Route tests through the codex namespace: auth, zod schema rejection
(non-object commands, bad search_context_size), search/open/find command
execution and rendered output, per-key usage accounting, unsupported
command text, domain-filter blocking, empty commands, and disabled /
missing-credential provider states surfaced as in-band output.

Codex derives its remote web-search URL from different base URLs across
auth and provider modes. Mount the same authenticated, schema-validated
handler at /alpha/search and /v1/alpha/search in addition to the generated
config's /azure-api.codex/alpha/search path.

Parameterize routing, missing/invalid auth, and schema rejection across the
namespaced, root, and /v1 alpha-search paths so aliases cannot drift from
the primary handler.

Route /alpha/search to the gateway in Vite development, Cloudflare Static
Assets, and the Docker nginx topology. /v1/alpha/search is already covered
by each topology's existing /v1 prefix rule.

Codex gates the remote web-search extension on either an OpenAI provider
identity or a non-empty x-openai-actor-authorization provider header. Keep
the provider key/name as floway/Floway so the wider is_openai behavior stays
disabled, and add a non-secret marker header that enables only the actor-auth
compatibility gates. The gateway scrubs the marker before upstream dispatch.

Cover the generated TOML so the provider identity, namespaced base URL, and
compatibility marker cannot drift.

Keep the inbound-header scrub list alphabetic, describe alpha-search output
in the parser's canonical operation order rather than JSON key order, and
make the shared truncated-page hint neutral across Responses and Codex
callers.

…aa14b68090a

# Conflicts:
#	packages/gateway/src/data-plane/chat/responses/interceptors/server-tools/web-search.ts
#	packages/gateway/src/data-plane/codex/routes.ts

Add callAlphaSearch to the provider contract. Codex dispatches to the ChatGPT subscription endpoint with its OAuth account, custom dispatches to /v1/alpha/search with static auth, and other provider kinds reject the unsupported call.

Persist a default-off OpenAI search passthrough selection with upstream and model. Add the Settings toggle and scoped Codex/Custom upstream and chat-model pickers while preserving the existing general search provider as the default.

Resolve the configured upstream and model without fallback. Raw Codex alpha-search requests relay the selected provider response, while the existing Responses web-search shim adapts commands and structured results through the same provider call.

Thread the default-off passthrough shape through existing search fixtures and finish the merged web-search filter and Azure unsupported-provider paths.

Verify custom and Codex provider wires, raw alpha-route relay, Responses shim adaptation, persisted configuration, and the Codex/Custom-only settings picker.

Type the settings component against its minimal upstream picker shape, handle the nullable model store at the page boundary, and apply workspace lint rules to the alpha dispatcher path.

Keep search configuration export and import fixtures aligned with the OpenAI search passthrough settings.

Publish the required OpenAI search passthrough settings under transfer format v10 so incompatible payload shapes never share a version number.

Keep Codex request identity and optional metadata coherent, document the ChatGPT search path, and route Custom alpha search through the existing endpoint override policy.

Use a callable alpha dispatcher, remove test-only compatibility exports, preserve cancellation through local search execution, and align comments and references with both local and passthrough modes.

Rebuild passthrough responses with mutable headers before returning through Hono so Custom-to-Floway alpha-search chains preserve the upstream stream, status, and headers on Node.

State that the selected upstream must support alpha search and that Anthropic Messages remains on the general search provider.

Live alpha-search results are opaque UI metadata and omit the hosted web_search snippet field. The existing compatibility filter therefore dropped every real result before silently falling back to the rendered output.\n\nKeep the upstream output as the lossless model-facing payload and emit one clearly synthetic Responses result when that surface needs result-shaped data. Raw alpha routes continue relaying the upstream response untouched.

Move the alpha route, dispatcher, Responses adapter, response relay, and their tests into one web-search/alpha-search slice. The Codex route module now only mounts the shared handler, and the fetched-response helper no longer implies gateway-wide reuse.

Give the alpha-search data-plane surface ownership of its paths, validation, and handler while keeping provider execution, upstream dispatch, response adaptation, and relay behavior under tools/web-search/alpha-search. Codex routes now contain only the compatibility namespace they actually mount.

Let the general alpha-search data plane own only the root and /v1 aliases. Codex alone declares its special provider-relative path and reuses a path-agnostic route registrar. Hosted search remains coupled only to the tools/web-search implementation layer.

…aa14b68090a