Changelog

What shipped, and when. The list starts with the version that is on the update channel today and grows forward from there.

What is listed here

Two things ship on their own schedules, so both are named in every entry that changes them.

They move independently: a client release may keep the engine it had, and a new engine can be installed under a client you already run. What is fixed is the direction: a client states the oldest engine it will work with, and the engine is published before the client that requires it.

How an update reaches you

The desktop client checks a signed feed when it starts, downloads a newer version in the background, and then waits: a banner tells you it is ready, and the installer runs when you next quit or restart the app, never in the middle of your work. Two checks stand before that installer. The file's SHA-512 has to match the feed manifest, and its signature has to verify against the release key compiled into the app. If either fails, nothing is installed and the app says so plainly rather than burying it in a log. The Help menu shows which app and daemon version you are on, and can check for an update on demand.

A published version can also be withdrawn. The client reads a signed recall list before it downloads anything, declines a version that is on it, and tells you the reason, including when the version you are already running has been recalled.

The engine has its own path: a local registry you drive from the command line, so an engine version is a decision you make rather than one that happens to you:

Because the previous build stays installed until you remove it, engine rollback is one command and needs no download. The Windows client keeps this in step for you: it provisions an engine on first start and, after an app update, brings the engine up to whatever the new client requires.

Releases

0.15.1

Released September 20, 2026. Engine 154.0.8037.17.

• A profile is no longer refused at its own reserved exit address. With "Keep this profile's exit address to itself" switched on, a start could be refused with error 4013 naming the profile itself as the holder: the address was reserved for that profile, and the reservation was then read as somebody else's. Three registers answer that question and only one of them asked whether the holder is the profile in front of it. Profiles on a provider whose session spelling is not known, Proxidize among them, hit this immediately because there is no second address to draw; elsewhere it was quieter and cost the profile its address at every start. All three now ask the same question, and a refusal from the account register names the profile that actually holds the address instead of "another profile".

0.15.0

Released September 20, 2026. Engine 154.0.8037.17.

• A new browser engine. Profiles move from build 151.0.7922.99 to 154.0.8037.17. A build reaches you only after twelve checks against the packaged files themselves, and then two days of running on our own machine before it is offered at all. Your profiles pick it up at their next start, and nothing needs reinstalling.

• The time zone now follows the city your proxy exits in, not the country. A profile on any US exit read America/New_York, because the first zone listed for the country was written no matter which city the address belonged to. Measured through a mobile proxy exiting in Denver: the browser said New York, and a fingerprint check deducted ten points for "Different time zones". The zone the address itself resolves to is now used whenever the country lists it, so the same profile reads America/Denver and the check passes with no deduction. A zone outside the country is never written, and an exit that cannot be resolved is left untouched rather than half changed.

• Strict mode is usable without running a measurement service of your own. strict_expected refused every start through a proxy unless the address of a JA4T reflector was configured, so in practice no installation could use the mode. Each check now carries its own rule: the exit type, the time zone and the TCP observation are individually required, advisory or off, and they ship as required, advisory, advisory. The country stays a hard refusal. Every strict start writes down what was checked, and the protection status reads the same table, so the status and the start cannot disagree.

• A refusal names the profile the way you named it. When a start was refused because another profile holds that exit address, the message gave both profiles as identifiers like 768db7b7-26a3-4c0e-9b37-b13af71ff10e, which appear in no list you ever see. It now says "Shop Wien". Two profiles sharing a name get the identifier back alongside it, and a profile held by another of your machines stays an identifier, because that is the only thing you can search for over there.

• A recording the browser refuses to start no longer ends as an empty video. The browser can decline a capture request while a tab is still coming up. That refusal was not counted as a failure to deliver pictures, so the watchdog that restarts a silent capture never armed and the recording ran to its end with nothing in it. A refusal is now treated like silence: the capture is restarted, and a recording that still receives no picture is marked failed with a reason instead of looking like a success.

• Both SDKs move to 0.9.0. The exit check reply carries the network operator, the time zone and the exit type, and is_mobile is now true, false or null instead of always false. That is the one field an existing client has to read differently. The Python package can also switch exit_exclusive on a profile that already exists.

