From 62e2d3d58beeecfaf5d14074659344c8ae731948 Mon Sep 17 00:00:00 2001 From: fylorn <249551762+fylorn@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:39:04 +0800 Subject: [PATCH] Docs: redaction searches only the written text of a request; core docs v0.74.0 Lite features and the relay guide, and the enterprise configuration page, say what Secrets & privacy searches now. The rule-group checkbox is gone from the Lite security page. Core docs are refreshed to v0.74.0. Co-Authored-By: Claude Opus 5.5 --- src/content/docs-lite/en/features.md | 4 ++-- .../docs-lite/en/keep-api-keys-from-relays.md | 2 +- src/content/docs-lite/zh-CN/features.md | 4 ++-- .../zh-CN/keep-api-keys-from-relays.md | 2 +- src/content/docs/en/configuration.md | 2 +- src/content/docs/zh-CN/configuration.md | 2 +- src/data/core-docs/config.md | 20 ++++++++++--------- src/data/core-docs/config.zh-CN.md | 4 ++-- src/data/core-docs/manifest.json | 6 +++--- 9 files changed, 24 insertions(+), 22 deletions(-) diff --git a/src/content/docs-lite/en/features.md b/src/content/docs-lite/en/features.md index 9cc29e0..292cb19 100644 --- a/src/content/docs-lite/en/features.md +++ b/src/content/docs-lite/en/features.md @@ -75,11 +75,11 @@ Every request records the rule it matched, the group it went through and each at The Security page has a **Log** tab and a tab for each of three protections: **Secrets & privacy**, **Dangerous commands** and **Content filter**. They apply to every upstream and every key alike. Each protection is **On**, **Monitor** or **Off**, shown as a dot on its tab. **On** handles each match by the action of the rule that found it. **Monitor** records every match in the log and raises a notification, and changes nothing. **Off** checks nothing. All three start in **Monitor**, so out of the box no request or answer is changed or refused. -- **Secrets & privacy** searches the whole request before it leaves, including the system prompt, earlier turns and tool calls, for credentials and personal information: API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS, Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs and passwords in connection strings, as well as Chinese resident ID numbers and bank card numbers, which count only when their structure and check digit are valid. Field names are not searched, and custom rules leave alone the identifiers a protocol needs as they are, such as item and call ids, types, roles, tool names and model names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. Rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains are included and start off, and a custom rule can name its own placeholder: `PROJECT` gives `<>`. +- **Secrets & privacy** searches the text written in a request before it leaves, including the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions, for credentials and personal information: API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS, Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs and passwords in connection strings, as well as Chinese resident ID numbers and bank card numbers, which count only when their structure and check digit are valid. