Docs: redaction searches only the written text of a request

src/content/docs-lite/en/features.md

@@ -75,11 +75,11 @@ Every request records the rule it matched, the group it went through and each at
 
 The Security page has a **Log** tab and a tab for each of three protections: **Secrets & privacy**, **Dangerous commands** and **Content filter**. They apply to every upstream and every key alike. Each protection is **On**, **Monitor** or **Off**, shown as a dot on its tab. **On** handles each match by the action of the rule that found it. **Monitor** records every match in the log and raises a notification, and changes nothing. **Off** checks nothing. All three start in **Monitor**, so out of the box no request or answer is changed or refused.
 
-- **Secrets & privacy** searches the whole request before it leaves, including the system prompt, earlier turns and tool calls, for credentials and personal information: API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS, Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs and passwords in connection strings, as well as Chinese resident ID numbers and bank card numbers, which count only when their structure and check digit are valid. Field names are not searched, and custom rules leave alone the identifiers a protocol needs as they are, such as item and call ids, types, roles, tool names and model names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<<TW_SECRET_1>>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. Rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains are included and start off, and a custom rule can name its own placeholder: `PROJECT` gives `<<TW_PROJECT_1>>`.
+- **Secrets & privacy** searches the text written in a request before it leaves, including the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions, for credentials and personal information: API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS, Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs and passwords in connection strings, as well as Chinese resident ID numbers and bank card numbers, which count only when their structure and check digit are valid. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names, so a rule cannot break an id a client sends back. A rule either replaces what it finds with a placeholder such as `<<TW_SECRET_1>>`, or records it and sends it unchanged. A placeholder the answer repeats is restored exactly as the value was written: a private key keeps its line breaks, and a value inside a tool call's arguments or Codex's freeform tool input, such as `apply_patch`, comes back so the client can use it. Rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains are included and start off, and a custom rule can name its own placeholder: `PROJECT` gives `<<TW_PROJECT_1>>`.
 - **Dangerous commands** checks the tool calls a model returns for commands that download or decode code and run it, send out environment variables or credential files, send a credential to a host that is neither local nor the credential's own provider, read private keys or cloud credentials, read or change ThinkWatch's own data directory, or install startup items and scheduled jobs. A path that only appears in text being written, such as a document that mentions the directory, does not count. A rule either cuts the answer off, so the client never receives a complete call to run, or only records the call. Deleting the home or root directory, making files world-writable and uploading a local file to an outside host are only recorded by default.
 - **Content filter** checks requests and, rule by rule, the model's answers. In a request it checks the user messages and tool results, context compaction included. In an answer it checks the text the model writes, including Codex's freeform tool input; tool calls are left to Dangerous commands, and thinking is not checked. A rule matches a keyword, a regular expression or code points such as `U+E0000–U+E007F`, and refuses the request, deletes the match without leaving a marker, replaces it with the rule's replacement text (`***` by default), or only records it. A replacement is not undone in the answer. Answers keep streaming: only the few characters at the end that could still become a match are held back. While a rule on answers can delete or replace, token probabilities (logprobs) are left out of streamed answers. Built-in rules check requests: they delete Unicode tag characters and bidirectional controls, which can hide instructions from people but not from a model, and refuse explicit "ignore previous instructions" phrasing. Rules for zero-width and private-use characters, which emoji, Persian text and icon fonts also use, and for jailbreaks, persona manipulation, prompt extraction and their Chinese counterparts start off and can be switched on.
 
-Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by category, with a checkbox on each group that switches all of its rules at once, and a search box filters rules by name and pattern.
+Every rule has its own switch and its own action, both set directly in the list: Secrets & privacy rules **Replace with placeholder** or **Record only**; Dangerous commands rules **Cut off** or **Record only**; Content filter rules **Refuse**, **Delete**, **Replace** or **Record only**. While a protection is in **Monitor**, each rule shows its action with **Monitoring** next to it. Built-in rules are grouped by category, and a search box filters rules by name and pattern.
 
 A custom Secrets & privacy rule looks for its text as written (**Contains**, the default) or takes a regular expression (**Regex**), and ignores case unless **Match case** is on. A custom content rule says what it **Checks**: **Request**, **Answer** or **Request and answer**. It matches a keyword, a regular expression or code points, and ignores case unless **Match case** is on. A rule on answers cannot refuse and cannot match code points; the dialog shows those options as unavailable, with the reason. A custom Dangerous commands rule is a regular expression. Any rule can be tried on a sample text first, and for Secrets & privacy and the content filter the test also shows the text after processing; a content sample can be tried as a request or as an answer.
 

src/content/docs-lite/en/keep-api-keys-from-relays.md

@@ -23,7 +23,7 @@ A relay receives every request in full, including keys that end up in the conver
 | **Monitor** (default) | Matches are recorded and notified; the request is sent unchanged. | Matching calls are recorded, notified and returned as usual. |
 | **On** | Matches of a **Replace with placeholder** rule are replaced before sending and restored in the answer; **Record only** rules record, notify and send the value unchanged. | Calls matching a **Cut off** rule never fully reach the client; **Record only** rules record, notify and return the call. |
 
