pi-provider-litellm 1.2.6 → 1.2.7

package/README.md

@@ -2,7 +2,7 @@
 
 LiteLLM proxy provider extension for [Pi](https://pi.dev).
 
-Discovers models from a self-hosted LiteLLM proxy and registers them under the `litellm` provider. Supports `/login litellm` and `/litellm-refresh`. Tries `/model/info` first (admin endpoint with rich metadata), falls back to `/v1/models` (OpenAI-compatible) on 401/403/404.
+Discovers models from a self-hosted LiteLLM proxy and registers them under the `litellm` provider. Supports `/login litellm`, `/litellm-refresh`, LiteLLM MCP tools, LiteLLM Skills Gateway prompt injection, and Google ADC token auth. Tries `/model/info` first (admin endpoint with rich metadata), falls back to `/v1/models` (OpenAI-compatible) on 401/403/404, then tries `/health` plus per-endpoint `/model/info` for older LiteLLM proxies.
 
 ## Install
 
@@ -64,11 +64,42 @@ Stored pi credentials for `litellm` take precedence over `LITELLM_API_KEY`; the
 | Variable | Default | Effect |
 |---|---|---|
 | `LITELLM_API_KEY_HELPER` | unset | Command that prints a fresh LiteLLM bearer token. Takes precedence over `LITELLM_API_KEY`. Registered as a `!command` provider key; Pi re-runs it on every request (the per-request auth path is uncached), so rotating/short-lived tokens stay fresh. |
+| `LITELLM_GCLOUD_TOKEN_AUTH` | unset | If set to a non-empty value other than `0`, use Google Application Default Credentials as the LiteLLM bearer token source when no stored `/login litellm` credential exists. If ADC is unavailable, the extension falls back to `LITELLM_API_KEY_HELPER` or `LITELLM_API_KEY`. |
+| `GOOGLE_APPLICATION_CREDENTIALS` | Google default ADC path | Optional path to an ADC JSON file used by `LITELLM_GCLOUD_TOKEN_AUTH`. If unset, the extension checks the default gcloud ADC locations. |
 | `LITELLM_OFFLINE` | unset | If `1`, skip discovery on this start; use cache only |
 | `LITELLM_DISCOVERY_TIMEOUT_MS` | `5000` | Discovery fetch timeout in ms; `0` to skip discovery |
 
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` only disables startup and refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
+### Google ADC token auth
+
+When your LiteLLM proxy accepts Google OAuth access tokens, you can let the extension refresh tokens from Application Default Credentials:
+
+```bash
+gcloud auth application-default login
+export LITELLM_BASE_URL="https://litellm.your-domain.com"
+export LITELLM_GCLOUD_TOKEN_AUTH=1
+```
+
+Only `authorized_user` ADC files are supported. Service account JSON files are rejected with a warning. Tokens are cached in memory for 50 minutes and are keyed by the ADC identity, so switching `GOOGLE_APPLICATION_CREDENTIALS` or changing `gcloud auth application-default login` users refreshes both request auth and model discovery cache identity. When ADC is available, the registered provider key is a Pi `!command`, so request-time auth resolves a fresh token when Pi sends model requests. If ADC cannot be read, provider registration uses the same helper or environment API key that discovery used.
+
+## LiteLLM MCP tools
+
+If your LiteLLM proxy exposes MCP REST endpoints, this extension discovers tools from:
+
+- `GET /mcp-rest/tools/list`
+- `POST /mcp-rest/tools/call`
+
+Each discovered tool is registered as a native Pi tool named `mcp_<server>_<tool>`, with simple JSON Schema parameters mapped to Pi/TypeBox parameters. Complex schemas fall back to a single `args` object. The extension accepts LiteLLM's `tools` response shape with `inputSchema` and `mcp_info`, and executes tools with LiteLLM's `server_id`, `name`, and `arguments` fields. MCP discovery runs after successful live model discovery, `/login litellm`, or `/litellm-refresh`; it does not force network or helper-token access when a fresh model cache is used.
+
+## LiteLLM Skills Gateway
+
+If your LiteLLM proxy exposes `/v1/skills`, enabled skills are fetched before each agent turn and appended to the system prompt as a `litellm_skills` section. The extension also registers Pi tools for basic Skills Gateway management:
+
+- `litellm_skill_list`
+- `litellm_skill_create`
+- `litellm_skill_delete`
+
 ## Mocked LiteLLM smoke workflow
 
