fix(skills): harden HAR-derived API output

[pnaaberi]

Summary

Fix three reproducible correctness and secret-handling problems in the optional har-derived-api-client skill:

• redact credential-bearing request header values in har_to_client.py output;
• preserve the observed request scheme instead of always printing https://;
• populate CDP-generated HAR queryString entries, including repeated and blank parameters.

The skill documentation now tells users to obtain current credentials from an approved runtime secret source rather than copying values from a HAR into code or shell history.

Reproduction on current main

A synthetic HTTP HAR with Authorization and X-API-Key headers currently:

1. prints truncated portions of both credential values;
2. reports the endpoint as HTTPS even though the observed URL is HTTP.

Separately, _har_entry() in har_capture_cdp.py currently emits an empty queryString array even when the request URL contains query parameters.

Changes

• classify common authorization/API-key/token/secret header names as sensitive and emit [REDACTED] instead of their values;
• include url.scheme in endpoint grouping and output;
• fall back to parsing query parameters from the request URL when a HAR omits queryString;
• populate CDP HAR queryString from the request URL while preserving repeated and blank values;
• add offline behavioral regressions for all three cases;
• clarify credential handling in SKILL.md.

Verification

scripts/run_tests.sh tests/skills/test_har_derived_api_client_skill.py -q
11 passed

python -m py_compile <changed Python files>
python -m ruff check <changed Python files>
git diff --check
All passed

Tested on Linux with Python 3.12. No live credentials or network calls were used.

Scope note

This intentionally does not include the postData: null fix from #84977, so the two pull requests do not overlap.

[pnaaberi]

Overlap with #85085

The two PRs address different bug classes, but they overlap substantially at the file level.

• fix(skills): harden HAR-derived API output #85053: credential-header redaction, preserving the captured HTTP/HTTPS scheme, and retaining query parameters.
• fix(skills): keep HAR capture usable after a bad action #85085: flushing partial HAR output after failed actions, safer CDP tab/context handling, form-body and base64 response handling, and postData: null support.

Both PRs modify:

• SKILL.md
• scripts/har_capture_cdp.py
• scripts/har_to_client.py
• tests/skills/test_har_derived_api_client_skill.py

A three-way merge of the exact commits produces content conflicts in har_capture_cdp.py, har_to_client.py, and the shared test file. Since #85085 is closed and unmerged, it does not currently block this PR, but its fixes would need manual integration if revived.

Conclusion: different bugs, overlapping implementation areas, not duplicate PRs.