reporting-labs 0.6.6 → 0.6.8

package/README.md

@@ -19,7 +19,7 @@ Today it ships with a **Playwright** reporter. WebdriverIO, Cypress and Jest/Vit
 **1. Install**
 
 ```bash
-npm i -D reporting-labs
+npm i -D reporting-labs@latest
 ```
 
 **2. Create the config file**
@@ -134,7 +134,7 @@ await testData(rowsFromExcelOrJson, 'Coupons');                           // arr
 await testData(fs.readFileSync('data/users.csv', 'utf8'), 'users.csv');   // CSV text → table
 ```
 
-**Secrets are masked automatically**, wherever they show up: `console.log` output, `log()` lines, `testData()` blocks, API headers and bodies, step titles and assertion messages. Covered forms: `password=x`, `Password: x`, `{ password: 'x' }`, `"password":"x"`, `X-Api-Key: x`, `access_token=x`, "password is x", "with password S3cret@1", `Bearer ...` / `Basic ...`, JWTs, and well-known token formats (GitHub, AWS, Slack, Stripe, Google, GitLab, npm, SendGrid). A failing `expect(token)` shows `Received: "****"`. Add your own keys with `maskKeys: ['otp', 'pan']` in the config; they apply to text too.
+**Secrets are masked automatically**, wherever they show up: `console.log` output, `log()` lines, `testData()` blocks, API headers and bodies, step titles and assertion messages. Covered forms: `password=x`, `Password: x`, `{ password: 'x' }`, `"password":"x"`, `X-Api-Key: x`, `access_token=x`, "password is x", "with password S3cret@1", `Bearer ...` / `Basic ...`, JWTs, and well-known token formats (GitHub, AWS, Slack, Stripe, Google, GitLab, npm, SendGrid). A failing `expect(token)` shows `Received: "****"`. Also `user:pass@host` in URLs, `curl -u user:pass`, `credentials user:pass`, `password for user X is Y`, `Typed x into password field`, and Luhn-valid card numbers. The masker remembers every value it has masked (and the values of `PASSWORD` / `API_TOKEN` / `*_SECRET` environment variables), so a secret that later appears with no key at all (`Logging in as admin / s3cret`) is blanked too. Add your own keys with `maskKeys: ['otp', 'pan']` and values it cannot know about with `maskValues: [process.env.PASSWORD]`; `maskFromEnv: false` turns the environment learning off.
 
 ## API calls: recorded on their own
 
@@ -303,10 +303,15 @@ Every option is optional. `npx reporting-labs init` writes them all, with commen
 | `title` | `'Test report'` | Title in the header |
 | `logo` | – | Your logo next to the title: `'logo.png'` (a file next to the config, embedded in the report) or an https URL |
 | `project` | – | `{ name, version, team, url }` shown under the title |
-| `metadata` | `{}` | Chips in the header, e.g. `{ env: 'staging', build: '#1842' }`. `build` labels the run in the trend; in CI the run number is used when it is not set |
+| `metadata` | `{}` | Chips in the header, e.g. `{ env: 'staging', build: '#1842' }`. `build` labels the run in the trend; in CI the run number is used when it is not set. The environment name is also read from the process environment and wins over `env` here: `ENV`, `TEST_ENV`, `APP_ENV`, `TARGET_ENV` and friends, or any variable ending in `_ENV` / `_ENVIRONMENT` (`OPENCART_ENV`), so a config that says `local` still labels CI reports `dev`, `qa`, `stage` |
+| `envVar` | – | Name of the variable that holds the environment name, when the detection cannot guess it |
+
+**Runtime overrides.** `REPORTING_LABS_METADATA_<KEY>` sets a header chip from the environment (`REPORTING_LABS_METADATA_ENV=qa`, `REPORTING_LABS_METADATA_RELEASE=2.3`) and `REPORTING_LABS_TITLE`, `_THEME`, `_PALETTE`, `_ACCENT`, `_LOGO` the matching option; they win over the config. The env chip resolves in this order: `REPORTING_LABS_METADATA_ENV`, the variable `envVar` names, the conventional names (`ENV`, `TEST_ENV`, `APP_ENV`, `TARGET_ENV`, `CI_ENVIRONMENT_NAME`, anything ending in `_ENV`), then `metadata.env` in the config.
