ee3d3da1c5
* fix: redact short credentials in CLI diagnostics
* fix(review-feedback-2111): Redact indented values under empty sensitive YAML fields and preserve
* fix: close structured diagnostic redaction gaps
* fix(review-feedback-2111): Treat comment-only YAML values as empty blocks and Redact indentless
* fix: redact YAML node property blocks
* fix: redact normalized proxy authorization fields
* fix: close multiline diagnostic redaction gaps
* fix: redact spaced credential labels
* fix(review-feedback-2111): Consume YAML blocks with node properties
* fix: include registered spaced credential labels
* fix: close remaining structured redaction gaps
* fix: redact shell words and explicit YAML mappings
* fix: redact single-quoted structured keys
* fix: redact shell append assignments
* fix: redact quoted YAML explicit keys
* fix(review-feedback-2111): add suffix text or drop segments from the env name, such as DeepSeek
* fix(review-feedback-2111): trimming the new docs/CHANGELOG
* fix(review-feedback-2111): update the PR description's verification counts/ranges to match the
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：基于
* fix(review-feedback-2111): 补上 helper 级和 non-zero-exit preview 级回归用例，避免文档与运行时行为再次漂移
* fix(review-feedback-2111): add focused helper-level and non-zero-exit preview regressions for
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：On the current
* fix(review-feedback-2111): update the PR description's reported current head from 27a013fbf to
* fix: redact sensitive env names embedded inside command substitutions across multi-segment diagnostics
- 覆盖 OPENAI_API_KEY=sk-12345 这种首段为非敏感赋值、值里又嵌敏感名的情况
- 当 $(...) 的前置赋值是敏感名时跳过尾扫避免双重改写，非敏感名仍需进入尾扫
- 新增测试覆盖多段 + 同函数敏感+非敏感赋值的复合诊断文本
- 使用 [A-Z][A-Z0-9_]* token 扫描找到 ALL 中的敏感 env 名引用
* fix(review-2111): redact export SENSITIVE=$(...) without dropping trailing fields
Round-3 review blocker closure for PR #2118 (issue #1784):
OR-COR-7c0a5d41 — the form
export SENSITIVE_ENV=$(printenv OTHER_SECRET) session_id=dup1 token_budget=1000
previously lost ``session_id=dup1`` (case 1) and ALL trailing fields
(case 2 with ``echo OPENAI_API_KEY=sk-12345``) because the second-pass
``$(...)`` scan re-added the same span that the first pass had already
replaced, and ``_replace_spans`` silently dropped the duplicated
region's width worth of trailing characters.
Two fixes:
1. Track first-pass sensitive-assignment replacement spans
(``first_pass_spans``) and skip any ``$(...)`` whose start lies
inside one of those spans. This is the principled guard against
the overlap regardless of where the leading assignment sits.
Previously the second-pass computed a "prior prefix" via three
independent regex branches (semicolon-separated / newline-
separated / head-of-string), each of which only matched bare
``NAME=`` — so ``export NAME=`` slipped through and the second
pass double-rewrote the same span.
2. Add ``(?:export[ \t]+)?`` to all three prior-prefix regexes so
that even if the first-pass span guard were ever evaded, the
leading ``export SENSITIVE=`` would still be recognised and the
second pass would skip the inner ``$(...)``.
Regression tests cover the two exact reproductions from the review
(``session_id=dup1 token_budget=1000`` and ``session_id=dup3``), plus
a non-``export`` control case to lock in the existing behaviour. Full
``tests/test_local_cli_backend.py`` passes 363/363; the ``tests/test_stock_*``
subset is unaffected (460 passed across the CLI + stock subset).
---------
Co-authored-by: zhulinsen <zhuls97@163.com>
Co-authored-by: xxiaoxiong <xxiaoxiong@nicholasxiong.cn>
AI Stock Analysis System
AI-powered stock analysis system for A-shares / Hong Kong / US / Japanese / Korean / Taiwan stocks
Analyze your watchlist daily -> generate a decision dashboard -> push to Telegram / Discord / Slack / Email / WeChat Work / Feishu.
Product Preview · Key Features · Quick Start · Sample Output · Documentation Index · Full Guide
💖 Sponsors
🖥️ Product Preview
✨ Key Features
| Capability | Coverage |
|---|---|
| AI decision reports | Core conclusion, score, trend, entry/exit levels, risk alerts, catalysts, and action checklist |
| Multi-market data | Covers A-shares, Hong Kong, US, Japanese, Korean, Taiwan stocks, and ETFs, with quotes, K-lines, technical indicators, news, announcements, fundamentals, and report context. Data-source coverage and market boundaries are documented in market boundaries |
| Web / desktop workspace | Manual analysis, task progress, history, full Markdown reports, backtest, portfolio, settings, and light/dark themes |
| Agent strategy chat | Multi-turn Q&A with 15 built-in strategies across Web/Bot/API |
| Smart import & autocomplete | Image, CSV/Excel, clipboard import; code/name/pinyin/alias autocomplete |
| Automation & notifications | GitHub Actions, Docker, local scheduler, FastAPI service, and WeChat Work / Feishu / Telegram / Discord / Slack / Email delivery |
Detailed fields, fundamental P0 timeout semantics, trading rules, data-source priority, Web/API behavior, and troubleshooting live in the Full Guide.