0.14.1

Released September 17, 2026. Engine 151.0.7922.99.

• A client update is now checked before it is installed, even when it was downloaded earlier. Until this release, an update that had finished downloading but was not yet applied, for example because you kept working or the machine restarted, was installed later from the download cache without its signature being checked. Every installation where a download had completed without being applied was affected. The client now checks the signature at that point as well; if the check fails, it does not install the file and deletes it.

0.14.0

Released September 16, 2026. Engine 151.0.7922.99.

• An engine update now says which build it is installing. The app used to show the same banner for an update as for the very first start, including "The first start takes a moment" on an installation that had been running for months. During an update the banner now reads "Updating the browser engine to" followed by the new version, and afterwards it tells you the new build is installed and that profiles use it from their next start. You can dismiss that notice, and it stays dismissed for that version. A recalled build that the client steps back from is not announced as an update.

• A machine without a graphics card gets a plain refusal. When a profile could not start because the machine renders in software, the message named internal rule and decision numbers. It now says what is going on in one sentence: this machine renders without a graphics card, a profile claiming real hardware would be caught immediately, so the start is refused. The protection status reports the same sentence.

• Both SDKs move to 0.8.1. The published Node package no longer lists a script that pointed at a file outside the package. The Python package is unchanged and moves along so both keep one version number.

0.13.0

Released September 16, 2026. Engine 151.0.7922.99.

• One kind of host, and it is the operating system underneath. A profile used to carry a host_mode naming one of two tiers, the second of which ran a Windows identity on a Linux engine. That combination is a contradiction a page can find, so it is gone: a daemon launches the engine built for its own platform and only a profile whose identity claims that same platform. The field disappears from the API, from a preset's configuration and from the management app. A client that still sends it is not refused; the daemon ignores the key.

• Self-hosting on Linux is withdrawn. There is no Linux daemon in the release, no container image and no compose or systemd files, and the page describing them is gone. Windows is the platform Scalebrowser ships for. A profile that arrives by sync from a machine with a different operating system now comes in disabled, with persona_os_changed as the reason, instead of being started against an engine it was not drawn for.

• Both SDKs move to 0.8.0. The host_mode field, the HostMode type and the list of its values are gone from the Node and Python packages. That is the only breaking change in either.

• A browser build that turns out to be bad can now be taken back. Until now the client only ever moved forward: a build that had reached your machine stayed there until a newer one replaced it, however long that took. The client now reads the recall list published with every engine release. If the build you are running is on it and a good build is still installed, the client switches back to that one; if none is, it downloads the newest build that is not recalled. Every engine build also runs for two days on our own machine before it is offered to you.

• Changing the browser build no longer closes your open profiles. Moving to a different build used to need a restart of the background service, and that restart closed every browser that was open. The client now picks up the new build the next time a profile starts, so an update or a recall leaves running profiles alone.

• An agent now hears what a page says after it acts. A sign-in form that answered "this account was not found" put that sentence where a screen reader announces it, and the agent never received it: its click came back as "no change", and the page map afterwards did not contain a word of the message. Agents now get what a screen reader would announce, including a field marked invalid together with the error text behind it. The reply to an action also waits up to 1.2 seconds for the page to react, instead of reading the page the instant the mouse button comes back up.

• Recording no longer disturbs the page while an agent types or clicks. The capture is meant to step back during every gesture, and the tool description promised it, but the part that does it was never connected. It is now, and it was measured through the daemon itself: a page timing its own input events sees a difference of at most a tenth of a millisecond. With the quieting switched off on purpose, the same measurement shows about a millisecond, so it would see a difference if there were one.

• A recording that receives no picture restarts its capture instead of staying empty. The browser can accept a capture request before the tab is ready and then deliver nothing, without an error. The recorder now waits two seconds for the first picture and restarts the capture if none arrives, up to three times. A recording that still ends without a single picture is marked failed with a reason, where it used to produce an empty video that looked like a success.

• Videos start with the first picture. A video began at the moment recording was requested, so it opened with one to two seconds of empty background while the browser produced its first frame. The film now starts where the pictures start, and the sound moves with it.

