tracereports 0.3.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tracereports",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "TraceReports client for JavaScript/TypeScript: Playwright Test reporter and fixtures, Selenium WebDriver helpers and a client for any runner.",
   "keywords": [
     "testing",

package/src/index.js

@@ -22,12 +22,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { detectBranch, detectCommit } from "./context.js";
 import { env } from "./env.js";
+import { screenshotAllowed } from "./mask.js";
 import { Recorder, newSessionDir } from "./offline.js";
 import { Mirror } from "./mirror.js";
 import { Sender } from "./transport.js";
 import { downloadBinary } from "./binary.js";
 
-export const VERSION = "0.3.0";
+export const VERSION = "0.4.1";
 const STATUSES = new Set(["INFO", "PASS", "FAIL", "WARNING", "SKIP"]);
 const truthy = (v) => ["1", "true", "yes"].includes(String(v || "").toLowerCase());
 
@@ -132,12 +133,12 @@ export class TraceReports {
     try {
       this.sender = new Recorder(dir);
     } catch (err) {
-      console.warn(`tracereports: no se pudo grabar en ${dir}: ${err.message}`);
+      console.warn(`tracereports: could not record locally in ${dir}: ${err.message}`);
       return;
     }
     this.offlineDir = dir;
     if (reason) {
-      console.warn(`tracereports: ${reason}; la evidencia se graba en ${dir}`);
+      console.warn(`tracereports: ${reason}; recording the evidence in ${dir}`);
     }
   }
 
@@ -146,7 +147,7 @@ export class TraceReports {
     try {
       this.sender = new Mirror(this.sender, dir, this.baseUrl, runId, payload);
       this.offlineDir = dir;
-    } catch (err) { console.warn(`tracereports: no se pudo iniciar la copia local en ${dir}: ${err.message}`); }
+    } catch (err) { console.warn(`tracereports: could not start local copy in ${dir}: ${err.message}`); }
   }
 
   /** Arma el HTML con el binario instalado o el renderer verificado de la caché. */
@@ -162,7 +163,7 @@ export class TraceReports {
       if (!fs.statSync(index).isFile()) throw Error("renderer did not create index.html");
       this.offlineReport = index;
       if (this.runId > 0) console.warn(`tracereports: server report: ${this.reportUrl}`);
-      console.warn(`tracereports: reporte local: ${this.offlineReport}`);
+      console.warn(`tracereports: local report in ${this.offlineReport}`);
       return this.offlineReport;
     } catch (err) {
       console.warn(`tracereports: local report unavailable (${err.message}); evidence retained in ${this.offlineDir}. ` +
@@ -233,14 +234,14 @@ export class TraceReports {
