v0.17.0

bdg v0.17.0

bdg 0.17.0 lets agents work with more than one tab: actions now report the tabs and popups they open, and bdg page tabs|switch|close move between them. You can save a logged-in browser state and load it again, and bdg cdp can collect CDP events (tracing, Fetch interception). A secrets theme runs through the release: credentials in network details, page URLs and HTML bodies are now masked by default, which changes three defaults (see "Changed defaults").

Highlights

• Tabs and popups: click results list what they opened (Opened: popup ... (bdg page switch 1)); bdg page tabs, page switch and page close drive them, and an OAuth popup that closes itself returns you to its opener (#556, #558).
• Auth state: bdg state save <file> / bdg state load <file> and bdg <url> --state <file> keep cookies and storage across sessions, in a 0600 file (#566).
• CDP event collection: bdg cdp <Method> --collect <Event> --until <Event> --out file.ndjson, plus buffered --listen / --events (#549).
• JS dialogs your way: --dialog accept|dismiss and --prompt-text on DOM actions and for a whole session (#550, #561).
• Why things failed: actions report the console errors they caused (#548), blocked submits name the fields (#581, #598), blocked cookies show in details network (#564), and bdg console lists Chrome Issues such as quirks mode and form errors (#551).
• Network lists you can steer: network list --page current --sort size, and details network --body|--no-body|--body-max (#565).
• Sturdier DOM commands: dom fill types like a user so minlength applies (#607), parallel commands no longer break each other (#602), closed shadow roots work for clicks (#604), and dom query rows are about 70% smaller on class-heavy pages (#571).
• Secrets: masking for DOM output, network details, URLs and HAR bodies (#597, #627, #638, #648, #649, #650), and page scripts no longer carry typed values in CDP expressions (#626, #654).

Changed defaults

• details network, network headers, network document mask credentials (#638): cookies, Authorization, API-key headers, secret URL parameters and body fields show ••••. Add --include-sensitive for the raw values.
• Page URLs lose user:pass@ and mask tokens (#650) in all output and daemon.log. Add --include-sensitive to status, sessions, page info, page tabs, network list or peek to see them as they are.
• The default HAR and details network --body mask secret form-control values in HTML bodies (#648). Use --include-sensitive to keep everything.
• Also: dom fill types text like a user (#607), secret fields report validity state instead of Chrome's message (#649), and Submit blocked appears in click and key results (#581, #598). To read a masked DOM value, use bdg dom eval.

Thanks

A warm welcome to @jay23606, whose first pull request here (#651) landed this release: bdg cleanup now removes atomic-write leftovers from the session directory. It was reviewed and merged the same day, and more is very welcome: issues, ideas and pull requests all help.

Install

npm install -g browser-debugger-cli

Full changelog: v0.16.0...v0.17.0