pi-provider-litellm 1.2.2 → 1.2.4

package/README.md

@@ -24,8 +24,8 @@ pi -e npm:pi-provider-litellm
 ```bash
 git clone https://github.com/balcsida/pi-provider-litellm.git ~/.pi/agent/extensions/pi-provider-litellm
 cd ~/.pi/agent/extensions/pi-provider-litellm
-npm install
-npm run build
+npm ci
+npm run clean && npm run build
 ```
 
 </details>
@@ -61,11 +61,45 @@ Stored pi credentials for `litellm` take precedence over `LITELLM_API_KEY`; the
 
 | Variable | Default | Effect |
 |---|---|---|
+| `LITELLM_API_KEY_HELPER` | unset | Command that prints a fresh LiteLLM bearer token. Takes precedence over `LITELLM_API_KEY`. Registered as a `!command` provider key; Pi re-runs it on every request (the per-request auth path is uncached), so rotating/short-lived tokens stay fresh. |
 | `LITELLM_OFFLINE` | unset | If `1`, skip discovery on this start; use cache only |
 | `LITELLM_DISCOVERY_TIMEOUT_MS` | `5000` | Discovery fetch timeout in ms; `0` to skip discovery |
 
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` only disables startup and refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
+## Mocked LiteLLM smoke workflow
+
+The `LiteLLM Smoke` GitHub Actions workflow starts VidaiMock and a real LiteLLM proxy on the runner. LiteLLM exposes OpenAI-compatible and Anthropic routes whose upstreams are served by VidaiMock, then this extension's smoke runner discovers those models through LiteLLM and sends `/v1/chat/completions` requests through the proxy.
+
+This keeps the LiteLLM integration path under test but does not call real LLM APIs. No provider API keys or GitHub Models permission are required. The workflow also runs a non-interactive Pi CLI smoke with `--list-models` and `-p` so extension loading, model discovery, and a real completion path are covered without opening the TUI.
+
+## Development
+
+This package requires Node.js `>=22.19.0`. CI currently uses Node `24.16.0`.
+
+```bash
+npm ci
+npm run check
+npm run clean && npm run build
+```
+
+`npm run check` runs Biome, type checking, and the Vitest suite. Runtime changes must be built before local Pi smoke checks because the extension entrypoint is `./dist/index.js`.
+
+Before changing package contents or dependency policy, also run:
+
+```bash
+npm run supply-chain:guard
+npm pack --dry-run
+```
+
+The published npm package should contain only `dist`, `README.md`, and `LICENSE`.
+
+## Release
+
+Releases are driven by semver tags named `v*.*.*`. The GitHub release workflow installs from the lockfile, runs the checks, builds `dist`, verifies the package tarball, publishes to npm with provenance, and creates a GitHub release.
+
+Before tagging a release, keep `package.json` and `package-lock.json` versions in sync and verify the dry-run package contents.
+
 ## Slash commands
 
 - `/litellm-refresh` — force re-fetch the model list, ignoring cache
@@ -74,6 +108,8 @@ Stored pi credentials for `litellm` take precedence over `LITELLM_API_KEY`; the
 
 The model list is cached at `~/.pi/agent/litellm-models.json` with a keyed fingerprint of the base URL + API key. Changing either invalidates the cache automatically.
 
+If the cache is older than 24 hours, the extension refreshes it in the background on session start (non-blocking). Failures are silent — the cached models remain in use. Run `/litellm-refresh` to force an immediate refresh.
+
 ## Troubleshooting
 
 | Symptom | Likely cause |
@@ -82,6 +118,7 @@ The model list is cached at `~/.pi/agent/litellm-models.json` with a keyed finge
 | "discovered no models" | Proxy returned an empty list — check pi's startup log for the actual response |
 | `/model/info` returning 401/403/404 | Expected behavior with virtual keys — extension falls back to `/v1/models` |
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
+| `401 Token expired` | Set `LITELLM_API_KEY_HELPER`. |
 
