dsh-industry-research

---

Research only, not investment advice. This pack does research support only: no trading, no price prediction, no paid/login-walled sources.

⭐ 如果它帮到了你

这个插件是 DSH 插件家族的一员（40+ 个，全部 Apache-2.0）。如果你在用，给个 star —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。

English: part of a 40+ plugin family for DeepSeek Harness. If it is useful, a star helps the next person find it — nothing is gated behind it.

Compatibility

• DeepSeek Harness dsh-v0.1.7-rc.2 (published npm line, verified 2026-09-25; peers >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0). 0.1.2-rc.1 (adapted 2026-09-02): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. Verified 2026-09-24 against the 0.1.7-rc.2 published peers (full gate chain; the real profile install smoke runs in the weekly and per-PR compat.yml job).
• Node ^22.19.0 || >=24.0.0, ESM only ("type": "module").
• Peer dependencies: @deepseek-ai/cordis ^4.0.2, @deepseek-ai/schemastery ^3.18.2, and @deepseek-ai/dsh-tools, @deepseek-ai/dsh-skill, @deepseek-ai/dsh-skill-filesystem at >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 (all composed by the official dsh-base bundle).
• Optional, looked up at execution time (never injected): ctx.web (public-source retrieval — composed by dsh-base) and ctx.researchReport (the sibling dsh-research-report sealing engine).

What you get

• industry_map — build or update an industry chain map (chain.json): upstream/midstream/downstream nodes, edges, and metric slots. A metric with a value must carry a sourceRef; a value-less slot is an explicit gap. Node status assertions carry a statusAsOf, and an optional taxonomyCode must hit the built-in 国民经济行业分类 大类 table. With renderSvg: true it also writes a deterministic, tier-layered chain.svg network diagram with funnel/hub bottleneck highlighting. A depth argument scales the web assist (quick/standard/comprehensive). Seed notes/files and an optional ctx.web digest are registered as citable sources (S1, S2, …).
• industry_track — public-source policy/news tracking over the official ctx.web seam: per-topic search, host allow/block lists, since filtering, bounded snapshot fetches with SHA-256 provenance hashes, and append + dedupe into timeline.jsonl with a retention cap. Entries may carry a validated evidenceCategory; a depth argument scales source counts. Fails loud when the web capability is unreachable.
• company_scan — company cards (card.json + card.md) from your workspace data files (SHA-256-hashed, with Markdown outlines and figure-candidate lines so every number cites a file and a line), plus an optional ctx.web citation complement. Cards carry a listing status (with statusAsOf), a format-checked ticker, and sourced price/value metrics (each with source + asOf). Batch mode (companies) isolates one bad company without aborting the batch; depth scales the web complement. Text formats only in v1 (no PDF).
• industry_report — one auditable report from the map + timeline + cards. Before producing, a deterministic delivery contract checks blocks, status/price assertions, and placeholder residue (fail loud, no half-assembled report). Timeline entries are grouped by evidenceCategory. A deterministic bull/bear (正反方) synthesis lists sourced, dated values against declared gaps and data-quality findings, is embedded as the report's multi-perspective section, and is forked as a subagent job writing perspectives-note.md into the version ledger. With a mounted ctx.researchReport engine the evidence/sections/claims are sealed by its assemble and per-claim verdicts come back; without one, the builtin fallback writes versioned reports/<YYYYMMDD-HHmmss>/report.md + manifest.json with a SHA-256 source-traceability table and honestly labels engine: 'builtin-fallback'.
• Artifact version ledger — industry_map / company_scan / industry_report append to versions.jsonl (root-relative path + SHA-256 + timestamp + change type) on every artifact write; reads verify the hash and fail loud on mismatch.
• Two methodology skills — industry-research-method (chain decomposition, supply/demand framework, sourcing discipline, gap-declaration discipline) and company-research-method (company framework, public-source list, compliance wording).
• Typed Cordis events — industry-research/map, industry-research/track, industry-research/report emitted after each committed artifact.

Quick start

git channel

# From a scratch profile (pins the commit; runs the self-contained `prepare` build)
dsh plugin --profile demo add "github:PerryLink/dsh-industry-research#<sha>"
# The profile's pnpm-workspace.yaml gains an allowBuilds entry for dsh-industry-research on first add.

npm channel

dsh plugin --profile demo add dsh-industry-research

Both channels install the bundle row (see cordis.patch.yml) into the profile's dsh.profile.bundles stack and take effect on restart.

