browser-commander 0.27.0 → 0.29.0

package/src/traces/stop.js

@@ -0,0 +1,160 @@
+import { createManifest, TRACE_EVENT, TRACE_OUTCOME } from './schema.js';
+import { readTrace } from './reader.js';
+import { writeHar } from './network.js';
+import { gzipTrace } from './storage.js';
+import { abortTraceStart } from './start-cleanup.js';
+export function createTraceStop(context) {
+  const {
+    getStopped,
+    setStopped,
+    options,
+    detachers,
+    navigationCapture,
+    video,
+    detachNetwork,
+  } = context;
+  const {
+    mutations,
+    captureState,
+    record,
+    note,
+    bundle,
+    checkpoints,
+    linksSink,
+    network,
+  } = context;
+  const {
+    recorderMode,
+    startedAt,
+    now,
+    commanderVersion,
+    engine,
+    domOptions,
+    eventSources,
+    privacyOptions,
+    limits,
+  } = context;
+  let stopping;
+  async function stop(stopOptions = {}) {
+    if (getStopped()) {
+      return getStopped();
+    }
+    const { discard = false, error = null } = stopOptions;
+
+    {
+      for (const detach of detachers.splice(0)) {
+        try {
+          await detach();
+        } catch (error) {
+          note(`could not detach a listener: ${error.message}`);
+        }
+      }
+      await navigationCapture();
+    }
+    if (video) {
+      const recording = await video.stop();
+      if (recording.bytes) {
+        await bundle.writeMember(
+          `recording.${recording.format}`,
+          recording.bytes
+        );
+      }
+    }
+    await detachNetwork();
+    await mutations.drain(captureState.index);
+    if (error) {
+      await record(TRACE_EVENT.PAGE_ERROR, {
+        message: error.message ?? String(error),
+        stack: error.stack ?? null,
+        fatal: true,
+      });
+    }
+    await record(TRACE_EVENT.TRACE_STOP, { discarded: discard });
+    setStopped(true);
+
+    // The documents that exist stop observing here; the engine's init-script
+    // registration is removed with the detachers below.
+    await mutations.stop();
+
+    for (const detach of detachers.reverse()) {
+      try {
+        await detach();
+      } catch (detachError) {
+        note(`could not detach a listener: ${detachError.message}`);
+      }
+    }
+
+    const manifest = await bundle.close(
+      createManifest({
+        mode: recorderMode,
+        startedAt,
+        stoppedAt: new Date(now()).toISOString(),
+        outcome: TRACE_OUTCOME.COMPLETE,
+        commanderVersion,
+        engine,
+        dom: domOptions,
+        events: eventSources,
+        replay: {
+          checkpoints: true,
+          mutations: Boolean(domOptions.mutations),
+          childListPositions: Boolean(domOptions.mutations),
+          liveState:
+            Boolean(domOptions.mutations) && domOptions.liveState !== false,
+          identifiers: true,
+        },
+        privacy: {
+          redactSelectors: privacyOptions.redactSelectors,
+          redactAttributes: privacyOptions.redactAttributes,
+          redactQueryParams: privacyOptions.redactQueryParams,
+          hasCallback: Boolean(privacyOptions.redact),
+        },
+        limits,
+      })
+    );
+
+    // Closed after the manifest, because the closing link reports the outcome
+    // the manifest settled on, and the control diffs are read back out of the
+    // finished bundle rather than kept in memory for the length of a run.
+    if (linksSink) {
+      await linksSink.close({ manifest, bundlePath: bundle.root });
+    }
+    if (network?.har) {
+      await writeHar(
+        await readTrace(bundle.root),
+        typeof network.har === 'string' ? network.har : undefined
+      );
+    }
+    if (options.gzip || limits.gzip) {
+      await gzipTrace(bundle.root);
+    }
+
+    const result = {
+      path: bundle.root,
+      manifest,
+      checkpoints: [...checkpoints],
+      problems: [...bundle.problems, ...(linksSink?.problems ?? [])],
+      links: linksSink?.path ?? null,
+      ...(bundle.segments?.length ? { segments: bundle.segments } : {}),
+    };
+    setStopped(result);
+
+    if (discard) {
+      const fs = await import('node:fs/promises');
+      await fs.rm(bundle.root, { recursive: true, force: true });
+      // An export of a bundle that no longer exists points at nothing.
+      await linksSink?.discard();
+      result.discarded = true;
+    }
+
+    return result;
+  }
+
+  return (options) => {
+    stopping ??= stop(options).catch(async (error) => {
+      setStopped(true);
+      await abortTraceStart({ ...context, video: null }).catch(() => {});
+      throw error;
+    });
+    return stopping;
+  };
+}

