Bugzilla

Add a module that turns a failed URL into a `{ action, query, reason, source }` result.

Use a fully local model (via `createEngine`) to produces a better topical `query` when the model is available and the user has not opted out via AI Controls. As a fallback, use a deterministic method to derive the query instead.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes. It shows a loading state until a prepared.
- Choose a path to proceed, either with or without the local LLM.
- For the LLM path:
  - Use the path and the domain name to build the model input. Filter out URL creds/port/query/fragment.
  - Also strip secret-shaped tokens from the input (opaque-token filter) so the model never sees them. Don't apply stopwords yet, though.
  - Model generates a candidate search query.
  - Run the opaque-token filter on the model's output before accepting it. This is what gets sent to the search engine. If the output is empty, it fails the filter and falls back to the deterministic path.
  - Set `source = llm` when the LLM string is used.
- For the deterministic path:
  - Tokenize `URL.pathname` and the registrable domain only.
  - Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
  - If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.
  - Set `source = deterministic`.

### Acceptance criteria
Host-viability check:
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.

Local LLM path:
- `action` and `reason` match the documented worked examples.
- The `query` is model-generated and validated by *properties*, not exact match. Contains no secret-shaped tokens (opaque filter applied to the output), is non-empty, and its tokens trace to the source URL (path/domain). Tested via a mock.
- User opt-out via AI Controls disables this path. Those users get the deterministic behavior.
- Passes a dedicated `featureId` to `createEngine`.
- Sets `source = llm` when the LLM query is used.

Deterministic fallback path:
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).
- Sets `source = deterministic`.

Add a module that turns a failed URL into a `{ action, query, reason, source }` result.

Use a fully local model (via `createEngine`) to produce a better topical `query` when the model is available and the user has not opted out via AI Controls. As a fallback, use a deterministic method to derive the query instead.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes. It shows a loading state until a prepared.
- Choose a path to proceed, either with or without the local LLM.
- For the LLM path:
  - Use the path and the domain name to build the model input. Filter out URL creds/port/query/fragment.
  - Also strip secret-shaped tokens from the input (opaque-token filter) so the model never sees them. Don't apply stopwords yet, though.
  - Model generates a candidate search query.
  - Run the opaque-token filter on the model's output before accepting it. This is what gets sent to the search engine. If the output is empty, it fails the filter and falls back to the deterministic path.
  - Set `source = llm` when the LLM string is used.
- For the deterministic path:
  - Tokenize `URL.pathname` and the registrable domain only.
  - Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
  - If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.
  - Set `source = deterministic`.

### Acceptance criteria
Host-viability check:
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.

Local LLM path:
- `action` and `reason` match the documented worked examples.
- The `query` is model-generated and validated by *properties*, not exact match. Contains no secret-shaped tokens (opaque filter applied to the output), is non-empty, and its tokens trace to the source URL (path/domain). Tested via a mock.
- User opt-out via AI Controls disables this path. Those users get the deterministic behavior.
- Passes a dedicated `featureId` to `createEngine`.
- Sets `source = llm` when the LLM query is used.

Deterministic fallback path:
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).
- Sets `source = deterministic`.

Add a module that turns a failed URL into a `{ action, query, reason, source }` result.

Use a fully local model (via `createEngine`) to produce a better topical `query` when the model is available and the user has not opted out via AI Controls. As a fallback, use a deterministic method to derive the query instead.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes.
- Choose a path to proceed, either with or without the local LLM.
- For the LLM path:
  - Use the path and the domain name to build the model input. Filter out URL creds/port/query/fragment.
  - Also strip secret-shaped tokens from the input (opaque-token filter) so the model never sees them. Don't apply stopwords yet, though.
  - Model generates a candidate search query.
  - Run the opaque-token filter on the model's output before accepting it. This is what gets sent to the search engine. If the output is empty, it fails the filter and falls back to the deterministic path.
  - Set `source = llm` when the LLM string is used.
- For the deterministic path:
  - Tokenize `URL.pathname` and the registrable domain only.
  - Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
  - If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.
  - Set `source = deterministic`.