Then, in a session:

加载 industry-research-method 技能，然后研究白酒行业：
先 industry_map 建产业链图，再 industry_track 跟踪政策，最后 industry_report 出报告。

Install & uninstall

dsh plugin --profile demo add dsh-industry-research       # install
dsh plugin --profile demo remove dsh-industry-research    # uninstall

Verify the row mounts: dsh --profile demo --dump-config | grep dsh-industry-research.

Configuration

All tunables are Schemastery Config fields; invalid values fail the profile load loudly.

Key	Default	Description
enabled	true	Master switch; false mounts nothing.
industryRoot	industry-research	Artifact root, relative to the session workspace (or absolute).
fetchTimeoutMs	20000	Per-request timeout (ms) for ctx.web search/fetch calls.
timelineMaxEntries	500	Entries retained per industry timeline.jsonl (oldest dropped).
sourceAllowlist	[]	Host allowlist for tracked sources (empty = all hosts).
sourceBlocklist	[]	Host blocklist for tracked sources (wins over the allowlist).
offline	false	Offline mode: never touch ctx.web; local workspace data only.
skillsDir	(unset)	Explicit skills root override; defaults to the packaged skills/.
track.maxResultsPerTopic	10	web_search maxResults per topic.
track.maxFetchesPerCall	10	Snapshot-fetch budget per industry_track call.
scan.maxFileBytes	1048576	Per-file read cap for company data files.
scan.maxFigureCandidates	100	Figure-candidate budget per company scan.
scan.strictTicker	true	Company-card tickers must match a built-in format (A-share 6 digits, US 1–5 letters, HK 1–5 digits); false exempts the format check.

Tools & surfaces

industry_map({ industry, seed?, seedFiles?, web?, chain?, renderSvg?, depth? })

Called with chain: validates (dangling edges, unsourced values, illegal tiers, duplicate ids, status/statusAsOf, unknown taxonomyCode — loud failure with the full issue list) and persists chain.json, then lists the explicit gap slots and bottleneck nodes. Called without chain: returns the current map, the registered sources, and an optional ctx.web chain-structure digest so the model can iterate. With renderSvg: true it also writes a deterministic chain.svg. depth (quick/standard/comprehensive) scales the web assist. Returns a delta summary vs the previous research-state.json. Emits industry-research/map.

industry_track({ industry, topics?, since?, depth?, evidenceCategory? })

Searches each topic through ctx.web, filters by the allow/block lists and since, fetches page snapshots (SHA-256) within the call budget, and merges into timeline.jsonl (dedupe by normalized URL, capped). depth scales the source/fetch budget; evidenceCategory labels every appended entry and is validated against the six-category enum. Sources whose snapshot failed are kept as citation-only entries with the reason in note. Returns a delta summary vs the previous research-state.json. Fails loud naming the missing capability when ctx.web is unmounted or offline: true. Emits industry-research/track.

company_scan({ name | companies, dataFiles?, web?, status?, statusAsOf?, ticker?, metrics?, depth?, parallel? })

Reads the workspace data files (.md/.txt/.csv/.tsv/.json; v1 does not parse PDF), hashes them, extracts Markdown outlines and figure-candidate lines, optionally attaches ctx.web citations, and persists the card. A status requires a non-future statusAsOf; a ticker must match a built-in format unless scan.strictTicker: false; every metrics value must carry source + asOf. companies (batch) isolates one bad company without aborting the batch; parallel: true fans each company into an independent job when ctx.jobs is mounted (otherwise it falls back to sequential, reported in the result mode). Rejected files come back with reasons; everything the card cannot establish is an explicit gap.

industry_report({ industry, sections?, companies?, draft? })

Assembles evidence (E-chain, E-timeline, E-company-<slug>), verifies the read artifacts against versions.jsonl (hash mismatch fails loud), and either validates your draft (sections + claims; every claim's evidenceIds must reference registered evidence) or builds the mechanical auto-draft (sourced metrics and recent timeline entries become claims, grouped by evidenceCategory). A deterministic delivery contract runs before production and fails loud on any missing block, placeholder, or unsourced/undated assertion. A deterministic adversarial machine-check always runs, and a red-team review job (red-review-note.md) is spawned when ctx.jobs is mounted (else review: skipped(jobs unavailable)). A deterministic bull/bear (正反方) synthesis embeds a multi-perspective section in the report and forks a debate job (perspectives-note.md) when ctx.jobs is mounted. Engine path: sealed directory + sealHash + per-claim verdicts. Fallback path: versioned Markdown + manifest, claims honestly marked unverified. Emits industry-research/report.

