dsh-ths-holdings

English | 中文

A floating position P&L card for the DeepSeek Harness (DSH) web GUI. It automatically syncs your real portfolio data from the Tonghuashun investment-ledger (同花顺投资账本) — no manual stock picking. Displays 今日盈亏 (today's P&L), 上证指数 (Shanghai Composite Index), and an intraday mini chart, all in the A-share red-up/green-down convention.

Unlike watchlist tools, this plugin reads your actual positions and shows your real profit & loss — both as a percentage and as a yuan amount — updating every 20 seconds.

Screenshots

Installation

Plugin 0.2.1 targets the DSH 0.2 series and has been tested with Desktop 0.2.0-rc.2, without a compatibility exemption. For DSH 0.1, keep plugin 0.2.0; this migration does not support the older host.

dsh plugin --profile web add dsh-ths-holdings

Installation is pnpm add inside your web profile: the package's dsh.bundle.patch is applied to the profile layer automatically. Then restart dsh web — a floating card appears at the bottom-right corner.

To install manually (without dsh plugin), edit $DSH_HOME/profiles/web/package.json:

{
  "dependencies": {
    "dsh-ths-holdings": "^0.2.1"
  },
  "dsh": {
    "profile": {
      "bundles": [
        // ...existing bundles,
        "dsh-ths-holdings"
      ]
    }
  }
}

then cd $DSH_HOME/profiles/web && pnpm install and restart dsh web. The plugin row itself comes from the package's cordis.patch.yml — you don't write it by hand.

Usage

Recommended — auto-acquire:

1. Open the DSH web GUI — click ⚙ on the card.
2. Click 🖥 自动获取 Cookie（推荐） — a system browser window opens (Edge / Chrome — the first installed one wins).
3. Sign in to the Tonghuashun investment ledger in that window (QR code / account).
4. When the sign-in succeeds the window closes itself, the Cookie is saved automatically, and the card refreshes with your portfolio.
5. The plugin auto-discovers your portfolio — if you have several, pick one from the dropdown. Done.

Auto-acquire uses a temporary browser profile and reads cookies through browser-level commands. It does not attach a page debugger, inject scripts, or emulate viewport dimensions. Only cookies for 10jqka.com.cn and its subdomains are saved; the temporary profile is deleted after the browser exits. You do not need to open developer tools during sign-in.

If closing the window times out, profile cleanup continues when the browser actually exits. Cleanup failures remain visible in settings with a retry button. Cookie saves wait up to 30 seconds; a timeout or cancellation closes the login window, but an already submitted storage operation may still complete. The card shows that the result is unconfirmed and blocks additional saves until that operation settles, preventing an older request from overwriting a newer Cookie.

Manual saves are unavailable while automatic login is starting or running; cancel automatic login and wait for it to end before saving manually. Pending writes continue to block new writes to the same credential reference after the plugin reloads within the same DSH process, until the old operation settles.

Manual (backup):

1. Open https://tzzb.10jqka.com.cn and log in.
2. Click the browser's top-right menu → More tools → Developer tools (… in Edge, ⋮ in Chrome). F12 may have no effect on this page; open the tools through the browser menu.
3. Keep developer tools open, select Network, then refresh the ledger page to record requests.
4. Select a page or ledger API request to tzzb.10jqka.com.cn. Under Headers → Request Headers, copy the complete Cookie value. Copy only the name=value; name2=value2 portion, without the Cookie: prefix; do not copy a response's Set-Cookie header.
5. Return to the DSH web GUI — click ⚙, paste the cookie into STOCK_PNL_COOKIE → save.
6. The card validates the saved cookie immediately — it shows ✓ valid or ✗ invalid (with the reason/hint).

If the page reports that developer tools are unsupported, first check whether Network has already recorded a ledger request with a Cookie header. If no usable Cookie is available, use auto-acquire above. Keep developer tools open while inspecting cookies manually.

The session cookie expires eventually — when it does, the card shows a Token 已过期 banner; re-open ⚙ and click auto-acquire (or repeat manual steps 1–5) with a fresh cookie.

💡 After completing a new trade, re-upload your data from the investment-ledger app to the web version so your holdings stay consistent between the two.

