Preface

In the development of DeepSeek Harness, the plugin @yeesy369/dsh-browser-playwright provides Playwright-based browser control capabilities, but its built-in SSRF (Server-Side Request Forgery) protection mechanism blocks access to local or LAN addresses. This causes inconvenience for developers who need to debug local services or access intranet pages. dsh-intranet-browser aims to solve this problem; it modifies the original plugin’s logic and, while maintaining security, allows Harness to open local and intranet resources.

Plugin Positioning

This is a plugin modified based on @yeesy369/dsh-browser-playwright, provided by maintainer Short-Arm-Ape. It bypasses the original plugin’s SSRF protection logic to start an independent Playwright browser instance for DeepSeek Harness. This instance has its own service name, configuration profile directory, and window, specifically for debugging intranet and local pages.

Core Features

  • Bypass SSRF protection: Removes the strict restrictions in the original plugin’s url-guard.ts, allowing access to localhost and LAN addresses.
  • Independent instance operation: Uses the independent service name intranet-browser and the default profile ~/.dsh/intranet-edge-profile, running in parallel with the original browser plugin.
  • Approval per invocation: By default, each invocation of intranet_* tools triggers a user approval prompt, ensuring controlled operations.
  • Cloud metadata interception: By default blocks cloud metadata endpoints (such as 169.254.169.254), preventing accidental leakage of cloud server information.
  • Tool support: Provides a series of tools for page interaction and management, including opening, screenshots, snapshots, clicking, input, scrolling, history navigation, multi-tab management, JS code execution, and window closing.

Installation and Enablement

The installation process requires adding the plugin to the web configuration file. Please ensure that you run the following command in the terminal from the plugin’s absolute path:

dsh plugin --profile web add [absolute path to this package]

After installation, DeepSeek Harness must be restarted for the plugin to take effect.

Typical Usage

After installation and restart, AI agents can interact with local or intranet pages by calling tools.

  1. Open page: The AI calls intranet_open to open an intranet address. Based on the default configuration, the system will prompt for approval; navigation is executed after confirmation.
  2. Debug page: After navigation, you can use intranet_snapshot to obtain an accessibility snapshot of the page, or use intranet_screenshot to capture an image for visual debugging.

Use Cases and Notes

  • Use cases: Mainly used during agent development to debug web applications running locally or on a LAN.
  • Maintenance status: This repository is no longer maintained and has been merged into the Short-Arm-Ape/dsh-browser-unified plugin. The current repository is retained as a read-only archive.
  • Security advice: Since the plugin involves modifications to browser behavior, it is recommended to check the source code and license (MIT) before installation.
  • Feature limitation: The intranet_evaluate tool is not registered by default. It will only appear after enabling evaluate: true in the configuration and restarting.

Summary

dsh-intranet-browser provides DeepSeek Harness with a controlled solution for bypassing SSRF restrictions to access intranet resources. Through an independent instance and an approval mechanism, it maintains security while facilitating debugging. More details and source code can be found on the plugin directory page or in the GitHub repository.