-- **What Secrets & privacy covers.** The whole request, system prompt, earlier turns and tool calls included, except field names and base64 data such as images. Custom rules also leave alone the identifiers a protocol needs as they are: item and call ids, types, roles, tool names and model names; built-in rules still search them. Built-in rules find API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS (access key IDs), Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs, passwords in connection strings, and Chinese resident ID and bank card numbers whose structure and check digit are valid. The rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains start off.
+- **What Secrets & privacy covers.** The text written in a request: the system prompt, earlier turns, reasoning, tool-call arguments, tool results and tool descriptions. Values a protocol needs as they are, such as item and call ids, types, roles, tool names, model names and signatures, are never searched, nor are field names and base64 data such as images. Built-in rules find API keys and tokens for Anthropic, OpenAI, GitHub, Slack, AWS (access key IDs), Google, GitLab, Stripe, npm, DigitalOcean and SendGrid, private keys, JWTs, passwords in connection strings, and Chinese resident ID and bank card numbers whose structure and check digit are valid. The rules for email addresses, Chinese mainland mobile numbers, internal IP addresses and internal domains start off.
 - **Rules from before 2026.10.17.** A custom rule saved by an earlier version was a case-sensitive regular expression; it now looks for its text as written and ignores case. A rule that relies on a regular expression still loads but stops matching, with nothing reported, so open each one and choose **Regex**, and **Match case** where capital letters matter.
 - **How values come back.** A value keeps one placeholder throughout a request, on every upstream. Placeholders the model writes back, in text, tool-call arguments or Codex's freeform tool input such as `apply_patch`, are restored before the client receives them, exactly as the value was written: a private key keeps its line breaks, and tool-call arguments still parse. A command using the key runs locally with the real value, while the relay sees only the placeholder.
 - **What is cut off.** Calls that download or decode code and run it, send out environment variables or credential files, read private keys or cloud credentials, send a credential to an unknown host, or install startup items or scheduled jobs. Built-in rules for deleting home or root, world-writable permissions and uploading a local file only record.

src/content/docs-lite/zh-CN/features.md

@@ -75,11 +75,11 @@ API 密钥和请求头的值可以写成 `${变量名}`，读取系统环境变
 
 安全页包括「日志」标签页，以及三项防护各自的标签页：「密钥与隐私」「危险命令」「内容过滤」。三项防护对所有上游和所有密钥统一生效。每项防护处于「开启」「监控」「关闭」三种状态之一，状态以圆点标在标签上。「开启」时，命中内容按命中规则的动作处理；「监控」时，命中内容记入日志并发出通知，不做任何改动；「关闭」时不检查。三项出厂均为「监控」，因此默认不会改动或拒绝任何请求和回答。
 
-- **密钥与隐私**：请求发出之前查找整个请求（含系统提示、之前的对话和工具调用）中的凭据和个人信息，包括 Anthropic、OpenAI、GitHub、Slack、AWS、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，以及私钥、JWT 和连接串中的口令，还有身份证号与银行卡号（号码结构与校验位都正确才算）。字段名不在查找之列；自定义规则还会跳过协议要求原样保留的标识，如条目与调用的 id、类型、角色、工具名和模型名，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<<TW_SECRET_1>>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。邮箱地址、中国大陆手机号、内网 IP 地址和内网域名四条规则出厂为停用，可以按需启用；自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<<TW_PROJECT_1>>`。
+- **密钥与隐私**：请求发出之前，在请求中写出的正文（含系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明）里查找凭据和个人信息，包括 Anthropic、OpenAI、GitHub、Slack、AWS、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，以及私钥、JWT 和连接串中的口令，还有身份证号与银行卡号（号码结构与校验位都正确才算）。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名也不查，因此规则不会改坏客户端回传的 id。每条规则把命中的内容替换为 `<<TW_SECRET_1>>` 这样的占位符，或只作记录、原样发出。回答中出现的占位符按原值的写法如实还原：私钥保留换行，工具调用参数和 Codex `apply_patch` 等自由格式工具输入中的值还原后仍可正常使用。邮箱地址、中国大陆手机号、内网 IP 地址和内网域名四条规则出厂为停用，可以按需启用；自定义规则可以指定占位符名称，如 `PROJECT` 替换为 `<<TW_PROJECT_1>>`。
 - **危险命令**：检查模型返回的工具调用中是否含有下载或解码后执行代码、外发环境变量或凭据文件、把凭据发往本机和其服务商以外的主机、读取私钥或云服务凭据、读写 ThinkWatch 自己的数据目录、写入启动项或定时任务等命令。只出现在要写入的文字里的路径（例如提到这个目录的文档）不算。每条规则切断回答，使客户端收不到一个完整、可执行的调用，或只作记录。删除主目录或根目录、设置全员可写权限、把本地文件上传到外部主机三条规则出厂只记录。
 - **内容过滤**：检查请求，并可按规则检查模型的回答。在请求中，检查用户消息和工具结果，压缩上下文的请求也在其内。在回答中，检查模型输出的正文，包括 Codex 的自由格式工具输入；工具调用由「危险命令」负责，思考过程不检查。规则按关键词、正则表达式或码位（如 `U+E0000–U+E007F`）匹配，命中时拒绝请求、删除命中内容（不留任何标记）、替换为规则指定的替换文本（默认 `***`），或只作记录。替换后的文字在回答中不还原。回答照常流式输出，只暂缓末尾可能构成命中的少量字符。有检查回答的规则可以删除或替换时，流式回答中不再附带 token 概率（logprobs）。内置规则只检查请求：删除 Unicode 标签字符和双向控制符（人看不见、模型读得到，可用于隐藏指令），拒绝明确要求「忽略先前指令」的请求。零宽字符、私用区字符两条规则（表情符号、波斯文和图标字体也会用到这些字符），以及越狱、身份操纵、套取提示词等规则及其中文版本出厂为停用，可以按需启用。
 