 ## License
 

package/dist/cost.d.ts

@@ -1,8 +1,8 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ProviderModelConfig } from "@earendil-works/pi-coding-agent";
 export interface ModelCostInfo {
     inputCostPerToken: number;
     outputCostPerToken: number;
     cacheReadCostPerToken: number;
     cacheWriteCostPerToken: number;
 }
-export declare function setupLiteLLMCostTracking(pi: ExtensionAPI): void;
+export declare function setupLiteLLMCostTracking(pi: ExtensionAPI, models: ProviderModelConfig[]): (models: ProviderModelConfig[]) => void;

package/dist/cost.js

@@ -1,48 +1,21 @@
-import { resolveCredentials } from "./litellm.js";
-export function setupLiteLLMCostTracking(pi) {
+export function setupLiteLLMCostTracking(pi, models) {
     const modelCosts = new Map();
     let lastResponseCost = null;
-    pi.on("session_start", async (_event, ctx) => {
-        try {
-            const config = await resolveCredentials();
-            if (!config.baseUrl || !config.apiKey) {
-                ctx.ui?.notify?.("LiteLLM cost extension: no credentials configured", "warning");
-                return;
-            }
-            const response = await fetch(`${config.baseUrl}/model/info`, {
-                headers: {
-                    Authorization: `Bearer ${config.apiKey}`,
-                    Accept: "application/json",
-                },
+    // pi reports model costs per million tokens; cost lookups multiply by raw token counts.
+    const updateCosts = (newModels) => {
+        modelCosts.clear();
+        for (const model of newModels) {
+            if (!model.cost)
+                continue;
+            modelCosts.set(model.id, {
+                inputCostPerToken: (model.cost.input ?? 0) / 1_000_000,
+                outputCostPerToken: (model.cost.output ?? 0) / 1_000_000,
+                cacheReadCostPerToken: (model.cost.cacheRead ?? 0) / 1_000_000,
+                cacheWriteCostPerToken: (model.cost.cacheWrite ?? 0) / 1_000_000,
             });
-            if (!response.ok) {
-                ctx.ui?.notify?.(`LiteLLM cost extension: /model/info returned ${response.status}`, "warning");
-                return;
-            }
-            const payload = (await response.json());
-            for (const entry of payload.data) {
-                const info = entry.model_info;
-                if (!info)
-                    continue;
-                const costInfo = {
-                    inputCostPerToken: info.input_cost_per_token ?? 0,
-                    outputCostPerToken: info.output_cost_per_token ?? 0,
-                    cacheReadCostPerToken: info.cache_read_input_token_cost ?? 0,
-                    cacheWriteCostPerToken: info.cache_creation_input_token_cost ?? 0,
-                };
-                modelCosts.set(entry.model_name, costInfo);
-                if (entry.litellm_params?.model) {
-                    modelCosts.set(entry.litellm_params.model, costInfo);
-                }
-            }
-            if (modelCosts.size > 0) {
-                ctx.ui?.notify?.(`LiteLLM cost: loaded pricing for ${modelCosts.size} model(s)`, "info");
-            }
         }
-        catch (error) {
-            ctx.ui?.notify?.(`LiteLLM cost extension: could not fetch /model/info (${error instanceof Error ? error.message : String(error)})`, "warning");
-        }
-    });
+    };
+    updateCosts(models);
     pi.on("after_provider_response", (event) => {
         const costHeader = event.headers?.["x-litellm-response-cost"] ?? event.headers?.["X-Litellm-Response-Cost"];
         if (costHeader) {
@@ -132,4 +105,5 @@ export function setupLiteLLMCostTracking(pi) {
         }
         return;
     });
+    return updateCosts;
 }