 The `LiteLLM Smoke` GitHub Actions workflow starts VidaiMock and a real LiteLLM proxy on the runner. LiteLLM exposes OpenAI-compatible and Anthropic routes whose upstreams are served by VidaiMock, then this extension's smoke runner discovers those models through LiteLLM and sends `/v1/chat/completions` requests through the proxy.
@@ -108,7 +139,7 @@ Before tagging a release, keep `package.json` and `package-lock.json` versions i
 
 ## Cache
 
-The model list is cached at `~/.pi/agent/litellm-models.json` with a keyed fingerprint of the base URL + API key. Changing either invalidates the cache automatically.
+The model list is cached at `~/.pi/agent/litellm-models.json` with the base URL and a keyed fingerprint of the selected auth source. Changing the base URL, API key, helper command, or Google ADC identity invalidates the cache automatically.
 
 If the cache is older than 24 hours, the extension refreshes it in the background on session start (non-blocking). Failures are silent — the cached models remain in use. Run `/litellm-refresh` to force an immediate refresh.
 
@@ -117,10 +148,13 @@ If the cache is older than 24 hours, the extension refreshes it in the backgroun
 | Symptom | Likely cause |
 |---|---|
 | "no credentials" warning at startup | Env vars not set and no OAuth credential — run `/login litellm` |
-| "discovered no models" | Proxy returned an empty list — check pi's startup log for the actual response |
+| "discovered no models" | Proxy returned an empty list — check pi's startup log and verify `/model/info`, `/v1/models`, or `/health` responds |
 | `/model/info` returning 401/403/404 | Expected behavior with virtual keys — extension falls back to `/v1/models` |
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
 | `401 Token expired` | Set `LITELLM_API_KEY_HELPER`. |
+| No models with gcloud auth | Verify `gcloud auth application-default login` has been run or set `GOOGLE_APPLICATION_CREDENTIALS` to an `authorized_user` ADC file |
+| MCP tools not showing | Verify the proxy exposes `/mcp-rest/tools/list` and run `/litellm-refresh` after fixing the proxy |
+| Skills not affecting prompts | Verify the proxy exposes `/v1/skills` and returns enabled skills |
 
 ## License
 

package/dist/cache.js

@@ -36,7 +36,7 @@ function isCacheFileShape(value) {
     return (typeof v.baseUrl === "string" &&
         typeof v.apiKeyFingerprint === "string" &&
         typeof v.fetchedAt === "number" &&
-        (v.source === "model_info" || v.source === "models_list") &&
+        (v.source === "model_info" || v.source === "models_list" || v.source === "health") &&
         Array.isArray(v.models));
 }
 export async function writeCache(path, cache) {

