Lite docs: expanded redaction rules and exceptions (2026.10.34)

src/content/docs-lite/en/features.md

@@ -75,11 +75,13 @@ Every request records the rule it matched, the group it went through and each at
 
 The Security page has a **Log** tab and a tab for each of three protections: **Secrets & privacy**, **Dangerous commands** and **Content filter**. They apply to every upstream and every key alike. Each protection is **On**, **Monitor** or **Off**, shown as a dot on its tab. **On** handles each match by the action of the rule that found it. **Monitor** records every match in the log and raises a notification, and changes nothing. **Off** checks nothing. All three start in **Monitor**, so out of the box no request or answer is changed or refused.
 
-- **Secrets & privacy** searches the text written in a request before it leaves, including the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions, for credentials and personal information: API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS, Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs and passwords in connection strings, as well as Chinese resident ID numbers and bank card numbers, which count only when their structure and check digit are valid. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<<TW_SECRET_1>>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. Rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains are included and start off, and a custom rule can name its own placeholder: `PROJECT` gives `<<TW_PROJECT_1>>`.
+- **Secrets & privacy** searches the text written in a request before it leaves, including the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions, for credentials and personal information, with 120 built-in rules. The keys saved in ThinkWatch (upstream keys, gateway keys, proxy passwords, sync credentials) are recognised by value, whatever their format; on top of those come API keys and tokens of about 60 services (such as Anthropic, OpenAI, DeepSeek-style `sk-` keys, xAI, Groq, OpenRouter, Hugging Face, Zhipu, Baidu Qianfan, GitHub, GitLab, AWS, Alibaba Cloud, Tencent Cloud, Slack and Stripe), private keys, JWTs, passwords in connection strings, and wallet seed phrases and private keys. Credentials recognised by where they appear have only the value replaced: `Authorization` and API-key headers, `curl -u` style command-line passwords, token parameters in URLs, bot webhooks (Feishu/Lark, DingTalk, WeCom, Slack, Discord, Teams) and assignments such as `DB_PASSWORD=...` in config files. Of personal information, resident ID numbers, bank card numbers, IBANs and passport machine-readable zones count only when their structure and check digits are valid, and start on; foreign ID numbers, mobile and landline numbers, email addresses, street addresses, precise coordinates, licence plates, vehicle identification numbers, device identifiers, public and internal addresses, and name, address, birth date, account and health fields recognised by their field names start off and can be switched on. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<<TW_SECRET_1>>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. A hit on a saved key is logged with where the key is saved (such as the upstream's name), never its value. A custom rule can name its own placeholder: `PROJECT` gives `<<TW_PROJECT_1>>`.
 - **Dangerous commands** checks the tool calls a model returns for commands that download or decode code and run it, send out environment variables or credential files, send a credential to a host that is neither local nor the credential's own provider, read private keys or cloud credentials, read or change ThinkWatch's own data directory, or install startup items and scheduled jobs. A path that only appears in text being written, such as a document that mentions the directory, does not count. A rule either cuts the answer off, so the client never receives a complete call to run, or only records the call. Deleting the home or root directory, making files world-writable and uploading a local file to an outside host are only recorded by default.
 - **Content filter** checks requests and, rule by rule, the model's answers. In a request it checks the user messages and tool results, context compaction included. In an answer it checks the text the model writes, including Codex's freeform tool input; tool calls are left to Dangerous commands, and thinking is not checked. A rule matches a keyword, a regular expression or code points such as `U+E0000–U+E007F`, and refuses the request, deletes the match without leaving a marker, replaces it with the rule's replacement text (`***` by default), or only records it. A replacement is not undone in the answer. Answers keep streaming: only the few characters at the end that could still become a match are held back. While a rule on answers can delete or replace, token probabilities (logprobs) are left out of streamed answers. Built-in rules check requests: they delete Unicode tag characters and bidirectional controls, which can hide instructions from people but not from a model, and refuse explicit "ignore previous instructions" phrasing. Rules for zero-width and private-use characters, which emoji, Persian text and icon fonts also use, and for jailbreaks, persona manipulation, prompt extraction and their Chinese counterparts start off and can be switched on.
 
-Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by category, and a search box filters rules by name and pattern.
+Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by what they protect; groups start collapsed, and each group head shows its number of rules, how many are on and how many matches the last 7 days had. Rule names and descriptions follow the app's language. A search box filters rules by name and pattern and opens the groups that match.
+
+A value Secrets & privacy matches by mistake can be listed as an exception: choose **List as exception** in a hit's details in the security log, or paste the value under **Exceptions** below the rule list. An excepted value is neither replaced nor recorded by any rule, while the rules keep working for every other value. The configuration keeps only a hash of the value and its masked form; keys saved in ThinkWatch cannot be excepted. Up to 500 exceptions are kept, and each can be removed.
 
