feat(runtime): add Qwen3.8-Max native WebSearch

[MoonOld]

Summary

Adds the first Alibaba Harness-tool slice from #3163: provider-native WebSearch for qwen3.8-max on the Alibaba Token Plan China and international access paths.

• keeps capability routing fail-closed and exact-model scoped; Qwen 3.7 remains disabled because Maka still routes it through Chat;
• lowers the canonical Maka WebSearch descriptor to the documented Responses tools: [{ type: "web_search" }] request shape;
• decodes streamed web_search_call items into provider-executed call/result events, preserving search, open_page, and find_in_page actions, generated queries, source URLs, and usage.x_tools;
• reuses the existing Runtime projection for durable events, UI/export, privacy-mode removal, and tool ceilings;
• keeps the current replay boundary explicit: the durable search episode and grounded answer survive, while the provider-owned call/result pair is omitted from the next request rather than creating a dangling function output.

Refs #3163

This PR intentionally does not close#3163. web_extractor, code interpreter, image-search tools, and broader Qwen 3.7 Responses routing remain follow-up slices.

Upstream dependency and patch retirement

The generic @ai-sdk/open-responses@2.0.34 adapter drops provider-defined tools and does not decode bare web_search_call items. This Draft carries a narrow dependency patch for current verification only.

The missing public seam is tracked upstream:

• @ai-sdk/open-responses: allow explicit codecs for documented bare extension types vercel/ai#19933
• implementation: feat: allow Open Responses extension codecs to explicitly opt in to bare tool, item, and event discriminators vercel/ai#19939

AI SDK 2.0.35 introduced explicit extension codecs, but they accept only normative namespaced wire types. #19939 adds an explicit fail-closed bare extension codec for documented implementation types such as web_search and web_search_call; its CI is green and it is awaiting upstream review.

Retirement rule: once that API is merged and released, replace this patch with a package-local Experimental_OpenResponsesBareExtension, prove request/stream/replay behavior against the unpatched package, and delete patches/@ai-sdk+open-responses+*.patch plus its LICENSE/patch README entries.

Verification

Exact head 3ae89609a, rebased directly onto main at bd951aa88:

• fresh npm ci applies @ai-sdk/open-responses@2.0.34 cleanly and reports 0 vulnerabilities;
• full workspace build:test and workspace typecheck passed;
• npm run format:check, npm run lint, npm run check:asf-headers, and git diff --check passed;
• focused capability, request, stream, action, reasoning, durable Tool Result, and backend set: 269 passed, 0 failed;
• Runtime full suite: 3,097 passed, 13 skipped, 0 failed;
• release contracts: 141 passed, 0 failed;
• the official Alibaba reasoning-summary fixture still crosses the patched 2.0.34 package, confirming the WebSearch patch does not regress feat(providers): add Alibaba Token Plan Responses compatibility #3255's upstream reasoning mapping.

Live Token Plan evidence

A protected live smoke on the exact rebased tree used production AiSdkBackend + ModelAdapter + getAIModel, the configured Token Plan China connection, and qwen3.8-max. The credential was read only in process and was never printed, placed in command arguments, persisted, or attached.

• request 1: HTTP 200, store:false, exactly one web_search tool descriptor, one provider-executed call/result pair, and a grounded final answer ending in the requested sentinel;
• a companion probe on the immediately preceding main base observed two completed search actions carrying 39 source rows;
• request 2: HTTP 200, store:false, completed from durable prior context with the requested replay sentinel;
• no web_search_call item was replayed in request 2, preserving the explicit fail-closed adapter boundary;
• both model turns completed with end_turn; no local Tavily or ToolRuntime WebSearch implementation ran.

Provider documentation:

• https://www.alibabacloud.com/help/en/model-studio/web-search
• https://www.alibabacloud.com/help/en/model-studio/retrieve-a-response
• https://www.alibabacloud.com/help/en/model-studio/token-plan-harness-tool

Review focus

• The product routing change is limited to both Alibaba Token Plan provider types and exact model ID qwen3.8-max.
• Unknown provider tools and item types remain unsupported.
• The patch is temporary, version-pinned, source-release-accounted, and bound to upstream #19933/#19939.
• Durable reasoning, ordinary function tools, DeepSeek's existing disabled native-search route, and main's durable Tool Result projection remain covered and unchanged.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

OpenAI Codex assisted with protocol research, implementation, tests, upstream coordination, live verification, and PR drafting. The human contributor reviewed the scope and remains responsible for the contribution. The commits carry Generated-by: OpenAI Codex trailers.

