browser-debugger-cli 0.8.0 → 0.9.0

package/dist/connection/launcher/profilePreferences.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Chrome profile preferences writer.
+ *
+ * Chrome reads `<user-data-dir>/Default/Preferences` as nested JSON and looks
+ * preferences up by path (`profile.password_manager_enabled` is
+ * `{"profile": {"password_manager_enabled": ...}}`). bdg's preferences use
+ * dotted names, so they are expanded into that structure and deep-merged into
+ * the existing file: persistent profiles reused across sessions get them too,
+ * and everything else Chrome stored there is kept.
+ */
+import type { Logger } from '../types.js';
+/** JSON object as stored in the Preferences file */
+type PrefsObject = Record<string, unknown>;
+/**
+ * Merge preferences into an existing Preferences object.
+ *
+ * Dotted names become nested paths, and a literal dotted top-level key (as
+ * earlier bdg versions wrote, which Chrome ignored) is removed.
+ *
+ * @param existing - Current Preferences content
+ * @param prefs - Preferences to apply, dotted or nested
+ * @returns Merged Preferences (a new object; `existing` is not modified)
+ */
+export declare function mergePreferences(existing: PrefsObject, prefs: PrefsObject): PrefsObject;
+/**
+ * Whether a running Chrome has the profile open, judged by its
+ * `SingletonLock` symlink (`<host>-<pid>`, macOS and Linux).
+ *
+ * @param userDataDir - Chrome user data directory
+ * @returns True if the lock names a live process on this host
+ */
+export declare function profileInUse(userDataDir: string): boolean;
+/**
+ * Apply preferences to the default profile in a Chrome user data directory.
+ *
+ * Failures are logged (visible in daemon.log), not thrown: Chrome still
+ * starts, only without them. An unreadable Preferences file and a profile
+ * that a running Chrome has open are left alone, and the file is not
+ * rewritten when nothing changes.
+ *
+ * @param userDataDir - Chrome user data directory
+ * @param prefs - Preferences to apply, dotted or nested
+ * @param logger - Logger for failures
+ */
+export declare function writeProfilePreferences(userDataDir: string, prefs: PrefsObject, logger: Logger): void;
+export {};
+//# sourceMappingURL=profilePreferences.d.ts.map