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. Rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains are included and start off, and a custom rule can name its own placeholder: `PROJECT` gives `<>`. - **Dangerous commands** checks the tool calls a model returns for commands that download or decode code and run it, send out environment variables or credential files, send a credential to a host that is neither local nor the credential's own provider, read private keys or cloud credentials, read or change ThinkWatch's own data directory, or install startup items and scheduled jobs. A path that only appears in text being written, such as a document that mentions the directory, does not count. A rule either cuts the answer off, so the client never receives a complete call to run, or only records the call. Deleting the home or root directory, making files world-writable and uploading a local file to an outside host are only recorded by default. - **Content filter** checks requests and, rule by rule, the model's answers. In a request it checks the user messages and tool results, context compaction included. In an answer it checks the text the model writes, including Codex's freeform tool input; tool calls are left to Dangerous commands, and thinking is not checked. A rule matches a keyword, a regular expression or code points such as `U+E0000–U+E007F`, and refuses the request, deletes the match without leaving a marker, replaces it with the rule's replacement text (`***` by default), or only records it. A replacement is not undone in the answer. Answers keep streaming: only the few characters at the end that could still become a match are held back. While a rule on answers can delete or replace, token probabilities (logprobs) are left out of streamed answers. Built-in rules check requests: they delete Unicode tag characters and bidirectional controls, which can hide instructions from people but not from a model, and refuse explicit "ignore previous instructions" phrasing. Rules for zero-width and private-use characters, which emoji, Persian text and icon fonts also use, and for jailbreaks, persona manipulation, prompt extraction and their Chinese counterparts start off and can be switched on. -Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by category, with a checkbox on each group that switches all of its rules at once, and a search box filters rules by name and pattern. +Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by category, and a search box filters rules by name and pattern. A custom Secrets & privacy rule looks for its text as written (**Contains**, the default) or takes a regular expression (**Regex**), and ignores case unless **Match case** is on. A custom content rule says what it **Checks**: **Request**, **Answer** or **Request and answer**. It matches a keyword, a regular expression or code points, and ignores case unless **Match case** is on. A rule on answers cannot refuse and cannot match code points; the dialog shows those options as unavailable, with the reason. A custom Dangerous commands rule is a regular expression. Any rule can be tried on a sample text first, and for Secrets & privacy and the content filter the test also shows the text after processing; a content sample can be tried as a request or as an answer. diff --git a/src/content/docs-lite/en/keep-api-keys-from-relays.md b/src/content/docs-lite/en/keep-api-keys-from-relays.md index f3eff5d..072b7fe 100644 --- a/src/content/docs-lite/en/keep-api-keys-from-relays.md +++ b/src/content/docs-lite/en/keep-api-keys-from-relays.md @@ -23,7 +23,7 @@ A relay receives every request in full, including keys that end up