package/src/traces/storage.js

@@ -0,0 +1,43 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { gzip, gunzip } from 'node:zlib';
+import { promisify } from 'node:util';
+const compress = promisify(gzip),
+  decompress = promisify(gunzip);
+
+export async function readTraceText(file) {
+  try {
+    return await fs.readFile(file, 'utf8');
+  } catch (error) {
+    if (error.code !== 'ENOENT') {
+      throw error;
+    }
+    try {
+      return (await decompress(await fs.readFile(`${file}.gz`))).toString(
+        'utf8'
+      );
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        return null;
+      }
+      throw error;
+    }
+  }
+}
+
+/** Compress closed NDJSON members only; active traces remain crash-readable. */
+export async function gzipTrace(root) {
+  for (const item of await fs.readdir(root, { withFileTypes: true })) {
+    const file = path.join(root, item.name);
+    if (item.isDirectory()) {
+      await gzipTrace(file);
+    } else if (item.name.endsWith('.ndjson')) {
+      const temporary = `${file}.gz.tmp`;
+      await fs.writeFile(temporary, await compress(await fs.readFile(file)), {
+        mode: 0o600,
+      });
+      await fs.rename(temporary, `${file}.gz`);
+      await fs.rm(file);
+    }
+  }
+}

package/src/utilities/subprocess.js

@@ -1,5 +1,37 @@
 import { ProcessRunner } from 'command-stream/process-runner';
 
+/** Start an explicitly persistent process, with no parent-owned pipes or signal forwarding. */
+export async function startDetachedProcess(file, args = [], options = {}) {
+  const runner = runnerFor(file, args, { ...options, capture: false });
+  runner.start();
+  await new Promise((resolve, reject) => {
+    runner.child.once('spawn', resolve);
+    runner.child.once('error', reject);
+  });
+  const child = runner.child;
+  // command-stream 1.x starts noninteractive children in their own process
+  // group. Release its controller-owned cancellation registry while retaining
+  // the child's exit listeners. Keep this adapter isolated until it exposes a
+  // public detach operation; normal subprocesses retain managed cancellation.
+  runner._child = null;
+  runner._abortController = null;
+  runner.finished = true;
+  runner._cleanup();
+  Promise.resolve(runner).catch(() => {});
+  child.stderrTail = '';
+  child.stderr?.on('data', (chunk) => {
+    child.stderrTail = (child.stderrTail + String(chunk)).slice(-8192);
+  });
+  child.on('error', (error) => {
+    child.spawnError = error;
+  });
+  child.unref();
+  child.stdout?.unref?.();
+  child.stderr?.unref?.();
+  child.stdin?.unref?.();
+  return child;
+}
+
 /**
  * Every subprocess Browser Commander starts - browsers, WebDriver servers, the
  * engine bridge, credential tools (`security`, `secret-tool`, `kwallet-query`,

