feat(runtime): add Qwen3.8-Max native WebSearch - #3685

Summary

Adds the first Alibaba Harness-tool slice from #3163: provider-native WebSearch for qwen3.8-max on the Alibaba Token Plan China and international access paths.

• keeps capability routing fail-closed and exact-model scoped; Qwen 3.7 remains disabled because Maka still routes it through Chat;
• lowers the canonical Maka WebSearch descriptor to the documented Responses tools: [{ type: "web_search" }] request shape;
• decodes streamed web_search_call items into provider-executed call/result events, preserving search, open_page, and find_in_page actions, generated queries, source URLs, and usage.x_tools;
• reuses the existing Runtime projection for durable events, UI/export, privacy-mode removal, and tool ceilings;
• keeps the current replay boundary explicit: the durable search episode and grounded answer survive, while the provider-owned call/result pair is omitted from the next request rather than creating a dangling function output.

Refs #3163

This PR intentionally does not close #3163. web_extractor, code interpreter, image-search tools, and broader Qwen 3.7 Responses routing remain follow-up slices.

Upstream dependency and patch retirement

The generic @ai-sdk/open-responses@2.0.34 adapter drops provider-defined tools and does not decode bare web_search_call items. This Draft carries a narrow dependency patch for current verification only.

The missing public seam is tracked upstream:

• @ai-sdk/open-responses: allow explicit codecs for documented bare extension types vercel/ai#19933
• implementation: feat: allow Open Responses extension codecs to explicitly opt in to bare tool, item, and event discriminators vercel/ai#19939

AI SDK 2.0.35 introduced explicit extension codecs, but they accept only normative namespaced wire types. #19939 adds an explicit fail-closed bare extension codec for documented implementation types such as web_search and web_search_call; its CI is green and it is awaiting upstream review.

Retirement rule: once that API is merged and released, replace this patch with a package-local Experimental_OpenResponsesBareExtension, prove request/stream/replay behavior against the unpatched package, and delete patches/@ai-sdk+open-responses+*.patch plus its LICENSE/patch README entries.

Verification

Exact head 3ae89609a, rebased directly onto main at bd951aa88:

• fresh npm ci applies @ai-sdk/open-responses@2.0.34 cleanly and reports 0 vulnerabilities;
• full workspace build:test and workspace typecheck passed;
• npm run format:check, npm run lint, npm run check:asf-headers, and git diff --check passed;
• focused capability, request, stream, action, reasoning, durable Tool Result, and backend set: 269 passed, 0 failed;
• Runtime full suite: 3,097 passed, 13 skipped, 0 failed;
• release contracts: 141 passed, 0 failed;
• the official Alibaba reasoning-summary fixture still crosses the patched 2.0.34 package, confirming the WebSearch patch does not regress feat(providers): add Alibaba Token Plan Responses compatibility #3255's upstream reasoning mapping.

Live Token Plan evidence

A protected live smoke on the exact rebased tree used production AiSdkBackend + ModelAdapter + getAIModel, the configured Token Plan China connection, and qwen3.8-max. The credential was read only in process and was never printed, placed in command arguments, persisted, or attached.

• request 1: HTTP 200, store:false, exactly one web_search tool descriptor, one provider-executed call/result pair, and a grounded final answer ending in the requested sentinel;
• a companion probe on the immediately preceding main base observed two completed search actions carrying 39 source rows;
• request 2: HTTP 200, store:false, completed from durable prior context with the requested replay sentinel;
• no web_search_call item was replayed in request 2, preserving the explicit fail-closed adapter boundary;
• both model turns completed with end_turn; no local Tavily or ToolRuntime WebSearch implementation ran.

Provider documentation:

• https://www.alibabacloud.com/help/en/model-studio/web-search
• https://www.alibabacloud.com/help/en/model-studio/retrieve-a-response
• https://www.alibabacloud.com/help/en/model-studio/token-plan-harness-tool

Review focus

• The product routing change is limited to both Alibaba Token Plan provider types and exact model ID qwen3.8-max.
• Unknown provider tools and item types remain unsupported.
• The patch is temporary, version-pinned, source-release-accounted, and bound to upstream #19933/#19939.
• Durable reasoning, ordinary function tools, DeepSeek's existing disabled native-search route, and main's durable Tool Result projection remain covered and unchanged.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

OpenAI Codex assisted with protocol research, implementation, tests, upstream coordination, live verification, and PR drafting. The human contributor reviewed the scope and remains responsible for the contribution. The commits carry Generated-by: OpenAI Codex trailers.

Checklist

• Tests cover the current compatibility behavior
• Lint, format, typecheck, build, release, and affected suites pass locally
• Exact-tree live WebSearch and next-turn replay evidence is recorded
• Replace the dependency patch with the released upstream bare-extension codec before marking ready for review

Does this PR entail a change in behavior?

• Yes — described under Summary
• No