lynkr 9.14.10 → 9.14.12

package/README.md

@@ -211,6 +211,7 @@ Claude Code / Cursor / Codex / Cline / Continue
 | **llama.cpp** | Local | Any GGUF model | **Free** |
 | **LM Studio** | Local | Local models with GUI | **Free** |
 | **OpenRouter** | Cloud | GPT-4o, Claude 3.5, Llama 3, Gemini | $ |
+| **OrcaRouter** | Cloud | Chat, reasoning, image, video (one endpoint, live catalog) | $ (zero-markup) |
 | **AWS Bedrock** | Cloud | Claude, Llama, Mistral, Titan | $$ |
 | **Databricks** | Cloud | Claude Sonnet 4.5, Opus 4.6 | $$$ |
 | **Azure OpenAI** | Cloud | GPT-4o, o1, o3 | $$$ |

package/bin/cli.js

@@ -15,6 +15,7 @@ const SUBCOMMANDS = {
   "desktop-token": path.join(__dirname, "lynkr-desktop-token.js"),
   restart:       path.join(__dirname, "lynkr-restart.js"),
   run:           path.join(__dirname, "run.js"),
+  connect:       path.join(__dirname, "lynkr-connect-orcarouter.js"),
 };
 
 const sub = process.argv[2];

package/bin/lynkr-connect-orcarouter.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+/**
+ * `lynkr connect orcarouter` — OAuth 2.0 + PKCE (Flow B, out-of-band) login.
+ *
+ * Lynkr is self-hosted software whose install address differs on every
+ * deployment (LAN box, NAS, moved port), so there is no predictable loopback
+ * port to register — Flow B (out-of-band code) exists precisely for that
+ * case. The command:
+ *
+ *   1. Generates a fresh PKCE verifier + CSRF state (crypto RNG, per attempt).
+ *   2. Prints an authorize URL (callback_url=oob, S256 challenge) and opens
+ *      it in the default browser when possible.
+ *   3. Asks for the one-time code shown on the consent screen.
+ *   4. Exchanges it at www.orcarouter.ai/api/v1/auth/keys for a durable
+ *      OrcaRouter API key that belongs to the user.
+ *   5. Persists the key to the project's .env (same secret location as every
+ *      other Lynkr provider key) and prints the masked status.
+ *
+ * The verifier never leaves the process until the exchange; it never appears
+ * in a URL, a log, or an error. Auth requests hit the auth origin
+ * (www.orcarouter.ai) only; inference stays on api.orcarouter.ai/v1.
+ *
+ * Usage:
+ *   lynkr connect orcarouter                  # interactive OOB code login
+ *   lynkr connect orcarouter --code <code>   # non-interactive (CI / GUI)
+ *   lynkr connect orcarouter --status        # masked status of stored key
+ *   lynkr connect orcarouter --clear         # remove the stored key
+ *
+ * @module bin/lynkr-connect-orcarouter
+ */
+
+const path = require("path");
+const fs = require("fs");
+const readline = require("readline");
+const { exec } = require("child_process");
+
+const ROOT = path.join(__dirname, "..");
+const ENV_PATH = path.join(ROOT, ".env");
+const {
+  connectWithPkce,
+  getCredentialStore,
+  createApiKeyAdapter,
+  maskKey,
+  resolveAuthBase,
+  resolveApiBase,
+} = require("../src/clients/orcarouter-credentials");
+
+// ---------------------------------------------------------------------------
+// .env persistence — the project's existing secret location. No new secret
+// store is introduced. Keys are written as `ORCAROUTER_API_KEY=...` alongside
+// the other provider keys; existing keys are updated in place.
+// ---------------------------------------------------------------------------
+
+function readEnvLines() {
+  try {
+    return fs.existsSync(ENV_PATH) ? fs.readFileSync(ENV_PATH, "utf8").split(/\r?\n/) : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeEnvLines(lines) {
+  fs.writeFileSync(ENV_PATH, lines.join("\n") + "\n", { mode: 0o600 });
+  // mode only applies on creation — tighten existing files explicitly so a
+  // previously 0644 .env doesn't leave the new OAuth key world-readable.
+  try {
+    fs.chmodSync(ENV_PATH, 0o600);
+  } catch {
+    /* best-effort: e.g. read-only FS in CI */
+  }
+}
+
+function readEnvKey(key) {
+  try {
+    const lines = readEnvLines();
+    for (const line of lines) {
+      const m = line.match(/^([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
+      if (m && m[1] === key) {
+        const v = (m[2] || "").trim();
+        return v || null;
+      }
+    }
+  } catch {
+    /* missing/unreadable .env → no file-backed value */
+  }
+  return null;
+}
+
+// File-backed env for status: process.env wins, .env file is the fallback so
+// a key saved by a previous `connect` process is visible without re-export.
+function statusEnv() {
+  const env = { ...process.env };
+  for (const k of ["ORCAROUTER_API_KEY", "ORCA_API_BASE_URL", "ORCA_AUTH_BASE_URL", "ORCA_BASE_URL"]) {
+    if (!env[k]) {
+      const v = readEnvKey(k);
+      if (v) env[k] = v;
+    }
+  }
+  return env;
+}
+
+function upsertEnvKey(key, value) {
+  const lines = readEnvLines();
