{"_id":"@codemycookieday/dsh-plugin-browser","_rev":"3-3451e35082a562c9e0cb92ec7fa4af7c","name":"@codemycookieday/dsh-plugin-browser","dist-tags":{"latest":"0.1.1"},"versions":{"0.1.0":{"name":"@codemycookieday/dsh-plugin-browser","version":"0.1.0","keywords":["dsh-plugin","deepseek-harness","dsh","browser","playwright","automation","agent"],"license":"MIT","_id":"@codemycookieday/dsh-plugin-browser@0.1.0","maintainers":[{"name":"codemycookieday","email":"1963346930@qq.com"}],"homepage":"https://github.com/coderdailyone/dsh-plugin-browser#readme","bugs":{"url":"https://github.com/coderdailyone/dsh-plugin-browser/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"2d6102204b5f4cccabf2e872696765198127dd19","tarball":"https://registry.npmjs.org/@codemycookieday/dsh-plugin-browser/-/dsh-plugin-browser-0.1.0.tgz","fileCount":20,"integrity":"sha512-6eMD90WFdQmNV3A/7QqfYQ8Ujdwh1q8TdfhGBWewzOiLfD3aI0GQACb4d3YaR7sNms+lb7jcU0dR+JZVcjlgqg==","signatures":[{"sig":"MEYCIQCE+hh1iFv7hYzr26dBGscHB5cb/RK0vv+LFTIVH5rQZQIhAN7qgL8rUC4t3fOwmEKDpUVpKyubtjxvazXkNM5VcZLL","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":103744},"main":"lib/index.js","type":"module","types":"lib/index.d.ts","engines":{"node":"^22.19.0 || >=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./src/*":"./src/*","./policy":{"types":"./lib/policy.d.ts","default":"./lib/policy.js"},"./session":{"types":"./lib/session.d.ts","default":"./lib/session.js"},"./package.json":"./package.json"},"gitHead":"376015d559f63b8e533f6a6f2f91de3f6288e418","scripts":{"test":"vitest run","build":"tsc","test:live":"DSH_BROWSER_LIVE=1 vitest run tests/live.spec.ts","typecheck":"tsc --noEmit -p tsconfig.test.json","prepublishOnly":"npm run build && npm run test"},"_npmUser":{"name":"codemycookieday","email":"1963346930@qq.com"},"repository":{"url":"git+https://github.com/coderdailyone/dsh-plugin-browser.git","type":"git"},"_npmVersion":"11.12.1","description":"Browser-automation tools for DeepSeek Harness (dsh): Chromium via playwright-core behind a security-first navigation policy re-checked on every action","directories":{},"_nodeVersion":"26.0.0","dependencies":{"playwright-core":"^1.62.1"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.2","typescript":"^5.9","@types/node":"^24","@deepseek-ai/cordis":"^4.0.1","@deepseek-ai/dsh-tools":"^0.1.0-rc.6","@deepseek-ai/schemastery":"^3.18.1","@deepseek-ai/dsh-system-prompt":"^0.1.0-rc.6"},"peerDependencies":{"@deepseek-ai/cordis":"^4.0.1","@deepseek-ai/dsh-tools":"^0.1.0-rc.6","@deepseek-ai/schemastery":"^3.18.1"},"_npmOperationalInternal":{"tmp":"tmp/dsh-plugin-browser_0.1.0_1786800439388_0.627488424460912","host":"s3://npm-registry-packages-npm-production"},"deprecated":"Renamed: this package is now published as dsh-plugin-browser-use"},"0.1.1":{"name":"@codemycookieday/dsh-plugin-browser","version":"0.1.1","keywords":["dsh-plugin","deepseek-harness","dsh","browser","playwright","automation","agent"],"license":"MIT","_id":"@codemycookieday/dsh-plugin-browser@0.1.1","maintainers":[{"name":"codemycookieday","email":"1963346930@qq.com"}],"homepage":"https://github.com/coderdailyone/dsh-plugin-browser#readme","bugs":{"url":"https://github.com/coderdailyone/dsh-plugin-browser/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