 | `env` | – | Extra rows on the Environment card |
 | `links` | `{}` | Turn meta keys into links. `{id}` is replaced by the value. An object `{ url, display }` builds the URL from several fields of an object passed to `meta()`, see below |
 | `maskKeys` | `[]` | Extra keys to mask as `****` |
+| `maskValues` | `[]` | Literal values to blank wherever they appear, keyed or not |
+| `maskFromEnv` | `true` | Learn the values of sensitive-looking environment variables (`PASSWORD`, `API_TOKEN`) and blank them everywhere |
 | `dimensions` | `['priority','severity','feature','owner']` | Which `meta()` keys get a tab in the Breakdown chart and a dropdown filter on the Tests page. Add your own key, e.g. `'team'`, to get a chart for it |
 | `dimensionOrder` | P0…P4, blocker…trivial | The order values appear in those charts and filters. Only needed for your own values, e.g. `{ severity: ['high','medium','low'] }` |
 | `widgets` | all on | Hide cards: `{ tags: false, timeline: false, ... }`. Failure clusters and the Trend chart are always shown |

package/dist/mask.d.ts

@@ -1,7 +1,14 @@
-export declare function makeMasker(extraKeys?: string[]): {
+export interface MaskerOptions {
+    /** Literal values to blank wherever they appear, keyed or not. */
+    knownValues?: string[];
+    /** Learn the values of PASSWORD / API_TOKEN / *_SECRET environment variables (default true). */
+    fromEnv?: boolean;
+}
+export declare function makeMasker(extraKeys?: string[], opts?: MaskerOptions): {
     mask: (v: unknown, key?: string) => unknown;
     maskStr: (input: string) => string;
     isSensitive: (k: string) => boolean;
+    learn: (value: unknown, minLength?: number) => void;
 };
 export declare function parseCsv(text: string): {
     columns: string[];

package/dist/mask.js

@@ -18,24 +18,93 @@ const VALUE_PATTERNS = [
     /\bnpm_[A-Za-z0-9]{30,}\b/g, // npm
     /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, // SendGrid
 ];
+/** 13 to 19 digits, spaces or dashes between groups allowed; masked only when the Luhn check passes. */
+const CARD_NUMBER = /(?<![\w.-])\d(?:[ -]?\d){12,18}(?![\w.-])/g;
+const luhn = (s) => { let sum = 0, dbl = false, digits = 0; for (let i = s.length - 1; i >= 0; i--) {
+    const c = s.charCodeAt(i);
+    if (c < 48 || c > 57)
+        continue;
+    let d = c - 48;
+    digits++;
+    if (dbl) {
+        d *= 2;
+        if (d > 9)
+            d -= 9;
+    }
+    sum += d;
+    dbl = !dbl;
+} return digits >= 13 && sum % 10 === 0; };
+/** Auth schemes and placeholders that follow a sensitive key but are not the secret. */
+const NOT_A_VALUE = new Set(['bearer', 'basic', 'digest', 'token', 'undefined', 'redacted', 'hidden', 'secret', 'password']);
 /** Words after "password is ..." that are plainly not a secret. */
 const NOT_A_SECRET = new Set(['valid', 'invalid', 'visible', 'hidden', 'required', 'optional', 'missing', 'empty', 'null', 'undefined', 'none',
     'correct', 'incorrect', 'wrong', 'right', 'expired', 'set', 'unset', 'not', 'present', 'absent', 'ok', 'true', 'false', 'masked', 'blank',
     'too', 'the', 'a', 'an', 'same', 'different', 'changed', 'unchanged', 'shown', 'displayed', 'accepted', 'rejected', 'weak', 'strong']);
 const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-function makeMasker(extraKeys = []) {
+function makeMasker(extraKeys = [], opts = {}) {
     const keys = [...DEFAULT_KEYS, ...extraKeys.map(k => k.toLowerCase())];
     const isSensitive = (k) => { const l = k.toLowerCase(); return keys.some(s => l === s || l.includes(s)); };
+    // ---- values already known to be secrets ----
+    // Every value the key patterns have masked, the values under sensitive keys in data blocks and API
+    // calls, `maskValues`, and sensitive-looking environment variables. Once known, a value is blanked
+    // wherever it shows up later, keyed or not: "Logging in as admin / s3cret" is masked because
+    // "password=s3cret" (or a PASSWORD env var) came first.
