030611/dsh-telemetry-redactor
30Last commit Aug 14, 2026
dsh-telemetry-redactor DSH plugin
DSH Telemetry Redactor is a minimal DeepSeek Harness Profile Bundle that redacts sensitive values from session telemetry before a backend receives them. It mounts on the official session-telemetry/record waterfall, calls next() so other deployment rules still compose, and returns a new recursively redacted record. The official telemetry coordinator deep-copies canonical session events before this waterfall, so the plugin changes only the outbound copy and never rewrites the canonical session log.
How to install the dsh-telemetry-redactor DSH plugin
dsh plugin --profile web add dsh-telemetry-redactorCopying does not run this command. Review the repository and version before installing the dsh-telemetry-redactor DSH plugin.
dsh-telemetry-redactor DSH plugin data source
dsh-telemetry-redactor DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-telemetry-redactor DSH plugin can do
- Redacts values under high-risk key names such as authorization, cookie, credential, password, secret, token, apiKey, access_token, clientSecret, and privateKey.
- Recognizes and redacts Bearer and Basic authorization values embedded in strings.
- Redacts common credential forms including sk-..., GitHub tokens, Slack tokens, JWT-like triples, and token=... / api_key: ... assignments.
- Keys are tokenized before matching so telemetry counters like inputTokens, output_tokens, tokenUsage, and ordinary fields like tokenizer remain intact.
- Configurable replacement string (default [REDACTED]) with 1-128 character validation.
Where the dsh-telemetry-redactor DSH plugin fits
- Prevent credential leakage when forwarding telemetry to third-party monitoring services.
- Comply with security policies that require sensitive data to be masked before leaving the host.
- Add an extra layer of protection for secrets in session telemetry without modifying the original log.
- Integrate into CI/CD pipelines to verify that telemetry redaction works as expected.
Who the dsh-telemetry-redactor DSH plugin is for
- DSH users who deploy telemetry backends and need to avoid exposing credentials.
- Security teams responsible for ensuring outbound telemetry does not contain sensitive information.
dsh-telemetry-redactor DSH plugin limitations
- Unknown secret formats that have neither a sensitive key nor a recognized string pattern may pass through.
- Accessor properties and non-plain objects are rejected rather than read or silently converted.
- A key-name match redacts the complete value, favoring safety over retaining structure beneath fields named as credentials.
- Redaction occurs synchronously and is bounded to 64 nested containers; very large shallow records still cost linear CPU time.
- A Proxy can run or throw from reflection traps before the plugin can inspect its contents.
dsh-telemetry-redactor DSH plugin: from the repository README
Quoted from the 030611/dsh-telemetry-redactor README, the upstream source of the dsh-telemetry-redactor DSH plugin. Copyright remains with the original authors.
English | [中文](README.zh.md)  **Redact supported credential patterns from outbound telemetry copies before configured backends receive them—without rewriting canonical session logs.** ```sh dsh plugin --profile web add dsh-telemetry-redactor ``` > Community-maintained and not an official DeepSeek project. Related trust-layer plugins: [Verification Receipt](https://github.com/030611/dsh-verification-receipt), [Evidence Audit](https://github.com/030611/qiushi-dsh-evidence-audit), and [Context Provenance](https://github.com/030611/dsh-context-provenance). `dsh-telemetry-redactor` is a minimal DeepSeek Harness Profile Bundle that redacts sensitive values from session telemetry before a backend receives them. It mounts on the official `session-telemetry/record` waterfall, calls `next()` so other deployment rules still compose, and returns a new recursively redacted record. The official telemetry coordinator deep-copies canonical session events before this waterfall and contains thrown rules per record. Therefore this plugin changes only the outbound copy: it never rewrites the canonical session log. In this document,
Read the full READMERepository license: MIT
dsh-telemetry-redactor DSH plugin questions
Does this plugin change the original session log?
No. The official telemetry coordinator deep-copies canonical session events before the waterfall, so the plugin only redacts the outbound copy. The canonical session log remains unchanged.
What credential patterns are supported for redaction?
It redacts values under high-risk key names like authorization, cookie, credential, password, secret, token, apiKey, and also recognizes patterns like Bearer tokens, Basic auth, sk-..., GitHub tokens, Slack tokens, JWT-like triples, and token=... / api_key: ... assignments. See SECRET-MATRIX.md for the exact list.
Can I configure the replacement string?
Yes. The only configuration option is `replacement`, which defaults to `[REDACTED]`. It must be 1-128 characters and must not match a supported credential pattern. Invalid values cause a loud failure when the plugin is awaited.
Will this plugin affect telemetry counters like token usage?
No. Keys are tokenized before matching, so counters like inputTokens, output_tokens, tokenUsage, and ordinary fields such as tokenizer remain intact. Only high-risk keys and recognized credential patterns are redacted.
What are the known limitations of this plugin?
Unknown secret formats not covered by key names or patterns may pass through. Accessor properties and non-plain objects are rejected. A key-name match redacts the entire value. The redaction is synchronous and bounded to 64 nested containers; large shallow records still cost linear CPU time. Proxies can run traps before inspection.