+  let replaced = false;
+  const out = lines.map((line) => {
+    const m = line.match(/^([A-Z0-9_]+)\s*=/);
+    if (m && m[1] === key) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) out.push(`${key}=${value}`);
+  writeEnvLines(out);
+}
+
+function clearEnvKey(_key) {
+  const lines = readEnvLines().filter((line) => !line.match(/^ORCAROUTER_API_KEY\s*=/));
+  writeEnvLines(lines);
+}
+
+// (readEnvKey is intentionally not exported — the store's read() covers status.)
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+  exec(`"${cmd}" "${url}"`, () => {});
+}
+
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) =>
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    })
+  );
+}
+
+function fail(msg) {
+  console.error(`✗ ${msg}`);
+  process.exit(1);
+}
+
+function status() {
+  // Read through a file-backed store: a key saved to .env by either
+  // connection path must show up in a later process without requiring export.
+  const { OrcaCredentialStore } = require("../src/clients/orcarouter-credentials");
+  const env = statusEnv();
+  const store = new OrcaCredentialStore({
+    env,
+    loadSecret: () => env.ORCAROUTER_API_KEY || null,
+  });
+  const st = store.read();
+  console.log(st.present
+    ? `OrcaRouter credential: ${st.masked} (generation ${st.generation})${st.needsReauth ? " — needs reauthentication" : ""}`
+    : "No OrcaRouter credential configured.");
+  console.log(`  API base:  ${resolveApiBase(env)}`);
+  console.log(`  Auth base: ${resolveAuthBase(env)}`);
+}
+
+async function runConnect(opts) {
+  const store = getCredentialStore();
+
+  // Adapter A: update/clear an API key directly through the seam too.
+  if (opts.apiKey) {
+    const adapter = createApiKeyAdapter(store, { env: process.env });
+    const cred = adapter.set(opts.apiKey);
+    upsertEnvKey("ORCAROUTER_API_KEY", cred.key);
+    console.log(`✓ OrcaRouter API key saved (${maskKey(cred.key)}).`);
+    return;
+  }
+  if (opts.clear) {
+    store.clear();
+    clearEnvKey("ORCAROUTER_API_KEY");
+    console.log("✓ OrcaRouter credential cleared.");
+    return;
+  }
+  if (opts.status) {
+    status();
+    return;
+  }
+
+  // PKCE connect. Generate verifier+state fresh; hand back the authorize URL.
+  const started = await connectWithPkce({ appName: "Lynkr" });
+  if (!started.ok) fail(started.error?.message || "Could not start OrcaRouter login");
+
+  console.log("\n1. Open this URL in your browser (opening automatically…):");
+  console.log(`   ${started.authorizeUrl}\n`);
+  openBrowser(started.authorizeUrl);
+
+  const code = opts.code || (await ask("2. Paste the one-time code from the consent screen: ")).trim();
+  if (!code) fail("No code provided.");
+
+  // Exchange the code for the durable key using the SAME verifier that
+  // produced the challenge (PKCE binding — a fresh verifier would mismatch).
+  const result = await connectWithPkce({ appName: "Lynkr", code, verifier: started.verifier, state: started.state });
+  if (!result.ok) {
+    fail(result.error?.message || `OrcaRouter exchange failed (HTTP ${result.error?.status || "?"})`);
+  }
+  upsertEnvKey("ORCAROUTER_API_KEY", result.credential.key);
+  const scopeNote = result.credential.scope && result.credential.scope !== "api"
+    ? ` (granted scope: ${result.credential.scope})`
+    : "";
+  console.log(`\n✓ Connected to OrcaRouter. Key saved to .env${scopeNote}.`);
+  console.log(`  Masked: ${maskKey(result.credential.key)}`);
+  console.log("  Revoke anytime at https://www.orcarouter.ai/console/authorized-apps");
+}
+
+function parseArgs(argv) {
+  const opts = { apiKey: null, code: null, status: false, clear: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--status") opts.status = true;
+    else if (a === "--clear") opts.clear = true;
+    else if (a === "--api-key") opts.apiKey = argv[++i];
+    else if (a === "--code") opts.code = argv[++i];
+  }
+  return opts;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`lynkr connect orcarouter — OAuth 2.0 + PKCE login for the OrcaRouter provider
+
+Usage:
+  lynkr connect orcarouter                  Interactive out-of-band code login
+  lynkr connect orcarouter --code <code>    Non-interactive (paste the consent code)
+  lynkr connect orcarouter --api-key <key>  Save an existing sk-orca-… API key
+  lynkr connect orcarouter --status         Show masked credential status
+  lynkr connect orcarouter --clear          Remove the stored credential`);
+    return;
+  }
+  return runConnect(parseArgs(args));
+}
+
+if (require.main === module || process.env._LYNKR_SUBCMD === "connect") {
+  main().catch((err) => fail(err.message));
+}
+
+module.exports = { runConnect, parseArgs, upsertEnvKey, clearEnvKey, readEnvKey, statusEnv, status };