+    const learned = new Set();
+    let learnedRe = null, learnedDirty = false;
+    const MAX_LEARNED = 500;
+    const learn = (value, minLength = 4) => {
+        if (typeof value !== 'string')
+            return;
+        let v = value.trim();
+        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
+            v = v.slice(1, -1);
+        if (v.length < minLength || v.includes('***') || !/[A-Za-z0-9]/.test(v) || learned.size >= MAX_LEARNED)
+            return;
+        const word = v.toLowerCase().replace(/[^a-z0-9]/g, '');
+        if (NOT_A_SECRET.has(word) || NOT_A_VALUE.has(word))
+            return;
+        if (!learned.has(v)) {
+            learned.add(v);
+            learnedDirty = true;
+        }
+    };
+    const learnedPattern = () => {
+        if (!learnedDirty)
+            return learnedRe;
+        const vals = [...learned].sort((a, b) => b.length - a.length); // longest first
+        learnedRe = vals.length ? new RegExp(vals.map(v => /^[A-Za-z0-9_]+$/.test(v) ? `(?<![A-Za-z0-9_])${esc(v)}(?![A-Za-z0-9_])` : esc(v)).join('|'), 'g') : null;
+        learnedDirty = false;
+        return learnedRe;
+    };
+    for (const v of opts.knownValues ?? [])
+        learn(v, 4);
+    if (opts.fromEnv !== false) {
+        // PASSWORD=…, API_TOKEN=…, OAUTH_CLIENT_SECRET=… in the environment: the values a CI job injects are the
+        // ones that end up in log lines. Short values are skipped so a plain word is not blanked everywhere.
+        try {
+            for (const [k, v] of Object.entries(process.env))
+                if (isSensitive(k))
+                    learn(v, 6);
+        }
+        catch { /* no env access */ }
+    }
     // Key names as they appear in free text: password, X-Api-Key, access_token, userPassword, "password", db.password...
     // `auth`, `otp`, `pin`... are matched as whole words only, so "author" or "pinned" stay untouched.