     let created = res;
     if (!created && this.enabled && ["auto", "both"].includes(this.offlineMode) && !this.recording) {
       // sin servidor, caído o con el token equivocado: se graba en vez de perderlo todo
-      this.goOffline(`no se pudo crear la ejecución en ${this.baseUrl} (servidor caído o token incorrecto)`);
+      this.goOffline(`could not create the run at ${this.baseUrl} (server down or wrong token)`);
       if (this.recording) created = await this.request("POST", "/api/v1/runs", payload);
     }
     if (created?.run_id > 0 && this.offlineMode === "both" && !this.recording) this.goMirror(created.run_id, payload);
     this.runId = created?.run_id ?? null;
     this.runCreated = Boolean(this.runId);
     if (this.enabled && !this.runId) {
-      console.warn(`tracereports: no se pudo crear la ejecución en ${this.baseUrl}; los tests siguen sin reporte.`);
+      console.warn(`tracereports: could not create the run at ${this.baseUrl}; tests will continue without reporting.`);
     }
     return this.runId;
   }
@@ -286,8 +287,8 @@ export class TraceReports {
       return res;
     }
     if (this.runNotClosed) {
-      console.warn(`tracereports: el servidor no confirmó el cierre de la ejecución #${this.runId}: quedó abierta ` +
-        `(ciérrala con PATCH ${this.baseUrl}/api/v1/runs/${this.runId}/finish)`);
+      console.warn(`tracereports: the server did not confirm that run #${this.runId} finished: it stays open ` +
+        `(finish it with PATCH ${this.baseUrl}/api/v1/runs/${this.runId}/finish)`);
     }
     return res;
   }
@@ -369,7 +370,8 @@ export class TraceTest {
    * base64 (Selenium `driver.takeScreenshot()`).
    */
   screenshot(image, message = "", status = "INFO") {
-    if (!this.active || !image) return;
+    // TRACEREPORTS_SCREENSHOTS=off|failures: la captura no se envía (ver mask.js)
+    if (!this.active || !image || !screenshotAllowed(status)) return;
     const data = typeof image === "string" ? Buffer.from(image, "base64") : Buffer.from(image);
     const boundary = `----tracereports${Math.random().toString(16).slice(2)}`;
     const part = (name, value) => `--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`;
@@ -409,7 +411,7 @@ export class TraceTest {
       }
     }
     if (body.length > 100 << 20) {
-      console.warn(`tracereports: ${name || kind} pesa más de 100 MB: no se adjunta`);
+      console.warn(`tracereports: ${name || kind} is larger than 100 MB: not attached`);
       return false;
     }
     const boundary = `----tracereports${Math.random().toString(16).slice(2)}`;

