v0.15.0

0.15.0 hardens what 0.14.0 started. It fixes findings from a dependency audit of chrome-launcher, commander, devtools-protocol and ws. Each finding was reproduced in a real browser before it was fixed, and every change went through an independent review.

Breaking changes

• network har writes a sanitized HAR by default, as Chrome DevTools has done since Chrome 130:
  • Headers: credential headers (Authorization, Cookie, Set-Cookie, API-key, token and session headers) keep their names, but their values become [redacted].
  • Cookies: every cookie value is redacted; names and attributes stay.
  • Request bodies: sensitive fields are redacted in JSON, form and multipart bodies.
  • URLs: sensitive query and fragment parameters are redacted in request URLs, redirects, Location and Referer (?code=, ?access_token=, #access_token=, ?sig=).
  • Full export: --include-sensitive writes the full HAR as before. HAR files are written with mode 0600.
  • Response bodies and WebSocket messages are not sanitized yet (#502).

Security

• Session directories are private and checked before use. ~/.bdg, $BDG_SESSION_DIR and named sessions are created 0700.
  • Refused (exit 103): a symlink, a directory owned by another user, or one that others can write to. The error says why and how to fix it.
  • Upgrades are safe: an existing ~/.bdg from earlier versions (0755, or 0775 under umask 002) is accepted and tightened. A directory you chose with BDG_SESSION_DIR is never chmodded.
• A symlinked daemon.log is refused, not followed. Before, the daemon appended its log to whatever file the link pointed to.

Fixes

• Chrome's background downloads are off again. bdg's own --disable-features replaced chrome-launcher's list, which turned 9 of its 10 disabled features back on. Every new profile downloaded about 45 MB of ML models within a minute. There is now one merged flag: a fresh profile is 8.8 MB instead of 54 MB. A feature you enable with --chrome-flags still wins.
• HEADLESS=1 in the environment no longer forces headless Chrome.
• Headless sessions keep their client hints. Hiding HeadlessChrome used to empty navigator.userAgentData.brands, which made the browser easier to detect. Brands, full versions and platform version now match a regular Chrome tab.
• dom eval --json bounds object and array results. Arrays list 100 elements with count/omitted, and larger values become a JSON-text prefix with truncatedFrom (2 MB → 23 KB). --full now returns every entry; it used to cut at 1000.
• Clearer hints:
  • "Did you mean: form or frames?" instead of "one of form, frames".
  • cdp sits on one line in bdg --help.
  • When no Chrome is found, the error suggests CHROME_PATH for Edge, Brave or Chromium.

Full list: CHANGELOG.