package/tests/e2e/cli.e2e.test.js

@@ -15,6 +15,8 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
 import { readFileSync } from 'node:fs';
+import { readFile, rm } from 'node:fs/promises';
+import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { ProcessRunner } from 'command-stream/process-runner';
@@ -23,6 +25,10 @@ import { normalizeRunOutput } from '../../../tests/cli-contract/normalize.mjs';
 import { runCommand } from '../../src/utilities/subprocess.js';
 import { SANDBOX_ARGS } from '../helpers/e2e-browser.js';
 import { repoPath } from '../helpers/repo.js';
+import {
+  closeRemoteBrowser,
+  SESSION_METADATA,
+} from '../../src/browser/persistent-session.js';
 
 const BIN = fileURLToPath(
   new URL('../../bin/browser-commander.js', import.meta.url)
@@ -124,8 +130,9 @@ for (const engine of ENGINES) {
       E2E,
       async () => {
         const { runner, printed } = startKeptOpenBrowser(engine);
+        let launched;
         try {
-          const launched = await printed;
+          launched = await printed;
           assert.match(launched.cdpEndpoint, /^http:\/\/127\.0\.0\.1:\d+$/u);
           const attach = [
             '--cdp-endpoint',
@@ -153,6 +160,18 @@ for (const engine of ENGINES) {
         } finally {
           runner.kill('SIGTERM');
           await Promise.resolve(runner).catch(() => {});
+          if (launched?.userDataDir) {
+            const file = path.join(launched.userDataDir, SESSION_METADATA);
+            const metadata = JSON.parse(await readFile(file, 'utf8'));
+            await closeRemoteBrowser(metadata.webSocketDebuggerUrl);
+            await assert.rejects(fetch(`${launched.cdpEndpoint}/json/version`));
+            // Chrome finishes flushing its profile after closing CDP.
+            await rm(launched.userDataDir, {
+              recursive: true,
+              force: true,
+              maxRetries: 5,
+            });
+          }
         }
       }
     );

package/tests/e2e/click-readiness.e2e.test.js

@@ -216,7 +216,7 @@ describe(
         });
 
         assert.strictEqual(result.ready, false);
-        assert.strictEqual(result.status, 'timed_out');
+        assert.strictEqual(result.status, 'timed_out', JSON.stringify(result));
         assert.ok(
           elapsed < 6000,
           `the wait took ${elapsed}ms for a 1500ms budget`

