In the DeepSeek Harness (DSH) ecosystem, plugins are the primary way to extend specific capabilities. When an agent needs to handle dynamic web pages, fill out forms, or scrape data, existing tools often struggle to meet the requirements of a real browsing environment. The dsh-plugin-browser-use plugin provides DSH with real browser capabilities based on Chromium and integrates a strict security policy.

What Is This

dsh-plugin-browser-use is a browser automation plugin designed for DeepSeek Harness (DSH). It drives Chromium through Playwright, enabling the model to perform actions such as navigation, clicking, filling, and taking screenshots. The core value of this plugin lies in its “security-first” design: policies are rechecked after every action and navigation, and all file writes are managed by the plugin, preventing the model from controlling file paths.

Core Features

The plugin provides 15 tools covering core browser interaction scenarios:

  • Page Operations: browser_navigate (navigate), browser_navigate_background (background loading), browser_screenshot (screenshot), browser_pdf (generate PDF).
  • Interaction: browser_click (click), browser_fill (fill form), browser_upload (upload file).
  • Reading: browser_read_text (read text), browser_read_snapshot (read ARIA snapshot).
  • Tab Management: browser_tab_new (new tab), browser_tab_list (list tabs), browser_tab_select (switch tab), browser_tab_close (close tab).
  • Others: browser_downloads (download management), browser_close (close browser).

Installation and Enabling

To install this plugin, use DSH’s plugin management commands. After installation, ensure that Chromium is configured in the system or that Playwright’s Chromium is installed.

dsh plugin --profile web add dsh-plugin-browser-use
dsh --profile web --dump-config   # 验证配置是否生效，应看到 "# == dsh-plugin-browser-use" 层

Prerequisites:
* Node.js version requirement: ^22.19.0 or >=24.0.0.
* Chromium must be installed. The plugin resolves it in the following order:
1. executablePath configuration item
2. environment variable $DSH_BROWSER_EXECUTABLE
3. common system locations
4. Playwright’s built-in resolution (can be obtained via npx playwright install chromium)

Security Model and Configuration

The plugin’s security mechanisms operate at three levels: policy checks, network isolation, and file path control.

1. Policy Rechecking
Policies are rechecked before every action and after every navigation. Even if the initial URL is allowed, operations are rejected if a redirect or click leads to an insecure domain.

2. Network Isolation
* Host Allowlist: configured via allowedHosts. Matching is based on host labels; for example, example.com matches example.com and sub.example.com, but not evil-example.com.
* Private Networks: 127.0.0.1, private network segments, etc., are blocked by default. Explicitly set allowPrivateNetwork: true to allow access.
* Protocol Restrictions: only http: and https: are supported. Protocols such as file:, data:, and javascript: are prohibited.

3. File Path Control
The plugin strictly prevents the model from controlling file paths. Screenshots, PDFs, and downloads are written to the configured artifactsDir, with file names generated by the plugin. File uploads are limited to files under the configured uploadsDir.

Common Configuration Items:
| Configuration Item | Type | Default | Description |
| :— | :— | :— | :— |
| allowedHosts | string[] | [] | Allowlist of hosts that may be accessed; if empty, all public hosts are allowed |
| allowPrivateNetwork | boolean | false | Whether to allow private network access (such as localhost) |
| headless | boolean | true | Whether to run in headless mode |
| executablePath | string | — | Absolute path to the Chromium executable |
| userAgent | string | custom | The browser User-Agent |
| proxyServer | string | — | Proxy server address (such as http://127.0.0.1:7890) |
| artifactsDir | string | private temporary directory | Directory for storing screenshots, PDFs, and downloads |

Typical Usage Examples

Allow specific hosts:

allowedHosts:
  - example.com

Specify Chromium path:

executablePath: /usr/bin/chromium

Custom User-Agent:

userAgent: dsh-plugin-browser-use/0.3.1

Background loading page:
If a page needs to be loaded without interrupting the current operation flow, use browser_navigate_background. This feature depends on @deepseek-ai/dsh-jobs and @deepseek-ai/dsh-tool-jobs.

Notes

  • Background Loading Dependency: The browser_navigate_background feature depends on @deepseek-ai/dsh-jobs; otherwise, the tool returns a BROWSER_JOBS_UNAVAILABLE error.
  • Node Version: Ensure the environment meets the ^22.19.0 or >=24.0.0 version requirement.
  • Source Code Review: The plugin runs with the privileges of the current DSH process; review the source code and license (MIT) before use.
  • Error Codes: All failures return isError: true in the tool result with a BROWSER_* error code, rather than throwing an exception.

Summary

dsh-plugin-browser-use provides DeepSeek Harness with controllable browser automation capabilities. Through strict policy checks, path isolation, and private network restrictions, it addresses the security risks associated with model network access. For developers building agents with web operation capabilities in DSH, this is a fundamental and secure tool choice.