@qartisan/playwright-loupe 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Before 1.0, minor versions may contain breaking changes. The JSON report has its own version (`schemaVersion`), see [`docs/schema/v1.md`](docs/schema/v1.md#versioning-policy).
 
+## [0.1.2] - 2026-10-21
+
+### Security
+
+- **Secrets are redacted from the report.** Reports are shared (CI artifacts, links), but they could contain secrets in clear: the value typed by `fill` into a password field is part of Playwright's step title (`Fill "<value>"`), and the call log of a failing API call prints the request and response headers, session cookies and bearer tokens included. Loupe now replaces them with `[redacted]` in `report.json`, and therefore in `index.html`, before writing them and before computing error signatures and categories. No change to your tests.
+  - **Input steps** (on by default): the value of `fill`, `type`, `pressSequentially`, `keyboard.type` and `keyboard.insertText` steps whose target has a secret-looking name, read from the step subtitle (Playwright 1.63+) or, on every version, from the source line of the call. That fallback also covers `keyboard.*` and neutral locators when the code names the value (`fill(password)`). The same value is redacted where Playwright repeats it in that attempt's errors (`fill("[redacted]")` in call logs, assertion lines).
+  - **HTTP headers** (on by default): `cookie`, `set-cookie`, `authorization`, `proxy-authorization` and any header with a secret-looking name, in call logs (`- cookie: [redacted]`).
+  - **URL parameters** (on by default): query and fragment parameters with a secret-looking name, wherever URLs appear (navigation steps, call logs, error messages, stdout), keeping the name: `?token=[redacted]`, `#access_token=[redacted]`.
+  - **Environment values** (opt-in): the values of the variables listed in the new `redact.env` option, or added through `LOUPE_REDACT_ENV`, everywhere in the report. Values shorter than 6 characters and unset variables are skipped with a warning naming the variable.
+  - New `redact` option (`patterns`, `mode`, `env`), validated at startup; one list of secret-looking names for input steps, headers and URL parameters, with whole-word matching (`auth` matches `x-auth-token`, not `Author`). The environment can add names, never remove them.
+  - **Not redacted**: attachments (traces, screenshots and videos contain typed values: treat a report with traces as private), snippets (source code from your repository), attachment file names. See [Secret redaction](docs/config.md#secret-redaction). Reports written by earlier versions are not rewritten.
+
+### Changed
+
+- **Error signatures keep HTTP status codes.** A status code (100–599) in an HTTP context is no longer replaced with `<n>`, so `Unable to delete the member with API with error 401` and `… with error 500` are two error groups instead of one. Other numbers are normalized as before. This changes how signatures are computed, not the JSON shape (`schemaVersion` stays 1): signatures of messages with an HTTP status change, so groups do not match across this upgrade for those errors. See [Error signature](docs/schema/v1.md#error-signature).
+- **Wider HTTP context, shared by categories and signatures.** A status code now also counts as an HTTP status after `error` (`with error 503`, `Error: 503`) and before its standard reason phrase (`401 Unauthorized`, previously only for 5xx). Categories change accordingly: an error such as `… with error 503` is now **Server error** and `… error 429` **Rate limited**, where they could be Uncategorized (or Assertion, Timeout) before. See [HTTP context](docs/schema/v1.md#http-context).
+
+### Fixed
+
+- Docs: `Step.subtitle` is provided from Playwright **1.63**, not 1.61, and before that the target of an action is not always in the title: Playwright 1.53 to 1.62 leave it out (`Click`, `Fill "<value>"`). Only 1.52 writes it there (`locator.getByRole('button').click`). The report itself is unchanged.
+
+## [0.1.1] - 2026-10-18
+
+### Added
+
+- **Tags and dimension values in the Tests view.** Each row shows, under the test title, what the test covers as small neutral chips: its dimension values first (dimensions in config order, annotation-based ones included, then values in the test's order; the chip shows the value, `api`, and its tooltip and accessible name the dimension, "Layer: api"), then its free tags with their `@`, sorted. As in the filters, a tag a dimension takes appears only as that dimension's value. Each chip is a link that adds its value to the filters, keeping the others and the sort; a chip whose value is already filtered is shown active (inverted, with a ×) and removes it ("Remove filter Layer: api"). Both add a history entry, so Back undoes them. A row shows up to four chips, then a "+N" button (`aria-expanded`) that shows the rest in place; that state is not in the URL. Active chips are never hidden behind "+N": they are always shown, the other slots filled in the normal order, and "+N" counts only the chips actually hidden. The chips of each test are computed once per report. No chip line for a test without tags or dimensions. Other annotations stay in the test detail.
+- `npm run perf:sample`: writes 5,000-test reports from the renderer sample (`loupe-perf/`, gitignored) and, with `-- --measure`, times the Tests view (opening, filtering, sorting, searching) in Chromium, optionally against another renderer build (`--renderer`), so performance measurements are reproducible.
+
+### Changed
+
+- **Search covers tags and dimension values.** The search (`q`, in the sidebar) now also matches every raw tag of a test, those a dimension takes included (`smoke`, `@smoke` and `layer:api` all match), and its dimension values, annotation-based ones included (`BUG-42`). Same rules as before: case- and accent-insensitive, every word must match, as substrings.
+- **Trace command: absolute path over `file://`.** When the report is opened from disk, "Copy trace command" copies the absolute path of the trace, computed from the report's own location (`npx playwright show-trace '/home/me/app/loupe-report/data/…/trace.zip'`), so the command works from any directory. Its help now says to run it from your project root, so it uses the project's own Playwright: the same rule as the rerun commands. The path is decoded (spaces, accented characters) before POSIX quoting; a Windows drive path loses the leading `/` of its URL form (commands stay POSIX-only). Over `http(s)` and for a `file://` URL with a host (a network share), the disk path is unknown: the command keeps the path relative to the report folder and the former help. The "Download trace" link is unchanged.
+
 ## [0.1.0] - 2026-10-18
 
