dsh-tabbit 0.2.3 → 0.3.0

package/skills/tabbit/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: tabbit
+description: Control Tabbit Browser in a task-isolated Playwright workspace; never switch browser backends.
+---
+
+# Tabbit
+
+## Choose invocation
+
+- Set `<launcher>` to macOS/POSIX `"$HOME/.local/bin/tabbit-cli"` or Windows
+  PowerShell `& "$env:LOCALAPPDATA\Tabbit\LocalAgent\bin\tabbit-cli.exe"`. Do
+  not assume `tabbit-cli` is on `PATH`.
+- If the command tool returns a reusable process handle and supports later
+  stdin writes through pipe-backed stdin (non-PTY on Windows), run `<launcher>
+  persistent` once. This is preferred.
+- Otherwise use `<launcher> nodejs --task NAME` immediately. Reuse the exact
+  name for every command. Do not try persistent first. Read [platform
+  invocation](references/platform-invocation.md) for CMD and code input.
+
+## Persistent workspace
+
+Send newline frame; wait for its response. Never detach or background the
+process.
+Commands renew a five-minute lease; expiry keeps tabs/group and stops animation.
+
+Send `bootstrap` first with a concise display `taskName`. In `code`, navigate,
+act, verify with Playwright `expect`, then return proof:
+
+```json
+{"op":"bootstrap","taskName":"Save-profile","requestId":"save-01","code":"await page.goto('https://example.test/profile',{waitUntil:'domcontentloaded'}); await page.getByRole('button',{name:'Save'}).click(); await expect(page.getByText('Saved')).toBeVisible(); return {verified: true};"}
+```
+
+If bootstrap returns `queued`, wait with
+`{"op":"inspect","requestId":"save-01","waitMs":60000}`; never resubmit.
+
+Split only when the returned state changes the next decision. Later `run`
+frames name a path-safe `requestId`:
+`{"op":"run","requestId":"save-02","code":"return await page.title();"}`
+Send `{"op":"tabs"}` before bootstrap to take over an existing tab; include its
+exact `tabId` in `claimTabIds`.
+Inventory creates no task, Page, tab, or group. Later frames omit task identity.
+
+The workspace owns only `context.pages()`/`pages()` and places every owned tab
+in its one group. Prefer semantic locators, bounded loops,
+same-program verification. Use `status` and `result.value`.
+
+Before the final response, finish exactly once: send `{"op":"finish"}` in
+persistent mode or run `<launcher> finish --task NAME` otherwise.
+Plain finish retains tabs and the resumable group. Use
+`{"op":"finish","keep":false}` only for explicit discard or necessary cleanup.
+It closes only session-created tabs, never claimed or resumed tabs.
+
+## Load details only when needed
+
+Do not preload these references:
+
+- Read [platform invocation](references/platform-invocation.md) for
+  product/instance routing or launcher failures.
+- Read [interaction helpers](references/interaction-helpers.md) for
+  claim/resume, evidence, focus, paste, or blockers.
+- Read [Playwright recipes](references/playwright-recipes.md) for popups,
+  frames, uploads, downloads, canvas, or repetition.
+- Read [information extraction](references/information-extraction.md) for results.
+- Read [runtime recovery](references/runtime-recovery.md) after a failed,
+  interrupted receipt or transport/finish failure.
+  Never blindly retry a possible mutation.

package/skills/tabbit/references/interaction-helpers.md

@@ -0,0 +1,150 @@
+# Interaction helpers
+
+These additive helpers live in the persistent Node evaluation realm as the
+frozen `tabbit` global. They do not replace native Playwright APIs.
+
+Evaluation code supports top-level `await` and `return` and provides persistent
+`browser`, `context`, `page`, `pages()`, `usePage()`, Node `assert`, official
+Playwright Test `expect`, `artifactPath()`, `reportIssue()`, and `tabbit`.
+Browser DOM globals exist only inside `page.evaluate()`; return bounded
+JSON-safe values, never Page, Locator, Frame, JSHandle, or DOM objects.