package/dist/discover.js

@@ -186,6 +186,45 @@ function mapFromModelInfo(entry) {
         compat: buildCompat(id),
     };
 }
+function mapFromHealthModelInfo(entry, fallbackId) {
+    const model = mapFromModelInfo(entry);
+    if (model || !fallbackId)
+        return model;
+    if (entry.model_info?.mode && entry.model_info.mode !== "chat")
+        return undefined;
+    return {
+        id: fallbackId,
+        name: fallbackId,
+        reasoning: entry.model_info?.supports_reasoning ?? false,
+        input: entry.model_info?.supports_vision ? ["text", "image"] : ["text"],
+        cost: {
+            input: (entry.model_info?.input_cost_per_token ?? 0) * 1_000_000,
+            output: (entry.model_info?.output_cost_per_token ?? 0) * 1_000_000,
+            cacheRead: (entry.model_info?.cache_read_input_token_cost ?? 0) * 1_000_000,
+            cacheWrite: (entry.model_info?.cache_creation_input_token_cost ?? 0) * 1_000_000,
+        },
+        contextWindow: entry.model_info?.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: entry.model_info?.max_output_tokens ?? DEFAULT_MAX_TOKENS,
+        compat: buildCompat(fallbackId),
+    };
+}
+function mapFromHealthEndpoint(entry) {
+    const id = entry.model;
+    if (!id)
+        return undefined;
+    const catalogModel = findCatalogModel(id);
+    return {
+        id,
+        name: catalogModel?.name ?? id,
+        reasoning: catalogModel?.reasoning ?? false,
+        thinkingLevelMap: catalogModel?.thinkingLevelMap,
+        input: catalogModel?.input ?? ["text"],
+        cost: catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
+        compat: buildCompat(id),
+    };
+}
 function mapFromModelsList(entry, modelsDev) {
     const id = entry.id;
     if (!id)
@@ -204,6 +243,22 @@ function mapFromModelsList(entry, modelsDev) {
         compat: buildCompat(id),
     };
 }
+async function discoverFromHealth(base, apiKey, options) {
+    const healthResult = await fetchJson(`${base}/health`, apiKey, options);
+    if (!healthResult.ok)
+        return [];
+    const endpoints = (healthResult.data.healthy_endpoints ?? []).filter((entry) => entry.model || entry.model_id);
+    const models = await Promise.all(endpoints.map(async (endpoint) => {
+        if (!endpoint.model_id)
+            return mapFromHealthEndpoint(endpoint);
+        const infoResult = await fetchJson(`${base}/model/info?litellm_model_id=${encodeURIComponent(endpoint.model_id)}`, apiKey, options);
+        if (!infoResult.ok)
+            return mapFromHealthEndpoint(endpoint);
+        const entry = infoResult.data.data?.[0];
+        return entry ? mapFromHealthModelInfo(entry, endpoint.model) : mapFromHealthEndpoint(endpoint);
+    }));
+    return models.filter((model) => model !== undefined);
+}
 export async function discoverModels(baseUrl, apiKey, options = {}) {
     const base = normalizeBaseUrl(baseUrl);
     const infoResult = await fetchJson(`${base}/model/info`, apiKey, options);
@@ -218,6 +273,11 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
     }
     const listResult = await fetchJson(`${base}/v1/models`, apiKey, options);
     if (!listResult.ok) {
+        if ([401, 403, 404].includes(listResult.status)) {
+            const models = await discoverFromHealth(base, apiKey, options);
+            if (models.length > 0)
+                return { source: "health", models };
+        }
         throw new Error(`/v1/models returned ${listResult.status}`);
     }
     const modelsDev = await getModelsDevCatalog(options);

package/dist/gcloud-token-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gcloud-token-cli.js

@@ -0,0 +1,8 @@
+import { getGcloudToken } from "./gcloud-token.js";
+const token = await getGcloudToken();
+if (token) {
+    process.stdout.write(token);
+}
+else {
+    process.exitCode = 1;
+}

package/dist/gcloud-token.d.ts

@@ -0,0 +1,7 @@
+export declare const CACHE_TTL_MS: number;
+export declare const GCLOUD_TOKEN_CACHE_KEY = "gcloud-adc";
+export declare function isGcloudTokenAuthEnabled(): boolean;
+export declare function getGcloudTokenCommand(): string;
+export declare function getGcloudTokenCacheKey(): Promise<string | null>;
+export declare function getGcloudToken(): Promise<string | null>;
+export declare function resetGcloudTokenCache(): void;

