@qartisan/playwright-loupe 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Before 1.0, minor versions may contain breaking changes. The JSON report has its own version (`schemaVersion`), see [`docs/schema/v1.md`](docs/schema/v1.md#versioning-policy).
 
+## [0.1.2] - 2026-10-21
+
+### Security
+
+- **Secrets are redacted from the report.** Reports are shared (CI artifacts, links), but they could contain secrets in clear: the value typed by `fill` into a password field is part of Playwright's step title (`Fill "<value>"`), and the call log of a failing API call prints the request and response headers, session cookies and bearer tokens included. Loupe now replaces them with `[redacted]` in `report.json`, and therefore in `index.html`, before writing them and before computing error signatures and categories. No change to your tests.
+  - **Input steps** (on by default): the value of `fill`, `type`, `pressSequentially`, `keyboard.type` and `keyboard.insertText` steps whose target has a secret-looking name, read from the step subtitle (Playwright 1.63+) or, on every version, from the source line of the call. That fallback also covers `keyboard.*` and neutral locators when the code names the value (`fill(password)`). The same value is redacted where Playwright repeats it in that attempt's errors (`fill("[redacted]")` in call logs, assertion lines).
+  - **HTTP headers** (on by default): `cookie`, `set-cookie`, `authorization`, `proxy-authorization` and any header with a secret-looking name, in call logs (`- cookie: [redacted]`).
+  - **URL parameters** (on by default): query and fragment parameters with a secret-looking name, wherever URLs appear (navigation steps, call logs, error messages, stdout), keeping the name: `?token=[redacted]`, `#access_token=[redacted]`.
+  - **Environment values** (opt-in): the values of the variables listed in the new `redact.env` option, or added through `LOUPE_REDACT_ENV`, everywhere in the report. Values shorter than 6 characters and unset variables are skipped with a warning naming the variable.
+  - New `redact` option (`patterns`, `mode`, `env`), validated at startup; one list of secret-looking names for input steps, headers and URL parameters, with whole-word matching (`auth` matches `x-auth-token`, not `Author`). The environment can add names, never remove them.
+  - **Not redacted**: attachments (traces, screenshots and videos contain typed values: treat a report with traces as private), snippets (source code from your repository), attachment file names. See [Secret redaction](docs/config.md#secret-redaction). Reports written by earlier versions are not rewritten.
+
+### Changed
+
+- **Error signatures keep HTTP status codes.** A status code (100–599) in an HTTP context is no longer replaced with `<n>`, so `Unable to delete the member with API with error 401` and `… with error 500` are two error groups instead of one. Other numbers are normalized as before. This changes how signatures are computed, not the JSON shape (`schemaVersion` stays 1): signatures of messages with an HTTP status change, so groups do not match across this upgrade for those errors. See [Error signature](docs/schema/v1.md#error-signature).
+- **Wider HTTP context, shared by categories and signatures.** A status code now also counts as an HTTP status after `error` (`with error 503`, `Error: 503`) and before its standard reason phrase (`401 Unauthorized`, previously only for 5xx). Categories change accordingly: an error such as `… with error 503` is now **Server error** and `… error 429` **Rate limited**, where they could be Uncategorized (or Assertion, Timeout) before. See [HTTP context](docs/schema/v1.md#http-context).
+
+### Fixed
+
+- Docs: `Step.subtitle` is provided from Playwright **1.63**, not 1.61, and before that the target of an action is not always in the title: Playwright 1.53 to 1.62 leave it out (`Click`, `Fill "<value>"`). Only 1.52 writes it there (`locator.getByRole('button').click`). The report itself is unchanged.
+
 ## [0.1.1] - 2026-10-18
 
 ### Added

package/README.md

@@ -103,6 +103,21 @@ Options can also be passed inline (`['@qartisan/playwright-loupe', { title: 'Nig
 
 Every option, the lookup rules and the environment variables are documented in [`docs/config.md`](docs/config.md).
 
+### Security
+
+Reports are meant to be shared, so Loupe removes secrets from `report.json` and `index.html` before writing them, replacing each with `[redacted]`:
+
+- **typed values** of `fill`, `type`, `pressSequentially` and `keyboard.*` steps on secret-looking fields (a password field, `getByLabel('Password')`, or a source line that names the value, `fill(password)`), and wherever Playwright repeats them in that attempt's errors;
+- **HTTP header values** printed in call logs (`cookie`, `set-cookie`, `authorization`, and any header with a secret-looking name);
+- **URL parameters** with a secret-looking name, wherever URLs appear (navigation steps, call logs, error messages): `?token=[redacted]`, `&access_token=[redacted]`;
+- the **values of the environment variables you list** in `redact.env` (names only, never values), everywhere in the report. It is also the fallback for what the names above miss: a secret in a URL parameter with a neutral name (`?sig=…`), or printed by your code.
+
+```ts
+redact: { env: ['E2E_PASSWORD', 'API_TOKEN'] },
+```
+
+**Attachments are not altered**: traces, screenshots and videos contain typed values and visible secrets, so a report with traces must be treated as private. Snippets (source excerpts around errors) are left as they are: they come from your repository. See [Secret redaction](docs/config.md#secret-redaction).
+
 ## Compatibility
 
 | | Supported | Tested in CI |

package/dist/config/resolve.d.ts

@@ -3,7 +3,7 @@ type Env = Readonly<Record<string, string | undefined>>;
 export declare const DEFAULT_OUTPUT_FOLDER = "loupe-report";
 export declare const DEFAULT_TITLE = "Loupe report";
 export declare const DEFAULT_UNCATEGORIZED = "Uncategorized";
-/** Environment variables mapped onto config options. `LOUPE_CONFIG` and `LOUPE_RUN_SCOPE` are handled apart. */
+/** Environment variables mapped onto config options. `LOUPE_CONFIG`, `LOUPE_RUN_SCOPE` and `LOUPE_REDACT_ENV` are handled apart. */
 export declare const ENV_OPTIONS: {
     readonly LOUPE_OUTPUT_FOLDER: 'outputFolder';
     readonly LOUPE_TITLE: 'title';
@@ -22,6 +22,17 @@ export declare class LoupeConfigError extends Error {
 export declare function stripPlaywrightKeys(options: Record<string, unknown>): Record<string, unknown>;
 /** The environment layer: options set through `LOUPE_*` variables. Empty variables are ignored. */
 export declare function envLayer(env: Env): LoupeConfig;
+/** Comma-separated variable names added to `redact.env`. */
+export declare const REDACT_ENV = "LOUPE_REDACT_ENV";
+/**
+ * Names from `LOUPE_REDACT_ENV`, with a problem for each invalid one (its text
+ * is not echoed: it may be a value pasted by mistake). The environment can only
+ * add names to `redact.env`, never remove or disable redaction.
+ */
+export declare function redactEnvNames(env: Env): {
+    names: string[];
+    problems: string[];
+};
 /**
  * Merges `layer` over `base`: nested objects (`categories`, `dimensions`,
  * `screenshots`, `aiPrompt`) merge key by key; arrays and other values replace. An