"fa93c0d3eba9568da70053636ea663e1a2845d42","tarball":"https://registry.npmjs.org/@codemycookieday/dsh-plugin-browser/-/dsh-plugin-browser-0.1.1.tgz","fileCount":20,"integrity":"sha512-ZOOPfbw0N5OCTZn+AU017pkwZxvPTnJLof4/VC/XaLQRg58+qt5snVi50Od7y6N03SN6Gl4wN7tapUxbYdoOVA==","signatures":[{"sig":"MEUCIQC2/Jx+vKqyfOjDQ9mcfTCmBP/82HwW7ZemHvwUOt+HWQIgEd4DpEk9A2Nq3+oWuu35bTRUmuuD+63xiug6yg02TG4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":103744},"main":"lib/index.js","type":"module","types":"lib/index.d.ts","engines":{"node":"^22.19.0 || >=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./src/*":"./src/*","./policy":{"types":"./lib/policy.d.ts","default":"./lib/policy.js"},"./session":{"types":"./lib/session.d.ts","default":"./lib/session.js"},"./package.json":"./package.json"},"gitHead":"d04158383b91dca88bc0e49297e2bf8378321dfa","scripts":{"test":"vitest run","build":"tsc","test:live":"DSH_BROWSER_LIVE=1 vitest run tests/live.spec.ts","typecheck":"tsc --noEmit -p tsconfig.test.json","prepublishOnly":"npm run build && npm run test"},"_npmUser":{"name":"codemycookieday","email":"1963346930@qq.com"},"repository":{"url":"git+https://github.com/coderdailyone/dsh-plugin-browser.git","type":"git"},"_npmVersion":"11.12.1","description":"Browser-automation tools for DeepSeek Harness (dsh): Chromium via playwright-core behind a security-first navigation policy re-checked on every action","directories":{},"_nodeVersion":"26.0.0","dependencies":{"playwright-core":"^1.62.1"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.2","typescript":"^5.9","@types/node":"^24","@deepseek-ai/cordis":"^4.0.1","@deepseek-ai/dsh-tools":"^0.1.0-rc.6","@deepseek-ai/schemastery":"^3.18.1","@deepseek-ai/dsh-system-prompt":"^0.1.0-rc.6"},"peerDependencies":{"@deepseek-ai/cordis":"^4.0.1","@deepseek-ai/dsh-tools":"^0.1.0-rc.6","@deepseek-ai/schemastery":"^3.18.1"},"_npmOperationalInternal":{"tmp":"tmp/dsh-plugin-browser_0.1.1_1786800713876_0.8182527802016244","host":"s3://npm-registry-packages-npm-production"},"deprecated":"Renamed: this package is now published as dsh-plugin-browser-use"}},"time":{"created":"2026-08-15T13:27:19.263Z","modified":"2026-08-15T13:57:50.598Z","0.1.0":"2026-08-15T13:27:19.541Z","0.1.1":"2026-08-15T13:31:54.042Z"},"bugs":{"url":"https://github.com/coderdailyone/dsh-plugin-browser/issues"},"license":"MIT","homepage":"https://github.com/coderdailyone/dsh-plugin-browser#readme","keywords":["dsh-plugin","deepseek-harness","dsh","browser","playwright","automation","agent"],"repository":{"url":"git+https://github.com/coderdailyone/dsh-plugin-browser.git","type":"git"},"description":"Browser-automation tools for DeepSeek Harness (dsh): Chromium via playwright-core behind a security-first navigation policy re-checked on every action","maintainers":[{"name":"codemycookieday","email":"1963346930@qq.com"}],"readme":"# dsh-plugin-browser\n\n一个 [DeepSeek Harness](https://github.com/deepseek-ai/dsh) 插件：通过 `playwright-core` 驱动 Chromium，为模型提供五个真实浏览器工具 —— 导航、点击、填充、读文本、关闭。\n\n差异化价值是**安全优先的导航策略**：每一个 URL 都会在**每次操作前、每次导航落地后**重新校验 —— 主机标签白名单 + 私有网络拦截，重定向和链接点击同样覆盖。\n\n[English](./README.md)\n\n## 安装\n\n```bash\ndsh plugin --profile web add @codemycookieday/dsh-plugin-browser\ndsh --profile web --dump-config   # 应能看到 \"# == dsh-plugin-browser\" 补丁层\n```\n\n需要一个 Chromium，按以下顺序解析：\n\n1. 