+
+## Inventory, claim, and resume
+
+`{"op":"tabs"}` before bootstrap is metadata-only discovery across regular
+tabs in the bound Profile. It creates no task, Page, tab, or group. Each bounded
+descriptor includes `tabId`, `windowId`, tab-strip
+`index`, `title`, `url`, `active`, relative `state`, and optional live group
+metadata. `available` means unowned, `owned` means owned by this workspace, and
+`busy` means another workspace owns it. Discovery never attaches, claims,
+groups, focuses, navigates, or creates a Playwright Page.
+
+Only owned tabs appear in `context.pages()` and `pages()`. Bootstrap an existing
+available tab with its exact returned ID in `claimTabIds`. After bootstrap,
+claim another available tab with `{"op":"claim","tabIds":[17]}` or resume
+every claimable tab in one exact group with `{"op":"resume","groupId":"A1B2"}`.
+Inventory is advisory:
+claim/resume revalidates and can fail if another session won. Batches are
+atomic; duplicate, stale, busy, unsupported, or cross-window inputs do not
+partially claim. Claims never move tabs between windows. Group titles are
+presentation, never identity or ownership.
+
+When the next program is known, combine ownership and evaluation:
+
+```json
+{"op":"run","tabIds":[17,18],"requestId":"compare-01","mutation":"possible","code":"await expect(page.getByRole('main')).toBeVisible(); return {controlled:pages().length,url:page.url()};"}
+```
+
+Use `groupId` instead of `tabIds` to resume and run. A workspace has no group
+while empty and one group once it owns a tab. Dragging an owned tab out is user
+takeover and removes that Page; dragging an unowned tab in does not claim it.
+
+## Screenshots
+
+Use screenshots for canvas or DOM/visual disagreement, not routine discovery.
+Before substantial input on a canvas or rich editor, make a small write probe
+and verify the rendered result. `page.screenshot()` produces a receipt entry
+rather than visual input. When
+`outcome.screenshotsDelta` gives `nextAction.type: "load_image"`, immediately
+load its path with `view_image(path)`. Without an image reader, make no visual
+claim and capture no further screenshot. Capture again only after a meaningful
+visual-state change. For broad accessible structure, prefer a bounded
+`page.ariaSnapshot({mode: "ai", depth: 20, boxes: true})`, then act with a fresh
+`page.locator("aria-ref=e2")`.
+
+## `tabbit.observe(options)`
+
+Returns bounded task state: page metadata, selected frame metadata, optional
+deep-focus details, and truncated native ARIA snapshots for the page and each
+selected frame. Frame entries include `hostBox`, `viewportIntersection`,
+`visible`, `actionable`, and `occludedBy`.
+
+```js
+return await tabbit.observe({frames: "visible", focus: true, depth: 16,
+  maxChars: 6000, frameMaxChars: 2000, maxFrames: 8});
+```
+
+`frames` is `"none"`, `"visible"`, or `"all"`; `depth` is 1–30, `maxChars` is
+256–20000, `frameMaxChars` is 256–6000, and `maxFrames` is 1–32. This is
+observation only. Do not treat a frame snapshot as permission to act when its
+host is non-actionable.
+
+## `tabbit.focusInfo()` and `tabbit.hitTest(targetOrPoint)`
+
+`tabbit.focusInfo()` follows focus through child frames and open shadow roots,
+returning role/name/type/editability, visibility, rectangle, and selection.
+Call it before keyboard input.
+
+`tabbit.hitTest(locator)` reports the element at the locator's center across
+frames. `tabbit.hitTest({x, y})` checks a main-frame viewport point. Call it
+before coordinate input and treat mismatches as a reason to re-observe.
+
+## `tabbit.actionability(locator)`
+
+`tabbit.actionability()` verifies the target inside its owner frame and every
+iframe host up to the main page. It reports target visibility, event reception,
+viewport intersection, frame identity, and blockers such as an `occludedBy`
+element. Click with native `locator.click()` so Playwright performs its full
+actionability and retry behavior.