package/dist/connection/launcher/profilePreferences.js

@@ -0,0 +1,151 @@
+/**
+ * Chrome profile preferences writer.
+ *
+ * Chrome reads `<user-data-dir>/Default/Preferences` as nested JSON and looks
+ * preferences up by path (`profile.password_manager_enabled` is
+ * `{"profile": {"password_manager_enabled": ...}}`). bdg's preferences use
+ * dotted names, so they are expanded into that structure and deep-merged into
+ * the existing file: persistent profiles reused across sessions get them too,
+ * and everything else Chrome stored there is kept.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { chromePrefsNotAppliedMessage } from '../../ui/messages/chrome.js';
+import { getErrorMessage } from '../../utils/errors.js';
+import { isProcessAlive } from '../../utils/process.js';
+/**
+ * Whether a value is a plain JSON object (not an array or null).
+ *
+ * @param value - Value to check
+ * @returns True for objects that can be merged into
+ */
+function isPrefsObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Set a preference at a nested path, merging objects with what is there.
+ *
+ * @param target - Preferences object to modify
+ * @param keys - Path segments, e.g. `['profile', 'exit_type']`
+ * @param value - Value to set
+ */
+function setAtPath(target, keys, value) {
+    const [key, ...rest] = keys;
+    if (key === undefined)
+        return;
+    const current = target[key];
+    if (rest.length > 0) {
+        const child = isPrefsObject(current) ? current : {};
+        target[key] = child;
+        setAtPath(child, rest, value);
+        return;
+    }
+    if (isPrefsObject(current) && isPrefsObject(value)) {
+        for (const [childKey, childValue] of Object.entries(value)) {
+            setAtPath(current, [childKey], childValue);
+        }
+        return;
+    }
+    target[key] = value;
+}
+/**
+ * Merge preferences into an existing Preferences object.
+ *
+ * Dotted names become nested paths, and a literal dotted top-level key (as
+ * earlier bdg versions wrote, which Chrome ignored) is removed.
+ *
+ * @param existing - Current Preferences content
+ * @param prefs - Preferences to apply, dotted or nested
+ * @returns Merged Preferences (a new object; `existing` is not modified)
+ */
+export function mergePreferences(existing, prefs) {
+    const merged = structuredClone(existing);
+    for (const [name, value] of Object.entries(prefs)) {
+        if (name.includes('.'))
+            delete merged[name];
+        setAtPath(merged, name.split('.'), value);
+    }
+    return merged;
+}
+/**
+ * Read the profile's Preferences file.
+ *
+ * @param file - Preferences file path
+ * @returns Its content, `{}` if missing
+ * @throws Error if it is not valid JSON or not a JSON object
+ */
+function readPreferencesFile(file) {
+    if (!fs.existsSync(file))
+        return {};
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!isPrefsObject(parsed))
+        throw new Error('not a JSON object');
+    return parsed;
+}
+/**
+ * Whether a running Chrome has the profile open, judged by its
+ * `SingletonLock` symlink (`<host>-<pid>`, macOS and Linux).
+ *
+ * @param userDataDir - Chrome user data directory
+ * @returns True if the lock names a live process on this host
+ */
+export function profileInUse(userDataDir) {
+    let target;
+    try {
+        target = fs.readlinkSync(path.join(userDataDir, 'SingletonLock'));
+    }
+    catch {
+        return false;
+    }
+    const separator = target.lastIndexOf('-');
+    const pid = Number(target.slice(separator + 1));
+    return (target.slice(0, separator) === os.hostname() && Number.isInteger(pid) && isProcessAlive(pid));
+}
+/**
+ * Replace a file atomically: write a temporary file next to it, then rename.
+ *
+ * @param file - File to replace
+ * @param content - New content
+ */
+function writeFileAtomic(file, content) {
+    const temp = `${file}.bdg-${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(temp, content, 'utf8');
+        fs.renameSync(temp, file);
+    }
+    finally {
+        fs.rmSync(temp, { force: true });
+    }
+}
+/**
+ * Apply preferences to the default profile in a Chrome user data directory.
+ *
+ * Failures are logged (visible in daemon.log), not thrown: Chrome still
+ * starts, only without them. An unreadable Preferences file and a profile
+ * that a running Chrome has open are left alone, and the file is not
+ * rewritten when nothing changes.
+ *
+ * @param userDataDir - Chrome user data directory
+ * @param prefs - Preferences to apply, dotted or nested
+ * @param logger - Logger for failures
+ */
+export function writeProfilePreferences(userDataDir, prefs, logger) {
+    const file = path.join(userDataDir, 'Default', 'Preferences');
+    if (profileInUse(userDataDir)) {
+        logger.info(chromePrefsNotAppliedMessage(file, 'the profile is in use by a running Chrome'));
+        return;
+    }
+    try {
+        const existing = readPreferencesFile(file);
+        const content = JSON.stringify(mergePreferences(existing, prefs));
+        if (content === JSON.stringify(existing))
+            return;
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        writeFileAtomic(file, content);
+    }
+    catch (error) {
+        logger.info(chromePrefsNotAppliedMessage(file, getErrorMessage(error)));
+    }
+}
+//# sourceMappingURL=profilePreferences.js.map