in the conver | **Monitor** (default) | Matches are recorded and notified; the request is sent unchanged. | Matching calls are recorded, notified and returned as usual. | | **On** | Matches of a **Replace with placeholder** rule are replaced before sending and restored in the answer; **Record only** rules record, notify and send the value unchanged. | Calls matching a **Cut off** rule never fully reach the client; **Record only** rules record, notify and return the call. | -- **What Secrets & privacy covers.** The whole request, system prompt, earlier turns and tool calls included, except field names and base64 data such as images. Custom rules also leave alone the identifiers a protocol needs as they are: item and call ids, types, roles, tool names and model names; built-in rules still search them. Built-in rules find API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS (access key IDs), Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs, passwords in connection strings, and Chinese resident ID and bank card numbers whose structure and check digit are valid. The rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains start off. +- **What Secrets & privacy covers.** The text written in a request: the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names and base64 data such as images. Built-in rules find API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS (access key IDs), Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs, passwords in connection strings, and Chinese resident ID and bank card numbers whose structure and check digit are valid. The rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains start off. - **Rules from before 2026.10.17.** A custom rule saved by an earlier version was a case-sensitive regular expression; it now looks for its text as written and ignores case. A rule that relies on a regular expression still loads but stops matching, with nothing reported, so open each one and choose **Regex**, and **Match case** where capital letters matter. - **How values come back.** A value keeps one placeholder throughout a request, on every upstream. Placeholders the model writes back, in text, tool-call arguments or Codex's freeform tool input such as `apply_patch`, are restored before the client receives them, exactly as the value was written: a private key keeps its line breaks, and tool-call arguments still parse. A command using the key runs locally with the real value, while the relay sees only the placeholder. - **What is cut off.** Calls that download or decode code and run it, send out environment variables or credential files, read private keys or cloud credentials, send a credential to an unknown host, or install startup items or scheduled jobs. Built-in rules for deleting home or root, world-writable permissions and uploading a local file only record. diff --git a/src/content/docs-lite/zh-CN/features.md b/src/content/docs-lite/zh-CN/features.md index e9ce248..f7957d0 100644 --- a/src/content/docs-lite/zh-CN/features.md +++ b/src/content/docs-lite/zh-CN/features.md @@ -75,11 +75,11 @@ API 密钥和请求头的值可以写成 `${变量名}`，读取系统环境变 安全页包括「日志」标签页，以及三项防护各自的标签页：「密钥与隐私」「危险命令」「内容过滤」。三项防护对所有上游和所有密钥统一生效。每项防护处于「开启」「监控」「关闭」三种状态之一，状态以圆点标在标签上。「开启」时，命中内容按命中规则的动作处理；「监控」时，命中内容记入日志并发出通知，不做任何改动；「关闭」时不检查。三项出厂均为「监控」，因此默认不会改动或拒绝任何请求和回答。 -- **密钥与隐私**：请求发出之前查找整个请求（含系统提示、之前的对话和工具调用）中的凭据和个人信息，包括 Anthropic、OpenAI、GitHub、Slack、AWS、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，以及私钥、JWT 和连接串中的口令，还有身份证号与银行卡号（号码结构与校验位都正确才算）。