Support blocked_domains in tools.web_search config

What variant of Codex are you using?

CLI

What feature would you like to see?

Please add support for configuring blocked domains for the hosted web_search tool.

The Responses API web search tool supports a filters.blocked_domains option, but Codex currently appears to expose only allowed_domains through tools.web_search config.

Today, users can configure:

web_search = "live"

[tools.web_search]
allowed_domains = ["docs.example"]

However, there does not seem to be a way to express the inverse policy:

web_search = "live"

[tools.web_search]
blocked_domains = ["some-domain.example"]

Why is this useful?

In some cases, users want Codex to keep using broad web search, but exclude one or more domains from search results. Using allowed_domains is not a good substitute because it turns the configuration into a strict allowlist and requires enumerating every acceptable domain.

Additional information

_No response_