dsh-telemetry-redactor
DeepSeek Harness 会话遥测数据的导出副本脱敏
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:030611/dsh-telemetry-redactor#811b0b1abf424e57045ab5a5eaa203660ca43908
Telemetry Redactor 以 dsh-telemetry-redactor 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
DSH Telemetry Redactor social preview
Redact supported credential patterns from outbound telemetry copies before configured backends receive them—without rewriting canonical session logs.
dsh plugin --profile web add dsh-telemetry-redactor
Community-maintained and not an official DeepSeek project. Related trust-layer plugins: Verification Receipt, Evidence Audit, and Context Provenance.
dsh-telemetry-redactor is a minimal DeepSeek Harness Profile Bundle that redacts sensitive values from session telemetry before a backend receives them. It mounts on the official session-telemetry/record waterfall, calls next() so other deployment rules still compose, and returns a new recursively redacted record.
The official telemetry coordinator deep-copies canonical session events before this waterfall and contains thrown rules per record. Therefore this plugin changes only the outbound copy: it never rewrites the canonical session log. In this document, fail-closed means only that this coordinator withholds one failing export copy and continues the agent loop. It is not a claim that every telemetry path or listener order is impossible to bypass.
authorization, cookie, credential, password, secret, token, apiKey, access_token, clientSecret, and privateKey; recognized credential patterns in key names are replaced too.sk-..., GitHub tokens, Slack tokens, JWT-like triples, and token=... / api_key: ... assignments.Keys are tokenized before matching, so telemetry counters such as inputTokens, output_tokens, tokenUsage, tokenCount, and contextTokenCount, and ordinary fields such as tokenizer, remain intact. Redaction is a safety filter, not a proof that an arbitrary unknown secret format is absent. The exact supported and unsupported cases are in SECRET-MATRIX.md; see SECURITY.md for the trust boundary.
The listener is prepended so it normally wraps deployment rules mounted before or after it and redacts their final output. A deliberately prepended outer listener can still add content after this plugin; review the complete waterfall listener set in security-sensitive deployments.
Install the public package into the selected DSH profile, then inspect the resolved configuration:
dsh plugin --profile web add dsh-telemetry-redactor
dsh --profile web --dump-config
The dump must contain the inserted telemetry-redactor row. The bundle does not add, replace, or enable a telemetry backend; it only protects records handled by whatever backend the deployment already selected.
The only option is replacement, which defaults to [REDACTED]. It must contain 1 to 128 characters and must not itself match a supported credential pattern; invalid values fail loudly when the Cordis plugin fiber is awaited.
- id: telemetry-redactor
config:
replacement: '[TELEMETRY-REDACTED]'
The key and pattern rules are fixed security behavior and cannot be disabled through configuration.
pnpm run typecheck
pnpm test
pnpm run build
pnpm run test:smoke
pnpm run test:performance
pnpm run test:official-head
pnpm run test:official-patch
pnpm run test:packed:clean-env
The tests include a real Cordis Loader composition with the SessionTelemetryCoordinator: the backend receives the replacement while the authoritative session event retains the fixture secret, and an over-deep record is withheld without escaping the capture handler. Release smokes use the packaged frozen fixture for official commit 47f943859bef60e4160492346772ded9b24f765a: it pins the reviewed source hashes, exact published runtime versions and runtime-file hashes, then verifies the required Cordis/session/LLM/coordinator API surface before composing it with the built or tarball-installed plugin. test:official-patch similarly pins the reviewed Include source hash before applying cordis.patch.yml. No environment variable or installed official checkout is required.
None. The plugin observes an outbound telemetry copy after session logging and contributes no prompt text, tool schema, message, or provider request.
None; no model request changes.
structuredClone normally rejects a Proxy before this waterfall; direct third-party dispatch is not a supported hostile-object sandbox.dsh.plugin.json is supplemental community metadata. DSH installation is controlled by package.json's dsh.bundle field and cordis.patch.yml.MIT