iCode-TUI 0.29.1__py3-none-any.whl

chrys/service/tools/builtins/web/search/exa_mcp.py

@@ -0,0 +1,146 @@
+# Copyright (c) Huawei Technologies Co., Ltd. 2026. All rights reserved.
+
+"""Anonymous Exa search over bounded, stateless MCP HTTP requests."""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+
+from chrys.foundation.net.url import normalize_url
+from chrys.service.tools.builtins.web.config import ANONYMOUS_SEARCH_ENDPOINTS
+from chrys.service.tools.builtins.web.http import WebError, bounded_body, check_status
+from chrys.service.tools.builtins.web.search.providers import ENVIRONMENT_FAILURES
+from chrys.service.tools.builtins.web.search.types import SearchHit, SearchRequest, SearchResponse
+
+_RESULT_HEADER = re.compile(r"(?:\A|\n---\n+)Title: ([^\n]+)\nURL: ([^\n]+)\n")
+# Every request to this anonymous service is ours, so these are the service
+# refusing, not a caller or configuration error: a 4xx (typically a bot block),
+# a JSON-RPC error, or a tool result flagged isError (its free-tier rate limit,
+# an upstream API error, a timeout). An empty search is a plain result, never
+# flagged, so it still ends the chain.
+_FALLS_THROUGH = ENVIRONMENT_FAILURES | {"http_4xx", "exa_rpc_error", "exa_search_failed"}
+_OBJECTIVE = (
+    "Find original pages relevant to the full query. Respect any dates and constraints in the query. "
+    "Extract relevant facts and publication dates; prefer primary sources."
+)
+
+
+def rpc_result(raw: bytes, mime: str) -> dict[str, Any]:
+    """Accept JSON or complete SSE frames; never interpret errors as empty hits."""
+    try:
+        text = raw.decode("utf-8-sig").replace("\r\n", "\n").replace("\r", "\n")
+        if mime == "text/event-stream":
+            messages = []
+            for frame in text.split("\n\n"):
+                data = []
+                for line in frame.split("\n"):
+                    if line.startswith("data:"):
+                        value = line[5:]
+                        data.append(value.removeprefix(" "))
+                if any(data):
+                    messages.append(json.loads("\n".join(data)))
+        elif mime == "application/json" or mime.endswith("+json"):
+            messages = [json.loads(text)]
+        else:
+            raise WebError("protocol_error")
+    except ValueError, UnicodeError, RecursionError:
+        raise WebError("protocol_error") from None
+    replies = []
+    for message in messages:
+        if not isinstance(message, dict) or message.get("jsonrpc") != "2.0":
+            raise WebError("protocol_error")
+        if "id" not in message and isinstance(message.get("method"), str):
+            continue  # Unrelated MCP progress notifications carry no search results.
+        if type(message.get("id")) is not int or message["id"] != 1:
+            raise WebError("protocol_error")
+        replies.append(message)
+    if len(replies) != 1:
+        raise WebError("protocol_error")
+    reply = replies[0]
+    if "error" in reply:
+        raise WebError("exa_rpc_error")
+    result = reply.get("result")
+    if not isinstance(result, dict):
+        raise WebError("protocol_error")
+    if result.get("isError", False) is not False:
+        raise WebError("exa_search_failed")
+    return result
+
+
+def parse_results(result: dict[str, Any]) -> tuple[SearchHit, ...]:
+    """Normalize Exa's title/URL/highlights text, retaining publication metadata."""
+    content = result.get("content")
+    if not isinstance(content, list):
+        raise WebError("protocol_error")
+    hits = []
+    for block in content:
+        if not isinstance(block, dict) or block.get("type") != "text" or not isinstance(block.get("text"), str):
+            raise WebError("protocol_error")
+        # Exa represents an empty search as this single text block, not an empty list.
+        if len(content) == 1 and block["text"] == "No search results found. Please try a different query.":
+            return ()
+        text = block["text"].replace("\r\n", "\n").strip() + "\n"
+        headers = list(_RESULT_HEADER.finditer(text))
+        if not headers or headers[0].start() != 0:
+            raise WebError("search_parse_failed")
+        for index, header in enumerate(headers):
+            try:
+                url = normalize_url(header[2].strip())
+            except ValueError:
+                continue
+            end = headers[index + 1].start() if index + 1 < len(headers) else len(text)
+            hits.append(SearchHit(header[1].strip()[:1000], url, text[header.end() : end].strip()))
+        if not hits:
+            # Headers matched but every URL was rejected; do not disguise that as an empty search.