+If a click fails, preserve the Playwright error and use this helper for explicit
+diagnostics; do not make the helper a precondition or force the click.
+
+## `tabbit.pasteText(text, options)`
+
+Dispatches a task-local synthetic paste, then uses an editable fallback when
+needed. It never reads or overwrites the user's OS clipboard and reports
+`trusted: false`. Options are `format: "text" | "tsv"` and
+`requireEditableFocus: true | false`. The receipt reports byte/character counts,
+strategy, and focus before/after, but never echoes the payload.
+
+```js
+const input = page.getByRole("textbox", {name: "Data"});
+await input.click();
+const paste = await tabbit.pasteText("张三\t25\t技术", {
+  format: "tsv", requireEditableFocus: true,
+});
+await expect(input).not.toHaveValue("");
+return {paste, value: await input.inputValue()};
+```
+
+Always verify application-visible state; synthetic events are not trusted user
+events and a site may reject them.
+
+## `tabbit.triggerAndWait(event, trigger, options)`
+
+Arms the waiter before running `trigger`. Supported events are `popup`, `page`,
+`download`, `dialog`, `navigation`, and `url` (`options.url` required for `url`).
+
+```js
+const popup = await tabbit.triggerAndWait(
+  "popup", () => page.getByRole("link", {name: "Open"}).click(),
+  {timeoutMs: 10000},
+);
+return {popupUrl: popup.url()};
+```
+
+## `tabbit.triggerAndObserve(trigger, options)`
+
+Use this for ambiguous transitions. It arms page, URL, navigation, frame, and
+DOM-revision observation before `trigger`, then returns the highest-priority
+observed result after a short settle window. Options are `timeoutMs`, `settleMs`,
+`pollMs`, and `activatePage`. With `activatePage: true`, a newly opened page
+becomes the task's active `page`.
+
+```js
+const result = await tabbit.triggerAndObserve(
+  () => target.click(),
+  {timeoutMs: 3000, activatePage: true},
+);
+return {kind: result.kind, url: page.url()};
+```
+
+## Input and blocker conventions
+
+For reactive inputs, select a visible suggestion or use the supported commit
+key, blur through a neutral control, and verify persistence. Close any visible
+calendar or suggestion overlay before submitting. Follow rendered first-party
+links for opaque routes instead of guessing.
+
+Report verified blockers with `reportIssue(code)`: `AUTHENTICATION_REQUIRED`,
+`SITE_ACCESS_BLOCKED`, or `BROWSER_ERROR_PAGE`.

package/skills/tabbit/references/platform-invocation.md

@@ -0,0 +1,174 @@
+# Platform invocation
+
+Read this reference only when the user names an instance or product, the host
+cannot keep process stdin writable, or launcher, permission, installation, or
+routing fails. Use only the installed stable launcher. Never invoke a CLI from
+an app bundle, use a versioned native CLI, read `endpoint.json`, or switch
+backends.
+
+## Persistent invocation
+
+Start the launcher once per Agent conversation and keep its stdin/stdout open.
+It selects and authenticates one Browser instance once, then accepts bounded
+newline-delimited JSON: optionally one unbound `tabs` inventory, then
+`bootstrap`; zero or more `run`, `inspect`, `tabs`, `claim`, `resume`,
+`receipt`, `checkpoint`, `diagnose`, `docs`, or `resource` frames; and `finish`
+last. When claiming existing Browser state, pass the selected returned ID
+through bootstrap `claimTabIds`. Wait for each newline JSON response before
+sending the next frame. Later frames must not contain `task`, `taskId`, `name`,
+`taskName`, or `generation`.
+
+Every submitted frame produces exactly one newline JSON receipt on stdout.
+Local validation failures and Runtime transport interruption are receipts too;
+stderr is reserved for process-level startup, shutdown, and usage failures.
