# Secret support matrix

[中文](SECRET-MATRIX.zh.md)

Baseline: official DSH commit `47f943859bef60e4160492346772ded9b24f765a`. A `SessionTelemetryRecord` contains `channel`, `time`, `severity`, identity-only `attributes: Record<string, string | number>`, and `body`. Ledger `body` is a deep copy of JSON-serializable event data, including plugin-defined event shapes; ops error data is normalized to `{ name, message }`.

| Location or form | Behavior | Support boundary |
|---|---|---|
| High-risk field name (`authorization`, `cookie`, `password`, `apiKey`, `access_token`, etc.) | Replaces the whole value | Supported for enumerable string keys |
| Recognized credential pattern in a field name | Rewrites the key; a resulting duplicate key rejects the record | Supported, fail-safe collision handling |
| Nested object, array, attributes, ops error message | Recurses and applies the same string rules | Supported through 64 nested containers |
| URL query text such as `access_token=...` | Replaces the value until a whitespace or common delimiter | Supported when the label/separator is visible text; no URL parser is used |
| Header object `{ Authorization: ... }` or `{ Cookie: ... }` | Replaces the whole value by key | Supported |
| Header/error text containing Bearer/Basic (8+ credential characters), `sk-`, GitHub, Slack, JWT-like triples, or named assignments | Replaces the recognized substring | Supported fixed patterns |
| DSH token accounting (`inputTokens`, `outputTokens`, `cacheReadTokens`, `cacheWriteTokens`, `reasoningTokens`) | Preserved | Explicit regression coverage |
| Common counters (`tokenUsage`, `tokenCount`, `totalTokens`, `contextTokens`, `contextTokenCount`, `maxTokens`, provider token counts, `tokenizer`) | Preserved unless a string value independently matches a credential pattern | Explicit regression coverage |
| Opaque/unlabelled value, novel credential format, encoded/encrypted value, short Bearer value, or Cookie text in an unrelated string | May pass unchanged | Unsupported; exported data remains sensitive |
| Percent-encoded label/separator | Detected only if enough literal text still matches a fixed rule | No decoding guarantee |
| Accessor, cycle, over-depth value, non-plain object, or key-redaction collision | Throws instead of exporting a partial/changed-meaning copy | Official coordinator drops only that one export copy |
| Proxy | Reflection traps may execute or throw; no isolation guarantee | Official `structuredClone` normally rejects it before this plugin; hostile direct dispatch unsupported |
| LLM/provider config (`apiKey`, `apiKeyEnv`, request `headers`) | Not seen | Outside `SessionTelemetryRecord` |
| OTel exporter config (`headers`, endpoint URL/query credentials) | Not seen | Outside `SessionTelemetryRecord` |
| Direct backend `emit()` or a later outer `prepend` listener | Can bypass or reintroduce data | Deployment/composition boundary; not fail-closed by this plugin |

The matrix describes detection, not declassification. Keep telemetry sharing minimal and treat every exported record as sensitive.