 ### Added

package/README.md

@@ -45,14 +45,14 @@ The report is a single self-contained HTML file. It works offline, straight from
   - **Screenshot comparisons**: a failed `toHaveScreenshot` / `toMatchSnapshot` gives one card per image name, before the other screenshots, with four modes: Diff, Side by side (expected | actual, at one scale), Slider (actual over expected, a divider to drag or move with the arrow keys) and Overlay (actual over expected, its opacity to set). Only the modes the images allow are offered; Diff is the default when there is a diff image. The chosen mode applies to every comparison until the report is closed. Each image's size is shown, with a warning when expected and actual differ: slider and overlay align them top-left. "Open in viewer" shows the same modes in the viewer below.
   - **Screenshots** as thumbnails. A click (or Enter / Space) opens them in a viewer, after the comparisons: fitted to the window, or at actual size by clicking the image; previous / next with the buttons or `←` / `→`; "Open original" in a new tab. Escape, the close button or a click outside closes it, back on the same thumbnail. A missing file shows its name and path.
   - **Videos** play inline. A missing or unplayable file shows its path instead of an empty player.
-  - **Traces**: "Copy trace command" copies `npx playwright show-trace <path>`, to run from the report folder (the one containing `index.html`) in a POSIX shell. The trace viewer needs an HTTP server, so it cannot open from `file://`; the command uses the project's own Playwright, which must be at least the version that ran the tests (an older trace viewer shows an empty screen on a newer trace). The card says which version, and has a "Download trace" link.
+  - **Traces**: "Copy trace command" copies `npx playwright show-trace <path>`, to run from your project root in a POSIX shell, like the rerun commands. When the report is opened from disk (`file://`), the path is the absolute path of the trace, so the command works from any directory; when the report is served over HTTP, the disk path is unknown and the path is relative to the report folder (the one containing `index.html`): run it from there. The trace viewer needs an HTTP server, so it cannot open from `file://`; the command uses the project's own Playwright, which must be at least the version that ran the tests (an older trace viewer shows an empty screen on a newer trace). The card says which version, and has a "Download trace" link.
   - Other files are listed as links; small text bodies inline, collapsed.
 - **Copy buttons:** rerun commands (this test, the failed tests of its file, the failed tests of the current list) and an AI prompt describing the failure, in English. Both are only copied to the clipboard; nothing is sent anywhere. Projects failing on the same lines share one command (`--project=a --project=b`); otherwise each project gets its own, joined with `&&`.
   - The commands target **POSIX shells** (bash, zsh; not `cmd.exe`) and run from the Playwright root directory: paths in the report are relative to it.
   - A `file:line` argument targets the line where the test is declared and reruns every test declared on that line. A command is only valid while the file has not changed since the run.
 - **Suite health:** dimensions from tags and annotations (with hints for unknown or inconsistent values), slowest, skipped and flaky tests.
-- **Tests:** every test in one sortable list (by default in declaration order, as in the sidebar: project, file, line; the Status header sorts failed, flaky, passed, skipped), filtered by status, error category, project, tag and dimension, with the count each filter would give. Header counts, error categories and dimension values open it pre-filtered. Large lists show their first 500 rows, with "Show 500 more" and "Show all".
-- **Sidebar:** search (`/` to focus), projects, folders, files, `describe` blocks and tests, with status icons, failure counts and keyboard navigation. The folder shared by every file is not repeated.
+- **Tests:** every test in one sortable list (by default in declaration order, as in the sidebar: project, file, line; the Status header sorts failed, flaky, passed, skipped), filtered by status, error category, project, tag and dimension, with the count each filter would give. Header counts, error categories and dimension values open it pre-filtered. Large lists show their first 500 rows, with "Show 500 more" and "Show all". Under each title, chips show what the test covers: its dimension values first (dimensions in config order, the value alone, `api`, with the dimension in the tooltip), then its other tags (`@smoke`), sorted. A tag a dimension takes appears only as that dimension's value. A chip adds its value to the filters, keeping the others and the sort; an active chip (with a ×) removes it, and Back undoes either. Up to four chips per row, active chips always among them; "+N" shows the rest.
+- **Sidebar:** search (`/` to focus; every word must match, ignoring case and accents, the title path, file, project, tags or dimension values: `smoke`, `api`, `layer:api`), projects, folders, files, `describe` blocks and tests, with status icons, failure counts and keyboard navigation. The folder shared by every file is not repeated.
 - **Filters in the URL:** search, filters and sort live in the link, so a filtered view can be shared or bookmarked, even from `file://`. A project without a `name` (Playwright's default project) cannot be selected in the project filter: an empty name cannot be written in the URL. Give your projects a name to filter by them. Each tag is filterable in one place only: a tag a dimension is built from (`@layer:ui` with a `layer` dimension, configured or automatic) is in that dimension's filter (Layer: `ui`), not in the tag filter, so the two can never be combined into an empty result. Unprefixed tags (`@smoke`) and prefixed tags no dimension uses stay in the tag filter.
 
