feat: add OrcaRouter gateway descriptor - #2125
Marc-oss-hub wants to merge 1 commit into
Conversation
Add first-class support for OrcaRouter, an OpenAI-compatible model routing gateway, as a generated gateway descriptor with hybrid catalog discovery and curated flagship models (openai/gpt-5.5, anthropic/claude-sonnet-4.6, google/gemini-3.5-flash) plus its orcarouter/auto named router. Registers ORCAROUTER_API_KEY in the env-file allow-list, surfaces the provider in the web provider list and README, and updates the compatibility/registry tests for the new preset. Co-Authored-By: Claude <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (7)
📜 Recent review details🧰 Additional context used📓 Path-based instructions (13)**/*.{ts,tsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{tsx,ts}📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/**/*.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{test,spec}.{ts,tsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{test,spec}.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
⚙️ CodeRabbit configuration file
Files:
{src/services/api/**,src/integrations/**,src/utils/model/**,src/utils/provider*.ts,src/commands/provider/**}⚙️ CodeRabbit configuration file
Files:
{src/**/*.test.ts,src/**/*.test.tsx,tests/**,scripts/**/*.test.ts,vscode-extension/**/*.test.js}⚙️ CodeRabbit configuration file
Files:
{README.md,CONTRIBUTING.md,docs/**,.github/pull_request_template.md}⚙️ CodeRabbit configuration file
Files:
web/**/*.{ts,tsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
web/**/*📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
web/**⚙️ CodeRabbit configuration file
Files:
🧠 Learnings (3)📓 Common learnings📚 Learning: 2026-08-07T01:57:07.096ZApplied to files:
📚 Learning: 2026-08-07T01:57:16.417ZApplied to files:
🔇 Additional comments (8)
📝 WalkthroughWalkthroughChangesAdds OrcaRouter as an OpenAI-compatible provider with API-key authentication, hybrid model discovery, routing presets, compatibility coverage, environment configuration, and web and README documentation. OrcaRouter provider
Estimated code review effort: 3 (Moderate) | ~20 minutes Mergeability Score: ⚪ Minimal · up to This PR adds a localized OrcaRouter provider descriptor and related generated listings without changing existing provider behavior. No actionable merge-blocking risk remains beyond normal review and checks. Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 7✅ Passed checks (7 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
jatmn
left a comment
jatmn
left a comment
There was a problem hiding this comment.
I found issues that need to be addressed before this is ready.
Findings
-
[P1] Persist
/providercredentials under the dedicated OrcaRouter variable
src/integrations/gateways/orcarouter.ts:13-14
This marks the route as accepting onlyORCAROUTER_API_KEY, but the generic profile flow stores the key entered in/provideronly asOPENAI_API_KEY. Applying an OrcaRouter profile therefore leavesresolveRouteCredentialValue('orcarouter')empty, and both discovery and chat requests are unauthenticated; the startup-profile and relaunch paths have the same mismatch. Please add the dedicated-key profile/apply/persist/launch plumbing (as the other dedicated routes do), or do not declare this route dedicated-only. -
[P1] Make the documented environment-only setup select OrcaRouter
README.md:284
resolveEnvOnlyProviderRouteIdhas no OrcaRouter branch, so in a clean environment with onlyORCAROUTER_API_KEYset, the active route remains Anthropic. The advertisedORCAROUTER_API_KEY=... openclaudepath—including the newly allowlisted provider env file—never selects this endpoint or its default model. Please wire safe env-only intent/default resolution for this key, or document the additional provider/base/model configuration that is actually required. -
[P1] Scope the dedicated key to the canonical OrcaRouter endpoint
src/integrations/gateways/orcarouter.ts:33
Authenticated discovery accepts any caller/profile-supplied base URL whileresolveRouteCredentialValuereturns the ambient dedicated key without an OrcaRouter host boundary. A profile retained as routeorcarouterbut edited tohttps://evil.example/v1consequently sendsAuthorization: Bearer <ORCAROUTER_API_KEY>to that host during/modelsdiscovery (and the inference path has the same credential-resolution contract). Please require the canonical OrcaRouter origin/path before using this dedicated credential, following the boundary used by ApiSmart. -