package/tests/e2e/issue-160.e2e.test.js

@@ -0,0 +1,291 @@
+import { it } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import net from 'node:net';
+import {
+  startTrace,
+  readTrace,
+  connectOrLaunch,
+  connectBrowser,
+} from '../../src/index.js';
+import { isNavigationError } from '../../src/core/navigation-safety.js';
+import { startProcess } from '../../src/utilities/subprocess.js';
+import {
+  closeOwnedSession,
+  closeRemoteBrowser,
+  SESSION_METADATA,
+  probeSession,
+} from '../../src/browser/persistent-session.js';
+import {
+  launchE2EBrowser,
+  CHROME_LAUNCH_OPTIONS,
+  PARITY_CHROME,
+} from '../helpers/e2e-browser.js';
+import { sendHtml, startFixtureHost } from '../helpers/fixture-server.js';
+
+const options = { skip: !process.env.RUN_E2E, timeout: 60000 };
+async function removeProfile(userDataDir) {
+  await fs.rm(userDataDir, {
+    recursive: true,
+    force: true,
+    maxRetries: 10,
+    retryDelay: 100,
+  });
+}
+async function port() {
+  const server = net.createServer();
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const number = server.address().port;
+  await new Promise((resolve) => server.close(resolve));
+  return number;
+}
+async function until(predicate) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    if (await predicate()) {
+      return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  throw new Error('browser condition did not settle');
+}
+
+for (const engine of ['playwright', 'puppeteer']) {
+  it(
+    `records bounded, private mutations and interrupted goto: ${engine}`,
+    options,
+    async () => {
+      const output = await fs.mkdtemp(path.join(os.tmpdir(), 'bc-160-e2e-'));
+      const launched = await launchE2EBrowser({ engine });
+      let trace;
+      let slowStarted;
+      const started = new Promise((resolve) => {
+        slowStarted = resolve;
+      });
+      const server = await startFixtureHost((route, req, res) => {
+        if (route === '/private') {
+          res.setHeader('content-type', 'application/json');
+          res.setHeader('X-Xsrftoken', 'PRIVATE_HEADER');
+          res.end(
+            JSON.stringify({ token: 'PRIVATE_RESPONSE', public: 'visible' })
+          );
+        } else if (route === '/slow') {
+          slowStarted();
+          req.once('close', () => res.destroy());
+        } else {
+          sendHtml(
+            res,
+            '<div id="app">public</div><input type="hidden" value="PRIVATE_HIDDEN"><meta name="csrf-token" content="PRIVATE_META"><script>window.xsrfToken="PRIVATE_SCRIPT";</script>'
+          );
+        }
+      });
+      try {
+        await launched.page.goto(server.baseUrl);
+        trace = await startTrace({
+          page: launched.page,
+          engine,
+          output,
+          mode: 'continuous',
+          screenshots: false,
+          network: { bodies: true, har: true },
+          gzip: engine === 'puppeteer',
+          privacy: { redactPatterns: [/PRIVATE_DYNAMIC/g] },
+          links: { dom: 'full', output: path.join(output, 'trace.lino') },
+        });
+        await launched.page.evaluate(async () => {
+          await fetch('/private?xsrf=PRIVATE_QUERY', {
+            method: 'POST',
+            headers: {
+              'content-type': 'application/json',
+              'X-Xsrftoken': 'PRIVATE_HEADER',
+            },
+            body: JSON.stringify({
+              password: 'PRIVATE_PASSWORD',
+              _xsrf: 'PRIVATE_BODY',
+              public: 'visible',
+            }),
+          }).then((response) => response.text());
+        });
+        await launched.page.evaluate(() => {
+          const app = document.querySelector('#app');
+          app.innerHTML = `<section>${'public'.repeat(1000)}</section>`;
+          for (let i = 0; i < 50; i++) {
+            const node = document.createElement('span');
+            node.textContent = `public-${i} PRIVATE_DYNAMIC`;
+            app.appendChild(node);
+          }
+          document.querySelector('meta').content = 'PRIVATE_CHANGED';
+        });
+        await trace.checkpoint('after');
+        await trace.stop();
+        const opened = await readTrace(output);
+        const batches = await opened.mutations(opened.checkpoints[0].index);
+        const data = JSON.stringify(batches);
+        assert.ok(data.length < 60000, `mutation bytes: ${data.length}`);
+        for (const batch of batches) {
+          for (const record of batch.records ?? []) {
+            assert.equal(record.target?.html, undefined);
+          }
+        }
+        const contents = [
+          data,
+          JSON.stringify(opened.events),
+          await fs.readFile(path.join(output, 'trace.lino'), 'utf8'),
+          await fs.readFile(path.join(output, 'network.har'), 'utf8'),
+          ...(await Promise.all(
+            opened.checkpoints.map((cp) => opened.html(cp.index))
+          )),
+        ];
+        for (const text of contents) {
+          assert.doesNotMatch(text, /PRIVATE_/);
