Redact secrets from telemetry spans, OAuth logs, and HTTP

[alessiodevoto]

Summary

Redacts secrets from three log/trace paths that previously wrote credentials to disk:

• Telemetry span scrubber did not inspect mapping keys, nested structures, short credentials, or the OAuth-specific fields client_secret, refresh_token, and code_verifier — so those values could reach exported spans intact.
• OAuth token-exchange failures logged the full request body (client_secret, code, code_verifier) and the raw provider response on error.
• HTTP debug logger persisted parsed request and response bodies and response headers verbatim — bodies were never scrubbed, and response headers (including Set-Cookie, X-Api-Key, X-Auth-Token, X-Session-Token, etc.) were written in plaintext even though request headers were already redacted.

Together these paths could write authorization codes, PKCE verifiers, client secrets, refresh/access tokens, session cookies, and provider credentials to trace or debug-log storage.

Changes

• Span scrubber recursively handles mappings and always redacts values under known credential keys; generic assignment matching covers short secrets and OAuth credential names.
• OAuth token-exchange failures log only the HTTP status; the exception chain is preserved via raise ... from e.
• HTTP debug logger passes every parsed request/response body through the scrubber before persisting. OAuth authorization-code bodies additionally treat the otherwise-generic code field as a credential. The live httpx.Request / httpx.Response returned to callers is not mutated.
• HTTP debug logger redacts request and response headers via the shared sensitive-key classifier, covering Authorization, Cookie / Set-Cookie, Proxy-Authorization, and provider-specific auth headers (X-Api-Key, X-Auth-Token, X-Session-Token, …).

Test plan

• uv run ruff check . passes on touched files
• uv run ruff format --check . passes on touched files
• uv run pytest — 6242 passed, 0 failures
• New regression tests in tests/tracing/test_secret_scrubber.py cover nested mappings, sensitive-key redaction, and short secrets
• New live-transport tests in tests/unifiedllm/test_http_logging.py cover response-header and body redaction in both save_responses (response_*.json) and errors_only (llm_errors.jsonl) paths

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.