package/dist/discover.js

@@ -1,15 +1,19 @@
+import { getModels, getProviders } from "@earendil-works/pi-ai";
 const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
+const KNOWN_PROVIDER_SET = new Set(getProviders());
+const MODELS_DEV_URL = "https://models.dev/api.json";
+let modelsDevCatalog;
 export function normalizeBaseUrl(input) {
     return input.replace(/\/+$/, "").replace(/\/v1\/?$/i, "");
 }
-// Matches both the conventional `anthropic/...` prefix and bare aliases that
+// Matches both the conventional `anthropic/...` prefix and aliases that
 // LiteLLM deployments commonly assign to Anthropic-backed routes (e.g.
-// `opus-4.7`, `sonnet-4.6`, `haiku-4.5`, `claude-3-5-sonnet`). Without the
-// `cacheControlFormat: "anthropic"` flag, pi never relays cache_control markers
-// through the proxy, so prompt caching silently no-ops on Claude models.
-const ANTHROPIC_MODEL_PATTERN = /^(anthropic\/|claude|opus|sonnet|haiku)/i;
+// `google/claude-sonnet-4-6`, `opus-4.7`, `sonnet-4.6`, `haiku-4.5`). Without
+// the `cacheControlFormat: "anthropic"` flag, pi never relays cache_control
+// markers through the proxy, so prompt caching silently no-ops on Claude models.
+const ANTHROPIC_MODEL_PATTERN = /(?:^|[-_/.:])(?:anthropic\/|(?:claude|opus|sonnet|haiku)(?=$|[-_/.:]))/i;
 const MOONSHOT_MODEL_PATTERN = /^(moonshotai\/|moonshot\/|kimi[-/])/i;
 const FORCED_THINKING_MODEL_PATTERN = /(?:^|[-/])thinking(?:[-/]|$)/i;
 export function isMoonshotModel(modelId) {
@@ -33,6 +37,44 @@ export function buildCompat(modelId) {
     }
     return { supportsStore: false };
 }
+function toKnownProvider(provider) {
+    if (!provider)
+        return undefined;
+    const normalized = provider.toLowerCase();
+    return KNOWN_PROVIDER_SET.has(normalized) ? normalized : undefined;
+}
+function findCatalogModel(id, ownedBy) {
+    const prefixProvider = toKnownProvider(id.split("/")[0]);
+    const candidates = [toKnownProvider(ownedBy), prefixProvider].filter((provider) => provider !== undefined);
+    for (const provider of candidates) {
+        const exact = getModels(provider).find((model) => model.id === id);
+        if (exact)
+            return exact;
+        const providerQualified = getModels(provider).find((model) => model.id === `${provider}/${id}`);
+        if (providerQualified)
+            return providerQualified;
+    }
+    for (const provider of getProviders()) {
+        const exact = getModels(provider).find((model) => model.id === id);
+        if (exact)
+            return exact;
+    }
+    return undefined;
+}
+function getFallbackProviderAndModel(id, ownedBy) {
+    const [prefix, ...rest] = id.split("/");
+    const prefixProvider = toKnownProvider(prefix);
+    if (prefixProvider && rest.length > 0) {
+        return { provider: prefixProvider, modelId: rest.join("/") };
+    }
+    return { provider: toKnownProvider(ownedBy), modelId: id };
+}
+function findModelsDevModel(catalog, id, ownedBy) {
+    const { provider, modelId } = getFallbackProviderAndModel(id, ownedBy);
+    if (!provider)
+        return undefined;
+    return catalog?.[provider]?.models?.[modelId];
+}
 function withTimeout(timeoutMs, signal) {
     const controller = new AbortController();
     const onAbort = () => controller.abort(signal?.reason);
@@ -68,6 +110,59 @@ async function fetchJson(url, apiKey, options) {
         cancel();
     }
 }
+async function fetchPublicJson(url, options) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const { signal, cancel } = withTimeout(timeoutMs, options.signal);
+    try {
+        const response = await fetch(url, {
+            headers: { Accept: "application/json" },
+            signal,
+        });
+        if (!response.ok)
+            throw new Error(`${url} returned ${response.status}`);
+        return (await response.json());
+    }
+    finally {
+        cancel();
+    }
+}
+async function getModelsDevCatalog(options) {
+    if (modelsDevCatalog)
+        return modelsDevCatalog;
+    try {
+        modelsDevCatalog = await fetchPublicJson(MODELS_DEV_URL, options);
+        return modelsDevCatalog;
+    }
+    catch {
+        return undefined;
+    }
+}
+function mapModelsDevMetadata(model) {
+    if (!model)
+        return {};
+    const metadata = {};
+    if (model.name)
+        metadata.name = model.name;
+    if (model.reasoning !== undefined)
+        metadata.reasoning = model.reasoning;
+    if (model.modalities?.input) {
+        metadata.input = model.modalities.input.includes("image") ? ["text", "image"] : ["text"];
+    }
+    const contextWindow = model.limit?.context ?? model.limit?.input;
+    if (contextWindow !== undefined)
+        metadata.contextWindow = contextWindow;
+    if (model.limit?.output !== undefined)
+        metadata.maxTokens = model.limit.output;
+    if (model.cost) {
+        metadata.cost = {
+            input: model.cost.input ?? 0,
+            output: model.cost.output ?? 0,
+            cacheRead: model.cost.cache_read ?? 0,
+            cacheWrite: model.cost.cache_write ?? 0,
+        };
+    }
+    return metadata;
+}
 function mapFromModelInfo(entry) {
     const id = entry.model_name;
     if (!id)
@@ -91,18 +186,21 @@ function mapFromModelInfo(entry) {
         compat: buildCompat(id),
     };
 }
-function mapFromModelsList(entry) {
+function mapFromModelsList(entry, modelsDev) {
     const id = entry.id;
     if (!id)
         return undefined;
+    const catalogModel = findCatalogModel(id, entry.owned_by);
+    const modelsDevMetadata = mapModelsDevMetadata(findModelsDevModel(modelsDev, id, entry.owned_by));
     return {
         id,
-        name: `${id} (no metadata)`,
-        reasoning: false,
-        input: ["text"],
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: DEFAULT_CONTEXT_WINDOW,
-        maxTokens: DEFAULT_MAX_TOKENS,
+        name: modelsDevMetadata.name ?? catalogModel?.name ?? `${id} (no metadata)`,
+        reasoning: modelsDevMetadata.reasoning ?? catalogModel?.reasoning ?? false,
+        thinkingLevelMap: catalogModel?.thinkingLevelMap,
+        input: modelsDevMetadata.input ?? catalogModel?.input ?? ["text"],
+        cost: modelsDevMetadata.cost ?? catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: modelsDevMetadata.contextWindow ?? catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: modelsDevMetadata.maxTokens ?? catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
     };
 }
@@ -122,8 +220,9 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
     if (!listResult.ok) {
         throw new Error(`/v1/models returned ${listResult.status}`);
     }
+    const modelsDev = await getModelsDevCatalog(options);
     const models = (listResult.data.data ?? [])
-        .map(mapFromModelsList)
+        .map((entry) => mapFromModelsList(entry, modelsDev))
         .filter((m) => m !== undefined);
     return { source: "models_list", models };
 }