package/bin/lynkr-init.js

@@ -188,12 +188,23 @@ const PROVIDERS = {
     extras: [],
     defaultModel: 'accounts/fireworks/models/kimi-k2-instruct-0905',
   },
+  orcarouter: {
+    label: 'OrcaRouter (OpenAI-compatible gateway — adaptive routing, failover, zero-markup inference)',
+    local: false,
+    creds: [
+      { key: 'ORCAROUTER_API_KEY', label: 'OrcaRouter API key (sk-orca-...; or run `lynkr connect orcarouter` for OAuth + PKCE login)', secret: true },
+    ],
+    extras: [
+      { key: 'ORCAROUTER_MODEL', label: 'default model', default: 'orcarouter/auto' },
+    ],
+    defaultModel: 'orcarouter/auto',
+  },
 };
 
 const PROVIDER_ORDER = [
   'ollama', 'llamacpp', 'lmstudio',
   'azure-anthropic', 'azure-openai', 'openai', 'atlas', 'openrouter', 'edenai',
-  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks',
+  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks', 'orcarouter',
 ];
 const TIERS = ['SIMPLE', 'MEDIUM', 'COMPLEX', 'REASONING'];
 
@@ -354,6 +365,9 @@ const BASELINE_ENV = {
   FIREWORKS_API_KEY: '',
   FIREWORKS_ENDPOINT: 'https://api.fireworks.ai/inference/v1/chat/completions',
   FIREWORKS_MODEL: 'accounts/fireworks/models/kimi-k2-instruct-0905',
+  ORCAROUTER_API_KEY: '',
+  ORCAROUTER_MODEL: 'orcarouter/auto',
+  ORCAROUTER_ENDPOINT: 'https://api.orcarouter.ai/v1/chat/completions',
   LLAMACPP_ENDPOINT: 'http://localhost:8080',
   LLAMACPP_MODEL: 'default',
   LLAMACPP_TIMEOUT_MS: '120000',

