lynkr 9.14.11 → 9.14.13

package/README.md

@@ -211,6 +211,7 @@ Claude Code / Cursor / Codex / Cline / Continue
 | **llama.cpp** | Local | Any GGUF model | **Free** |
 | **LM Studio** | Local | Local models with GUI | **Free** |
 | **OpenRouter** | Cloud | GPT-4o, Claude 3.5, Llama 3, Gemini | $ |
+| **OrcaRouter** | Cloud | Chat, reasoning, image, video (one endpoint, live catalog) | $ (zero-markup) |
 | **AWS Bedrock** | Cloud | Claude, Llama, Mistral, Titan | $$ |
 | **Databricks** | Cloud | Claude Sonnet 4.5, Opus 4.6 | $$$ |
 | **Azure OpenAI** | Cloud | GPT-4o, o1, o3 | $$$ |

package/bin/cli.js

@@ -15,6 +15,7 @@ const SUBCOMMANDS = {
   "desktop-token": path.join(__dirname, "lynkr-desktop-token.js"),
   restart:       path.join(__dirname, "lynkr-restart.js"),
   run:           path.join(__dirname, "run.js"),
+  connect:       path.join(__dirname, "lynkr-connect-orcarouter.js"),
 };
 
 const sub = process.argv[2];

package/bin/lynkr-connect-orcarouter.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+/**
+ * `lynkr connect orcarouter` — OAuth 2.0 + PKCE (Flow B, out-of-band) login.
+ *
+ * Lynkr is self-hosted software whose install address differs on every
+ * deployment (LAN box, NAS, moved port), so there is no predictable loopback
+ * port to register — Flow B (out-of-band code) exists precisely for that
+ * case. The command:
+ *
+ *   1. Generates a fresh PKCE verifier + CSRF state (crypto RNG, per attempt).
+ *   2. Prints an authorize URL (callback_url=oob, S256 challenge) and opens
+ *      it in the default browser when possible.
+ *   3. Asks for the one-time code shown on the consent screen.
+ *   4. Exchanges it at www.orcarouter.ai/api/v1/auth/keys for a durable
+ *      OrcaRouter API key that belongs to the user.
+ *   5. Persists the key to the project's .env (same secret location as every
+ *      other Lynkr provider key) and prints the masked status.
+ *
+ * The verifier never leaves the process until the exchange; it never appears
+ * in a URL, a log, or an error. Auth requests hit the auth origin
+ * (www.orcarouter.ai) only; inference stays on api.orcarouter.ai/v1.
+ *
+ * Usage:
+ *   lynkr connect orcarouter                  # interactive OOB code login
+ *   lynkr connect orcarouter --code <code>   # non-interactive (CI / GUI)
+ *   lynkr connect orcarouter --status        # masked status of stored key
+ *   lynkr connect orcarouter --clear         # remove the stored key
+ *
+ * @module bin/lynkr-connect-orcarouter
+ */
+
+const path = require("path");
+const fs = require("fs");
+const readline = require("readline");
+const { exec } = require("child_process");
+
+const ROOT = path.join(__dirname, "..");
+const ENV_PATH = path.join(ROOT, ".env");
+const {
+  connectWithPkce,
+  getCredentialStore,
+  createApiKeyAdapter,
+  maskKey,
+  resolveAuthBase,
+  resolveApiBase,
+} = require("../src/clients/orcarouter-credentials");
+
+// ---------------------------------------------------------------------------
+// .env persistence — the project's existing secret location. No new secret
+// store is introduced. Keys are written as `ORCAROUTER_API_KEY=...` alongside
+// the other provider keys; existing keys are updated in place.
+// ---------------------------------------------------------------------------
+
+function readEnvLines() {
+  try {
+    return fs.existsSync(ENV_PATH) ? fs.readFileSync(ENV_PATH, "utf8").split(/\r?\n/) : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeEnvLines(lines) {
+  fs.writeFileSync(ENV_PATH, lines.join("\n") + "\n", { mode: 0o600 });
+  // mode only applies on creation — tighten existing files explicitly so a
+  // previously 0644 .env doesn't leave the new OAuth key world-readable.
+  try {
+    fs.chmodSync(ENV_PATH, 0o600);
+  } catch {
+    /* best-effort: e.g. read-only FS in CI */
+  }
+}
+
+function readEnvKey(key) {
+  try {
+    const lines = readEnvLines();
+    for (const line of lines) {
+      const m = line.match(/^([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
+      if (m && m[1] === key) {
+        const v = (m[2] || "").trim();
+        return v || null;
+      }
+    }
+  } catch {
+    /* missing/unreadable .env → no file-backed value */
+  }
+  return null;
+}
+
+// File-backed env for status: process.env wins, .env file is the fallback so
+// a key saved by a previous `connect` process is visible without re-export.
+function statusEnv() {
+  const env = { ...process.env };
+  for (const k of ["ORCAROUTER_API_KEY", "ORCA_API_BASE_URL", "ORCA_AUTH_BASE_URL", "ORCA_BASE_URL"]) {
+    if (!env[k]) {
+      const v = readEnvKey(k);
+      if (v) env[k] = v;
+    }
+  }
+  return env;
+}
+
+function upsertEnvKey(key, value) {
+  const lines = readEnvLines();