package/src/mask.js

@@ -0,0 +1,107 @@
+// Capturas sin datos sensibles: se tapan antes de capturar.
+//
+// - TRACEREPORTS_SCREENSHOT_MASK: selectores CSS a tapar (un grupo CSS: "input[name=rut], .tarjeta").
+// - Siempre se tapan input[type=password] y los elementos con el atributo data-tracereports-mask;
+//   TRACEREPORTS_SCREENSHOT_MASK_DEFAULTS=off lo desactiva.
+// - TRACEREPORTS_SCREENSHOTS: all (por defecto), failures (solo la captura de un paso FAIL) u off
+//   (ninguna). El servidor aplica la misma política por su cuenta.
+//
+// Playwright usa su opción nativa `mask`. Selenium no la tiene: se ponen recuadros del mismo color
+// sobre los elementos, se captura y se quitan, también si la captura falla, así el DOM queda igual.
+// Sin dependencias: lo importan index.js, playwright.js y selenium.js.
+
+import { env } from "./env.js";
+
+/** Lo que se tapa siempre (salvo TRACEREPORTS_SCREENSHOT_MASK_DEFAULTS=off). */
+export const DEFAULT_MASK = "input[type=password], [data-tracereports-mask]";
+/** Color de los recuadros: el mismo que usa Playwright por defecto. */
+export const MASK_COLOR = "#FF00FF";
+
+const OVERLAY_ATTR = "data-tracereports-mask-overlay";
+
+/** Nombre del attachment de Playwright con la captura al fallar ya tapada (la toman los fixtures). */
+export const MASKED_SHOT = "tracereports-screenshot";
+
+/** El grupo de selectores CSS a tapar ("" = nada). */
+export function maskSelector() {
+  const parts = [];
+  if (!["off", "0", "false", "no"].includes(String(env("SCREENSHOT_MASK_DEFAULTS") ?? "").trim().toLowerCase())) {
+    parts.push(DEFAULT_MASK);
+  }
+  const extra = String(env("SCREENSHOT_MASK") ?? "").trim().replace(/^,+|,+$/g, "").trim();
+  if (extra) parts.push(extra);
+  return parts.join(", ");
+}
+
+/** TRACEREPORTS_SCREENSHOTS: all, failures u off (un valor desconocido cuenta como all). */
+export function screenshotsPolicy() {
+  const v = String(env("SCREENSHOTS") ?? "").trim().toLowerCase();
+  return v === "failures" || v === "off" ? v : "all";
+}
+
+/** Si la política deja enviar una captura de un paso con este estado. */
+export function screenshotAllowed(status) {
+  const policy = screenshotsPolicy();
+  if (policy === "off") return false;
+  return policy === "all" || String(status).toUpperCase() === "FAIL";
+}
+
+/** `page.screenshot()` de Playwright con los elementos sensibles tapados (opción `mask`). */
+export function playwrightScreenshot(page, options = {}) {
+  const selector = maskSelector();
+  const opts = { ...options };
+  if (selector) {
+    opts.mask ??= [page.locator(selector)];
+    opts.maskColor ??= MASK_COLOR;
+  }
+  return page.screenshot(opts);
+}
+
+// Recuadros fijos sobre cada elemento visible del selector (la captura de Selenium es del viewport).
+const COVER_JS = `
+const [sel, color, attr] = arguments;
+let n = 0;
+for (const el of document.querySelectorAll(sel)) {
+  const r = el.getBoundingClientRect();
+  if (!r.width || !r.height) continue;
+  const d = document.createElement("div");
+  d.setAttribute(attr, "");
+  d.style.cssText = "position:fixed;left:" + r.left + "px;top:" + r.top + "px;width:" + r.width + "px;height:" + r.height + "px;" +
+    "background:" + color + ";z-index:2147483647;pointer-events:none;margin:0;padding:0;border:0";
+  document.documentElement.appendChild(d);
+  n++;
+}
+return n;
+`;
+
+const UNCOVER_JS = `for (const d of document.querySelectorAll("[" + arguments[0] + "]")) d.remove();`;
+
+/**
+ * Captura de Selenium (base64, lo que acepta `t.screenshot`) con los elementos sensibles tapados, o
+ * null si el navegador ya no responde. Los recuadros se quitan siempre; si no se pueden poner (un
+ * selector inválido) no se captura: mejor sin captura que sin máscara.
+ */
+export async function seleniumScreenshot(driver) {
+  const selector = maskSelector();
+  let covered = false;
+  try {
+    if (selector) {
+      try {
+        await driver.executeScript(COVER_JS, selector, MASK_COLOR, OVERLAY_ATTR);
+        covered = true;
+      } catch (err) {
+        console.warn(`tracereports: could not cover ${JSON.stringify(selector)} before the screenshot: ${err?.message ?? err}`);
+        return null;
+      }
+    }
+    return await driver.takeScreenshot();
+  } catch {
+    return null;
+  } finally {
+    if (covered) {
+      try {
+        await driver.executeScript(UNCOVER_JS, OVERLAY_ATTR);
+      } catch { /* el navegador ya no responde */ }
+    }
+  }
+}