 A custom Secrets & privacy rule looks for its text as written (**Contains**, the default) or takes a regular expression (**Regex**), and ignores case unless **Match case** is on. A custom content rule says what it **Checks**: **Request**, **Answer** or **Request and answer**. It matches a keyword, a regular expression or code points, and ignores case unless **Match case** is on. A rule on answers cannot refuse and cannot match code points; the dialog shows those options as unavailable, with the reason. A custom Dangerous commands rule is a regular expression. Any rule can be tried on a sample text first, and for Secrets & privacy and the content filter the test also shows the text after processing; a content sample can be tried as a request or as an answer.
 

src/content/docs-lite/zh-CN/features.md

@@ -75,11 +75,13 @@ API 密钥和请求头的值可以写成 `${变量名}`，读取系统环境变
 
 安全页包括「日志」标签页，以及三项防护各自的标签页：「密钥与隐私」「危险命令」「内容过滤」。三项防护对所有上游和所有密钥统一生效。每项防护处于「开启」「监控」「关闭」三种状态之一，状态以圆点标在标签上。「开启」时，命中内容按命中规则的动作处理；「监控」时，命中内容记入日志并发出通知，不做任何改动；「关闭」时不检查。三项出厂均为「监控」，因此默认不会改动或拒绝任何请求和回答。
 
-- **密钥与隐私**：请求发出之前，在请求中写出的正文（含系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明）里查找凭据和个人信息，包括 Anthropic、OpenAI、GitHub、Slack、AWS、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，以及私钥、JWT 和连接串中的口令，还有身份证号与银行卡号（号码结构与校验位都正确才算）。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名也不查，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<<TW_SECRET_1>>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。邮箱地址、中国大陆手机号、内网 IP 地址和内网域名四条规则出厂为停用，可以按需启用；自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<<TW_PROJECT_1>>`。
+- **密钥与隐私**：请求发出之前，在请求中写出的正文（含系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明）里查找凭据和个人信息，内置规则共 120 条。保存在 ThinkWatch 中的密钥（上游密钥、网关密钥、代理密码、同步凭据）按值识别，与格式无关；另有约 60 种服务的 API 密钥与令牌（如 Anthropic、OpenAI、DeepSeek 一类的 `sk-` 密钥、xAI、Groq、OpenRouter、Hugging Face、智谱、百度千帆、GitHub、GitLab、AWS、阿里云、腾讯云、Slack、Stripe）、私钥、JWT、连接串中的口令、钱包助记词与私钥。按出现位置识别的凭据只替换值本身：`Authorization` 与 API 密钥请求头、`curl -u` 一类的命令行口令、URL 中的令牌参数、机器人 Webhook（飞书、钉钉、企业微信、Slack、Discord、Teams），以及配置文件中 `DB_PASSWORD=...` 一类的赋值。个人信息中，身份证号、银行卡号、IBAN 与护照机读区在号码结构与校验位都正确时才算，出厂开启；境外证件、手机号与固定电话、邮箱、地址、精确坐标、车牌、车辆识别代号、设备标识、公网与内网地址，以及按字段名识别的姓名、住址、出生日期、账号与健康信息，出厂停用，可以按需启用。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名也不查，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<<TW_SECRET_1>>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。命中保存的密钥时，日志只写明它保存在哪里（如上游名称），不显示值。自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<<TW_PROJECT_1>>`。
 - **危险命令**：检查模型返回的工具调用中是否含有下载或解码后执行代码、外发环境变量或凭据文件、把凭据发往本机和其服务商以外的主机、读取私钥或云服务凭据、读写 ThinkWatch 自己的数据目录、写入启动项或定时任务等命令。只出现在要写入的文字里的路径（例如提到这个目录的文档）不算。每条规则切断回答，使客户端收不到一个完整、可执行的调用，或只作记录。删除主目录或根目录、设置全员可写权限、把本地文件上传到外部主机三条规则出厂只记录。
 - **内容过滤**：检查请求，并可按规则检查模型的回答。在请求中，检查用户消息和工具结果，压缩上下文的请求也在其内。在回答中，检查模型输出的正文，包括 Codex 的自由格式工具输入；工具调用由「危险命令」负责，思考过程不检查。规则按关键词、正则表达式或码位（如 `U+E0000–U+E007F`）匹配，命中时拒绝请求、删除命中内容（不留任何标记）、替换为规则指定的替换文本（默认 `***`），或只作记录。替换后的文字在回答中不还原。回答照常流式输出，只暂缓末尾可能构成命中的少量字符。有检查回答的规则可以删除或替换时，流式回答中不再附带 token 概率（logprobs）。内置规则只检查请求：删除 Unicode 标签字符和双向控制符（人看不见、模型读得到，可用于隐藏指令），拒绝明确要求「忽略先前指令」的请求。零宽字符、私用区字符两条规则（表情符号、波斯文和图标字体也会用到这些字符），以及越狱、身份操纵、套取提示词等规则及其中文版本出厂为停用，可以按需启用。
 
-每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按类别分组，检索框按名称和匹配内容筛选规则。
+每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按保护对象分组，各组默认收起，组头显示规则数、已开启的条数和最近 7 天的命中次数；规则的名称与说明随语言显示。检索框按名称和匹配内容筛选规则，命中的组自动展开。
+
+「密钥与隐私」中被误认的值可以列为例外：在安全日志的命中详情中选「列为例外」，或在规则表下方的「例外」一节粘贴值添加。列为例外的值在任何规则下都不替换、不记录，规则对其他值照常生效。配置中只保存值的哈希与打码后的样子；保存在 ThinkWatch 中的密钥不能列为例外。例外最多 500 个，可逐个移出。
 
 「密钥与隐私」的自定义规则按原样查找文字（「包含」，默认）或按正则表达式匹配（「正则」），默认不区分大小写，打开「区分大小写」后区分。内容过滤的自定义规则须选定「检查对象」：「请求」「回答」或「请求和回答」；按关键词、正则表达式或码位匹配，默认不区分大小写，打开「区分大小写」后区分。检查回答的规则不能拒绝，也不能按码位匹配，对话框中这两项不可选，并注明原因。「危险命令」的自定义规则为正则表达式。任何规则都可以先用一段文本测试，「密钥与隐私」和内容过滤的测试还会显示处理后的文本；内容过滤的测试可按请求或按回答进行。