-    const compound = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[_-]?key', 'cookie', 'credentials?', 'private[_-]?key', 'access[_-]?key', 'session[_-]?id', ...extraKeys.map(esc)];
-    const exact = ['authorization', 'auth', 'otp', 'pin', 'cvv', 'ssn'];
-    const KEY = `(?:[\\w.-]*?(?:${compound.join('|')})[\\w-]*|${exact.join('|')})`;
+    const compound = ['password', 'passwort', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[ _-]?key', 'cookie', 'credentials?', 'private[ _-]?key', 'access[ _-]?key', 'session[ _-]?id', '(?<![A-Za-z])auth(?![A-Za-z])', ...extraKeys.map(esc)];
+    const exact = ['authorization', 'pass', 'pw', 'otp', 'pin', 'cvv', 'ssn'];
+    const KEY = `(?:[\\w.-]*?(?:${compound.join('|')})[\\w.-]*|${exact.join('|')})`;
     // key = value | key: value | "key": "value" | key => value | key -> value   (value runs to a delimiter; a closing quote stays)
     const KV = new RegExp(`(["']?)\\b(${KEY})\\b(["']?)(\\s*(?:=>|->|[=:])\\s*)(["']?)([^"'\\s&;,}\\]\\)]+)`, 'gi');
     // password is S3cret | token was abc | password 'S3cret' | with password S3cret@123 (only when the value looks like a secret)
-    const SPOKEN_KEYS = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[ _-]?key', 'access[ _-]?key', 'otp', 'pin', 'cvv', ...extraKeys.map(esc)];
-    const SPOKEN = new RegExp(`\\b(${SPOKEN_KEYS.join('|')})(s?\\b\\s+(?:is|was|of|as)?\\s*['"]?)([^\\s'",;]+)`, 'gi');
+    const SPOKEN_KEYS = ['password', 'passwort', 'passwd', 'pwd', 'pass', 'passcode', 'secret', 'token', 'api[ _-]?key', 'access[ _-]?key', 'otp', 'pin', 'cvv', ...extraKeys.map(esc)];
+    // "password is x", "password for user admin is x", "token: x", "the token is: x", "with pwd x"
+    const SPOKEN = new RegExp(`\\b(${SPOKEN_KEYS.join('|')})(s?\\b(?:\\s+for\\s+(?:\\S+\\s+){1,3}?(?:[:=]|(?:is|was)\\b)\\s*|\\s*[:=]?\\s*(?:(?:is|was|of|as)\\b\\s*)?[:=]?\\s*)['"]?)((?=[A-Za-z0-9])[^\\s'",;]+)`, 'gi');
+    // user:password@host in a URL, curl -u user:password, "credentials admin:x"
+    const URL_USERINFO = /(:\/\/[^\s/:@]+:)([^\s@]+)(@)/g;
+    const CLI_USER = /((?:^|\s)(?:-u|--user|--username|--credentials?)\s+[^\s:]+:)(\S+)/g;
+    const CREDS_PAIR = /\b(credentials?|creds|login)(\s*[:=]?\s+[^\s:'"]+:)([^\s'",;]+)/gi;
+    // The value comes first: "Typed s3cret into password field", "Entered x in #password"
+    const VALUE_THEN_KEY = /([^\s'"(]+)(\s+(?:into|in|to|for|as)\s+(?:the\s+)?['"#]?[\w-]*?(?:password|passwd|pwd|secret|token|otp|pin)\b)/gi;
     const looksSecret = (v) => !/\s/.test(v) && (/\d/.test(v) && v.length >= 4 || /[^A-Za-z0-9]/.test(v) && v.length >= 6 || /[a-z][A-Z]|[A-Z][a-z].*[A-Z]/.test(v) && v.length >= 8);
     // Assertion output: when the text talks about a password/token/secret, the compared values are that secret.
     //   expect(token, 'token should match').toBe('x')  ->  Expected: "x" / Received: "tok_9f8e..."
