Decode hosted web search sources for clients

[alexi-openai]

Summary

• deserialize bounded hosted web search source URLs as transient response metadata
• convert them into client-facing WebSearchItem.results for app rendering and persistence
• remove the sources from the client-facing action after conversion

Stacked on #31515. Standalone /alpha/search parsing is split into #31516.

Model-context boundary

The hosted sources field is deserialize-only: Serde skips it during serialization, and it is excluded from Rust/TypeScript schemas. A two-turn regression test verifies that the app receives the URL while the next Responses request contains no action.sources field.

This PR intentionally does not change Responses request construction. Requesting the hosted source sidecar can be reviewed as a separate one-line follow-up.

Validation

• just test -p codex-protocol
• just test -p codex-app-server-protocol
• env -u CODEX_SANDBOX_NETWORK_DISABLED just test -p codex-core web_search_item_is_emitted
• just test -p codex-core parses_web_search_call
• just test -p codex-web-search-extension
• just test -p codex-app-server-protocol -p codex-exec -p codex-web-search-extension web_search
• just fix (scoped to affected packages)
• just fmt

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99afc38d5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Cap web search sources before putting them in context

When hosted web search is available and the Responses API returns a large action.sources array, this new include asks for the full list and it is then retained as part of the ResponseItem history that is sent on later requests; unlike the standalone web-search extraction, there is no hard cap or truncation on these URLs before they enter model context. A search with many or very long source URLs can therefore add a >1k-token item and cause unbounded context/cache growth, so the sources should be bounded before being persisted or replayed.

AGENTS.md reference: AGENTS.md:L91-L100

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include sources for Azure Responses providers

When the configured provider is Azure Responses, provider.info().is_openai() is false even though the request later uses the Azure Responses path (store: provider.is_azure_responses_endpoint()), so web-search turns on Azure never send include: ["web_search_call.action.sources"] and the new app-server sources field remains null. Azure's Responses web-search docs also require this include to return action.sources, so Azure users with web search enabled will not get the source URLs this change is meant to expose (Microsoft Learn).

Useful? React with 👍 / 👎.