docs: changelog 2026-07-11, release 150.0.7871.46 with PAC and profile consistency updates

Author: MSTU0

ADVANCED_FEATURES.md

@@ -40,7 +40,7 @@ Smart auto-configuration: timezone, locale, and languages derive from your proxy
 - DNS-through-proxy plus credentialed proxy URLs keep browser-level geo signals protected
 - UDP-over-SOCKS5 tunnel (ENT Tier3) for QUIC/STUN so ICE presets are only needed when UDP is unavailable
 - The standard `--disable-quic` flag remains available for deployments that prefer TCP-based HTTP protocols while keeping SOCKS5 proxying
-- PAC-like request callback (ENT Tier3) for trusted PAC sources and approved request-aware policy workflows while preserving standard PAC routing behavior and helping maintain HTTP/2 continuity in automation-heavy sessions
+- PAC-like request callback (ENT Tier3) for trusted PAC sources, authenticated PAC proxy routes, controlled synthetic responses, and request-aware policy workflows that preserve standard PAC routing behavior and help maintain HTTP/2 continuity in automation-heavy sessions
 - Optional ICE control via [`--bot-webrtc-ice`](CLI_FLAGS.md#behavior--protection-toggles) (ENT Tier1) when the proxy lacks UDP support
 - Chromium-level implementation: tunneling lives inside the network stack, no external proxy-chain hijacking
 
@@ -206,6 +206,7 @@ Advanced font rendering with consistent results across hosts.
 - Rare symbol and Unicode character support
 - Cross-worker consistency
 - HarfBuzz text shaping integration
+- Profile-backed local font requests and request-by-name loading
 
 **Text-Rendering Features:**
 - Skia anti-aliasing integration
@@ -256,6 +257,7 @@ Comprehensive hardware emulation and fingerprint management.
 - Screen resolution and color depth control
 - Multi-monitor configuration simulation
 - Refresh rate and orientation control via [`--bot-config-orientation`](CLI_FLAGS.md#profile-configuration-override-flags) for mobile profiles, covering all orientation APIs and CSS media queries
+- Opt-in mobile keyboard visual viewport behavior via [`--bot-mobile-keyboard`](CLI_FLAGS.md#profile-configuration-override-flags) for Android and WebKit-family mobile profiles
 
 **Device-Behavior Simulation:**
 - Authentic device memory reporting
@@ -368,7 +370,7 @@ Comprehensive hardware emulation and fingerprint management.
 <a id="webkit-family-profile-consistency"></a>
 ### WebKit-Family Profile Consistency (ENT Tier4)
 
-WebKit-family Profile Consistency extends premium profiles beyond browser-brand metadata. The browser runtime, CSS behavior, media capability behavior, navigation headers, TLS behavior, HTTP/2 behavior, and per-context isolation are shaped to match the selected WebKit-family profile across supported host platforms.
+WebKit-family Profile Consistency extends premium profiles beyond browser-brand metadata. The browser runtime, workers, CSS behavior, fonts, canvas output, permission states, navigation headers, TLS behavior, HTTP/2 behavior, and per-context isolation are shaped to match the selected WebKit-family profile across supported host platforms.
 
 Supported profile bundles cover desktop and mobile WebKit-family identities. Use this capability for authorized privacy validation when a workflow needs browser-family consistency while keeping BotBrowser's profile, automation, and per-context control model.
 
@@ -396,18 +398,18 @@ See [WebKit-family Profile Consistency](WEBKIT_PROFILE_CONSISTENCY.md) for the f
 | Component | Capabilities |
 |-----------|-------------|
 | **Keyboard** | Layout emulation, key timing, input method simulation |
-| **Touch Interface** | Touch event simulation, gesture recognition, mobile patterns |
+| **Touch Interface** | Touch event simulation, gesture recognition, mobile patterns, opt-in mobile keyboard visual viewport behavior |
 | **Mouse Patterns** | Movement algorithms, click timing, scroll behavior |
 | **Languages** | Accept-Language headers, navigator.languages, speech recognition |
-| **Permissions** | API permission simulation, notification handling, media access |
+| **Permissions** | Profile-backed permission states, notification handling, media access, and per-context consistency |
 | **Navigation** | History management, referrer control, navigation timing |
 
