@tracelane/wdio 0.1.0-alpha.22 → 0.1.0-alpha.24

package/README.md

@@ -2,13 +2,16 @@
 
 # @tracelane/wdio
 
-> The recorder for your WebdriverIO and Playwright tests — Cypress on the roadmap. Self-contained HTML for every run — replay failures, audit successes, attach to any bug tracker. No SaaS, no dashboard, no signup.
+> The recorder for your WebdriverIO tests. Self-contained HTML for every run — replay failures, audit successes, attach to any bug tracker. No SaaS, no dashboard, no signup. (Playwright is available via [`@tracelane/playwright`](https://github.com/Cubenest/rrweb-stack/tree/main/packages/tracelane-playwright); Cypress is on the roadmap.)
 
 [![npm](https://img.shields.io/npm/v/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
 [![downloads](https://img.shields.io/npm/dw/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
 [![license](https://img.shields.io/npm/l/@tracelane/wdio.svg)](https://github.com/Cubenest/rrweb-stack/blob/main/LICENSE)
 [![CI](https://github.com/Cubenest/rrweb-stack/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Cubenest/rrweb-stack/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Cubenest/rrweb-stack/badge)](https://scorecard.dev/viewer/?uri=github.com/Cubenest/rrweb-stack)
+[![types](https://img.shields.io/npm/types/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
+[![node](https://img.shields.io/node/v/@tracelane/wdio.svg)](https://www.npmjs.com/package/@tracelane/wdio)
+![status: alpha](https://img.shields.io/badge/status-alpha-orange.svg)
 
 ![tracelane install — one command](https://raw.githubusercontent.com/Cubenest/rrweb-stack/main/assets/tracelane-hero.gif)
 