package/config/model-capability-seeds.json

@@ -1,13 +1,16 @@
 {
   "version": 1,
-  "updatedAt": "2026-09-08",
-  "notes": "Reviewed per-family capability seeds. Values are curated estimates triangulated from SWE-Bench Verified, TerminalBench, LiveCodeBench/BigCodeBench and Artificial Analysis coding index (see scripts/seed-capabilities.js to regenerate from live sources). Heads: reasoning/codegen/debugging/tool_use in [0,1]. Keys are normalized family ids (see capability-seeds/family.js) with trailing-* wildcards matched longest-first. Quantized self-hosted servings take an automatic -0.02 haircut at resolve time. Unknown families fall through to the family heuristic, then tier-slot caps.",
+  "updatedAt": "2026-09-16",
+  "notes": "Reviewed per-family capability seeds. Values are curated estimates triangulated from SWE-Bench Verified, TerminalBench, LiveCodeBench/BigCodeBench and Artificial Analysis coding index (see scripts/seed-capabilities.js to regenerate from live sources). Heads: reasoning/codegen/debugging/tool_use in [0,1]. Keys are normalized family ids (see capability-seeds/family.js) with trailing-* wildcards matched longest-first. Quantized self-hosted servings take an automatic -0.02 haircut at resolve time. Unknown families fall through to the family heuristic, then tier-slot caps. 2026-09-16: added local-runtime + tier-catalog gaps (ornith, qwen2.5 base sizes, qwen3.5 sizes, spark-x2.5, gemma4, minimax-m3, versioned claude-3.5/gpt-4o/gpt-4.1 names, mistral bare, deepseek-coder, codellama, llama-3.1-8b, gemini-1.5-flash, amazon nova, gpt-4-turbo, gpt-3.5-turbo). Entries without benchmark rows are marked provisional — promote on data.",
   "seeds": {
     "claude-opus-4*": { "caps": { "reasoning": 0.9, "codegen": 0.9, "debugging": 0.9, "tool_use": 0.9 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate: flagship tier" },
     "claude-opus-3*": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "claude-sonnet-4*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.78 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate" },
     "claude-sonnet-3.5": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "orcarouter-auto": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.82 }, "sources": ["provider-routing:adaptive auto"], "note": "curated-estimate: orcarouter/auto routes across frontier models per request" },
+    "claude-3.5-sonnet*": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-sonnet-20241022) shares claude-sonnet-3.5 caps" },
     "claude-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "claude-3.5-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-haiku-20241022) shares claude-haiku caps" },
     "gpt-5.6*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },
     "gpt-5.4*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },
     "gpt-5.3*": { "caps": { "reasoning": 0.82, "codegen": 0.85, "debugging": 0.82, "tool_use": 0.8 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -15,10 +18,12 @@
     "gpt-5.1*": { "caps": { "reasoning": 0.7, "codegen": 0.72, "debugging": 0.7, "tool_use": 0.68 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-5-mini*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-5-nano*": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
-    "gpt-4o": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.68 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
+    "gpt-4o*": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.68 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate; wildcard also covers dated snapshots (gpt-4o-2024-*). Exact gpt-4o-mini still wins via exact-first lookup." },
     "gpt-4o-mini": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
-    "gpt-4.1": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gpt-4.1*": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate; wildcard also covers dated snapshots. Exact gpt-4.1-mini still wins via exact-first lookup." },
     "gpt-4.1-mini": { "caps": { "reasoning": 0.5, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.52 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gpt-4-turbo*": { "caps": { "reasoning": 0.62, "codegen": 0.68, "debugging": 0.62, "tool_use": 0.64 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (MEDIUM openai slot); sized just below gpt-4o — promote on benchmark rows" },
+    "gpt-3.5-turbo": { "caps": { "reasoning": 0.3, "codegen": 0.35, "debugging": 0.3, "tool_use": 0.33 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (SIMPLE openai slot); matches tiny/small ladder rung" },
     "o3": { "caps": { "reasoning": 0.88, "codegen": 0.8, "debugging": 0.85, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: reasoning tilt" },
     "o3-mini": { "caps": { "reasoning": 0.72, "codegen": 0.68, "debugging": 0.7, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: reasoning tilt" },
     "o4-mini": { "caps": { "reasoning": 0.7, "codegen": 0.66, "debugging": 0.68, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -28,11 +33,16 @@
     "gemini-3-pro*": { "caps": { "reasoning": 0.85, "codegen": 0.83, "debugging": 0.85, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemini-2.5-flash": { "caps": { "reasoning": 0.55, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.58 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemini-2.0-flash": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gemini-1.5-flash*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.46 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (openrouter google/gemini-flash-1.5); sized just below gemini-2.0-flash" },