Skills

• industry-research-method — industry research methodology: upstream/midstream/downstream decomposition, supply/demand framework, sourcing discipline (every number: value + unit + source + asOf), and gap-declaration discipline (declare, never fabricate).
• company-research-method — company research methodology: the business-structure / financials / risks card framework, the public-source priority list (company disclosures → regulators → authoritative media), and compliance wording.

Both load on demand through the standard skill tool (加载 industry-research-method 技能).

Data layout

<workspace>/<industryRoot>/versions.jsonl              artifact version ledger (SHA-256 + timestamp + change)
<workspace>/<industryRoot>/<industry>/research-state.json  research-state memory
<workspace>/<industryRoot>/<industry>/chain.json      industry_map
<workspace>/<industryRoot>/<industry>/chain.svg       industry_map (renderSvg: true)
<workspace>/<industryRoot>/<industry>/timeline.jsonl  industry_track
<workspace>/<industryRoot>/<industry>/sources.json    citable source registry (S1, S2, …)
<workspace>/<industryRoot>/<industry>/notes/          seed notes
<workspace>/<industryRoot>/<industry>/red-review-note.md  industry_report (red-team review, jobs)
<workspace>/<industryRoot>/<industry>/perspectives-note.md  industry_report (bull/bear debate, jobs)
<workspace>/<industryRoot>/<industry>/reports/<ts>/   industry_report (report.md + manifest.json)
<workspace>/<industryRoot>/companies/<name>/card.*    company_scan

Permissions & data

dsh-industry-research consumes only public seams: ctx.tools, ctx.skills, and — looked up optionally — ctx.web and ctx.researchReport. It performs no network access of its own (all retrieval goes through ctx.web with the deployment's provider selection and your configured timeouts), stores no credentials, and writes only inside the session workspace under industryRoot. Only public sources are used; paid or login-walled sources are out of scope — pass your own exports in as dataFiles.

Security boundaries

• Workspace containment — industry/company names are validated path segments; data files are containment-checked against the session cwd (both sides resolved).
• Provenance by construction — sources carry SHA-256 hashes; unsourced numbers are validation errors; corrupt timeline lines are skipped with a surfaced count, never silently.
• Honest degradation — missing ctx.web / ctx.researchReport produce loud failures or honestly labeled fallback artifacts, never silent fabrication.
• Reversible registrations — everything goes through ctx.effect() / ctx.on() / register().
• Research-only compliance — tool descriptions, cards, and reports carry 「仅供研究，不构成投资建议」; data points carry asOf and sources.

Known limitations

• Cordis events, not session-log events — industry-research/* events are typed Cordis observability events and are never appended to the session log; the durable record is the workspace artifacts themselves, and model-visible tool results ride the durable tool/result session event.
• No ctx.attachment writes — the rc2 attachment seam accepts images only (PNG/JPEG/WebP/GIF); Markdown reports therefore stay versioned workspace files, referenced by absolute path in the tool result.
• v1 reads text formats only — no PDF parsing; ask users to convert PDFs to text/Markdown first.
• Chinese-edition skills — the packaged methodology skills ship in Chinese; an English edition is future work.
• Foreground tools — industry_track is bounded by track.maxFetchesPerCall and fetchTimeoutMs and runs in the foreground; a background-jobs mode is future work.
• The auto-draft is mechanical — it summarizes artifacts and turns sourced data points into claims; narrative quality comes from model-authored drafts.

Development

pnpm install
pnpm run typecheck && pnpm run typecheck:ci
pnpm test
pnpm run build
pnpm run verify:self-contained && pnpm run verify:artifacts
pnpm run verify:readme-sync
pnpm run verify:skills
pnpm run pack:check

Topics

dsh, dsh-plugin, deepseek-harness, cordis, industry-research, company-research, research, report

Contributors

• Initial design and implementation by the dsh-industry-research development session (DeepSeek Harness).