+  let replaced = false;
+  const out = lines.map((line) => {
+    const m = line.match(/^([A-Z0-9_]+)\s*=/);
+    if (m && m[1] === key) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) out.push(`${key}=${value}`);
+  writeEnvLines(out);
+}
+
+function clearEnvKey(_key) {
+  const lines = readEnvLines().filter((line) => !line.match(/^ORCAROUTER_API_KEY\s*=/));
+  writeEnvLines(lines);
+}
+
+// (readEnvKey is intentionally not exported — the store's read() covers status.)
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+  exec(`"${cmd}" "${url}"`, () => {});
+}
+
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) =>
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    })
+  );
+}
+
+function fail(msg) {
+  console.error(`✗ ${msg}`);
+  process.exit(1);
+}
+
+function status() {
+  // Read through a file-backed store: a key saved to .env by either
+  // connection path must show up in a later process without requiring export.
+  const { OrcaCredentialStore } = require("../src/clients/orcarouter-credentials");
+  const env = statusEnv();
+  const store = new OrcaCredentialStore({
+    env,
+    loadSecret: () => env.ORCAROUTER_API_KEY || null,
+  });
+  const st = store.read();
+  console.log(st.present
+    ? `OrcaRouter credential: ${st.masked} (generation ${st.generation})${st.needsReauth ? " — needs reauthentication" : ""}`
+    : "No OrcaRouter credential configured.");
+  console.log(`  API base:  ${resolveApiBase(env)}`);
+  console.log(`  Auth base: ${resolveAuthBase(env)}`);
+}
+
+async function runConnect(opts) {
+  const store = getCredentialStore();
+
+  // Adapter A: update/clear an API key directly through the seam too.
+  if (opts.apiKey) {
+    const adapter = createApiKeyAdapter(store, { env: process.env });
+    const cred = adapter.set(opts.apiKey);
+    upsertEnvKey("ORCAROUTER_API_KEY", cred.key);
+    console.log(`✓ OrcaRouter API key saved (${maskKey(cred.key)}).`);
+    return;
+  }
+  if (opts.clear) {
+    store.clear();
+    clearEnvKey("ORCAROUTER_API_KEY");
+    console.log("✓ OrcaRouter credential cleared.");
+    return;
+  }
+  if (opts.status) {
+    status();
+    return;
+  }
+
+  // PKCE connect. Generate verifier+state fresh; hand back the authorize URL.
+  const started = await connectWithPkce({ appName: "Lynkr" });
+  if (!started.ok) fail(started.error?.message || "Could not start OrcaRouter login");
+
+  console.log("\n1. Open this URL in your browser (opening automatically…):");
+  console.log(`   ${started.authorizeUrl}\n`);
+  openBrowser(started.authorizeUrl);
+
+  const code = opts.code || (await ask("2. Paste the one-time code from the consent screen: ")).trim();
+  if (!code) fail("No code provided.");
+
+  // Exchange the code for the durable key using the SAME verifier that
+  // produced the challenge (PKCE binding — a fresh verifier would mismatch).
+  const result = await connectWithPkce({ appName: "Lynkr", code, verifier: started.verifier, state: started.state });
+  if (!result.ok) {
+    fail(result.error?.message || `OrcaRouter exchange failed (HTTP ${result.error?.status || "?"})`);
+  }
+  upsertEnvKey("ORCAROUTER_API_KEY", result.credential.key);
+  const scopeNote = result.credential.scope && result.credential.scope !== "api"
+    ? ` (granted scope: ${result.credential.scope})`
+    : "";
+  console.log(`\n✓ Connected to OrcaRouter. Key saved to .env${scopeNote}.`);
+  console.log(`  Masked: ${maskKey(result.credential.key)}`);
+  console.log("  Revoke anytime at https://www.orcarouter.ai/console/authorized-apps");
+}
+
+function parseArgs(argv) {
+  const opts = { apiKey: null, code: null, status: false, clear: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--status") opts.status = true;
+    else if (a === "--clear") opts.clear = true;
+    else if (a === "--api-key") opts.apiKey = argv[++i];
+    else if (a === "--code") opts.code = argv[++i];
+  }
+  return opts;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`lynkr connect orcarouter — OAuth 2.0 + PKCE login for the OrcaRouter provider
+
+Usage:
+  lynkr connect orcarouter                  Interactive out-of-band code login
+  lynkr connect orcarouter --code <code>    Non-interactive (paste the consent code)
+  lynkr connect orcarouter --api-key <key>  Save an existing sk-orca-… API key
+  lynkr connect orcarouter --status         Show masked credential status
+  lynkr connect orcarouter --clear          Remove the stored credential`);
+    return;
+  }
+  return runConnect(parseArgs(args));
+}
+
+if (require.main === module || process.env._LYNKR_SUBCMD === "connect") {
+  main().catch((err) => fail(err.message));
+}
+
+module.exports = { runConnect, parseArgs, upsertEnvKey, clearEnvKey, readEnvKey, statusEnv, status };