package/dist/config/resolve.js

@@ -1,10 +1,10 @@
 import path from 'node:path';
 import { paletteReference } from '../shared/palette.js';
-import { validateConfig } from './validate.js';
+import { ENV_NAME, validateConfig } from './validate.js';
 export const DEFAULT_OUTPUT_FOLDER = 'loupe-report';
 export const DEFAULT_TITLE = 'Loupe report';
 export const DEFAULT_UNCATEGORIZED = 'Uncategorized';
-/** Environment variables mapped onto config options. `LOUPE_CONFIG` and `LOUPE_RUN_SCOPE` are handled apart. */
+/** Environment variables mapped onto config options. `LOUPE_CONFIG`, `LOUPE_RUN_SCOPE` and `LOUPE_REDACT_ENV` are handled apart. */
 export const ENV_OPTIONS = {
     LOUPE_OUTPUT_FOLDER: 'outputFolder',
     LOUPE_TITLE: 'title',
@@ -42,6 +42,30 @@ export function envLayer(env) {
     }
     return layer;
 }
+/** Comma-separated variable names added to `redact.env`. */
+export const REDACT_ENV = 'LOUPE_REDACT_ENV';
+/**
+ * Names from `LOUPE_REDACT_ENV`, with a problem for each invalid one (its text
+ * is not echoed: it may be a value pasted by mistake). The environment can only
+ * add names to `redact.env`, never remove or disable redaction.
+ */
+export function redactEnvNames(env) {
+    const raw = envValue(env, REDACT_ENV);
+    if (raw === undefined)
+        return { names: [], problems: [] };
+    const names = [];
+    const problems = [];
+    raw.split(',').forEach((part, index) => {
+        const name = part.trim();
+        if (name === '')
+            return;
+        if (ENV_NAME.test(name))
+            names.push(name);
+        else
+            problems.push(`${REDACT_ENV}: item ${index + 1} must be an environment variable name (letters, digits, _), got a string that is not a variable name (value not shown)`);
+    });
+    return { names, problems };
+}
 function isObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof RegExp);
 }
@@ -86,9 +110,11 @@ function resolveDimensions(config) {
 export function resolveConfig(layers) {
     const fileSource = layers.file ? path.basename(layers.file.path) : '';
     const env = envLayer(layers.env);
+    const redactEnv = redactEnvNames(layers.env);
     const problems = [
         ...(layers.file ? validateConfig(layers.file.config, fileSource) : []),
         ...validateConfig(layers.inline, 'reporter options', { allowConfigFile: true }),
+        ...redactEnv.problems,
     ];
     if (problems.length > 0)
         throw new LoupeConfigError(problems);
@@ -115,5 +141,11 @@ export function resolveConfig(layers) {
         screenshots: { defaultView: merged.screenshots?.defaultView ?? 'side-by-side' },
         theme: merged.theme ?? 'system',
         aiPrompt: { includeStack: merged.aiPrompt?.includeStack ?? true },
+        redact: {
+            mode: merged.redact?.mode ?? 'extend',
+            patterns: (merged.redact?.patterns ?? []).map((pattern) => (pattern instanceof RegExp ? stateless(pattern) : pattern)),
+            // LOUPE_REDACT_ENV adds to the configured names: a higher layer never removes one.
+            env: [...new Set([...(merged.redact?.env ?? []), ...redactEnv.names])],
+        },
     };
 }

package/dist/config/types.d.ts

@@ -4,6 +4,8 @@
  */
 export declare const CATEGORY_MODES: readonly ['extend', 'replace'];
 export type CategoryMode = (typeof CATEGORY_MODES)[number];
+export declare const REDACT_MODES: readonly ['extend', 'replace'];
+export type RedactMode = (typeof REDACT_MODES)[number];
 export declare const CATEGORY_TARGETS: readonly ['message', 'stack', 'step', 'all'];
 export type CategoryTarget = (typeof CATEGORY_TARGETS)[number];
 export declare const SCREENSHOT_VIEWS: readonly ['side-by-side', 'slider', 'overlay', 'diff'];
@@ -53,6 +55,18 @@ export interface DimensionsConfig {
     auto?: boolean;
     definitions?: DimensionConfig[];
 }
+export interface RedactConfig {
+    /**
+     * Secret-looking names, for input step targets and source lines, and for
+     * HTTP header names. A string matches whole words (`auth` matches
+     * `x-auth-token`, not `Author`); a RegExp is tested as is.
+     */
+    patterns?: Array<string | RegExp>;
+    /** `extend` (default): `patterns` add to the default names. `replace`: only `patterns`; `[]` turns name-based redaction off. */
+    mode?: RedactMode;
+    /** Names of environment variables whose values are redacted everywhere in the report. Names only, never values. */
+    env?: string[];
+}
 export interface LoupeConfig {
     /** Folder the report is written to, relative to the Playwright config file. Default: `loupe-report`. */
     outputFolder?: string;
@@ -72,6 +86,8 @@ export interface LoupeConfig {
         /** Include each error's stack trace in the copyable AI prompt. Default: `true`. */
         includeStack?: boolean;
     };
+    /** Secret redaction in report.json and index.html. `LOUPE_REDACT_ENV` adds variable names. */
+    redact?: RedactConfig;
 }
 /** Inline reporter options: a config, plus the path of the config file. */
 export interface LoupeReporterOptions extends LoupeConfig {
@@ -121,4 +137,10 @@ export interface ResolvedConfig {
     aiPrompt: {
         includeStack: boolean;
     };
+    /** RegExps without the `g` and `y` flags; `env` merged from every layer, without duplicates. */
+    redact: {
+        mode: RedactMode;
+        patterns: Array<string | RegExp>;
+        env: string[];
+    };
 }