字段名不在查找之列；自定义规则还会跳过协议要求原样保留的标识，如条目与调用的 id、类型、角色、工具名和模型名，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。邮箱地址、中国大陆手机号、内网 IP 地址和内网域名四条规则出厂为停用，可以按需启用；自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<>`。 +- **密钥与隐私**：请求发出之前，在请求中写出的正文（含系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明）里查找凭据和个人信息，包括 Anthropic、OpenAI、GitHub、Slack、AWS、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，以及私钥、JWT 和连接串中的口令，还有身份证号与银行卡号（号码结构与校验位都正确才算）。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名也不查，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。邮箱地址、中国大陆手机号、内网 IP 地址和内网域名四条规则出厂为停用，可以按需启用；自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<>`。 - **危险命令**：检查模型返回的工具调用中是否含有下载或解码后执行代码、外发环境变量或凭据文件、把凭据发往本机和其服务商以外的主机、读取私钥或云服务凭据、读写 ThinkWatch 自己的数据目录、写入启动项或定时任务等命令。只出现在要写入的文字里的路径（例如提到这个目录的文档）不算。每条规则切断回答，使客户端收不到一个完整、可执行的调用，或只作记录。删除主目录或根目录、设置全员可写权限、把本地文件上传到外部主机三条规则出厂只记录。 - **内容过滤**：检查请求，并可按规则检查模型的回答。在请求中，检查用户消息和工具结果，压缩上下文的请求也在其内。在回答中，检查模型输出的正文，包括 Codex 的自由格式工具输入；工具调用由「危险命令」负责，思考过程不检查。规则按关键词、正则表达式或码位（如 `U+E0000–U+E007F`）匹配，命中时拒绝请求、删除命中内容（不留任何标记）、替换为规则指定的替换文本（默认 `***`），或只作记录。替换后的文字在回答中不还原。回答照常流式输出，只暂缓末尾可能构成命中的少量字符。有检查回答的规则可以删除或替换时，流式回答中不再附带 token 概率（logprobs）。内置规则只检查请求：删除 Unicode 标签字符和双向控制符（人看不见、模型读得到，可用于隐藏指令），拒绝明确要求「忽略先前指令」的请求。零宽字符、私用区字符两条规则（表情符号、波斯文和图标字体也会用到这些字符），以及越狱、身份操纵、套取提示词等规则及其中文版本出厂为停用，可以按需启用。 -每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按类别分组，每组带一个复选框，可一次启用或停用组内全部规则；检索框按名称和匹配内容筛选规则。 +每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按类别分组，检索框按名称和匹配内容筛选规则。 「密钥与隐私」的自定义规则按原样查找文字（「包含」，默认）或按正则表达式匹配（「正则」），默认不区分大小写，打开「区分大小写」后区分。内容过滤的自定义规则须选定「检查对象」：「请求」「回答」或「请求和回答」；按关键词、正则表达式或码位匹配，默认不区分大小写，打开「区分大小写」后区分。检查回答的规则不能拒绝，也不能按码位匹配，对话框中这两项不可选，并注明原因。「危险命令」的自定义规则为正则表达式。任何规则都可以先用一段文本测试，「密钥与隐私」和内容过滤的测试还会显示处理后的文本；内容过滤的测试可按请求或按回答进行。 diff --git a/src/content/docs-lite/zh-CN/keep-api-keys-from-relays.md b/src/content/docs-lite/zh-CN/keep-api-keys-from-relays.md index 53f7860..086d4b1 100644 --- a/src/content/docs-lite/zh-CN/keep-api-keys-from-relays.md +++ b/src/content/docs-lite/zh-CN/keep-api-keys-from-relays.md @@ -23,7 +23,7 @@ | 「监控」（出厂） | 检出的内容记入日志并发出通知，请求原样发出。 | 命中的调用记入日志并发出通知，照常返回。 | | 「开启」 | 「替换为占位符」规则检出的内容替换为占位符后发出，回答中的占位符还原为原值；「仅记录」规则只记录并通知，原样发出。 | 命中「切断」规则的调用不会完整到达客户端；「仅记录」规则只记录并通知，照常返回。 | -- **「密钥与隐私」的范围。**查找整个请求，包括系统提示、之前的对话和工具调用，但不查找字段名和图片等 base64 数据。自定义规则还会跳过协议要求原样保留的标识：条目与调用的 id、类型、角色、工具名和模型名；内置规则照常查找这些值。内置规则覆盖 Anthropic、OpenAI、GitHub、Slack、AWS（访问密钥 ID）、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，私钥、JWT、连接串中的口令，以及号码结构与校验位都正确的身份证号和银行卡号。邮箱地址、中国大陆手机号、内网地址、内部域名四条规则出厂为停用。 +- **「密钥与隐私」的范围。**查找请求中写出的正文：系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名和图片等 base64 数据也不查。内置规则覆盖 Anthropic、OpenAI、GitHub、Slack、AWS（访问密钥 ID）、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，私钥、JWT、连接串中的口令，以及号码结构与校验位都正确的身份证号和银行卡号。邮箱地址、中国大陆手机号、内网地址、内部域名四条规则出厂为停用。 - **2026.10.17 之前保存的规则。**此前版本保存的自定义规则按区分大小写的正则表达式匹配，现在改为按原样查找文字、不区分大小写。依赖正则表达式的规则仍可加载，但不再命中，也没有任何提示；应逐条打开，选择「正则」，需要区分大小写的再打开「区分大小写」。 - **原值如何还原。**同一个值在整个请求中只对应一个占位符，无论发往哪个上游都不变。模型在文字、工具调用参数或 Codex `apply_patch` 等自由格式工具输入中写回的占位符，在交给客户端之前按原值的写法如实还原：私钥保留换行，工具调用参数仍可正常解析。用到这把密钥的命令在本机以原值执行，中转站始终只看到占位符。 - **哪些调用会被切断。**下载或解码后执行代码、外发环境变量或凭据文件、读取私钥或云凭据、把凭据发往陌生主机、写入启动项或安装定时任务的调用。删除主目录或根目录、开放全部写权限、上传本地文件三类内置规则出厂只记录。 