When an Anthropic Messages request declares a gateway-owned tool (web_search),
run the server-side gateway tool loop natively against vLLM /v1/messages —
execute the tool, hide it from the client, and surface only the final
assistant message. Requests without a gateway-owned tool keep the transparent
proxy (vllm-project#99).

The loop talks Anthropic Messages end to end (no RequestPayload/ResponsePayload
detour), so the client's request is forwarded to vLLM untouched and every
Anthropic field is preserved. It reuses only the protocol-neutral tool layer
(ToolRegistry::dispatch, name-based classification, per-call timeout,
concurrent execution) via a small tool seam.

- types/messages: Anthropic wire types + tool seam (tool_use<->FunctionToolCall,
  ToolOutput->tool_result, gateway/client classification).
- executor::messages_loop: non-streaming loop (hide-the-call, feed tool_result
  back, round cap; client-owned tool_use returns to the client).
- executor::messages_stream: streaming loop + MessagesStreamAccumulator that
  presents one logical message across rounds (single lifecycle, contiguous
  block indices, gateway tool_use suppressed, client-owned tool_use terminal) —
  the Anthropic-native analogue of the Responses GatewayAccumulator (vllm-project#119).
- handler: routes gateway-tool requests to the loop, forwards the client's
  x-api-key, returns the Anthropic error envelope on failure.

Tests: tool-seam + accumulator unit tests; non-streaming and streaming
acceptance tests replaying live-recorded /v1/messages cassettes (single-round,
parallel, sequential multi-round, no-tool-call); edge coverage for tool
failure, upstream error, round cap, malformed input, and mixed client+gateway
tools; handler routing tests. Validated live on G6e (Qwen3 + real You.com) via
curl and a real upstream Claude Code CLI session.

Implements vllm-project#115.

Signed-off-by: Ashwin Giridharan <girida@amazon.com>

Address review on the Messages-native gateway tool loop:

- Feed the model's full assistant turn (thinking/text/signature +
  tool_use, order preserved) into the next round's history in both the
  streaming and non-streaming loops, instead of reconstructing it from
  only the gateway tool_use blocks. Dropping the preceding blocks lost
  conversation state and could invalidate extended-thinking follow-ups.
- Reject malformed/incomplete tool input (streaming partial_json or a
  non-object input) with an is_error tool_result rather than coercing to
  {} and dispatching the tool with arguments the model never supplied.
- Apply a consistent mixed-call policy: when an assistant turn contains
  both a gateway-owned and a client-owned tool_use, hide the gateway
  call, surface the client call, and stop the loop -- in both paths.
- Reset final_message_delta in begin_round() so a clean-EOF round cannot
  re-emit the previous round's stop_reason: tool_use.

Adds repro tests covering each case in both loops.

Signed-off-by: Ashwin Giridharan <girida@amazon.com>

…e Code)

Claude Code declares its built-in web search as a client function named
`WebSearch`, so it fell through the name-based `web_search` classifier and
was proxied — Claude Code's web search never ran server-side, unlike
Codex, whose typed `web_search` tool routes through the Responses loop.

Add an operator-configured client-tool -> gateway-executor alias map
(`MESSAGES_GATEWAY_TOOL_ALIASES`, e.g. `WebSearch=web_search`), empty by
default. This is the ownership doctrine's "client function is client-owned
unless configured as gateway-owned" clause (docs/design/codex-integration.md),
applied structurally rather than by a hardcoded name. When configured:

- routing, registry build, and both loops classify the aliased tool as
  gateway-owned via GatewayToolMap;
- dispatch canonicalizes the call name to the `web_search` executor key AND
  adapts the arguments (allowed_domains -> include_domains,
  blocked_domains -> exclude_domains) so Claude Code's WebSearch schema
  reaches the executor correctly;
- the raw request still forwards to vLLM verbatim, so the model sees the
  client's own tool contract; the gateway executes and hides the call.

Adds the follow-up design doc and unit tests for classification, env
parsing, name canonicalization, and the argument adapter.

Signed-off-by: Ashwin Giridharan <girida@amazon.com>