package/dist/config/types.js

@@ -3,6 +3,7 @@
  * reporter options. Every option is optional; see docs/config.md.
  */
 export const CATEGORY_MODES = ['extend', 'replace'];
+export const REDACT_MODES = ['extend', 'replace'];
 export const CATEGORY_TARGETS = ['message', 'stack', 'step', 'all'];
 export const SCREENSHOT_VIEWS = ['side-by-side', 'slider', 'overlay', 'diff'];
 export const THEMES = ['system', 'light', 'dark'];

package/dist/config/validate.d.ts

@@ -1,3 +1,5 @@
+/** An environment variable name, as `redact.env` and `LOUPE_REDACT_ENV` take them. */
+export declare const ENV_NAME: RegExp;
 /** Optimal string alignment distance: Levenshtein plus adjacent transpositions (`titel` → `title` is 1). */
 export declare function editDistance(a: string, b: string): number;
 /** The closest known key, when it is close enough to be a typo. */

package/dist/config/validate.js

@@ -1,6 +1,8 @@
 import { PALETTE_NAMES } from '../shared/palette.js';
-import { CATEGORY_MODES, CATEGORY_TARGETS, SCREENSHOT_VIEWS, THEMES } from './types.js';
+import { CATEGORY_MODES, CATEGORY_TARGETS, REDACT_MODES, SCREENSHOT_VIEWS, THEMES } from './types.js';
 const COLOR = /^#[0-9a-fA-F]{6}$/;
+/** An environment variable name, as `redact.env` and `LOUPE_REDACT_ENV` take them. */
+export const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** What a tag prefix cannot contain: `@layer:api` has the prefix `layer`. */
 const INVALID_PREFIX = /[@:\s]/;
 function describe(value) {
@@ -151,6 +153,37 @@ function values(ctx) {
         });
     };
 }
+/** Secret-looking names: non-empty strings or RegExps. An empty list is valid (with `mode: 'replace'`, it turns them off). */
+function namePatterns(ctx) {
+    return (value, path, errors) => {
+        if (!Array.isArray(value))
+            return fail(ctx, path, 'an array of strings or RegExps', value, errors);
+        value.forEach((item, index) => {
+            if (item instanceof RegExp)
+                return;
+            if (typeof item !== 'string' || item.trim() === '')
+                fail(ctx, `${path}[${index}]`, 'a non-empty string or a RegExp', item, errors);
+        });
+    };
+}
+/** Environment variable names. A value with other characters is most likely a secret pasted by mistake: it is not echoed. */
+function envNames(ctx) {
+    return (value, path, errors) => {
+        if (!Array.isArray(value))
+            return fail(ctx, path, 'an array of environment variable names', value, errors);
+        const seen = new Set();
+        value.forEach((item, index) => {
+            if (typeof item !== 'string' || !ENV_NAME.test(item)) {
+                const got = typeof item === 'string' ? 'a string that is not a variable name (value not shown)' : describe(item);
+                errors.push(`${ctx.source}: ${path}[${index}] must be an environment variable name (letters, digits, _), got ${got}`);
+                return;
+            }
+            if (seen.has(item))
+                errors.push(`${ctx.source}: ${path}[${index}] repeats the variable ${item}`);
+            seen.add(item);
+        });
+    };
+}
 function tagPrefix(ctx) {
     return (value, path, errors) => {
         if (typeof value !== 'string' || value === '' || INVALID_PREFIX.test(value)) {
@@ -228,6 +261,7 @@ export function validateConfig(value, source, options = {}) {
         screenshots: object({ defaultView: oneOf(SCREENSHOT_VIEWS, ctx) }, ctx),
         theme: oneOf(THEMES, ctx),
         aiPrompt: object({ includeStack: boolean(ctx) }, ctx),
+        redact: object({ patterns: namePatterns(ctx), mode: oneOf(REDACT_MODES, ctx), env: envNames(ctx) }, ctx),
     };
     if (options.allowConfigFile)
         fields['configFile'] = nonEmptyString(ctx);

package/dist/core/build.d.ts

@@ -2,6 +2,7 @@ import type { FullConfig, FullResult, Suite, TestError, TestStep } from '@playwr
 import type { LoupeReport, RunScope } from '../schema/v1.js';
 import { type CategoriesOptions, type ErrorText } from './categories.js';
 import { type DimensionsOptions } from './dimensions.js';
+import { type RedactOptions } from './redact.js';
 /** Folder, inside the report folder, that holds the copied attachments. */
 export declare const DATA_FOLDER = "data";
 export interface BuildOptions {
@@ -20,12 +21,14 @@ export interface BuildOptions {
         error: TestError;
         project: string | null;
     }>;
+    /** Secret redaction; default: the built-in names, no env values. */
+    redact?: RedactOptions;
 }
 /**
  * Titles of the failing steps leading to `error`, outermost first: the path to
  * the deepest step that ended with the same message. Empty when no step did.
  */
-export declare function failingSteps(steps: readonly TestStep[], error: TestError): string[];
+export declare function failingSteps(steps: readonly TestStep[], error: TestError, title?: (step: TestStep) => string): string[];
 /**
  * Text an error is categorized on. `steps`: titles of the failing steps, outermost first.
  * Run errors lose the `merge-reports` tag prefix, so rules match the same text merged or not.