diff --git a/src/content/docs/en/configuration.md b/src/content/docs/en/configuration.md index eb560c4..091c5fc 100644 --- a/src/content/docs/en/configuration.md +++ b/src/content/docs/en/configuration.md @@ -508,7 +508,7 @@ The three request guards, Secrets & privacy (outbound redaction), Dangerous comm - `enable` and `disable` switch built-in rules on and off by id, `actions` changes what a built-in rule does under `enforce`, and `custom` holds rules of the deployment's own, each with its own `action`. A redaction rule replaces what it finds with a placeholder (`placeholder`, the default) or only records it (`record`); a tool-call rule cuts the answer off (`cut`) or records; a content rule refuses the request (`block`), deletes the match (`strip`), replaces it (`replace`) or records. - A record-only redaction rule sends the value upstream unchanged and writes `gateway.redaction_flagged` while the guard is On. Where its match overlaps a match that is replaced, the value is replaced. With `audit.body_redact_pii` on, the value is still masked in stored bodies. - A custom redaction rule's `match` is `contains`, the default, which looks for `pattern` as written, so `.`, `*` and `\d` have no special meaning, or `regex`, which takes `pattern` as a regular expression. It ignores case unless `case_sensitive` is `true`. The console calls these Match by and Case-sensitive. -- Redaction does not search field names, and custom redaction rules leave alone the values of `id`, `call_id`, `item_id`, `tool_use_id`, `tool_call_id`, `toolUseId`, `previous_response_id`, `response_id`, `type`, `role`, `name`, `namespace`, `model`, `status`, `object` and `phase`. Built-in rules still search those values, and every other value is searched by every rule. The same holds when stored bodies are masked with `audit.body_redact_pii`. +- Redaction searches only the text written in a request, located by its format: system prompts, the messages of every role, reasoning, tool-call arguments and inputs, tool results and tool descriptions. Ids, types, roles, tool names, model names, signatures, settings and field names are never searched, so a rule cannot change a value the upstream needs as it is. Stored bodies masked with `audit.body_redact_pii` are searched as whole text, field names and base64 data excepted. - A custom content rule's `scope` says what it checks: `["request"]` (the default, the caller's messages and tool results), `["response"]` or both. On an answer the rule reads the text the client is shown and the input of freeform tools such as Codex's `apply_patch`, not tool calls and not reasoning, in whole and streamed answers, answers served from the cache and the Responses WebSocket. A rule that checks answers cannot use `block` or `"match": "codepoints"`; such a policy is refused when saved. Built-in content rules check requests only. - `replace` writes the rule's `replacement` (`***` when left out, at most 200 characters) in place of a match, in requests and in answers. A replacement is not put back in the answer and is not checked again. `case_sensitive: true` makes a content rule tell capital letters from small ones; content rules ignore case by default. - Under On, with a rule that checks answers and deletes or replaces, a streamed answer is never held back whole: only the last characters that could still grow into a match wait for the next piece, at most 256 for a regular expression. Logprobs are then removed from streamed answers, and from a whole answer whose