package/dist/connection/launcher.d.ts

@@ -7,7 +7,11 @@ import type { Options as ChromeLaunchOptions } from 'chrome-launcher';
 export interface LaunchOptions extends Pick<ChromeLaunchOptions, 'logLevel' | 'connectionPollInterval' | 'maxConnectionRetries' | 'portStrictMode' | 'envVars' | 'handleSIGINT' | 'ignoreDefaultFlags' | 'chromeFlags' | 'chromePath'> {
     /** Remote debugging port (defaults to 9222 when omitted) */
     port?: number;
-    /** Directory for Chrome profile data. Falls back to persistent ~/.bdg/chrome-profile directory */
+    /**
+     * Directory for Chrome profile data, chosen by the user: bdg's default
+     * preferences are not written into it. Falls back to the bdg-managed
+     * persistent profile in the session directory (~/.bdg/chrome-profile)
+     */
     userDataDir?: string | undefined;
     /** Base directory for creating user data dir (defaults to OS temp dir, injectable for testing) */
     baseDir?: string | undefined;
@@ -23,7 +27,7 @@ export interface LaunchOptions extends Pick<ChromeLaunchOptions, 'logLevel' | 'c
     prefsFile?: string | undefined;
     /** Override Chrome binary detection with an explicit path */
     chromePath?: string;
-    /** bdg session directory, recorded as a marker flag on the Chrome command line */
+    /** bdg session directory: recorded as a marker flag on the Chrome command line, and holds the default profile */
     sessionDir?: string | undefined;
 }
 /**
@@ -46,4 +50,19 @@ export interface LaunchOptions extends Pick<ChromeLaunchOptions, 'logLevel' | 'c
  * Uses chrome-launcher for cross-platform Chrome detection and launching.
  */
 export declare function launchChrome(options?: LaunchOptions): Promise<LaunchedChrome>;
+/**
+ * Preferences for the launched profile: bdg's defaults (no translate prompt,
+ * no password manager or leak check, whose bubbles capture input) for
+ * profiles bdg manages, with the caller's preferences on top. A profile the
+ * user chose (`--user-data-dir`) gets only preferences the caller passed.
+ *
+ * File-based preferences take precedence over inline preferences because
+ * files allow for complex, reusable configurations that can be version
+ * controlled and shared across team members or CI environments.
+ *
+ * @param options - Launch options containing prefs or prefsFile
+ * @returns Merged preferences (empty when there is nothing to apply)
+ * @throws ChromeLaunchError if prefs file cannot be read or parsed, or prefs are not JSON
+ */
+export declare function resolveChromePrefs(options: LaunchOptions): Record<string, unknown>;
 //# sourceMappingURL=launcher.d.ts.map