package/dist/gcloud-token.js

@@ -0,0 +1,133 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+export const CACHE_TTL_MS = 50 * 60 * 1000;
+export const GCLOUD_TOKEN_CACHE_KEY = "gcloud-adc";
+const ADC_FILENAME = "application_default_credentials.json";
+let cachedToken = null;
+let cachedAt = 0;
+let cachedTokenKey = null;
+function isAuthorizedUserCredentials(credentials) {
+    return (credentials.type === "authorized_user" &&
+        typeof credentials.client_id === "string" &&
+        typeof credentials.client_secret === "string" &&
+        typeof credentials.refresh_token === "string");
+}
+export function isGcloudTokenAuthEnabled() {
+    const raw = process.env.LITELLM_GCLOUD_TOKEN_AUTH;
+    return raw !== undefined && raw !== "" && raw !== "0";
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+export function getGcloudTokenCommand() {
+    const cliPath = fileURLToPath(new URL("./gcloud-token-cli.js", import.meta.url));
+    return `!${shellQuote(process.execPath)} ${shellQuote(cliPath)}`;
+}
+function getAdcPath() {
+    const envPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (envPath)
+        return envPath;
+    const candidates = [join(homedir(), ".config", "gcloud", ADC_FILENAME)];
+    if (process.env.APPDATA)
+        candidates.push(join(process.env.APPDATA, "gcloud", ADC_FILENAME));
+    return candidates.find((path) => existsSync(path)) ?? null;
+}
+function getCredentialsCacheKey(credentials) {
+    if (isAuthorizedUserCredentials(credentials)) {
+        return `${GCLOUD_TOKEN_CACHE_KEY}:authorized_user:${credentials.client_id}:${credentials.refresh_token}`;
+    }
+    return null;
+}
+async function readCredentials(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export async function getGcloudTokenCacheKey() {
+    const adcPath = getAdcPath();
+    if (!adcPath) {
+        console.warn("LiteLLM gcloud auth: No Google ADC file found. Set GOOGLE_APPLICATION_CREDENTIALS or run `gcloud auth application-default login`.");
+        return null;
+    }
+    const credentials = await readCredentials(adcPath);
+    if (!credentials) {
+        console.warn(`LiteLLM gcloud auth: Failed to read ADC file: ${adcPath}`);
+        return null;
+    }
+    const cacheKey = getCredentialsCacheKey(credentials);
+    if (cacheKey)
+        return cacheKey;
+    if (credentials.type === "service_account") {
+        console.warn("LiteLLM gcloud auth: Service account credentials are not supported; use authorized_user ADC.");
+        return null;
+    }
+    console.warn(`LiteLLM gcloud auth: Unknown credential type: ${credentials.type ?? "missing"}`);
+    return null;
+}
+async function exchangeRefreshToken(credentials) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: credentials.client_id,
+        client_secret: credentials.client_secret,
+        refresh_token: credentials.refresh_token,
+    }).toString();
+    try {
+        const response = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            console.warn(`LiteLLM gcloud auth: Token exchange failed (${response.status}): ${await response.text()}`);
+            return null;
+        }
+        const data = (await response.json());
+        return typeof data.access_token === "string" && data.access_token ? data.access_token : null;
+    }
+    catch (error) {
+        console.warn(`LiteLLM gcloud auth: Token exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+export async function getGcloudToken() {
+    const adcPath = getAdcPath();
+    if (!adcPath) {
+        console.warn("LiteLLM gcloud auth: No Google ADC file found. Set GOOGLE_APPLICATION_CREDENTIALS or run `gcloud auth application-default login`.");
+        return null;
+    }
+    const credentials = await readCredentials(adcPath);
+    if (!credentials) {
+        console.warn(`LiteLLM gcloud auth: Failed to read ADC file: ${adcPath}`);
+        return null;
+    }
+    const cacheKey = getCredentialsCacheKey(credentials);
+    if (cacheKey && cachedToken && cachedTokenKey === cacheKey && Date.now() - cachedAt < CACHE_TTL_MS)
+        return cachedToken;
+    if (isAuthorizedUserCredentials(credentials)) {
+        const token = await exchangeRefreshToken(credentials);
+        if (token) {
+            cachedToken = token;
+            cachedTokenKey = cacheKey;
+            cachedAt = Date.now();
+        }
+        return token;
+    }
+    if (credentials.type === "service_account") {
+        console.warn("LiteLLM gcloud auth: Service account credentials are not supported; use authorized_user ADC.");
+        return null;
+    }
+    console.warn(`LiteLLM gcloud auth: Unknown credential type: ${credentials.type ?? "missing"}`);
+    return null;
+}
+export function resetGcloudTokenCache() {
+    cachedToken = null;
+    cachedTokenKey = null;
+    cachedAt = 0;
+}