package/dist/core/build.js

@@ -8,6 +8,7 @@ import { detectEnvironment, detectGit } from './metadata.js';
 import { collectOutput } from './output.js';
 import { esmImportLocation, isUsableLocation } from './runErrors.js';
 import { detectScopeReasons, resolveScope } from './scope.js';
+import { DEFAULT_REDACT, createRedactor, mapReportStrings } from './redact.js';
 import { errorSignature, stripAnsi, stripMergeTagPrefix } from './signature.js';
 /** Folder, inside the report folder, that holds the copied attachments. */
 export const DATA_FOLDER = 'data';
@@ -119,20 +120,20 @@ function isFocused(test) {
  * Titles of the failing steps leading to `error`, outermost first: the path to
  * the deepest step that ended with the same message. Empty when no step did.
  */
-export function failingSteps(steps, error) {
+export function failingSteps(steps, error, title = (step) => step.title) {
     const message = error.message ?? error.value;
     if (message === undefined)
         return [];
     for (const step of [...steps].reverse()) {
         if (!step.error || (step.error.message ?? step.error.value) !== message)
             continue;
-        return [step.title, ...failingSteps(step.steps, error)];
+        return [title(step), ...failingSteps(step.steps, error, title)];
     }
     // A step may fail with a wrapped message while one of its children has the exact one.
     for (const step of [...steps].reverse()) {
-        const inner = failingSteps(step.steps, error);
+        const inner = failingSteps(step.steps, error, title);
         if (inner.length > 0)
-            return [step.title, ...inner];
+            return [title(step), ...inner];
     }
     return [];
 }
@@ -151,6 +152,7 @@ export async function buildReport(config, suite, result, options) {
     const rootDir = config.rootDir;
     const store = new AttachmentStore(options.outputFolder);
     const categorizer = createCategorizer(options.categories ?? DEFAULT_CATEGORIES);
+    const redactor = createRedactor(options.redact ?? DEFAULT_REDACT);
     const dimensionSet = createDimensions(options.dimensions ?? DEFAULT_DIMENSIONS);
     const categories = new Set();
     const usedDimensions = new Set();
@@ -161,10 +163,11 @@ export async function buildReport(config, suite, result, options) {
     /**
      * `steps`: titles of the failing steps leading to the error, outermost first.
      * `runError`: the `merge-reports` tag prefix is ignored by categories and the signature, kept in `message` and `stack`.
+     * `redact`: applied to the message and the stack before the signature and the category, so they never depend on a secret.
      */
-    const toError = (error, steps = [], location = error.location, runError = false) => {
-        const message = stripAnsi(error.message ?? error.value ?? '');
-        const stack = error.stack ? stripAnsi(error.stack) : null;
+    const toError = (error, redact, steps = [], location = error.location, runError = false) => {
+        const message = redact(stripAnsi(error.message ?? error.value ?? ''));
+        const stack = error.stack ? redact(stripAnsi(error.stack)) : null;
         const category = categorizer.categorize(errorText(message, stack, steps, runError));
         categories.add(category);
         return {
@@ -176,17 +179,21 @@ export async function buildReport(config, suite, result, options) {
             category,
         };
     };
-    const toStep = (step, parents) => {
-        const chain = [...parents, step.title];
+    const toStep = (step, parents, redact) => {
+        const title = redact.title(step);
+        const chain = [...parents, title];
+        // `subtitle` exists from Playwright 1.63. Before, the target of an action is in
+        // the title on 1.52 (`locator.getByRole('button').click`), and nowhere on
+        // 1.53–1.62 (`Click`, `Fill "<value>"`).
+        const subtitle = step.subtitle;
         return {
-            title: step.title,
-            // `subtitle` exists from Playwright 1.61; older versions keep the target in the title.
-            subtitle: step.subtitle ?? null,
+            title,
+            subtitle: subtitle === undefined ? null : redact.text(subtitle),
             category: step.category,
             durationMs: toMs(step.duration),
-            error: step.error ? toError(step.error, chain) : null,
+            error: step.error ? toError(step.error, redact.text, chain) : null,
             location: toLocation(step.location),
-            steps: step.steps.map((child) => toStep(child, chain)),
+            steps: step.steps.map((child) => toStep(child, chain, redact)),
         };
     };
     const toAttempt = async (attempt, folder) => {
@@ -194,14 +201,15 @@ export async function buildReport(config, suite, result, options) {
         for (const attachment of attempt.attachments) {
             attachments.push(await store.add(`${folder}/${attempt.retry}`, attachment));
         }
+        const redact = redactor.attempt(attempt.steps);
         return {
             index: attempt.retry,
             status: attempt.status,
             startedAt: attempt.startTime.toISOString(),
             durationMs: toMs(attempt.duration),
             workerIndex: attempt.workerIndex,
-            errors: attempt.errors.map((error) => toError(error, failingSteps(attempt.steps, error))),
-            steps: attempt.steps.map((step) => toStep(step, [])),
+            errors: attempt.errors.map((error) => toError(error, redact.text, failingSteps(attempt.steps, error, redact.title))),
+            steps: attempt.steps.map((step) => toStep(step, [], redact)),
             attachments,
             annotations: attempt.annotations.map(toAnnotation),
             stdout: collectOutput(attempt.stdout),
@@ -292,9 +300,9 @@ export async function buildReport(config, suite, result, options) {
     for (const { error, project } of options.runErrors ?? []) {
         const message = stripAnsi(error.message ?? error.value ?? '');
         const location = isUsableLocation(error.location) ? error.location : ((await esmImportLocation(message)) ?? undefined);
-        errors.push({ ...toError(error, [], location, true), project });
+        errors.push({ ...toError(error, redactor.text, [], location, true), project });
     }
-    return {
+    const report = {
         schemaVersion: 1,
         generator: { name: 'playwright-loupe', version: options.generatorVersion },
         run: {
@@ -318,4 +326,6 @@ export async function buildReport(config, suite, result, options) {
         categories: categorizer.definitions(categories),
         dimensions: dimensionSet.definitions(usedDimensions),
     };
+    // URL parameters and env values (redact.env) are redacted in every other string: test titles, annotations, outputs, attachment bodies...
+    return redactor.rewritesStrings ? mapReportStrings(report, redactor.strings) : report;
 }

package/dist/core/categories.js

@@ -1,14 +1,7 @@
 import { NEUTRAL_ENTRY, PALETTE_ENTRIES, paletteReference } from '../shared/palette.js';
+import { httpStatus } from './http.js';
 const ALL_TARGETS = ['message', 'stack', 'step'];
 export const UNCATEGORIZED_COLOR = NEUTRAL_ENTRY.reference;
-/**
- * An HTTP status in context: `status 429`, `status code: 429`, `"status": 429`,
- * `statusCode=429`, `HTTP 429`, `HTTP/1.1 429`, `Response status: 429`, or
- * `← 429`, the response line of Playwright's fetch log.
- */
-function httpStatus(code) {
-    return new RegExp(`(?:\\b(?:status(?:[ _]?code)?["']?\\s*[:=]?|HTTP(?:/\\d(?:\\.\\d)?)?:?)|\u2190)\\s*${code}(?!\\w|\\.\\d)`, 'i');
-}
 export const BUILT_IN_RULES = [
     {
         // Before "Locator not found", "Assertion" and "Timeout": a locator matching
@@ -30,7 +23,7 @@ export const BUILT_IN_RULES = [
         // Before "Network", "Assertion" and "Timeout": the status is the diagnosis,
         // whether it surfaces through `failOnStatusCode`, `toBeOK()` or a thrown
         // error. A bare 429 is not enough (`429ms`, `Received: 429`): it needs an
-        // HTTP context.
+        // HTTP context (src/core/http.ts), shared with error signatures.
         name: 'Rate limited',
         color: paletteReference('teal'),
         match: [/\bToo Many Requests\b/i, /\brate[- ]?limit/i, httpStatus('429')],
@@ -39,10 +32,8 @@ export const BUILT_IN_RULES = [
     {
         name: 'Server error',
         color: paletteReference('orange'),
-        match: [
-            httpStatus('5\\d\\d'),
-            /\b5\d\d (?:Internal Server Error|Not Implemented|Bad Gateway|Service Unavailable|Gateway Time-?out|HTTP Version Not Supported)\b/i,
-        ],
+        // In an HTTP context, reason phrase included: `500 Internal Server Error` (failOnStatusCode).
+        match: [httpStatus('5\\d\\d')],
         targets: ['message', 'stack'],
     },
     {