+            raise WebError("search_parse_failed")
+    return tuple(hits)
+
+
+@dataclass(frozen=True)
+class ExaMcpProvider:
+    """Exa's public MCP search: no key, a query and a result count, filters only as prose."""
+
+    id: str
+    endpoint: str = ANONYMOUS_SEARCH_ENDPOINTS["exa_mcp"]
+
+    def falls_through(self, failure: WebError) -> bool:
+        return failure.code in _FALLS_THROUGH
+
+    async def search(self, request: SearchRequest, *, http: httpx.AsyncClient) -> SearchResponse:
+        objective = _OBJECTIVE
+        filters = ""
+        if request.allowed_domains:
+            filters = " Only include these domains and their subdomains: " + ", ".join(request.allowed_domains)
+        elif request.blocked_domains:
+            filters = " Exclude these domains and their subdomains: " + ", ".join(request.blocked_domains)
+        # The hosted tool limits objective to 4096 characters. The coordinator
+        # also enforces every domain filter locally, including filters too long
+        # to send, so a filtered search asks for more candidates to keep.
+        if len(objective) + len(filters) <= 4096:
+            objective += filters
+        limit = min(request.limit * 3, 20) if filters else request.limit
+        payload = {
+            "jsonrpc": "2.0",
+            "id": 1,
+            "method": "tools/call",
+            "params": {
+                "name": "web_search_exa",
+                "arguments": {"query": request.query, "numResults": limit, "objective": objective},
+            },
+        }
+        http.cookies.clear()
+        async with http.stream(
+            "POST",
+            self.endpoint,
+            headers={"Accept": "application/json, text/event-stream", "Accept-Encoding": "identity"},
+            json=payload,
+        ) as response:
+            check_status(response)
+            mime = response.headers.get("content-type", "").split(";", 1)[0].strip().lower()
+            raw = await bounded_body(response, decompress=False)
+        return SearchResponse(self.id, parse_results(rpc_result(raw, mime)))

chrys/service/tools/builtins/web/search/html.py

@@ -0,0 +1,152 @@
+# Copyright (c) Huawei Technologies Co., Ltd. 2026. All rights reserved.
+
+"""Credential-free HTML search adapters using the shared validated transport."""
+
+from __future__ import annotations
+
+import base64
+import binascii
+from dataclasses import dataclass
+from urllib.parse import parse_qs, urljoin, urlsplit
+
+import httpx
+from bs4 import BeautifulSoup
+
+from chrys.foundation.net.url import normalize_url
+from chrys.service.tools.builtins.web.config import HTML_SEARCH_ENDPOINTS
+from chrys.service.tools.builtins.web.http import WebError, bounded_body, check_status, run_off_loop
+from chrys.service.tools.builtins.web.search.providers import ENVIRONMENT_FAILURES, site_filtered
+from chrys.service.tools.builtins.web.search.types import SearchHit, SearchRequest, SearchResponse
+
+_REDIRECT_HOSTS = {
+    "bing_html": frozenset({"www.bing.com", "cn.bing.com"}),
+    "duckduckgo_html": frozenset({"html.duckduckgo.com"}),
+}
+# A 4xx from a search page nobody holds a key for is a bot block, not our mistake.
+_FALLS_THROUGH = ENVIRONMENT_FAILURES | {"http_4xx"}
+
+
+def result_url(href: str, provider_type: str) -> str:
+    """Decode result link wrappers locally, without requesting tracking URLs."""