• Every video preset setting now does what it says. Several options could be set and changed nothing: extra outputs such as an additional GIF, a destination that creates a sharing link when the render finishes, subtitles delivered as a file without burning them in, a subtitle font you uploaded, and holding the first picture as an intro. Each one now takes effect, checked by rendering two videos that differ only in that setting. 4K is hidden while this machine cannot record wide enough for it.

• Rendering is more dependable. Cancelling a render stops it within one frame; before, a running render finished anyway. A machine short of memory ends the render with memory_low and the app keeps running, where the failed allocation used to take the whole background service down. A render that makes no progress for ten minutes is ended with a reason, instead of looking healthy forever.

• An agent can fetch the finished video itself. video status now answers with an address for every file, valid for one hour, that a plain download can use. Before, the reply pointed at a route that needs the daemon's access token, which an agent does not have.

• The activity trail and the profile list are easier to read. Repeated identical steps fold into one line, times count from the start of the run, and each chapter carries a title. The profile list now shows how many profiles you have, split by state.

0.12.0

Released September 10, 2026. Engine 150.0.7871.186.

• New profiles are no longer created on a superseded browser build. Nothing removes an old build once a newer one is installed, and a new profile drew from everything on disk, so about a quarter of them landed on a package that was nine patches behind. Three of those patches are things a page can read: the machine reported no Windows Hello where most real machines report one, the speech voice list arrived complete before any real browser would have it, and no microphone was listed at all. The pinned build is now the floor of that choice.

• A profile keeps up with the browser, the way a real one does. Chrome applies its update the next time that install starts, so a profile frozen on the build it was created on falls further behind every release. A profile now moves to the pinned build at its next start, and it moves back if you roll the pin back after a bad build. Nothing changes while a browser is open, and nothing moves onto a build the machine does not have.

• The battery reports a value Windows can actually produce. A charging battery below full said it would be full in one to twenty-nine minutes. Windows has no such estimate to give, so Chrome there answers "unknown" instead, and roughly two thirds of profiles were carrying a number no Windows browser emits. Existing profiles are repaired the next time they start.

• The fastest typists slowed down to human speed. The share of keystrokes that overlap was allowed to run higher than the reference corpus it is calibrated against reports, and the fastest drawn typist ended up with a rhythm that sits where verification vendors look for automation. The ceiling now matches the corpus. Only the extreme end moves; the middle of the range is unchanged.

• A password field no longer costs you the picture trail. Typing into a password field made every following step lose its still image, so a registration run could go seventeen steps with nothing to look at. The two questions behind it, whether the page shows a value and where to paint over it, were being answered from two different sources; they are one question now, and a value that cannot be placed blacks out the frame instead of discarding it.

0.11.0

Released September 9, 2026. Engine 150.0.7871.186.

• A mouse move no longer jumps. The gap between two sampled positions was capped at a fixed 400 ms, which is about as long as an ordinary move lasts. One long gap could therefore cover most of the travel, and the page saw a 231 pixel move as two positions 397 ms apart. The cap now belongs to the stroke rather than to the clock, at a third of its duration, which is inside what a recorded human hand does.

• The kind of an exit address is read rather than guessed. It used to be inferred from the provider's name, which is advertising copy: colo matched 235 real provider names of which 12 were colocation, the rest being places like Colombia and Colorado. A shipped range list now answers at the address itself. It says datacenter or nothing, never residential, because no free source can prove residential. Without the list the product behaves exactly as before.

• Your proxy rows now show what their address really is. The operator string the check fetched was thrown away on the way into the row, so every address read unknown and every ownership term fell back to the shortest one. It is kept now, alongside the address and country from the same check.

• The exit address is not swapped under a running browser. Changing a profile's proxy while its browser is open moved the reservation to the new address while the browser still spoke over the old one, which then fell free for another profile. The change is refused while the profile runs, on every one of the five ways to make it.

• The dashboard no longer goes blank while an agent is working. Sync pulls every profile every fifteen minutes, and the pull wrote its own idea of the runtime state over the live one. A running profile was marked stopped, the activity view emptied, and both guards against starting a profile twice were cleared in the same write. What a pull carries is a profile's identity, never its state.

• A run's step list fills in from the first step. Opening a run while it was still filing steps could leave the panel saying "Nothing done yet" for the whole run.