     "gemini-1.5-pro": { "caps": { "reasoning": 0.6, "codegen": 0.62, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "amazon.nova-lite*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.38 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (bedrock SIMPLE slot); dotted key matches normalized amazon.nova-lite-v1-0 form" },
+    "amazon.nova-pro*": { "caps": { "reasoning": 0.5, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.52 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (bedrock MEDIUM slot)" },
     "deepseek-r1": { "caps": { "reasoning": 0.82, "codegen": 0.78, "debugging": 0.8, "tool_use": 0.6 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate: reasoning tilt, weak tool-use" },
     "deepseek-reasoner": { "caps": { "reasoning": 0.82, "codegen": 0.78, "debugging": 0.8, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "deepseek-chat": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.62 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "deepseek-v3*": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.62 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
+    "deepseek-coder*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog legacy (MEDIUM/COMPLEX ollama slots: 33b, v2:236b); coder tilt, sized below qwen2.5-coder-32b" },
+    "codellama*": { "caps": { "reasoning": 0.45, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.45 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog legacy (MEDIUM ollama slot: 34b); coder tilt" },
     "qwen3-max": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.72 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
     "qwen3-235b*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.7 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen3-32b": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.6 }, "sources": ["livecodebench"], "note": "curated-estimate" },
@@ -40,8 +50,18 @@
     "qwen2.5-coder-32b*": { "caps": { "reasoning": 0.55, "codegen": 0.68, "debugging": 0.6, "tool_use": 0.55 }, "sources": ["livecodebench"], "note": "curated-estimate: coder tilt" },
     "qwen2.5-coder-14b*": { "caps": { "reasoning": 0.45, "codegen": 0.58, "debugging": 0.5, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen2.5-coder-7b*": { "caps": { "reasoning": 0.35, "codegen": 0.48, "debugging": 0.4, "tool_use": 0.38 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "qwen2.5-72b*": { "caps": { "reasoning": 0.55, "codegen": 0.62, "debugging": 0.55, "tool_use": 0.52 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (COMPLEX ollama slot); sized at llama-3.1-70b rung" },
+    "qwen2.5-32b*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (MEDIUM ollama slot); sized just below qwen2.5-coder-32b" },
+    "qwen2.5-14b*": { "caps": { "reasoning": 0.42, "codegen": 0.55, "debugging": 0.48, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: sized between qwen2.5-7b and qwen2.5-32b rungs" },
+    "qwen2.5-7b*": { "caps": { "reasoning": 0.33, "codegen": 0.45, "debugging": 0.38, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (SIMPLE ollama slot); sized just below qwen2.5-coder-7b" },
+    "qwen2.5-3b*": { "caps": { "reasoning": 0.28, "codegen": 0.35, "debugging": 0.3, "tool_use": 0.3 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:3b); small-ladder rung" },
+    "qwen2.5-1.5b*": { "caps": { "reasoning": 0.22, "codegen": 0.28, "debugging": 0.24, "tool_use": 0.24 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:1.5b); tiny-ladder rung" },
+    "qwen2.5-0.5b*": { "caps": { "reasoning": 0.15, "codegen": 0.2, "debugging": 0.18, "tool_use": 0.18 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:0.5b); floor rung, trivial turns only" },
     "qwen3-8b": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen3-4b": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.38 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "qwen3.5-9b*": { "caps": { "reasoning": 0.42, "codegen": 0.5, "debugging": 0.44, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 9B class (ornith arch family); sized just below qwen3-8b+ — promote on benchmark rows" },
+    "qwen3.5-4b*": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.38 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 4B class; mirrors qwen3-4b — promote on benchmark rows" },
+    "qwen3.5-2b*": { "caps": { "reasoning": 0.26, "codegen": 0.3, "debugging": 0.27, "tool_use": 0.28 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 2B class; tiny/small rung" },
     "glm-5.2": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.66 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate: provider-agnostic (z.ai/Baidu/local share this entry)" },
     "glm-5*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.62 }, "sources": ["artificial-analysis"], "note": "curated-estimate: GLM-5 family default" },
     "glm-4.7": { "caps": { "reasoning": 0.62, "codegen": 0.66, "debugging": 0.62, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -54,20 +74,28 @@
     "kimi-k2*": { "caps": { "reasoning": 0.6, "codegen": 0.63, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: Kimi-K2 family default" },