+
+The macOS/POSIX stable launcher is:
+
+```bash
+"$HOME/.local/bin/tabbit-cli" persistent
+```
+
+The Windows PowerShell form is:
+
+```powershell
+& "$env:LOCALAPPDATA\Tabbit\LocalAgent\bin\tabbit-cli.exe" persistent
+```
+
+The Windows CMD form is:
+
+```bat
+"%LOCALAPPDATA%\Tabbit\LocalAgent\bin\tabbit-cli.exe" persistent
+```
+
+Use pipe-backed stdin for persistent mode on Windows. Do not allocate a console
+PTY: terminal echo, line editing, or wrapping can alter an NDJSON frame. If the
+host offers only a PTY, use the compatibility commands immediately. This rule
+does not change the macOS/POSIX launcher or its stdin behavior.
+
+Keep the launcher as the first command token. When the Agent command sandbox
+blocks it, request reusable approval only for that stable path; do not wrap it
+with `env`, a shell, or another executable. The client retains one Browser
+connection for the workspace. If that connection closes, the workspace ends.
+
+Do not start persistent mode with a detached or background command that closes
+stdin. `Persistent input ended before bootstrap` means the host closed the
+protocol stream; it is not Browser or instance unavailability. When the host
+has no interactive process primitive, use the compatibility commands instead
+of building a FIFO or wrapper. A frame the client rejects reports
+`INVALID_PERSISTENT_INPUT` on stdout and leaves the connection open; correct
+that frame and continue on the same process. Choose one concise task name and
+reuse it exactly:
+
+- `nodejs --task NAME`, `inspect --task NAME`, `tabs --task NAME`
+- `claim --task NAME --tab ID...`, `resume --task NAME --group ID`
+- `receipt --task NAME --request ID`, `checkpoint --task NAME`,
+  `diagnose --task NAME`
+- `resource --task NAME --resource ID`, `finish --task NAME [--discard]`
+
+These commands reuse the same Browser-owned task and receipt lane. Plain
+`finish` retains it; `--discard` closes only tabs created by that session.
+
+On Windows, pass multiline `nodejs` code through pipe-backed stdin. If the host
+cannot close that pipe, write the code to a task-scoped temporary `.js` file,
+then invoke the stable launcher from CMD with `<` redirection:
+
+```bat
+"%LOCALAPPDATA%\Tabbit\LocalAgent\bin\tabbit-cli.exe" nodejs --task NAME < "%TEMP%\tabbit-task.js"
+```
+
+Remove the temporary file after its receipt. Do not use a PowerShell pipeline,
+here-string, `echo`, or a console PTY to transport code; those paths can alter
+newlines, encoding, or long input.
+
+## Product and instance selection
+
+With no explicit instance or product request, do not inspect the registry or
+set an override. The stable launcher selects once when persistent mode starts.
+
+For an explicit request, inspect only the current user's registry with
+read-only commands. Normalize only case and surrounding space for a product and
+match exactly `Tabbit Browser`, `Tabbit Browser Dev`, `Tabbit`, or `Tabbit Dev`;
+they are not aliases. Discard records that fail the platform checks below. Pick
+the exact requested instance or one exact product match. If multiple valid
+records match a product, show their instance IDs and ask the user. Automatic
+liveness and newest-endpoint selection belong to the stable launcher.
+
+Set the selected uppercase 16-hex instance ID before starting the one persistent
+process. Do not invoke an unpinned launcher as a probe, change the ID during the
+conversation, or repeat environment setup for operations.