External contributions are welcome — open an issue or a pull request.

Applicable DSH version: verified against dsh-v0.1.7-rc.2 (the host release this build targets); requires >=0.1.7-alpha.1 <0.2.0.

PerryLink DSH Plugin Family

This project is one of the 45 DeepSeek Harness plugins maintained by PerryLink. If this one helps you, the others likely will too:

Plugin	One-liner
dsh-auto-review	Second-model auto-review on the approval chain, fail-closed by default
dsh-autotier	Automatic strong/cheap model-tier routing with deterministic risk guards and a /tier command
dsh-background-agents	Durable background child agents with a Web UI sidebar, messaging and interrupt
dsh-budget	Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel.
dsh-catalog	DSH Desktop Market standard catalog source for the PerryLink family
dsh-cert-mcp	Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence
dsh-checkpoint-rewind	Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore
dsh-claude-move	Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH
dsh-click	Cross-platform native desktop control for DeepSeek Harness — Windows first.
dsh-composer-history	Terminal-style input history for the web composer: arrows, Ctrl+R search
dsh-data-quality	Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here)
dsh-defend	Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness.
dsh-doublecheck	Engineering-discipline guard: requirements grill, test gates, adversary review
dsh-draw	Unified static-image generation routing for DeepSeek Harness.
dsh-fast	Read-only performance diagnostics for DeepSeek Harness.
dsh-fund-research	Deterministic research reports for Chinese public mutual funds
dsh-github	GitHub PR/issues integration for DSH, every write gated by approval
dsh-industry-research	Industry research orchestration that seals its deliverables through this plugin's ctx.researchReport.assemble
dsh-laya	Laya typed decisions (noul/choice/score) as a first-class Cordis service and model-visible tools
dsh-library	Local document knowledge base for DeepSeek Harness.
dsh-local-ai	Local-model (Ollama) integration for DeepSeek Harness.
dsh-lsp-actions	LSP diagnostics, formatting, completion, code actions and rename over language servers
dsh-mask	PII masking middleware: anonymize at the model boundary, restore at the display layer
dsh-mcp-panel	Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors
dsh-memento	Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool
dsh-observe	OpenTelemetry and Langfuse observability exporter for DeepSeek Harness.
dsh-output-styles	Claude Code outputStyles-equivalent runtime style switching
dsh-permission-rules	Claude Code-style declarative allow/deny/ask permission rules with audit
dsh-plugin-certification	Community certification registry with repro-checkable grades and badges
dsh-plugin-doctor	Zero-dependency static + sandbox smoke detector for DSH plugins
dsh-plugin-guide	Plugin-development knowledge base as an on-demand agent skill
dsh-plugin-kit	Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins
dsh-plugin-upgrade	One-package, one-corridor-index plugin upgrade skill: routes a repository to the matching closed corridor card
dsh-plugin-upgrade-015	Merged 0.1.3-alpha.1 → 0.1.5-rc.1 upgrade corridor card plus a zero-dependency seam scanner
dsh-reach	Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console
dsh-research-report	Verifiable research-report engine: content-addressed evidence ledger and sealed versions
dsh-score	Multi-dimensional quality scoring for DeepSeek Harness plugins.
dsh-session-pin	Pin sessions in the Web sidebar with durable ordering
dsh-session-sync	Cross-device session sync for DeepSeek Harness — a dedicated git mirror of your session store.
dsh-skill-pack-security	Security-audit skill pack: secret scan, dependency and supply-chain review
dsh-talk	Voice-first session loop for DeepSeek Harness: talk to it, hear it answer.
dsh-team-rooms	Cross-session team rooms: shared message bus, task board and timeline
dsh-test-drive	Isolated install-and-smoke test drives for DeepSeek Harness plugins.
dsh-ticktick	TickTick/Dida365 task bridge: session-header panel + 11 tools
dsh-translate	Vendor parameter translation and deterministic JSON repair for DeepSeek Harness.

Install from the DSH Desktop Market

All PerryLink plugins are browsable in the built-in DSH Desktop Market: Market → Sources → add source → paste https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json → select it. Installation still goes through the Market's npm-identity verification and your confirmation.

License

Apache-2.0 — see LICENSE.