配置项 `executablePath`\n2. 环境变量 `$DSH_BROWSER_EXECUTABLE`\n3. 操作系统常见安装位置（Chrome / Chromium / Edge / Brave）\n4. Playwright 自带浏览器（`npx playwright install chromium`）\n\n## 配置\n\n| 键 | 类型 | 默认 | 含义 |\n| --- | --- | --- | --- |\n| `allowedHosts` | `string[]` | `[]` | 主机标签白名单。`example.com` 匹配 `example.com` 与 `*.example.com`；按主机标签匹配，绝不按子串。空 = 任意公共主机。 |\n| `allowPrivateNetwork` | `boolean` | `false` | 是否放行环回 / 私有 / 链路本地地址。默认关闭。 |\n| `headless` | `boolean` | `true` | 无窗口运行。 |\n| `executablePath` | `string` | — | 显式指定 Chromium 路径。回退顺序：`$DSH_BROWSER_EXECUTABLE` → 系统常见位置 → Playwright。 |\n| `userAgent` | `string` | `dsh-plugin-browser/<版本>` | 浏览器上下文的 User-Agent。 |\n| `navigationTimeoutMs` | `≥1 整数` | `30000` | 每次导航的加载预算。 |\n| `actionTimeoutMs` | `≥1 整数` | `15000` | 每次点击 / 填充 / 读取的预算。 |\n| `maxTextChars` | `≥1 整数` | `20000` | 提取页面文本的硬上限。 |\n\n## 五个工具\n\n| 工具 | 模型看到的结果 |\n| --- | --- |\n| `browser_navigate` | 落地页的 `{ url, title, statusCode, text, truncated }` |\n| `browser_click` | 点击导航落定后的 `{ url, title }` |\n| `browser_fill` | 填充字段后的 `{ url, title }` |\n| `browser_read_text` | 当前页面的 `{ url, title, text, truncated }` |\n| `browser_close` | `{ closed: true }` —— 幂等 |\n\n每个 agent 会话拥有独立浏览器；同一 owner 的调用按提交顺序串行。所有失败都以普通 `isError` 工具结果返回（绝不抛出异常），带 `BROWSER_*` 错误码，例如 `BROWSER_HOST_NOT_ALLOWED`、`BROWSER_PRIVATE_NETWORK`、`BROWSER_NO_PAGE`、`BROWSER_NAVIGATION_FAILED`、`BROWSER_ACTION_FAILED`、`BROWSER_LAUNCH_FAILED`、`BROWSER_CLOSED`、`BROWSER_ABORTED`、`BROWSER_UNSUPPORTED_SCHEME`、`BROWSER_INVALID_URL`。\n\n## 安全模型\n\n- **持续复查。** 策略在每次操作前执行、并在每次导航后再次执行 —— `browser_navigate` 校验的是**落地 URL**，因此即使请求 URL 合法，重定向（或链接点击）跨入未授权主机也会被拒绝。\n- **主机标签匹配，绝不子串匹配。** `allowedHosts: [\"example.com\"]` 匹配 `example.com` 和 `sub.example.com`，但**不**匹配 `evil-example.com` 或 `evil.example.com.attacker.test`。\n- **默认拦截私有网络。** 环回、私有、链路本地、ULA 及 IPv4 映射写法（`127.0.0.1`、`10.0.0.5`、`::1`、`::ffff:127.0.0.1`、`fc00::/7` 十六进制形式等）默认拒绝，除非显式开启 `allowPrivateNetwork` —— 且设置了白名单时，私有主机也必须名列其中。\n- **规范化主机比较。** 大小写、尾部点号、IPv6 方括号在校验前统一归一化；无法解析的一律拒绝（fail-closed）。\n- **协议白名单。** 仅允许 `http:` / `https:` 导航；`file:`、`data:`、`javascript:` 等一律拒绝。\n- **诚实的残留风险：不防御 DNS rebinding。** 若一个主机名在校验与建连之间从公共 IP 解析到私有 IP，仍可能触达内网。如果你的环境在意这一点，请把 harness 放进网络隔离沙箱运行，不要只依赖本插件。\n\n## 模型体验\n\n**模型看到什么：** 五个工具名（`browser_navigate`、`browser_click`、`browser_fill`、`browser_read_text`、`browser_close`）；导航与读取返回落地 URL、标题、HTTP 状态（仅导航）和有界的可见文本 —— 没有截图、DOM 转储或 Cookie。\n\n**Token 效应：** 每次 `browser_navigate` / `browser_read_text` 最多返回 `maxTextChars`（默认 20,000）字符页面文本；调小更省，调大适配密集页面。`browser_click` / `browser_fill` 只返回 URL + 标题。\n\n**KV 缓存效应：** 无 —— 结果都是普通工具结果，追加在对话尾部；不改写提示前缀。\n\n## 已知限制与后续工作\n\n- 不防御 DNS rebinding（见上）。\n- v1 没有截图、无障碍快照、下载、Cookie 访问、多标签页或后台任务。\n- `playwright-core` 需要本机存在浏览器二进制（见安装）。\n- dsh 处于开发者预览阶段，peer 版本可能需要同步升级。\n\n## 开发\n\n```bash\nnpm install\nnpm run build    # tsc → lib/\nnpm test         # vitest run（58 个测试；live 冒烟默认自跳过）\n```\n\n设置 `DSH_BROWSER_LIVE=1` 且能解析到浏览器时（可用 `DSH_BROWSER_EXECUTABLE` 指定），live 冒烟会驱动真实 Chromium：\n\n```bash\nDSH_BROWSER_LIVE=1 npm test\n```\n\n代码分层：`src/policy.ts`（纯 URL 策略）→ `src/session.ts`（浏览器会话、逐操作复查）→ `src/tool.ts`（dsh 工具定义、owner 注册表）→ `src/index.ts`（插件入口）。\n\n## 许可证\n\nMIT\n","readmeFilename":"README.zh.md"}