lynkr 9.14.11 → 9.14.12

package/README.md

@@ -211,6 +211,7 @@ Claude Code / Cursor / Codex / Cline / Continue
 | **llama.cpp** | Local | Any GGUF model | **Free** |
 | **LM Studio** | Local | Local models with GUI | **Free** |
 | **OpenRouter** | Cloud | GPT-4o, Claude 3.5, Llama 3, Gemini | $ |
+| **OrcaRouter** | Cloud | Chat, reasoning, image, video (one endpoint, live catalog) | $ (zero-markup) |
 | **AWS Bedrock** | Cloud | Claude, Llama, Mistral, Titan | $$ |
 | **Databricks** | Cloud | Claude Sonnet 4.5, Opus 4.6 | $$$ |
 | **Azure OpenAI** | Cloud | GPT-4o, o1, o3 | $$$ |

package/bin/cli.js

@@ -15,6 +15,7 @@ const SUBCOMMANDS = {
   "desktop-token": path.join(__dirname, "lynkr-desktop-token.js"),
   restart:       path.join(__dirname, "lynkr-restart.js"),
   run:           path.join(__dirname, "run.js"),
+  connect:       path.join(__dirname, "lynkr-connect-orcarouter.js"),
 };
 
 const sub = process.argv[2];

package/bin/lynkr-connect-orcarouter.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+/**
+ * `lynkr connect orcarouter` — OAuth 2.0 + PKCE (Flow B, out-of-band) login.
+ *
+ * Lynkr is self-hosted software whose install address differs on every
+ * deployment (LAN box, NAS, moved port), so there is no predictable loopback
+ * port to register — Flow B (out-of-band code) exists precisely for that
+ * case. The command:
+ *
+ *   1. Generates a fresh PKCE verifier + CSRF state (crypto RNG, per attempt).
+ *   2. Prints an authorize URL (callback_url=oob, S256 challenge) and opens
+ *      it in the default browser when possible.
+ *   3. Asks for the one-time code shown on the consent screen.
+ *   4. Exchanges it at www.orcarouter.ai/api/v1/auth/keys for a durable
+ *      OrcaRouter API key that belongs to the user.
+ *   5. Persists the key to the project's .env (same secret location as every
+ *      other Lynkr provider key) and prints the masked status.
+ *
+ * The verifier never leaves the process until the exchange; it never appears
+ * in a URL, a log, or an error. Auth requests hit the auth origin
+ * (www.orcarouter.ai) only; inference stays on api.orcarouter.ai/v1.
+ *
+ * Usage:
+ *   lynkr connect orcarouter                  # interactive OOB code login
+ *   lynkr connect orcarouter --code <code>   # non-interactive (CI / GUI)
+ *   lynkr connect orcarouter --status        # masked status of stored key
+ *   lynkr connect orcarouter --clear         # remove the stored key
+ *
+ * @module bin/lynkr-connect-orcarouter
+ */
+
+const path = require("path");
+const fs = require("fs");
+const readline = require("readline");
+const { exec } = require("child_process");
+
+const ROOT = path.join(__dirname, "..");
+const ENV_PATH = path.join(ROOT, ".env");
+const {
+  connectWithPkce,
+  getCredentialStore,
+  createApiKeyAdapter,
+  maskKey,
+  resolveAuthBase,
+  resolveApiBase,
+} = require("../src/clients/orcarouter-credentials");
+
+// ---------------------------------------------------------------------------
+// .env persistence — the project's existing secret location. No new secret
+// store is introduced. Keys are written as `ORCAROUTER_API_KEY=...` alongside
+// the other provider keys; existing keys are updated in place.
+// ---------------------------------------------------------------------------
+
+function readEnvLines() {
+  try {
+    return fs.existsSync(ENV_PATH) ? fs.readFileSync(ENV_PATH, "utf8").split(/\r?\n/) : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeEnvLines(lines) {
+  fs.writeFileSync(ENV_PATH, lines.join("\n") + "\n", { mode: 0o600 });
+  // mode only applies on creation — tighten existing files explicitly so a
+  // previously 0644 .env doesn't leave the new OAuth key world-readable.
+  try {
+    fs.chmodSync(ENV_PATH, 0o600);
+  } catch {
+    /* best-effort: e.g. read-only FS in CI */
+  }
+}
+
+function readEnvKey(key) {
+  try {
+    const lines = readEnvLines();
+    for (const line of lines) {
+      const m = line.match(/^([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
+      if (m && m[1] === key) {
+        const v = (m[2] || "").trim();
+        return v || null;
+      }
+    }
+  } catch {
+    /* missing/unreadable .env → no file-backed value */
+  }
+  return null;
+}
+
+// File-backed env for status: process.env wins, .env file is the fallback so
+// a key saved by a previous `connect` process is visible without re-export.
+function statusEnv() {
+  const env = { ...process.env };
+  for (const k of ["ORCAROUTER_API_KEY", "ORCA_API_BASE_URL", "ORCA_AUTH_BASE_URL", "ORCA_BASE_URL"]) {
+    if (!env[k]) {
+      const v = readEnvKey(k);
+      if (v) env[k] = v;
+    }
+  }
+  return env;
+}
+
+function upsertEnvKey(key, value) {
+  const lines = readEnvLines();