package/dist/core/http.d.ts

@@ -0,0 +1,21 @@
+/**
+ * HTTP status codes in context, shared by the "Rate limited" and "Server
+ * error" categories and by error signatures, so both agree on what an HTTP
+ * status is. See "Error categories" and "Error signature" in docs/schema/v1.md.
+ *
+ * A code is in an HTTP context when it is:
+ * - preceded by `status`, `status code`, `statusCode`, `"status":`, `HTTP`,
+ *   `HTTP/1.1`, `error`, or `←` (the response line of Playwright's fetch log),
+ *   with an optional `:` or `=`: `status 429`, `Response status: 503`,
+ *   `HTTP 500`, `statusCode=502`, `with error 401`;
+ * - or followed by its reason phrase: `401 Unauthorized`, `500 Internal Server Error`.
+ *
+ * A bare number is not enough: `Timeout 429ms exceeded` and `Expected: 200
+ * Received: 500` have no HTTP context.
+ */
+/** Any status code from 100 to 599. */
+export declare const STATUS_CODE = "[1-5]\\d\\d";
+/** Source of a pattern matching `code` (a regex source such as `429` or `5\\d\\d`) in an HTTP context, case-insensitive. */
+export declare function httpStatusSource(code: string): string;
+/** `code` in an HTTP context. */
+export declare function httpStatus(code: string): RegExp;

package/dist/core/http.js

@@ -0,0 +1,64 @@
+/**
+ * HTTP status codes in context, shared by the "Rate limited" and "Server
+ * error" categories and by error signatures, so both agree on what an HTTP
+ * status is. See "Error categories" and "Error signature" in docs/schema/v1.md.
+ *
+ * A code is in an HTTP context when it is:
+ * - preceded by `status`, `status code`, `statusCode`, `"status":`, `HTTP`,
+ *   `HTTP/1.1`, `error`, or `←` (the response line of Playwright's fetch log),
+ *   with an optional `:` or `=`: `status 429`, `Response status: 503`,
+ *   `HTTP 500`, `statusCode=502`, `with error 401`;
+ * - or followed by its reason phrase: `401 Unauthorized`, `500 Internal Server Error`.
+ *
+ * A bare number is not enough: `Timeout 429ms exceeded` and `Expected: 200
+ * Received: 500` have no HTTP context.
+ */
+const PREFIX = `(?:\\b(?:status(?:[ _]?code)?["']?\\s*[:=]?|HTTP(?:/\\d(?:\\.\\d)?)?:?|error\\s*[:=]?)|←)`;
+/** Standard reason phrases (RFC 9110, plus 429). */
+const REASON_PHRASES = [
+    'Continue',
+    'Switching Protocols',
+    'OK',
+    'Created',
+    'Accepted',
+    'No Content',
+    'Moved Permanently',
+    'Found',
+    'See Other',
+    'Not Modified',
+    'Temporary Redirect',
+    'Permanent Redirect',
+    'Bad Request',
+    'Unauthorized',
+    'Payment Required',
+    'Forbidden',
+    'Not Found',
+    'Method Not Allowed',
+    'Not Acceptable',
+    'Request Time-?out',
+    'Conflict',
+    'Gone',
+    'Precondition Failed',
+    'Payload Too Large',
+    'Content Too Large',
+    'Unsupported Media Type',
+    'Unprocessable Entity',
+    'Unprocessable Content',
+    'Too Many Requests',
+    'Internal Server Error',
+    'Not Implemented',
+    'Bad Gateway',
+    'Service Unavailable',
+    'Gateway Time-?out',
+    'HTTP Version Not Supported',
+];
+/** Any status code from 100 to 599. */
+export const STATUS_CODE = '[1-5]\\d\\d';
+/** Source of a pattern matching `code` (a regex source such as `429` or `5\\d\\d`) in an HTTP context, case-insensitive. */
+export function httpStatusSource(code) {
+    return `${PREFIX}\\s*${code}(?!\\w|\\.\\d)|\\b${code} (?:${REASON_PHRASES.join('|')})\\b`;
+}
+/** `code` in an HTTP context. */
+export function httpStatus(code) {
+    return new RegExp(httpStatusSource(code), 'i');
+}

