zhu1090093659/dsh-trading

What it claims

dsh-trading is a set of plugin packages for DeepSeek Harness (DSH) that turn it into a browser trading terminal with an embedded agent. The layout is a watchlist on the left, a chart in the centre and the agent on the right. It claims "nineteen-plus connectors" across four markets, keeps all API keys local (BYOK), and gates every order behind dry-run defaults and human approval. It is licensed PolyForm Noncommercial 1.0.0: free for personal study, research and noncommercial use. Commercial use requires prior written authorization from the author (chunlinzhu666@gmail.com or a GitHub issue).

How it works

The code is split into npm packages on a Cordis microkernel:

• @dshtrading/base holds the account, order and quote contracts, the approval gate and the GUI shell.
• @dshtrading/crypto: Binance, OKX, Bybit, CCXT.
• @dshtrading/us: Yahoo, Alpaca, FMP, Finnhub, Polygon, IBKR.
• @dshtrading/cn: Tencent, Eastmoney, Tushare, AkShare, MiniQMT.
• @dshtrading/hk: Tencent HK, Longbridge, Futu, Tiger.

Each market package also ships its own skills and agent preset. Under Settings → Trading you can route any market to any installed provider without restarting. Agent sessions pick up the change on their next turn.

The agent roles have these constraints, which the summary does not cover:

• Subagents never execute. They return analysis text only. Only the master places orders, and only behind the gate.
• The researcher and risk-reviewer cannot trade. They keep read-only quotes and candles but mount no order or cancel connectors.
• Role scoping is not a security sandbox. Subagents inherit the session toolset and shared host tools stay visible. A persona pins each role's duties but does not isolate it.
• The trading journal is append-only. It tracks "what the agent did" separately from "what you did".

Order flow:

flowchart TD
  A[Order/cancel tool call] --> B{liveTrading: true?}
  B -- no --> C[Dry-run simulation]
  B -- yes --> D{Interactive session?}
  D -- no, headless --> E[Fail closed]
  D -- yes --> F{Human approves?}
  F -- yes --> G[Live routing to broker]
  F -- no --> E

Dry-run simulation is separate from exchange or broker paper trading. Paper trading is optional and only available through supported connectors.

How to use it

Requirements: Node ^22.19.0 || >=24.0.0 and pnpm 11. dsh-trading runs in its own DSH home (~/.dsh-trading) so it does not mix with ~/.dsh.

export DSH_HOME=~/.dsh-trading
dsh plugin --profile trading-web add @dshtrading/base @dshtrading/crypto @dshtrading/us
# …or all four markets
dsh plugin --profile trading-web add @dshtrading/base @dshtrading/crypto @dshtrading/us @dshtrading/cn @dshtrading/hk
# Serve the browser UI in this profile (once): add the in-box web host layer
# right after the dsh core layer in the profile manifest
node -e "const f=(process.env.DSH_HOME||require('os').homedir()+'/.dsh')+'/profiles/trading-web/package.json',fs=require('fs'),m=JSON.parse(fs.readFileSync(f,'utf8'));m.dsh.profile.bundles.includes('@deepseek-ai/dsh-web-app')||m.dsh.profile.bundles.splice(1,0,'@deepseek-ai/dsh-web-app');fs.writeFileSync(f,JSON.stringify(m,null,2)+'\n')"

To launch from a repository checkout:

cp scripts/home/dsh-trading ~/.local/bin/ && chmod +x ~/.local/bin/dsh-trading
dsh-trading --profile trading-web        # serves on port 8888 by default

To launch from an npm-only install:

DSH_HOME=~/.dsh-trading dsh --profile trading-web --port 8888

To build from source:

pnpm install && pnpm build && pnpm test
./scripts/refresh-trading-web-profile.sh

To make an order live, set liveTrading: true. Each live order still needs interactive approval. The full run, profile and refresh contract is in docs/running.md.

Limits

• Commercial use is prohibited without written authorization.
• Credentials and costs vary by provider. Coverage, trading support, credentials and local gateway requirements differ per connector. Some public data needs no key, but authenticated data, broker accounts and the LLM provider may require their own keys and fees.
• Role isolation is not enforced. The README itself states that role scoping is not a security boundary.
• Backtests carry the usual caveat. The page says past performance does not predict future returns and the tool is not investment advice. It reports no performance results.
• Upgrades move some presets. Unmodified managed legacy presets are moved to a .legacy-backup sibling directory. Custom presets are left untouched.