{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wqty123-dsh-browser","slug":"wqty123-dsh-browser","rank":238,"url":"https://github.com/wqty123/dsh-browser","name":"wqty123/dsh-browser","category":"browser","description":{"zh":"共享真实浏览器：用户可观看并随时接管的原生 Electron 窗口，agent 通过 CDP 驱动，内置 20 个 browser_* 工具（打开/快照/执行/填表/截图/下载/登录态）；任务级会话隔离、登录态持久化、人机验证识别，纯 `dsh web` 无需桌面外壳即可自托管。","en":"Shared real browser for DSH: a native Electron window the human can watch and take over, driven by the agent over CDP with 20 browser_* tools (open/snapshot/execute/fill/screenshot/download/auth), per-task session isolation, cookie persistence, CAPTCHA detection; self-hosts on plain dsh web without a desktop shell."},"stars":12,"starsCheckedAt":"2026-08-21","repository":{"owner":"wqty123","repo":"dsh-browser","requestedRef":null,"subpath":""},"npm":"dsh-builtin-browser","downloads":3064,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-builtin-browser","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/wqty123/dsh-browser/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wqty123-dsh-browser","slug":"wqty123-dsh-browser","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:36.469Z","scanStatus":"static-complete","verdict":"pass","score":98,"commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","commitDate":"2026-08-16T16:28:20+08:00","artifactDigest":"sha256:ce811cbb5b13c6b6da08f53a9aa97f0bcff78a2504f57a9ac0984ed851b2f1ce","downloadUrl":"https://github.com/wqty123/dsh-browser/archive/9ffe5d6c0d782f3c489d342943fee56d22d6d283.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-builtin-browser","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-builtin-browser","packageVersion":"0.1.15","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-system-prompt","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-builtin-browser","manifestName":"dsh-builtin-browser","nameMatch":true,"npm":{"name":"dsh-builtin-browser","latestVersion":"0.1.15","publishedAt":"2026-08-15T21:48:30.045Z","createdAt":"2026-08-14T19:01:44.811Z","versionCount":16,"maintainers":1,"repository":"git+https://github.com/wqty123/dsh-browser.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"browser","name":"dsh-builtin-browser/browser","path":"cordis.patch.yml","disabled":false},{"id":"browser-electron","name":"dsh-builtin-browser/browser-electron","path":"cordis.patch.yml","disabled":false},{"id":"tool-browser","name":"dsh-builtin-browser/tool-browser","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":1,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"low","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":14,"evidence":"!!js ctx.get('electronViewHost')","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","hash":"5d713c5b49389a11fd746b2b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/browser-electron/remote-host.js","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f6c0664c731adf0f92bd6e97"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/browser-electron/remote-host.ts","pathClass":"source","line":19,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cdb180346d31db6a09b6ef64"}],"counts":{"critical":0,"high":0,"medium":0,"low":3},"rawCounts":{"critical":0,"high":0,"medium":0,"low":3},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":35,"bytesScanned":387918,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":7,"cordis":1,"source":25,"manifest":1,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:22:36.469Z","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:27.168Z","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:58.244Z","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:36.469Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:27.168Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"9ffe5d6c0d782f3c489d342943fee56d22d6d283","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:58.244Z"}]}