Tech Stack & Data Sources
| Type | Supported |
|---|---|
| AI Models | Anspire, AIHubMix, Gemini, OpenAI-compatible providers, DeepSeek, Qwen, Claude, Ollama |
| Market Data | TickFlow, AkShare, Tushare, Pytdx, Baostock, YFinance, Longbridge |
| News Search | Anspire, SerpAPI, Tavily, Bocha, Brave, MiniMax, SearXNG |
| Social Sentiment | Stock Sentiment API for Reddit / X / Polymarket, US stocks only |
The project includes free market-data sources such as AkShare, Baostock, and YFinance and can run without extra data-source credentials. These free sources can be rate-limited, change upstream contracts, or fluctuate by network condition, so stability is not guaranteed. For scheduled runs, batch analysis, or steadier quotes, configure token-based sources such as TickFlow, Tushare, or Longbridge; market coverage, Actions mappings, and fallback rules are documented in Data Source Configuration.
🚀 Quick Start
Option 1: GitHub Actions (Recommended)
Deploy in about 5 minutes, with no server and no infrastructure cost.
1. Fork this repository
Click Fork in the upper-right corner. A star is very welcome if this project helps you.
2. Configure Secrets
Open your forked repository, then go to Settings -> Secrets and variables -> Actions -> New repository secret.
AI model configuration (configure at least one)
Start with one provider and one API key. For multi-model routing, image recognition, local models, or advanced routing, see the LLM Config Guide.
| Secret Name | Description | Required |
|---|---|---|
ANSPIRE_API_KEYS |
Anspire API key, one key for popular LLMs and web search with free quota for this project | Recommended |
AIHUBMIX_KEY |
AIHubMix API key, one key for multiple model families and a 10% top-up discount for this project | Recommended |
GEMINI_API_KEY |
Google Gemini API key | Optional |
ANTHROPIC_API_KEY |
Anthropic Claude API key | Optional |
OPENAI_API_KEY |
OpenAI-compatible API key, including DeepSeek and Qwen-compatible services | Optional |
OPENAI_BASE_URL / OPENAI_MODEL |
Fill these when using an OpenAI-compatible provider | Optional |
Ollama is better suited for local or Docker deployment. GitHub Actions is usually smoother with a cloud API.
Notification channels (configure at least one)
| Secret Name | Description |
|---|---|
WECHAT_WEBHOOK_URL |
WeChat Work bot |
FEISHU_WEBHOOK_URL |
Feishu bot |
TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID |
Telegram |
DISCORD_WEBHOOK_URL |
Discord webhook |
SLACK_BOT_TOKEN + SLACK_CHANNEL_ID |
Slack bot |
EMAIL_SENDER + EMAIL_PASSWORD |
Email push |
More channels, signatures, email groups, and Markdown-to-image settings are in Notification Configuration.
Watchlist (required)
| Secret Name | Description | Required |
|---|---|---|
STOCK_LIST |
Watchlist codes, such as 600519,hk00700,AAPL,7203.T,005930.KS,2330.TW |
✅ |
News sources (recommended)
News search strongly improves sentiment, announcements, events, and catalyst quality. Configure at least one search provider if possible.
| Secret Name | Description | Required |
|---|---|---|
ANSPIRE_API_KEYS |
Anspire AI Search, optimized for Chinese content and A-share analysis; the same key can also be used for Anspire LLM fallback examples | Recommended |
SERPAPI_API_KEYS |
SerpAPI, search-engine results for realtime financial news | Recommended |
TAVILY_API_KEYS |
Tavily, general news search API | Optional |
BOCHA_API_KEYS |
Bocha, Chinese search with AI summaries | Optional |
BRAVE_API_KEYS |
Brave Search, privacy-first search and US-stock news enrichment | Optional |
MINIMAX_API_KEYS |
MiniMax, structured search results | Optional |
SEARXNG_BASE_URLS |
Self-hosted SearXNG instances for quota-free fallback | Optional |
More search providers, social sentiment, and fallback behavior are in Search Configuration.
