Introduction

In the DSH plugin ecosystem, there are many tools for driving a browser, and most of them operate by reading the page’s accessibility tree. That is the industry convention rather than a distinguishing feature. The key point is the permission model. Existing plugins usually check permissions only at the entry point of a tool call, which makes redirects, in-page link clicks, or history navigation easy to bypass.

dsh-pilot corrects this. It does not invent its own permission system; instead, it directly reads the approval stance of the DSH session itself and enforces it at the network layer via request interception. This means that no matter how the page navigates, navigation is blocked as long as the session has not authorized it.

Core Features

The plugin provides the following tools for operating a page in a browser context:

  • pilot_navigate: Handles goto, back, forward, refresh, and tab operations. This is the only origin-restricted entry point, and decisions are enforced at the network layer (including redirects, link jumps, and history moves).
  • pilot_snapshot: Returns the page’s accessibility tree, with elements marked using [ref=eX] tags. Supports Shadow DOM and same-origin iframes.
  • pilot_act: Executes clicks, input, key presses, hover, selection, checking, unchecking, and uploads via refs. Reports console errors and whether navigation was triggered.
  • pilot_wait: Waits for a selector, text, URL fragment, or network idle. Returns satisfied: false instead of entering a blind retry loop.
  • pilot_screenshot: Saves a viewport or full-page PNG screenshot to the workspace for human review.
  • pilot_close: Closes the tab after the task is completed.

Installation and Enablement

Installing this plugin requires Node.js version ^22.19 or >=24.

dsh plugin --profile web add dsh-pilot

The plugin automatically uses the installed Google Chrome or Microsoft Edge. If you need to use Chromium, first run npx playwright install chromium and set browserChannels: [chromium] in the configuration.

Permission Model

The permission model is entirely based on the DSH session rather than internal plugin logic.

  1. Local Access: localhost is always available, and frontend testing requires no additional configuration.
  2. Preauthorized Origins: Known good origins can be preauthorized via allowedOrigins.
  3. Session Following: Remaining access follows newOriginPolicy (default auto):
    • When the session approval policy is ask, the user is asked once for each origin.
    • When the session is in danger-full-access (approval policy never), access is silently allowed.
    • When there is no approval channel (unattended automation), access is denied.
  4. Network-layer Boundary: Decisions are executed in the browser context’s request interceptor, so redirects, in-page link clicks, and back/forward operations cannot bypass this check. Popups (window.open) are closed upon arrival.
  5. Credential Hygiene: Input into password fields is denied by default unless the deployment sets allowPasswordFields: true. Uploads are limited to workspace files, and downloads are directed to a specified directory.

Configuration Example

In DSH plugin configuration, dsh-pilot supports the following parameters:

- id: pilot
  name: dsh-pilot
  config:
    headless: true
    browserChannels: [chrome, msedge, chromium]
    viewportWidth: 1280
    viewportHeight: 800
    navigationTimeoutMs: 15000
    actionTimeoutMs: 5000
    waitMaxMs: 60000
    snapshotMaxChars: 24000
    maxTabs: 8
    allowedOrigins: []
    newOriginPolicy: auto       # auto | ask | deny | allow
    allowPasswordFields: false
    profileDir: ''              # 留空表示每次运行使用隔离上下文
    screenshotDir: .dsh-pilot
    downloadDir: .dsh-pilot/downloads
    maxConsoleMessages: 100
    registerSkill: true

Enabling profileDir allows the agent to operate within a persisted browser profile, but you should be aware of the security risks this implies (logged-in state may be accessible).

Known Limitations

  • Accumulation of Approved Origins: Approved origins accumulate over the lifetime of a plugin instance and are shared across sessions within the same DSH process (that is, they share one browser context).
  • Canvas Content: Canvas-rendered content has no accessibility semantics. pilot_screenshot can only expose it to humans; using screenshots with a vision model is still planned.
  • Headless Rendering Differences: Rendering behavior in headless mode differs from that of desktop browsers, including pointer lock, some GPU paths, and operating-system dialogs.
  • Ref Mechanism Maintenance Cost: The ref mechanism is based on Playwright internals. Although ariaSnapshot({ mode: 'ai' }) is public, the aria-ref= engine that converts refs into selectors is not public, and Locator.ariaRef() was removed in Playwright 1.60. Therefore, playwright-core is pinned to ~1.62.0, and later version updates require re-validation of Shadow DOM and iframe scenarios.
  • Name Conflict: This name is not unique. guo6x/dsh-pilot is an earlier, different plugin, and care is needed to distinguish them during installation.

Ecosystem Context

DSH plugins are independent from the DeepSeek or Huanfang official app store and belong to a plugin ecosystem managed through a community catalog. The maintainer of dsh-pilot, Viger1, has also developed plugins such as dsh-preview (visual inspection), dsh-review (defect review), and dsh-design (design constraints), which can be installed independently and coexist.

  • Plugin catalog: https://www.skillhub.cn/plugins/Viger1/dsh-pilot
  • Source repository: https://github.com/Viger1/dsh-pilot