fix(provider): add OrcaRouter as a built-in provider

[jinhaosong-source]

Summary

Add OrcaRouter as a built-in LLM provider. OrcaRouter is an OpenAI-compatible model routing gateway that fronts 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, xAI and others behind a single API key, with configurable routing strategies including an adaptive orcarouter/auto router. It also provides gateway-level security controls for AI agents.

Disclosure: I'm an engineer on the OrcaRouter team.

Context

The OrcaRouter API is OpenAI-compatible (https://api.orcarouter.ai/v1/chat/completions and https://api.orcarouter.ai/v1/models), so this integration plugs into the existing OpenAI response type with no new transport code, following the same shape as the OpenRouter and Ambient entries. Because it is a thin base-URL entry, Forge sessions that use it also inherit OrcaRouter's gateway-level, zero-trust security controls for AI agents (scoped keys, guardrails, an agent firewall, and audit trails), and named routers such as orcarouter/auto can be driven by a routing DSL, YAML + CEL rules that select an upstream per request based on task type, difficulty, and agent session state, all with no client-side code changes.

The models endpoint is driven live from the API, so the model catalog stays in sync without further code changes. The full catalog is listed at https://www.orcarouter.ai/models.

Changes

crates/forge_repo/src/provider/provider.json

• Added orca_router provider entry with OpenAI-compatible response type
• Chat endpoint: https://api.orcarouter.ai/v1/chat/completions
• Models endpoint: https://api.orcarouter.ai/v1/models (fetched live)
• Auth: API key (ORCAROUTER_API_KEY)

crates/forge_domain/src/provider.rs

• Added ProviderId::ORCA_ROUTER constant
• Registered in built_in_providers()
• Added "OrcaRouter" display-name mapping
• Added "orca_router" arm to FromStr
• Added 3 unit tests (test_orca_router_from_str, test_orca_router_display_name, test_orca_router_in_built_in_providers) and extended test_provider_id_display_name and test_codex_in_built_in_providers

crates/forge_app/src/dto/openai/model.rs

• Made Architecture.modality and Architecture.tokenizer optional, and gave TopProvider.is_moderated a serde default. OrcaRouter's /v1/models returns an architecture object carrying only input_modalities/output_modalities and a top_provider without is_moderated; the previous required fields made the whole model list fail to deserialize. None of the three fields is consumed anywhere, so this only loosens parsing, in the same spirit as the existing numeric/string pricing tolerance added for Chutes
• Added an orcarouter_api_response.json fixture (taken from the live API response) and test_orcarouter_api_response_format, mirroring test_chutes_api_response_format

crates/forge_repo/src/provider/provider_repo.rs

• Added test_orca_router_config verifying the entry loads with the expected endpoints, auth variable, and URL-driven model source

README.md

• Added OrcaRouter to the provider environment variable reference

How to verify

1. Run forge provider login and select OrcaRouter, then paste an API key from https://www.orcarouter.ai/console (keys start with sk-orca-)
2. Start forge, pick a model such as openai/gpt-4o-mini
3. Send a prompt and confirm streaming responses and tool calls work end to end

[CLAassistant]

All committers have signed the CLA.