package/dist/index.js

@@ -1,3 +1,4 @@
+import { execSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
@@ -8,11 +9,16 @@ import { getSessionIdFromFile } from "./litellm.js";
 const PROVIDER_NAME = "litellm";
 const ENV_BASE_URL = "LITELLM_BASE_URL";
 const ENV_API_KEY = "LITELLM_API_KEY";
+const ENV_API_KEY_HELPER = "LITELLM_API_KEY_HELPER";
 const ENV_TIMEOUT = "LITELLM_DISCOVERY_TIMEOUT_MS";
 const ENV_OFFLINE = "LITELLM_OFFLINE";
 const DEFAULT_TIMEOUT_MS = 5000;
 const LOGIN_TIMEOUT_MS = 10_000;
 const CACHE_FILENAME = "litellm-models.json";
+const CACHE_STALE_MS = 24 * 60 * 60 * 1000;
+const TOKEN_REFRESH_LEAD_MS = 5 * 60 * 1000;
+const PERMANENT_TOKEN_EXPIRES_AT = Number.MAX_SAFE_INTEGER;
+const EXPIRE_TOKEN_IMMEDIATELY = 0;
 function getAuthPath() {
     return join(getAgentDir(), "auth.json");
 }
@@ -29,20 +35,74 @@ async function readAuthEntry() {
         return undefined;
     }
 }
-async function resolveCredentials() {
+function cleanConfig(raw) {
+    const trimmed = raw?.trim();
+    return trimmed && trimmed !== "undefined" ? trimmed : undefined;
+}
+function normalizeCommand(raw) {
+    const trimmed = cleanConfig(raw);
+    if (!trimmed)
+        return undefined;
+    return trimmed.startsWith("!") ? trimmed : `!${trimmed}`;
+}
+function getApiKeyHelperCommand() {
+    return normalizeCommand(process.env[ENV_API_KEY_HELPER]);
+}
+function executeApiKeyCommand(commandConfig) {
+    const command = commandConfig.startsWith("!") ? commandConfig.slice(1) : commandConfig;
+    const output = execSync(command, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10_000 }).trim();
+    if (!output)
+        throw new Error(`LiteLLM API key helper produced no output: ${command}`);
+    return output;
+}
+function tokenExpiresAt(apiKey, opaqueFallback = PERMANENT_TOKEN_EXPIRES_AT) {
+    const [, payload] = apiKey.split(".");
+    if (!payload)
+        return opaqueFallback;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof claims.exp === "number"
+            ? Math.max(Date.now(), claims.exp * 1000 - TOKEN_REFRESH_LEAD_MS)
+            : opaqueFallback;
+    }
+    catch {
+        return opaqueFallback;
+    }
+}
+function getLiteLLMApiKey(credentials) {
+    return credentials.access;
+}
+function resolveOAuthApiKey(credentials) {
+    return credentials.refresh.startsWith("!")
+        ? executeApiKeyCommand(credentials.refresh)
+        : getLiteLLMApiKey(credentials);
+}
+async function resolveCredentials({ executeHelpers = true } = {}) {
     const entry = await readAuthEntry();
-    const envBase = process.env[ENV_BASE_URL]?.trim();
-    const envKey = process.env[ENV_API_KEY]?.trim();
+    const envBase = cleanConfig(process.env[ENV_BASE_URL]);
+    const envKey = cleanConfig(process.env[ENV_API_KEY]);
+    const envHelperCommand = getApiKeyHelperCommand();
     const authBase = entry?.type === "oauth" ? entry.baseUrl?.trim() : undefined;
     const authKey = entry?.type === "oauth"
-        ? entry.access?.trim()
+        ? (executeHelpers ? resolveOAuthApiKey(entry) : entry.access).trim()
         : entry?.type === "api_key"
             ? (await AuthStorage.create(getAuthPath()).getApiKey(PROVIDER_NAME, { includeFallback: false }))?.trim()
             : undefined;
+    const apiKey = authKey || (executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined) || envKey;
+    const apiKeyFingerprint = entry?.type === "oauth" && entry.refresh.startsWith("!")
+        ? fingerprint(entry.refresh)
+        : authKey
+            ? fingerprint(authKey)
+            : envHelperCommand
+                ? fingerprint(envHelperCommand)
+                : envKey
+                    ? fingerprint(envKey)
+                    : undefined;
     const rawBase = authBase || envBase;
     return {
         baseUrl: rawBase ? normalizeBaseUrl(rawBase) : undefined,
-        apiKey: authKey || envKey || undefined,
+        apiKey: apiKey || undefined,
+        apiKeyFingerprint,
     };
 }
 function getDiscoveryTimeoutMs() {