 ### Keyboard shortcuts
@@ -103,6 +103,21 @@ Options can also be passed inline (`['@qartisan/playwright-loupe', { title: 'Nig
 
 Every option, the lookup rules and the environment variables are documented in [`docs/config.md`](docs/config.md).
 
+### Security
+
+Reports are meant to be shared, so Loupe removes secrets from `report.json` and `index.html` before writing them, replacing each with `[redacted]`:
+
+- **typed values** of `fill`, `type`, `pressSequentially` and `keyboard.*` steps on secret-looking fields (a password field, `getByLabel('Password')`, or a source line that names the value, `fill(password)`), and wherever Playwright repeats them in that attempt's errors;
+- **HTTP header values** printed in call logs (`cookie`, `set-cookie`, `authorization`, and any header with a secret-looking name);
+- **URL parameters** with a secret-looking name, wherever URLs appear (navigation steps, call logs, error messages): `?token=[redacted]`, `&access_token=[redacted]`;
+- the **values of the environment variables you list** in `redact.env` (names only, never values), everywhere in the report. It is also the fallback for what the names above miss: a secret in a URL parameter with a neutral name (`?sig=…`), or printed by your code.
+
+```ts
+redact: { env: ['E2E_PASSWORD', 'API_TOKEN'] },
+```
+
+**Attachments are not altered**: traces, screenshots and videos contain typed values and visible secrets, so a report with traces must be treated as private. Snippets (source excerpts around errors) are left as they are: they come from your repository. See [Secret redaction](docs/config.md#secret-redaction).
+
 ## Compatibility
 
 | | Supported | Tested in CI |
@@ -123,6 +138,7 @@ Node.js 22.12 is the minimum because ES module config files are loaded with `req
 | `npm test` | Builds, then runs the Vitest unit tests and the integration tests (fixture suite, and a sharded run merged with `merge-reports`). |
 | `npm run fixtures` | Builds, then runs the fixture suite into `loupe-report/`. Its failures are intentional, see [`fixtures/README.md`](fixtures/README.md). |
 | `npm run sample:update` | Builds, then runs the fixture suite with `fixtures/sample.config.ts` and writes its report to `src/renderer/dev/sample.json`: failures, flaky and skipped tests, a partial run and a run error. Its attachment files go to `src/renderer/dev/data/` (gitignored). |
+| `npm run perf:sample` | Builds, then writes two 5,000-test reports to `loupe-perf/` (gitignored), from the renderer sample: `sample` (its own tags) and `heavy` (7 to 8 chips per row). Add `-- --measure` to time opening, filtering, sorting and searching the Tests view in Chromium (median of 7 runs), and `--renderer <index.html>` to time another renderer build, for a before / after comparison. |
 | `npm run dev:renderer` | Vite dev server for the renderer, fed with `src/renderer/dev/sample.json`, with hot reload; it serves the sample's attachments at `data/`. No Playwright run needed for UI work. |
 
 Tests that drive a browser need Chromium: `npx playwright install chromium`.

