feat(provider): add OrcaRouter as a first-class provider

[JinhaoSong322]

Issue for this PR

Closes #

Type of change

• New feature

What does this PR do?

Adds OrcaRouter — an OpenAI-compatible LLM routing gateway — as a named provider, so it is selectable the same way as the other gateways rather than only through a hand-typed custom endpoint. It is already in the models.dev catalog (providers/orcarouter, api = https://api.orcarouter.ai/v1, ORCAROUTER_API_KEY), so this PR is only the bcode-side wiring that catalog entry expects.

Two small pieces, each mirroring existing precedent:

• packages/llm — added the orcarouter entry to openai-compatible-profile.ts and the matching define(profiles.orcarouter) export, exactly like groq / deepseek / togetherai. The API is plain OpenAI chat-completions, so no custom protocol module is needed (unlike openrouter.ts, which exists only for its extra body options).
• packages/core — added OrcaRouterPlugin, modelled on ZenmuxPlugin: it matches on @ai-sdk/openai-compatible + the OrcaRouter base URL and sets HTTP-Referer / X-Title with ??= so user-configured headers still win. Registered in ProviderPlugins.

It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

How did you verify your code works?

• bun test test/plugin/ in packages/core → 226 pass / 0 fail, including 5 new tests in provider-orcarouter.test.ts covering registration, header application, merging with existing headers, user overrides, and that the guard does not leak onto the openrouter provider.
• bun run typecheck → 17/17 tasks pass.
• bunx oxlint on the five touched files → 0 warnings / 0 errors. (The repo-wide bun run lint reports the same 4760 warnings + 1 pre-existing error in publish-llm-event.ts on a clean main as it does with this branch.)
• Live check against the real endpoint with the profile's baseURL and the attribution headers: POST /v1/chat/completions with model: orcarouter/auto → HTTP 200, routed to gemini-3.1-flash-lite, response body returned as expected.

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

Disclosure: I'm an engineer on the OrcaRouter team.

---

Summary by cubic

Adds OrcaRouter as a first-class OpenAI-compatible provider and applies default attribution headers when using its base URL. Previously it required a custom endpoint; now you can select the orcarouter provider, and defaults do not override user-specified headers.

• LLM: adds the orcarouter profile (https://api.orcarouter.ai/v1) and exports orcarouter via the existing OpenAI-compatible facade; no custom protocol beyond @ai-sdk/openai-compatible.
• Core: introduces OrcaRouterPlugin that matches @ai-sdk/openai-compatible + the OrcaRouter base URL and sets HTTP-Referer and X-Title with ??=; registered in ProviderPlugins.
• Scope: attribution headers apply only to the OrcaRouter URL and do not affect openrouter or other providers.
• Tests: new provider tests cover plugin registration, header application, header merging, user overrides, and URL scoping.
• Migration: none. Select the orcarouter provider to use it.

^{Written for commit 792e77f. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}