[BUG] claude-in-chrome Tab Context prints full URLs of every tab, leaking credentials in query strings

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

claude-in-chrome tool results append a "Tab Context" footer listing the **full URL of every tab in the MCP tab group**. When any open tab's URL carries a credential in its query string, that credential is written into the session transcript on the next tool call — even a call targeting a different tab, and without the page ever being read.

During an API-key rotation, a data provider's key detail page used the pattern `https:///apikey?api_key=<32-char key>`. The next `javascript_tool` / `navigate` result printed that URL in Tab Context. The freshly created key had to be treated as burned and rotated again.

### What Should Happen?

Credentials in URLs should not reach the transcript through tool metadata the model did not ask for.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Open any page whose URL contains a credential-shaped query parameter (e.g. `?api_key=TEST_PLACEHOLDER`) inside the MCP tab group.
2. Call any claude-in-chrome tool (e.g. `javascript_tool`) on **another** tab in the group.
3. The result's Tab Context footer includes the full URL with the parameter value.

### Claude Model

Opus

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.270 (Claude Code)

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Non-interactive/CI environment

### Additional Information

**Asks**

1. **Redact credential-shaped query parameters in Tab Context** (`api_key`, `apikey`, `key`, `token`, `access_token`, `secret`, `password`, `sig`, `code`, …), or print origin + path only.
2. Limit Tab Context to the tab a tool call targets, or make the all-tabs footer opt-in.
3. Document the current behavior so users know to keep credential-bearing pages out of the MCP tab group.

**Workaround in use**

A dedicated Chrome profile for MCP work with no provider consoles; `history.replaceState` to strip the query before a tool returns (only helps once the tab is known to be dirty).

Related: #79411 (revoke Claude's access to a specific tab).