• The app can create an account without inventing a password. Its agent tools could read stored logins but not write one, so an agent asked to sign up had to think a password up and type it in the clear. The tools that draw, store and fill a password are now served. If a password is still typed in the clear, the reply says so and names the three tools that make it unnecessary, rather than blocking the form in front of it.

0.10.2

Released September 8, 2026. Engine 150.0.7871.186.

• The app no longer reports a failed background service while that service is running. A single missed health check counted as a crash: it tore the daemon down and started two restarts at once, which then locked each other out of the data directory, and every locked-out attempt counted as a further crash. The error box appeared over a browser that was working. A restart now needs three missed checks in a row, each with its own time limit, and the retry budget starts over once the daemon has been up for two minutes.

• The tray icon follows the colour of your taskbar. It was drawn for one theme and faded into the other.

• Fewer harmless values are blacked out. The layer that keeps secrets away from the agent also judged text no visitor ever sees, such as class names and tracking parameters buried in the page source. It now reads only what the page actually displays, which leaves the room for real secrets free.

• Closing a profile database releases its file at once. The last handle used to signal the shutdown and return, so whatever touched the file next raced it.

0.9.0

Released September 5, 2026. Engine 150.0.7871.186.

Two threads run through this release. The exit address a profile uses stopped being something the product promises and became something it measures, and four places where information about you was visible when it should not have been are closed.

• A rotating proxy is now measured, not taken at its word. A provider's stated rotation period is a claim; the daemon works out the real one from two probes and only calls a gap a rotation once two matching gaps confirm it. A single differing pair no longer counts as proof, which it did before, and one bought proxy account can now serve many profiles because a taken address means drawing a new session tag rather than giving up.

• The exclusivity rule has a switch you can reach. It sits globally and per profile, so a profile that is meant to share an address can, without turning the rule off everywhere. A refusal now says which of the two reasons it was and how to get past it, instead of leaving you to guess.

• Your own connection counts as an exit like any other. A profile created without a proxy used to carry a randomly drawn region until its first launch, so a fresh profile on a machine in Vienna could claim Melbourne and only heal later. The check now runs when the profile is created, against the connection the machine really has.

• A proxy row carries a name, and shows what hangs on it. Rows used to be told apart by their address, which is the one thing that changes. The list now names each row and shows which profiles use it, so removing one is no longer a guess.

• Starting a profile got faster. The path that establishes the exit address costs 0.6 seconds instead of 2.8, because the launch and the watcher ask the same place once rather than each asking separately.

• A deleted profile stays deleted. Sync brought profiles back on the next start after they were removed. It no longer does.

• Two leaks are closed. Error reports carried the account holder's name in every Rust event, and the settings page showed a map token in the clear. Neither reaches anyone now.

• The stdio relay attaches only to its own daemon. It used to take whatever held the port, so a call could land on a different installation and come back rejected while the log said it had attached. It now asks which data directory a daemon serves before it speaks to it.

• Both SDKs and the app can ask which daemon they reached. Until now there was no way to tell one installation from another from the client side.

• A field that already has a value gets replaced, not appended to. Filling a form through the agent layer used to add to what was there.

• The documentation is measured against the code. Every number, table and claim on the documentation pages is now bound to a test that carries its identifier, so a page cannot quietly fall behind the product it describes.

0.8.0

Released September 1, 2026. Engine 150.0.7871.186.

Remote access became usable rather than merely built. Everything here is about the last few steps between a connection that exists and a connection that works.

• Remote access has a switch. It sits under Settings, General, Remote access in the app. Until this release the only way to turn it on was a line in a configuration file inside the install directory, which the next update overwrote: a customer who created a connection in the portal and pasted its address into a chat service got an error and had no place to fix it. The daemon now reads the switch on every beat, so turning it on takes effect without a restart.
• A new connection is served immediately. It used to wait for a daemon restart.
• Chat services find our OAuth metadata. It was not at the address the standard says to look, so at least one service fell back to a hand-filled form with empty endpoints.
• The consent screen says what you are granting. It showed an identifier instead of a name, ran across the full window width, and on a phone it was unreadable. The Allow button also did nothing, because the signed request was not carried through.
• Every tool carries a readable title, which is what a permission screen shows instead of a wire name.
• A sign-in link from a message is used rather than read. inbox_open_link opens a link out of a confirmation mail by its number. The address is never shown to the agent, because a sign-in link is the account.

