Preface

DeepSeek Harness (DSH) adopts a plugin-based architecture that allows extending Harness capabilities through plugins. @kasenri/dsh-browser is a community plugin designed to address the limitation that AI agents cannot directly operate browsers. It leverages Harness’s native infrastructure (agents, tools, sessions) to integrate browser automation capabilities into the DSH workflow.

Plugin Introduction

This is a plugin that enables AI agents to genuinely operate browsers to complete tasks. It provides a BrowserAutomationService through ctx.browserAutomation and exposes the agent_browser tool, which drives the underlying agent-browser CLI (version 0.33.2, must be available in the PATH environment).

The plugin supports operations such as opening web pages, clicking, typing, navigating pages, reading content, and downloading files. These capabilities can be used for web testing, information gathering, and automation workflows. The plugin provides security controls such as domain restrictions and implements protective mechanisms for output handling.

Installation & Activation

Installing this plugin requires DSH to be in the developer preview stage. The installation command is as follows:

dsh plugin --profile web add @kasenri/dsh-browser

After installation, the profile must be restarted (or a new session must be started) for changes to take effect. The package declares a dsh.bundle patch, which is automatically registered as a profile layer during registration.

The plugin depends on the following components:
- @deepseek-ai/dsh (version 0.1.5-rc.2)
- @deepseek-ai/cordis (version 4.0.2)
- agent-browser (version 0.33.2, must be in PATH)
- Node.js (version >= 22.19.0)

If agent-browser is not in the PATH, the executable file path can be specified via the command or executablePath configuration options, or by setting the DSH_BROWSER_EXECUTABLE_PATH environment variable.

Core Features

The plugin provides the following core capabilities:

  1. Browser Operations: Supports opening web pages, clicking, typing, navigating pages, reading content, and downloading files.
  2. Multiple Input Modes: The agent_browser tool supports multiple input modes, including args (raw arguments), semanticAction (semantic action), job (batch steps), qa (page quality check), electron (CDP connection), sourceLookup (DOM/React evidence lookup), and networkSourceLookup (network request evidence lookup).
  3. Standard Workflow: The recommended workflow is open → snapshot -i → use @refs → click/fill/select → snapshot -i again.

Security & Protection Mechanisms

To prevent accidents and risks during automation, the plugin has built-in multi-layer protection mechanisms:

  1. Prevention of Stale References: Refs are page-scoped, and the plugin prevents operations on targets from non-latest snapshots.
  2. Prevention of Tab Drift: If the target activity changes (including about:blank), the plugin triggers a recovery mechanism rather than making blind guesses.
  3. Validation of Disk Artifacts: Artifacts such as screenshots, downloaded files, PDFs, HAR/traces are validated for existence, size, and type before reporting success.
  4. Blocking of Sensitive Information: Access to .agent-browser state, password stores, and cookie databases is blocked; all credential-shaped values in tool outputs are redacted.
  5. Domain Restrictions: After configuring allowedDomains, a pre-check is performed, and the --allowed-domains parameter is injected at startup. When restrictions are enabled, CDP attach (electron/connect) is rejected because it cannot be enforced within an existing browser context.
  6. Human Verification Enforcement: The plugin does not bypass CAPTCHA, OTP, passkey, WebAuthn, or 2FA; upon encountering these, it stops and reports.

Configuration Reference

The plugin supports the following configuration options:

Option Default Value Description
command agent-browser The name of the executable file to invoke.
namespace — An optional agent-browser namespace.
executablePath DSH_BROWSER_EXECUTABLE_PATH Path to the Chromium/Chrome executable.
timeoutMs 35000 Default timeout for each subprocess invocation.
maxOutputChars 8000 Character budget for inline output; excess is written to a spill file.
maxOutputLines 120 Line budget for inline output; excess is written to a spill file.
spillDir ~/.dsh/browser-artifacts Directory for writing compacted output.
allowedDomains [] Strict domain whitelist for domain isolation.
registerTool true Whether to register the agent_browser tool.

Important Notes

  1. Version Dependency: The plugin has only been tested against specific versions of DSH and related dependencies; compatibility with other versions is not guaranteed.
  2. Privilege Execution: The plugin runs with the privileges of the current DSH process. The source code and license should be reviewed before installation.
  3. State Management: The plugin confirms operation success by validating disk artifacts, which means traces must be left in the file system.

References