@@ -43,23 +112,52 @@ function makeMasker(extraKeys = []) {
     const COMPARED = /\b(Expected|Received|Actual|expected|received|actual|got)(\s*[:=]\s*)(["'\u201c]?)([^"'\u201d\s]+)/g;
     const maskStr = (input) => {
         let s = input;
+        s = s.replace(CARD_NUMBER, m => luhn(m) ? '****' : m);
         for (const re of VALUE_PATTERNS)
-            s = s.replace(re, m => /^(Bearer|Basic|Digest|Token)\s/i.test(m) ? m.split(/\s+/)[0] + ' ****' : '****');
-        s = s.replace(KV, (_m, q1, key, q2, sep, q3, _value) => `${q1}${key}${q2}${sep}${q3}****`);
+            s = s.replace(re, m => {
+                if (/^(Bearer|Basic|Digest|Token)\s/i.test(m)) {
+                    const i = m.search(/\s/);
+                    learn(m.slice(i).trim());
+                    return m.slice(0, i) + ' ****';
+                }
+                learn(m);
+                return '****';
+            });
+        s = s.replace(URL_USERINFO, (_m, a, value, b) => { learn(value); return `${a}****${b}`; });
+        s = s.replace(CLI_USER, (_m, a, value) => { learn(value); return `${a}****`; });
+        s = s.replace(CREDS_PAIR, (_m, a, b, value) => { learn(value); return `${a}${b}****`; });
+        s = s.replace(KV, (_m, q1, key, q2, sep, q3, value) => { learn(value); return `${q1}${key}${q2}${sep}${q3}****`; });
         s = s.replace(SPOKEN, (m, key, between, value) => {
             const word = value.toLowerCase().replace(/[^a-z0-9]/g, '');
-            if (NOT_A_SECRET.has(word) || word === '****' || value === '****')
+            if (NOT_A_SECRET.has(word) || value.includes('*'))
                 return m;
-            const explicit = /\b(is|was|of|as)\b|['"]$/.test(between);
-            return explicit || looksSecret(value) ? `${key}${between}****` : m;
+            const explicit = /\b(is|was|of|as)\b|['"]$|[:=]\s*$/.test(between);
+            if (explicit || looksSecret(value)) {
+                learn(value);
+                return `${key}${between}****`;
+            }
+            return m;
+        });
+        s = s.replace(VALUE_THEN_KEY, (m, value, rest) => {
+            const word = value.toLowerCase().replace(/[^a-z0-9]/g, '');
+            if (NOT_A_SECRET.has(word) || value.includes('*') || !looksSecret(value))
+                return m;
+            learn(value);
+            return `****${rest}`;
         });
         if (MENTIONS_SECRET.test(s))
-            s = s.replace(COMPARED, (m, label, sep, q, value) => looksSecret(value) ? `${label}${sep}${q}****` : m);
+            s = s.replace(COMPARED, (m, label, sep, q, value) => { if (!looksSecret(value))
+                return m; learn(value); return `${label}${sep}${q}****`; });
+        const known = learnedPattern();
+        if (known)
+            s = s.replace(known, '****');
         return s;
     };
     const mask = (v, key = '') => {
-        if (key && isSensitive(key))
+        if (key && isSensitive(key)) {
+            learn(v);
             return '****';
+        }
         if (typeof v === 'string')
             return maskStr(v);
         if (Array.isArray(v))
@@ -72,7 +170,7 @@ function makeMasker(extraKeys = []) {
         }
         return v;
     };
-    return { mask, maskStr, isSensitive };
+    return { mask, maskStr, isSensitive, learn };
 }
 function parseCsv(text) {
     const lines = text.replace(/\r/g, '').split('\n').filter(l => l.trim());

package/dist/reporter.d.ts

@@ -54,3 +54,10 @@ export default class ReportingLabsReporter implements Reporter {
     private serializeStep;
     private serializeAttachment;
 }
+/**
+ * The environment name the run was pointed at, from the process environment: the variable named
+ * by `envVar` if given, else the usual names (ENV, TEST_ENV, APP_ENV, TARGET_ENV, …), else any
+ * variable whose name ends in _ENV or _ENVIRONMENT (OPENCART_ENV, app_env). Every project names
+ * it differently; this finds it without being told. Undefined when nothing fits.
+ */
+export declare function detectEnvName(env: NodeJS.ProcessEnv, envVar?: string): string | undefined;

package/dist/reporter.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectEnvName = detectEnvName;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
@@ -56,8 +57,33 @@ class ReportingLabsReporter {
         this.masker = (0, mask_1.makeMasker)();
         this.globalErrors = [];
         this.globalOutput = [];
-        this.options = options;
-        this.masker = (0, mask_1.makeMasker)(options.maskKeys ?? []);
+        // The env chip. A runtime variable beats the config file, the same precedence as everything
+        // else: the ENV / TEST_ENV / ENVIRONMENT / APP_ENV a CI job exports wins over metadata.env in
+        // the config, so a config that says env: 'local' still labels the pipeline's reports dev, qa,
+        // stage without anyone touching it. The config value applies when no variable is set.