[P1] Clear stale custom-auth state when selecting this fixed Bearer route
src/integrations/gateways/orcarouter.ts:21-22
supportsAuthHeaders: truecombines with the generic provider-flag path to preserveOPENAI_AUTH_HEADER,OPENAI_AUTH_SCHEME, andOPENAI_AUTH_HEADER_VALUEfrom the previous provider. The request executor gives that custom value precedence: after switching with a valid Orca key, a reproduced request omitted Bearer auth and instead sentX-Old-Key: old-provider-secretto OrcaRouter. This both breaks authentication and discloses the prior provider's secret. Please model OrcaRouter's documented fixed Bearer contract and clear unsupported custom-auth state during the switch. -
[P2] Filter discovery to chat-compatible models
src/integrations/gateways/orcarouter.ts:33
Generic OpenAI-compatible discovery keeps every/v1/modelsID and discards OrcaRouter'ssupported_endpoint_typesand output-modality fields. OrcaRouter's catalog also contains image, TTS, embedding, and video models that require other endpoints, so background discovery places entries such asopenai/tts-1andkling/*in the chat model picker; selecting one then sends it to Chat Completions and fails. Please add an Orca-specificmapModelfilter for text-output/chat-capable entries, using the metadata documented by the Models API. -
[P2] Override direct-provider limits with the routed model limits
src/integrations/gateways/orcarouter.ts:45-54
These entries inherit transport-specific shared descriptors: runtime resolution gives GPT-5.5 a 272,000-token context and Claude Sonnet 4.6 a 200,000-token context with only 8,192 output tokens. The routed APIs support much larger limits—GPT-5.5 is documented at 1.05M/128K and Sonnet 4.6 at 1M/64K—so OpenClaude compacts long sessions prematurely and hard-caps Sonnet output far below the gateway limit. Please add route-specific overrides (and preferably map discovery'scontext_length/max_completion_tokens) instead of reusing those direct-transport ceilings. -
[P2] Correct the unconditional default-deny security claim
PR description — “gateway-level, zero-trust security” paragraph
The description says merely using this endpoint screens every prompt/response and governs every tool call on a default-deny basis, but OrcaRouter's own documentation says a key with no attached or workspace-default policy is allowed silently, a policy defaults toaudit, and only the optionaltightposture is default-deny. The code here does not configure any posture or policy, and locally executed tools are outside the gateway's view. Please state the required workspace/key policy setup and the enforcement boundary rather than implying these protections are automatic.
2 participants
Add OrcaRouter gateway descriptor
Summary
Adds first-class support for OrcaRouter, an OpenAI-compatible model routing gateway, as a generated gateway descriptor. The gateway is set up like the existing OpenRouter entry, with its own base URL (
https://api.orcarouter.ai/v1), dedicatedORCAROUTER_API_KEYcredential, and a hybrid catalog that combines authenticated model discovery with curated entries for theorcarouter/autonamed router and flagship models (openai/gpt-5.5,anthropic/claude-sonnet-4.6,google/gemini-3.5-flash).It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.
I'm an engineer on the OrcaRouter team.
Impact
/providerand profile flows via the generated preset manifest (followingdocs/integrations/how-to/add-gateway.md).ORCAROUTER_API_KEYis added to the env-file allow-list so it can be stored in provider setup files.Testing
bun run integrations:generate(artifacts regenerated) andbun run integrations:checkpass.bun run typecheckpasses.bun run smokepasses (build + CLI version 0.28.0).bun test src/integrations/gateways/orcarouter.test.tspasses (2 pass, 0 fail).bun test src/integrationspasses except two pre-existing failures (discoverModelsForRouteApiSmart timeout,AIMLAPI runtime attribution) that fail identically on cleanmain.--provider orcarouter --model openai/gpt-5.5): returnedORCA-OK.GET /v1/modelswith the key returns 200 and includesorcarouter/autoandopenai/gpt-5.5;orcarouter/autochat returns 200.Notes
dedicatedCredentialsOnly: trueprevents a genericOPENAI_API_KEYfrom being sent to the OrcaRouter endpoint.orcarouter/autois a virtual model (the gateway resolves the serving model server-side), so it has no model descriptor reference, matching the existinggitlawb-opengatewayauto entry.Summary by CodeRabbit
New Features
ORCAROUTER_API_KEY.Documentation