+          assert.match(text, /public|visible/);
+        }
+        const interrupted = launched.page
+          .goto(`${server.baseUrl}/slow`)
+          .catch((error) => error);
+        await started;
+        await launched.page.goto(server.baseUrl);
+        assert.equal(isNavigationError(await interrupted), true);
+      } finally {
+        await trace?.stop();
+        await launched.cleanup();
+        await server.close();
+        await fs.rm(output, { recursive: true, force: true });
+      }
+    }
+  );
+}
+
+it(
+  'adopts a verified profile, heartbeats an idle controller and closes later tabs',
+  options,
+  async () => {
+    const userDataDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), 'bc-160-session-')
+    );
+    const remoteDebuggingPort = await port();
+    const settings = {
+      engine: 'playwright',
+      userDataDir,
+      remoteDebuggingPort,
+      idleTimeoutMs: 2500,
+      headless: true,
+      ...CHROME_LAUNCH_OPTIONS,
+    };
+    let session, originalOwner;
+    try {
+      session = await connectOrLaunch(settings);
+      originalOwner = JSON.parse(
+        await fs.readFile(path.join(userDataDir, SESSION_METADATA), 'utf8')
+      );
+      const originalUrl = session.page.url();
+      const preferred = await session.browser.contexts()[0].newPage();
+      await preferred.goto('data:text/html,<p>preferred tab</p>');
+      const preferredUrl = preferred.url();
+      assert.ok(
+        (await session.reusePage({
+          urlMatchers: [preferredUrl, originalUrl],
+        })) === preferred,
+        'ranked URL matchers must override the remembered target'
+      );
+      await session.detach();
+      session = await connectOrLaunch({
+        ...settings,
+        urlMatchers: [originalUrl, preferredUrl],
+      });
+      assert.equal(session.page.url(), originalUrl);
+      await session.detach();
+      await fs.rm(path.join(userDataDir, SESSION_METADATA));
+      session = await connectOrLaunch({
+        ...settings,
+        adoptExisting: true,
+        closeNewTabs: true,
+        singleTab: true,
+      });
+      assert.equal(session.adopted, true);
+      const selected = session.page;
+      await session.browser
+        .contexts()[0]
+        .newPage()
+        .catch(() => {});
+      await until(() => session.browser.contexts()[0].pages().length === 1);
+      assert.equal(session.page, selected);
+      await selected.close();
+      const replacement = await session.reusePage();
+      assert.equal(replacement.isClosed(), false);
+      await new Promise((resolve) => setTimeout(resolve, 4000));
+      assert.ok(await probeSession(`http://127.0.0.1:${remoteDebuggingPort}`));
+      await session.detach();
+      await closeOwnedSession(
+        path.join(userDataDir, SESSION_METADATA),
+        JSON.parse(
+          await fs.readFile(path.join(userDataDir, SESSION_METADATA), 'utf8')
+        )
+      );
+    } finally {
+      await session?.detach();
+      const metadataFile = path.join(userDataDir, SESSION_METADATA);
+      const metadata = await fs
+        .readFile(metadataFile, 'utf8')
+        .then(JSON.parse, () => null);
+      if (metadata) {
+        await closeOwnedSession(metadataFile, metadata);
+      } else if (originalOwner) {
+        const version = await probeSession(
+          `http://127.0.0.1:${remoteDebuggingPort}`
+        );
+        if (
+          version?.webSocketDebuggerUrl === originalOwner.webSocketDebuggerUrl
+        ) {
+          await closeRemoteBrowser(version.webSocketDebuggerUrl);
+        }
+      }
+      await removeProfile(userDataDir);
+    }
+  }
+);
+
+it(
+  'reconnects to headed Chrome with no page targets in its default context',
+  options,
+  async () => {
+    const userDataDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), 'bc-160-zero-pages-')
+    );
+    const remoteDebuggingPort = await port();
+    const endpoint = `http://127.0.0.1:${remoteDebuggingPort}`;
+    const process = startProcess(PARITY_CHROME, [
+      ...(CHROME_LAUNCH_OPTIONS.args ?? []),
+      `--user-data-dir=${userDataDir}`,
+      `--remote-debugging-port=${remoteDebuggingPort}`,
+      '--no-startup-window',
+      '--keep-alive-for-test',
+      '--no-first-run',
+    ]);
+    let connection;
+    try {
+      await until(() => probeSession(endpoint));
+      const targets = await fetch(`${endpoint}/json/list`).then((response) =>
+        response.json()
+      );
+      assert.equal(
+        targets.filter((target) => target.type === 'page').length,
+        0
+      );
+      connection = await connectBrowser({
+        engine: 'playwright',
+        cdpEndpoint: endpoint,
+      });
+      assert.ok(connection.page);
+      await connection.page.goto('data:text/html,<p>public profile page</p>');
+      await connection.detach();
+      assert.ok(await probeSession(endpoint));
+    } finally {
+      await connection?.detach();
+      process.kill();
+      await process.exited;
+      await removeProfile(userDataDir);
+    }
+  }
+);