package/bin/lynkr-init.js

@@ -188,12 +188,23 @@ const PROVIDERS = {
     extras: [],
     defaultModel: 'accounts/fireworks/models/kimi-k2-instruct-0905',
   },
+  orcarouter: {
+    label: 'OrcaRouter (OpenAI-compatible gateway — adaptive routing, failover, zero-markup inference)',
+    local: false,
+    creds: [
+      { key: 'ORCAROUTER_API_KEY', label: 'OrcaRouter API key (sk-orca-...; or run `lynkr connect orcarouter` for OAuth + PKCE login)', secret: true },
+    ],
+    extras: [
+      { key: 'ORCAROUTER_MODEL', label: 'default model', default: 'orcarouter/auto' },
+    ],
+    defaultModel: 'orcarouter/auto',
+  },
 };
 
 const PROVIDER_ORDER = [
   'ollama', 'llamacpp', 'lmstudio',
   'azure-anthropic', 'azure-openai', 'openai', 'atlas', 'openrouter', 'edenai',
-  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks',
+  'databricks', 'bedrock', 'vertex', 'zai', 'moonshot', 'baidu', 'fireworks', 'orcarouter',
 ];
 const TIERS = ['SIMPLE', 'MEDIUM', 'COMPLEX', 'REASONING'];
 