package/dist/core/redact.d.ts

@@ -0,0 +1,101 @@
+import type { RedactMode } from '../config/types.js';
+/**
+ * Secret redaction, applied by the core before signatures and categories are
+ * computed and before anything is written. Three mechanisms (see "Secret
+ * redaction" in docs/config.md):
+ *
+ * - A, input steps: the value typed by `fill`, `type`, `pressSequentially`,
+ *   `keyboard.type` or `keyboard.insertText` is replaced when the target
+ *   (step subtitle, from Playwright 1.63) or the source line of the call has a
+ *   secret-looking name. The same value is then redacted in the attempt's
+ *   errors (Playwright repeats it in the call log: `fill("<value>")`).
+ * - C, HTTP headers and URL parameters: values of header lines with a
+ *   secret-looking name, as Playwright prints them in call logs
+ *   (`- cookie: <value>`), and of URL query or fragment parameters with a
+ *   secret-looking name (`?token=<value>`), wherever URLs appear.
+ * - B, environment values: the values of the variables listed in
+ *   `redact.env`, everywhere in the report except snippets and attachment paths.
+ *
+ * A and C share one list of secret-looking names. Attachment files (traces,
+ * screenshots, videos) are never altered.
+ */
+/** What replaces a secret. */
+export declare const REDACTED = "[redacted]";
+/** Values shorter than this are only redacted in quoted form (A), or not used at all (B): too many false matches. */
+export declare const MIN_SECRET_LENGTH = 6;
+/**
+ * Default secret-looking names, for A (locators, source lines) and C (header
+ * and URL parameter names). A string matches whole words, see `createNameMatcher`; a RegExp is
+ * tested as is.
+ */
+export declare const DEFAULT_SECRET_NAMES: ReadonlyArray<string | RegExp>;
+/**
+ * Lowercase words of a name or a line: split on anything but ASCII letters and
+ * digits, and on camelCase boundaries (`passwordInput` → password, input;
+ * `APIKey` → api, key).
+ */
+export declare function words(text: string): string[];
+/**
+ * Tells whether a text has a secret-looking name. A string pattern matches
+ * consecutive whole words, case-insensitively, each word allowing a trailing
+ * "s": `auth` matches `x-auth-token` and `authToken` but not `Author`; `pin`
+ * matches `PIN code` but not `spinner`; `api key` matches `x-api-key`, `apiKey`
+ * and `API_KEY`. A RegExp is tested on the text as is.
+ */
+export declare function createNameMatcher(patterns: ReadonlyArray<string | RegExp>): (text: string) => boolean;
+export interface InputStep {
+    /** The title with the value replaced by `[redacted]`. */
+    redacted: string;
+    value: string;
+    /** Target written in the title (Playwright 1.52), null otherwise. */
+    target: string | null;
+}
+export declare function parseInputStep(title: string): InputStep | null;
+/** The part of a Playwright step redaction reads. */
+export interface StepLike {
+    title: string;
+    category: string;
+    location?: {
+        file: string;
+        line: number;
+    } | undefined;
+    steps: readonly StepLike[];
+}
+export interface RedactOptions {
+    /** `extend`: `patterns` add to the default names. `replace`: only `patterns`; `[]` turns A and C off. */
+    mode: RedactMode;
+    patterns: ReadonlyArray<string | RegExp>;
+    /** Values of the `redact.env` variables, already filtered by `secretValues`. */
+    values: readonly string[];
+    /** Reads a source file; null when it cannot be read. Default: from disk. */
+    readSource?: (file: string) => string | null;
+}
+export declare const DEFAULT_REDACT: RedactOptions;
+/** Redaction for the steps and errors of one attempt. */
+export interface AttemptRedactor {
+    /** A step title: input value (A), values typed in this attempt, URL parameters (C), env values (B). */
+    title(step: StepLike): string;
+    /** An error message or stack, a subtitle: values typed in this attempt, header values and URL parameters (C), env values (B). */
+    text(text: string): string;
+}
+export interface Redactor {
+    /** Finds the secret input steps of an attempt (A) and returns the redaction for its steps and errors. */
+    attempt(steps: readonly StepLike[]): AttemptRedactor;
+    /** Text outside any attempt (run errors): header values and URL parameters (C), env values (B). */
+    text(text: string): string;
+    /** Env values only (B). */
+    values(text: string): string;
+    /** URL parameters (C) and env values (B), for every other string of the report: outputs, annotations, test titles... */
+    strings(text: string): string;
+    /** False when `strings` never changes anything (no names and no env values): the report needs no rewriting pass. */
+    rewritesStrings: boolean;
+}
+export declare function createRedactor(options?: RedactOptions): Redactor;
+/**
+ * Values of the `redact.env` variables. A variable that is unset or empty, or
+ * whose value is shorter than MIN_SECRET_LENGTH, is left out with a warning
+ * that names the variable, never its value.
+ */
+export declare function secretValues(names: readonly string[], env: Readonly<Record<string, string | undefined>>, warn: (message: string) => void): string[];
+/** Applies `replace` to every string of a JSON value, except under KEPT_KEYS. Returns a copy. */
+export declare function mapReportStrings<T>(value: T, replace: (text: string) => string): T;