package/dist/index.js

@@ -5,7 +5,10 @@ import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { fingerprint, readCache, writeCache } from "./cache.js";
 import { setupLiteLLMCostTracking } from "./cost.js";
 import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent } from "./discover.js";
+import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
+import { createMcpToolDefinitions } from "./mcp-tools.js";
+import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
 const ENV_BASE_URL = "LITELLM_BASE_URL";
 const ENV_API_KEY = "LITELLM_API_KEY";
@@ -82,27 +85,51 @@ async function resolveCredentials({ executeHelpers = true } = {}) {
     const envBase = cleanConfig(process.env[ENV_BASE_URL]);
     const envKey = cleanConfig(process.env[ENV_API_KEY]);
     const envHelperCommand = getApiKeyHelperCommand();
+    const useGcloudToken = isGcloudTokenAuthEnabled();
     const authBase = entry?.type === "oauth" ? entry.baseUrl?.trim() : undefined;
+    const gcloudCacheKey = useGcloudToken && !entry ? ((await getGcloudTokenCacheKey()) ?? undefined) : undefined;
     const authKey = entry?.type === "oauth"
         ? (executeHelpers ? resolveOAuthApiKey(entry) : entry.access).trim()
         : entry?.type === "api_key"
             ? (await AuthStorage.create(getAuthPath()).getApiKey(PROVIDER_NAME, { includeFallback: false }))?.trim()
             : undefined;
-    const apiKey = authKey || (executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined) || envKey;
-    const apiKeyFingerprint = entry?.type === "oauth" && entry.refresh.startsWith("!")
-        ? fingerprint(entry.refresh)
-        : authKey
-            ? fingerprint(authKey)
-            : envHelperCommand
-                ? fingerprint(envHelperCommand)
-                : envKey
-                    ? fingerprint(envKey)
-                    : undefined;
+    const gcloudKey = executeHelpers && gcloudCacheKey ? (await getGcloudToken())?.trim() : undefined;
+    const helperKey = !authKey && !gcloudKey && executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined;
+    const apiKey = authKey || gcloudKey || helperKey || envKey;
+    let apiKeyFingerprint;
+    let apiKeyConfig;
+    if (entry?.type === "oauth" && entry.refresh.startsWith("!")) {
+        apiKeyFingerprint = fingerprint(entry.refresh);
+    }
+    else if (authKey) {
+        apiKeyFingerprint = fingerprint(authKey);
+    }
+    else if (gcloudKey) {
+        apiKeyFingerprint = fingerprint(gcloudCacheKey ?? gcloudKey);
+        apiKeyConfig = getGcloudTokenCommand();
+    }
+    else if (!executeHelpers && gcloudCacheKey) {
+        apiKeyFingerprint = fingerprint(gcloudCacheKey);
+        apiKeyConfig = getGcloudTokenCommand();
+    }
+    else if (helperKey && envHelperCommand) {
+        apiKeyFingerprint = fingerprint(envHelperCommand);
+        apiKeyConfig = envHelperCommand;
+    }
+    else if (!executeHelpers && envHelperCommand) {
+        apiKeyFingerprint = fingerprint(envHelperCommand);
+        apiKeyConfig = envHelperCommand;
+    }
+    else if (envKey) {
+        apiKeyFingerprint = fingerprint(envKey);
+        apiKeyConfig = `$${ENV_API_KEY}`;
+    }
     const rawBase = authBase || envBase;
     return {
         baseUrl: rawBase ? normalizeBaseUrl(rawBase) : undefined,
         apiKey: apiKey || undefined,
         apiKeyFingerprint,
+        apiKeyConfig,
     };
 }
 function getDiscoveryTimeoutMs() {
@@ -274,6 +301,7 @@ export default async function (pi) {
         getDiscoveryTimeoutMs() > 0 &&
         (!cacheValid || isListModelsMode());
     let credentialWarning;
+    let liveDiscoveryApiKey;
     if (shouldFetch) {
         try {
             creds = await resolveCredentials();
@@ -304,6 +332,7 @@ export default async function (pi) {
         }
         else {
             models = result.models;
+            liveDiscoveryApiKey = creds.apiKey;
             const next = {
                 baseUrl: creds.baseUrl,
                 apiKeyFingerprint: fp,
@@ -330,7 +359,7 @@ export default async function (pi) {
         getApiKey: getLiteLLMApiKey,
         modifyModels: modifyLiteLLMModels,
     };
-    function registerProvider(baseUrl, models) {
+    function registerProvider(baseUrl, models, apiKeyConfig = creds.apiKeyConfig ?? getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`) {