@@ -72,36 +132,43 @@ async function discoverWithFallback(baseUrl, apiKey, options) {
         };
     }
 }
-async function loginLiteLLM(callbacks) {
+async function loginLiteLLM(callbacks, onCacheWrite) {
     const rawBaseUrl = (await callbacks.onPrompt({
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
         placeholder: "https://litellm.example.com",
     })).trim();
-    const apiKey = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
-    if (!rawBaseUrl || !apiKey)
+    const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
+    if (!rawBaseUrl || !apiKeyInput)
         throw new Error("Both base URL and API key are required");
     const baseUrl = normalizeBaseUrl(rawBaseUrl);
+    const refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
+    const apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
     const { models, source } = await discoverModels(baseUrl, apiKey, {
         timeoutMs: LOGIN_TIMEOUT_MS,
         signal: callbacks.signal,
     });
-    await writeCache(getCachePath(), {
+    const cache = {
         baseUrl,
-        apiKeyFingerprint: fingerprint(apiKey),
+        apiKeyFingerprint: fingerprint(refresh || apiKey),
         fetchedAt: Date.now(),
         source,
         models,
-    });
+    };
+    await writeCache(getCachePath(), cache);
+    onCacheWrite?.(cache);
     callbacks.onProgress?.(`LiteLLM: ${models.length} models discovered (source: ${source})`);
     return {
         access: apiKey,
-        refresh: "",
-        expires: Number.MAX_SAFE_INTEGER,
+        refresh,
+        expires: tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT),
         baseUrl,
     };
 }
 async function refreshLiteLLM(credentials) {
-    return credentials;
+    if (!credentials.refresh.startsWith("!"))
+        return credentials;
+    const access = executeApiKeyCommand(credentials.refresh);
+    return { ...credentials, access, expires: tokenExpiresAt(access, EXPIRE_TOKEN_IMMEDIATELY) };
 }
 function modifyLiteLLMModels(models, cred) {
     const baseUrl = cred.baseUrl;
@@ -191,97 +258,137 @@ function normalizeThinkTags(message) {
     return { ...message, content };
 }
 export default async function (pi) {
-    const creds = await resolveCredentials();
+    let creds = await resolveCredentials({ executeHelpers: false });
     const cache = await readCache(getCachePath());
-    const fp = creds.apiKey ? fingerprint(creds.apiKey) : undefined;
+    let fp = creds.apiKeyFingerprint;
+    let cacheFetchedAt = cache?.fetchedAt ?? 0;
     const cacheValid = cache !== null &&
         creds.baseUrl !== undefined &&
         fp !== undefined &&
         cache.baseUrl === creds.baseUrl &&
         cache.apiKeyFingerprint === fp;
     let models = cacheValid && cache ? cache.models : [];
-    const haveCreds = creds.baseUrl !== undefined && creds.apiKey !== undefined && fp !== undefined;
-    const shouldFetch = haveCreds && !isOffline() && (!cacheValid || isListModelsMode());
-    if (shouldFetch && creds.baseUrl && creds.apiKey && fp) {
+    const shouldFetch = creds.baseUrl !== undefined &&
+        fp !== undefined &&
+        !isOffline() &&
+        getDiscoveryTimeoutMs() > 0 &&
+        (!cacheValid || isListModelsMode());
+    let credentialWarning;
+    if (shouldFetch) {
+        try {
+            creds = await resolveCredentials();
+            fp = creds.apiKeyFingerprint;
+        }
+        catch (error) {
+            if (!cacheValid || !cache)
+                throw error;
+            credentialWarning = error instanceof Error ? error.message : String(error);
+            process.stderr.write(`LiteLLM: discovery failed (${credentialWarning}); using cached models.\n`);
+            models = cache.models;
+        }
+    }
+    if (shouldFetch && !credentialWarning && creds.baseUrl && creds.apiKey && fp) {
         const timeoutMs = getDiscoveryTimeoutMs();
-        if (timeoutMs > 0) {
-            const { result, warning } = await discoverWithFallback(creds.baseUrl, creds.apiKey, {
