dsh-ths-holdings
DSH 持仓盈亏悬浮卡片（同花顺投资账本）— 自动同步真实持仓数据，显示今日盈亏、上证指数和当日走势图，无需手动添加股票。Real portfolio holdings overlay for the DSH web GUI — automatically syncs your positions from the Tonghuashun investment-ledger API.
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-ths-holdings@0.1.7
Ths Holdings 以 dsh-ths-holdings 发布，当前版本为 0.1.7。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
A floating position P&L card for the DeepSeek Harness (DSH) web GUI. It automatically syncs your real portfolio data from the Tonghuashun investment-ledger (同花顺投资账本) — no manual stock picking. Displays 今日盈亏 (today's P&L), 上证指数 (Shanghai Composite Index), and an intraday mini chart, all in the A-share red-up/green-down convention.
Unlike watchlist tools, this plugin reads your actual positions and shows your real profit & loss — both as a percentage and as a yuan amount — updating every 20 seconds.
dsh plugin --profile web add dsh-ths-holdings
Installation is pnpm add inside your web profile: the package's dsh.bundle.patch is applied to the profile layer automatically. Then restart dsh web — a floating card appears at the bottom-right corner.
To install manually (without dsh plugin), edit $DSH_HOME/profiles/web/package.json:
{
"dependencies": {
"dsh-ths-holdings": "^0.1.0"
},
"dsh": {
"profile": {
"bundles": [
// ...existing bundles,
"dsh-ths-holdings"
]
}
}
}
then cd $DSH_HOME/profiles/web && pnpm install and restart dsh web. The plugin row itself comes from the package's cordis.patch.yml — you don't write it by hand.
Recommended — auto-acquire:
The auto-acquired Edge window ships anti-automation camouflage (hides
navigator.webdriver, disables the AutomationControlled Blink feature) to pass the Tonghuashun WAF. If a specific network/time still shows Nginx forbidden, pressF5in the popped window or open https://tzzb.10jqka.com.cn manually, then click 「我已登录，继续 →」 on the card; only10jqka-domain cookies are kept, never stored as raw plaintext.
Manual (backup):
copy(document.cookie)
The session cookie expires eventually — when it does, the card shows a Token 已过期 banner; re-open ⚙ and click auto-acquire (or repeat manual steps 1–4) with a fresh cookie (the v anti-bot token is handled automatically).
💡 After completing a new trade, re-upload your data from the investment-ledger app to the web version so your holdings stay consistent between the two.
fund_key is discovered from the portfolio list; multi-account selection via dropdown┌─────────────── Web browser ───────────────┐
│ lib/client.js (browser module) │
│ · shell.overlay slot → floating card │
│ · React + CSS Modules │
│ · config in localStorage │
│ │ fetch (same-origin) │
└──────────┼─────────────────────────────────┘
▼
┌─────────────── DSH Host (lib/index.js) ───┐
│ cordis plugin: webServer routes │
│ · GET /api/stock-pnl snapshot │
│ · GET /api/stock-pnl/portfolios accounts │
│ · GET /api/stock-pnl/verify cookie ok?│
│ · POST /api/stock-pnl/acquire* sign-in │
│ resolves Cookie via ctx.credentials │
│ auto-discovers user_id + fund_key │
│ POSTs Tonghuashun ledger APIs │
└───────────────────────────────────────────┘
The node half reads the login Cookie per request through the credential-reference seam (ctx.credentials) — it never reaches the browser. Credential-bearing requests never follow a redirect. The v anti-bot token is minted per request from the User-Agent; the stored Cookie only needs its session fields.
Auto-acquire runs an in-host state machine (acquire.ts): click the button → an anti-automation Edge window opens the ledger → once the sign-in is detected (userid cookie), the host collects that domain's cookies, commits them through the credential seam, and closes the window. Timeout, an early user window-close, or a WAF interception all surface as actionable notices on the card.
| Key | Default | Meaning |
|---|---|---|
cookieEnv | STOCK_PNL_COOKIE | Credential reference holding the ledger Cookie. |
fundKeyEnv | STOCK_PNL_FUND_KEY | Credential reference holding the ledger fund key (saved from the card's ⚙ form). |
user_id | the Cookie's userid | The ledger user id, included in every form payload; an empty value falls back to the Cookie's own userid. |
fund_key | auto-discovered | The ledger fund key selecting the managed portfolio; overridden by the fundKeyEnv credential when set, auto-discovered from the account list when empty. |
pnlUrl | Tonghuashun time_share endpoint | P&L endpoint override (tests point at a scripted server). |
indexUrl | Tonghuashun getQuotes endpoint | Index endpoint override (tests point at a scripted server). |
pollMs | 20000 | Poll interval (ms) the card uses; reported to the browser in each response's poll_ms. |
dsh-ths-holdings/
├── src/
│ ├── index.ts # node half: webServer routes + credential resolution
│ ├── fetch.ts # Tonghuashun ledger API calls + auto-discovery + cookie verify
│ ├── acquire.ts # auto-acquire cookie (playwright-core drives Edge)
│ └── client/
│ ├── index.ts # browser half: shell.overlay registration
│ └── StockPnlCard.tsx
├── lib/ # built artifacts (index.js + client.js)
├── cordis.patch.yml # dsh.bundle patch layer
├── package.json # dsh.bundle + dsh.client manifests
├── tests/ # ledger / verify / acquire unit tests
└── README.md
| Symptom | Cause & fix |
|---|---|
Card shows 请配置 Cookie | STOCK_PNL_COOKIE is empty — click auto-acquire in the ⚙ panel, or paste manually. |
Card shows Token 已过期 | The session Cookie expired — click auto-acquire in the ⚙ panel to re-sign-in, or re-run copy(document.cookie) and paste. |
| Auto-acquire reports missing playwright-core | playwright-core did not ship with the install (typically a legacy install or a manually pruned dependency tree) — re-pnpm add dsh-ths-holdings (or npm i playwright-core), restart dsh web, retry. |
Popped window shows Nginx forbidden | The Tonghuashun WAF intermittently refuses automation — F5 in the window or open the ledger URL manually, then click 「我已登录，继续 →」. |
| No portfolio in the dropdown | The account list needs a valid Cookie first; save the Cookie, then click ↻ to refresh. |
| Multiple portfolios | Select the one you want from the dropdown — the choice is saved as STOCK_PNL_FUND_KEY. |
| Cookie pasted with line breaks | The plugin strips whitespace on save, so wrapped lines are fine. |
None — the card is a browser-side overlay over a host data route and registers nothing model-facing.
None — the plugin contributes no prompt, schema, or result.
account_list) requires the Cookie to be saved first — the portfolio selector appears after you paste a valid Cookie.pollMs interval; there is no shared cache or push channel.