package/dist/connection/launcher.js

@@ -6,10 +6,12 @@ import { BDG_CHROME_PREFS, DEFAULT_CDP_PORT, CHROME_PROFILE_DIR, DEFAULT_CHROME_
 import { getErrorMessage } from '../utils/errors.js';
 import { filterDefined } from '../utils/objects.js';
 import { isProcessAlive } from '../utils/process.js';
+import { verifyLaunchedChrome } from './chromeIdentity.js';
 import { ChromeLaunchError } from './errors.js';
 import { resolveChromeBinary } from './launcher/binaryResolver.js';
 import { buildChromeFlags } from './launcher/flagsBuilder.js';
 import { loadChromePrefs, ensureJSONCompatiblePrefs } from './launcher/preferencesLoader.js';
+import { writeProfilePreferences } from './launcher/profilePreferences.js';
 import { reservePort } from './portReservation.js';
 import { markStartupLogs, watchStartupExit } from './startupExit.js';
 /**
@@ -57,7 +59,7 @@ export async function launchChrome(options = {}) {
     }
     const reservation = await reservePort(port);
     reservation.release();
-    const userDataDir = options.userDataDir ?? getPersistentUserDataDir(options.baseDir);
+    const userDataDir = options.userDataDir ?? getPersistentUserDataDir(options.baseDir ?? options.sessionDir);
     if (!fs.existsSync(userDataDir)) {
         try {
             fs.mkdirSync(userDataDir, { recursive: true });
@@ -74,9 +76,11 @@ export async function launchChrome(options = {}) {
     }
     logger.info(`Launching Chrome on port ${port}...`);
     logger.debug(`User data directory: ${userDataDir}`);
-    const chromeOptions = buildChromeOptions(options);
+    applyProfilePreferences(userDataDir, options, logger);
+    const chromeOptions = buildChromeOptions({ ...options, port });
     const launcher = new chromeLauncher.Launcher(chromeOptions);
-    const startup = watchStartupExit(() => launcher.chromeProcess, markStartupLogs(userDataDir), userDataDir);
+    const logs = markStartupLogs(userDataDir);
+    const startup = watchStartupExit(() => launcher.chromeProcess, logs, userDataDir);
     try {
         const launchStart = Date.now();
         logger.info('Waiting for Chrome to be ready...');
@@ -96,10 +100,11 @@ export async function launchChrome(options = {}) {
                 },
             });
         }
+        await verifyLaunchedChrome({ logs, port, pid: chromeProcessPid });
         logger.info(`Chrome launched successfully (PID: ${chromeProcessPid}, ${launchDurationMs}ms)`);
         return {
             pid: chromeProcessPid,
-            port: launcher.port ?? port,
+            port,
             userDataDir: launcher.userDataDir,
             kill: async () => {
                 return Promise.resolve().then(() => {
@@ -128,7 +133,9 @@ export async function launchChrome(options = {}) {
 /**
  * Get the default persistent user-data-dir path.
  *
- * Uses the session directory ($BDG_SESSION_DIR) to store Chrome profile data,
+ * Uses the session directory (`~/.bdg`, `$BDG_SESSION_DIR`, or
+ * `<base>/sessions/<name>` for a named session, passed as `sessionDir`) to
+ * store Chrome profile data,
  * ensuring each session has its own isolated Chrome profile. This prevents
  * SingletonLock conflicts when multiple agents run concurrently.
  *
@@ -136,7 +143,7 @@ export async function launchChrome(options = {}) {
  * For shared login state across sessions, use --user-data-dir to specify a
  * shared location explicitly.
  *
- * @param baseDir - Optional base directory (defaults to session dir). Allows injection for testing or custom locations.
+ * @param baseDir - Optional base directory (defaults to `~/.bdg` or `$BDG_SESSION_DIR`). Allows injection for testing or custom locations.
  * @returns Absolute path to session-isolated user-data-dir
  * @throws Error if user data directory cannot be created due to permission issues
  */
@@ -168,32 +175,52 @@ function getPersistentUserDataDir(baseDir) {
     return userDataDir;
 }
 /**
- * Load Chrome preferences from options.
+ * Preferences for the launched profile: bdg's defaults (no translate prompt,
+ * no password manager or leak check, whose bubbles capture input) for
+ * profiles bdg manages, with the caller's preferences on top. A profile the
+ * user chose (`--user-data-dir`) gets only preferences the caller passed.
  *
  * File-based preferences take precedence over inline preferences because
  * files allow for complex, reusable configurations that can be version
  * controlled and shared across team members or CI environments.
  *
  * @param options - Launch options containing prefs or prefsFile
- * @returns Chrome preferences object or undefined if no preferences specified
- * @throws ChromeLaunchError if prefs file cannot be read, parsed, or doesn't exist
+ * @returns Merged preferences (empty when there is nothing to apply)
+ * @throws ChromeLaunchError if prefs file cannot be read or parsed, or prefs are not JSON
  */
+export function resolveChromePrefs(options) {
+    const defaults = options.userDataDir === undefined ? BDG_CHROME_PREFS : {};
+    const prefs = { ...defaults, ...loadChromePrefs(options) };
+    ensureJSONCompatiblePrefs(prefs);
+    return prefs;
+}
+/**
+ * Write the launch preferences into the profile, if there are any.
+ *
+ * @param userDataDir - Chrome user data directory
+ * @param options - Launch options
+ * @param logger - Logger for failures
+ * @throws ChromeLaunchError if prefs file cannot be read or parsed, or prefs are not JSON
+ */
+function applyProfilePreferences(userDataDir, options, logger) {
+    const prefs = resolveChromePrefs(options);
+    if (Object.keys(prefs).length > 0)
+        writeProfilePreferences(userDataDir, prefs, logger);
+}
 /**
  * Build chrome-launcher options from bdg launch options.
  *
  * Maps LaunchOptions to chrome-launcher API format using a clean utility approach
- * that filters out undefined values automatically. User preferences override bdg
- * defaults to allow customization while maintaining sensible base configuration.
+ * that filters out undefined values automatically. Preferences are not passed:
+ * chrome-launcher would replace whole nested sections of an existing profile's
+ * Preferences, so `writeProfilePreferences` merges them instead.
  *
  * @param options - bdg launch options to convert
  * @returns chrome-launcher compatible options object
- * @throws ChromeLaunchError if preference loading fails
  */
 function buildChromeOptions(options) {
-    const userPrefs = loadChromePrefs(options);
-    const userDataDir = options.userDataDir ?? getPersistentUserDataDir(options.baseDir);
+    const userDataDir = options.userDataDir ?? getPersistentUserDataDir(options.baseDir ?? options.sessionDir);
     const chromePathOverride = resolveChromeBinary(options);
-    const mergedPrefs = userPrefs ? { ...BDG_CHROME_PREFS, ...userPrefs } : BDG_CHROME_PREFS;
     return {
         logLevel: options.logLevel ?? DEFAULT_CHROME_LOG_LEVEL,
         handleSIGINT: options.handleSIGINT ?? DEFAULT_CHROME_HANDLE_SIGINT,
@@ -206,7 +233,6 @@ function buildChromeOptions(options) {
             connectionPollInterval: options.connectionPollInterval ?? CHROME_READY_POLL_MS,
             maxConnectionRetries: options.maxConnectionRetries ?? CHROME_READY_POLL_ATTEMPTS,
             portStrictMode: options.portStrictMode,
-            prefs: ensureJSONCompatiblePrefs(mergedPrefs),
             envVars: options.envVars,
             chromePath: chromePathOverride,
         }),

