dsh-pilot
为你的 DeepSeek Harness agent 提供操作能力——采用原生权限模型实现自主浏览器操作。Accessibility-ref 页面快照让纯文本模型无需视觉或猜测 CSS 选择器即可导航、执行操作和测试。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-pilot@0.1.1Pilot 以 dsh-pilot 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →English | 中文
Hands for your DeepSeek Harness agent — autonomous browser operation with a native permission model.
Your dsh agent can already see pages (dsh-preview); dsh-pilot lets it drive them: navigate, read any page as a numbered accessibility tree, act on elements by ref, wait for conditions, upload files, and test complete flows — all without vision, CSS-selector guessing, or a second model. Built for text-only models: the page IS text.
Real, unedited runs from a headless dsh agent (DeepSeek-V4-Pro):
Form flow, fully autonomous. This is what pilot_snapshot actually returns for a registration page — the agent's entire view of it:
- heading "用户注册" [level=1] [ref=e2]
- generic [ref=e3]:
- text: 用户名
- textbox "用户名" [ref=e5]
- text: 邮箱
- textbox "邮箱" [ref=e7]
- text: 套餐
- combobox "套餐" [ref=e9]:
- option "免费版" [selected]
- option "专业版"
- checkbox "同意服务条款" [ref=e11]
- button "提交注册" [ref=e12]
- button "重置" [ref=e13]
From there: fill e5 and e7, select 专业版 on e9, check e11, click e12, pilot_wait for the success text (hit in 5ms), screenshot, close. Zero console errors, zero selectors written, no vision model in the loop.
Permissions that follow the session — the same agent asked to open https://example.com:
workspace-write session: refused — the approval chain answered unavailable and the agent was told exactly what config to request;danger-full-access (the user opted out of prompts): opens silently, no gate in the way.That is the design: the plugin never invents a second permission system. It reads the dsh session's own durable permission events and behaves accordingly.
dsh plugin --profile web add dsh-pilot
Uses your installed Google Chrome / Microsoft Edge automatically; otherwise run npx playwright install chromium once and set browserChannels: [chromium]. Requires Node ^22.19 || >=24.
| Tool | What it does |
|---|---|
pilot_navigate | goto / back / forward / reload, tabs. The single origin-gated entry; decisions are enforced at the network layer (redirects, link-outs, history moves included). |
pilot_snapshot | The page as an accessibility tree with [ref=e12] markers bound to concrete elements — shadow DOM and same-origin iframes (f1e3) included. |
pilot_act | click / type / press / hover / select / check / uncheck / upload by ref. Reports console errors it caused and whether it navigated. |
pilot_wait | Wait for a selector, text, URL fragment, or network idle — returns satisfied: false instead of blind-retry loops. |
pilot_screenshot | Viewport or full-page PNG into the workspace, for the human. |
pilot_close | Close tabs when done. |
Refs come from playwright's engine-bound accessibility snapshots (aria-ref locators — the same mechanism playwright-mcp uses in production), so snapshot order can never misdirect an action. Stale refs are refused with instructions to re-snapshot.
localhost always works — frontend testing needs no setup.allowedOrigins pre-authorizes known-good origins/hostnames.newOriginPolicy: auto, the default):
ask → a standard dsh approval card asks the user once per origin;danger-full-access (approval policy never) → silent allow — a user who opted into full access is not re-gated by a plugin;window.open, target=_blank) are closed on arrival.allowPasswordFields: true — dsh itself never lets credential literals reach model context, and neither does this plugin. Uploads are restricted to workspace files; downloads land in downloadDir.- id: pilot
name: dsh-pilot
config:
headless: true
browserChannels: [chrome, msedge, chromium]
viewportWidth: 1280
viewportHeight: 800
navigationTimeoutMs: 15000
actionTimeoutMs: 5000
waitMaxMs: 60000
snapshotMaxChars: 24000
maxTabs: 8
allowedOrigins: []
newOriginPolicy: auto # auto | ask | deny | allow
allowPasswordFields: false
profileDir: '' # set a path to keep logged-in state (understand the risk)
screenshotDir: .dsh-pilot
downloadDir: .dsh-pilot/downloads
maxConsoleMessages: 100
registerSkill: true
profileDir opt-in gives the agent a persistent browser profile — everything logged in inside that profile becomes operable by the agent. Leave empty for a fresh isolated context per run.
pilot_screenshot shows it to the human, and screenshot→vision-model routing is on the roadmap.~1.62.0: the ref-bearing snapshot mode is validated per minor version before upgrading.| Plugin | What it gives your agent |
|---|---|
| dsh-preview | 👁 Eyes — verify what it builds: open, read, screenshot, self-check |
| dsh-pilot (this repo) | ✋ Hands — operate any page by accessibility refs, with a native permission model |
| dsh-review | 🔍 Judgement — find defects, then try to refute each one before reporting it |
| dsh-design | 🎨 Taste — constrain the choices, then measure whether the result kept them |
Each installs independently and they coexist. Design rationale and milestones: DESIGN.md.
git clone https://github.com/Viger1/dsh-pilot.git && cd dsh-pilot
corepack pnpm install
corepack pnpm run build
dsh plugin --profile web add /absolute/path/to/dsh-pilot