+    if len(href) > 16384:
+        raise ValueError("Result link too long")
+    absolute = urljoin(HTML_SEARCH_ENDPOINTS[provider_type], href)
+    parsed = urlsplit(absolute)
+    params = parse_qs(parsed.query)
+    if provider_type == "bing_html" and parsed.hostname in _REDIRECT_HOSTS[provider_type] and parsed.path == "/ck/a":
+        encoded = params.get("u", [""])[0]
+        if not encoded.startswith("a1"):
+            raise ValueError("Unknown Bing link wrapper")
+        try:
+            absolute = base64.b64decode(
+                encoded[2:] + "=" * (-len(encoded[2:]) % 4), altchars=b"-_", validate=True
+            ).decode()
+        except (binascii.Error, UnicodeError) as err:
+            raise ValueError("Invalid Bing link wrapper") from err
+    elif provider_type == "duckduckgo_html" and parsed.hostname in {"duckduckgo.com", "html.duckduckgo.com"}:
+        if parsed.path.rstrip("/") == "/l":
+            absolute = params.get("uddg", [""])[0]
+    return normalize_url(absolute)
+
+
+def parse_html(raw: bytes, provider_type: str) -> tuple[SearchHit, ...]:
+    """Extract organic results only; unknown layouts and challenges fail closed."""
+    soup = BeautifulSoup(raw, "html.parser", from_encoding="utf-8")
+    if soup.select_one(
+        '#challenge-form, #anomaly-modal, .anomaly-modal, #b_captcha, [id*="captcha"], iframe[src*="captcha"]'
+    ):
+        raise WebError("search_challenge")
+    if soup.select_one('form[action*="anomaly"], form[action*="challenge"]'):
+        raise WebError("search_challenge")
+    for node in soup.select("script, style, template, noscript"):
+        node.decompose()
+    bing = provider_type == "bing_html"
+    blocks = (
+        soup.select("li.b_algo")
+        if bing
+        else soup.select("div.result:not(.result--ad):not(.result--silver):not(.result--sponsored)")
+    )
+    hits: list[SearchHit] = []
+    seen: set[str] = set()
+    for block in blocks:
+        anchor = block.select_one("h2 a[href]" if bing else "a.result__a[href]")
+        if anchor is None:
+            continue
+        href = anchor.get("href")
+        if not isinstance(href, str):
+            continue
+        try:
+            url = result_url(href, provider_type)
+        except ValueError:
+            continue
+        if url in seen:
+            continue
+        title = anchor.get_text(" ", strip=True)
+        if not title:
+            continue
+        snippet = block.select_one(".b_caption p" if bing else ".result__snippet")
+        hits.append(SearchHit(title[:1000], url, snippet.get_text(" ", strip=True)[:10000] if snippet else ""))
+        seen.add(url)
+    if hits:
+        return tuple(hits)
+    empty = soup.select_one("#b_results .b_no" if bing else ".no-results")
+    if empty is not None and not soup.select("li.b_algo h2 a[href]" if bing else "a.result__a[href]"):
+        return ()
+    # Login pages, consent forms, changed layouts and malformed links are not
+    # authoritative evidence that a query has no results.
+    raise WebError("search_parse_failed")
+
+
+@dataclass(frozen=True)
+class HtmlSearchProvider:
+    """A search engine's plain HTML results page, read without a key or tracking redirects."""
+
+    id: str
+    type: str
+    """A key of HTML_SEARCH_ENDPOINTS."""
+
+    @property
+    def endpoint(self) -> str:
+        return HTML_SEARCH_ENDPOINTS[self.type]
+
+    def falls_through(self, failure: WebError) -> bool:
+        return failure.code in _FALLS_THROUGH
+
+    async def search(self, request: SearchRequest, *, http: httpx.AsyncClient) -> SearchResponse:
+        current = str(httpx.URL(self.endpoint, params={"q": site_filtered(request).query}))
+        if len(current) > 16384:
+            raise WebError("request_too_large")
+        for hop in range(3):
+            http.cookies.clear()
+            async with http.stream(
+                "GET", current, headers={"Accept": "text/html", "Accept-Encoding": "gzip"}
+            ) as response:
+                if response.status_code in {301, 302, 303, 307, 308}:
+                    current = self._redirect_target(current, response.headers.get("location"), last_hop=hop == 2)
+                    continue
+                if response.status_code == 202:
+                    raise WebError("search_challenge")
+                check_status(response)
+                if response.headers.get("content-type", "").split(";", 1)[0].strip().lower() != "text/html":
+                    raise WebError("protocol_error")
+                raw = await bounded_body(response, decompress=True)
+            return SearchResponse(self.id, await run_off_loop(parse_html, raw, self.type))
+        raise WebError("redirect_not_allowed")
+
+    def _redirect_target(self, current: str, location: str | None, *, last_hop: bool) -> str:
+        """Follow only the engine's own regional hosts, and only to its search path."""