package/dist/connection/portReservation.d.ts

@@ -12,14 +12,24 @@ export interface PortReservation {
     release: () => void;
 }
 /**
- * Whether something already accepts connections on 127.0.0.1:port. A
- * listener on all interfaces (`0.0.0.0`/`::`) does not stop bdg from binding
- * 127.0.0.1 on macOS, but Chrome would then fail to listen, so it is checked
- * by connecting.
+ * Whether something already accepts connections on host:port.
  *
  * @param port - Port to check
+ * @param host - Address to connect to
  * @returns True if a connection was accepted
  */
+export declare function acceptsConnections(port: number, host: string): Promise<boolean>;
+/**
+ * Whether something already accepts connections on the port, on 127.0.0.1 or
+ * ::1. A listener on all interfaces (`0.0.0.0`/`::`) does not stop bdg from
+ * binding 127.0.0.1 on macOS, but Chrome would then fail to listen; a Chrome
+ * on [::1] (one that found 127.0.0.1 taken) does not stop it either, but a
+ * second Chrome would be reached through the first one's port. Both are found
+ * by connecting.
+ *
+ * @param port - Port to check
+ * @returns True if a connection was accepted on either address
+ */
 export declare function isPortAnswering(port: number): Promise<boolean>;
 /**
  * Atomically reserve a port to prevent race conditions during Chrome launch.