@@ -354,6 +365,9 @@ const BASELINE_ENV = {
   FIREWORKS_API_KEY: '',
   FIREWORKS_ENDPOINT: 'https://api.fireworks.ai/inference/v1/chat/completions',
   FIREWORKS_MODEL: 'accounts/fireworks/models/kimi-k2-instruct-0905',
+  ORCAROUTER_API_KEY: '',
+  ORCAROUTER_MODEL: 'orcarouter/auto',
+  ORCAROUTER_ENDPOINT: 'https://api.orcarouter.ai/v1/chat/completions',
   LLAMACPP_ENDPOINT: 'http://localhost:8080',
   LLAMACPP_MODEL: 'default',
   LLAMACPP_TIMEOUT_MS: '120000',

package/config/difficulty-anchors.json

@@ -12,11 +12,21 @@
   "substantive": [
     "Review this retry helper for bugs and race conditions",
     "give me a plan to refactor this code",
-    "Read the current repo and explain it to me"
+    "Read the current repo and explain it to me",
+    "Implement a distributed rate limiter with Redis",
+    "Run the unit tests and summarize failures",
+    "What does this function do",
+    "List the exports from this file",
+    "Fix the linter warnings",
+    "Add error handling to this try block",
+    "Write a test for the login function",
+    "Debug this null reference error"
   ],
   "heavyweight": [
     "Do an architecture review of the orchestrator",
     "analyze every module in src/ for circular dependencies and give me a dependency-order refactor plan",
-    "design a horizontally scalable architecture for this service with failure-mode analysis"
+    "design a horizontally scalable architecture for this service with failure-mode analysis",
+    "Compare how databricks.js and openai-format.js each handle non-2xx upstream responses, then propose a unified error-normalization helper both could share",
+    "Code review the PR #84 routing hardening changes"
   ]
 }

