dsh-browser-playwright-codex

dsh plugin --profile web add dsh-browser-playwright-codex

dsh-browser-playwright-codex

   

 

一句话：让 AI 用你已经登录的账号在真实网页上干活 —— 填表、抓取列表、多标签查后台；浏览器窗口就在你桌面上、你随时看得见。原生弹框会被挂起、绝不替你点「确定」（机制级）；验证码/挑战页会被识别出来，并以提示要求模型停下交给你（提示不是阻断）。登录/二次验证没有探测器，靠模型从快照看出来并停下；密码、一次性验证码、卡号字段 browser_fill 直接拒绝——这类字由你本人在窗口里输。

In one line: the agent drives a visible, profile-backed browser window with the logins you

already have — filling in forms, scraping lists and working across tabs in real pages — through

accessibility snapshots with stable element refs. Native dialogs are parked and reported instead of

auto-accepted. Challenge pages are detected and reported as a note that tells the agent to stop and hand

the page back — a note, not a block. There is no sign-in detector, and browser_fill refuses

password / one-time-code / card fields outright — you type those in the visible window. No

CSS-selector guessing, no full-DOM dumps.

# from npm
dsh plugin --profile <name> add dsh-browser-playwright-codex

# or straight from the repository
dsh plugin --profile <name> add github:miqian-nomad/dsh-browser-playwright-codex

为什么值得装 / What makes it different

• 登录一次，一直用 — a profile-backed window plus an exported session state, so a closed window or

a restarted harness comes back logged in.

• 全程看得见，也不抢你的焦点 — a real window you can watch, minimise or take over; the provider

keeps working while it is minimised (FOCUS-STEALING.md).

• 遇事停下来叫人 — alert / confirm / prompt are parked and reported, answered only by an

explicit browser_dialog call (DIALOG-POLICY.md).

A challenge page is recognised from the interceptor's own response headers first

(cf-mitigated: challenge and friends; x-iinfo / x-datadome* additionally need a blocking

status), then from the vendor widget's accessible name, then from wording; if none of those match,

a page that stops changing after an action is reported as a possible wall instead of being retried.

Recognition adds a note that tells the agent to stop and hand the window back to you — that note is

advice to the model, not a hard block; the mechanism-level guarantee exists for native dialogs only

(docs/articles/dialogs-and-captcha.md).

• ref 失效会明说 — per-document nonce refs; a stale ref fails fast with an explanation instead of

silently clicking a different element.

• 强力工具默认关闭 — browser_evaluate / browser_cdp are not registered at all unless your

deployment opts in; this package ships both off.

安全一览 / Security at a glance — dsh.so's scanner flags this repository's one Critical finding, and that finding is the

implementation of browser_evaluate (its dynamic evaluation), which this package ships switched off.

SECURITY.md says what each

finding actually is, whether a capability gate makes it reachable (two of the warnings are not gate-controlled:

cannot do with your logins (URL policy, CDP allow-list, dialog policy, no telemetry, and browser_fill

refuses password / one-time-code / card fields). Counts move as the scanner and the code change — their own report is the

passwords or 2FA codes). Counts move as the scanner and the code change — their own report is the

live number.

Install

From npm (published since v0.5.1 — npmjs.com/package/dsh-browser-playwright-codex):

dsh plugin --profile <name> add dsh-browser-playwright-codex

Or straight from the repository / a checkout:

dsh plugin --profile <name> add github:miqian-nomad/dsh-browser-playwright-codex

# local development: clone, then link the checkout
dsh plugin --profile <name> add link:<absolute path to this directory>

Compatibility. Built and tested against DSH 0.2.0-rc.1. The dependency ranges are **floors, not

wildcards**: peers @deepseek-ai/cordis >=4.0.4, @deepseek-ai/dsh-llm >=0.2.0-rc.1,

@deepseek-ai/dsh-tools >=0.2.0-rc.1, and the direct dependency @deepseek-ai/schemastery ^3.18.4. The

floors exist so an empty project cannot resolve a very old 0.0.1-rc.* build, while a newer harness still

installs. One cost of npm's prerelease rules: a prerelease whose [major, minor, patch] tuple differs from

0.2.0 (for example 0.2.1-rc.*) is outside a >=0.2.0-rc.1 range, so you may see a peer warning — a

warning, not an install failure (pnpm does not enforce peer ranges strictly by default). After a harness

upgrade, npm run doctor re-checks that every named export this plugin imports still exists — that is the

fast way to tell "the harness moved" from "the plugin broke".

lib/ ships in the repository (and there is deliberately no prepare hook), so a fresh clone loads

without a build step — npm run build is only needed after editing src/.

The bundle mounts three rows: the ctx.browser seam (service), the Playwright pro

…(truncated)