package/src/mirror.js

@@ -17,15 +17,15 @@ export class Mirror {
     this.closed = false;
     this.disabled = false;
     this.active = 0;
-    fs.mkdirSync(directory, { recursive: true });
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     this.locked(() => {
       const marker = path.join(directory, MARKER);
-      if (fs.existsSync(marker) && JSON.parse(fs.readFileSync(marker)).raw_removed) throw new Error("la carpeta solo contiene el reporte; usa otra carpeta");
+      if (fs.existsSync(marker) && JSON.parse(fs.readFileSync(marker)).raw_removed) throw new Error("the folder only contains the report; use another folder");
       this.recorder = new Recorder(directory);
       this.status = `status-${process.pid}-${this.recorder.tag}.json`;
       this.write(this.status, { complete: false, reason: "active" });
       const m = JSON.parse(fs.readFileSync(marker));
-      if (m.mirror && m.mirror.server !== server) throw new Error("la carpeta pertenece a otro servidor");
+      if (m.mirror && m.mirror.server !== server) throw new Error("the folder belongs to another server");
       m.mirror ||= { server, runs: [], complete: false };
       m.mirror.complete = false;
       this.write(MARKER, m);
@@ -33,16 +33,16 @@ export class Mirror {
       const mapping = path.join(directory, "ids", `server-${runId}`);
       if (payload) {
         local = this.recorder.record("POST", "/api/v1/runs", JSON.stringify(payload), "application/json").run_id;
-        fs.writeFileSync(mapping, String(local), { flag: "wx" });
+        fs.writeFileSync(mapping, String(local), { flag: "wx", mode: 0o600 });
         m.mirror.runs.push({ local, server: runId });
         this.write(MARKER, m);
       } else {
         try {
           local = Number(fs.readFileSync(mapping, "utf8"));
-          if (!Number.isSafeInteger(local) || local >= 0) throw new Error("id local inválido");
+          if (!Number.isSafeInteger(local) || local >= 0) throw new Error("invalid local id");
         } catch (err) {
           this.failed = true;
-          console.warn(`tracereports: falta el id local de la ejecución #${runId}: ${err.message}`);
+          console.warn(`tracereports: missing local id for run #${runId}: ${err.message}`);
         }
       }
       if (local) this.runs.set(runId, local);
@@ -52,12 +52,12 @@ export class Mirror {
   locked(fn) {
     const lock = path.join(this.directory, ".mirror-lock");
     for (let n = 0; ; n++) {
-      try { fs.mkdirSync(lock); break; } catch (err) {
+      try { fs.mkdirSync(lock, { mode: 0o700 }); break; } catch (err) {
         if (err.code !== "EEXIST") throw err;
         if (n >= 50) {
           let stale = false;
           try { stale = Date.now() - fs.statSync(lock).mtimeMs > STALE_LOCK_MS; } catch { /* ya no existe */ }
-          if (!stale) throw new Error(`${lock} lo tiene otro proceso (bórralo si ninguna ejecución usa esta carpeta)`);
+          if (!stale) throw new Error(`${lock} is held by another process (delete it if no run uses this folder)`);
           try { fs.rmdirSync(lock); } catch { /* otro proceso lo retiró antes */ }
           n = 0; // huérfano: se retira y se vuelve a intentar
         }
@@ -70,7 +70,7 @@ export class Mirror {
   write(name, value) {
     const dest = path.join(this.directory, name), tmp = `${dest}.${randomUUID()}.tmp`;
     try {
-      fs.writeFileSync(tmp, JSON.stringify(value));
+      fs.writeFileSync(tmp, JSON.stringify(value), { mode: 0o600 });
       try { fs.renameSync(tmp, dest); }
       catch (err) {
         // Windows can reject a replacement rename even while this process owns the lock.
@@ -83,7 +83,7 @@ export class Mirror {
 
   diskError(err) {
     this.failed = true;
-    if (!this.disabled) console.warn(`tracereports: se detuvo la copia local en ${this.directory}: ${err.message}`);
+    if (!this.disabled) console.warn(`tracereports: stopped local copy in ${this.directory}: ${err.message}`);
     this.disabled = true;
   }
 

package/src/offline.js

@@ -42,10 +42,11 @@ export class Recorder {
     this.nextId = 0;
     this.block = 0;
     this.tag = randomUUID().slice(0, 8);
-    fs.mkdirSync(path.join(directory, "bodies"), { recursive: true });
+    // la grabación lleva la evidencia sin redactar (eso lo hace el servidor): solo para el usuario
+    fs.mkdirSync(path.join(directory, "bodies"), { recursive: true, mode: 0o700 });
     try {
       fs.writeFileSync(path.join(directory, MARKER),
-        JSON.stringify({ format: "tracereports-offline", version: FORMAT_VERSION, id: randomUUID().replace(/-/g, "") }), { flag: "wx" });
+        JSON.stringify({ format: "tracereports-offline", version: FORMAT_VERSION, id: randomUUID().replace(/-/g, "") }), { flag: "wx", mode: 0o600 });
     } catch (err) {
       if (err.code !== "EEXIST") throw err; // otro proceso ya lo creó
     }
@@ -64,11 +65,11 @@ export class Recorder {
 