+
+POSIX shell:
+
+```bash
+export TABBIT_PLAYWRIGHT_INSTANCE='0123456789ABCDEF'
+"$HOME/.local/bin/tabbit-cli" persistent
+unset TABBIT_PLAYWRIGHT_INSTANCE
+```
+
+PowerShell:
+
+```powershell
+$env:TABBIT_PLAYWRIGHT_INSTANCE = '0123456789ABCDEF'
+& "$env:LOCALAPPDATA\Tabbit\LocalAgent\bin\tabbit-cli.exe" persistent
+Remove-Item Env:TABBIT_PLAYWRIGHT_INSTANCE
+```
+
+CMD:
+
+```bat
+set "TABBIT_PLAYWRIGHT_INSTANCE=0123456789ABCDEF"
+"%LOCALAPPDATA%\Tabbit\LocalAgent\bin\tabbit-cli.exe" persistent
+set "TABBIT_PLAYWRIGHT_INSTANCE="
+```
+
+## Registry validation
+
+On macOS/POSIX, the registry is exactly:
+
+```text
+$HOME/.local/share/tabbit-playwright/instances
+```
+
+Inspect candidate `*.instance` files and matching `*.product` sidecars with
+`find`, `test`, `stat`, and bounded text reads. The directory must be owned by
+the current user, mode 0700, and not a symlink. A record must be a
+regular non-symlink owned by the current user with mode 0600, an uppercase
+16-hex filename ID, exact managed marker and line count, absolute managed paths,
+and a canonical product sidecar. Missing `endpoint.json` means offline; never read
+the file. Ignore invalid records.
+
+On Windows, the registry is exactly:
+
+```text
+%LOCALAPPDATA%\Tabbit\LocalAgent\instances
+```
+
+Use PowerShell `Get-ChildItem`, `Get-Item`, `Get-Acl`, and `Get-Content -Raw`
+only for read-only inspection. A valid `*.json` record is a regular file under
+that protected root, has no reparse component, has the protected DACL for the
+current user and `SYSTEM`, and has exactly `version`, `instanceId`, `product`,
+`cliPath`, `endpointPath`, `browserPath`, and `userDataDir`. Require version 1,
+a matching uppercase 16-hex filename ID, a canonical product, absolute accepted
+installation paths, and `endpointPath` exactly below `userDataDir\LocalAgent`.
+Ignore invalid records; do not repair them.
+
+## Failure boundaries
+
+- Agent sandbox denial: request reusable approval for the stable launcher path
+  and, only for explicit selection, read-only registry access. Approval does not
+  authorize registry changes.
+- OS ownership, mode, ACL, endpoint-access, quarantine, or signing-policy
+  denial: verify Agent and Browser share an OS user, then relaunch Browser so it
+  can repair its managed integration. Report any remaining denial without
+  changing system security.
+- Missing or malformed launcher/registry: invalid installation.
+- exit 69: unavailable or ambiguous routing.
+- `Persistent input ended before bootstrap`: closed host stdin; use an
+  interactive process or the compatibility commands above. Do not relaunch the
+  Browser.
+- Failure after selection: runtime connection denial.
+- `BROWSER_RUNTIME_UNAVAILABLE`: relaunch Browser once with permission. Never
+  start the Browser-owned Runtime Service directly.
+
+Never broaden permissions or ACLs, require administrator access, disable
+security controls, or copy/relocate native binaries.

package/skills/{tabbit-browser → tabbit}/references/playwright-recipes.md

@@ -1,8 +1,14 @@
 # Playwright recipes
 
-Use these recipes inside a `tabbit-cli nodejs --task '<name>'` heredoc.
-Each code block is an async function body: use it
-directly without adding an async wrapper.
+Use these code bodies as the `code` field of a bound `bootstrap` or `run`
+request. Each is an async function body: use it directly without adding an
+async wrapper. For name-addressed compatibility, send the same body to
+`<launcher> nodejs --task NAME` through a POSIX heredoc on macOS/Linux or the
+Windows code-input procedure in [platform invocation](platform-invocation.md).
+
+Each frame gets a fresh async wrapper, so lexical variables do not survive.
+Re-resolve Pages with `context.pages()`/`pages()`, or put intentional
+cross-frame state on `globalThis`.
 
 ## Contents
 
@@ -37,6 +43,8 @@ return {
 ```
 
 Use `mutation: "possible"` because navigation changes browser state.
+Prefer `domcontentloaded`, or `commit` followed by an explicit readiness check.
+Reserve full `load` for tasks that depend on every page resource.