+  let replaced = false;
+  const out = lines.map((line) => {
+    const m = line.match(/^([A-Z0-9_]+)\s*=/);
+    if (m && m[1] === key) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) out.push(`${key}=${value}`);
+  writeEnvLines(out);
+}
+
+function clearEnvKey(_key) {
+  const lines = readEnvLines().filter((line) => !line.match(/^ORCAROUTER_API_KEY\s*=/));
+  writeEnvLines(lines);
+}
+
+// (readEnvKey is intentionally not exported — the store's read() covers status.)
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+  exec(`"${cmd}" "${url}"`, () => {});
+}
+
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) =>
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    })
+  );
+}
+
+function fail(msg) {
+  console.error(`✗ ${msg}`);
+  process.exit(1);
+}
+
+function status() {
+  // Read through a file-backed store: a key saved to .env by either
+  // connection path must show up in a later process without requiring export.
+  const { OrcaCredentialStore } = require("../src/clients/orcarouter-credentials");
+  const env = statusEnv();
+  const store = new OrcaCredentialStore({
+    env,
+    loadSecret: () => env.ORCAROUTER_API_KEY || null,
+  });
+  const st = store.read();
+  console.log(st.present
+    ? `OrcaRouter credential: ${st.masked} (generation ${st.generation})${st.needsReauth ? " — needs reauthentication" : ""}`
+    : "No OrcaRouter credential configured.");
+  console.log(`  API base:  ${resolveApiBase(env)}`);
+  console.log(`  Auth base: ${resolveAuthBase(env)}`);
+}
+
+async function runConnect(opts) {
+  const store = getCredentialStore();
+
+  // Adapter A: update/clear an API key directly through the seam too.
+  if (opts.apiKey) {
+    const adapter = createApiKeyAdapter(store, { env: process.env });
+    const cred = adapter.set(opts.apiKey);
+    upsertEnvKey("ORCAROUTER_API_KEY", cred.key);
+    console.log(`✓ OrcaRouter API key saved (${maskKey(cred.key)}).`);
+    return;
+  }
+  if (opts.clear) {
+    store.clear();
+    clearEnvKey("ORCAROUTER_API_KEY");
+    console.log("✓ OrcaRouter credential cleared.");
+    return;
+  }
+  if (opts.status) {
+    status();
+    return;
+  }
+
+  // PKCE connect. Generate verifier+state fresh; hand back the authorize URL.
+  const started = await connectWithPkce({ appName: "Lynkr" });
+  if (!started.ok) fail(started.error?.message || "Could not start OrcaRouter login");
+
+  console.log("\n1. Open this URL in your browser (opening automatically…):");
+  console.log(`   ${started.authorizeUrl}\n`);
+  openBrowser(started.authorizeUrl);
+
+  const code = opts.code || (await ask("2. Paste the one-time code from the consent screen: ")).trim();
+  if (!code) fail("No code provided.");
+
+  // Exchange the code for the durable key using the SAME verifier that
+  // produced the challenge (PKCE binding — a fresh verifier would mismatch).
+  const result = await connectWithPkce({ appName: "Lynkr", code, verifier: started.verifier, state: started.state });
+  if (!result.ok) {
+    fail(result.error?.message || `OrcaRouter exchange failed (HTTP ${result.error?.status || "?"})`);
+  }
+  upsertEnvKey("ORCAROUTER_API_KEY", result.credential.key);
+  const scopeNote = result.credential.scope && result.credential.scope !== "api"
+    ? ` (granted scope: ${result.credential.scope})`
+    : "";
+  console.log(`\n✓ Connected to OrcaRouter. Key saved to .env${scopeNote}.`);
+  console.log(`  Masked: ${maskKey(result.credential.key)}`);
+  console.log("  Revoke anytime at https://www.orcarouter.ai/console/authorized-apps");
+}
+
+function parseArgs(argv) {
+  const opts = { apiKey: null, code: null, status: false, clear: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--status") opts.status = true;
+    else if (a === "--clear") opts.clear = true;
+    else if (a === "--api-key") opts.apiKey = argv[++i];
+    else if (a === "--code") opts.code = argv[++i];
+  }
+  return opts;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`lynkr connect orcarouter — OAuth 2.0 + PKCE login for the OrcaRouter provider
+
+Usage:
+  lynkr connect orcarouter                  Interactive out-of-band code login
+  lynkr connect orcarouter --code <code>    Non-interactive (paste the consent code)
+  lynkr connect orcarouter --api-key <key>  Save an existing sk-orca-… API key
+  lynkr connect orcarouter --status         Show masked credential status
+  lynkr connect orcarouter --clear          Remove the stored credential`);
+    return;
+  }
+  return runConnect(parseArgs(args));
+}
+
+if (require.main === module || process.env._LYNKR_SUBCMD === "connect") {
+  main().catch((err) => fail(err.message));
+}
+
+module.exports = { runConnect, parseArgs, upsertEnvKey, clearEnvKey, readEnvKey, statusEnv, status };

