dsh-plugin-diepi

dsh-plugin-diepi is an independently maintained community DSH plugin: users express daily-bar stock or ETF strategies in natural language, DSH handles the conversation and orchestration, diepi-mcp provides a constrained tool protocol, and diePi handles data validation, causality boundaries, matching, bookkeeping, and immutable result artifacts.

自然语言
  -> DSH + diepi-quant-research Skill
  -> StrategySpec v1（结构化、可预览、拒绝任意代码）
  -> diepi-mcp（MCP stdio、作业队列、证据绑定）
  -> 独立 diePi 子进程
  -> 已验证的 RunArtifact / ResultContract

The current version is a Developer Preview: the Python package is diepi-mcp 0.1.0a1, and the npm bundle is dsh-plugin-diepi 0.1.0-alpha.1. This project is not an official DeepSeek project and does not represent any official endorsement.

What it can do

• Daily bars, cash accounts, single A-share or ETF.

• StrategySpec v1 / ma_crossover: strict crossover of fast and slow moving averages, with an optional turnover amplification filter.

• Pre-market decisions only read complete daily bars up to T-1; orders are matched at the earliest at the T-day open.

• Supports raw_only, adjusted_only, and strictly aligned dual data.

• Backtests are queued asynchronously; submission_id keeps retries idempotent under unknown timeouts.

• Data sources, trading calendars, strategy templates, execution parameters, and final artifacts are bound layer by layer.

• The DSH bundle automatically mounts eight constrained MCP tools and the diepi-quant-research Skill.

Arbitrary Python, minute-level strategy protocols, shorting, leverage, futures, live trading, broker credentials, built-in market data downloads, parameter optimizers, and GUIs are not supported. Models cannot pass paths, commands, SQL, or Python source code through this plugin.

Related MCP server: OpenFinClaw CLI

Five-minute synthetic experience

The first experience does not read real market data from this repository or the diePi repository. diepi-mcp init-config exclusively claims a brand-new adapter home outside the DSH workspace and invokes the same deterministic demo generator from diePi to produce fictional prices, volumes, trading days, and security labels; this data is only used to verify installation and protocol wiring.

Requirements:

• Python 3.10+;

• Node.js ^22.19.0 || >=24.0.0;

• pnpm 11.7.x, with pnpm on PATH;

• DSH 0.1.0-rc.7 (primary support) or 0.1.0-rc.8 (canary).

First install the Python Alpha after the coordinated release, and create a new host-owned root. adapter-home-alpha1 must not already exist:

$hostRoot = Join-Path $env:LOCALAPPDATA "diepi-mcp-host"
$adapterHome = Join-Path $hostRoot "adapter-home-alpha1"
New-Item -ItemType Directory -Force -Path $hostRoot | Out-Null

python -m venv (Join-Path $hostRoot "venv")
$experiencePython = Join-Path $hostRoot "venv\Scripts\python.exe"
$mcpCommand = Join-Path $hostRoot "venv\Scripts\diepi-mcp.exe"

& $experiencePython -m pip install "diepi-mcp==0.1.0a1"
& $mcpCommand init-config --target $adapterHome

$env:DIEPI_MCP_COMMAND = (Resolve-Path $mcpCommand).Path
$env:DIEPI_MCP_CONFIG = (Resolve-Path (Join-Path $adapterHome "diepi-mcp.json")).Path
& $env:DIEPI_MCP_COMMAND --check-config

The init command refuses to overwrite, merge, or reuse an existing target. It first creates the target and the .diepi-mcp-incomplete marker exclusively, then writes the staged payload with exclusive-create, and only then commits diepi-mcp.json and removes the marker. On failure, an incomplete directory with no usable configuration is left behind; it never deletes or takes over a racing target. Use a new directory instead, or have the host owner inspect the contents and clean up manually. The generated configuration contains only relative paths; state, results, and synthetic data all stay in the adapter home and never enter the Agent workspace or Git repository. examples/config.example.json is only a schema reference and does not need to be copied by hand. In production, file permissions should also make market data read-only for the Agent, which must not be able to write the config, MCP environment, state, or results roots.

DSH plugin management invokes bare pnpm. When Node ships with Corepack, you can pin the DSH-used version:

corepack enable
corepack prepare pnpm@11.7.0 --activate
pnpm --version

If the current Node does not include corepack, install it first per the official Corepack/pnpm instructions, then continue. Install into the web profile, not into an arbitrary custom profile that only contains the base bundle:

dsh plugin --profile web add dsh-plugin-diepi@0.1.0-alpha.1
dsh --profile web --dump-config
dsh web --no-open

Plugin membership changes only take effect for new DSH processes. To use headless:

dsh plugin --profile headless add dsh-plugin-diepi@0.1.0-alpha.1
dsh --profile headless --dump-config
dsh --profile headless

When checking out the test bundle from this repository, replace the package name with ./dsh at the repository root. Do not install the npm package directly from the Git repository root URL; the npm package lives in the dsh/ subdirectory.