package/config/model-capability-seeds.json

@@ -6,9 +6,14 @@
     "claude-opus-4*": { "caps": { "reasoning": 0.9, "codegen": 0.9, "debugging": 0.9, "tool_use": 0.9 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate: flagship tier" },
     "claude-opus-3*": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "claude-sonnet-4*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.78 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate" },
+    "claude-sonnet-5*": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.78 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: 4.5 successor (Active per Anthropic deprecations table); sized just above sonnet-4.5 — promote on benchmark rows" },
+    "claude-sonnet": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.78 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "alias: bare family id shares claude-sonnet-4 caps" },
+    "claude-opus": { "caps": { "reasoning": 0.9, "codegen": 0.9, "debugging": 0.9, "tool_use": 0.9 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "alias: bare family id shares claude-opus-4 caps" },
     "claude-sonnet-3.5": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "orcarouter-auto": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.82 }, "sources": ["provider-routing:adaptive auto"], "note": "curated-estimate: orcarouter/auto routes across frontier models per request" },
     "claude-3.5-sonnet*": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-sonnet-20241022) shares claude-sonnet-3.5 caps" },
     "claude-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "claude-haiku": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "alias: bare family id shares claude-haiku caps (matters: heuristic rates bare haiku 0.5, overstating it)" },
     "claude-3.5-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-haiku-20241022) shares claude-haiku caps" },
     "gpt-5.6*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },
     "gpt-5.4*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lynkr",
-  "version": "9.14.11",
+  "version": "9.14.13",
   "files": [
     "index.js",
     "install.sh",
@@ -38,7 +38,7 @@
     "start:supervised": "while true; do node index.js 2>&1 | npx pino-pretty --sync; code=$?; echo \"[supervisor] lynkr exited ($code) — restarting in 3s\"; sleep 3; done",
     "lint": "eslint src index.js",
     "test": "npm run test:unit && npm run test:performance",
-    "test:unit": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com LOG_FILE_ENABLED=false node --test test/routing.test.js test/hybrid-routing-integration.test.js test/retry-logic.test.js test/sse-transformer.test.js test/passthrough-stream.test.js test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js test/azure-openai-config.test.js test/azure-openai-format-conversion.test.js test/azure-openai-routing.test.js test/azure-openai-streaming.test.js test/azure-openai-error-resilience.test.js test/azure-openai-integration.test.js test/openai-integration.test.js test/atlas-integration.test.js test/toon-compression.test.js test/gcf-compression.test.js test/llamacpp-integration.test.js test/resilience.test.js test/telemetry-routing.test.js test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js test/distill.test.js test/large-payload.test.js test/prompt-cache-injection.test.js test/risk-analyzer.test.js test/interaction-block.test.js test/preflight.test.js test/token-reduction.test.js test/session-affinity.test.js test/cache-state.test.js test/cache-switch-cost.test.js test/lens-recommendations.test.js test/model-registry-cost.test.js test/output-format-guard.test.js test/tier-fallback.test.js test/wrap.test.js test/init.test.js test/tool-call-response-metadata.test.js test/degradation.test.js test/routing-telemetry-columns.test.js test/sticky-routing.test.js test/knn-ambiguous-escalate.test.js test/deescalator.test.js test/client-profiles.test.js test/strip-internal-fields.test.js test/complexity-tool-subtraction.test.js test/bandit.test.js test/routing-propensity.test.js test/reward-pipeline.test.js test/knn-cold-start.test.js test/calibration.test.js test/feedback-loop.test.js test/session-fingerprint.test.js test/side-request-guards.test.js test/verifier.test.js test/intent-score.test.js test/difficulty-classifier.test.js test/classifier-setup.test.js test/usage-stats.test.js test/loop-guard.test.js test/moonshot-model-mapping.test.js test/baidu-model-mapping.test.js test/tenant-policy-ingress-parity.test.js test/decide.test.js test/embeddings-degradation.test.js test/health-probe.test.js test/stuck-detector.test.js test/onnx-embedder.test.js test/ope.test.js test/hierarchical-budget.test.js test/token-rate-limit.test.js test/otel-export.test.js test/mcp-broker.test.js test/compression-budget.test.js test/gpt-utils.test.js test/dedup-observe-only.test.js test/context-window-header.test.js test/token-budget-auto.test.js test/opencode-setup.test.js test/auth-mode-first-party.test.js",
+    "test:unit": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com LOG_FILE_ENABLED=false node --test test/routing.test.js test/hybrid-routing-integration.test.js test/retry-logic.test.js test/sse-transformer.test.js test/passthrough-stream.test.js test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js test/azure-openai-config.test.js test/azure-openai-format-conversion.test.js test/azure-openai-routing.test.js test/azure-openai-streaming.test.js test/azure-openai-error-resilience.test.js test/azure-openai-integration.test.js test/openai-integration.test.js test/atlas-integration.test.js test/toon-compression.test.js test/gcf-compression.test.js test/llamacpp-integration.test.js test/resilience.test.js test/telemetry-routing.test.js test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js test/distill.test.js test/large-payload.test.js test/prompt-cache-injection.test.js test/risk-analyzer.test.js test/interaction-block.test.js test/preflight.test.js test/token-reduction.test.js test/session-affinity.test.js test/cache-state.test.js test/cache-switch-cost.test.js test/lens-recommendations.test.js test/model-registry-cost.test.js test/output-format-guard.test.js test/tier-fallback.test.js test/wrap.test.js test/init.test.js test/tool-call-response-metadata.test.js test/degradation.test.js test/routing-telemetry-columns.test.js test/sticky-routing.test.js test/knn-ambiguous-escalate.test.js test/deescalator.test.js test/client-profiles.test.js test/strip-internal-fields.test.js test/complexity-tool-subtraction.test.js test/bandit.test.js test/routing-propensity.test.js test/reward-pipeline.test.js test/knn-cold-start.test.js test/calibration.test.js test/feedback-loop.test.js test/session-fingerprint.test.js test/side-request-guards.test.js test/verifier.test.js test/intent-score.test.js test/difficulty-classifier.test.js test/classifier-setup.test.js test/usage-stats.test.js test/loop-guard.test.js test/moonshot-model-mapping.test.js test/baidu-model-mapping.test.js test/tenant-policy-ingress-parity.test.js test/decide.test.js test/embeddings-degradation.test.js test/health-probe.test.js test/stuck-detector.test.js test/onnx-embedder.test.js test/ope.test.js test/hierarchical-budget.test.js test/token-rate-limit.test.js test/otel-export.test.js test/mcp-broker.test.js test/compression-budget.test.js test/gpt-utils.test.js test/dedup-observe-only.test.js test/context-window-header.test.js test/token-budget-auto.test.js test/opencode-setup.test.js test/auth-mode-first-party.test.js test/jev-router.test.js test/jev-routing.test.js test/force-patterns.test.js test/upstream-fidelity.test.js test/tool-schema-compression.test.js test/passthrough-route.test.js test/quota-ledger.test.js",
     "test:memory": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node --test test/memory/store.test.js test/memory/surprise.test.js test/memory/extractor.test.js test/memory/search.test.js test/memory/retriever.test.js test/memory/distiller.test.js test/memory/distiller-freeze.test.js test/memory/wiki.test.js test/memory/skills-cache.test.js test/memory/tencentdb-launcher.test.js",
     "test:new-features": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node --test test/passthrough-mode.test.js test/openrouter-error-resilience.test.js test/format-conversion.test.js",
     "test:performance": "LYNKR_KNN_DIR=/tmp/lynkr-test-knn DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node test/hybrid-routing-performance.test.js && DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com node test/performance-tests.js",
@@ -122,6 +122,6 @@
   "allowScripts": {},
   "overrides": {
     "sharp": "^0.35.4",
-    "adm-zip": "^0.6.0"
+    "adm-zip": "^0.6.1"
   }
 }