package/bin/lynkr-init.js

@@ -188,12 +188,23 @@ const PROVIDERS = {
     extras: [],
     defaultModel: 'accounts/fireworks/models/kimi-k2-instruct-0905',
   },
+  orcarouter: {
+    label: 'OrcaRouter (OpenAI-compatible gateway — adaptive routing, failover, zero-markup inference)',
+    local: false,
+    creds: [
+      { key: 'ORCAROUTER_API_KEY', label: 'OrcaRouter API key (sk-orca-...; or run `lynkr connect orcarouter` for OAuth + PKCE login)', secret: true },
+    ],
+    extras: [
+      { key: 'ORCAROUTER_MODEL', label: 'default model', default: 'orcarouter/auto' },
+    ],
+    defaultModel: 'orcarouter/auto',
+  },
 };
 
 const PROVIDER_ORDER = [
   'ollama', 'llamacpp', 'lmstudio',
   'azure-anthropic', 'azure-openai', 'openai', 'atlas', 'openrouter', 'edenai',
-  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks',
+  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks', 'orcarouter',
 ];
 const TIERS = ['SIMPLE', 'MEDIUM', 'COMPLEX', 'REASONING'];
 
@@ -354,6 +365,9 @@ const BASELINE_ENV = {
   FIREWORKS_API_KEY: '',
   FIREWORKS_ENDPOINT: 'https://api.fireworks.ai/inference/v1/chat/completions',
   FIREWORKS_MODEL: 'accounts/fireworks/models/kimi-k2-instruct-0905',
+  ORCAROUTER_API_KEY: '',
+  ORCAROUTER_MODEL: 'orcarouter/auto',
+  ORCAROUTER_ENDPOINT: 'https://api.orcarouter.ai/v1/chat/completions',
   LLAMACPP_ENDPOINT: 'http://localhost:8080',
   LLAMACPP_MODEL: 'default',
   LLAMACPP_TIMEOUT_MS: '120000',

package/config/model-capability-seeds.json

@@ -7,6 +7,7 @@
     "claude-opus-3*": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "claude-sonnet-4*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.78 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate" },
     "claude-sonnet-3.5": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "orcarouter-auto": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.82 }, "sources": ["provider-routing:adaptive auto"], "note": "curated-estimate: orcarouter/auto routes across frontier models per request" },
     "claude-3.5-sonnet*": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-sonnet-20241022) shares claude-sonnet-3.5 caps" },
     "claude-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "claude-3.5-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-haiku-20241022) shares claude-haiku caps" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lynkr",
-  "version": "9.14.11",
+  "version": "9.14.12",
   "files": [
     "index.js",
     "install.sh",

package/src/api/openai-router.js

@@ -986,9 +986,10 @@ router.post("/chat/completions", async (req, res) => {
 
 /**
  * Get all configured providers with their models (cc-relay style)
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter contributes its live capability-filtered chat catalog.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   if (config.databricks?.url && config.databricks?.apiKey) {
@@ -1156,6 +1157,23 @@ function getConfiguredProviders() {
     });
   }
 