package/dist/config/resolve.d.ts

@@ -3,7 +3,7 @@ type Env = Readonly<Record<string, string | undefined>>;
 export declare const DEFAULT_OUTPUT_FOLDER = "loupe-report";
 export declare const DEFAULT_TITLE = "Loupe report";
 export declare const DEFAULT_UNCATEGORIZED = "Uncategorized";
-/** Environment variables mapped onto config options. `LOUPE_CONFIG` and `LOUPE_RUN_SCOPE` are handled apart. */
+/** Environment variables mapped onto config options. `LOUPE_CONFIG`, `LOUPE_RUN_SCOPE` and `LOUPE_REDACT_ENV` are handled apart. */
 export declare const ENV_OPTIONS: {
     readonly LOUPE_OUTPUT_FOLDER: 'outputFolder';
     readonly LOUPE_TITLE: 'title';
@@ -22,6 +22,17 @@ export declare class LoupeConfigError extends Error {
 export declare function stripPlaywrightKeys(options: Record<string, unknown>): Record<string, unknown>;
 /** The environment layer: options set through `LOUPE_*` variables. Empty variables are ignored. */
 export declare function envLayer(env: Env): LoupeConfig;
+/** Comma-separated variable names added to `redact.env`. */
+export declare const REDACT_ENV = "LOUPE_REDACT_ENV";
+/**
+ * Names from `LOUPE_REDACT_ENV`, with a problem for each invalid one (its text
+ * is not echoed: it may be a value pasted by mistake). The environment can only
+ * add names to `redact.env`, never remove or disable redaction.
+ */
+export declare function redactEnvNames(env: Env): {
+    names: string[];
+    problems: string[];
+};
 /**
  * Merges `layer` over `base`: nested objects (`categories`, `dimensions`,
  * `screenshots`, `aiPrompt`) merge key by key; arrays and other values replace. An

package/dist/config/resolve.js

@@ -1,10 +1,10 @@
 import path from 'node:path';
 import { paletteReference } from '../shared/palette.js';
-import { validateConfig } from './validate.js';
+import { ENV_NAME, validateConfig } from './validate.js';
 export const DEFAULT_OUTPUT_FOLDER = 'loupe-report';
 export const DEFAULT_TITLE = 'Loupe report';
 export const DEFAULT_UNCATEGORIZED = 'Uncategorized';
-/** Environment variables mapped onto config options. `LOUPE_CONFIG` and `LOUPE_RUN_SCOPE` are handled apart. */
+/** Environment variables mapped onto config options. `LOUPE_CONFIG`, `LOUPE_RUN_SCOPE` and `LOUPE_REDACT_ENV` are handled apart. */
 export const ENV_OPTIONS = {
     LOUPE_OUTPUT_FOLDER: 'outputFolder',
     LOUPE_TITLE: 'title',
@@ -42,6 +42,30 @@ export function envLayer(env) {
     }
     return layer;
 }
+/** Comma-separated variable names added to `redact.env`. */
+export const REDACT_ENV = 'LOUPE_REDACT_ENV';
+/**
+ * Names from `LOUPE_REDACT_ENV`, with a problem for each invalid one (its text
+ * is not echoed: it may be a value pasted by mistake). The environment can only
+ * add names to `redact.env`, never remove or disable redaction.
+ */
+export function redactEnvNames(env) {
+    const raw = envValue(env, REDACT_ENV);
+    if (raw === undefined)
+        return { names: [], problems: [] };
+    const names = [];
+    const problems = [];
+    raw.split(',').forEach((part, index) => {
+        const name = part.trim();
+        if (name === '')
+            return;
+        if (ENV_NAME.test(name))
+            names.push(name);
+        else
+            problems.push(`${REDACT_ENV}: item ${index + 1} must be an environment variable name (letters, digits, _), got a string that is not a variable name (value not shown)`);
+    });
+    return { names, problems };
+}
 function isObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof RegExp);
 }
@@ -86,9 +110,11 @@ function resolveDimensions(config) {
 export function resolveConfig(layers) {
     const fileSource = layers.file ? path.basename(layers.file.path) : '';
     const env = envLayer(layers.env);
+    const redactEnv = redactEnvNames(layers.env);
     const problems = [
         ...(layers.file ? validateConfig(layers.file.config, fileSource) : []),
         ...validateConfig(layers.inline, 'reporter options', { allowConfigFile: true }),
+        ...redactEnv.problems,
     ];
     if (problems.length > 0)
         throw new LoupeConfigError(problems);
@@ -115,5 +141,11 @@ export function resolveConfig(layers) {
         screenshots: { defaultView: merged.screenshots?.defaultView ?? 'side-by-side' },
         theme: merged.theme ?? 'system',
         aiPrompt: { includeStack: merged.aiPrompt?.includeStack ?? true },
+        redact: {
+            mode: merged.redact?.mode ?? 'extend',
+            patterns: (merged.redact?.patterns ?? []).map((pattern) => (pattern instanceof RegExp ? stateless(pattern) : pattern)),
+            // LOUPE_REDACT_ENV adds to the configured names: a higher layer never removes one.
+            env: [...new Set([...(merged.redact?.env ?? []), ...redactEnv.names])],
+        },
     };
 }