package/dist/core/redact.js

@@ -0,0 +1,254 @@
+import { readFileSync } from 'node:fs';
+/**
+ * Secret redaction, applied by the core before signatures and categories are
+ * computed and before anything is written. Three mechanisms (see "Secret
+ * redaction" in docs/config.md):
+ *
+ * - A, input steps: the value typed by `fill`, `type`, `pressSequentially`,
+ *   `keyboard.type` or `keyboard.insertText` is replaced when the target
+ *   (step subtitle, from Playwright 1.63) or the source line of the call has a
+ *   secret-looking name. The same value is then redacted in the attempt's
+ *   errors (Playwright repeats it in the call log: `fill("<value>")`).
+ * - C, HTTP headers and URL parameters: values of header lines with a
+ *   secret-looking name, as Playwright prints them in call logs
+ *   (`- cookie: <value>`), and of URL query or fragment parameters with a
+ *   secret-looking name (`?token=<value>`), wherever URLs appear.
+ * - B, environment values: the values of the variables listed in
+ *   `redact.env`, everywhere in the report except snippets and attachment paths.
+ *
+ * A and C share one list of secret-looking names. Attachment files (traces,
+ * screenshots, videos) are never altered.
+ */
+/** What replaces a secret. */
+export const REDACTED = '[redacted]';
+/** Values shorter than this are only redacted in quoted form (A), or not used at all (B): too many false matches. */
+export const MIN_SECRET_LENGTH = 6;
+/**
+ * Default secret-looking names, for A (locators, source lines) and C (header
+ * and URL parameter names). A string matches whole words, see `createNameMatcher`; a RegExp is
+ * tested as is.
+ */
+export const DEFAULT_SECRET_NAMES = [
+    // As a substring: newPassword, passwordConfirm, Passphrase, passwd.
+    /pass(?:word|wd|phrase)/i,
+    'pwd',
+    'passcode',
+    'secret',
+    'token',
+    'otp',
+    'totp',
+    'pin',
+    'api key',
+    'apikey',
+    'private key',
+    'credential',
+    'cookie',
+    'session',
+    'authorization',
+    'auth',
+    'bearer',
+    'jwt',
+    'csrf',
+    'xsrf',
+];
+/**
+ * Lowercase words of a name or a line: split on anything but ASCII letters and
+ * digits, and on camelCase boundaries (`passwordInput` → password, input;
+ * `APIKey` → api, key).
+ */
+export function words(text) {
+    return text
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((word) => word !== '');
+}
+/**
+ * Tells whether a text has a secret-looking name. A string pattern matches
+ * consecutive whole words, case-insensitively, each word allowing a trailing
+ * "s": `auth` matches `x-auth-token` and `authToken` but not `Author`; `pin`
+ * matches `PIN code` but not `spinner`; `api key` matches `x-api-key`, `apiKey`
+ * and `API_KEY`. A RegExp is tested on the text as is.
+ */
+export function createNameMatcher(patterns) {
+    const regexps = patterns.filter((pattern) => pattern instanceof RegExp);
+    const sequences = patterns.filter((pattern) => typeof pattern === 'string').map(words).filter((list) => list.length > 0);
+    if (regexps.length === 0 && sequences.length === 0)
+        return () => false;
+    return (text) => {
+        if (regexps.some((pattern) => pattern.test(text)))
+            return true;
+        if (sequences.length === 0)
+            return false;
+        const textWords = words(text);
+        return sequences.some((sequence) => textWords.some((_, start) => sequence.every((word, offset) => {
+            const candidate = textWords[start + offset];
+            return candidate === word || candidate === `${word}s`;
+        })));
+    };
+}
+/**
+ * Value input steps, as Playwright titles them:
+ * - 1.53+: `Fill "<value>"`, `Type "<value>"` (`type`, `pressSequentially`,
+ *   `keyboard.type`), `Insert "<value>"` (`keyboard.insertText`). Quotes in
+ *   the value are not escaped, so the value runs to the last quote; newlines
+ *   are written `\n`.
+ * - 1.52: `locator.fill(<value>)`, `locator.getByLabel('Password').type(<value>)`,
+ *   `locator.getByLabel('Password').pressSequentially(<value>)`,
+ *   `keyboard.type(<value>)`, `keyboard.insertText(<value>)`. The target is
+ *   part of the title for `type` and `pressSequentially` only.
+ */
+const INPUT_TITLE = /^(Fill|Type|Insert) "([\s\S]*)"$/;
+const LEGACY_INPUT_TITLE = /^((?:locator|page|frame|keyboard|elementHandle)\b.*?)\.(fill|type|pressSequentially|insertText)\(([\s\S]*)\)$/;
+export function parseInputStep(title) {
+    const current = INPUT_TITLE.exec(title);
+    if (current)
+        return { redacted: `${current[1]} "${REDACTED}"`, value: current[2], target: null };
+    const legacy = LEGACY_INPUT_TITLE.exec(title);
+    if (legacy) {
+        const [, target, action, value] = legacy;
+        return { redacted: `${target}.${action}(${REDACTED})`, value, target };
+    }
+    return null;
+}
+/**
+ * A header line as Playwright prints it in a call log (`  - cookie: <value>`),
+ * or a bare `Name: value` line. Header names are tokens: no spaces.
+ */
+const HEADER_LINE = /^([ \t]*(?:-[ \t]+)?)([A-Za-z0-9!#$%&'*+.^_`|~-]+):[ \t]+\S.*$/gm;
+/**
+ * A URL query or fragment parameter: `?token=<value>`, `&access_token=<value>`,
+ * `#access_token=<value>` (OAuth implicit flow). Only after `?`, `&` or `#`, so
+ * a bare `token=abc` in prose is left alone. The value stops at the next
+ * parameter, the fragment, whitespace, a quote, a bracket or a parenthesis.
+ */
+const URL_PARAM = /([?&#])([A-Za-z0-9_.~%-]+)=(\[redacted\]|[^&#\s"'`<>()[\]]+)/g;
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Replaces every occurrence of `values` with `[redacted]`, longest first. An
+ * existing `[redacted]` is left alone, so applying it twice changes nothing
+ * even when a value is part of the word "redacted".
+ */
+function valueReplacer(values) {
+    const unique = [...new Set(values)].filter((value) => value !== '').sort((a, b) => b.length - a.length);
+    if (unique.length === 0)
+        return (text) => text;
+    const pattern = new RegExp([escapeRegExp(REDACTED), ...unique.map(escapeRegExp)].join('|'), 'g');
+    return (text) => text.replace(pattern, REDACTED);
+}
+export const DEFAULT_REDACT = { mode: 'extend', patterns: [], values: [] };
+function readFromDisk(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+export function createRedactor(options = DEFAULT_REDACT) {
+    const namePatterns = options.mode === 'extend' ? [...DEFAULT_SECRET_NAMES, ...options.patterns] : options.patterns;
+    const names = createNameMatcher(namePatterns);
+    const envValues = valueReplacer(options.values);
+    const readSource = options.readSource ?? readFromDisk;
+    const sources = new Map();
+    /** The source line of a step, from disk; null when the file cannot be read (merge-reports without the code). */
+    const sourceLine = (location) => {
+        if (!location)
+            return null;
+        if (!sources.has(location.file))
+            sources.set(location.file, readSource(location.file)?.split(/\r?\n/) ?? null);
+        return sources.get(location.file)?.[location.line - 1] ?? null;
+    };
+    const headers = (text) => text.replace(HEADER_LINE, (line, indent, name) => (names(name) ? `${indent}${name}: ${REDACTED}` : line));
+    const urlParams = (text) => text.replace(URL_PARAM, (param, separator, name) => (names(name) ? `${separator}${name}=${REDACTED}` : param));
+    /** A: the target (subtitle from 1.63, title on 1.52), else the source line of the call, has a secret-looking name. */
+    const isSecret = (step, input) => {
+        const subtitle = step.subtitle;
+        if (typeof subtitle === 'string' && names(subtitle))
+            return true;
+        if (input.target !== null && names(input.target))
+            return true;
+        const line = sourceLine(step.location);
+        return line !== null && names(line);
+    };
+    return {
+        rewritesStrings: namePatterns.length > 0 || options.values.length > 0,
+        text: (text) => envValues(urlParams(headers(text))),
+        values: envValues,
+        strings: (text) => envValues(urlParams(text)),
+        attempt(steps) {
+            const titles = new Map();
+            const typed = new Set();
+            const visit = (list) => {
+                for (const step of list) {
+                    const input = step.category === 'pw:api' ? parseInputStep(step.title) : null;
+                    if (input && isSecret(step, input)) {
+                        titles.set(step, input.redacted);
+                        typed.add(input.value);
+                        // Titles from 1.53 write newlines as `\n`; call logs keep the real ones.
+                        typed.add(input.value.replaceAll('\\n', '\n'));
+                    }
+                    visit(step.steps);
+                }
+            };
+            visit(steps);
+            // A short value (a PIN) would also match line numbers and other text: only its quoted form is redacted.
+            const long = [...typed].filter((value) => value.length >= MIN_SECRET_LENGTH);
+            const short = [...typed].filter((value) => value !== '' && value.length < MIN_SECRET_LENGTH).map((value) => `"${value}"`);
+            const replaceLong = valueReplacer(long);
+            const shortPattern = short.length > 0 ? new RegExp(short.map(escapeRegExp).join('|'), 'g') : null;
+            const typedValues = (text) => {
+                const replaced = replaceLong(text);
+                return shortPattern ? replaced.replace(shortPattern, `"${REDACTED}"`) : replaced;
+            };
+            return {
+                title: (step) => envValues(urlParams(titles.get(step) ?? typedValues(step.title))),
+                text: (text) => envValues(urlParams(headers(typedValues(text)))),
+            };
+        },
+    };
+}
+/**
+ * Values of the `redact.env` variables. A variable that is unset or empty, or
+ * whose value is shorter than MIN_SECRET_LENGTH, is left out with a warning
+ * that names the variable, never its value.
+ */
+export function secretValues(names, env, warn) {
+    const values = [];
+    for (const name of names) {
+        const value = env[name];
+        if (value === undefined || value === '') {
+            warn(`Loupe: redact.env: ${name} is not set or empty; nothing to redact for it.`);
+        }
+        else if (value.length < MIN_SECRET_LENGTH) {
+            warn(`Loupe: redact.env: the value of ${name} is shorter than ${MIN_SECRET_LENGTH} characters and is not redacted (too many false matches).`);
+        }
+        else {
+            values.push(value);
+        }
+    }
+    return values;
+}
+/**
+ * Keys whose strings B never rewrites: identifiers and signatures (hex that a
+ * short value could match), snippets (source code, already in the
+ * repository) and attachment paths (the files keep their names).
+ */
+const KEPT_KEYS = new Set(['id', 'signature', 'errorSignature', 'snippet', 'path']);
+/** Applies `replace` to every string of a JSON value, except under KEPT_KEYS. Returns a copy. */
+export function mapReportStrings(value, replace) {
+    const visit = (node) => {
+        if (typeof node === 'string')
+            return replace(node);
+        if (Array.isArray(node))
+            return node.map(visit);
+        if (node !== null && typeof node === 'object') {
+            return Object.fromEntries(Object.entries(node).map(([key, child]) => [key, KEPT_KEYS.has(key) ? child : visit(child)]));
+        }
+        return node;
+    };
+    return visit(value);
+}

