TraceLens v0.2.0

Privacy controls and OpenTelemetry integration (Phases 16–17).

Added

• Configurable element-attribute allowlists, URL query allowlists, path-segment redaction, and custom URL sanitizers before telemetry is queued.
• CLI tracelens privacy audit for local Studio events or trace files. Findings omit detected values; exit code 1 means findings or an error, not a compliance assessment.
• New @tracelens/otel transport for OTLP/HTTP JSON trace export, including resource/build metadata and interaction-linked span contexts.
• Opt-in W3C traceparent propagation for fetch requests to exact allowed origins. Existing trace headers are preserved.
• Nine package-specific READMEs, updated setup guides, and version-aware release notes and smoke checks.

Upgrading from v0.1.0

Update all TraceLens packages together to 0.2.0. Default element attributes are now data-tracelens-name, role, and type; explicitly allow aria-label or id only after reviewing their contents. Prefer stable, non-sensitive data-tracelens-name labels.

URL credentials, queries, fragments (including hash routes), and email-shaped path segments are removed before queueing. This can change route grouping and labels compared with old traces. Configure path redaction for user/order identifiers; custom names and metadata are not automatically anonymized.

Create the OTLP exporter before calling browser init(). Selecting this transport replaces Studio delivery. Propagation is disabled by default and may require server CORS changes when enabled.

Installation and artifacts

See registry availability and setup. npm uses @tracelens/*; the GitHub Packages mirror uses @leracherry/tracelens-*. npm scope access previously blocked publication and is checked separately by the workflow. GitHub Release assets contain nine npm-format tarballs; those do not imply npm registry availability.

Limits

The OTLP transport is not an OpenTelemetry SDK SpanExporter. It exports traces only; Web Vitals are represented as spans, not metrics. XHR timing is exported but propagation is fetch-only. Existing external trace contexts are preserved but not adopted as local parents. This is not a general-purpose asynchronous context manager.

Studio remains a local, unauthenticated, in-memory tool. Privacy auditing is heuristic. Source maps, CI budgets, and hosted collection remain future work. Automated tests exercise OTLP payloads and transport behavior; a live Collector integration was not validated locally.

Guides: Privacy · OpenTelemetry.