fix: correct HTTP header wire order + add H2 PRIORITY flag

Header order: reqwest pre-inserted `accept: */*` at position 0 in
ClientBuilder::new(), pinning it ahead of sec-ch-ua headers. Fixed by
replacing the header map instead of merging. Moved user-agent into
each profile's default_headers at the correct Chrome/Firefox/Safari
wire position.

H2 PRIORITY: Real Chrome sends HEADERS frames with PRIORITY flag
(weight=256, dep=0, exclusive). Added h2_headers_priority field to
BrowserProfile and wired it through reqwest → hyper → h2.

Before: accept[4] user-agent[5] sec-ch-ua[6]
After:  sec-ch-ua[4] user-agent[8] accept[9] (matches real Chrome)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 0xMassi

webclaw-http/src/client.rs

@@ -261,15 +261,15 @@ impl ClientBuilder {
 
         let mut builder = reqwest::Client::builder()
             .rustls_config(tls_config)
-            .user_agent(profile.user_agent)
             .timeout(self.timeout)
             .cookie_store(self.cookie_store)
             .http2_header_table_size(h2.header_table_size)
             .http2_enable_push(h2.enable_push)
             .http2_initial_stream_window_size(h2.initial_window_size)
             .http2_initial_connection_window_size(profile.h2_connection_window)
             .http2_settings_order(settings_order)
-            .http2_headers_pseudo_order(pseudo_order);
+            .http2_headers_pseudo_order(pseudo_order)
+            .http2_headers_priority(profile.h2_headers_priority);
 
         if h2.max_header_list_size > 0 {
             builder = builder.http2_max_header_list_size(h2.max_header_list_size);

webclaw-http/src/profiles.rs

@@ -47,6 +47,10 @@ pub struct BrowserProfile {
     pub settings_order: &'static [H2Setting],
     /// HTTP/2 pseudo-header wire order.
     pub pseudo_order: &'static [PseudoHeader],
+    /// HTTP/2 PRIORITY in HEADERS frame: (weight, stream_dep, exclusive).
+    /// Chrome: Some((255, 0, true)) — weight 256, dep 0, exclusive.
+    /// None = no PRIORITY flag (detectable as non-browser).
+    pub h2_headers_priority: Option<(u8, u32, bool)>,
 }
 
 impl BrowserProfile {
@@ -99,7 +103,7 @@ pub fn chrome() -> BrowserProfile {
             ("sec-ch-ua-mobile", "?0"),
             ("sec-ch-ua-platform", "\"Windows\""),
             ("upgrade-insecure-requests", "1"),
-            // user-agent is set separately via reqwest builder
+            ("user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"),
             ("accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"),
             ("sec-fetch-site", "none"),
             ("sec-fetch-mode", "navigate"),
@@ -122,6 +126,8 @@ pub fn chrome() -> BrowserProfile {
             PseudoHeader::Scheme,
             PseudoHeader::Path,
         ],
+        // Chrome: weight=256 (255 on wire), dep=0, exclusive=true
+        h2_headers_priority: Some((255, 0, true)),
     }
 }
 
@@ -134,6 +140,7 @@ pub fn chrome_macos() -> BrowserProfile {
         ("sec-ch-ua-mobile", "?0"),
         ("sec-ch-ua-platform", "\"macOS\""),
         ("upgrade-insecure-requests", "1"),
+        ("user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"),
         ("accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"),
         ("sec-fetch-site", "none"),
         ("sec-fetch-mode", "navigate"),
@@ -162,7 +169,10 @@ pub fn firefox() -> BrowserProfile {
         },
         h2_connection_window: 12517377,
         default_headers: &[
-            // user-agent set separately
+            (
+                "user-agent",
+                "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0",
+            ),
             (
                 "accept",
                 "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
@@ -190,6 +200,8 @@ pub fn firefox() -> BrowserProfile {
             PseudoHeader::Authority,
             PseudoHeader::Scheme,
         ],
+        // Firefox deprecated PRIORITY frames in HTTP/2
+        h2_headers_priority: None,
     }
 }
 
@@ -213,7 +225,7 @@ pub fn safari() -> BrowserProfile {
             ("sec-fetch-dest", "document"),
             ("accept-language", "en-GB,en;q=0.9"),
             ("sec-fetch-mode", "navigate"),
-            // user-agent set separately
+            ("user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15"),
             ("accept-encoding", "gzip, deflate, br"),
             ("priority", "u=0, i"),
         ],
@@ -231,6 +243,8 @@ pub fn safari() -> BrowserProfile {
             PseudoHeader::Authority,
             PseudoHeader::Scheme,
         ],
+        // Safari uses its own priority scheme
+        h2_headers_priority: Some((255, 0, false)),
     }
 }
 
@@ -244,6 +258,7 @@ pub fn edge() -> BrowserProfile {
         ("sec-ch-ua-mobile", "?0"),
         ("sec-ch-ua-platform", "\"Windows\""),
         ("upgrade-insecure-requests", "1"),
+        ("user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0"),
         ("accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"),
         ("sec-fetch-site", "none"),
         ("sec-fetch-mode", "navigate"),

webclaw-reqwest/src/async_impl/client.rs

@@ -1207,9 +1207,10 @@ impl ClientBuilder {
     /// # }
     /// ```
     pub fn default_headers(mut self, headers: HeaderMap) -> ClientBuilder {
-        for (key, value) in headers.iter() {
-            self.config.headers.insert(key, value.clone());
-        }
+        // Replace entirely to preserve caller's insertion order.
+        // The default `accept: */*` from ClientBuilder::new() would otherwise
+        // pin `accept` at position 0, breaking HTTP header order fingerprinting.
+        self.config.headers = headers;
         self
     }