[aikins01]

With captureInput: false or captureOutput: false, the core SDKs still exported each recorded error's exception.message and exception.stacktrace without masking. Error text often repeats a prompt or a tool result, so turning capture off did not keep that content out of telemetry.

The TypeScript and Python cores now record the message and stack only when both effective input and output capture are on for the span, including per-span overrides. Either flag is enough to block them, because an exception can echo the input or the output. When they are recorded, they go through mask with exception.message or exception.stacktrace as the key, then the usual serialization and truncation. Error status, error.type, and the exception event with exception.type are always kept. The rule is per span: an error that propagates to an enclosing span with capture on is recorded there in full, and the docs say so.

A mask hook that throws now drops the field and reports a fixed mask hook raised; content dropped error to onError / on_error and the SDK log. Before, it reported the hook's own error, which can carry the unmasked value or chain the application exception. Python serialization failures report the same way. The application's own error is still rethrown unchanged.

This changes what existing users receive: with either capture flag off, exception messages and stacks are gone, and existing masks now also see the two exception keys. The pi, omp, and opencode integrations already withheld host error text unless the span captures output unmasked, and they keep doing that for users on older core versions. The OpenAI, Anthropic, and Cursor READMEs now describe the new rule and note that older core versions still export exception text. docs/sdk-conformance.md updates C14 and C16.