dsh-pilot

English | 中文

Browser automation whose permission model is the dsh session's, enforced at the network layer.

Plenty of plugins let a dsh agent drive a browser, and most of them read the page as an accessibility tree — that part is the ecosystem norm, not a feature. What none of them do is answer where the agent is allowed to go with anything sturdier than a check at the tool-call entry point, which by construction cannot stop a redirect, an in-page link click, or a back/forward move.

dsh-pilot answers it twice: the policy is read from the session's own approval stance rather than invented by the plugin, and it is enforced by request interception on the browser context, so every main-frame navigation passes it however it started.

What it looks like

Real, unedited runs from a headless dsh agent (DeepSeek-V4-Pro):

Form flow, fully autonomous. This is what pilot_snapshot actually returns for a registration page — the agent's entire view of it:

- heading "用户注册" [level=1] [ref=e2]
- generic [ref=e3]:
  - text: 用户名
  - textbox "用户名" [ref=e5]
  - text: 邮箱
  - textbox "邮箱" [ref=e7]
  - text: 套餐
  - combobox "套餐" [ref=e9]:
    - option "免费版" [selected]
    - option "专业版"
  - checkbox "同意服务条款" [ref=e11]
  - button "提交注册" [ref=e12]
  - button "重置" [ref=e13]

From there: fill e5 and e7, select 专业版 on e9, check e11, click e12, pilot_wait for the success text (hit in 5ms), screenshot, close. Zero console errors, zero selectors written, no vision model in the loop.

Permissions that follow the session — the same agent asked to open https://example.com:

• under the default workspace-write session: refused — the approval chain answered unavailable and the agent was told exactly what config to request;
• under danger-full-access (the user opted out of prompts): opens silently, no gate in the way.

That is the design: the plugin never invents a second permission system. It reads the dsh session's own durable permission events and behaves accordingly — and because the decision lives in a request interceptor rather than a pre-execute hook, a page that redirects or links its way somewhere else does not slip past it.

Install

dsh plugin --profile web add dsh-pilot

Uses your installed Google Chrome / Microsoft Edge automatically; otherwise run npx playwright install chromium once and set browserChannels: [chromium]. Requires Node ^22.19 || >=24.

Tools

Tool	What it does
pilot_navigate	goto / back / forward / reload, tabs. The single origin-gated entry; decisions are enforced at the network layer (redirects, link-outs, history moves included).
pilot_snapshot	The page as an accessibility tree with [ref=e12] markers bound to concrete elements — shadow DOM and same-origin iframes (f1e3) included.
pilot_act	click / type / press / hover / select / check / uncheck / upload by ref. Reports console errors it caused and whether it navigated.
pilot_wait	Wait for a selector, text, URL fragment, or network idle — returns satisfied: false instead of blind-retry loops.
pilot_screenshot	Viewport or full-page PNG into the workspace, for the human.
pilot_close	Close tabs when done.

…