feat: add OrcaRouter to the default LLM egress allowlist - #1907
Open
XiaoHuo888-hue wants to merge 1 commit into
Open
feat: add OrcaRouter to the default LLM egress allowlist#1907XiaoHuo888-hue wants to merge 1 commit into
XiaoHuo888-hue wants to merge 1 commit into
Conversation
Add api.orcarouter.ai to the client's default egress allowlist so VMs can reach the OrcaRouter gateway without extra network configuration, mirroring the existing openrouter.ai entry. Also document ORCAROUTER_API_KEY as a supported provider variable on the OpenCode and Pi agent pages. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: XiaoHuo888-hue <jinhao.song@myflashcloud.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add OrcaRouter to the default LLM egress allowlist, so a VM can reach the OrcaRouter gateway with zero extra network configuration (same as the existing
openrouter.aientry).It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.
OrcaRouter serves both OpenAI-compatible (
/v1/chat/completions) and Anthropic-compatible (/v1/messages) surfaces, so it works for the Claude, Codex, Pi, and OpenCode agents without any per-agent wiring.Changes
api.orcarouter.aitoDEFAULT_EGRESS_HOSTSincrates/client/src/agent_os.rs(bothdns://andtcp://patterns are generated automatically).ORCAROUTER_API_KEYon the OpenCode and Pi agent pages.Validation
cargo test -p agentos-client --lib: 45 passed (includes the updated egress allowlist test).cargo check -p agentos-client: clean.cargo fmt -p agentos-client -- --check: clean.cargo clippy -p agentos-client --lib: clean (pre-existing e2e test clippy warnings on the base branch are unrelated).POST https://api.orcarouter.ai/v1/chat/completions(Bearer) andPOST https://api.orcarouter.ai/v1/messages(x-api-key) both return 200 with real model routing.Disclosure: I'm an engineer on the OrcaRouter team.