feat(orcarouter): add OrcaRouter as a first-class OpenAI-compatible provider

[nissrin2020ali-ux]

What & why

WindsurfAPI turns Windsurf/Devin's models into OpenAI/Anthropic/Gemini-compatible API endpoints, and it already accepts third-party OpenAI-compatible providers (Astraflow landed via #184 as a catalog + config entry). This PR adds OrcaRouter the same way — but with a working forwarder, not just catalog entries.

OrcaRouter is an OpenAI-compatible AI gateway built for both models and agents. Like OpenRouter, it exposes a provider/model namespace across many models — but it also combines adaptive routing, automatic failover, zero-markup inference, observability, guardrails, and agent-tool governance behind the same endpoint. Adding orcarouter as a first-class provider means this project's users can use that stack directly, without treating OrcaRouter as an anonymous custom base URL. It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

Changes

• src/orcarouter.js (new): zero-dependency forwarder. Posts /v1/chat/completions verbatim to https://api.orcarouter.ai/v1 with ORCAROUTER_API_KEY and relays the OpenAI-compatible JSON or SSE response back. Mirrors the __setCatalogRequestImpl transport seam from devin-connect-catalog.js.
• src/handlers/chat.js: short-circuits orcarouter/* models after access control and before the Windsurf backends (no account-pool or LS contact); transport failures map to a clean 502 upstream_error.
• src/models.js: registers orcarouter/free, fusion, fusion-flash, fusion-mini, auto with provider/backend: 'orcarouter'; the cloud-catalog filter never hides them (they consume the operator's gateway key, not Windsurf quota). Any raw orcarouter/<id> forwards too, so the gateway's full GET /v1/models catalog is reachable without a static entry.
• src/config.js / .env.example: ORCAROUTER_API_KEY + base URL; src/handlers/cascade-metadata-egress.js: OrcaRouter display name.
• Docs: README.md / README.en.md third-party provider section under "Supported Models" plus an env-var row.

Testing

• test/orcarouter.test.js (new): 10 tests — transport mock covers request construction (auth header, path, body), success/error/SSE relay, the 503 when no key is set, dynamic orcarouter/<id> routing, and 502 on transport failure. All green.
• test/cloud-catalog-filter.test.js: gates orcarouter out of the Cascade-catalog view like special_agent models.
• Full npm test: 4314 tests, 4299 pass, 15 pre-existing env-sensitive failures (mutate-verify-harness 12, restart 2, update-script-release-target 1) that fail identically on master without this change.
• L3 live test against the real gateway using the operator key: non-streaming orcarouter/fusion-mini → 200 with a real completion; streaming → 200 with SSE frames relayed and [DONE]; confirmed through the full handleChatCompletions path.

Checklist

• Code style matches existing files (2-space, single quotes, semicolons, ESM)
• Zero npm dependencies
• No protocol/field-number changes (no LS proto touched)
• No AI attribution trailer in the commit message

Discord: discord.gg/YEubt8enRA · X: https://x.com/OrcaRouter

I'm an engineer on the OrcaRouter team.

[dwgx]

I am not merging this.

This repo turns Windsurf / Devin into OpenAI / Anthropic / Gemini. It is not a generic OpenAI-compatible multiplexer. Astraflow (#184) already taught that: catalog rows with no working transport, later all deprecated: true. A second first-class vendor, with a Discord link in the PR, is the same product shape — even with a forwarder attached.

I read 70c3fde against current master. What holds: zero npm, the key is required before the socket, the short-circuit sits after access control, 503 when ORCAROUTER_API_KEY is empty, transport mock tests.

What does not:

• Only /v1/chat/completions. /v1/messages, /v1/responses, and Gemini never hit src/orcarouter.js. Those catalog rows have enumValue: 0, which is the [Bug] 回复的模型和使用的模型不一致 #68 silent-default path.
• Stream is buffered then dumped. forwardChatCompletions concatenates the whole body; the SSE test fires one respond(). TTFT is the full response.
• config.orcarouterApiUrl is unused. src/orcarouter.js hardcodes https://api.orcarouter.ai/v1.
• backend === 'orcarouter' always passes the cloud-catalog filter, so /v1/models lists orcarouter/free on every default install. No key → 503 at chat. Clients pick what the list shows.
• Any orcarouter/<id> is forwarded. That is a transparent proxy for their gateway, not a Devin catalog.

Do not rebase. Do not add messages / responses / Gemini on this branch expecting a merge. Anyone who wants OrcaRouter can point the client at https://api.orcarouter.ai/v1 directly — that is what this PR already does, minus this process.

Closing as not planned.