feat(runtime): map Alibaba Token Plan native Harness tools into Maka

[MoonOld]

Problem

Alibaba Token Plan exposes provider-native Harness tools for current Qwen models, including web_search, web_extractor, code_interpreter, text-to-image search, and image-to-image search. qwen3.8-max completed a live native code_interpreter call during #3156 verification.

Maka does not currently expose that provider contract:

• model-web-search.ts marks Alibaba hosted search as unimplemented and does not cover the Token Plan provider types;
• ModelAdapter only lowers the provider-executed tool shapes it already understands;
• RuntimeEvent replay, usage, citations, and UI projections do not decode Alibaba Harness output items;
• enabling a capability flag without those mappings could drop results or leave dangling provider tool history.

Follow-up to #3156, #3157, and the Alibaba Responses wire work in #3162.

Desired outcome

Maka can offer the native Alibaba Harness tools supported by the selected Token Plan model, execute them through the provider, and preserve their complete semantic result through streaming, persistence, replay, and user-facing projections.

Maka-owned tools such as Bash and configured Tavily search remain distinct choices; selecting model-native search must never silently substitute a different executor.

Proposed delivery

First slice

1. Add capability resolution for alibaba-token-plan-cn and alibaba-token-plan on the verified Responses wire.
2. Map web_search and web_extractor request and streamed output items.
3. Preserve source URLs, titles, bounded snippets, and provider call identity without persisting credentials or unbounded raw payloads.
4. Project the result as a provider-executed tool episode that survives RuntimeEvent replay.

Follow-up slices

• code_interpreter: code/execution/output items, generated files, bounded logs, and usage.
• text-to-image and image-to-image search: image inputs, result provenance, and Artifact handling.

Acceptance criteria

• The UI/runtime advertises only tools the exact selected model and wire support.
• Provider-executed search completes without creating a fake Maka-owned tool operation.
• Search/extractor citations survive streaming, persistence, restart, and transcript replay.
• Code interpreter output and generated files are bounded and attributable when that slice lands.
• Stop/cancel cannot leave an unmatched provider call or result.
• Harness invocation counts in provider usage are retained without double-counting Maka tools.
• Incognito, redaction, and egress/audit policies remain explicit at the provider boundary.

References

• https://help.aliyun.com/zh/model-studio/token-plan-harness-tool
• https://help.aliyun.com/zh/model-studio/qwen-api-via-openai-responses

Disclosure: this issue was drafted with OpenAI Codex assistance and reviewed and approved by the human contributor.

[MoonOld]

I will take the first slice for provider-native web_search, building on the Qwen3.8-Max Responses foundation in #3255. I will keep capability routing fail-closed, preserve provider-executed call/result replay and citations, retain privacy/tool-ceiling behavior, and link the implementation PR here.

[MoonOld]

Draft implementation for the provider-native web_search first slice is now in #3685. It is stacked on #3255, keeps routing exact to Token Plan qwen3.8-max, and includes deterministic request/stream contract coverage. I will rebase the PR after the Responses foundation merges.

[MoonOld]

The real Token Plan China WebSearch smoke for #3685 passed on qwen3.8-max: two provider-executed search calls, official source URLs, a grounded final answer, and a normal stop outcome. Detailed sanitized evidence is attached to #3685. The PR remains Draft only because it is stacked on the Responses foundation in #3255.