On activation, the bundle requires both DIEPI_MCP_COMMAND and DIEPI_MCP_CONFIG to be explicit absolute paths. It does not fall back to an executable with the same name on PATH, nor does it guess the config location. The MCP subprocess working directory is fixed to the host-owned config directory, not the Agent workspace.

From natural language to backtest

For example:

Use 510300.SH daily bars, go full position when the 5-day line crosses above the 20-day line, and clear the position on a death cross; backtest 2024.

The Agent first generates a reviewable StrategySpec v1, then calls in order:

1. capabilities

2. preview_strategy

3. validate_data

4. start_backtest with a new submission_id starting with req_

5. job_status, and cancel_job if necessary

6. get_result

On an MCP timeout or transport interruption, retry with exactly the same parameters and the same submission_id. Results may only be compared when all of the following conditions hold:

artifact_verified == true
adapter_attribution_verified == true
result_committed == true
result_status == SUCCESS
rankable == true

Own market data and the Tushare Skill

The minimal input is raw daily bars conforming to diePi market_data_v1; the best input is a fully aligned three-track set of raw, HFQ, and original adjustment factors. The fact that an upstream interface calls the data hfq does not prove it satisfies diePi's factor identity; the diePi validator is the final authority.

The plugin ships no connectors, carries no real market data, stores no tokens, and does not auto-install external Skills. When data is missing, the Agent can guide the user to the independently installed Tushare official Skill. We only record a reviewed upstream commit as a manual handoff reference; installation, network permissions, credentials, vendor terms, and update decisions are all controlled by the user. See the Tushare handoff for detailed rules.

External Skills are only responsible for writing data into a new staging root. The host owner must validate it outside the session, register it as an opaque dataset_id, freeze the data root, and restart MCP; a single Agent session cannot skip this boundary.

Versioning and compatibility strategy

• diepi-mcp==0.1.0a1 depends exactly on diepi==0.1.1. This is intentional: the adapter currently depends on diePi's cancellation callbacks, source evidence, calendar identity, and atomic artifact semantics, and a broad 0.1.x range cannot prove compatibility.

• DSH rc.7 is the Alpha primary support version; rc.8 is the forward-looking canary. Both are still Developer Preview; rc.8 testing should use a separate DSH_HOME and must not reuse rc.7 session state.

• The harness ships @deepseek-ai/dsh-mcp-client and @deepseek-ai/dsh-skill-filesystem; this bundle does not carry them again.

The hard gate for release order is to first make diepi==0.1.1 installable from the coordinated Python index; plugin CI should fail before that rather than loosening the pin. Subsequent release gates verify the SHA-256 of download candidates, install the sdist in a clean environment, and install the wheel and the packaged npm tgz across the Windows/Ubuntu, Node 22/24, web/headless, and DSH rc.7/rc.8 grid. Each cell runs a direct MCP/adapter synthetic smoke on the wheel and also really starts DSH, strictly discovering the eight mcp__diepi__* tools after the Loader settles and calling capabilities. This model-free key probe does not claim coverage of cancellation through DSH, crash reconnects, or real model effects; those boundaries are covered by source tests or separately documented manual release verification.

Security boundary

MCP stdio is a host process, not inside the Agent file sandbox. Config, executables, data roots, state, and results must be controlled by the host owner. Hash proofs establish identity consistency between artifacts, but cannot turn an Agent-writable directory into a trusted evidence root, nor prove that market data is real, that legal authorization was obtained, or that there is no survivorship bias.

See SECURITY.md for the detailed threat model and the private vulnerability reporting entry point.

Development

python -m venv .venv
.\.venv\Scripts\python.exe -m pip install ".[dev]"
.\.venv\Scripts\python.exe -m pytest -m "not integration"
.\.venv\Scripts\ruff.exe check src tests
.\.venv\Scripts\python.exe -m build
.\.venv\Scripts\python.exe -m twine check dist\*

Push-Location dsh
npm pack --dry-run
Pop-Location

Contribution rules are in CONTRIBUTING.md, and version changes are in CHANGELOG.md.

Disclaimer and license

This project is intended only for software engineering validation, quantitative research, and historical backtesting. Output does not constitute investment advice, a trading offer, an earnings guarantee, or broker services; backtests may be affected by data quality, survivorship bias, adjustment, matching assumptions, fees, slippage, and overfitting. Users are responsible for data sources, vendor licenses, model usage, and investment decisions.

Apache-2.0, see LICENSE. Third-party relationships are in THIRD_PARTY_NOTICES.md. The relevant names and marks of DeepSeek, DeepSeek Harness, and DSH belong to their respective owners; this project has no affiliation with or endorsement from them.