package/dist/config/types.d.ts

@@ -4,6 +4,8 @@
  */
 export declare const CATEGORY_MODES: readonly ['extend', 'replace'];
 export type CategoryMode = (typeof CATEGORY_MODES)[number];
+export declare const REDACT_MODES: readonly ['extend', 'replace'];
+export type RedactMode = (typeof REDACT_MODES)[number];
 export declare const CATEGORY_TARGETS: readonly ['message', 'stack', 'step', 'all'];
 export type CategoryTarget = (typeof CATEGORY_TARGETS)[number];
 export declare const SCREENSHOT_VIEWS: readonly ['side-by-side', 'slider', 'overlay', 'diff'];
@@ -53,6 +55,18 @@ export interface DimensionsConfig {
     auto?: boolean;
     definitions?: DimensionConfig[];
 }
+export interface RedactConfig {
+    /**
+     * Secret-looking names, for input step targets and source lines, and for
+     * HTTP header names. A string matches whole words (`auth` matches
+     * `x-auth-token`, not `Author`); a RegExp is tested as is.
+     */
+    patterns?: Array<string | RegExp>;
+    /** `extend` (default): `patterns` add to the default names. `replace`: only `patterns`; `[]` turns name-based redaction off. */
+    mode?: RedactMode;
+    /** Names of environment variables whose values are redacted everywhere in the report. Names only, never values. */
+    env?: string[];
+}
 export interface LoupeConfig {
     /** Folder the report is written to, relative to the Playwright config file. Default: `loupe-report`. */
     outputFolder?: string;
@@ -72,6 +86,8 @@ export interface LoupeConfig {
         /** Include each error's stack trace in the copyable AI prompt. Default: `true`. */
         includeStack?: boolean;
     };
+    /** Secret redaction in report.json and index.html. `LOUPE_REDACT_ENV` adds variable names. */
+    redact?: RedactConfig;
 }
 /** Inline reporter options: a config, plus the path of the config file. */
 export interface LoupeReporterOptions extends LoupeConfig {
@@ -121,4 +137,10 @@ export interface ResolvedConfig {
     aiPrompt: {
         includeStack: boolean;
     };
+    /** RegExps without the `g` and `y` flags; `env` merged from every layer, without duplicates. */
+    redact: {
+        mode: RedactMode;
+        patterns: Array<string | RegExp>;
+        env: string[];
+    };
 }

package/dist/config/types.js

@@ -3,6 +3,7 @@
  * reporter options. Every option is optional; see docs/config.md.
  */
 export const CATEGORY_MODES = ['extend', 'replace'];
+export const REDACT_MODES = ['extend', 'replace'];
 export const CATEGORY_TARGETS = ['message', 'stack', 'step', 'all'];
 export const SCREENSHOT_VIEWS = ['side-by-side', 'slider', 'overlay', 'diff'];
 export const THEMES = ['system', 'light', 'dark'];

package/dist/config/validate.d.ts

@@ -1,3 +1,5 @@
+/** An environment variable name, as `redact.env` and `LOUPE_REDACT_ENV` take them. */
+export declare const ENV_NAME: RegExp;
 /** Optimal string alignment distance: Levenshtein plus adjacent transpositions (`titel` → `title` is 1). */
 export declare function editDistance(a: string, b: string): number;
 /** The closest known key, when it is close enough to be a typo. */

package/dist/config/validate.js

@@ -1,6 +1,8 @@
 import { PALETTE_NAMES } from '../shared/palette.js';
-import { CATEGORY_MODES, CATEGORY_TARGETS, SCREENSHOT_VIEWS, THEMES } from './types.js';
+import { CATEGORY_MODES, CATEGORY_TARGETS, REDACT_MODES, SCREENSHOT_VIEWS, THEMES } from './types.js';
 const COLOR = /^#[0-9a-fA-F]{6}$/;
+/** An environment variable name, as `redact.env` and `LOUPE_REDACT_ENV` take them. */
+export const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** What a tag prefix cannot contain: `@layer:api` has the prefix `layer`. */
 const INVALID_PREFIX = /[@:\s]/;
 function describe(value) {
@@ -151,6 +153,37 @@ function values(ctx) {
         });
     };
 }
+/** Secret-looking names: non-empty strings or RegExps. An empty list is valid (with `mode: 'replace'`, it turns them off). */
+function namePatterns(ctx) {
+    return (value, path, errors) => {
+        if (!Array.isArray(value))
+            return fail(ctx, path, 'an array of strings or RegExps', value, errors);
+        value.forEach((item, index) => {
+            if (item instanceof RegExp)
+                return;
+            if (typeof item !== 'string' || item.trim() === '')
+                fail(ctx, `${path}[${index}]`, 'a non-empty string or a RegExp', item, errors);
+        });
+    };
+}
+/** Environment variable names. A value with other characters is most likely a secret pasted by mistake: it is not echoed. */
+function envNames(ctx) {
+    return (value, path, errors) => {
+        if (!Array.isArray(value))
+            return fail(ctx, path, 'an array of environment variable names', value, errors);
+        const seen = new Set();
+        value.forEach((item, index) => {
+            if (typeof item !== 'string' || !ENV_NAME.test(item)) {
+                const got = typeof item === 'string' ? 'a string that is not a variable name (value not shown)' : describe(item);
+                errors.push(`${ctx.source}: ${path}[${index}] must be an environment variable name (letters, digits, _), got ${got}`);
+                return;
+            }
+            if (seen.has(item))
+                errors.push(`${ctx.source}: ${path}[${index}] repeats the variable ${item}`);
+            seen.add(item);
+        });
+    };
+}
 function tagPrefix(ctx) {
     return (value, path, errors) => {
         if (typeof value !== 'string' || value === '' || INVALID_PREFIX.test(value)) {
@@ -228,6 +261,7 @@ export function validateConfig(value, source, options = {}) {
         screenshots: object({ defaultView: oneOf(SCREENSHOT_VIEWS, ctx) }, ctx),
         theme: oneOf(THEMES, ctx),
         aiPrompt: object({ includeStack: boolean(ctx) }, ctx),
+        redact: object({ patterns: namePatterns(ctx), mode: oneOf(REDACT_MODES, ctx), env: envNames(ctx) }, ctx),
     };
     if (options.allowConfigFile)
         fields['configFile'] = nonEmptyString(ctx);