-                timeoutMs,
-            });
-            if (warning) {
-                if (cacheValid && cache) {
-                    process.stderr.write(`LiteLLM: discovery failed (${warning}); using cached models.\n`);
-                    models = cache.models;
-                }
-                else {
-                    process.stderr.write(`LiteLLM: discovery failed (${warning}); registering provider with no models.\n`);
-                    models = [];
-                }
+        const { result, warning } = await discoverWithFallback(creds.baseUrl, creds.apiKey, {
+            timeoutMs,
+        });
+        if (warning) {
+            if (cacheValid && cache) {
+                process.stderr.write(`LiteLLM: discovery failed (${warning}); using cached models.\n`);
+                models = cache.models;
             }
             else {
-                models = result.models;
-                const next = {
-                    baseUrl: creds.baseUrl,
-                    apiKeyFingerprint: fp,
-                    fetchedAt: Date.now(),
-                    source: result.source,
-                    models: result.models,
-                };
-                await writeCache(getCachePath(), next);
-                if (isListModelsMode()) {
-                    process.stderr.write(`LiteLLM: ${result.models.length} models discovered (source: ${result.source}).\n`);
-                }
+                process.stderr.write(`LiteLLM: discovery failed (${warning}); registering provider with no models.\n`);
+                models = [];
+            }
+        }
+        else {
+            models = result.models;
+            const next = {
+                baseUrl: creds.baseUrl,
+                apiKeyFingerprint: fp,
+                fetchedAt: Date.now(),
+                source: result.source,
+                models: result.models,
+            };
+            await writeCache(getCachePath(), next);
+            cacheFetchedAt = next.fetchedAt;
+            if (isListModelsMode()) {
+                process.stderr.write(`LiteLLM: ${result.models.length} models discovered (source: ${result.source}).\n`);
             }
         }
     }
     const oauth = {
         name: "LiteLLM",
-        login: loginLiteLLM,
+        login: (callbacks) => loginLiteLLM(callbacks, (next) => {
+            cacheFetchedAt = next.fetchedAt;
+        }),
         refreshToken: refreshLiteLLM,
-        getApiKey: (cred) => cred.access,
+        getApiKey: getLiteLLMApiKey,
         modifyModels: modifyLiteLLMModels,
     };
-    pi.registerProvider(PROVIDER_NAME, {
-        baseUrl: creds.baseUrl ? `${creds.baseUrl}/v1` : "https://litellm.example.com/v1",
-        apiKey: ENV_API_KEY,
-        api: "openai-completions",
-        models,
-        oauth,
-    });
+    function registerProvider(baseUrl, models) {
+        pi.registerProvider(PROVIDER_NAME, {
+            baseUrl: baseUrl ? `${baseUrl}/v1` : "https://litellm.example.com/v1",
+            // When LITELLM_API_KEY_HELPER is set we register the helper as a `!command` provider key.
+            // Pi's per-request auth path (ModelRegistry.getApiKeyAndHeaders) resolves provider keys via
+            // resolveConfigValueOrThrow -> resolveConfigValueUncached, i.e. the command is re-executed on
+            // every request (it does NOT use the process-lifetime command cache, which only applies to
+            // resolveConfigValue). So a short-lived/rotating helper token stays fresh. The OAuth hooks
+            // remain registered for `/login litellm` users. See the regression test
+            // "re-runs the helper command on every request" in tests/index.test.ts.
+            apiKey: getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`,
+            api: "openai-completions",
+            models,
+            oauth,
+        });
+    }
+    registerProvider(creds.baseUrl, models);
+    const updateCosts = setupLiteLLMCostTracking(pi, models);