 <a id="graphics-rendering-engine"></a>
 ### Graphics & Rendering Engine
 
 | Component | Capabilities |
 |-----------|-------------|
-| **Canvas** | 2D context noise, consistent image data, cross-worker consistency |
+| **Canvas** | 2D context noise, standard and wide-gamut color-space consistency, consistent image data, cross-worker consistency |
 | **WebGL** | Precision GPU micro-benchmarks, driver-specific behavior, extension simulation |
 | **WebGPU** | Modern GPU API support, compute shader capabilities, buffer management |
 | **Text Rendering** | HarfBuzz text shaping, cross-platform fonts, emoji rendering consistency |
@@ -417,7 +419,7 @@ See [WebKit-family Profile Consistency](WEBKIT_PROFILE_CONSISTENCY.md) for the f
 
 | Component | Capabilities |
 |-----------|-------------|
-| **Proxy** | Authentication embedding, credential management, geo-detection, PAC-like request callback |
+| **Proxy** | Authentication embedding, credential management, geo-detection, authenticated PAC routing, PAC-like request callback, controlled synthetic responses |
 | **WebRTC** | SDP control, ICE candidate filtering, media stream simulation |
 | **HTTP Headers** | Google-specific headers (ENT Tier2), Chrome behavior patterns, request timing |
 | **Media Devices** | AudioContext simulation, speech synthesis, device enumeration |

CHANGELOG.md

@@ -3,6 +3,23 @@
 > **Research scope:** Entries in this changelog describe features evaluated in authorized labs and defensive benchmarking programs. Follow the [Legal Disclaimer](DISCLAIMER.md) and [Responsible Use Guidelines](RESPONSIBLE_USE.md). We work with security vendors to investigate any misuse, so report concerns to [support@botbrowser.io](mailto:support@botbrowser.io).
 
 
+## [2026-07-11]
+### Major
+- **Chromium Core -> 150.0.7871.46**: Updated the Chrome 150 release line to 150.0.7871.46. Web Platform consistency, rendering accuracy, and security patches stay aligned with upstream Chrome.
+
+### New
+- **PAC Synthetic Responses (`RESPONSE`, `RESPONSE_FILE`, ENT Tier3)**: Trusted `BotBrowserFindProxyForRequest(...)` callbacks can now provide controlled HTTP responses directly from approved file or embedded PAC sources.
+- **Mobile Keyboard Viewport Control (`--bot-mobile-keyboard`)**: Added opt-in mobile keyboard behavior that updates the visual viewport for Android and WebKit-family mobile profile workflows.
+
+### Improvements
+- **WebKit-Family Profile Consistency**: Expanded desktop and mobile browser-family consistency across runtime, CSS, font, canvas, permission, worker, and navigation surfaces.
+- **Authenticated PAC Routing**: Improved standard and request-aware PAC routing for authenticated proxy results, including per-context workflows.
+- **Per-Context Identity Lifecycle**: Strengthened profile application rules so identity-bearing settings are established before the first page or worker starts while supported live session controls remain available afterward.
+- **Profile-Backed Permission, Font, and Canvas Behavior**: Improved permission-state replay, local font handling, multilingual fallback, and wide-gamut Canvas 2D consistency.
+- **High-Concurrency and Headless Stability**: Improved per-context stability under heavy load, kept headless profile guidance in terminal output without visible windows, and reduced benign Linux container startup diagnostics.
+- **Profile Package Guidance**: Improved startup guidance for missing, invalid, expired, and version-mismatched profile packages, with clearer access paths for Chrome 150 profiles.
+
+
 ## [2026-07-06]
 ### New
 - **Memory and Storage Quota Controls (`--bot-js-heap-size-limit`, `--bot-storage-quota`)**: Added explicit `profile`, `real`, and byte-value controls for profile-backed memory and storage quota behavior in Chrome 149 sessions.