0.7.0

Released August 31, 2026. Engine 150.0.7871.186.

The way a machine joins an account, end to end.

• A machine can be approved from the portal, with a fingerprint you compare against the one the app shows you.
• Signing in during a connection request returns to the request, instead of dropping you on the dashboard with nothing to click.
• The relay is actually deployed. Its release job reported success without shipping anything, and the same relay could answer "attached" and "machine offline" for one connection.
• A tunnel no longer crashes on its own TLS setup.
• The update address is checked like every other pinned value. It was the one baked-in value with no gate on it.

0.6.0

Released August 31, 2026. Engine 150.0.7871.186.

The release that let a chat service in a browser tab drive a browser on your machine.

• Remote access. A relay between a chat service and your daemon, with OAuth. The browser does not move: it stays on your machine with its profiles and its logins, and only the control channel goes through the cloud. The relay has no authority of its own, your daemon's static token deliberately does not work through it, and a token is cryptographically bound to one connection's address. See Remote access.
• No tunnel without a running subscription, asked both when the connection is made and while it is open. A tunnel lasts days and a subscription can end in the middle of one.
• A read-only connection is really read only. The scope was checked, stored, and then read by nobody: the portal offered "read only" and the chat could still click and type. For two days.
• A copied machine is found. A second track under the licence: a rotating proof, a climbing counter, and a device row read on every call. When a clone is found the whole family has to pair again, because nobody can tell which machine is the real one.
• Revoking a connection cuts the tunnel now, rather than only marking it revoked and waiting for something to break the connection.
• Recording no longer stalls on Windows on a blocking child process that exists there under a different name.

0.5.1

Released August 25, 2026. Engine 150.0.7871.186.

The build on the update channel today. The detectability tool reached its full depth, and three places that reported a version reported the wrong one.

• /check and /ai-agent-check are finished. The five-layer tool now runs end to end and says how rare each of your readings is rather than only what it measured. The agent check is its counterpart: it measures what the automation tool does, not what the browser claims. Both stay account-free.
• A build reports the version it actually is. Until this release the daemon identified itself as 0.1.0 to the control plane, in its user agent and in every error report, whatever the installer said. Both SDKs carried the same defect, so a support case could not be tied to a build.
• A wedged profile is refused rather than waited on. A launch that cannot finish now answers with an error instead of holding its reservation until the lease expires.
• Countries are flags again in the profile list, where a bare two-letter code had appeared.

0.5.0

Released August 24, 2026. Engine 150.0.7871.186.

Two machines could drive one identity, and a machine you had removed kept running. Both are closed.

• A profile runs on one machine at a time, whether or not sync is set up. That rule used to live in the sync service, so a customer who never configured sync had no protection at all: two computers could sign into the same account with the same identity, and neither said so. The claim now sits in the slot a launch acquires, and a takeover is acknowledged rather than silently applied (error 4012, distinct from the plan limit).
• "Remove this machine" bites immediately. A device that had been refused kept working for up to five hours behind a screen still saying the account was connected, because every failure to reach the control plane was read as an outage. A refusal is now told apart from an outage, and signing in again on that machine re-enrols it.
• Error 4011 reaches every surface. The management UI named it in two places out of three, and neither SDK knew the value, so a client could not tell "sign in" from a real fault.
• The secret layer reads what the page shows, not what the browser brings with it, and a long address is no longer mistaken for a token.
• The management UI navigation comes from the design system, including a way through it on a phone.

0.4.1

Released August 23, 2026. Engine 150.0.7871.186.

The debug port stopped answering the whole machine, and an agent can now use a password without ever reading it.