+        // Runtime overrides, highest precedence: REPORTING_LABS_METADATA_<KEY> sets a header chip
+        // (REPORTING_LABS_METADATA_ENV=qa, REPORTING_LABS_METADATA_RELEASE=2.3) and REPORTING_LABS_TITLE /
+        // _THEME / _PALETTE / _ACCENT / _LOGO the matching option, so a pipeline can label a run without
+        // touching the config. Same contract as the Java reporter's REPORTING_LABS_* variables.
+        const metadata = { ...(options.metadata ?? {}) };
+        for (const [k, v] of Object.entries(process.env)) {
+            const m = /^REPORTING_LABS_METADATA_([A-Z0-9_]+)$/.exec(k);
+            if (m && v && v.trim())
+                metadata[m[1].toLowerCase()] = v.trim();
+        }
+        // Below the explicit override, the environment name the run was pointed at, found by convention
+        // (ENV, TEST_ENV, APP_ENV, TARGET_ENV, anything ending in _ENV) or the variable `envVar` names.
+        // It beats metadata.env in the config: a runtime value wins over the file, as everywhere else.
+        if (!process.env.REPORTING_LABS_METADATA_ENV) {
+            const detected = detectEnvName(process.env, options.envVar);
+            if (detected)
+                metadata.env = detected;
+        }
+        const scalar = (name, current) => { const v = process.env['REPORTING_LABS_' + name]; return v && v.trim() ? v.trim() : current; };
+        this.options = { ...options, metadata,
+            title: scalar('TITLE', options.title), theme: scalar('THEME', options.theme), palette: scalar('PALETTE', options.palette),
+            accent: scalar('ACCENT', options.accent), logo: scalar('LOGO', options.logo) };
+        this.masker = (0, mask_1.makeMasker)(options.maskKeys ?? [], { knownValues: options.maskValues ?? [], fromEnv: options.maskFromEnv !== false });
     }
     printsToStdio() { return false; }
     /** Errors outside tests: a spec that throws at load, global setup, a crashed worker. */
@@ -317,6 +343,7 @@ class ReportingLabsReporter {
         return rows;
     }
     toDataBlock(name, raw) {
+        name = this.masker.maskStr(String(name)); // a block name can carry a secret too
         let v;
         try {
             v = JSON.parse(raw);
@@ -326,7 +353,10 @@ class ReportingLabsReporter {
         }
         if (v && typeof v === 'object' && typeof v.csv === 'string' && Object.keys(v).length === 1) {
             const { columns, rows } = (0, mask_1.parseCsv)(v.csv);
-            const masked = rows.map(r => r.map((c, i) => this.masker.isSensitive(columns[i] ?? '') ? '****' : this.masker.maskStr(c)));
+            const masked = rows.map(r => r.map((c, i) => { if (this.masker.isSensitive(columns[i] ?? '')) {
+                this.masker.learn(c);
+                return '****';
+            } return this.masker.maskStr(c); }));
             return { name, kind: 'table', columns, rows: masked };
         }
         v = this.masker.mask(v);
@@ -591,6 +621,35 @@ class ReportingLabsReporter {
 }
 exports.default = ReportingLabsReporter;
 /** Run number from the CI system, used to label history entries when metadata.build is not set. */
+/** Variables whose name ends in ENV but never hold an environment name. */
+const NOT_AN_ENV_VAR = new Set(['GITHUB_ENV', 'NODE_ENV', 'BASH_ENV', 'VIRTUAL_ENV', 'CONDA_DEFAULT_ENV', 'RUNNER_ENVIRONMENT', 'PIPENV_ACTIVE', 'ZSH_ENV', 'JAVA_ENV', 'DOTNET_ENVIRONMENT', 'ASPNETCORE_ENVIRONMENT', 'HOSTING_ENVIRONMENT']);