CLI_FLAGS.md

@@ -120,7 +120,7 @@ function BotBrowserFindProxyForRequest(url, host, method, headersB64, bodyB64, b
 }
 ```
 
-The callback can return `CONTINUE`, `BLOCK`, `CAPTURE`, `CAPTURE_TAG <tag>`, `CAPTURE_FILE <path>`, or a standard PAC route such as `DIRECT`, `PROXY`, `HTTPS`, `SOCKS`, `SOCKS4`, or `SOCKS5`. Capture records are written only when `CAPTURE` and `CAPTURE_FILE <path>` are returned together. Guide: [PAC-Like Request Callback](docs/guides/network/PAC_REQUEST_POLICY.md)
+The callback can return `CONTINUE`, `BLOCK`, `CAPTURE`, `CAPTURE_TAG <tag>`, `CAPTURE_FILE <path>`, `RESPONSE <raw_http_response_b64>`, `RESPONSE_FILE <path>`, or a standard PAC route such as `DIRECT`, `PROXY`, `HTTPS`, `SOCKS`, `SOCKS4`, or `SOCKS5`. Standard PAC routes and request callback routes can include credentials, for example `SOCKS5 user:pass@proxy.example.com:1080`. Capture records are written only when `CAPTURE` and `CAPTURE_FILE <path>` are returned together. Synthetic responses are limited to approved `file:` and `data:` PAC sources and fail closed when response input is invalid. Guide: [PAC-Like Request Callback](docs/guides/network/PAC_REQUEST_POLICY.md)
 
 Use this when request-aware policy should stay in PAC routing instead of CDP-level request interception, especially for workflows that need help preserving HTTP/2 connection and stream continuity while directing selected requests to different routes.
 
@@ -471,6 +471,7 @@ BotBrowser auto-generates matching `navigator.userAgentData` (brands, fullVersio
 
 - `--bot-config-keyboard=profile`: Keyboard settings: profile (emulated), real (system keyboard)
 - `--bot-config-fonts=profile`: Font settings: profile (embedded), expand (profile + fallback), real (system fonts)
+- `--bot-mobile-keyboard[=true|false]`: Opt-in mobile keyboard visual viewport behavior. When enabled for a mobile profile, trusted user focus on an editable field reduces `visualViewport.height` while leaving the layout viewport unchanged. Default: false.
 - `--bot-config-orientation=<value>`: Screen orientation for mobile profiles. Desktop profiles ignore this flag.
   - `profile` - Auto-detect from profile dimensions (default)
   - `landscape` / `portrait` - Force orientation, automatically adjusting all related dimensions to match

PER_CONTEXT_FINGERPRINT.md

@@ -99,7 +99,7 @@ No additional configuration needed. Fingerprint consistency is maintained across
 
 Configure fingerprint flags on an existing BrowserContext.
 
-> **Critical**: `BotBrowser.setBrowserContextFlags` must be called on a **browser-level** CDP session, and **before** any page is created in that context. The renderer process reads its flags at startup. If a page already exists, the flags will not take effect.
+> **Critical**: `BotBrowser.setBrowserContextFlags` must be called on a **browser-level** CDP session, and identity-bearing flags must be set **before** any page is created in that context. The first renderer seals the context identity. Later profile or identity changes are rejected to prevent mixed identity surfaces.
 
 ```javascript
 const puppeteer = require('puppeteer-core');
@@ -302,7 +302,7 @@ Most `--bot-*` flags from [CLI_FLAGS.md](CLI_FLAGS.md) work with per-context con
 | Noise Seed | [`--bot-noise-seed`](CLI_FLAGS.md#behavior--protection-toggles) for deterministic fingerprint variance |
 | Timing | [`--bot-time-scale`](CLI_FLAGS.md#behavior--protection-toggles) for performance timing control, [`--bot-time-seed`](ADVANCED_FEATURES.md#performance-timing-protection) for deterministic timing diversity, [`--bot-stack-seed`](ADVANCED_FEATURES.md#stack-depth-control) for stack depth variation, [`--bot-fps`](CLI_FLAGS.md#behavior--protection-toggles) for frame rate control |
 | Storage and Memory | [`--bot-js-heap-size-limit`](CLI_FLAGS.md#--bot-js-heap-size-limit) and [`--bot-storage-quota`](CLI_FLAGS.md#--bot-storage-quota) for profile, real, or explicit byte-value policy |
-| Network | [`--bot-network-info-override`](ADVANCED_FEATURES.md#network-info-privacy) for profile-defined `navigator.connection` values |
+| Network | [`--bot-network-info-override`](ADVANCED_FEATURES.md#network-info-privacy) for profile-defined `navigator.connection` values, [`--bot-local-dns`](CLI_FLAGS.md#--bot-local-dns-ent-tier1) for context DNS policy |
 | WebRTC | [`--bot-webrtc-ice`](ADVANCED_FEATURES.md#webrtc-leak-protection) for ICE endpoint control |
 | Window | [`--bot-always-active`](ADVANCED_FEATURES.md#active-window-emulation) to maintain active window state |
 | Session | `--bot-inject-random-history` for session authenticity (supports precise count, e.g., `=15`), `--bot-cookies` for context-scoped cookie import at creation time |
@@ -314,6 +314,14 @@ Most `--bot-*` flags from [CLI_FLAGS.md](CLI_FLAGS.md) work with per-context con
 
 See [CLI_FLAGS.md](CLI_FLAGS.md) for the complete flag reference.
 