@@ -82,7 +85,7 @@ export const config: Options.Testrunner = {
 };
 ```
 
-`webdriverio` and `@wdio/types` are **peer dependencies** (`^9.0.0`); you already have them in a WDIO project.
+`webdriverio` and `@wdio/types` are **peer dependencies** (`^9.0.0`); you already have them in a WDIO project. Node **>= 22** is required (a common first-run failure on older runtimes).
 
 ## How it works
 
@@ -92,6 +95,8 @@ export const config: Options.Testrunner = {
 
 **Content-Security-Policy**: rrweb capture requires in-page script evaluation. If a page's CSP blocks `'unsafe-eval'`, capture degrades gracefully — the test still runs and completes normally, a warning is logged once, but no replay is recorded for the affected page.
 
+For what `tracelane` captures, masks, and never sends off your machine, see the [security notes](https://github.com/Cubenest/rrweb-stack/blob/main/docs/SECURITY-NOTES.md).
+
 ## Options
 
 | Option | Type | Default | Notes |
@@ -102,10 +107,13 @@ export const config: Options.Testrunner = {
 | `capture.network` | `boolean` | `true` | Capture network requests via the in-page `rrweb/network@1` plugin — all browsers, no CDP. Privacy-first: only URL/method/status/timing by default (headers + bodies off; opt in via `capture.networkOptions`). CDP is an optional fallback that adds authoritative status + true no-response failures where it's available. |
 | `capture.networkOptions` | `NetworkRecordOptions` | plugin defaults | Forwarded to the in-page network plugin (`recordHeaders`, `recordBody`, `maskRequestFn`, `payloadHostDenyList`, …). Defaults are privacy-first (headers + bodies off). Ignored when `capture.network` is `false`. |
 | `capture.console` | `boolean` | `true` | Capture `console.*` via the rrweb console plugin. Setting this `false` also drops any `[tracelane.net]` network-error lines from the CDP fallback path, since those surface through `console.error`. |
+| `consolePluginOptions` | `ConsolePluginOptions` | plugin defaults | Forwarded to the in-page rrweb console plugin. Ignored when `capture.console` is `false` (which instead passes `{ level: [] }` to patch no methods). |
 | `drainIntervalMs` | `number` | `500` | Node-side drain poll interval. |
 | `cooldownMs` | `number` | `250` | Re-injection cooldown guard (suppresses double-init on hash/HMR navigation). |
+| `security` | `boolean` | `true` | Advisory security-hygiene signals (`[tracelane.sec]`) captured during the run and analyzed in the report. Set `false` to disable both the capture and the analysis. When on, an optional `tracelane.security.suppress.json` in the project cwd silences known-acceptable signals (missing/malformed file degrades to no suppressions). |
 | `allure` | `boolean` | `false` | Reserved for the v1.1 Allure shim. No-op in v1. |
 | `visualDiff` | `boolean` | `false` | Reserved for the post-MVP visual-diff add-on. No-op in v1. |
+| `report.footer` | `boolean` | `true` | Show the tool-credit footer in the generated HTML report. Set `false` to suppress it. |
 
 The options type is published — `import type { TraceLaneOptions } from '@tracelane/wdio'`.
 
@@ -145,7 +153,6 @@ Privacy-first by default: only **URL, method, status, and timing** are captured.
 
 When a CDP-capable session is present, `tracelane` *additionally* uses `browser.cdp(...)` to capture **authoritative HTTP status** for failed responses (`status >= 400`) and **true no-response failures** (CORS/DNS/offline/abort) that the page wrappers can't always see. These are routed into the report's console timeline (prefixed `[tracelane.net]`) and the report merges them over the in-page rows for the same request (real status wins). To enable it:
 
-- **WDIO 8:** add `['devtools', {}]` via `@wdio/devtools-service@8`.
 - **WDIO 9:** `@wdio/devtools-service` has no stable v9 line (it stabilized at v10); use the v10 service or a CDP-capable session.
 
 If CDP is unavailable (cloud Selenium, Firefox, Safari), nothing is lost beyond the CDP-only authoritative-status enhancement — the in-page plugin still populates the network panel and the report is still produced.
@@ -167,7 +174,7 @@ If CDP is unavailable (cloud Selenium, Firefox, Safari), nothing is lost beyond
 
 ## Playwright + Cypress
 
-The tagline says Playwright and Cypress because the design is portable across runners — same `@tracelane/core` engine, different glue. Tracking issues:
+The design is portable across runners — same `@tracelane/core` engine, different glue. Tracking issues:
 
 - **`@tracelane/playwright`** — Playwright Reporter implementing `onTestEnd` + `onAttachment` for shareable HTML. Targeted for week 2-3 of the public launch.
 - **`@tracelane/cypress`** — JSON-output adapter only (no Cypress Test Replay overlap). Targeted for week 11.
@@ -176,7 +183,7 @@ Watch the [release notes](https://github.com/Cubenest/rrweb-stack/releases) on `
 
 ## Versioning & telemetry
 
-Semantic Versioning. Currently `0.1.0-alpha.x` (pre-release; the API may shift before `1.0.0`). See [SUPPORTED.md](https://github.com/Cubenest/rrweb-stack/blob/main/SUPPORTED.md) for the compatibility matrix.
+Semantic Versioning. Currently `0.1.0-alpha.x` (pre-release; the API may shift before `1.0.0`). See [SUPPORTED.md](https://github.com/Cubenest/rrweb-stack/blob/main/SUPPORTED.md) for the compatibility matrix and the [CHANGELOG](https://github.com/Cubenest/rrweb-stack/blob/main/packages/tracelane-wdio/CHANGELOG.md) for release history.
 
 **No telemetry.** `tracelane` collects and sends nothing; reports are written to your local `outDir` only. The generated HTML report includes a footer crediting the tool; you can suppress it with `report: { footer: false }`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tracelane/wdio",
-  "version": "0.1.0-alpha.22",
+  "version": "0.1.0-alpha.24",
   "description": "WebdriverIO Service that records rrweb sessions and writes a self-contained HTML report on failed tests. The user-facing tracelane integration for WDIO.",
   "keywords": [
     "tracelane",
@@ -38,24 +38,24 @@
     "README.md"
   ],
   "dependencies": {
-    "@tracelane/core": "0.1.0-alpha.16",
-    "@tracelane/report": "0.1.0-alpha.19"
+    "@tracelane/core": "0.1.0-alpha.18",
+    "@tracelane/report": "0.1.0-alpha.21"
   },
   "peerDependencies": {
     "@wdio/types": "^9.0.0",
     "webdriverio": "^9.0.0"
   },
   "devDependencies": {
-    "@wdio/cli": "^9.0.0",
-    "@wdio/globals": "^9.0.0",
-    "@wdio/local-runner": "^9.0.0",
-    "@wdio/mocha-framework": "^9.0.0",
-    "@wdio/spec-reporter": "^9.0.0",
-    "@wdio/types": "^9.0.0",
-    "esbuild": "^0.28.0",
-    "tsx": "^4.19.0",
-    "webdriverio": "^9.0.0",
-    "@cubenest/rrweb-core": "0.1.0-alpha.6"
+    "@wdio/cli": "^9.29.0",
+    "@wdio/globals": "^9.29.0",
+    "@wdio/local-runner": "^9.29.0",
+    "@wdio/mocha-framework": "^9.29.0",
+    "@wdio/spec-reporter": "^9.29.0",
+    "@wdio/types": "^9.29.0",
+    "esbuild": "^0.28.1",
+    "tsx": "^4.22.4",
+    "webdriverio": "^9.29.0",
+    "@cubenest/rrweb-core": "0.1.0-alpha.7"
   },
   "publishConfig": {
     "access": "public",