From bba7389efc23cf8e6261ce1c5cd6ab4f61618a01 Mon Sep 17 00:00:00 2001 From: Terada Kousuke Date: Sat, 1 Aug 2026 22:48:34 +0900 Subject: [PATCH] feat(guardrails): admit native deepseek provider Add deepseek to enabled_providers and provider whitelist (v4 flash/pro, chat, reasoner). Keep free-tier paid map and tier recommendations in sync so connect UI can search and use DeepSeek natively. --- packages/guardrails/README.md | 4 ++-- packages/guardrails/managed/opencode.json | 9 +++++++++ packages/guardrails/profile/opencode.json | 9 +++++++++ .../guardrails/profile/plugins/guardrail-patterns.ts | 1 + packages/guardrails/profile/plugins/guardrail.ts | 6 +++--- 5 files changed, 24 insertions(+), 5 deletions(-) diff --git a/packages/guardrails/README.md b/packages/guardrails/README.md index d821b078fcfe..f1479fceaa55 100644 --- a/packages/guardrails/README.md +++ b/packages/guardrails/README.md @@ -47,7 +47,7 @@ Current contents focus on the first thin-distribution slice: - packaged custom config dir profile - packaged plugin for runtime guardrail hooks - guarded `implement` and `review` agents plus packaged `/implement`, `/review`, `/ship`, and `/handoff` workflow commands -- declarative provider admission policy for `zai`, `zai-coding-plan`, `openai`, and the isolated OpenRouter evaluation lane +- declarative provider admission policy for `zai`, `zai-coding-plan`, `openai`, `deepseek`, and the isolated OpenRouter evaluation lane - scenario coverage for managed config precedence, project-local asset compatibility, plugin behavior, and workflow safety defaults Planned next slices are tracked in the fork: @@ -93,7 +93,7 @@ It respects an existing `OPENCODE_CONFIG_DIR` so project- or environment-specifi The packaged profile defaults to the `implement` agent. Review and release-readiness work should run through the packaged `/review`, `/ship`, and `/handoff` commands so the workflow stays read-only at the gate layer. -Provider admission is also packaged here. Standard confidential-code work is admitted on the `zai`, `zai-coding-plan`, and `openai` lane. `zai-coding-plan` is kept as a separate provider because Z.AI's official OpenCode guide tells Coding Plan subscribers to select `Z.AI Coding Plan` explicitly. OpenRouter-backed candidates are available only through the dedicated `provider-eval` lane so evaluation traffic does not silently become the default implementation path. +Provider admission is also packaged here. Standard confidential-code work is admitted on the `zai`, `zai-coding-plan`, `openai`, and `deepseek` lane. `zai-coding-plan` is kept as a separate provider because Z.AI's official OpenCode guide tells Coding Plan subscribers to select `Z.AI Coding Plan` explicitly. OpenRouter-backed candidates remain available for evaluation and multi-vendor routing without replacing the default implementation path. ## Managed deployment diff --git a/packages/guardrails/managed/opencode.json b/packages/guardrails/managed/opencode.json index 1547afeed5d7..7f556fd221e7 100644 --- a/packages/guardrails/managed/opencode.json +++ b/packages/guardrails/managed/opencode.json @@ -5,6 +5,7 @@ "zai", "zai-coding-plan", "openai", + "deepseek", "openrouter" ], "share": "disabled", @@ -63,6 +64,14 @@ "gpt-4.1" ] }, + "deepseek": { + "whitelist": [ + "deepseek-v4-flash", + "deepseek-v4-pro", + "deepseek-chat", + "deepseek-reasoner" + ] + }, "openrouter": { "whitelist": [ "anthropic/claude-haiku-4.5", diff --git a/packages/guardrails/profile/opencode.json b/packages/guardrails/profile/opencode.json index 1becb6c3f7e8..783e4bad783e 100644 --- a/packages/guardrails/profile/opencode.json +++ b/packages/guardrails/profile/opencode.json @@ -13,6 +13,7 @@ "zai", "zai-coding-plan", "openai", + "deepseek", "openrouter" ], "share": "disabled", @@ -89,6 +90,14 @@ "gpt-4.1" ] }, + "deepseek": { + "whitelist": [ + "deepseek-v4-flash", + "deepseek-v4-pro", + "deepseek-chat", + "deepseek-reasoner" + ] + }, "openrouter": { "whitelist": [ "anthropic/claude-haiku-4.5", diff --git a/packages/guardrails/profile/plugins/guardrail-patterns.ts b/packages/guardrails/profile/plugins/guardrail-patterns.ts index 5aba99ff5e6f..f064401ec95e 100644 --- a/packages/guardrails/profile/plugins/guardrail-patterns.ts +++ b/packages/guardrails/profile/plugins/guardrail-patterns.ts @@ -94,6 +94,7 @@ export const paid: Record> = { "gpt-5.5", "gpt-5.5-pro", ]), + deepseek: new Set(["deepseek-v4-flash", "deepseek-v4-pro", "deepseek-chat", "deepseek-reasoner"]), } export const secEnvExempt = /\.env\.(example|sample|template)$/i diff --git a/packages/guardrails/profile/plugins/guardrail.ts b/packages/guardrails/profile/plugins/guardrail.ts index 49ca0934815e..2b6176a3a335 100644 --- a/packages/guardrails/profile/plugins/guardrail.ts +++ b/packages/guardrails/profile/plugins/guardrail.ts @@ -571,9 +571,9 @@ export default async function guardrail(input: GuardrailInput, opts?: Record = { - high: ["zai-coding-plan", "openai"], - standard: ["zai-coding-plan", "openai", "openrouter"], - low: ["openrouter", "zai-coding-plan"], + high: ["zai-coding-plan", "openai", "deepseek"], + standard: ["zai-coding-plan", "openai", "deepseek", "openrouter"], + low: ["openrouter", "zai-coding-plan", "deepseek"], } const recommendedProviders = providerTiers[tier] ?? [] if (recommendedProviders.length > 0 && !recommendedProviders.includes(provider)) {