feat(codex): add per-provider option to disable hosted web search

[ChanthMiao]

动机

Codex 供应商走原生 /responses（NativeResponses）格式直连网关时，部分网关不支持 hosted web-search 工具；此前 cc-switch 只能通过 model catalog 的 supports_search_tool: false 隐式抑制工具声明，无法在 config.toml 顶层显式禁用。本 PR 为这类供应商提供「禁用内置联网搜索」开关，控制 web_search 字段的生成。

行为变化

• 表单新增开关（Codex 快捷配置菜单），仅对原生 Responses（openai_responses）格式的供应商显示；官方 OAuth 供应商同样可见
• 开关开启时，生成 live config.toml 写入 web_search = "disabled"
• 关闭/未设置：不写入；仅清理 cc-switch 之前写入的恰好为 "disabled" 的值，用户手写的 "live" 等偏好保留
• Anthropic 格式维持现状（恒禁用，Messages 桥无法携带该工具）；Chat 格式不受影响（本地代理负责转换）
• 选项持久化于 settingsConfig.disableWebSearch（布尔），随 provider 经 SQLite / 导入导出 / WebDAV 同步往返，无需数据库迁移

实现要点

• 写时生成：prepare_codex_config_text_with_model_catalog_payload 根据 profile + 选项推导 disable 条件，覆盖切换、同步、takeover、failover、恢复全部 live 写入入口
• 代理快照合并：build_effective_live_snapshot 对 Codex 只投影 {auth, config}，新增 merge_codex_provider_catalog_options 在 proxy 侧三处写路径补齐选项
• 表单遵循既有 touched 模式，未触碰开关的保存不产生任何键写入

测试

• 新增 8 个单测（codex_config 生成 4 个 + 表单 4 个），更新 3 处既有断言
• cargo test --lib web_search（9 个）、--lib provider_add_form_codex（43 个）全绿
• cargo fmt --check 通过；改动文件无新增 clippy 警告
• 两路独立盲审无 findings
• 注：全量 lib 测试的 16 个失败（theme 15 + proxy catalog 1）与两个 settings 集成目标编译失败均为 HEAD 预先存在的问题（stash 对比验证），与本 PR 无关

[SaladDay]

Thanks for the PR! The TUI direction looks consistent, but there are a few blockers:

• The backend currently relies only on settingsConfig.disableWebSearch. Please align it with upstream’s host/model-based detection, keeping the toggle as an optional force-disable override if needed.
• disableWebSearch is dropped when Codex snapshots are rebuilt during provider backfill or temporary-launch capture, so it does not survive a normal switch cycle.
• Proxy takeover restore can rebuild the config with the ProxyChat profile and remove web_search = "disabled" from native providers.

Please add lifecycle coverage for switch-away/back, temporary capture, and takeover restore.

[ChanthMiao]

Ok, I will fix them later. But, my laptop failed to boot for unknown problem. I need some time to fix it first.

[ChanthMiao]

All review points are addressed in commit 4436c8d4 (pushed to the PR branch):

1. Align with upstream host/model-based detection — ported the blacklist from d380b410 verbatim: web_search = "disabled" is now written automatically for native /responses gateways matched by base_url host (xiaomimimo.com, longcat.chat, minimax.io, minimaxi.com) or by model brand prefix (mimo, longcat, minimax, after stripping aggregator vendor/ segments). The host check also falls back to the top-level base_url for legacy flat configs, mirroring upstream's extraction. The disableWebSearch toggle remains as an optional force-disable override (additive only; the blacklist is default-on regardless of the toggle).

2. Option survives snapshot rebuilds — merge_codex_provider_catalog_options now carries disableWebSearch across backfill_codex_current (both branches) and capture_codex_temp_launch_snapshot, so the option no longer drops on a normal switch cycle.

3. Takeover restore no longer strips web_search = "disabled" — the provider-less verbatim restore path (write_codex_live_verbatim) now preserves the captured text's web_search state (manage_web_search=false), and takeover writes evaluate the blacklist against the provider's stored pre-rewrite config, since rewrite_live_for_proxy replaces the live base_url with the local proxy address (host check would otherwise miss and clean the sentinel).

4. Lifecycle test coverage added — switch-away/back cycles the field, temporary-launch capture and backfill preserve the option, takeover/verbatim restore keeps disabled, and a verdict-override test covers the rewritten-base_url takeover path.

Test status: cargo test --lib codex_config::tests (55 passed), services::provider::tests (111 passed), proxy_takeover integration (12 passed), targeted form tests green, cargo fmt --check clean, no new clippy warnings. (The 16 pre-existing flaky failures in the full parallel lib run — theme palette tests plus one proxy catalog test, all pass serially — are unrelated to this PR and reproduce on main without these changes.)