• The debug port answered every account on the machine. A process running as a different user could read a running profile's entire cookie jar and run script in every origin it was signed into. That is a stronger channel than the token-protected REST surface, on a daemon that stores its keys 0600 precisely against that neighbour. The engine now drops any peer running as another user, with no runtime switch: a toggle that can remove enforcement is not enforcement.
• An agent can use a secret without ever seeing it. Passwords, tokens and confirmation codes reach the page through the daemon; the agent names the field, never the value. Two filter points cover the reply, its three attachments and the error branch, and a reply the filter could not check is withheld rather than sent.
• The shipped daemon pinned no signing key, so every 0.4.x build refused to enrol while the app still showed a success message. Signing in now changes the state it claims to change.
• The fork's patch series targets Chromium 151.

0.4.0

Released August 22, 2026. Engine 150.0.7871.186.

The release that made an account mandatory, and the one that fixed the most that a customer could feel.

• An account is now required. There is no unlicensed mode: the daemon serves its API but starts no browser without one, and the engine is no longer downloadable without a plan behind it.
• Billing tells you when a payment fails. A declined card used to be visible only on a page nobody opens. Chargebacks are answered instead of lost by default, a daily reconciliation runs against Stripe, and closing an account no longer takes the remaining balance with it.
• Two sign-in paths handed out a full session without ever touching the second factor.
• Any web page could start a browser on this machine. The AdsPower-compatible adapter answers a plain GET, which any page can fire; it now checks where the request came from.
• The pointer landed between two device pixels, and gestures could reach a tab nobody could see.
• The grace window survived a restart. It used to be lost with the process, so an unreachable control plane locked you out sooner than the policy said.
• The voice list is added to rather than replaced. A Windows persona kept its own voices instead of shipping a list no real machine has.
• The product documentation moved back into the portal, rebuilt on the design system.

0.3.0

Released August 21, 2026. Engine 150.0.7871.186.

Profile sync, from the bundle that travels to the page that switches it on.

• Profile sync, end to end. A profile reaches your other machines encrypted with a key the control plane never holds: the bundle itself, the service that pushes it at every stop, the settings page, the /v1/sync routes, and a command-line path for a server that has no browser to sign in with.
• The owner latch did not hold between machines at all. Two computers could pull the same profile and both start it. Nine green table tests could not show it, because none of them had two machines.
• A profile read another profile's confirmation codes. A catch-all mailbox belongs to every bound profile, and the fetch never asked the server who the mail was addressed to.
• The documentation is reachable under its own address again.
• The engine package carries its licence files. It shipped without a single one, for a product built on Chromium.
• Security updates. better-auth (an account-takeover advisory), Next.js (nine advisories including SSRF and a middleware bypass), Electron 43, and the portal's dependency chain.

0.2.0

Released August 20, 2026. Engine 150.0.7871.186.

The release that turned a browser an agent can watch into one it can operate.

• An agent that can see a page can now work one. Clicking, typing, key presses, press-and-hold, waiting for a condition and the clipboard, every one of them through the humanized input layer.
• The fleet cut. Leasing several profiles in one call, batch operations across a selection, presets that instantiate into new profiles, and the group and proxy lists.
• The confirmation code, out of band. read_inbox fetches the code a signup mails you and stores nothing, so an agent can finish a registration on its own.
• Concurrency is what is sold, not the number of profiles. Profiles are unlimited; your plan decides how many browsers run at the same time and across how many machines (error 4008).
• /check, the five-layer detectability tool, public and account-free.
• Both SDKs reach the whole API, and both are published on npm and PyPI under the MIT licence.
• A download named by the page could reach a private address. That DNS-rebinding hole is closed.

0.1.1, the first published build

Released August 2, 2026. Engine 150.0.7871.186.

The first published build. It is the whole product rather than a change to it:

• Windows desktop client. A per-user installer that needs no administrator rights. It bundles and supervises the daemon, serves the management UI, fetches and verifies the engine on first start, and shuts the daemon and its browsers down when you close it.
• Self-hosted Linux daemon. A signed single binary for x86-64, built against an old enough glibc to run on current distributions. Same daemon, same API, same four interfaces as the Windows client.
• Engine 150.0.7871.186 or newer is what this client requires; it refuses to settle for an older build and provisions one that satisfies it.
• Signed updates end to end. Client, installer and update manifest are all signed with the same key the engine is signed with, and the client verifies that signature before applying anything.

There is no 0.1.0 entry above this one. That version was tagged and its build failed before anything was published, so nothing under that number ever existed to install.