text changed, and the log row stores the answer as the client received it. Under Monitor, or when every answer rule only records, answers pass unchanged. diff --git a/src/content/docs/zh-CN/configuration.md b/src/content/docs/zh-CN/configuration.md index bbe7a31..033a063 100644 --- a/src/content/docs/zh-CN/configuration.md +++ b/src/content/docs/zh-CN/configuration.md @@ -508,7 +508,7 @@ openssl rand -base64 32 - `enable` 和 `disable` 按 id 启用或停用内置规则，`actions` 改变内置规则在 `enforce` 下的动作，`custom` 保存部署自己的规则，每条规则各带 `action`。脱敏规则替换为占位符（`placeholder`，默认）或只记录（`record`）；工具调用规则切断回答（`cut`）或只记录；内容规则拒绝请求（`block`）、删除命中内容（`strip`）、替换命中内容（`replace`）或只记录。 - 只记录的脱敏规则把值原样发往上游，防护处于「开启」时写入 `gateway.redaction_flagged`。与要替换的命中重叠时，该值照常替换。开启 `audit.body_redact_pii` 时，存储的请求体中该值仍以掩码保存。 - 自定义脱敏规则以 `match` 指定匹配方式：`contains`（默认）按原样查找 `pattern`，`.`、`*`、`\d` 等没有特殊含义；`regex` 把 `pattern` 作为正则表达式。`case_sensitive` 为 `true` 时区分大小写，否则不区分。控制台中两项分别为「匹配方式」和「区分大小写」。 -- 脱敏不查找字段名；自定义脱敏规则还会跳过 `id`、`call_id`、`item_id`、`tool_use_id`、`tool_call_id`、`toolUseId`、`previous_response_id`、`response_id`、`type`、`role`、`name`、`namespace`、`model`、`status`、`object` 和 `phase` 的值。内置规则照常查找这些值，其余的值由所有规则照常查找。按 `audit.body_redact_pii` 对存储的请求体脱敏时同样如此。 +- 脱敏只在请求中写出的正文里查找，按请求的格式定位：系统提示、各角色的消息、推理、工具调用的参数和输入、工具结果和工具说明。id、类型、角色、工具名、模型名、签名、配置项和字段名一律不查，因此规则不会改坏上游要求原样保留的值。按 `audit.body_redact_pii` 对存储的请求体脱敏时查找整段文字，字段名和 base64 数据除外。 - 自定义内容规则以 `scope` 指定检查对象：`["request"]`（默认，即调用方的消息与工具结果）、`["response"]` 或两者。检查回答时，规则读取客户端看到的正文，以及 Codex `apply_patch` 等自由格式工具的输入，不含工具调用与思考过程；整份回答、流式回答、缓存命中的回答与 Responses WebSocket 都在其内。检查回答的规则不能使用 `block`，也不能使用 `"match": "codepoints"`，这样的策略在保存时被拒绝。内置内容规则只检查请求。 - `replace` 把命中内容替换为规则的 `replacement`（省略时为 `***`，最多 200 个字符），请求与回答中均适用。替换后的文字在回答中不还原，也不再检查。`case_sensitive: true` 使内容规则区分大小写；内容规则默认不区分。 - 防护处于「开启」且有检查回答的规则会删除或替换时，流式回答不整体缓冲，只暂缓末尾可能构成命中的字符，正则规则至多 256 个字符。此时流式回答以及正文有改动的整份回答不再附带 logprobs，日志行保存客户端实际收到的回答。处于「监控」或检查回答的规则全部只记录时，回答原样通过。 diff --git a/src/data/core-docs/config.md b/src/data/core-docs/config.md index 65200a7..7ef1c66 100644 --- a/src/data/core-docs/config.md +++ b/src/data/core-docs/config.md @@ -749,21 +749,23 @@ refuses, deletes, replaces or only records. | Field | Type | Default | Description | |---|---|---|---| -| `redact` | object, [`security.redact`](#cfg-security-redact) | — | Outbound redaction (Secrets & privacy in the app): credentials and personal information anywhere in a request are replaced with placeholders before it leaves, or only recorded, rule by rule. | +| `redact` | object, [`security.redact`](#cfg-security-redact) | — | Outbound redaction (Secrets & privacy in the app): credentials and personal information in the text a request carries (messages, system prompts, reasoning, tool arguments and results, tool descriptions) are replaced with placeholders before it leaves, or only recorded, rule by rule. Identifiers, model names and other protocol fields are sent as they are. | | `inspect_tools` | object, [`security.inspect_tools`](#cfg-security-inspect_tools) | — | Tool-call inspection (Dangerous commands in the app): dangerous commands in the tool calls a model returns cut the response off. | | `content` | object, [`security.content`](#cfg-security-content) | — | Content filter: words, patterns or characters (hidden ones among them) in what the caller sends, and words or patterns in the text of the answer; each rule refuses the request, deletes or replaces what it