     "llama-3.3-70b*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.58 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
     "llama-3.1-70b*": { "caps": { "reasoning": 0.55, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.52 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "llama-3.1-8b*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (fireworks llama-3.1-8b-instruct); small rung" },
     "llama-4-maverick*": { "caps": { "reasoning": 0.6, "codegen": 0.62, "debugging": 0.6, "tool_use": 0.58 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "llama-4-scout*": { "caps": { "reasoning": 0.5, "codegen": 0.52, "debugging": 0.5, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "llama-3.2*": { "caps": { "reasoning": 0.25, "codegen": 0.3, "debugging": 0.25, "tool_use": 0.28 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "mistral-large*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.62 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "codestral*": { "caps": { "reasoning": 0.5, "codegen": 0.62, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["livecodebench"], "note": "curated-estimate: coder tilt" },
     "mistral-small*": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["artificial-analysis"], "note": "curated-estimate" },
+    "mistral*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: bare/7b-class mistral (ollama SIMPLE slot); longer keys (mistral-large/small) still win via longest-prefix" },
     "devstral*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: coder tilt" },
     "gpt-oss-120b": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.55 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-oss-20b": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.42 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemma-3-27b": { "caps": { "reasoning": 0.45, "codegen": 0.48, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "gemma4*": { "caps": { "reasoning": 0.42, "codegen": 0.46, "debugging": 0.42, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama gemma4:12b normalizes to gemma4-12b, no dash); sized just below gemma-3-27b" },
     "gemma-2*": { "caps": { "reasoning": 0.28, "codegen": 0.32, "debugging": 0.28, "tool_use": 0.3 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "phi-4": { "caps": { "reasoning": 0.45, "codegen": 0.48, "debugging": 0.45, "tool_use": 0.4 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "phi-3*": { "caps": { "reasoning": 0.28, "codegen": 0.32, "debugging": 0.28, "tool_use": 0.28 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "minimax-m2*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.65 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "minimax-m3*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.65 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (OLLAMA_MODEL minimax-m3:cloud); mirrors minimax-m2 pending m3 rows" },
+    "ornith*": { "caps": { "reasoning": 0.44, "codegen": 0.52, "debugging": 0.46, "tool_use": 0.47 }, "sources": ["ollama-library", "lynkr-operator-estimate"], "note": "provisional: 9B Qwen3.5-based agentic coder (tools+thinking, 262k ctx); no public SWE-bench row — coder/agentic tilt, revisit on data" },
+    "spark-x2.5-4b*": { "caps": { "reasoning": 0.42, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["vendor-reported", "lynkr-operator-estimate"], "note": "provisional: vendor claims SOTA-among-size on agent/code; capped per self-report policy (cf. muse-spark-1.3) — revisit on independent rows" },
+    "spark-x2.5-1.7b*": { "caps": { "reasoning": 0.32, "codegen": 0.38, "debugging": 0.34, "tool_use": 0.36 }, "sources": ["vendor-reported", "lynkr-operator-estimate"], "note": "provisional: 1.7B sibling; small rung with agent tilt — revisit on independent rows" },
+    "spark-x2.5*": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.4 }, "sources": ["lynkr-operator-estimate"], "note": "family default; dated/suffixed forms fall here, longer 4b/1.7b keys win via longest-prefix" },
     "muse-spark-1.3": { "caps": { "reasoning": 0.85, "codegen": 0.87, "debugging": 0.85, "tool_use": 0.75 }, "sources": ["deepswe-1.1@75.4% (vendor-reported, max setting)", "terminal-bench-2.1@88.8% (vendor-reported)"], "note": "curated-estimate: full 1.3 at max reasoning. Vendor self-reported; absent from public DeepSWE leaderboard (only 1.2 listed); hands-on gap reported by third parties. tool_use capped — no direct tool-use data. Revisit on independent rows." },
     "muse-spark-1.2*": { "caps": { "reasoning": 0.42, "codegen": 0.46, "debugging": 0.42, "tool_use": 0.44 }, "sources": ["lynkr-telemetry:4176 scored rows, avg quality 52.7 @ complexity 51.7"], "note": "measured: operator's own traffic. Below the 70 evidence bar — economize trivial turns only." },
     "muse-spark-1.3-contributor*": { "caps": { "reasoning": 0.4, "codegen": 0.45, "debugging": 0.4, "tool_use": 0.45 }, "sources": ["lynkr-telemetry:29 scored rows (thin) + 1.2 family history"], "note": "provisional: free/contributor serving grades far below full-1.3 published scores (variant, effort setting, or benchmark inflation — undetermined). Do NOT cover with muse-spark*: the full model and the free serving must never share caps." }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lynkr",
-  "version": "9.14.10",
+  "version": "9.14.12",
   "files": [
     "index.js",
     "install.sh",