   reserveBlock() {
     const ids = path.join(this.directory, "ids");
-    fs.mkdirSync(ids, { recursive: true });
+    fs.mkdirSync(ids, { recursive: true, mode: 0o700 });
     for (let i = 0; i < 100; i++) {
       const block = randomInt(MIN_BLOCK, MAX_BLOCK);
       try {
-        fs.writeFileSync(path.join(ids, String(block)), "", { flag: "wx" });
+        fs.writeFileSync(path.join(ids, String(block)), "", { flag: "wx", mode: 0o600 });
         return block;
       } catch (err) {
         if (err.code !== "EEXIST") throw err; // ya es de otro grabador: se prueba otro
@@ -91,7 +92,7 @@ export class Recorder {
     if (parsed !== undefined) event.body = parsed;
     else {
       const name = `bodies/${process.pid}-${this.tag}-${this.seq}.bin`;
-      fs.writeFileSync(path.join(this.directory, name), body ?? "");
+      fs.writeFileSync(path.join(this.directory, name), body ?? "", { mode: 0o600 });
       event.body_file = name;
     }
     let res = {};
@@ -99,7 +100,7 @@ export class Recorder {
     else if (method === "POST" && apiPath.startsWith("/api/v1/runs/") && apiPath.endsWith("/tests")) res = { test_id: this.localId() };
     const id = res.run_id ?? res.test_id;
     if (id) event.local_id = id;
-    fs.appendFileSync(this.file, JSON.stringify(event) + "\n"); // síncrono: si el proceso muere, lo escrito queda
+    fs.appendFileSync(this.file, JSON.stringify(event) + "\n", { mode: 0o600 }); // síncrono: si el proceso muere, lo escrito queda
     this.stats.recorded++;
     return res;
   }

package/src/playwright.js

@@ -14,14 +14,18 @@
 //     navegador, no los logs del backend);
 //   - captura la consola: console.error, console.warn y los errores de JavaScript sin manejar
 //     (pestaña "Consola");
-//   - si el test falla: snapshot del DOM (recomendador de locators) y una captura si el proyecto
-//     no tiene `screenshot: "only-on-failure"`.
+//   - si el test falla: snapshot del DOM (recomendador de locators) y una captura con los datos
+//     sensibles tapados (ver mask.js); el reporter la sube en vez de la de `screenshot:
+//     "only-on-failure"`, que Playwright toma sin máscara.
 // Todo viaja como attachments del test; el reporter `tracereports/reporter` los sube.
 
 import { createRequire } from "node:module";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { domSnapshotInPage } from "./dom.js";
+import { MASKED_SHOT, playwrightScreenshot, screenshotsPolicy } from "./mask.js";
+
+export { MASKED_SHOT, playwrightScreenshot };
 
 // @playwright/test se carga desde el proyecto que corre los tests: así hay una sola copia aunque
 // este paquete esté instalado como enlace (npm install ../tracereports/client/js).
@@ -169,11 +173,11 @@ const fixtures = {
     if (testInfo.status !== testInfo.expectedStatus) {
       const snap = await captureDom(page);
       if (snap) await testInfo.attach("tracereports-dom", { body: JSON.stringify(snap), contentType: "application/json" });
-      const mode = testInfo.project.use?.screenshot;
-      const auto = mode === "on" || mode === "only-on-failure" || mode?.mode === "on" || mode?.mode === "only-on-failure";
-      if (!auto) {
+      // siempre la captura tapada: la automática de Playwright (screenshot: "only-on-failure") no se
+      // puede tapar, y el reporter la reemplaza por esta
+      if (screenshotsPolicy() !== "off") {
         try {
-          await testInfo.attach("Captura al fallar", { body: await page.screenshot({ timeout: 5000 }), contentType: "image/png" });
+          await testInfo.attach(MASKED_SHOT, { body: await playwrightScreenshot(page, { timeout: 5000 }), contentType: "image/png" });
         } catch { /* la página puede estar cerrada */ }
       }
     }

package/src/reporter.js

@@ -23,6 +23,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { env } from "./env.js";
 import { TraceReports } from "./index.js";
+import { MASKED_SHOT, screenshotAllowed, screenshotsPolicy } from "./mask.js";
 
 const ANSI = /\u001b\[[0-9;]*m/g;
 const truthy = (v) => ["1", "true", "yes"].includes(String(v || "").toLowerCase());
@@ -131,17 +132,25 @@ export default class TraceReportsReporter {
       }));
       for (const l of [...steps, ...logs].sort((a, b) => a.timestamp - b.timestamp)) ct.log(l.status, l.message, l.timestamp);
 
