fix(sdk): block real network in test context, strip query from HttpError message

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/plugin-sdk/src/http.ts

@@ -1,10 +1,20 @@
 import type { HttpClient } from "./types.ts";
 
+/** Origin + pathname only: query strings may carry API keys or tokens. */
+function safeUrl(url: string): string {
+  try {
+    const u = new URL(url);
+    return u.origin + u.pathname;
+  } catch {
+    return url.split(/[?#]/)[0] ?? "";
+  }
+}
+
 export class HttpError extends Error {
   readonly status: number;
   readonly body: string;
   constructor(status: number, body: string, url = "") {
-    super(`HTTP ${status}${url ? ` for ${url}` : ""}`);
+    super(`HTTP ${status}${url ? ` for ${safeUrl(url)}` : ""}`);
     this.name = "HttpError";
     this.status = status;
     this.body = body;