package/dist/core/build.d.ts

@@ -2,6 +2,7 @@ import type { FullConfig, FullResult, Suite, TestError, TestStep } from '@playwr
 import type { LoupeReport, RunScope } from '../schema/v1.js';
 import { type CategoriesOptions, type ErrorText } from './categories.js';
 import { type DimensionsOptions } from './dimensions.js';
+import { type RedactOptions } from './redact.js';
 /** Folder, inside the report folder, that holds the copied attachments. */
 export declare const DATA_FOLDER = "data";
 export interface BuildOptions {
@@ -20,12 +21,14 @@ export interface BuildOptions {
         error: TestError;
         project: string | null;
     }>;
+    /** Secret redaction; default: the built-in names, no env values. */
+    redact?: RedactOptions;
 }
 /**
  * Titles of the failing steps leading to `error`, outermost first: the path to
  * the deepest step that ended with the same message. Empty when no step did.
  */
-export declare function failingSteps(steps: readonly TestStep[], error: TestError): string[];
+export declare function failingSteps(steps: readonly TestStep[], error: TestError, title?: (step: TestStep) => string): string[];
 /**
  * Text an error is categorized on. `steps`: titles of the failing steps, outermost first.
  * Run errors lose the `merge-reports` tag prefix, so rules match the same text merged or not.