package/dist/connection/portReservation.js

@@ -8,18 +8,18 @@ import * as net from 'net';
 import { ChromeLaunchError } from './errors.js';
 /** How long a connection attempt may take when checking a port */
 const CONNECT_CHECK_MS = 500;
+/** Loopback addresses Chrome may listen on (it falls back to IPv6 when IPv4 is taken) */
+const LOOPBACK_HOSTS = ['127.0.0.1', '::1'];
 /**
- * Whether something already accepts connections on 127.0.0.1:port. A
- * listener on all interfaces (`0.0.0.0`/`::`) does not stop bdg from binding
- * 127.0.0.1 on macOS, but Chrome would then fail to listen, so it is checked
- * by connecting.
+ * Whether something already accepts connections on host:port.
  *
  * @param port - Port to check
+ * @param host - Address to connect to
  * @returns True if a connection was accepted
  */
-export function isPortAnswering(port) {
+export function acceptsConnections(port, host) {
     return new Promise((resolve) => {
-        const socket = net.connect({ port, host: '127.0.0.1' });
+        const socket = net.connect({ port, host });
         const finish = (answering) => {
             socket.destroy();
             resolve(answering);
@@ -29,6 +29,21 @@ export function isPortAnswering(port) {
         socket.once('error', () => finish(false));
     });
 }
+/**
+ * Whether something already accepts connections on the port, on 127.0.0.1 or
+ * ::1. A listener on all interfaces (`0.0.0.0`/`::`) does not stop bdg from
+ * binding 127.0.0.1 on macOS, but Chrome would then fail to listen; a Chrome
+ * on [::1] (one that found 127.0.0.1 taken) does not stop it either, but a
+ * second Chrome would be reached through the first one's port. Both are found
+ * by connecting.
+ *
+ * @param port - Port to check
+ * @returns True if a connection was accepted on either address
+ */
+export async function isPortAnswering(port) {
+    const answers = await Promise.all(LOOPBACK_HOSTS.map((host) => acceptsConnections(port, host)));
+    return answers.some(Boolean);
+}
 /**
  * The error for a port another process uses.
  *

package/dist/connection/startupExit.d.ts

@@ -22,6 +22,14 @@ export interface StartupLogs {
  * @returns Log positions
  */
 export declare function markStartupLogs(userDataDir: string): StartupLogs;
+/**
+ * Chrome's output (stderr, then stdout) since {@link markStartupLogs}. The
+ * marked offsets are byte sizes, so the files are cut before decoding.
+ *
+ * @param logs - Log positions
+ * @returns Output lines
+ */
+export declare function readStartupLines(logs: StartupLogs): string[];
 /**
  * Reject when the launched Chrome exits before it is ready.
  *

package/dist/connection/startupExit.js

@@ -31,18 +31,27 @@ export function markStartupLogs(userDataDir) {
     };
 }
 /**
- * Chrome's output since {@link markStartupLogs}, last lines first trimmed.
+ * Chrome's output (stderr, then stdout) since {@link markStartupLogs}. The
+ * marked offsets are byte sizes, so the files are cut before decoding.
  *
  * @param logs - Log positions
- * @returns Up to {@link OUTPUT_LINES} non-empty lines
+ * @returns Output lines
  */
-function readStartupOutput(logs) {
-    const lines = logs.files.flatMap(({ file, offset }) => {
+export function readStartupLines(logs) {
+    return logs.files.flatMap(({ file, offset }) => {
         if (!fs.existsSync(file))
             return [];
-        return fs.readFileSync(file, 'utf8').slice(offset).split('\n');
+        return fs.readFileSync(file).subarray(offset).toString('utf8').split('\n');
     });
-    return lines
+}
+/**
+ * Chrome's output since {@link markStartupLogs}, last lines first trimmed.
+ *
+ * @param logs - Log positions
+ * @returns Up to {@link OUTPUT_LINES} non-empty lines
+ */
+function readStartupOutput(logs) {
+    return readStartupLines(logs)
         .map((line) => line.trim())
         .filter(Boolean)
         .slice(-OUTPUT_LINES);

