Harden URL handling in span attributes

[RhysSullivan]

Change

Telemetry spans can carry request URLs verbatim, including query strings.
Query strings are not a safe thing to put in a trace store by default: they
are attacker-influenced, vary by route, and some OAuth and integration flows
legitimately put sensitive values there.

This adds a redaction step so URL attributes are sanitised before export
rather than relying on each call site to do the right thing.

• A span processor wraps the export chain in apps/cloud/src/observability/.
  It is the single point every span passes through, so a route added later
  cannot bypass it.
• Sensitive query parameters are stripped from URL attributes; url.path is
  preserved so route-level debugging is unaffected. The stripped parameter
  names are recorded so traces stay useful.
• The redactor follows one level of nesting, since some redirect parameters
  embed a full URL.
• A shared endpoint-normalising helper replaces the per-plugin copy, so
  plugin-stamped endpoint attributes get the same treatment.

Verification

format:check, lint, typecheck, test all pass.

Tests cover the processor directly and the nested-parameter case, and assert
the preserved fields survive. Verified fail-before/pass-after by reverting the
change in place. All test data is synthetic.

Follow-up

Only the cloud host installs this processor today. Other hosts do not
currently export traces, so this is not a gap now, but the placement is worth
revisiting if that changes.

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1477.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1477.executor-e2e.workers.dev/mcp
Deployed commit	114d866

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	114d866	Jul 28 2026, 07:09 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	114d866	Commit Preview URL Branch Preview URL	Jul 28 2026, 07:09 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1477

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1477

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1477

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1477

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1477

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1477

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1477

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1477

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1477

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1477

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1477

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1477

executor

npm i https://pkg.pr.new/executor@1477

commit: 114d866