+    let refreshInProgress = null;
+    function discoveryDisabledReason() {
+        if (isOffline())
+            return `${ENV_OFFLINE}=1`;
+        if (getDiscoveryTimeoutMs() === 0)
+            return `${ENV_TIMEOUT}=0`;
+        return null;
+    }
+    async function refreshModelsAndCosts() {
+        const fresh = await resolveCredentials();
+        const freshFp = fresh.apiKeyFingerprint;
+        if (!fresh.baseUrl || !fresh.apiKey || !freshFp) {
+            throw new Error("no credentials. Run /login litellm or set env vars.");
+        }
+        const result = await discoverModels(fresh.baseUrl, fresh.apiKey, { timeoutMs: getDiscoveryTimeoutMs() });
+        const now = Date.now();
+        await writeCache(getCachePath(), {
+            baseUrl: fresh.baseUrl,
+            apiKeyFingerprint: freshFp,
+            fetchedAt: now,
+            source: result.source,
+            models: result.models,
+        });
+        registerProvider(fresh.baseUrl, result.models);
+        updateCosts(result.models);
+        cacheFetchedAt = now;
+        return { models: result.models, source: result.source };
+    }
+    function runRefresh() {
+        refreshInProgress ??= refreshModelsAndCosts().finally(() => {
+            refreshInProgress = null;
+        });
+        return refreshInProgress;
+    }
     pi.registerCommand("litellm-refresh", {
         description: "Re-discover models from the LiteLLM proxy.",
         handler: async (_args, ctx) => {
-            if (isOffline()) {
-                ctx.ui.notify(`LiteLLM refresh disabled (${ENV_OFFLINE}=1)`, "warning");
-                return;
-            }
-            const timeoutMs = getDiscoveryTimeoutMs();
-            if (timeoutMs === 0) {
-                ctx.ui.notify(`LiteLLM refresh disabled (${ENV_TIMEOUT}=0)`, "warning");
-                return;
-            }
-            const fresh = await resolveCredentials();
-            const freshFp = fresh.apiKey ? fingerprint(fresh.apiKey) : undefined;
-            if (!fresh.baseUrl || !fresh.apiKey || !freshFp) {
-                ctx.ui.notify("LiteLLM refresh failed: no credentials. Run /login litellm or set env vars.", "error");
+            const disabledReason = discoveryDisabledReason();
+            if (disabledReason) {
+                ctx.ui.notify(`LiteLLM refresh disabled (${disabledReason})`, "warning");
                 return;
             }
             try {
-                const result = await discoverModels(fresh.baseUrl, fresh.apiKey, { timeoutMs });
-                await writeCache(getCachePath(), {
-                    baseUrl: fresh.baseUrl,
-                    apiKeyFingerprint: freshFp,
-                    fetchedAt: Date.now(),
-                    source: result.source,
-                    models: result.models,
-                });
-                pi.registerProvider(PROVIDER_NAME, {
-                    baseUrl: `${fresh.baseUrl}/v1`,
-                    apiKey: ENV_API_KEY,
-                    api: "openai-completions",
-                    models: result.models,
-                    oauth,
-                });
+                const result = await runRefresh();
                 ctx.ui.notify(`LiteLLM: ${result.models.length} models refreshed (source: ${result.source})`, "info");
             }
             catch (error) {
@@ -290,10 +397,12 @@ export default async function (pi) {
             }
         },
     });
-    setupLiteLLMCostTracking(pi);
     let sessionId;
-    pi.on("session_start", async (_event, ctx) => {
+    pi.on("session_start", (_event, ctx) => {
         sessionId = getSessionIdFromFile(ctx.sessionManager.getSessionFile());
+        if (discoveryDisabledReason() || !cacheFetchedAt || Date.now() - cacheFetchedAt <= CACHE_STALE_MS)
+            return;
+        void runRefresh().catch(() => undefined);
     });
     pi.on("before_provider_request", (event, ctx) => {
         if (ctx.model?.provider !== PROVIDER_NAME)

