dsh-chrome
DeepSeek Harness (dsh) 浏览器伴侣：一个嵌入完整 dsh 网页界面的 Chrome 侧边栏，可让 dsh 代理读取当前页面、捕获 HTTP 流量并控制浏览器。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-chrome@0.1.3Chrome 以 dsh-chrome 发布，当前版本为 0.1.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A Chrome side panel that embeds the full dsh web UI (sessions, settings, approvals, tasks, goals, workspaces — everything) and lets the dsh agent perceive and drive your browser:
http(s) tabs are injected
this way.browser_start_capture) and records the active tab's request
method, URL, status, request body and response body via the Chrome DevTools
Protocol; browser_capture_requests reads them back. Secret-shaped values
are masked by default — see Security.browser_navigate / browser_click /
browser_open_tab.browser_navigate / browser_click / browser_open_tab are open,
navigate, click, visit, tab (打开 / 跳转 / 前往 / 点击 / 导航 / 访问 /
浏览一下 / 新标签), plus "go to" when it is followed by a page or URL
(go to github.com, go to the page — a bare go to the next step does
not unlock anything); the words that unlock browser_start_capture are
capture, debug (抓包 / 抓一下 / 抓取请求 / 监听网络 / 网络请求 / 流量).
Note that 抓取 on its own does not unlock capture — it reads as ordinary
"fetch/scrape" intent; say 抓包 or 抓取请求. If an action is blocked you get
a refusal quoting the exact words that would unlock that tool, so you can
simply restate. An instruction hidden inside a web page cannot drive the
browser (best-effort protection in approval-free mode, not an absolute
guarantee).dsh web running locally (default http://127.0.0.1:3080; configurable in
the extension's settings).InjectionResult.error, added in Chrome 118).Two halves: the host plugins (added to dsh) and the Chrome extension (loaded unpacked).
1. Add the host plugins to your dsh web profile:
dsh plugin --profile web add dsh-chrome
This registers the bridge, the browser tools, and the page injector. dsh hot-applies new plugin rows, so just refresh the browser afterwards — no restart needed unless you later edit an already-loaded plugin file.
2. Install the Chrome extension files and load them:
npx dsh-chrome install
This copies the extension to a stable per-user directory (prints the path) and shows the remaining steps:
chrome://extensions, turn on Developer mode.Re-run npx dsh-chrome install after upgrading the package, then reload
the extension at chrome://extensions — the installer copies the files, so
without both steps Chrome keeps running the previous version against the new
host plugins. npx dsh-chrome path prints the directory.
To remove dsh-chrome completely, undo both halves: npx dsh-chrome uninstall
deletes the extension directory (then remove it in chrome://extensions), and
dsh plugin --profile web remove dsh-chrome unwires the host plugins.
Trusted, local use only. The bridge and browser tools give a local dsh agent the ability to read pages, capture traffic, and drive your browser.
browser_capture_requests) is not intent-gated, so any session talking to
the same browser can read it. Only starting a capture requires your
explicit instruction. HTTP headers are not captured (so Cookie /
Set-Cookie / Authorization headers never reach the model). The remaining credential
surface — secret-shaped URL query parameters (?access_token=…), request
bodies (form/JSON logins) and tokens embedded in response bodies — is
masked as «redacted» by default. To capture raw, unmasked traffic
(e.g. for your own debugging), set redactCredentials: false on the
dsh-chrome-browser-tools row in your profile's cordis.patch.yml.
npx dsh-chrome install), unrecognised fields are dropped rather
than forwarded unmasked, and an unrecognisable reply raises an error.| Path | Contents |
|---|---|
extension/ | Chrome MV3 extension (side panel + service worker + options page) |
host/ | Three dsh host plugins: bridge.js (WS bridge), browser-tools.js (agent tools + redaction), page-injector.js |
host/redact.js | Credential redaction for captured traffic |
host/intent-gate.js | Intent-unlock keywords + turn-text extraction (shared with tools/verify-intent.cjs) |
cordis.patch.yml | Bundle patch that mounts the three host plugins |
bin/cli.js | dsh-chrome installer for the extension files |
docs/bridge-protocol.md | Wire protocol between the extension and dsh |
tools/ | Dev-only diagnostics over dsh session logs (verify-intent.cjs, dump-session.cjs, shared session-log.cjs); not shipped to npm |
browser_list_tabs and browser_open_tab are the
natural exceptions.browser_get_page — the on-demand read — is a separate, smaller limit:
~40,000 characters of visible text and up to 400 links.history.pushState and replaceState), ~2 s debounce; scrolling does not
trigger it. Only the active tab's navigations count — a background tab
churning through SPA routes pushes nothing. The current page is also re-sent
whenever the bridge reconnects.browser_click never retries. If the click's result is lost — the page
navigated away, or the injection/CDP call was cut off — the tool reports that
it could not confirm whether the click took effect, rather than clicking
again (clicking is not idempotent), and tells the agent to re-read the page
with browser_get_page to see what happened.chrome-extension://
(another extension's options page), chrome://, file://, and the Chrome
Web Store. The worker decides this from the tab's URL before trying, and
routes those pages to the browser's remote debugging protocol
(http://127.0.0.1:9222) instead. This requires the browser to be launched
with --remote-debugging-port=9222 (and
--remote-allow-origins=chrome-extension://<this-extension-id> if the remote
endpoint enforces the Origin check). If the CDP endpoint is missing or
unreachable, reading such a page fails with an explicit error naming the
flag — it is not silently empty. Ordinary http(s) pages never take this
path, even when injection fails on them, and automatic "current page"
injection covers only ordinary http(s) tabs (the Web Store included in the
exclusions).MIT © Stuart Hu