fix: allowlist credential URLs, block fetch redirects, harden error redaction

[lewismarshall]

Summary

Stops sending the live gateway / EnsureSandBox bearer token to unexpected hosts or across HTTP redirects, and hardens stderr redaction so error bodies are less likely to leak credentials.

Changes

1. Gateway URL allowlist (src/url-policy.js)
   • Default: https only on *.cursor.sh / *.cursor.com (and apex).
   • GROK_BOT_ALLOW_LOCAL_GATEWAY=1 for http(s)://127.0.0.1, localhost, ::1.
   • GROK_BOT_ALLOW_ANY_GATEWAY=1 break-glass (documented as unsafe).
   • Applied on env override, app-session load, EnsureSandBox response, and each gatewayCall.
2. redirect: "error" on both fetch sites (ensureSandbox, gatewayCall).
3. Key-based secret redaction via redactSecrets() in fail() and gateway error paths (broader than the old Bearer-only regex).

Test plan

• npm test (includes new test/url-policy.test.js)
• Smoke: normal macOS app-session gbot bots list
• Smoke: GROK_BOT_ALLOW_LOCAL_GATEWAY=1 with local gateway
• Confirm rejected host fails closed without sending the token

Notes for maintainers

If production box gateway hosts are not under *.cursor.sh / *.cursor.com, please say so in review and we can extend the allowlist before merge (or document the required env opt-in).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2892b13

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR