feat: enable console log recording in session replays

[KAUSHALCODER123]

Feature: Enabled console log recording and playback in session replays.
Settings: Added a "Record console logs" toggle in the Website Replay settings UI.
Tracker: Integrated @rrweb/rrweb-plugin-console-record to capture console logs during recording.
Player: Integrated @rrweb/rrweb-plugin-console-replay to display logs during playback.
Localization: Added translation strings for English (US and GB).

[vercel]

@KAUSHALCODER123 is attempting to deploy a commit to the Umami Software Team on Vercel.

A member of the Team first needs to authorize it.

[KAUSHALCODER123]

please accept pull requst

[greptile-apps]

Greptile Summary

This PR adds an opt-in "Record console logs" feature to session replays by integrating @rrweb/rrweb-plugin-console-record in the tracker and @rrweb/rrweb-plugin-console-replay in the player, alongside a settings toggle and two localization strings. It also bumps rrweb and rrweb-player from 2.0.0-alpha.4/1.0.0-alpha.4 to 2.0.0-alpha.20.

• Unconditional player plugin: getReplayConsolePlugin() is always added to the replay player regardless of the recordConsole setting, so sessions recorded without console logging will display an empty console panel.
• Major version bump: rrweb-player jumps from 1.x-alpha to 2.x-alpha with structural dependency changes, which could silently regress existing replay playback.
• Privacy exposure: The console plugin captures all console.* output without any filtering, so secrets, tokens, or PII logged by third-party scripts will be stored in replay events.

Confidence Score: 3/5

Two real defects need fixing before merging: the player always shows a console panel even when console recording was disabled, and the rrweb-player major version bump is untested alongside existing replay data.

The player unconditionally injects the console replay plugin for all sessions, contradicting the explicit opt-out setting. Combined with an undiscussed major-version upgrade of rrweb-player (1.x to 2.x across 16 alpha releases, with a restructured dependency tree), there is real risk that existing replay functionality regresses for all users.

ReplayPlayer.tsx (unconditional plugin injection) and package.json/pnpm-lock.yaml (rrweb-player 1.x to 2.x major bump with dependency restructuring)

Important Files Changed

Filename	Overview
src/app/(main)/websites/[websiteId]/replays/[replayId]/ReplayPlayer.tsx	Console replay plugin unconditionally loaded for all sessions regardless of the recordConsole setting — renders an empty console panel for opt-out sessions.
package.json	Adds two new rrweb console plugins and bumps rrweb + rrweb-player from alpha.4/1.x to alpha.20/2.x — a major-version jump bundled with the feature that could regress existing replay playback.
src/recorder/index.js	Correctly reads data-record-console and conditionally activates the record plugin; all console output is captured without filtering.
src/app/(main)/websites/[websiteId]/settings/WebsiteReplaySettings.tsx	Adds recordConsole toggle with proper state management; data-record-console attribute correctly omitted when false.
src/components/messages.ts	Adds recordConsole label key; consistent with existing pattern.

_{Reviews (1): Last reviewed commit: "feat: enable console log recording in se..." | Re-trigger Greptile}

[greptile-apps]

Console replay panel always shown regardless of recording config

getReplayConsolePlugin() is unconditionally injected into every player instance, even for sessions recorded when recordConsole was false (the default). Those sessions contain no console events, so the player will render an empty console panel — contradicting the explicit opt-out. The ReplayPlayer component should receive the recordConsole flag (or derive it from the events list) and conditionally include the plugin.

[greptile-apps]

rrweb-player major version jump may break existing replay playback

rrweb-player was bumped from 1.0.0-alpha.4 to 2.0.0-alpha.20 — a major-version change across 16 alpha releases. The lock file confirms the new package no longer directly lists rrweb as a dependency; it now pulls in @rrweb/packer and @rrweb/replay instead, indicating significant internal restructuring. Bundling this breaking upgrade with the console-log feature makes it harder to bisect regressions if existing replays stop playing correctly.

[greptile-apps]

When recordConsole is false (the default), the data-record-console attribute is correctly omitted. Consider a strict equality guard to future-proof against accidental inclusion of a falsy string value.

Suggested change

	if (recordConsole) recorderAttrs += ` data-record-console="true"`;
	if (recordConsole === true) recorderAttrs += ` data-record-console="true"`;

[greptile-apps]

Console logs may capture sensitive data before masking rules apply

getRecordConsolePlugin() intercepts console.* calls wholesale. Secrets, tokens, PII, or debug payloads logged by third-party SDKs will be transmitted to the server and stored in replay events. Unlike DOM masking (configurable via maskLevel), there is no filtering or redaction option. Consider documenting this risk near the toggle, or providing a level option (e.g., warn/error only) to limit exposure.