+        if last_hop or not location:
+            raise WebError("redirect_not_allowed")
+        try:
+            target = normalize_url(urljoin(current, location), limit=16384)
+        except ValueError as err:
+            raise WebError("redirect_not_allowed") from err
+        parsed = urlsplit(target)
+        if (
+            parsed.scheme != "https"
+            or parsed.port not in {None, 443}
+            or parsed.hostname not in _REDIRECT_HOSTS[self.type]
+            or parsed.path != urlsplit(self.endpoint).path
+        ):
+            raise WebError("redirect_not_allowed")
+        return target

chrys/service/tools/builtins/web/search/json_api.py

@@ -0,0 +1,227 @@
+# Copyright (c) Huawei Technologies Co., Ltd. 2026. All rights reserved.
+
+"""Keyed JSON search APIs: the official Tavily, Brave and Exa adapters and declarative custom_http."""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from typing import Any
+
+import httpx
+
+from chrys.foundation.net.url import normalize_url
+from chrys.service.tools.builtins.web.config import SearchProviderConfig
+from chrys.service.tools.builtins.web.credentials import ResolvedSearchCredentials
+from chrys.service.tools.builtins.web.http import WebError, bounded_body, check_status
+from chrys.service.tools.builtins.web.search.providers import ENVIRONMENT_FAILURES, site_filtered
+from chrys.service.tools.builtins.web.search.types import SearchHit, SearchRequest, SearchResponse
+
+_DEFAULT_MAPPING = {
+    "results_pointer": "/results",
+    "title_pointer": "/title",
+    "url_pointer": "/url",
+    "snippet_pointer": "/content",
+}
+
+
+def at_pointer(data: Any, path: str) -> Any:
+    """Resolve RFC 6901 segments without recursive searches or coercion."""
+    for token in path.split("/")[1:] if path else ():
+        token = token.replace("~1", "/").replace("~0", "~")
+        if isinstance(data, dict):
+            if token not in data:
+                raise KeyError(token)
+            data = data[token]
+        elif isinstance(data, list) and token.isdecimal() and (token == "0" or not token.startswith("0")):
+            data = data[int(token)]
+        else:
+            raise KeyError(token)
+    return data
+
+
+def expand(value: Any, inputs: dict[str, Any], secrets: dict[str, str]) -> Any:
+    if isinstance(value, dict):
+        if "$input" in value:
+            return inputs[value["$input"]]
+        if "$env" in value:
+            return secrets[value["$env"]]
+        return {key: expand(item, inputs, secrets) for key, item in value.items()}
+    if isinstance(value, list):
+        return [expand(item, inputs, secrets) for item in value]
+    return value
+
+
+def query_pairs(params: dict[str, Any]) -> list[tuple[str, str]]:
+    pairs: list[tuple[str, str]] = []
+    for key, value in params.items():
+        for item in value if isinstance(value, list) else [value]:
+            if item is None or isinstance(item, dict | list):
+                raise WebError("invalid_request")
+            pairs.append((key, str(item).lower() if isinstance(item, bool) else str(item)))
+    return pairs
+
+
+def parse_hits(data: Any, mapping: dict[str, str], *, highlights: bool = False) -> tuple[SearchHit, ...]:
+    try:
+        items = at_pointer(data, mapping["results_pointer"])
+    except KeyError, IndexError:
+        raise WebError("protocol_error") from None
+    if not isinstance(items, list):
+        raise WebError("protocol_error")
+    hits: list[SearchHit] = []
+    for item in items:
+        try:
+            raw_url = at_pointer(item, mapping["url_pointer"])
+            url = normalize_url(raw_url)
+        except ValueError, KeyError, IndexError, TypeError:
+            continue
+        values = {"title": url, "snippet": ""}
+        for key in values:
+            if key + "_pointer" not in mapping:
+                continue
+            try:
+                value = at_pointer(item, mapping[key + "_pointer"])
+            except KeyError, IndexError:
+                continue
+            if highlights and key == "snippet" and isinstance(value, list) and all(isinstance(v, str) for v in value):
+                value = "\n".join(value)
+            if not isinstance(value, str):
+                # A null title/snippet degrades to the default; only wholesale silence is protocol failure.