[ChanthMiao]

@SaladDay Any other problems to fix ?

[SaladDay]

Thanks for the update! I re-reviewed commit 4436c8d4 and the full discussion timeline. Most of the original feedback is addressed, but two blockers remain:

1. disableWebSearch is still dropped during a real provider switch. After writing the target provider, refresh_provider_snapshot() rebuilds the settings from { auth, config }, while restore_codex_settings_for_backfill() only restores modelCatalog. As a result, the option disappears from the newly active provider. The current switch-away/back test only exercises config-preparation helpers, so it does not catch this. Please preserve the option in the refresh path and add a real ProviderService::switch lifecycle test.

2. The blacklist is missing the current upstream Qwen3-Coder correction. The PR copies d380b410, but upstream added qwen3-coder in the same-day follow-up 26f0d221, because DashScope rejects hosted web search for Qwen3-Coder models. The current test explicitly treats qwen3-coder-plus as supported; that expectation should be reversed while keeping general Qwen models enabled.

Also, the takeover restore coverage is still helper-level only. Please add a real takeover/restore assertion under proxy_takeover.rs for web_search = "disabled", as requested in the earlier review.

I also checked the #415 cross-reference: it covers the separate Claude-to-Responses WebSearch bridge and does not add scope to this PR.

The PR merges cleanly with current main, and the targeted formatting/config/provider/TUI/takeover tests pass. Once the items above are fixed, it should be ready for another review. Thanks! 🙂

[ChanthMiao]

All three round-2 blockers are fixed in commit e95a391d (pushed):

1. disableWebSearch survives a real provider switch — restore_codex_settings_for_backfill now restores the option alongside modelCatalog, so refresh_provider_snapshot() keeps it on the newly active provider. Added a real ProviderService::switch lifecycle test (switch_codex_cycle_preserves_disable_web_search_option_on_active_provider): seed → switch away → switch back, asserting both the DB snapshot retains the option and the live config.toml carries web_search = "disabled". The provider uses a non-blacklisted host, so the disable provably comes from the preserved option, not the blacklist.

2. Qwen3-Coder blacklist aligned with upstream 26f0d221 — qwen3-coder added to the reject model prefixes (model axis only). The test now asserts qwen3-coder-plus is disabled on the DashScope host, on an aggregator host, and behind a qwen/ vendor prefix, while general Qwen models (qwen-max, qwen3-max) stay enabled.

3. Real takeover assertion under proxy_takeover.rs — new codex_takeover_keeps_web_search_disabled_for_blacklisted_gateway: activates an actual managed proxy session (set_managed_session_for_app) for a host-blacklisted native gateway whose live config already carries the sentinel, and asserts web_search = "disabled" survives after rewrite_live_for_proxy replaces the base_url with 127.0.0.1:<port> (host-only match, model brand deliberately not a reject prefix, so only the stored-config verdict can keep it).

Verification: codex_config::tests (57 passed), services::provider::tests (113 passed), proxy_takeover integration (13 passed, serial), targeted form tests green, cargo fmt --check clean, clippy never-used count unchanged at 30 (no new warnings). The pre-existing parallel-run flakiness (theme palette tests + a proxy catalog test, all green serially) reproduces on main without this PR.

[ChanthMiao]

Rebased onto latest upstream main to resolve conflicts (branch now at fa56a7a).

Upstream advanced past the PR's original base (v5.10.3 release, Pi support, provider presets, skills rework), so the PR was rebased onto the current main
(0f26ed6) and all conflicts resolved:

• The web-search blacklist implementation now coexists with upstream's own presets-migration copy: upstream's duplicate (2-host/2-model) constants were dropped
  in favor of this PR's complete list (xiaomimimo.com, longcat.chat, minimax.io, minimaxi.com; model prefixes mimo, longcat, minimax, qwen3-coder) with the
  top-level base_url fallback.
• Both test suites are kept: upstream's preset-gateway test plus this PR's blacklist/lifecycle tests.
• All feature behavior is unchanged: disableWebSearch toggle, blacklist default-on detection, verbatim takeover restore preserving web_search = "disabled",
  snapshot-rebuild preservation, and the lifecycle/switch/takeover test coverage.

Verification after rebase: codex_config 57 passed, services::provider 120, proxy_takeover/proxy_service 13/30, form tests 44, fmt clean, clippy warnings
unchanged vs upstream baseline. The only failing lib tests are the pre-existing parallel-run flaky ones (theme palette tests, green serially) plus one upstream
time-of-day-sensitive usage test that also fails on main itself.