package/scripts/validate-intent-anchors.js

@@ -56,14 +56,14 @@ const EVAL_SET = [
   { text: "Refactor this into smaller functions", target: "MEDIUM" },
   // COMPLEX (GLM)
   { text: "Do an architecture review of the orchestrator", target: "COMPLEX" },
-  { text: "Review this retry helper for bugs", target: "COMPLEX" },
+  { text: "Review this retry helper for bugs", target: "MEDIUM" }, // near-paraphrase of a substantive anchor — single-file review, not systemic work (retargeted 2026-09-21)
   { text: "Refactor the entire ingestion pipeline and give me the plan", target: "COMPLEX" },
   { text: "Design a horizontally scalable architecture for the router", target: "COMPLEX" },
   { text: "Code review the PR #84 routing hardening changes", target: "COMPLEX" },
   { text: "Analyze every module in src/ for circular dependencies", target: "COMPLEX" },
   { text: "Debug this complex race condition in the connection pool", target: "COMPLEX" },
   { text: "Plan a zero-downtime migration to the new schema", target: "COMPLEX" },
-  { text: "Implement a distributed rate limiter with Redis", target: "COMPLEX" },
+  { text: "Implement a distributed rate limiter with Redis", target: "MEDIUM" }, // single-component build with a named tech — implementation, not design (retargeted 2026-09-21)
   { text: "Design the caching strategy for this API gateway", target: "COMPLEX" },
   // REASONING (Claude)
   { text: "Prove the correctness of this lock-free queue implementation", target: "REASONING" },

package/src/api/openai-router.js

@@ -986,9 +986,10 @@ router.post("/chat/completions", async (req, res) => {
 
 /**
  * Get all configured providers with their models (cc-relay style)
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter contributes its live capability-filtered chat catalog.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   if (config.databricks?.url && config.databricks?.apiKey) {
@@ -1156,6 +1157,23 @@ function getConfiguredProviders() {
     });
   }
 
