Fix Codex hosted-search history imitation

[Pizzaface]

Problem and expected behavior

Codex sometimes emitted Hosted web search history ... as assistant text instead of making a hosted search. The uncommitted search-history replay draft supplied the model with synthetic assistant messages in exactly that format. An affected session contained both genuine hosted search events and fabricated assistant-text lookalikes. Search cards should remain visible without teaching the model to imitate them.

Changes

• Exclude hosted-search UI blocks before cross-model transcript normalization; exclude the legacy fake-history lines from subsequent model requests without rewriting saved sessions.
• Explicitly tell enabled Codex requests that hosted web_search is available directly, not via MCP discovery, and not to simulate a search in prose.
• Add same-model, model-switch, nullish-history, and request-hook regressions. Update web-search and patch documentation.

Verification

• REDISMS_DISABLE_POSTINSTALL=1 bun install --frozen-lockfile — passed; patch reapplies.
• bun scripts/test-isolated.ts packages/cli/src/patches.test.ts — 56 passed, 0 failed.
• bun scripts/test-isolated.ts packages/cli/src/extensions/openai-codex-web-search.test.ts — 5 passed, 0 failed.
• bun run lint, bun run typecheck, bun run build, bun run build:docs — passed.
• bun run test with an ephemeral redis-memory-server and PIZZAPI_REDIS_URL — exit 0; existing environment-specific skips remain.
• Read-only replay of the affected session through the patched converter: 24 genuine search blocks, 7 fake assistant-history lines, 0 fake lines or search metadata replayed into provider request input. No private transcript was committed.
• Fresh independent code review: LGTM, no P0–P2 findings.
• Live provider/model-choice behavior was not retested against credentials; the deterministic request-conversion path and an actual saved session were tested instead.

Risks and compatibility

No wire/schema or storage migration. Existing fake lines remain visible in historical transcripts, but are excluded from future model requests after a worker loads this patch. Native search events continue rendering as UI cards. This branch is not deployed; running workers keep their current code until updated/restarted. Cross-model requests no longer inherit search-card source URLs unless they are in ordinary assistant answer text.

UI evidence

N/A — no UI code changed; the existing search cards retain their metadata.

Contribution checklist

• Scope is focused; unrelated changes and sensitive data are excluded
• Changed behavior has regression and relevant failure/lifecycle tests
• Lint, typecheck, build, and full tests passed; environment-specific skips noted above
• Ownership, validation, sandbox/approval, and compatibility impacts reviewed (no trust-boundary change)
• Applicable web UI and CLI/TUI paths are complete (search cards unchanged; provider request/replay fixed)
• Docs and config examples are current; no prompt-template source changed
• Packaging verified by frozen reinstall; actual saved-session replay checked; no new platform-specific behavior