+  // OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog fetch (authoritative when the account key
+  // works), with a verified seed fallback. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        models: models.map(m => m.id),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter discovery failed — omitting from OpenAI /v1/models");
+    }
+  }
+
   if (config.vertex?.projectId) {
     providers.push({
       name: "vertex",
@@ -1178,9 +1196,9 @@ function getConfiguredProviders() {
  * List available models from ALL configured providers (cc-relay style).
  * Returns OpenAI-compatible model list with provider field.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const timestamp = Math.floor(Date.now() / 1000);
     const models = [];
     const seenModelIds = new Set();

package/src/api/providers-handler.js

@@ -17,9 +17,11 @@ const router = express.Router();
 
 /**
  * Get all configured providers with their models
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter's model list is a live capability-filtered catalog fetch
+ * (authoritative when the account key works), with a verified seed fallback.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   // Check Databricks
@@ -253,6 +255,27 @@ function getConfiguredProviders() {
     });
   }
 
+  // Check OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog (text chat) — authoritative when discovery
+  // succeeds, verified seed otherwise. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models, source, degraded } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        baseUrl: `${config.orcarouter.apiBaseUrl || "https://api.orcarouter.ai"}/v1`,
+        enabled: true,
+        catalog_source: source,
+        catalog_degraded: degraded,
+        models: models.map(m => ({ id: m.id, name: m.name || m.id })),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter provider discovery failed — omitting from /v1/models");
+    }
+  }
+
   // Check Vertex AI (Google Cloud)
   if (config.vertex?.projectId) {
     const region = config.vertex.region || "us-east5";
@@ -287,9 +310,9 @@ function getPrimaryProvider() {
  * Anthropic-compatible model listing endpoint (cc-relay style).
  * Lists all available models from all configured providers.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const timestamp = Math.floor(Date.now() / 1000);
 
@@ -344,9 +367,9 @@ router.get("/models", (req, res) => {
  * Provider listing endpoint (cc-relay style).
  * Lists all configured providers with their metadata and models.
  */
-router.get("/providers", (req, res) => {
+router.get("/providers", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const fallbackProvider = config.modelProvider?.fallbackProvider;
 
@@ -391,10 +414,10 @@ router.get("/providers", (req, res) => {
  *
  * Get details for a specific provider.
  */
-router.get("/providers/:name", (req, res) => {
+router.get("/providers/:name", async (req, res) => {
   try {
     const providerName = req.params.name.toLowerCase();
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const provider = providers.find(p => p.name === providerName);
 
     if (!provider) {
@@ -435,9 +458,9 @@ router.get("/providers/:name", (req, res) => {
  *
  * Get current configuration summary (without sensitive data).
  */
-router.get("/config", (req, res) => {
+router.get("/config", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
 
     res.json({
       model_provider: config.modelProvider?.type || "databricks",

package/src/clients/databricks.js

@@ -2893,6 +2893,137 @@ function sanitizeSchemaForGemini(schema) {
   return sanitized;
 }
 