package/dist/constants.d.ts

@@ -46,8 +46,12 @@ export declare const BDG_CHROME_FLAGS: string[];
 export declare const DOCKER_CHROME_FLAGS: string[];
 /**
  * BDG-specific Chrome preferences for automation
- * These preferences are automatically merged with user preferences when launching Chrome
- * User preferences take precedence over these defaults
+ * Written into the launched profile's Default/Preferences (dotted names become nested paths)
+ * before every launch, so persistent profiles get them too. User preferences take precedence.
+ *
+ * The password manager and its leak check are off: after a login their bubble
+ * (e.g. "Change your password") captures all input in headless Chrome, so
+ * later clicks silently never reach the page.
  *
  * Note: Crash/restore popup suppression is handled by Chrome flags (--disable-session-crashed-bubble, --disable-infobars)
  * which are more reliable than preference-based approaches.

package/dist/constants.js

@@ -64,8 +64,12 @@ export const DOCKER_CHROME_FLAGS = [
 ];
 /**
  * BDG-specific Chrome preferences for automation
- * These preferences are automatically merged with user preferences when launching Chrome
- * User preferences take precedence over these defaults
+ * Written into the launched profile's Default/Preferences (dotted names become nested paths)
+ * before every launch, so persistent profiles get them too. User preferences take precedence.
+ *
+ * The password manager and its leak check are off: after a login their bubble
+ * (e.g. "Change your password") captures all input in headless Chrome, so
+ * later clicks silently never reach the page.
  *
  * Note: Crash/restore popup suppression is handled by Chrome flags (--disable-session-crashed-bubble, --disable-infobars)
  * which are more reliable than preference-based approaches.
@@ -75,6 +79,9 @@ export const BDG_CHROME_PREFS = {
     'translate.enabled': false, // Disable Google Translate popup
     translate_site_blacklist: ['*'], // Block translate for all sites
     'profile.exit_type': 'Normal', // Trick Chrome into thinking it shut down correctly
+    credentials_enable_service: false, // No "Save password?" bubble
+    'profile.password_manager_enabled': false, // Password manager off
+    'profile.password_manager_leak_detection': false, // No "Change your password" breach dialog
 };
 // ============================================================================
 // DATA COLLECTION LIMITS

