[Bug]: Forced web_search termination drops synthetic tool declaration, causing GLM/开源模型 to emit raw <tool_call>web_search</tool_call> as content #6464

Environment

• OpenCodex version: 2.73.0 (macOS, global proxy on port 10100)
• Upstream provider: adapter: openai-chat with spark-vllm (GLM-5.3-Flash on TensorFold/vLLM)
• Client: Codex Desktop (Responses API)

Describe the Bug

In src/web-search/run-turn-loop.ts, when searchesExecuted >= plan.maxSearches (default 1), OpenCodex removes web_search from context.tools on the subsequent iteration:

const nextForceAnswer = searchesExecuted >= plan.maxSearches;
const iterParsed: OcxParsedRequest = {
  ...parsed,
  context: {
    ...parsed.context,
    messages: nextForceAnswer && executedSearchCount > 0
      ? [...messages, forcedAnswerNudge()]
      : messages,
    tools: nextForceAnswer ? toolsNoWebSearch : allTools,
  },
};

When calling reasoning-heavy open-source models (such as GLM-5.3-Flash), the model may decide in its reasoning that the first search result requires follow-up verification and attempts a second search. Because web_search was abruptly stripped from tools, the upstream inference server (TensorFold / vLLM) no longer recognizes web_search as a declared tool.

Depending on the backend:

1. The backend refuses to parse the undeclared tool into tool_calls and leaks the raw markup into message.content:
   <tool_call>web_search<arg_key>queries</arg_key><arg_value>[...]</arg_value></tool_call>
2. OpenCodex does not intercept this raw XML block in the openai-chat adapter.
3. Codex Desktop receives the text, sees the model finish, and ends the turn with phase: final_answer, leaving the session broken and unfinished.

Suggested Fix

1. In run-turn-loop.ts, allow configuring maxSearches (e.g., 2-3 searches per turn), or keep the tool declared with a graceful fallback instead of immediately stripping it.
2. In the openai-chat adapter (serialized-tool-call-content.ts), add GLM-style tag parsing (<tool_call>name<arg_key>...</tool_call>) alongside the existing <function=name> parser, so that undeclared or leaked tool calls can be intercepted before reaching Codex.