package/dist/core/build.js

@@ -8,6 +8,7 @@ import { detectEnvironment, detectGit } from './metadata.js';
 import { collectOutput } from './output.js';
 import { esmImportLocation, isUsableLocation } from './runErrors.js';
 import { detectScopeReasons, resolveScope } from './scope.js';
+import { DEFAULT_REDACT, createRedactor, mapReportStrings } from './redact.js';
 import { errorSignature, stripAnsi, stripMergeTagPrefix } from './signature.js';
 /** Folder, inside the report folder, that holds the copied attachments. */
 export const DATA_FOLDER = 'data';
@@ -119,20 +120,20 @@ function isFocused(test) {
  * Titles of the failing steps leading to `error`, outermost first: the path to
  * the deepest step that ended with the same message. Empty when no step did.
  */
-export function failingSteps(steps, error) {
+export function failingSteps(steps, error, title = (step) => step.title) {
     const message = error.message ?? error.value;
     if (message === undefined)
         return [];
     for (const step of [...steps].reverse()) {
         if (!step.error || (step.error.message ?? step.error.value) !== message)
             continue;
-        return [step.title, ...failingSteps(step.steps, error)];
+        return [title(step), ...failingSteps(step.steps, error, title)];
     }
     // A step may fail with a wrapped message while one of its children has the exact one.
     for (const step of [...steps].reverse()) {
-        const inner = failingSteps(step.steps, error);
+        const inner = failingSteps(step.steps, error, title);
         if (inner.length > 0)
-            return [step.title, ...inner];
+            return [title(step), ...inner];
     }
     return [];
 }
@@ -151,6 +152,7 @@ export async function buildReport(config, suite, result, options) {
     const rootDir = config.rootDir;
     const store = new AttachmentStore(options.outputFolder);
     const categorizer = createCategorizer(options.categories ?? DEFAULT_CATEGORIES);
+    const redactor = createRedactor(options.redact ?? DEFAULT_REDACT);
     const dimensionSet = createDimensions(options.dimensions ?? DEFAULT_DIMENSIONS);
     const categories = new Set();
     const usedDimensions = new Set();
@@ -161,10 +163,11 @@ export async function buildReport(config, suite, result, options) {
     /**
      * `steps`: titles of the failing steps leading to the error, outermost first.
      * `runError`: the `merge-reports` tag prefix is ignored by categories and the signature, kept in `message` and `stack`.
+     * `redact`: applied to the message and the stack before the signature and the category, so they never depend on a secret.
      */
-    const toError = (error, steps = [], location = error.location, runError = false) => {
-        const message = stripAnsi(error.message ?? error.value ?? '');
-        const stack = error.stack ? stripAnsi(error.stack) : null;
+    const toError = (error, redact, steps = [], location = error.location, runError = false) => {
+        const message = redact(stripAnsi(error.message ?? error.value ?? ''));
+        const stack = error.stack ? redact(stripAnsi(error.stack)) : null;
         const category = categorizer.categorize(errorText(message, stack, steps, runError));
         categories.add(category);
         return {
@@ -176,17 +179,21 @@ export async function buildReport(config, suite, result, options) {
             category,
         };
     };
-    const toStep = (step, parents) => {
-        const chain = [...parents, step.title];
+    const toStep = (step, parents, redact) => {
+        const title = redact.title(step);
+        const chain = [...parents, title];
+        // `subtitle` exists from Playwright 1.63. Before, the target of an action is in
+        // the title on 1.52 (`locator.getByRole('button').click`), and nowhere on
+        // 1.53–1.62 (`Click`, `Fill "<value>"`).
+        const subtitle = step.subtitle;
         return {
-            title: step.title,
-            // `subtitle` exists from Playwright 1.61; older versions keep the target in the title.
-            subtitle: step.subtitle ?? null,
+            title,
+            subtitle: subtitle === undefined ? null : redact.text(subtitle),
             category: step.category,
             durationMs: toMs(step.duration),
-            error: step.error ? toError(step.error, chain) : null,
+            error: step.error ? toError(step.error, redact.text, chain) : null,
             location: toLocation(step.location),
-            steps: step.steps.map((child) => toStep(child, chain)),
+            steps: step.steps.map((child) => toStep(child, chain, redact)),
         };
     };
     const toAttempt = async (attempt, folder) => {
@@ -194,14 +201,15 @@ export async function buildReport(config, suite, result, options) {
         for (const attachment of attempt.attachments) {
             attachments.push(await store.add(`${folder}/${attempt.retry}`, attachment));
         }
+        const redact = redactor.attempt(attempt.steps);
         return {
             index: attempt.retry,
             status: attempt.status,
             startedAt: attempt.startTime.toISOString(),
             durationMs: toMs(attempt.duration),
             workerIndex: attempt.workerIndex,
-            errors: attempt.errors.map((error) => toError(error, failingSteps(attempt.steps, error))),
-            steps: attempt.steps.map((step) => toStep(step, [])),
+            errors: attempt.errors.map((error) => toError(error, redact.text, failingSteps(attempt.steps, error, redact.title))),
+            steps: attempt.steps.map((step) => toStep(step, [], redact)),
             attachments,
             annotations: attempt.annotations.map(toAnnotation),
             stdout: collectOutput(attempt.stdout),
@@ -292,9 +300,9 @@ export async function buildReport(config, suite, result, options) {
     for (const { error, project } of options.runErrors ?? []) {
         const message = stripAnsi(error.message ?? error.value ?? '');
         const location = isUsableLocation(error.location) ? error.location : ((await esmImportLocation(message)) ?? undefined);
-        errors.push({ ...toError(error, [], location, true), project });
+        errors.push({ ...toError(error, redactor.text, [], location, true), project });
     }
-    return {
+    const report = {
         schemaVersion: 1,
         generator: { name: 'playwright-loupe', version: options.generatorVersion },
         run: {
@@ -318,4 +326,6 @@ export async function buildReport(config, suite, result, options) {
         categories: categorizer.definitions(categories),
         dimensions: dimensionSet.definitions(usedDimensions),
     };
+    // URL parameters and env values (redact.env) are redacted in every other string: test titles, annotations, outputs, attachment bodies...
+    return redactor.rewritesStrings ? mapReportStrings(report, redactor.strings) : report;
 }

package/dist/core/categories.js

@@ -1,14 +1,7 @@
 import { NEUTRAL_ENTRY, PALETTE_ENTRIES, paletteReference } from '../shared/palette.js';
+import { httpStatus } from './http.js';
 const ALL_TARGETS = ['message', 'stack', 'step'];
 export const UNCATEGORIZED_COLOR = NEUTRAL_ENTRY.reference;
-/**
- * An HTTP status in context: `status 429`, `status code: 429`, `"status": 429`,
- * `statusCode=429`, `HTTP 429`, `HTTP/1.1 429`, `Response status: 429`, or
- * `← 429`, the response line of Playwright's fetch log.
- */
-function httpStatus(code) {
-    return new RegExp(`(?:\\b(?:status(?:[ _]?code)?["']?\\s*[:=]?|HTTP(?:/\\d(?:\\.\\d)?)?:?)|\u2190)\\s*${code}(?!\\w|\\.\\d)`, 'i');
-}
 export const BUILT_IN_RULES = [
     {
         // Before "Locator not found", "Assertion" and "Timeout": a locator matching
@@ -30,7 +23,7 @@ export const BUILT_IN_RULES = [
         // Before "Network", "Assertion" and "Timeout": the status is the diagnosis,
         // whether it surfaces through `failOnStatusCode`, `toBeOK()` or a thrown
         // error. A bare 429 is not enough (`429ms`, `Received: 429`): it needs an
-        // HTTP context.
+        // HTTP context (src/core/http.ts), shared with error signatures.
         name: 'Rate limited',
         color: paletteReference('teal'),
         match: [/\bToo Many Requests\b/i, /\brate[- ]?limit/i, httpStatus('429')],
@@ -39,10 +32,8 @@ export const BUILT_IN_RULES = [
     {
         name: 'Server error',
         color: paletteReference('orange'),
-        match: [
-            httpStatus('5\\d\\d'),
-            /\b5\d\d (?:Internal Server Error|Not Implemented|Bad Gateway|Service Unavailable|Gateway Time-?out|HTTP Version Not Supported)\b/i,
-        ],
+        // In an HTTP context, reason phrase included: `500 Internal Server Error` (failOnStatusCode).
+        match: [httpStatus('5\\d\\d')],
         targets: ['message', 'stack'],
     },
     {

