dsh-cloudflare-browser-run

1. 安装并启动 DeepSeek Harness：npx @deepseek-ai/dsh web
2. 在终端执行上面的安装命令（CLI 会解析插件并核验来源）
3. 用 dsh plugins list 确认已安装，必要时重启 Harness 生效

插件以当前 dsh 进程的权限运行，安装时可能执行代码。请先通读仓库源码与许可证，确认无破坏性命令与越权访问；本站只做索引，不对第三方插件安全性作担保。

事实信息来自公开插件目录快照（2026-10-01），介绍文案由本站再加工。

以下为插件仓库 README 全文（原始内容，由公开目录抓取整理）。

[图片: dsh-cloudflare-browser-run — real browser access for DeepSeek Harness]

# dsh-cloudflare-browser-run

A DeepSeek Harness plugin that gives the agent **real browser access**: headless Chrome on Cloudflare's network, so JS-rendered pages, screenshots, and PDFs all just work.

> Port of [pi-cloudflare-browser-run](https://github.com/RealAlexandreAI/pi-cloudflare-browser-run), built to the dsh (Cordis) plugin spec.

[English](README.md) · [中文](README.zh.md)

## Why

The built-in `web_fetch` is a plain HTTP fetch — JS pages come back empty and SSRF protection is deferred upstream. This plugin adds a real browser:

- clean **markdown** from any public page (SPA/JS included)
- **screenshots** (PNG) and **PDFs**
- login-capable sessions and WebMCP sites

## Quick start

```sh
dsh plugin --profile web add dsh-cloudflare-browser-run
```

Configure credentials in your profile/settings layer:

```yaml
- id: cloudflare-browser-run
  name: dsh-cloudflare-browser-run
  config:
    cf_api_token:
    cf_account_id:
```

Token: Cloudflare dashboard → API Tokens → **Browser Rendering: Edit** template.
Account id: `dash.cloudflare.com//...`.

## Tools

| tool | what it does |
|---|---|
| `browse` | fetch a public URL → clean markdown (default); `action` = `screenshot` \| `pdf` |
| `screenshot` | save the page as PNG locally, returns the file path |
| `pdf` | save the page as PDF locally, returns the file path |

## Config

| key | required | meaning |
|---|---|---|
| `cf_api_token` | ✅ | your API token (Browser Rendering:Edit) |
| `cf_account_id` | ✅ | your Cloudflare account id |
| `cf_api_base` | – | API base override |
| `output_dir` | – | where screenshots/PDFs land (default OS temp) |

## Privacy

- **Public web only**: every URL passes an SSRF guard (localhost / private IPs / IPv6 literals / userinfo rejected) before the API is called.
- The token lives only in your config file — never logged, never stored by the plugin.
- Browser Run identifies itself as a well-behaved bot, the compliant way to fetch.

## Development

```bash
npm install
npm run typecheck
npm test          # SSRF guard / config / API shape
npm run build
```

Live API test (not part of `npm test`):

```bash
DSH_TEST_CF_TOKEN= DSH_TEST_CF_ACCOUNT= node --import tsx tests/real/real-cf.mjs
```

## License

MIT