+                continue
+            values[key] = value
+        hits.append(SearchHit(values["title"][:1000], url, values["snippet"]))
+    if items and not hits:
+        raise WebError("protocol_error")
+    return tuple(hits)
+
+
+@dataclass(frozen=True)
+class _WireRequest:
+    method: str
+    headers: dict[str, str]
+    params: dict[str, Any] = field(default_factory=dict)
+    body: dict[str, Any] | None = None
+    send_body: bool = False
+    """custom_http sends its configured JSON body even when that body is null."""
+    mapping: dict[str, str] = field(default_factory=lambda: dict(_DEFAULT_MAPPING))
+
+
+@dataclass(frozen=True)
+class JsonApiProvider:
+    """One selected keyed or custom JSON API, with an isolated credential snapshot."""
+
+    id: str
+    config: SearchProviderConfig
+    credentials: ResolvedSearchCredentials = field(repr=False)
+
+    @property
+    def endpoint(self) -> str:
+        return self.config.url
+
+    def falls_through(self, failure: WebError) -> bool:
+        # A 4xx from a keyed API is about our key or quota: the user must see it.
+        return failure.code in ENVIRONMENT_FAILURES
+
+    async def search(self, request: SearchRequest, *, http: httpx.AsyncClient) -> SearchResponse:
+        wire = self._wire_request(request)
+        headers = {"Accept": "application/json", "Accept-Encoding": "identity", **wire.headers}
+        for header_value in headers.values():
+            if "\r" in header_value or "\n" in header_value:
+                raise WebError("invalid_request")
+            try:
+                header_value.encode("ascii")
+            except UnicodeEncodeError:
+                # The exception repr carries the full header value; never let it escape to logs.
+                raise WebError("non_ascii_header") from None
+        content = None
+        if wire.body is not None or wire.send_body:
+            content = json.dumps(wire.body, ensure_ascii=False, allow_nan=False).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        url = httpx.URL(self.endpoint, params=query_pairs(wire.params))
+        if (
+            len(str(url).encode()) > 16384
+            or len(json.dumps(headers).encode()) > 16384
+            or (content is not None and len(content) > 300 * 1024)
+        ):
+            raise WebError("request_too_large")
+        async with http.stream(wire.method, url, headers=headers, content=content) as response:
+            check_status(response)
+            mime = response.headers.get("content-type", "").split(";", 1)[0].strip().lower()
+            if mime != "application/json" and not mime.endswith("+json"):
+                raise WebError("protocol_error")
+            raw = await bounded_body(response, decompress=False)
+        try:
+            parsed = json.loads(raw)
+        except ValueError, UnicodeError, RecursionError:
+            raise WebError("protocol_error") from None
+        if (
+            self.config.type == "brave"
+            and isinstance(parsed, dict)
+            and parsed.get("type") == "search"
+            and parsed.get("web") is None
+        ):
+            # A Brave search response leaves out (or nulls) its web section when a query has no web
+            # results. Anything else without one, such as `{}` or an error object, stays a protocol error.