 
 ## Inspect visible controls and visual targets
 

package/skills/tabbit/references/runtime-recovery.md

@@ -0,0 +1,104 @@
+# Runtime receipts and recovery
+
+Read this reference after a failed, interrupted, or quarantined receipt, a
+possible mutation, a resource result, explicit diagnostics, transport close, or
+finish failure. A `queued` or `running` receipt is not one of those: it is
+ordinary pending work, described under receipt states below. Keep using the
+same open `tabbit-cli persistent` process while its Browser connection remains
+open.
+
+## Compact and explicit results
+
+Normal success is compact: use `result.value` and `status`.
+Only bootstrap includes `task` identity. Static Browser/Playwright capabilities
+are available with `{"op":"docs","topic":"capabilities"}`; binding,
+controller, and Browser health are available with `{"op":"diagnose"}`. Do not
+request either after ordinary successful actions.
+
+Each evaluation has a stable `requestId`. Recovery operations are explicit:
+
+- `{"op":"inspect","requestId":"save-01"}` returns the compact state of that
+  original request. Its optional `waitMs` waits for that receipt to reach a
+  terminal state without resubmitting the request, and can be repeated;
+  `{"op":"inspect"}` returns current task status. In compatibility mode the
+  same bounded wait is
+  `tabbit-cli receipt --task NAME --request save-01 --wait-ms 60000`.
+- `{"op":"receipt","requestId":"save-01"}` returns its complete canonical
+  receipt.
+- `{"op":"checkpoint"}` returns task/page recovery state.
+- `{"op":"resource","resourceId":"...","offset":0,"maxBytes":8192}` reads
+  a bounded spilled result; continue with the returned `nextOffset` until
+  `eof`.
+
+Use `receipt`, `checkpoint`, `diagnose`, `docs`, and `resource` only when their
+detail changes the next decision or the user explicitly requests diagnostics.
+Choose request IDs that encode intent and order, such as `submit-order-03`, and
+never reuse one for changed code. A `run` frame carrying `code` must name its
+`requestId`; only `bootstrap` may omit it and take the default `bootstrap`.
+That default is reserved: submitting your own work under it fails with
+`REQUEST_ID_RESERVED` rather than replaying the bootstrap receipt.
+`timeoutMs` bounds the evaluation and must be positive and at most 120000;
+`waitMs` bounds only the client-side wait for its receipt and is capped the
+same way.
+
+## Receipt states
+
+- `succeeded`: consume inline `result.value`, or read its bounded `resourceId`
+  using the operation above.
+- A terminal receipt's `transition` reports URL and Page changes plus the new
+  page count, target epoch, and document generation. Check it before recovery.
+- `queued` or `running`: ordinary pending work, not failure.
+  Bootstrap code returns this prompt receipt by default after the workspace
+  is bound; its evaluation continues on the same receipt lane. Wait with
+  `{"op":"inspect","requestId":"save-01","waitMs":60000}`, repeat that wait as
+  long as it stays pending, and never submit the request again. Treat it as a
+  fault only once it outlives its own `timeoutMs`.
+- `failed`: inspect its bounded error and `mutationState`. Correct and rerun
+  only when no uncertain mutation remains. A failed `bootstrap` still created
+  the task and bound the connection, and its response carries `bound: true`;
+  continue with a corrected `run` frame and never resend `bootstrap`, because
+  a second frame naming a task is rejected as an invalid bound request.
+- `interrupted`, quarantine, or `mutationState: "possible"`: the action may
+  already have happened. Inspect the same request, then its canonical receipt
+  and checkpoint. Check `url`, `pageCount`, `targetEpoch`,
+  `documentGeneration`, and `mainFrameAttached`, then perform a new read-only
+  observation of application state.
+  Continue from evidence and retry only when evidence proves the original
+  mutation did not occur.
+- A screenshot result includes a bounded screenshot delta and `nextAction`. If
+  `nextAction.type` is `load_image`, immediately load the named immutable PNG
+  with the host image reader before making visual claims.
+
+A client-side wait expiry is not operation failure. Never evade pending or
+quarantined work by changing request IDs, tasks, instances, or browser backends.