Checklist

• Tests cover the current compatibility behavior
• Lint, format, typecheck, build, release, and affected suites pass locally
• Exact-tree live WebSearch and next-turn replay evidence is recorded
• Replace the dependency patch with the released upstream bare-extension codec before marking ready for review

Does this PR entail a change in behavior?

• Yes — described under Summary
• No

[MoonOld]

Live Token Plan WebSearch smoke passed on exact feature head 46e452d32 (2026-08-24).

Execution path: the PR branch production getAIModel + ModelAdapter, configured Alibaba Token Plan China connection, exact model qwen3.8-max, and the canonical provider WebSearch descriptor. The credential was read only in process from the local credential vault and was never printed.

Observed result:

• outcome: completed; finish reason: stop;
• two WebSearch calls, both marked providerExecuted: true;
• provider results included the official Qwen3.8-Max model page and Alibaba Model Studio Web Search documentation;
• final grounded answer correctly reported that Qwen3.8-Max supports Web Search and named the official source URLs;
• usage: 9,386 input / 866 output / 532 reasoning / 10,252 total tokens;
• no local ToolRuntime WebSearch execution occurred.

Representative returned sources:

• https://help.aliyun.com/en/model-studio/qwen3-8-max
• https://help.aliyun.com/zh/model-studio/web-search
• https://www.alibabacloud.com/help/en/model-studio/web-search

The temporary smoke runner was removed after the run and retained no credential material.

[MoonOld]

Additional live boundary probe on exact head 46e452d32: the local DEEPSEEK_API_KEY was read in process from /Users/moonold/.env without printing or persisting it, and a forced provider descriptor was sent through the production getAIModel + ModelAdapter path to first-party https://api.deepseek.com/responses with deepseek-v4-flash.

Observed:

• outbound tools: [{ "type": "web_search" }];
• outcome: completed, finish reason stop;
• six provider-executed WebSearch calls;
• raw provider action types: search, open_page, and find_in_page;
• the model completed a grounded final answer;
• usage: 14,514 input / 1,497 output / 810 reasoning / 16,011 total tokens.

This proves the dependency patch fixes the common Open Responses request/stream transport for DeepSeek as well, but it does not make DeepSeek production-ready yet:

1. resolveHostedWebSearchCapability(deepseek, ...) still returns implemented:false, so normal Maka routing never advertises the tool.
2. The current narrow mapper is correct for Alibaba search + sources, but it rewrites DeepSeek open_page and find_in_page actions as empty search actions, losing their URL/pattern in the normalized tool result.

Therefore DeepSeek should stay disabled until the action union and tests cover all three shapes and a normal routed smoke passes. The temporary probe runner was removed and retained no credential material.

[MoonOld]

Shared mapper follow-up pushed in 3a74825a9: Open Responses WebSearch now preserves search, open_page → openPage, and find_in_page → findInPage instead of collapsing every provider action to search. A deterministic raw-SSE contract test pins all three shapes.

DeepSeek capability enablement remains out of this Alibaba PR and is isolated in #3694 / #3689.

[MoonOld]

#3685 has been rebuilt after #3255 merged and is now on exact head 3ae89609a, directly based on current mainbd951aa88.

Key changes:

• removed the stacked feat(providers): add Alibaba Token Plan Responses compatibility #3255 commits from this branch;
• regenerated the temporary dependency patch against the currently pinned @ai-sdk/open-responses@2.0.34, preserving the released reasoning-summary mapping;
• tied the patch to upstream @ai-sdk/open-responses: allow explicit codecs for documented bare extension types vercel/ai#19933 and implementation PR feat: allow Open Responses extension codecs to explicitly opt in to bare tool, item, and event discriminators vercel/ai#19939, with an explicit delete-on-release rule;
• added the patch to the root source-license inventory;
• retained only the Qwen WebSearch capability/routing and request/stream action tests.

Exact-head verification is green: fresh npm ci, build, workspace typecheck, format/lint/ASF headers, 269 focused cross-surface tests, Runtime 3,097 passed / 13 skipped / 0 failed, and release 141/141.

The Token Plan China live smoke also passed on the rebased tree: qwen3.8-max received exactly one native web_search descriptor, emitted a provider-executed WebSearch pair, completed a grounded answer, and completed a second durable-context turn without replaying a dangling web_search_call item.

This remains Draft while #19939 is awaiting upstream review. Once its bare-extension codec is published, the dependency patch and legal/README entries should be deleted before this PR is marked ready.