v0.16.0

0.16.0 is about trust in what bdg reports. A busy, slow or starved page is reported as it is. Ctrl-C always leaves a clean session. Downloads stay out of your ~/Downloads. The default HAR no longer leaks tokens from responses. Every change was reproduced before it was fixed and went through an independent review. Timing-sensitive changes were also run 10–20 times on Linux and macOS CI.

Behaviour changes

• A page whose JavaScript is blocked or starved is no longer reported settled. After dom click / pressKey, time when the page's main thread could not run no longer counts as a quiet gap between DOM changes. That covers a long task, and also a starved event loop on a slow machine. bdg detects this with a lightweight 20 ms heartbeat in its own isolated world, which the page doesn't see. A page busy running JS is now pending.domChanging. A page that rendered once and then ran heavy JS may get the 250 ms second look. Clicks on idle pages are as fast as before.
• Downloads go to the session directory (<session dir>/downloads/, created 0700) instead of your real ~/Downloads. They are reported in the action result, and in status and peek. This includes downloads from target=_blank links and window.open(). If the directory can't be created, downloads are refused rather than falling back to ~/Downloads. With --chrome-ws-url, the browser isn't bdg's, so downloads stay in that Chrome's own folder; this is documented.

Security

• The default HAR redacts response bodies and WebSocket messages. Before, it redacted request bodies only. The credential fields are redacted in:

  • JSON and form bodies;
  • truncated JSON, and JSON inside string values;
  • socket.io, SockJS and Engine.io packets;
  • SSE, NDJSON and base64 bodies;
  • UTF-8 binary WebSocket frames.

  JWTs are redacted under any key. --include-sensitive still writes everything.

• Sanitizing keeps every other byte. Request bodies used to be parsed and re-serialized, which rounded 64-bit integers. Only credential values are replaced now, in one linear pass.

• More credential names are redacted and masked, for example passphrase, csrf, auth_code, code_verifier, and camelCase names like userPin.

Fixes

• Ctrl-C works cleanly:
  • On bdg <url>, at any moment, Ctrl-C leaves no session answering, exits 130 (143 for SIGTERM), and orphans no Chrome. bdg stop during a slow start ends it at once.
  • On dom screenshot, the next command sees the session's own viewport, DPR and touch emulation. Page commands wait for a running capture's restore. With --json, the error envelope is printed.
• bdg cdp:
  • Methods missing from the bundled protocol are sent to Chrome with a warning.
  • Typos still exit 81, and --send-anyway overrides that.
  • --describe shows redirects, enums and types, with realistic example values.
  • Errors say why a method is missing: wrong case, unknown domain, or a protocol redirect to a method that doesn't exist.
• Busy and settled reporting:
  • A static page on a loaded machine is no longer reported busy, because a starved renderer is told apart from a long task.
  • Pages changing every 100–150 ms are reported as changing.
• Network:
  • Request bodies count toward the 100 MB body budget.
  • A response body Chrome refused to return now says why (bodyNotCaptured).
• Misleading Chrome errors fixed: a slow Chrome start is no longer reported as a port conflict. A failed screenshot reports the real error.

Also

• The npm description and keywords now say what bdg is for: coding agents driving and debugging Chrome from the shell.
• CI runs macOS smoke tests on pull requests that touch timing-sensitive code. The timing tests wait for events instead of sleeping.

Install

npm install -g browser-debugger-cli

Full list: CHANGELOG · Compare: v0.15.0...v0.16.0