@f5xc-salesdemos/pi-ai 17.0.2 → 17.1.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/pi-ai",
-	"version": "17.0.2",
+	"version": "17.1.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -45,7 +45,7 @@
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
 		"@google/genai": "^1.43",
-		"@f5xc-salesdemos/pi-utils": "17.0.2",
+		"@f5xc-salesdemos/pi-utils": "17.1.0",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",
 		"ajv": "^8.18",

package/src/utils/anthropic-auth.ts

@@ -1,12 +1,13 @@
 /**
  * Anthropic Authentication
  *
- * 5-tier auth resolution:
+ * 6-tier auth resolution:
  *   1. ANTHROPIC_SEARCH_API_KEY / ANTHROPIC_SEARCH_BASE_URL env vars
  *   2. ANTHROPIC_FOUNDRY_API_KEY override when Foundry mode is enabled
  *   3. OAuth credentials in ~/.xcsh/agent/agent.db (with expiry check)
  *   4. API key credentials in ~/.xcsh/agent/agent.db
  *   5. Generic Anthropic fallback (ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL)
+ *   6. LiteLLM passthrough (LITELLM_BASE_URL / LITELLM_API_KEY)
  */
 import { $env, getAgentDbPath } from "@f5xc-salesdemos/pi-utils";
 import { type AuthCredential, AuthCredentialStore } from "../auth-storage";
@@ -112,6 +113,7 @@ async function readAnthropicOAuthCredentials(store?: AuthCredentialStore): Promi
  *   3. OAuth in agent.db (with 5-minute expiry buffer)
  *   4. API key in agent.db
  *   5. ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL fallback
+ *   6. LiteLLM passthrough (LITELLM_BASE_URL / LITELLM_API_KEY)
  * @param store - Optional credential store (creates one from default db path if not provided)
  * @returns The first valid auth configuration found, or null if none available
  */
@@ -137,38 +139,47 @@ export async function findAnthropicAuth(store?: AuthCredentialStore): Promise<An
 		};
 	}
 
-	// Tiers 3-4 use the credential store; manage lifecycle once
-	const ownsStore = !store;
-	const effectiveStore = store ?? (await AuthCredentialStore.open(getAgentDbPath()));
+	// Tiers 3-4 use the credential store; wrapped in try/catch so DB
+	// failures (missing file, corruption, locking) never prevent the
+	// env-var fallback tiers from running.
+	let storeError: unknown;
 	try {
-		// 3. OAuth credentials in agent.db (with 5-minute expiry buffer)
-		const expiryBuffer = 5 * 60 * 1000; // 5 minutes
-		const now = Date.now();
-		const credentials = await readAnthropicOAuthCredentials(effectiveStore);
-		for (const credential of credentials) {
-			if (!credential.access) continue;
-			if (credential.expires > now + expiryBuffer) {
+		const ownsStore = !store;
+		const effectiveStore = store ?? (await AuthCredentialStore.open(getAgentDbPath()));
+		try {
+			// 3. OAuth credentials in agent.db (with 5-minute expiry buffer)
+			const expiryBuffer = 5 * 60 * 1000; // 5 minutes
+			const now = Date.now();
+			const credentials = await readAnthropicOAuthCredentials(effectiveStore);
+			for (const credential of credentials) {
+				if (!credential.access) continue;
+				if (credential.expires > now + expiryBuffer) {
+					return {
+						apiKey: credential.access,
+						baseUrl: DEFAULT_BASE_URL,
+						isOAuth: true,
+					};
+				}
+			}
+
+			// 4. API key credentials in agent.db
+			const storedApiKey = effectiveStore.getApiKey("anthropic");
+			if (storedApiKey) {
 				return {
-					apiKey: credential.access,
-					baseUrl: DEFAULT_BASE_URL,
-					isOAuth: true,
+					apiKey: storedApiKey,
+					baseUrl: resolveAnthropicBaseUrlFromEnv() ?? DEFAULT_BASE_URL,
+					isOAuth: isOAuthToken(storedApiKey),
 				};
 			}
+		} finally {
+			if (ownsStore) {
+				effectiveStore.close();
+			}
 		}
-
-		// 4. API key credentials in agent.db
-		const storedApiKey = effectiveStore.getApiKey("anthropic");
-		if (storedApiKey) {
-			return {
-				apiKey: storedApiKey,
-				baseUrl: resolveAnthropicBaseUrlFromEnv() ?? DEFAULT_BASE_URL,
-				isOAuth: isOAuthToken(storedApiKey),
-			};
-		}
-	} finally {
-		if (ownsStore) {
-			effectiveStore.close();
-		}
+	} catch (err) {
+		// DB unavailable — fall through to env-var tiers, but preserve the
+		// error so it can be surfaced if no later tier succeeds.
+		storeError = err;
 	}
 
 	// 5. Generic ANTHROPIC_API_KEY fallback
@@ -182,6 +193,24 @@ export async function findAnthropicAuth(store?: AuthCredentialStore): Promise<An
 		};
 	}
 
+	// 6. Derive from litellm passthrough credentials
+	const litellmBaseUrl = $env.LITELLM_BASE_URL;
+	const litellmApiKey = $env.LITELLM_API_KEY;
+	if (litellmBaseUrl && litellmApiKey) {
+		const normalized = litellmBaseUrl.replace(/\/+$/, "").replace(/\/anthropic$/, "");
+		return {
+			apiKey: litellmApiKey,
+			baseUrl: `${normalized}/anthropic`,
+			isOAuth: false,
+		};
+	}
+
+	// No auth tier succeeded. If the credential store threw, surface
+	// that error so a broken DB isn't silently hidden as "unconfigured".
+	if (storeError) {
+		throw storeError;
+	}
+
 	return null;
 }