I've tried plenty of automatable browsers over the years(nightmare, puppeteer+puppeteer-stealth, playwright, fakebrowser, selenium, secret-agent...)
Unless you tweak them a lot, they're all detectable.
I'm not talking about headless browsers because they're all detectable no matter what you do(at least with timing attacks, with the way things are rendered... you need to run them in a real window to make them undetectable)
Why is there not one 100% undetectable browser out of the box?
Just a regular chrome/firefox with some way to fake clicks and inputs without changing any of the behaviors of the browser besides this?
I've had multiple ideas, like running a real browser with a fake uBlock/adblock extension that get the coordinates/values of elements, transmits those to another process, and then moves a real mouse cursor through the screen and send keyboard events to the actual OS. or just use OCR on the screen without doing anything to the browser. (Of course clicks and keyboard events needs to emulate the timings and movements of a human, but that's another problem entirely.)
But it would seem really painful to make those reliable.
Do you know of a package/browser that is 100% undetectable and just exactly behaves like a real browser?
But assuming you're driving a real browser you're probably being "detected" because of your behaviour.
Humans are slow. They follow certain browsing patterns. They interact with the site in a certain way (scrolling, moving the mouse cursor, keyboard presses).
If a client is hitting a site many times a minute without much scrolling or mouse movement and seemingly doing things in an unusual or systematic way it will often trigger security measures like Captchas.
What you're describing here is the product of an arms race between people who want to scrape and exploit websites using automated tools and the websites themselves who want to offer the best service possible to legitimate users.
It's partly why so much of the internet today requires people to login and verify phone numbers / email addresses. It's also why we see captchas and other tactics to slow users down and screen out bots.
If you built something completely undetectable the bad guys would love it and sites would then need to find new ways to detect / stop whatever you're doing.