[WRONG BRANCH] fix(web-search): bind continuations to initial API key

[luvs01]

Motivation

• Prevent a bridged web-search continuation from being rebuilt and sent under a different API-key/account when the global key selection changes mid-turn, which can expose the original request context to another account.

Description

• Add selectionBoundContinuationDispatch in src/server/responses/core.ts to enforce that a continuation uses the same provider selection that served the first leg and to fail closed if the selection changed.
• Replace the web-search bridge continuation dispatchOverride use from oauthDispatch(request) to selectionBoundContinuationDispatch(request) so continuation sends cannot rebuild under a new key.
• Add an end-to-end regression test in tests/web-search/web-search-passthrough-bridge.test.ts that mutates the configured API key during the hosted search and verifies the bridged continuation fails closed and does not reach the replacement account.
• Files changed: src/server/responses/core.ts and tests/web-search/web-search-passthrough-bridge.test.ts.

Testing

• Ran the focused regression: node_modules/bun/bin/bun.exe test tests/web-search/web-search-passthrough-bridge.test.ts, which passed (22 passed / 0 failed).
• Ran typecheck: PATH="$PWD/node_modules/bun/bin:$PATH" bun run typecheck, which succeeded.
• Ran privacy scan: PATH="$PWD/node_modules/bun/bin:$PATH" bun run privacy:scan, which succeeded.
• Ran the full test suite (PATH="$PWD/node_modules/bun/bin:$PATH" bun run test) and observed unrelated environment-dependent failures (150 failures across other tests); the focused regression remains green and was validated by the focused test run.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1ba1d5f4-8b1e-4944-ae51-3b03882c834a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T12:12:02.285431Z	8321daf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[luvs01]

Closing this original proposal after reimplementing its useful scope with current code and executable regression coverage. Follow-up now belongs to the submitted implementation and its review/CI; this closure does not claim the change has merged.