Market data sources (optional)
Free sources like AkShare, Baostock, and YFinance are used by default. "Not configured" messages in the logs are informational and do not affect execution. For more stable data, configure the following secrets per market:
| Secret Name | Market | Description |
|---|---|---|
TUSHARE_TOKEN |
A-shares | Improves historical data stability |
LONGBRIDGE_OAUTH_CLIENT_ID + LONGBRIDGE_OAUTH_TOKEN_CACHE_B64 |
HK/US stocks | Fills in volume ratio, turnover rate, P/E, and other fields |
3. Enable Actions
Open the Actions tab and click I understand my workflows, go ahead and enable them.
4. Manual Test
Actions -> Daily Stock Analysis -> Run workflow -> Run workflow.
Done
By default, the workflow runs every weekday at 18:00 Beijing time and skips non-trading days. Forced runs, trading-day checks, and resume rules are covered in the Full Guide.
Option 2: Local / Docker Deployment
# Clone the project
git clone https://github.com/ZhuLinsen/daily_stock_analysis.git && cd daily_stock_analysis
# Install dependencies
pip install -r requirements.txt
# Configure environment variables
cp .env.example .env && vim .env
# Run analysis
python main.py
Common commands:
python main.py --debug
python main.py --dry-run
python main.py --stocks 600519,hk00700,AAPL,2330.TW
python main.py --market-review
python main.py --schedule
python main.py --serve-only
Docker deployment, scheduling, and cloud-server WebUI access are documented in the Full Guide.
📱 Sample Output
Decision Dashboard
🎯 2026-02-08 Decision Dashboard
Analyzed 3 stocks | 🟢 Buy:0 🟡 Watch:2 🔴 Sell:1
📊 Summary
🟡 000657: Watch | Score 65 | Bullish
🟡 600105: Watch | Score 48 | Range-bound
🔴 300260: Sell | Score 35 | Bearish
🚨 Risk Alerts:
Risk 1: Main-force funds showed notable outflow.
Risk 2: Chip concentration suggests short-term resistance.
✨ Positive Catalysts:
Catalyst 1: AI-server supply-chain exposure remains a market focus.
Catalyst 2: Recent earnings growth provides fundamental support.
Market Review
🎯 2026-01-10 Market Review
📊 Major Indices
- SSE Composite: 3250.12 (+0.85%)
- SZSE Component: 10521.36 (+1.02%)
- ChiNext: 2156.78 (+1.35%)
📈 Market Breadth
Up: 3920 | Down: 1349 | Limit up: 155 | Limit down: 3
⚙️ Configuration
Full environment variables, model routing, notification channels, data-source priority, trading rules, fundamental P0 semantics, and deployment details are in the Full Guide.
🖥️ Web UI
The Web workspace supports settings, task monitoring, manual analysis, history reports, full Markdown reports, Agent strategy chat, backtest, portfolio management, smart import, and light/dark themes.
python main.py --webui
python main.py --webui-only
Visit http://127.0.0.1:8000. Authentication, smart import, autocomplete, report copying, and cloud-server access are documented in Local WebUI Management.
🤖 Agent Strategy Chat
After configuring any available AI API key, the Web /chat page can use strategy chat. Set AGENT_MODE=false only if you want to disable it explicitly.
- Built-in strategies include moving-average crossovers, Chan theory, Elliott wave, bull trend, hot themes, event-driven, growth quality, expectation repricing, and more
- Calls realtime quotes, K-line data, technical indicators, news, and risk context
- Supports follow-up questions, session export, notification sending, and background execution
- Supports custom strategy files and experimental multi-agent orchestration
Agent parameters,
skillnaming compatibility, multi-agent mode, and budget guards are covered in the Full Guide and LLM Config Guide.
🧩 Related Projects
DSA focuses on daily analysis reports. These sibling projects cover stock screening, strategy validation, and strategy evolution for users who want to extend the workflow. They are maintained independently today, with candidate import, backtest validation, and report handoff planned as future integration directions.
| Project | Focus |
|---|---|
| AlphaSift | Multi-factor stock screening and full-market scanning for building candidate watchlists |
| AlphaEvo | Strategy backtesting and self-evolution experiments for validating rules and iteratively exploring strategy parameters and combinations |
📞 Contact
|
zhuls345@gmail.com Project consulting, deployment support, and feature extensions |
 Follow on Xiaohongshu |
|
| Xiaohongshu | Follow on Xiaohongshu | |
| Feedback | GitHub Issues · Discussions |
📄 License
MIT License © 2026 ZhuLinsen
If you use or build on this project, attribution with a link back to this repository is appreciated.
⚠️ Disclaimer
This project is for informational and educational purposes only. AI-generated analysis is not investment advice. Stock market investing involves risk; do your own research and consult a licensed financial advisor when needed.