matched, or only records it. | #### `security.redact` -Before a request leaves, the whole request (system prompt, earlier answers -and tool calls included) is searched for credentials and personal -information. Under `enforce` what a rule finds is replaced with placeholders, -and put back where the answer repeats them; what a rule with `action: record` -finds is sent as it is and only recorded. Images, files and other base64 -payloads are not searched, nor are field names; custom rules also leave alone -the identifiers a protocol needs as they are, such as item and call ids, -types, roles, tool names and model names. +Before a request leaves, the text written in it is searched for credentials +and personal information: system prompts, the messages of every role +(earlier answers included), reasoning, tool-call arguments, tool results and +tool descriptions. Under `enforce` what a rule finds is replaced with +placeholders, and put back where the answer repeats them; what a rule with +`action: record` finds is sent as it is and only recorded. Values the +protocol needs as they are, such as ids, types, roles, tool names, model +names and signatures, are never searched, nor are field names, images, +files, settings, or parts of a request the gateway does not recognize as +written text. diff --git a/src/data/core-docs/config.zh-CN.md b/src/data/core-docs/config.zh-CN.md index f038a2b..1940b24 100644 --- a/src/data/core-docs/config.zh-CN.md +++ b/src/data/core-docs/config.zh-CN.md @@ -554,14 +554,14 @@ pricing: | 字段 | 类型 | 默认值 | 说明 | |---|---|---|---| -| `redact` | 对象，见 [`security.redact`](#cfg-security-redact) | — | 出站脱敏（应用里叫「密钥与隐私」）：请求发出前，按每条规则把其中任何位置的凭据和个人信息替换为占位符，或只记录。 | +| `redact` | 对象，见 [`security.redact`](#cfg-security-redact) | — | 出站脱敏（应用里叫「密钥与隐私」）：请求发出前，按每条规则把其中正文（消息、系统提示、推理、工具调用的参数和结果、工具说明）里的凭据和个人信息替换为占位符，或只记录；id、模型名等协议字段原样发出。 | | `inspect_tools` | 对象，见 [`security.inspect_tools`](#cfg-security-inspect_tools) | — | 工具调用审查（应用里叫「危险命令」）：模型返回的工具调用中出现危险命令时切断响应。 | | `content` | 对象，见 [`security.content`](#cfg-security-content) | — | 内容过滤：调用方发送的内容中、或模型回答的正文中出现指定的词、写法或字符（包括隐藏字符）时，按规则拒绝请求、删除或替换命中的内容，或只记录。 | #### `security.redact` -请求发出前，在整个请求中（包括系统提示、之前的回答和工具调用）查找凭据和个人信息。`enforce` 下将规则找到的内容替换为占位符，回答中重复出现时再换回原值；`action: record` 的规则找到的内容原样发送，只作记录。图片、文件等 base64 内容不查，字段名也不查；自定义规则还不查协议要求原样保留的标识，如条目和调用的 id、类型、角色、工具名、模型名。 +请求发出前，在请求中写出的正文里查找凭据和个人信息：系统提示、各角色的消息（包括之前的回答）、推理、工具调用的参数、工具结果和工具说明。`enforce` 下将规则找到的内容替换为占位符，回答中重复出现时再换回原值；`action: record` 的规则找到的内容原样发送，只作记录。协议要求原样保留的值（如 id、类型、角色、工具名、模型名、签名）一律不查，字段名、图片、文件、配置项以及网关不认作正文的部分也不查。 diff --git a/src/data/core-docs/manifest.json b/src/data/core-docs/manifest.json index 2fd8726..6354f6c 100644 --- a/src/data/core-docs/manifest.json +++ b/src/data/core-docs/manifest.json @@ -1,9 +1,9 @@ { "repository": "ThinkWatchProject/ThinkWatch-Core", - "ref": "v0.73.0", + "ref": "v0.74.0", "files": { - "docs/config.md": "986aa44925c1d0e4143c35d19a9b233ae831352df0cb0ebb1f5e1948a3db2a3b", - "docs/config.zh-CN.md": "8337946ff902c365f02ff3c11fbd97c62f3458b42ba428f5d49cc7a797ffb9dc", + "docs/config.md": "d8027cba044015bd3ff43a8471280a3e755a0227d190838a53cd4baabf2aa1eb", + "docs/config.zh-CN.md": "705c4e1b2be4c6e05da083521a84cf904175a4523a8120b9dcac282047ea3279", "docs/server.md": "5e1e9b901bef2b46d417aea057a1db24c78457d3c1938b8540ecb4766515b68f", "docs/server.zh-CN.md": "1f508e7c39b8ded28653773ca4d8701e6bdc2247bcd359c3a8fd00fd1401a6ff" }