package/dist/daemon/SessionController.js

@@ -9,20 +9,36 @@ import { CDPConnectionError, CDPProtocolError, ChromeLaunchError, ConnectionErro
 import { Session, StartCancelledError } from './session/Session.js';
 import { detectTargetMismatch } from './session/targetMismatch.js';
 import { CommandError } from '../errors/index.js';
-import { LAUNCHED_CHROME_DESCRIPTION, cdpRequestRejectedError, sessionEndedDuringCommandError, } from '../errors/messages.js';
+import { LAUNCHED_CHROME_DESCRIPTION, cdpRequestRejectedError, sessionAlreadyRunningMessage, sessionEndedDuringCommandError, sessionUnavailableSuggestion, } from '../errors/messages.js';
 import { IPCErrorCode, } from '../ipc/index.js';
 import { clearLastSessionEnd, writeLastSessionEnd } from '../session/lastSession.js';
 import { createLogger } from '../ui/logging/index.js';
 import { formatChromeIssue } from '../ui/messages/chrome.js';
+import { noActiveSessionMessage } from '../ui/messages/sessionCommand.js';
 import { getErrorMessage } from '../utils/errors.js';
 import { EXIT_CODES } from '../utils/exitCodes.js';
 import { filterDefined } from '../utils/objects.js';
 const log = createLogger('daemon');
-const NO_SESSION_ERROR = 'No active session';
 /** Error for requests that need the session while `bdg <url>` is still starting it */
 const STARTING_ERROR = 'The session is still starting';
 const COMMAND_TIMEOUT_MS = 30000;
 const QUERY_TIMEOUT_MS = 5000;
+/** Time a `dom wait` gets beyond its own --timeout to report the timeout itself */
+const WAIT_COMMAND_MARGIN_MS = 5000;
+/**
+ * How long a session command may run: `dom wait` runs for its own
+ * --timeout, everything else gets {@link COMMAND_TIMEOUT_MS}.
+ *
+ * @param name - Command name
+ * @param params - Command parameters
+ * @returns Timeout in milliseconds
+ */
+function commandTimeoutMs(name, params) {
+    if (name !== 'dom_wait')
+        return COMMAND_TIMEOUT_MS;
+    const { timeout } = params;
+    return Math.max(COMMAND_TIMEOUT_MS, (timeout ?? 0) + WAIT_COMMAND_MARGIN_MS);
+}
 /**
  * Run a promise with a timeout, clearing the timer either way.
  *
@@ -139,11 +155,11 @@ export class SessionController {
      */
     noSessionError() {
         if (!this.launching)
-            return { error: NO_SESSION_ERROR };
+            return { error: noActiveSessionMessage() };
         return {
             error: STARTING_ERROR,
             exitCode: EXIT_CODES.RESOURCE_BUSY,
-            suggestion: 'Wait until "bdg <url>" returns, then retry',
+            suggestion: sessionUnavailableSuggestion(EXIT_CODES.RESOURCE_BUSY),
         };
     }
     /**
@@ -270,7 +286,7 @@ export class SessionController {
         const { sessionId: _sessionId, type: _type, ...params } = request;
         try {
             const execute = this.session.execute.bind(this.session);
-            const data = await withTimeout(execute(name, params), COMMAND_TIMEOUT_MS, 'Command');
+            const data = await withTimeout(execute(name, params), commandTimeoutMs(name, params), 'Command');
             return { ...base, status: 'ok', data };
         }
         catch (error) {
@@ -367,7 +383,7 @@ export class SessionController {
             return {
                 ...base,
                 status: 'error',
-                message: 'No active session found',
+                message: noActiveSessionMessage(),
                 errorCode: IPCErrorCode.NO_SESSION,
             };
         }
@@ -430,7 +446,7 @@ export class SessionController {
             };
         }
         return {
-            message: `Session already running (PID ${process.pid}). Stop it first with: bdg stop`,
+            message: sessionAlreadyRunningMessage(process.pid),
             errorCode: IPCErrorCode.SESSION_ALREADY_RUNNING,
             existingSession: { ...existingSession, targetUrl },
         };

package/dist/daemon/errors.d.ts

@@ -54,7 +54,7 @@ export declare class SessionDirError extends DaemonError {
     /**
      * @param message - What is wrong with the directory
      * @param suggestion - How to fix it
-     * @param exitCode - 82 for permissions, 103 otherwise
+     * @param exitCode - 82 for permissions, 81 for a too-long path, 103 otherwise
      */
     constructor(message: string, suggestion: string, exitCode?: number);
 }

package/dist/daemon/errors.js

@@ -69,7 +69,7 @@ export class SessionDirError extends DaemonError {
     /**
      * @param message - What is wrong with the directory
      * @param suggestion - How to fix it
-     * @param exitCode - 82 for permissions, 103 otherwise
+     * @param exitCode - 82 for permissions, 81 for a too-long path, 103 otherwise
      */
     constructor(message, suggestion, exitCode = EXIT_CODES.SESSION_FILE_ERROR) {
         super(message, 'SESSION_DIR_UNUSABLE', exitCode);

package/dist/daemon/launcher.d.ts

@@ -17,7 +17,8 @@ export declare function launchDaemon(): Promise<void>;
  * Check that the session directory can hold the daemon's files before
  * spawning it (otherwise the daemon dies and only its log says why).
  *
- * @throws SessionDirError (103) for a file or a too-long path, (82) when not writable
+ * @throws SessionDirError (103) for a file, (81) for a too-long path like a
+ *   named session's, (82) when not writable
  */
 export declare function assertUsableSessionDir(): void;
 //# sourceMappingURL=launcher.d.ts.map