+
+## Transport close
+
+`TRANSPORT_INTERRUPTED` is the submitted frame's terminal stdout receipt: the
+Runtime connection ended before its operation receipt arrived. It does not
+prove that a possible mutation did not happen.
+
+The authenticated connection owns the workspace. If it closes, the Runtime
+finalizes the task and the native client exits. Do not reconnect, replay the
+request, or issue bound receipt/checkpoint operations through a replacement
+connection. A fresh workspace may inspect externally visible application state
+read-only; retry a mutation only if that proves the original did not occur.
+
+If a group disappeared while the current empty binding remains healthy, list
+current tab/group descriptors and make a new explicit claim/resume decision.
+If a user drags an owned tab out, accept its release and continue only with the
+remaining owned Pages.
+
+## Finish
+
+Send `{"op":"finish"}` exactly once after verification or when abandoning the
+workspace. Plain finish releases ownership and retains live tabs and the group;
+its returned `groupId` can later be discovered and resumed. To honor an
+explicit discard request, send `{"op":"finish","keep":false}`. Discard closes
+only tabs created during this session, never claimed tabs or tabs inherited by
+group resume.
+
+A repeated finish on the same open connection returns the terminal finish
+result and cannot restore execution. If the connection closes before finish is
+confirmed, the Runtime finalizes the task; do not start another controller or
+fallback browser merely to finish.

package/README.zh-CN.md

@@ -1,114 +0,0 @@
-# tabbit-browser for DeepSeek Harness
-
-[English](README.md) | **简体中文**
-
-![Tabbit Browser for DeepSeek Harness](tabbit-for-dsh.png?v=2)
-
-这是一个为 DeepSeek Harness（DSH）打造的插件。安装后，DSH 中的 Agent 获得控制 Tabbit 浏览器的能力：通过 `tabbit-cli`——Tabbit 浏览器自带的、任务隔离的 Playwright CLI——操作真实网页、复用真实登录态，完成网页自动化、信息提取、QA 与基准测试等任务。
-
-## 插件内容
-
-| 组件 | 说明 |
-| ---- | ---- |
-| `tabbit-browser` skill | 浏览器自动化工作指南：持久化任务空间、locator 与等待、截图、回执与恢复。随插件安装自动发现和加载，无需单独安装。模型通过 `skill({ name: "tabbit-browser" })` 或 `/tabbit-browser` 加载。 |
-| `tabbit_browser_install` 工具 | 环境预检：检测已安装的正式版 Tabbit、要求版本 ≥ `1.9.0`、检查 `tabbit-cli` 常驻运行时；未安装或版本过低时，创建 DSH 后台任务按地区下载对应安装包。 |
-| `tabbit_plugin_update` 工具 | 插件更新检查：每天至多一次对比本地插件版本与仓库发布的 CHANGELOG，离线失败时静默跳过，并可记录用户已拒绝的版本。存在新版本时，skill 会附带更新提示加载，展示新版本的新增功能。 |
-
-## 安装
-
-### 1. 检查并安装 DeepSeek Harness
-
-先检查本地是否已经安装 DSH：
-
-```sh
-dsh --version
-```
-
-如果命令能够正常输出版本号，直接进入下一步。如果提示找不到命令，请根据操作系统安装。
-
-#### macOS
-
-安装 Node.js 20 或更高版本，然后安装 DSH：
-
-```sh
-brew install node
-npm install -g @deepseek-ai/dsh
-```
-
-#### Windows
-
-在 PowerShell 中安装 Node.js LTS：
-
-```powershell
-winget install OpenJS.NodeJS.LTS
-```
-
-安装完成后重新打开 PowerShell，再安装 DSH：
-
-```powershell
-npm install -g @deepseek-ai/dsh
-```
-
-安装后再次运行 `dsh --version`，确认 DSH 可以正常使用。
-
-### 2. 安装 tabbit-browser 插件
-
-```sh
-dsh plugin --profile web add dsh-tabbit
-```
-
-这会安装 npm 包（预构建 tarball，走 CDN 分发）。如果无法访问 npm
-registry，可以回退到 GitHub 源：
-
-```sh
-dsh plugin --profile web add github:Tabbit-Browser/dsh-tabbit
-```
-
-### 3. 启动 DSH
-
-```sh
-dsh web
-```
-
-## 工作原理
-
-安装插件后，bundle 会自动加载 Skill Provider，模型可通过 `skill({ name: "tabbit-browser" })` 或 `/tabbit-browser` 加载说明。在任务中的第一次浏览器操作之前，skill 会先调用 `tabbit_browser_install` 做环境预检：
-
-- **`ready`** — 已安装 `1.9.0` 或更高版本的正式版 Tabbit 且运行时正在运行，Agent 继续通过 `tabbit-cli` 操作浏览器。
-- **`restart-required`** — 已安装的版本达标，但 `tabbit-cli` 常驻运行时未运行，提示用户重启一次 Tabbit 浏览器。
-- **`background`** — 未安装任何正式版，或版本低于 `1.9.0`；工具会创建 DSH 后台任务，读取系统地区（macOS 读取系统地区，Windows 调用系统地区 API），中国大陆下载国内正式版安装包，其他地区或无法识别地区时下载国际正式版安装包；自动选择对应的 Windows x64、macOS Apple Silicon 或 macOS Intel 包，保存到用户的 `Downloads` 目录，下载过程会输出进度，完成后 DSH 会通知安装包的绝对路径。
-
-环境检查还会：
-
-- 多个 Tabbit 实例同时运行时，仍判定 Runtime 可用；模型根据 CLI 提示设置 `TABBIT_PLAYWRIGHT_INSTANCE`，不会把实例选择歧义误报为 Runtime 未运行。
-- 诊断当前平台调用 CLI 所需的 DSH sandbox mode；Windows 返回 `cliSandboxMode: danger-full-access`，其他平台返回 `default`。
-- 按 Agent session 缓存成功的环境检查；仅在 Runtime/launcher 失败或安装变化后通过 `refresh: true` 主动失效并重新检查。
-
-## 前提
-
-- 需要 `1.9.0` 或更高版本的正式版 Tabbit 浏览器。国际版 `Tabbit` 和国内版 `Tabbit Browser` 均支持，安装任意一个即可；如果未安装或版本过低，插件会自动下载对应安装包。
-- 当前 DSH profile 已提供 `ctx.skills`、`ctx.tools`、`ctx.jobs` 以及对应模型工具。
-- `dsh-tool-jobs` 已为当前 Agent 提供后台任务控制和完成通知。
-- 当前 DSH profile 已提供运行在 Tabbit Browser 所在宿主机的 Bash/Shell 工具。
-- Shell 的执行环境可以访问 Browser-owned Runtime Service。
-- Windows 上 DSH 的 `read-only` 与 `workspace-write` 限制令牌无法写入 Runtime 命名管道。Skill 先正常执行 `tabbit-cli tasks` 连接探测；成功时完全不询问权限。仅当 Browser、launcher 和 Runtime 进程均已检测到但连接返回 `BROWSER_RUNTIME_UNAVAILABLE` 时，才要求用户把当前 DSH 会话切换到 Full Permission，并立即停止当前任务，不重试或继续浏览器操作。
-
-## 行为说明与限制
-
-- 中国大陆使用 `tabbit.com` 国内版下载源，其他地区使用 `tabbit.ai` 国际版下载源。
-- 后台下载会输出进度，完成后通知安装包的绝对路径，但不会自动打开 `.dmg` 或 `.exe`。
-- 不会检测开发版。
-- 不提供 `tabbit_browser_evaluate` 等原生浏览器工具。
-
-如果 DSH 的 Bash 运行在 E2B、远程容器或无法访问本机 GUI Browser 的沙箱中，本 Skill 不会使 Tabbit 自动化变得可用。
-
-## 开发验证
-
-```sh
-npm test
-npm pack --dry-run
-```
-
-## 许可证
-
-MIT