package/tests/fixtures/traces/conformance/expected/bundle/checkpoints/0002.html

@@ -1,2 +1,2 @@
 <!DOCTYPE html>
-<html><body><form><input name="user" value="bob"><textarea>sk-zzz9 note</textarea></form></body></html>
+<html><body><form><input name="user" value="bob"><textarea>[redacted] note</textarea></form></body></html>

package/tests/fixtures/traces/conformance/expected/bundle/checkpoints/0003.html

@@ -1,2 +1,2 @@
 <!DOCTYPE html>
-<html><body><form><input name="user" value="bob"><textarea>sk-zzz9 note</textarea></form></body></html>
+<html><body><form><input name="user" value="bob"><textarea>[redacted] note</textarea></form></body></html>

package/tests/fixtures/traces/conformance/expected/bundle/events.ndjson

@@ -10,9 +10,9 @@
 {"sequence":10,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"interaction","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","actionId":"trace-1-action-1","action":"goto","target":"https://example.com/next?code=abc","durationMs":0,"ok":true}
 {"sequence":11,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"interaction","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","actionId":"trace-1-action-2","action":"clickButton","target":"#go","durationMs":0,"ok":false,"error":"button #go is not visible"}
 {"sequence":12,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"dropped","reason":"size-limit","member":"mutations","detail":"2 records over the in-page queue limit"}
-{"sequence":13,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"mutations","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","member":"mutations/0001.ndjson","batches":2,"checkpoint":1,"frames":1}
+{"sequence":13,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"mutations","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","member":"mutations/0001.ndjson","batches":2,"checkpoint":1,"frames":1,"truncated":false}
 {"sequence":14,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"checkpoint","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","index":2,"name":"after click","actor":"automation","reason":"checkpoint","url":"https://example.com/next?token=[redacted]","truncated":true,"members":{"html":"checkpoints/0002.html","state":"checkpoints/0002.state.json","screenshot":"checkpoints/0002.png"}}
 {"sequence":15,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"interaction","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","action":"note","actor":"caller","authorization":"[redacted]","detail":"uses [redacted]","pageUrl":"https://example.com/?session=[redacted]","count":3,"ratio":0.25,"whole":2,"nested":{"list":[1,"two",null,true]}}
-{"sequence":16,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"mutations","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","member":"mutations/0002.ndjson","batches":1,"checkpoint":2,"frames":1}
+{"sequence":16,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"mutations","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","member":"mutations/0002.ndjson","batches":1,"checkpoint":2,"frames":1,"truncated":false}
 {"sequence":17,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"checkpoint","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","index":3,"name":"final","actor":"caller","reason":"failure","url":"https://example.com/next?token=[redacted]","truncated":true,"members":{"html":"checkpoints/0003.html","state":"checkpoints/0003.state.json","screenshot":"checkpoints/0003.png"}}
 {"sequence":18,"at":"2026-01-01T00:00:00.000Z","monotonicMs":1235,"kind":"trace.stop","traceId":"trace-1","browserContextId":"context-1","pageId":"page-1","navigationId":"nav-2","discarded":false}

package/tests/fixtures/traces/conformance/expected/bundle/manifest.json

@@ -36,6 +36,7 @@
   "privacy": {
     "redactSelectors": [
       "input[type=password]",
+      "input[type=hidden]",
       "[data-private]",
       "[data-bc-redact]"
     ],
@@ -61,6 +62,9 @@
       "session",
       "signature",
       "token",
+      "csrf",
+      "xsrf",
+      "_xsrf",
       "ticket"
     ],
     "hasCallback": false