+      // la captura automática de Playwright no viene tapada: si los fixtures dejaron la suya, va esa
+      const masked = result.attachments.some((a) => a.name === MASKED_SHOT);
+      // trace y video muestran la pantalla: siguen TRACEREPORTS_SCREENSHOTS
+      const policy = screenshotsPolicy();
+      const artifacts = policy === "all" || (policy === "failures" && unexpected);
       for (const att of result.attachments) {
+        if (att.name === "screenshot" && masked) continue;
+        const isImage = att.contentType?.startsWith("image/");
+        if (isImage && !screenshotAllowed(unexpected ? "FAIL" : "INFO")) continue;
         const body = att.body ?? (att.path && fs.existsSync(att.path) ? fs.readFileSync(att.path) : null);
         if (!body) continue;
         if (att.name === "tracereports-network") ct.network(JSON.parse(body.toString()));
         else if (att.name === "tracereports-dom") ct.dom(JSON.parse(body.toString()));
         else if (att.name === "tracereports-console") ct.console(JSON.parse(body.toString()));
-        else if (att.contentType?.startsWith("image/")) ct.screenshot(body, att.name === "screenshot" ? "Captura al fallar" : att.name,
+        else if (isImage) ct.screenshot(body, att.name === "screenshot" || att.name === MASKED_SHOT ? "Captura al fallar" : att.name,
           unexpected ? "FAIL" : "INFO");
         // trace: "on" / "retain-on-failure" / "on-first-retry"; video: lo mismo en use.video
-        else if (att.name === "trace" && att.contentType === "application/zip") ct.artifact("trace", body, `trace-${result.retry + 1}.zip`);
-        else if (att.contentType?.startsWith("video/")) ct.artifact("video", body, att.name === "video" ? `video-${result.retry + 1}` : att.name);
+        else if (att.name === "trace" && att.contentType === "application/zip") { if (artifacts) ct.artifact("trace", body, `trace-${result.retry + 1}.zip`); }
+        else if (att.contentType?.startsWith("video/")) { if (artifacts) ct.artifact("video", body, att.name === "video" ? `video-${result.retry + 1}` : att.name); }
       }
       const final = asExpected || skipped || result.retry >= test.retries;
       if (!final) {
@@ -172,18 +181,18 @@ export default class TraceReportsReporter {
     const problems = this.cr.deliveryProblems() + (this.cr.recording && this.cr.runId < 0 && ["auto", "both"].includes(this.cr.offlineMode) ? 1 : 0);
     if (this.cr.recording && this.cr.runId > 0) {
       console.log(`TraceReports: ${this.cr.reportUrl}`);
-      console.log(`TraceReports copia local: ${this.cr.offlineReport || `tracereports report ${this.cr.offlineDir}`}`);
+      console.log(`TraceReports local copy: ${this.cr.offlineReport || `tracereports report ${this.cr.offlineDir}`}`);
     } else if (this.cr.recording) {
-      console.log(`TraceReports (sin servidor): evidencia en ${this.cr.offlineDir}; reporte: ` +
-        (this.cr.reportUrl || `\`tracereports report ${this.cr.offlineDir} -o reporte\``) +
-        `; para subirla: \`tracereports push ${this.cr.offlineDir}\``);
+      console.log(`TraceReports (no server): evidence in ${this.cr.offlineDir}; report: ` +
+        (this.cr.reportUrl || `\`tracereports report ${this.cr.offlineDir} -o report\``) +
+        `; to upload it: \`tracereports push ${this.cr.offlineDir}\``);
     } else if (this.cr.runId) console.log(`TraceReports: ${this.cr.reportUrl}`);
     if (problems && (!this.cr.recording || this.cr.runId > 0)) {
       const d = this.cr.delivery;
-      console.warn(`TraceReports: atención: ${problems - d.runNotClosed} eventos de evidencia no llegaron al servidor ` +
-        `(enviados ${d.sent}, rechazados ${d.rejected}, descartados ${d.dropped}, perdidos ${d.lost})` +
-        (d.runNotClosed ? "; el servidor no confirmó el cierre de la ejecución: quedó abierta" : "") +
-        (this.strict ? " — TRACEREPORTS_STRICT: la corrida falla" : ""));
+      console.warn(`TraceReports: warning: ${problems - d.runNotClosed} evidence events did not reach the server ` +
+        `(sent ${d.sent}, rejected ${d.rejected}, dropped ${d.dropped}, lost ${d.lost})` +
+        (d.runNotClosed ? "; the server did not confirm that the run finished: it stays open" : "") +
+        (this.strict ? " - TRACEREPORTS_STRICT: the run fails" : ""));
     }
     if (this.strict && (problems || (this.cr.enabled && !this.cr.runId)) && result.status === "passed") {
       return { status: "failed" };