package/dist/types.d.ts

@@ -34,6 +34,7 @@ export interface ModelInfoResponse {
 }
 export interface ModelsListEntry {
     id?: string;
+    owned_by?: string;
 }
 export interface ModelsListResponse {
     data?: ModelsListEntry[];
@@ -51,4 +52,5 @@ export type AuthFileEntry = {
 export interface ResolvedCredentials {
     baseUrl?: string;
     apiKey?: string;
+    apiKeyFingerprint?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -47,15 +47,16 @@
     "lint": "biome check --error-on-warnings .",
     "format": "biome check --write .",
     "test": "vitest --run",
+    "supply-chain:guard": "tsx scripts/supply-chain-guard.ts",
     "check": "npm run lint && npm run typecheck && npm test",
-    "prepublishOnly": "npm run check && npm run clean && npm run build"
+    "prepublishOnly": "npm run check && npm run clean && npm run build && npm run supply-chain:guard"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "^0.74.0",
-    "@earendil-works/pi-coding-agent": "^0.74.0"
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
   },
   "overrides": {
     "basic-ftp": "6.0.1",
@@ -63,14 +64,14 @@
     "protobufjs": "8.2.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.74.0",
-    "@earendil-works/pi-coding-agent": "^0.74.0",
-    "@biomejs/biome": "^1.9.4",
-    "@types/node": "^24.12.3",
-    "@typescript/native-preview": "7.0.0-dev.20260120.1",
+    "@earendil-works/pi-ai": "^0.78.1",
+    "@earendil-works/pi-coding-agent": "^0.78.1",
+    "@biomejs/biome": "^2.4.15",
+    "@types/node": "^25.9.1",
+    "@typescript/native-preview": "7.0.0-dev.20260607.1",
     "shx": "^0.4.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
   }
 }