+## Context Identity Lifecycle
+
+A BrowserContext accepts its full profile and identity configuration until its first renderer starts. This includes profile, browser and platform identity, locale, screen and window metrics, and other fingerprint-bearing settings.
+
+After the first page or worker starts, the context identity is sealed. Later identity-bearing changes are rejected instead of partially updating an active context. Create a new BrowserContext when a different profile or device identity is required.
+
+Supported live session controls remain available after identity sealing when they do not replace the context identity. These include dynamic proxy routing through the dedicated proxy commands, route-only proxy updates, custom headers, color scheme, storage quota policy, and LocalDNS policy where supported.
+
 ## Use Cases
 
 **Privacy Research at Scale**
@@ -335,25 +343,30 @@ See [CLI_FLAGS.md](CLI_FLAGS.md) for the complete flag reference.
 
 ⚠️ `BotBrowser.setBrowserContextFlags` must be called on a **browser-level CDP session** (`browser.target().createCDPSession()` in Puppeteer, `browser.newBrowserCDPSession()` in Playwright). Page-level CDP sessions (`page.createCDPSession()`) do not have access to the `BotBrowser` domain.
 
-⚠️ `setBrowserContextFlags` must be called **before** creating any page in that context. The renderer process reads its flags at startup. If a page already exists, the new flags will not apply to that renderer. Correct order: `createBrowserContext` → `setBrowserContextFlags` → `newPage`.
+⚠️ `setBrowserContextFlags` must be called **before** creating any page in that context. The first renderer seals identity-bearing settings. Later profile and identity changes are rejected. Correct order: `createBrowserContext` → `setBrowserContextFlags` → `newPage`.
 
 ⚠️ Per-context proxy via `botbrowserFlags` or `createBrowserContext` must be set before navigation. To switch proxies at runtime, use `BotBrowser.setBrowserContextProxy` (ENT Tier3). See [Dynamic Proxy Switching](ADVANCED_FEATURES.md#dynamic-proxy-switching).
 
-⚠️ Some network-layer settings ([`--bot-local-dns`](CLI_FLAGS.md#--bot-local-dns-ent-tier1), UDP proxy support) apply at the browser level and cannot be configured per-context.
+⚠️ UDP proxy support applies at the browser level and cannot be configured per-context. LocalDNS policy can be assigned per context and remains a supported live-safe policy after identity sealing.
 
 ⚠️ Each context can load a completely different profile (`--bot-profile`), or use `--bot-config-*` flags to override specific settings from the browser's base profile.
 
 ⚠️ Proxy merge semantics are explicit: `--proxy-server` in `botbrowserFlags` sets or replaces the context proxy route, while `--proxy-ip` only supplies the exit IP for geo-detection. If a context was created with `createBrowserContext({ proxyServer })`, a later `setBrowserContextFlags` call with only `--proxy-ip` preserves that proxy route.
 
+⚠️ After identity sealing, dedicated proxy commands may update the route server or bypass rules while preserving the existing proxy IP identity. Changing or clearing `proxyIp` is rejected because it would change geo-derived identity. Create a new BrowserContext when the exit identity must change.
+
 ## High-Concurrency Tuning
 
+Chrome 150.0.7871.46 improves stability for rapid BrowserContext churn and shared graphics and request workloads under load.
+
 When running many per-context fingerprints under one browser instance (for example, 20+ concurrent BrowserContexts), launch with [`--bot-gpu-emulation=priority`](CLI_FLAGS.md#--bot-gpu-emulation) to prioritize GPU and WebGPU command-buffer scheduling across sibling contexts. Default behavior is unchanged; this is an opt-in mode for high-concurrency workloads. See [`--bot-gpu-emulation` modes](docs/guides/deployment/LINUX_GPU_BACKEND.md#gpu-emulation-modes).
 
 ## Related Documentation
 
 - [Guides](https://botbrowser.io/docs/) - Comprehensive guides for all BotBrowser features
 - [CLI Flags Reference](CLI_FLAGS.md)
 - [Advanced Features](ADVANCED_FEATURES.md)
+- [Permission State Consistency](docs/guides/fingerprint/PERMISSIONS.md)
 - [Profile Configuration](profiles/PROFILE_CONFIGS.md)
 - [Per-Context Fingerprint Example (Puppeteer)](examples/puppeteer/per_context_fingerprint.js)
 - [Per-Context Fingerprint Example (Playwright)](examples/playwright/nodejs/per_context_fingerprint.js)