package/dist/core/http.d.ts

@@ -0,0 +1,21 @@
+/**
+ * HTTP status codes in context, shared by the "Rate limited" and "Server
+ * error" categories and by error signatures, so both agree on what an HTTP
+ * status is. See "Error categories" and "Error signature" in docs/schema/v1.md.
+ *
+ * A code is in an HTTP context when it is:
+ * - preceded by `status`, `status code`, `statusCode`, `"status":`, `HTTP`,
+ *   `HTTP/1.1`, `error`, or `←` (the response line of Playwright's fetch log),
+ *   with an optional `:` or `=`: `status 429`, `Response status: 503`,
+ *   `HTTP 500`, `statusCode=502`, `with error 401`;
+ * - or followed by its reason phrase: `401 Unauthorized`, `500 Internal Server Error`.
+ *
+ * A bare number is not enough: `Timeout 429ms exceeded` and `Expected: 200
+ * Received: 500` have no HTTP context.
+ */
+/** Any status code from 100 to 599. */
+export declare const STATUS_CODE = "[1-5]\\d\\d";
+/** Source of a pattern matching `code` (a regex source such as `429` or `5\\d\\d`) in an HTTP context, case-insensitive. */
+export declare function httpStatusSource(code: string): string;
+/** `code` in an HTTP context. */
+export declare function httpStatus(code: string): RegExp;

package/dist/core/http.js

@@ -0,0 +1,64 @@
+/**
+ * HTTP status codes in context, shared by the "Rate limited" and "Server
+ * error" categories and by error signatures, so both agree on what an HTTP
+ * status is. See "Error categories" and "Error signature" in docs/schema/v1.md.
+ *
+ * A code is in an HTTP context when it is:
+ * - preceded by `status`, `status code`, `statusCode`, `"status":`, `HTTP`,
+ *   `HTTP/1.1`, `error`, or `←` (the response line of Playwright's fetch log),
+ *   with an optional `:` or `=`: `status 429`, `Response status: 503`,
+ *   `HTTP 500`, `statusCode=502`, `with error 401`;
+ * - or followed by its reason phrase: `401 Unauthorized`, `500 Internal Server Error`.
+ *
+ * A bare number is not enough: `Timeout 429ms exceeded` and `Expected: 200
+ * Received: 500` have no HTTP context.
+ */
+const PREFIX = `(?:\\b(?:status(?:[ _]?code)?["']?\\s*[:=]?|HTTP(?:/\\d(?:\\.\\d)?)?:?|error\\s*[:=]?)|←)`;
+/** Standard reason phrases (RFC 9110, plus 429). */
+const REASON_PHRASES = [
+    'Continue',
+    'Switching Protocols',
+    'OK',
+    'Created',
+    'Accepted',
+    'No Content',
+    'Moved Permanently',
+    'Found',
+    'See Other',
+    'Not Modified',
+    'Temporary Redirect',
+    'Permanent Redirect',
+    'Bad Request',
+    'Unauthorized',
+    'Payment Required',
+    'Forbidden',
+    'Not Found',
+    'Method Not Allowed',
+    'Not Acceptable',
+    'Request Time-?out',
+    'Conflict',
+    'Gone',
+    'Precondition Failed',
+    'Payload Too Large',
+    'Content Too Large',
+    'Unsupported Media Type',
+    'Unprocessable Entity',
+    'Unprocessable Content',
+    'Too Many Requests',
+    'Internal Server Error',
+    'Not Implemented',
+    'Bad Gateway',
+    'Service Unavailable',
+    'Gateway Time-?out',
+    'HTTP Version Not Supported',
+];
+/** Any status code from 100 to 599. */
+export const STATUS_CODE = '[1-5]\\d\\d';
+/** Source of a pattern matching `code` (a regex source such as `429` or `5\\d\\d`) in an HTTP context, case-insensitive. */
+export function httpStatusSource(code) {
+    return `${PREFIX}\\s*${code}(?!\\w|\\.\\d)|\\b${code} (?:${REASON_PHRASES.join('|')})\\b`;
+}
+/** `code` in an HTTP context. */
+export function httpStatus(code) {
+    return new RegExp(httpStatusSource(code), 'i');
+}