+/**
+ * OrcaRouter Provider (OpenAI-compatible gateway)
+ *
+ * OrcaRouter exposes an OpenAI-compatible Chat Completions API at
+ * https://api.orcarouter.ai/v1/chat/completions with Bearer-token auth.
+ * Modeled on invokeFireworks/invokeAtlas: request side reuses the shared
+ * openrouter-utils converters, streaming returns the raw OpenAI SSE stream
+ * (orcarouter is in DEFAULT_OPENAI_SSE_PROVIDERS), buffered responses are
+ * converted to Anthropic shape locally so the orchestrator branch is a plain
+ * passthrough.
+ *
+ * The key comes from the credential seam (src/clients/orcarouter-credentials):
+ * either a user-pasted sk-orca-… key or a key issued via OAuth 2.0 + PKCE.
+ * Downstream code never knows which source produced it.
+ */
+async function invokeOrcaRouter(body, _incomingHeaders = {}) {
+  const {
+    convertAnthropicToolsToOpenRouter,
+    convertAnthropicMessagesToOpenRouter
+  } = require("./openrouter-utils");
+  const { chatCompletionsUrl } = require("./orcarouter-catalog");
+
+  const apiKey = config.orcarouter?.apiKey;
+  if (!apiKey) {
+    throw new Error("OrcaRouter API key is not configured. Run `lynkr connect orcarouter` or set ORCAROUTER_API_KEY in your .env file.");
+  }
+
+  // Defense in depth: never send the Bearer key over remote plaintext HTTP.
+  // chatCompletionsUrl() already validates the base; validate an explicit
+  // ORCAROUTER_ENDPOINT override here too (config is lazy by design).
+  try {
+    const { assertAllowedOrigin } = require("./orcarouter-credentials");
+    const epOrigin = new URL(config.orcarouter?.endpoint || chatCompletionsUrl(config.orcarouter?.apiBaseUrl)).origin;
+    assertAllowedOrigin(epOrigin, { allowHttpLoopback: true });
+  } catch (err) {
+    throw new Error(`OrcaRouter endpoint rejected: ${err.message}`);
+  }
+
+  const endpoint = config.orcarouter?.endpoint || chatCompletionsUrl(config.orcarouter?.apiBaseUrl || "https://api.orcarouter.ai");
+
+  const requestedModel = body._tierModel || body.model || config.orcarouter?.model || "orcarouter/auto";
+  const messages = convertAnthropicMessagesToOpenRouter(body.messages || []);
+
+  if (body.system) {
+    const systemContent = Array.isArray(body.system)
+      ? body.system.map(s => s.text || s).join("\n")
+      : body.system;
+    messages.unshift({ role: "system", content: systemContent });
+  }
+
+  const { resolveThinkingParam } = require("./provider-capabilities");
+  const orcaBody = {
+    model: requestedModel,
+    messages,
+    max_tokens: body.max_tokens || 16384,
+    temperature: body.temperature ?? 0.7,
+    top_p: body.top_p ?? 1.0,
+    thinking: resolveThinkingParam(body),
+    stream: body.stream ?? false,
+  };
+
+  if (Array.isArray(body.tools) && body.tools.length > 0) {
+    orcaBody.tools = convertAnthropicToolsToOpenRouter(body.tools);
+    orcaBody.tool_choice = "auto";
+    orcaBody.parallel_tool_calls = false;
+  }
+
+  const headers = {
+    "Content-Type": "application/json",
+    "Authorization": `Bearer ${apiKey}`,
+  };
+
+  logger.debug({
+    endpoint,
+    model: orcaBody.model,
+    originalModel: requestedModel,
+    messageCount: orcaBody.messages?.length || 0,
+    hasTools: !!orcaBody.tools,
+    toolCount: orcaBody.tools?.length || 0,
+  }, "=== OrcaRouter REQUEST ===");
+
+  // Same pre-return 429 check as the other OpenAI-compatible providers:
+  // performJsonRequest's streaming branch never throws on a bad status, so a
+  // 429 would otherwise be silently handed back as a "successful" response
+  // and tier-fallback would never climb. Like Atlas Cloud, chat completions
+  // are billable POSTs and are never replayed automatically — callers can
+  // retry explicitly with their own idempotency policy; only 429 escalates
+  // to tier-fallback.
+  const response = await performJsonRequest(endpoint, {
+    headers,
+    body: orcaBody,
+    maxRetriesOverride: 0,
+    retryableStatusesOverride: [],
+  }, "OrcaRouter");
+
+  // A 401 means the durable key was revoked (there is no refresh grant).
+  // Mark the exact credential generation needsReauth — the UI/status command
+  // surfaces it and the user re-runs `lynkr connect orcarouter`. No retry
+  // loop, no fake refresh.
+  if (response && !response.ok && response.status === 401) {
+    try {
+      const { getCredentialStore } = require("./orcarouter-credentials");
+      getCredentialStore().markRejected(apiKey, null);
+    } catch { /* reauth marking is best-effort — never fail the request path */ }
+  }
+
+  if (!response.ok && response.status === 429) {
+    const err = new Error(`OrcaRouter rate-limited: ${String(response.json?.error?.message || '').slice(0, 120)}`);
+    err.status = 429;
+    throw err;
+  }
+
+  if (response?.stream) {
+    return response;
+  }
+
+  if (response?.ok && response?.json) {
+    const anthropicJson = convertOpenAIToAnthropic(response.json);
+    return {
+      ok: response.ok,
+      status: response.status,
+      json: anthropicJson,
+      text: JSON.stringify(anthropicJson),
+      contentType: "application/json",
+      headers: response.headers,
+    };
+  }
+
+  return response;
+}
+
 /**
  * Vertex AI Provider - Gemini Models
  *
@@ -3370,6 +3501,7 @@ const PROVIDER_INVOKERS = {
   codex: invokeCodex,
   baidu: invokeBaidu,
   fireworks: invokeFireworks,
+  orcarouter: invokeOrcaRouter,
 };
 
 function invokeProvider(provider, body, incomingHeaders) {
@@ -4241,6 +4373,7 @@ module.exports = {
   invokeBaidu,
   invokeFireworks,
   invokeAtlas,
+  invokeOrcaRouter,
   PROVIDER_INVOKERS,
   stripLynkrBadges,
   destroyHttpAgents,