package/src/selenium.js

@@ -25,6 +25,7 @@
 // página navegara puede no estar ya disponible; el resto de la llamada sí.
 
 import { DOM_SCRIPT } from "./dom.js";
+import { seleniumScreenshot } from "./mask.js";
 
 const LOG_PREFS = { performance: "ALL", browser: "ALL" };
 const BODY_TYPES = new Set(["xhr", "fetch"]);
@@ -39,15 +40,16 @@ export function seleniumOptions(options) {
   return options;
 }
 
-/** Captura de pantalla como base64 (lo que acepta `t.screenshot`), o null. */
+/**
+ * Captura de pantalla como base64 (lo que acepta `t.screenshot`) con los datos sensibles tapados
+ * (ver mask.js), o null.
+ */
 export async function screenshot(driver) {
-  try {
-    return await driver.takeScreenshot();
-  } catch {
-    return null;
-  }
+  return seleniumScreenshot(driver);
 }
 
+export { seleniumScreenshot };
+
 /** Snapshot de los elementos de la página, o null si el navegador ya no responde. */
 export async function captureDom(driver) {
   try {

package/src/transport.js

@@ -60,11 +60,11 @@ export class Sender {
         return { kind: "ok", data: text ? JSON.parse(text) : {} };
       }
       if (RETRYABLE.has(res.status)) return { kind: "retry" };
-      const hint = res.status === 401 ? " (configura el token: new TraceReports({ token }), la variable TRACEREPORTS_TOKEN o TRACEREPORTS_TOKEN en el .env del proyecto)" : "";
+      const hint = res.status === 401 ? " (set the token: new TraceReports({ token }), the TRACEREPORTS_TOKEN variable or TRACEREPORTS_TOKEN in the project .env)" : "";
       console.warn(`tracereports: ${item.method} ${item.path} -> HTTP ${res.status} ${text.slice(0, 300)}${hint}`);
       return { kind: "reject" };
     } catch (err) {
-      if (!this.serverDown()) console.warn(`tracereports: ${item.method} ${item.path} falló: ${err.cause?.code || err.message}`);
+      if (!this.serverDown()) console.warn(`tracereports: ${item.method} ${item.path} failed: ${err.cause?.code || err.message}`);
       this.downUntil = Date.now() + limits.circuitMs;
       return { kind: "retry" };
     }
@@ -92,7 +92,7 @@ export class Sender {
     const size = body?.length ?? 0;
     if (this.pending + 1 > this.maxItems || this.bytes + size > this.maxBytes) {
       if (this.stats.dropped++ === 0) {
-        console.warn(`tracereports: la cola de envío está llena (${this.maxItems} eventos); se descartan los eventos nuevos`);
+        console.warn(`tracereports: the send queue is full (${this.maxItems} events); new events are dropped`);
       }
       return false;
     }
@@ -178,7 +178,7 @@ export class Sender {
     }
     this.notify();
     if (items.length) {
-      console.warn(`tracereports: ${items.length} eventos de evidencia no se pudieron enviar y se perdieron`);
+      console.warn(`tracereports: ${items.length} evidence events could not be sent and were lost`);
     }
     return items.length;
   }