+  // OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog fetch (authoritative when the account key
+  // works), with a verified seed fallback. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        models: models.map(m => m.id),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter discovery failed — omitting from OpenAI /v1/models");
+    }
+  }
+
   if (config.vertex?.projectId) {
     providers.push({
       name: "vertex",
@@ -1178,9 +1196,9 @@ function getConfiguredProviders() {
  * List available models from ALL configured providers (cc-relay style).
  * Returns OpenAI-compatible model list with provider field.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const timestamp = Math.floor(Date.now() / 1000);
     const models = [];
     const seenModelIds = new Set();

package/src/api/providers-handler.js

@@ -17,9 +17,11 @@ const router = express.Router();
 
 /**
  * Get all configured providers with their models
- * Reads from config (which comes from .env) to discover what's available
+ * Reads from config (which comes from .env) to discover what's available.
+ * OrcaRouter's model list is a live capability-filtered catalog fetch
+ * (authoritative when the account key works), with a verified seed fallback.
  */
-function getConfiguredProviders() {
+async function getConfiguredProviders() {
   const providers = [];
 
   // Check Databricks
@@ -253,6 +255,27 @@ function getConfiguredProviders() {
     });
   }
 
+  // Check OrcaRouter (OpenAI-compatible gateway). The model list is the live
+  // capability-filtered catalog (text chat) — authoritative when discovery
+  // succeeds, verified seed otherwise. Never a hand-written example list.
+  if (config.orcarouter?.apiKey) {
+    try {
+      const { getOrcaChatModels } = require("../clients/orcarouter-catalog");
+      const { models, source, degraded } = await getOrcaChatModels(config.orcarouter, { capability: "chat" });
+      providers.push({
+        name: "orcarouter",
+        type: "orcarouter",
+        baseUrl: `${config.orcarouter.apiBaseUrl || "https://api.orcarouter.ai"}/v1`,
+        enabled: true,
+        catalog_source: source,
+        catalog_degraded: degraded,
+        models: models.map(m => ({ id: m.id, name: m.name || m.id })),
+      });
+    } catch (err) {
+      logger.debug({ err: err.message }, "OrcaRouter provider discovery failed — omitting from /v1/models");
+    }
+  }
+
   // Check Vertex AI (Google Cloud)
   if (config.vertex?.projectId) {
     const region = config.vertex.region || "us-east5";
@@ -287,9 +310,9 @@ function getPrimaryProvider() {
  * Anthropic-compatible model listing endpoint (cc-relay style).
  * Lists all available models from all configured providers.
  */
-router.get("/models", (req, res) => {
+router.get("/models", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const timestamp = Math.floor(Date.now() / 1000);
 
@@ -344,9 +367,9 @@ router.get("/models", (req, res) => {
  * Provider listing endpoint (cc-relay style).
  * Lists all configured providers with their metadata and models.
  */
-router.get("/providers", (req, res) => {
+router.get("/providers", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const primaryProvider = getPrimaryProvider();
     const fallbackProvider = config.modelProvider?.fallbackProvider;
 
@@ -391,10 +414,10 @@ router.get("/providers", (req, res) => {
  *
  * Get details for a specific provider.
  */
-router.get("/providers/:name", (req, res) => {
+router.get("/providers/:name", async (req, res) => {
   try {
     const providerName = req.params.name.toLowerCase();
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
     const provider = providers.find(p => p.name === providerName);
 
     if (!provider) {
@@ -435,9 +458,9 @@ router.get("/providers/:name", (req, res) => {
  *
  * Get current configuration summary (without sensitive data).
  */
-router.get("/config", (req, res) => {
+router.get("/config", async (req, res) => {
   try {
-    const providers = getConfiguredProviders();
+    const providers = await getConfiguredProviders();
 
     res.json({
       model_provider: config.modelProvider?.type || "databricks",