-每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按类别分组，每组带一个复选框，可一次启用或停用组内全部规则；检索框按名称和匹配内容筛选规则。
+每条规则都有自己的开关和动作，直接在列表中设置：「密钥与隐私」的规则可选「替换为占位符」或「仅记录」；「危险命令」的规则可选「切断」或「仅记录」；「内容过滤」的规则可选「拒绝」「删除」「替换」或「仅记录」。防护处于「监控」时，各条规则的动作旁注明「监控中」。内置规则按类别分组，检索框按名称和匹配内容筛选规则。
 
 「密钥与隐私」的自定义规则按原样查找文字（「包含」，默认）或按正则表达式匹配（「正则」），默认不区分大小写，打开「区分大小写」后区分。内容过滤的自定义规则须选定「检查对象」：「请求」「回答」或「请求和回答」；按关键词、正则表达式或码位匹配，默认不区分大小写，打开「区分大小写」后区分。检查回答的规则不能拒绝，也不能按码位匹配，对话框中这两项不可选，并注明原因。「危险命令」的自定义规则为正则表达式。任何规则都可以先用一段文本测试，「密钥与隐私」和内容过滤的测试还会显示处理后的文本；内容过滤的测试可按请求或按回答进行。
 

src/content/docs-lite/zh-CN/keep-api-keys-from-relays.md

@@ -23,7 +23,7 @@
 | 「监控」（出厂） | 检出的内容记入日志并发出通知，请求原样发出。 | 命中的调用记入日志并发出通知，照常返回。 |
 | 「开启」 | 「替换为占位符」规则检出的内容替换为占位符后发出，回答中的占位符还原为原值；「仅记录」规则只记录并通知，原样发出。 | 命中「切断」规则的调用不会完整到达客户端；「仅记录」规则只记录并通知，照常返回。 |
 
-- **「密钥与隐私」的范围。**查找整个请求，包括系统提示、之前的对话和工具调用，但不查找字段名和图片等 base64 数据。自定义规则还会跳过协议要求原样保留的标识：条目与调用的 id、类型、角色、工具名和模型名；内置规则照常查找这些值。内置规则覆盖 Anthropic、OpenAI、GitHub、Slack、AWS（访问密钥 ID）、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，私钥、JWT、连接串中的口令，以及号码结构与校验位都正确的身份证号和银行卡号。邮箱地址、中国大陆手机号、内网地址、内部域名四条规则出厂为停用。
+- **「密钥与隐私」的范围。**查找请求中写出的正文：系统提示、之前的对话、推理、工具调用的参数、工具结果和工具说明。协议要求原样保留的值，如条目与调用的 id、类型、角色、工具名、模型名和签名，一律不查，字段名和图片等 base64 数据也不查。内置规则覆盖 Anthropic、OpenAI、GitHub、Slack、AWS（访问密钥 ID）、Google、GitLab、Stripe、npm、DigitalOcean、SendGrid 的 API 密钥与令牌，私钥、JWT、连接串中的口令，以及号码结构与校验位都正确的身份证号和银行卡号。邮箱地址、中国大陆手机号、内网地址、内部域名四条规则出厂为停用。
 - **2026.10.17 之前保存的规则。**此前版本保存的自定义规则按区分大小写的正则表达式匹配，现在改为按原样查找文字、不区分大小写。依赖正则表达式的规则仍可加载，但不再命中，也没有任何提示；应逐条打开，选择「正则」，需要区分大小写的再打开「区分大小写」。
 - **原值如何还原。**同一个值在整个请求中只对应一个占位符，无论发往哪个上游都不变。模型在文字、工具调用参数或 Codex `apply_patch` 等自由格式工具输入中写回的占位符，在交给客户端之前按原值的写法如实还原：私钥保留换行，工具调用参数仍可正常解析。用到这把密钥的命令在本机以原值执行，中转站始终只看到占位符。
 - **哪些调用会被切断。**下载或解码后执行代码、外发环境变量或凭据文件、读取私钥或云凭据、把凭据发往陌生主机、写入启动项或安装定时任务的调用。删除主目录或根目录、开放全部写权限、上传本地文件三类内置规则出厂只记录。