package/src/api/middleware/session.js

@@ -8,12 +8,21 @@ const FALLBACK_HEADERS = [
   "x-claude-session",
   "x-claude-conversation-id",
   "anthropic-session-id",
+  // open-code-review per-bundle affinity: internal/llm/sessionkey.go sends
+  // `x-session-affinity: <ocr_session_key>` (real task key, or an
+  // auto-generated fallback). Each file bundle gets its own key so bundles
+  // route independently instead of sharing one PR-wide pin.
+  "x-session-affinity",
 ];
 
 function normaliseSessionId(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
-  return trimmed.length ? trimmed : null;
+  if (!trimmed.length) return null;
+  // Ignore unsubstituted templates (OCR sends literal "{ocr_session_key}"
+  // when no key is configured — its own client falls back to auto-generated).
+  if (trimmed.includes("{") && trimmed.includes("}")) return null;
+  return trimmed;
 }
 
 function _contentText(content) {

package/src/api/openai-router.js

@@ -986,9 +986,10 @@ router.post("/chat/completions", async (req, res) => {
 
 /**
  * Get all configured providers with their models (cc-relay style)
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter contributes its live capability-filtered chat catalog.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   if (config.databricks?.url && config.databricks?.apiKey) {
@@ -1156,6 +1157,23 @@ function getConfiguredProviders() {
     });
   }
 
+  // OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog fetch (authoritative when the account key
+  // works), with a verified seed fallback. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        models: models.map(m => m.id),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter discovery failed — omitting from OpenAI /v1/models");
+    }
+  }
+
   if (config.vertex?.projectId) {
     providers.push({
       name: "vertex",
@@ -1178,9 +1196,9 @@ function getConfiguredProviders() {
  * List available models from ALL configured providers (cc-relay style).
  * Returns OpenAI-compatible model list with provider field.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const timestamp = Math.floor(Date.now() / 1000);
     const models = [];
     const seenModelIds = new Set();

package/src/api/providers-handler.js

@@ -17,9 +17,11 @@ const router = express.Router();
 
 /**
  * Get all configured providers with their models
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter's model list is a live capability-filtered catalog fetch
+ * (authoritative when the account key works), with a verified seed fallback.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   // Check Databricks
@@ -253,6 +255,27 @@ function getConfiguredProviders() {
     });
   }
 
+  // Check OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog (text chat) — authoritative when discovery
+  // succeeds, verified seed otherwise. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models, source, degraded } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        baseUrl: `${config.orcarouter.apiBaseUrl || "https://api.orcarouter.ai"}/v1`,
+        enabled: true,
+        catalog_source: source,
+        catalog_degraded: degraded,
+        models: models.map(m => ({ id: m.id, name: m.name || m.id })),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter provider discovery failed — omitting from /v1/models");
+    }
+  }
+
   // Check Vertex AI (Google Cloud)
   if (config.vertex?.projectId) {
     const region = config.vertex.region || "us-east5";
@@ -287,9 +310,9 @@ function getPrimaryProvider() {
  * Anthropic-compatible model listing endpoint (cc-relay style).
  * Lists all available models from all configured providers.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const timestamp = Math.floor(Date.now() / 1000);
 
@@ -344,9 +367,9 @@ router.get("/models", (req, res) => {
  * Provider listing endpoint (cc-relay style).
  * Lists all configured providers with their metadata and models.
  */
-router.get("/providers", (req, res) => {
+router.get("/providers", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const fallbackProvider = config.modelProvider?.fallbackProvider;
 
@@ -391,10 +414,10 @@ router.get("/providers", (req, res) => {
  *
  * Get details for a specific provider.
  */
-router.get("/providers/:name", (req, res) => {
+router.get("/providers/:name", async (req, res) => {
   try {
     const providerName = req.params.name.toLowerCase();
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const provider = providers.find(p => p.name === providerName);
 
     if (!provider) {
@@ -435,9 +458,9 @@ router.get("/providers/:name", (req, res) => {
  *
  * Get current configuration summary (without sensitive data).
  */
-router.get("/config", (req, res) => {
+router.get("/config", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
 
     res.json({
       model_provider: config.modelProvider?.type || "databricks",