Skip to content

[WRONG BRANCH] fix(responses): preserve forced hosted web_search choice - #255

Draft
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-web-search-vulnerability
Draft

[WRONG BRANCH] fix(responses): preserve forced hosted web_search choice#255
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-web-search-vulnerability

Conversation

@luvs01

@luvs01 luvs01 commented Aug 13, 2026

Copy link
Copy Markdown
Owner

Motivation

  • Hosted Responses tool choices for Claude were being translated to a { type: "web_search" } shape that the internal parser mapped to "auto", which widened the advertised tool set and allowed routed models to access unrelated client/local tools.
  • Preserve the caller's forced hosted-web-search intent by mapping hosted web_search declarations to the internal synthetic routed web-search tool so sidecar injection does not leak other declared tools.

Description

  • Update mapToolChoice in src/responses/parser.ts to map type: "web_search" and type: "web_search_preview" to the synthetic routed tool via WEB_SEARCH_TOOL_NAME instead of falling through to "auto".
  • Add a regression unit test in tests/responses-parser.test.ts that asserts a forced hosted web_search tool_choice is parsed to the synthetic routed web_search tool even when other client tools are declared.
  • Include an explanatory comment near the mapping to document why hosted web-search must be preserved as the synthetic tool choice.

Testing

  • Ran the focused parser tests with bun test tests/responses-parser.test.ts, and the updated Responses parser tests passed.
  • Ran static checks with bun run typecheck, which completed successfully.
  • Ran bun run privacy:scan, which completed successfully.
  • A full test run was exercised in this environment and showed large-scale green output for many suites, while one unrelated provider-management test exhibited an intermittent timeout in a constrained run; the fix is covered by the focused regression test added above.

Codex Task

Summary by CodeRabbit

  • Bug Fixes
    • Improved handling of hosted web search tool choices.
    • Ensured forced web search selections are correctly routed to the web search tool.

@github-actions

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Aug 13, 2026
@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The response parser now maps web_search and web_search_preview tool choices to the synthetic web_search tool name. A parser test verifies the forced web_search mapping.

Changes

Hosted web-search routing

Layer / File(s) Summary
Parser mapping and validation
src/responses/parser.ts, tests/responses-parser.test.ts
mapToolChoice maps web_search and web_search_preview to WEB_SEARCH_TOOL_NAME. The test verifies that { type: "web_search" } becomes { name: "web_search" }.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to bf984

This localized parser change preserves forced hosted web-search behavior without introducing a supported merge-blocking correctness, security, or availability risk. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: lidge-jun, ingwannu, wibias

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: preserving forced hosted web_search choices in the responses parser.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/propose-fix-for-web-search-vulnerability

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot changed the title fix(responses): preserve forced hosted web_search choice [WRONG BRANCH] fix(responses): preserve forced hosted web_search choice Aug 13, 2026
@github-actions

github-actions Bot commented Aug 13, 2026

Copy link
Copy Markdown

⏳ DRAFT

  • wrong target branch (main); retarget to dev.

What to do

  • Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

@github-actions
github-actions Bot marked this pull request as draft August 13, 2026 00:02

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/responses-parser.test.ts`:
- Around line 164-176: Add a focused test alongside the existing forced hosted
web_search test in the responses parser suite, using tool_choice type
"web_search_preview" and asserting parsed.options.toolChoice equals { name:
"web_search" }. Keep the same request setup and preserve the existing web_search
coverage.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d8bc499e-8d5d-4dab-a66d-1d6d033f1207

📥 Commits

Reviewing files that changed from the base of the PR and between bf61867 and bf9840c.

📒 Files selected for processing (2)
  • src/responses/parser.ts
  • tests/responses-parser.test.ts

Comment on lines +164 to +176
test("maps a forced hosted web_search choice to the synthetic routed tool", () => {
const parsed = parseRequest({
model: "umans/umans-kimi-k2.7",
input: "search",
tools: [
{ type: "web_search" },
{ type: "function", name: "run_shell", parameters: { type: "object" } },
],
tool_choice: { type: "web_search" },
});

expect(parsed.options.toolChoice).toEqual({ name: "web_search" });
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add coverage for web_search_preview.

The parser now handles both web_search and web_search_preview, but this test covers only web_search. Add a second case that expects { name: "web_search" } for tool_choice: { type: "web_search_preview" }.

As per path instructions, behavior changes in src/ should have focused regression coverage in tests/.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/responses-parser.test.ts` around lines 164 - 176, Add a focused test
alongside the existing forced hosted web_search test in the responses parser
suite, using tool_choice type "web_search_preview" and asserting
parsed.options.toolChoice equals { name: "web_search" }. Keep the same request
setup and preserve the existing web_search coverage.

Source: Path instructions

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf9840c5c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/responses/parser.ts
Comment on lines +117 to +118
if (t === "web_search" || t === "web_search_preview") {
return { name: WEB_SEARCH_TOOL_NAME };

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Activate the sidecar for forced web_search_preview choices

For a routed Responses request whose tool declaration and choice both use the supported web_search_preview type, this new branch sets toolChoice to { name: "web_search" }, but extractHostedWebSearch() recognizes only type === "web_search". Consequently _webSearch remains unset, planWebSearch() returns no plan, the synthetic tool is never injected, and adapter filtering removes every unrelated declared tool, so the model produces an ordinary answer without performing the forced search. Normalize or extract web_search_preview as a hosted search too, and add a routed-planning regression case for this branch.

AGENTS.md reference: src/AGENTS.md:L22-L25

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant