Everything is YAML with defaults; nothing security-relevant is a tool argument.

key	default	meaning
`engine.provider`	`patchright`	`patchright` · `cloakbrowser` · `cdp` (attach your own)
`engine.humanize`	`true`	bezier pointers, jittered keys, honest posture
`frames.source`	`screenshot`	`screenshot` · `screencast` · `dom`
`frames.maxFps`	`5`	capture cadence = detection surface; boost tightens only for playing video
`policy.approvalForSensitiveActions`	`true`	harness approval prompts for sensitive verbs
`policy.allowEvaluate`	`false`	arbitrary page JS is a config gate, not a model right

@dsh-community/dsh-browser

安装