+            return SearchResponse(self.id, ())
+        return SearchResponse(self.id, parse_hits(parsed, wire.mapping, highlights=self.config.type == "exa"))
+
+    def _wire_request(self, request: SearchRequest) -> _WireRequest:
+        cfg = self.config
+        secrets = self.credentials.values
+        if cfg.type == "tavily":
+            body: dict[str, Any] = {"query": request.query, "max_results": request.limit, "search_depth": "basic"}
+            if request.allowed_domains:
+                body.update(include_domains=list(request.allowed_domains), include_domains_mode="restrict")
+            if request.blocked_domains:
+                body["exclude_domains"] = list(request.blocked_domains)
+            return _WireRequest("POST", {"Authorization": "Bearer " + secrets[cfg.api_key_env]}, body=body)
+        if cfg.type == "exa":
+            body = {
+                "query": request.query,
+                "numResults": request.limit,
+                "type": "auto",
+                "contents": {"highlights": True},
+            }
+            if request.allowed_domains:
+                body["includeDomains"] = list(request.allowed_domains)
+            if request.blocked_domains:
+                body["excludeDomains"] = list(request.blocked_domains)
+            return _WireRequest(
+                "POST",
+                {"x-api-key": secrets[cfg.api_key_env]},
+                body=body,
+                mapping={**_DEFAULT_MAPPING, "snippet_pointer": "/highlights"},
+            )
+        request = site_filtered(request)
+        if cfg.type == "brave":
+            return _WireRequest(
+                "GET",
+                {"X-Subscription-Token": secrets[cfg.api_key_env]},
+                params={"q": request.query, "count": request.limit},
+                mapping={**_DEFAULT_MAPPING, "results_pointer": "/web/results", "snippet_pointer": "/description"},
+            )
+        inputs = {
+            "query": request.query,
+            "limit": request.limit,
+            "allowed_domains": list(request.allowed_domains),
+            "blocked_domains": list(request.blocked_domains),
+        }
+        expanded = expand(cfg.request or {}, inputs, secrets)
+        headers = dict(cfg.headers or {})
+        params = expanded.get("query_params", {})
+        auth = cfg.auth or {}
+        if auth.get("location", "none") != "none":
+            value = auth.get("prefix", "") + secrets[auth["key_env"]]
+            if auth["location"] == "header":
+                headers[auth["name"]] = value
+            else:
+                params[auth["name"]] = value
+        return _WireRequest(
+            cfg.method,
+            headers,
+            params=params,
+            body=expanded.get("json"),
+            send_body="json" in (cfg.request or {}),
+            mapping=cfg.response or {},
+        )

chrys/service/tools/builtins/web/search/providers.py

@@ -0,0 +1,77 @@
+# Copyright (c) Huawei Technologies Co., Ltd. 2026. All rights reserved.
+
+"""The contract between the search coordinator and its provider adapters.
+
+The coordinator owns the call budget, deadlines, retries, the fallback order
+and the authoritative domain filter. An adapter owns everything particular to
+its service: adapting the request, the wire protocol, and which of its
+failures leave the query to the next provider.
+"""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from typing import Protocol
+
+import httpx
+
+from chrys.service.tools.builtins.web.http import WebError
+from chrys.service.tools.builtins.web.search.types import SearchRequest, SearchResponse
+
+# Provider-environment failures: another configured provider may still serve
+# the query, so the chain advances instead of failing the whole call. A request
+# level error (invalid_request) is the caller's and fails every provider alike.
+# A connection failure that is not worth retrying (a certificate rejected by an
+# inspecting proxy, a DNS filter answering with 0.0.0.0) still belongs to one
+# provider's host, and a request too large for one provider (a long CJK query
+# in a GET URL) may still fit another's POST body.
+ENVIRONMENT_FAILURES = frozenset(
+    {
+        "dns_failure",
+        "connection_failed",
+        "private_address_blocked",
+        "proxy_ipv6_unsupported",
+        "redirect_not_allowed",
+        "unsupported_content_encoding",
+        "response_too_large",
+        "request_too_large",
+        "search_challenge",
+        "search_parse_failed",
+        "protocol_error",
+    }
+)
+
+
+class SearchProvider(Protocol):
+    """One configured search service, frozen for a build."""
+
+    @property
+    def id(self) -> str: ...
+
+    @property
+    def endpoint(self) -> str:
+        """The URL requests go to; the tool description names its origin."""
+        ...
+
+    async def search(self, request: SearchRequest, *, http: httpx.AsyncClient) -> SearchResponse:
+        """Search with the caller's request, adapted to what this service understands."""
+        ...
+
+    def falls_through(self, failure: WebError) -> bool:
+        """Whether the next provider may still serve a query this one failed with *failure*."""
+        ...
+
+
+def site_filtered(request: SearchRequest) -> SearchRequest:
+    """Push domain filters into the query, for services without native filtering.
+
+    The server-side filter widens the candidate pool; the local filter stays authoritative.
+    """
+    if not (request.allowed_domains or request.blocked_domains):
+        return request
+    parts = [request.query]
+    if request.allowed_domains:
+        sites = " OR ".join(f"site:{domain}" for domain in request.allowed_domains)
+        parts.append(f"({sites})" if len(request.allowed_domains) > 1 else sites)
+    parts.extend(f"-site:{domain}" for domain in request.blocked_domains)
+    return replace(request, query=" ".join(parts))