+/** Names every project seems to pick first, in order. */
+const ENV_VAR_NAMES = ['ENV', 'TEST_ENV', 'ENVIRONMENT', 'APP_ENV', 'TARGET_ENV', 'RUN_ENV', 'DEPLOY_ENV', 'ENV_NAME', 'TEST_ENVIRONMENT', 'TARGET_ENVIRONMENT', 'CI_ENVIRONMENT_NAME', 'DEPLOYMENT_ENVIRONMENT', 'STAGE'];
+/** dev, qa, stage-2, app_qa, prod-eu: a short token, never a path, URL or sentence. */
+const looksLikeEnvName = (v) => !!v && /^[A-Za-z][\w.-]{0,31}$/.test(v.trim());
+/**
+ * The environment name the run was pointed at, from the process environment: the variable named
+ * by `envVar` if given, else the usual names (ENV, TEST_ENV, APP_ENV, TARGET_ENV, …), else any
+ * variable whose name ends in _ENV or _ENVIRONMENT (OPENCART_ENV, app_env). Every project names
+ * it differently; this finds it without being told. Undefined when nothing fits.
+ */
+function detectEnvName(env, envVar) {
+    const get = (name) => { const v = env[name] ?? env[name.toLowerCase()]; return looksLikeEnvName(v) ? v.trim() : undefined; };
+    if (envVar)
+        return get(envVar) ?? (looksLikeEnvName(env[envVar]) ? env[envVar].trim() : undefined);
+    for (const n of ENV_VAR_NAMES) {
+        const v = get(n);
+        if (v)
+            return v;
+    }
+    const wild = Object.keys(env).filter(k => /_(ENV|ENVIRONMENT|ENV_NAME)$/i.test(k) && !NOT_AN_ENV_VAR.has(k.toUpperCase())).sort();
+    for (const k of wild) {
+        const v = env[k];
+        if (looksLikeEnvName(v))
+            return v.trim();
+    }
+    return undefined;
+}
 function ciRunLabel(env) {
     const n = env.GITHUB_RUN_NUMBER || env.BUILD_NUMBER || env.CI_PIPELINE_IID || env.CIRCLE_BUILD_NUM || env.BUILD_BUILDNUMBER || env.BITBUCKET_BUILD_NUMBER;
     return n ? `#${n}` : undefined;

package/dist/types.d.ts

@@ -25,6 +25,8 @@ export interface ReportingLabsOptions {
     embedVideos?: boolean;
     /** Key/value shown in the header (env, branch, build...). `build` labels the run in the history; when it is not set the CI run number is used. */
     metadata?: Record<string, string>;
+    /** Name of the environment variable that holds the environment name, when it is not one the reporter finds by itself (ENV, TEST_ENV, APP_ENV, anything ending in _ENV). */
+    envVar?: string;
     /** Extra sections rendered below the summary. HTML is allowed. */
     sections?: Array<{
         title: string;
@@ -87,6 +89,10 @@ export interface ReportingLabsOptions {
     links?: Record<string, string | LinkTemplate>;
     /** Keys (case-insensitive substrings) whose values are masked in test data and API panels. */
     maskKeys?: string[];
+    /** Literal values to blank wherever they appear, keyed or not (the test password, a token). Pass the real ones from CI: process.env.PASSWORD. */
+    maskValues?: string[];
+    /** Learn the values of PASSWORD / API_TOKEN / *_SECRET environment variables and blank them everywhere (default true). */
+    maskFromEnv?: boolean;
     /** Keep a rolling run history next to the report and draw a trend chart. Per-test outcomes are stored too, which powers new-vs-known failures, flaky history and duration regressions. */
     history?: {
         enabled?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reporting-labs",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "reportingLabs – beautiful, customizable single-file HTML test reports. One line of config. Playwright adapter included, more runners on the way.",
   "keywords": [
     "test-report",