package/dist/core/reporter.d.ts

@@ -11,6 +11,8 @@ interface ErrorWorkerInfo {
 }
 export declare class LoupeReporter implements Reporter {
     private readonly loupeConfig;
+    /** Values of the `redact.env` variables, read once at startup. */
+    private readonly secretValues;
     private readonly scopeOverride;
     private readonly runErrors;
     private config;

package/dist/core/reporter.js

@@ -4,12 +4,15 @@ import path from 'node:path';
 import { loadConfig } from '../config/index.js';
 import { buildReport } from './build.js';
 import { injectData, injectSettings } from './inject.js';
+import { secretValues } from './redact.js';
 import { SCOPE_ENV, parseScopeOverride } from './scope.js';
 import { generatorVersion } from './version.js';
 /** Built renderer template, shipped next to the compiled core (`dist/renderer/index.html`). */
 const TEMPLATE_URL = new URL('../renderer/index.html', import.meta.url);
 export class LoupeReporter {
     loupeConfig;
+    /** Values of the `redact.env` variables, read once at startup. */
+    secretValues;
     scopeOverride;
     runErrors = [];
     config;
@@ -20,6 +23,8 @@ export class LoupeReporter {
         // run with its message, which no later reporter hook can do.
         this.scopeOverride = parseScopeOverride(process.env[SCOPE_ENV]);
         this.loupeConfig = loadConfig(options);
+        // After the config is loaded; warnings name a variable, never its value.
+        this.secretValues = secretValues(this.loupeConfig.redact.env, process.env, (message) => console.warn(message));
     }
     printsToStdio() {
         return false;
@@ -47,6 +52,7 @@ export class LoupeReporter {
             categories: this.loupeConfig.categories,
             dimensions: this.loupeConfig.dimensions,
             runErrors: this.runErrors,
+            redact: { mode: this.loupeConfig.redact.mode, patterns: this.loupeConfig.redact.patterns, values: this.secretValues },
         });
         const settings = {
             title: this.loupeConfig.title,

package/dist/core/signature.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { STATUS_CODE, httpStatusSource } from './http.js';
 // Same pattern as the `ansi-regex` package (CSI and OSC sequences).
 const ANSI_PATTERN = /[\u001B\u009B][[\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\d/#&.:=?%@~_]+)*|[a-zA-Z\d]+(?:;[-a-zA-Z\d/#&.:=?%@~_]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-ntqry=><~]))/g;
 export function stripAnsi(text) {
@@ -78,8 +79,14 @@ const REPLACEMENTS = [
     [/\b\d+(?:\.\d+)?\s?(?:ms|milliseconds?|s|secs?|seconds?|m|mins?|minutes?|h|hours?)\b/gi, '<duration>'],
     // 8+ hex chars with at least one letter (pure digit runs fall through to <n>).
     [/(?<![0-9A-Za-z])(?=[0-9a-f]*[a-f])[0-9a-f]{8,}(?![0-9A-Za-z])/gi, '<hex>'],
-    [/\d+(?:\.\d+)?/g, '<n>'],
 ];
+/**
+ * Last replacement: remaining numbers become `<n>`, except HTTP status codes
+ * (100–599) in an HTTP context, kept with their context so `error 401` and
+ * `error 500` stay apart. Same context as the "Rate limited" and "Server
+ * error" categories (src/core/http.ts).
+ */
+const STATUS_OR_NUMBER = new RegExp(`(${httpStatusSource(STATUS_CODE)})|\\d+(?:\\.\\d+)?`, 'gi');
 /**
  * Normalizes an error message so the same failure produces the same text
  * across tests, retries and runs: ANSI codes and the call log are removed,
@@ -97,6 +104,7 @@ export function normalizeErrorMessage(message, options = {}) {
     for (const [pattern, placeholder] of REPLACEMENTS) {
         text = text.replace(pattern, placeholder);
     }
+    text = text.replace(STATUS_OR_NUMBER, (_match, status) => status ?? '<n>');
     return text.replace(/\s+/g, ' ').trim();
 }
 /** First 12 hex chars of sha256 of the normalized message. Independent of the test. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qartisan/playwright-loupe",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "HTML reporter for Playwright: dashboard, error groups by normalized signature, tests by project and suite, dimensions from tags and annotations.",
   "keywords": [
     "playwright",