### Acceptance criteria
Host-viability check:
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.

Local LLM path:
- `action` and `reason` match the documented worked examples.
- The `query` is model-generated and validated by *properties*, not exact match. Contains no secret-shaped tokens (opaque filter applied to the output), is non-empty, and its tokens trace to the source URL (path/domain). Tested via a mock.
- User opt-out via AI Controls disables this path. Those users get the deterministic behavior.
- Passes a dedicated `featureId` to `createEngine`.
- Sets `source = llm` when the LLM query is used.

Deterministic fallback path:
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).
- Sets `source = deterministic`.

Add a module that turns a failed URL into a `{ action, query, reason, source }` result.

Use a fully local model (via `createEngine`) to produce a better topical `query` when the model is available and the user has not opted out via AI Controls. As a fallback, use a deterministic method to derive the query instead.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes.
- We proceed either with or without the local LLM.
- For the LLM path:
  - Use the path and the domain name to build the model input. Filter out URL creds/port/query/fragment.
  - Also strip secret-shaped tokens from the input (opaque-token filter) so the model never sees them. Don't apply stopwords yet, though.
  - Model generates a candidate search query.
  - Run the opaque-token filter on the model's output before accepting it. This is what gets sent to the search engine. If the output is empty, it fails the filter and falls back to the deterministic path.
  - Set `source = llm` when the LLM string is used.
- For the deterministic path:
  - Tokenize `URL.pathname` and the registrable domain only.
  - Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
  - If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.
  - Set `source = deterministic`.

### Acceptance criteria
Host-viability check:
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.

Local LLM path:
- `action` and `reason` match the documented worked examples.
- The `query` is model-generated and validated by *properties*, not exact match. Contains no secret-shaped tokens (opaque filter applied to the output), is non-empty, and its tokens trace to the source URL (path/domain). Tested via a mock.
- User opt-out via AI Controls disables this path. Those users get the deterministic behavior.
- Passes a dedicated `featureId` to `createEngine`.
- Sets `source = llm` when the LLM query is used.

Deterministic fallback path:
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).
- Sets `source = deterministic`.

Add a module that turns a failed URL into a `{ action, query, reason, source }` result.

Use a fully local model (via `createEngine`) to produce a better topical `query` when the model is available and the user has not opted out via AI Controls. As a fallback, use a deterministic method to derive the query instead.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes.
- Tokenize `URL.pathname` and the registrable domain only.
- Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
- If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.
- Set `source = deterministic`.

### Acceptance criteria
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).
- Sets `source = deterministic`.

Add a module that turns a failed URL into a `{ action, query, reason }` result.

See:
https://docs.google.com/document/d/1c8ZPioin4Bnj_5u9_su7vsfv6L3FSgnmORz7EM0ucAI/edit?tab=t.i5r0fb3p704v#heading=h.lhd46c2jtkx3

The full routine looks like this:
- Check for host viability (see the linked doc for criteria). Either we block here and don't show the CTA, or we continue.
- Not part of this bug's scope, but we'd render the CTA as soon as host viability passes.
- Tokenize `URL.pathname` and the registrable domain only.
- Filter tokens: grammar stopwords, URL-structure stopwords, opaque-token filter.
- If surviving tokens >= `minKeywords` then we return `action=keywords` and `reason=ok`. Otherwise use the host fallback: `action=host` and `reason=no-path` or `no-meaningful-keywords`.

### Acceptance criteria
- If a host doesn't pass our host-viability check, then we do not show the CTA and we don't derive the search query.
- Produces the documented `{action, query, reason}` for the worked examples (blocked hosts, descriptive path, typo'd bare host, secret-laden path).
- URL search query string / `#fragment` are never tokenized.
- Host fallback uses the registrable domain only.
- `minKeywords` parameterized (defaults to 1).