         pi.registerProvider(PROVIDER_NAME, {
             baseUrl: baseUrl ? `${baseUrl}/v1` : "https://litellm.example.com/v1",
             // When LITELLM_API_KEY_HELPER is set we register the helper as a `!command` provider key.
@@ -340,7 +369,7 @@ export default async function (pi) {
             // resolveConfigValue). So a short-lived/rotating helper token stays fresh. The OAuth hooks
             // remain registered for `/login litellm` users. See the regression test
             // "re-runs the helper command on every request" in tests/index.test.ts.
-            apiKey: getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`,
+            apiKey: apiKeyConfig,
             api: "openai-completions",
             models,
             oauth,
@@ -356,6 +385,45 @@ export default async function (pi) {
             return `${ENV_TIMEOUT}=0`;
         return null;
     }
+    async function resolveRuntimeApiKey() {
+        const fresh = await resolveCredentials();
+        if (!fresh.apiKey)
+            throw new Error("no credentials. Run /login litellm or set env vars.");
+        return fresh.apiKey;
+    }
+    function registerSkillTools(baseUrl) {
+        if (!baseUrl)
+            return;
+        for (const tool of createSkillToolDefinitions(baseUrl, resolveRuntimeApiKey)) {
+            pi.registerTool(tool);
+        }
+    }
+    function seededRuntimeApiKey(seed) {
+        let first = seed;
+        return async () => {
+            if (first) {
+                const value = first;
+                first = undefined;
+                return value;
+            }
+            return resolveRuntimeApiKey();
+        };
+    }
+    async function registerMcpTools(baseUrl, discoveryApiKey) {
+        if (!baseUrl || !discoveryApiKey || discoveryDisabledReason())
+            return;
+        try {
+            const tools = await createMcpToolDefinitions(baseUrl, seededRuntimeApiKey(discoveryApiKey));
+            for (const tool of tools) {
+                pi.registerTool(tool);
+            }
+        }
+        catch (error) {
+            process.stderr.write(`LiteLLM: MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
+        }
+    }
+    registerSkillTools(creds.baseUrl);
+    await registerMcpTools(creds.baseUrl, liveDiscoveryApiKey);
     async function refreshModelsAndCosts() {
         const fresh = await resolveCredentials();
         const freshFp = fresh.apiKeyFingerprint;
@@ -371,9 +439,10 @@ export default async function (pi) {
             source: result.source,
             models: result.models,
         });
-        registerProvider(fresh.baseUrl, result.models);
+        registerProvider(fresh.baseUrl, result.models, fresh.apiKeyConfig);
         updateCosts(result.models);
         cacheFetchedAt = now;
+        await registerMcpTools(fresh.baseUrl, fresh.apiKey);
         return { models: result.models, source: result.source };
     }
     function runRefresh() {
@@ -402,6 +471,10 @@ export default async function (pi) {
         });
         ctx.modelRegistry.authStorage.set(PROVIDER_NAME, { type: "oauth", ...credential });
         ctx.modelRegistry.refresh();
+        const credentialBaseUrl = credential.baseUrl;
+        const credentialAccess = typeof credential.access === "string" ? credential.access : undefined;
+        registerSkillTools(credentialBaseUrl);
+        await registerMcpTools(credentialBaseUrl, credentialAccess);
         ctx.ui.notify(`Logged in to LiteLLM. Credentials saved to ${getAuthPath()}`, "info");
     }
     pi.on("input", async (event, ctx) => {
@@ -451,6 +524,18 @@ export default async function (pi) {
             return;
         return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, sessionId);
     });
+    pi.on("before_agent_start", async (event) => {
+        if (discoveryDisabledReason())
+            return;
+        const fresh = await resolveCredentials();
+        if (!fresh.baseUrl || !fresh.apiKey)
+            return;
+        const skills = await listSkills(fresh.baseUrl, fresh.apiKey);
+        const section = createSkillsPromptSection(skills);
+        if (!section)
+            return;
+        return { systemPrompt: `${event.systemPrompt}\n\n${section}` };
+    });
     pi.on("message_end", (event) => {
         if (event.message.role !== "assistant")
             return;