Features

• 📊 Real-time position P&L — polls every 20 s (configurable) from your actual portfolio
• ¥ / % toggle — show today's P&L as a yuan amount, a percentage, or both
• 📈 Intraday chart — mini polyline with a zero axis, red-up/green-down
• 🇨🇳 Shanghai Composite Index — displayed alongside your P&L
• 🔄 Auto-discovery — fund_key is discovered from the portfolio list; multi-account selection via dropdown
• 🖥 Auto-acquire Cookie — one click pops the Edge sign-in window; the cookie is saved automatically, no F12 needed
• ✓ Validate on save — the stored cookie is checked against the ledger right after paste or auto-acquire
• ↕ Draggable — drag the title bar vertically along the right edge (position persists in localStorage)
• ⚙ In-place settings — paste Cookie and select portfolio from the card itself
• 🔒 Credential-safe — the Cookie never leaves the host process

How it works

┌─────────────── Web browser ───────────────┐
│  lib/client.js (browser module)           │
│  · shell.overlay slot → floating card      │
│  · React + CSS Modules                     │
│  · config in localStorage                  │
│          │ fetch (same-origin)             │
└──────────┼─────────────────────────────────┘
           ▼
┌─────────────── DSH Host (lib/index.js) ───┐
│  cordis plugin: webServer routes          │
│  · GET /api/stock-pnl          snapshot    │
│  · GET /api/stock-pnl/portfolios  accounts │
│  · GET /api/stock-pnl/verify     cookie ok?│
│  · POST /api/stock-pnl/acquire*   sign-in │
│  resolves Cookie via ctx.credentials      │
│  auto-discovers user_id + fund_key        │
│  POSTs Tonghuashun ledger APIs            │
└───────────────────────────────────────────┘

The node half reads the login Cookie per request through the credential-reference seam (ctx.credentials). Manually pasted values are submitted to the host and never returned after saving; automatically acquired values stay on the host. Credential-bearing requests never follow a redirect.

Auto-acquire runs a host state machine (acquire.ts): open a system Edge / Chrome window, wait for a userid cookie, save ledger-domain cookies and close the window. login-browser.ts uses a dedicated pipe with browser-level commands, without opening a debugging port or enabling page Runtime / Debugger sessions. It does not read page contents; the user sees any site refusal directly. Cancellation, timeout, early closure and save failures are handled explicitly. Manual saves use the plugin's same-origin POST routes (/api/stock-pnl/cookie and /api/stock-pnl/fund-key), respect configured credential references, and no longer depend on DSH's legacy connection.api.credentials interface.

Config

Directory structure

dsh-ths-holdings/
├── src/
│   ├── index.ts            # node half: webServer routes + credential resolution
│   ├── fetch.ts            # Tonghuashun ledger API calls + auto-discovery + cookie verify
│   ├── acquire.ts          # cookie acquisition state machine
│   ├── login-browser.ts    # system browser launch and cookie access
│   ├── settings.ts         # write-only cookie / portfolio routes
│   └── client/
│       ├── index.ts        # browser half: shell.overlay registration
│       └── StockPnlCard.tsx
├── lib/                    # built artifacts (index.js + client.js)
├── cordis.patch.yml        # dsh.bundle patch layer
├── package.json            # dsh.bundle + dsh.client manifests
├── tests/                  # ledger / verify / acquire unit tests
└── README.md

FAQ / Troubleshooting

Model Experience

None — the card is a browser-side overlay over a host data route and registers nothing model-facing.

KV Cache effect

None — the plugin contributes no prompt, schema, or result.

Known Limitations

• The ledger API is an undocumented, login-gated endpoint — its response format can change and the Cookie expires; the plugin surfaces both as errors rather than retrying or caching.
• The portfolio list endpoint (account_list) requires the Cookie to be saved first — the portfolio selector appears after you paste a valid Cookie.
• Auto-acquire uses a system browser — no Playwright installation is needed. Edge or Chrome must be installed and the host must have a visible desktop session; otherwise use manual paste.
• No server-side polling — the route fetches on each request and the card polls at the configured pollMs interval; there is no shared cache or push channel.

Local validation

npm test, npm run typecheck, and npm run build run the regression suite, check types, and build the plugin. npm run test:browser opens an isolated browser against a local fixture to verify Cookie access and cleanup.

npm run test:desktop-compat uses an installed Desktop's real runtime with an isolated profile. It checks plugin admission, credential writes and reads, Cookie validation, portfolio selection, and P&L routes. Ledger responses come from a local fixture; no real account or existing DSH configuration is used. The default paths target a standard Windows installation; override them with DSH_DESKTOP_EXECUTABLE and DSH_DESKTOP_RESOURCES for other locations. Run the test script directly with --serve to keep it available for UI checks. Test directories live under dist/desktop-compat-*. Real ledger sign-in and holdings still require account-level verification.

License

MIT