[search] allow explicitly disabling web search (#9249)

moving `web_search` rollout serverside, so need a way to explicitly
disable search + signal eligibility from the client.

- Add `x‑oai‑web‑search‑eligible` header that signifies whether the
request can have web search.
- Only attach the `web_search` tool when the resolved `WebSearchMode` is
`Live` or `Cached`.

codex-rs/core/tests/responses_headers.rs

@@ -9,15 +9,18 @@ use codex_core::ModelProviderInfo;
 use codex_core::Prompt;
 use codex_core::ResponseEvent;
 use codex_core::ResponseItem;
+use codex_core::WEB_SEARCH_ELIGIBLE_HEADER;
 use codex_core::WireApi;
 use codex_core::models_manager::manager::ModelsManager;
 use codex_otel::OtelManager;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::ReasoningSummary;
+use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
 use core_test_support::load_default_config_for_test;
 use core_test_support::responses;
+use core_test_support::test_codex::test_codex;
 use futures::StreamExt;
 use tempfile::TempDir;
 use wiremock::matchers::header;
@@ -213,6 +216,66 @@ async fn responses_stream_includes_subagent_header_on_other() {
     );
 }
 
+#[tokio::test]
+async fn responses_stream_includes_web_search_eligible_header_true_by_default() {
+    core_test_support::skip_if_no_network!();
+
+    let server = responses::start_mock_server().await;
+    let response_body = responses::sse(vec![
+        responses::ev_response_created("resp-1"),
+        responses::ev_completed("resp-1"),
+    ]);
+
+    let request_recorder = responses::mount_sse_once_match(
+        &server,
+        header(WEB_SEARCH_ELIGIBLE_HEADER, "true"),
+        response_body,
+    )
+    .await;
+
+    let test = test_codex().build(&server).await.expect("build test codex");
+    test.submit_turn("hello").await.expect("submit test prompt");
+
+    let request = request_recorder.single_request();
+    assert_eq!(
+        request.header(WEB_SEARCH_ELIGIBLE_HEADER).as_deref(),
+        Some("true")
+    );
+}
+
+#[tokio::test]
+async fn responses_stream_includes_web_search_eligible_header_false_when_disabled() {
+    core_test_support::skip_if_no_network!();
+
+    let server = responses::start_mock_server().await;
+    let response_body = responses::sse(vec![
+        responses::ev_response_created("resp-1"),
+        responses::ev_completed("resp-1"),
+    ]);
+
+    let request_recorder = responses::mount_sse_once_match(
+        &server,
+        header(WEB_SEARCH_ELIGIBLE_HEADER, "false"),
+        response_body,
+    )
+    .await;
+
+    let test = test_codex()
+        .with_config(|config| {
+            config.web_search_mode = Some(WebSearchMode::Disabled);
+        })
+        .build(&server)
+        .await
+        .expect("build test codex");
+    test.submit_turn("hello").await.expect("submit test prompt");
+
+    let request = request_recorder.single_request();
+    assert_eq!(
+        request.header(WEB_SEARCH_ELIGIBLE_HEADER).as_deref(),
+        Some("false")
+    );
+}
+
 #[tokio::test]
 async fn responses_respects_model_info_overrides_from_config() {
     core_test_support::skip_if_no_network!();

codex-rs/core/tests/suite/client.rs

@@ -14,6 +14,7 @@ use codex_core::ThreadManager;
 use codex_core::WireApi;
 use codex_core::auth::AuthCredentialsStoreMode;
 use codex_core::built_in_model_providers;
+use codex_core::default_client::originator;
 use codex_core::error::CodexErr;
 use codex_core::models_manager::manager::ModelsManager;
 use codex_core::protocol::EventMsg;
@@ -406,7 +407,7 @@ async fn includes_conversation_id_and_model_headers_in_request() {
     let request_originator = request.header("originator").expect("originator header");
 
     assert_eq!(request_session_id, session_id.to_string());
-    assert_eq!(request_originator, "codex_cli_rs");
+    assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Test API Key");
 }
 
@@ -522,7 +523,7 @@ async fn chatgpt_auth_sends_correct_request() {
     let session_id = request.header("session_id").expect("session_id header");
     assert_eq!(session_id, thread_id.to_string());
 
-    assert_eq!(request_originator, "codex_cli_rs");
+    assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Access Token");
     assert_eq!(request_chatgpt_account_id, "account_id");
     assert!(request_body["stream"].as_bool().unwrap());

codex-rs/core/tests/suite/model_tools.rs

@@ -36,7 +36,7 @@ async fn collect_tool_identifiers_for_model(model: &str) -> Vec<String> {
     let mut builder = test_codex()
         .with_model(model)
         // Keep tool expectations stable when the default web_search mode changes.
-        .with_config(|config| config.web_search_mode = WebSearchMode::Cached);
+        .with_config(|config| config.web_search_mode = Some(WebSearchMode::Cached));
     let test = builder
         .build(&server)
         .await

codex-rs/core/tests/suite/prompt_caching.rs

@@ -88,7 +88,7 @@ async fn prompt_tools_are_consistent_across_requests() -> anyhow::Result<()> {
             config.user_instructions = Some("be consistent and helpful".to_string());
             config.model = Some("gpt-5.1-codex-max".to_string());
             // Keep tool expectations stable when the default web_search mode changes.
-            config.web_search_mode = WebSearchMode::Cached;
+            config.web_search_mode = Some(WebSearchMode::Cached);
         })
         .build(&server)
         .await?;

codex-rs/core/tests/suite/web_search_cached.rs

@@ -35,7 +35,7 @@ async fn web_search_mode_cached_sets_external_web_access_false_in_request_body()
     let mut builder = test_codex()
         .with_model("gpt-5-codex")
         .with_config(|config| {
-            config.web_search_mode = WebSearchMode::Cached;
+            config.web_search_mode = Some(WebSearchMode::Cached);
         });
     let test = builder
         .build(&server)
@@ -67,7 +67,7 @@ async fn web_search_mode_takes_precedence_over_legacy_flags_in_request_body() {
         .with_model("gpt-5-codex")
         .with_config(|config| {
             config.features.enable(Feature::WebSearchRequest);
-            config.web_search_mode = WebSearchMode::Cached;
+            config.web_search_mode = Some(WebSearchMode::Cached);
         });
     let test = builder
         .build(&server)