package/dist/mcp-tools.d.ts

@@ -0,0 +1,5 @@
+import { type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { LiteLLMMcpTool } from "./types.js";
+export declare function discoverMcpTools(baseUrl: string, apiKey: string): Promise<LiteLLMMcpTool[]>;
+export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>): Promise<string>;
+export declare function createMcpToolDefinitions(baseUrl: string, getApiKey: () => Promise<string>): Promise<ToolDefinition[]>;

package/dist/mcp-tools.js

@@ -0,0 +1,175 @@
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { normalizeBaseUrl } from "./discover.js";
+const LIST_TIMEOUT_MS = 10_000;
+const CALL_TIMEOUT_MS = 30_000;
+function withTimeout(timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`Timed out after ${timeoutMs}ms`)), timeoutMs);
+    return {
+        signal: controller.signal,
+        cancel: () => clearTimeout(timer),
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function normalizeMcpTool(value) {
+    const raw = asRecord(value);
+    if (!raw)
+        return undefined;
+    const name = stringValue(raw.name);
+    const serverName = stringValue(raw.mcp_info?.server_name) ??
+        stringValue(raw.server_name) ??
+        stringValue(raw.mcp_info?.server_id) ??
+        stringValue(raw.server_id);
+    if (!name || !serverName)
+        return undefined;
+    const inputSchema = asRecord(raw.inputSchema) ?? asRecord(raw.input_schema) ?? { type: "object", properties: {} };
+    return {
+        name,
+        server_name: serverName,
+        server_id: stringValue(raw.mcp_info?.server_id) ?? stringValue(raw.server_id) ?? serverName,
+        description: stringValue(raw.description) ?? name,
+        input_schema: inputSchema,
+    };
+}
+export async function discoverMcpTools(baseUrl, apiKey) {
+    const { signal, cancel } = withTimeout(LIST_TIMEOUT_MS);
+    try {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/list`, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal,
+        });
+        if (!response.ok)
+            return [];
+        const body = (await response.json());
+        const bodyRecord = asRecord(body);
+        const rawTools = Array.isArray(body) ? body : Array.isArray(bodyRecord?.tools) ? bodyRecord.tools : [];
+        return rawTools.map(normalizeMcpTool).filter((tool) => tool !== undefined);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        cancel();
+    }
+}
+export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args) {
+    const { signal, cancel } = withTimeout(CALL_TIMEOUT_MS);
+    try {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/call`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ server_id: serverId, name: toolName, arguments: args }),
+            signal,
+        });
+        if (!response.ok)
+            return `Error calling ${toolName} on ${serverId}: HTTP ${response.status}`;
+        const body = (await response.json());
+        return JSON.stringify("result" in body ? body.result : body, null, 2);
+    }
+    catch (error) {
+        return `Error calling ${toolName} on ${serverId}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    finally {
+        cancel();
+    }
+}
+function sanitizeName(name) {
+    const sanitized = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "");
+    return sanitized || "tool";
+}
+function isMappableSchema(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const schema = value;
+    if ("$ref" in schema || "anyOf" in schema || "oneOf" in schema || "allOf" in schema)
+        return false;
+    if (["string", "number", "integer", "boolean"].includes(String(schema.type)))
+        return true;
+    if (schema.type === "array") {
+        const items = schema.items;
+        return items?.type === "string";
+    }
+    return false;
+}
+function mapPropertySchema(name, schema) {
+    const description = typeof schema.description === "string" ? schema.description : name;
+    switch (schema.type) {
+        case "string":
+            return Type.String({ description });
+        case "number":
+            return Type.Number({ description });
+        case "integer":
+            return Type.Integer({ description });
+        case "boolean":
+            return Type.Boolean({ description });
+        case "array":
+            return Type.Array(Type.String(), { description });
+        default:
+            return Type.Unknown({ description });
+    }
+}
+function buildParameters(inputSchema) {
+    const properties = inputSchema.properties;
+    if (!properties || typeof properties !== "object") {
+        return Type.Object({
+            args: Type.Record(Type.String(), Type.Unknown(), { description: "Tool arguments as key-value pairs" }),
+        });
+    }
+    const required = Array.isArray(inputSchema.required)
+        ? inputSchema.required.filter((key) => typeof key === "string")
+        : [];
+    const mapped = {};
+    for (const [key, property] of Object.entries(properties)) {
+        if (!isMappableSchema(property)) {
+            return Type.Object({
+                args: Type.Record(Type.String(), Type.Unknown(), { description: "Tool arguments as key-value pairs" }),
+            });
+        }
+        const field = mapPropertySchema(key, property);
+        mapped[key] = required.includes(key) ? field : Type.Optional(field);
+    }
+    return Type.Object(mapped);
+}
+export async function createMcpToolDefinitions(baseUrl, getApiKey) {
+    const discoveryApiKey = await getApiKey();
+    const tools = await discoverMcpTools(baseUrl, discoveryApiKey);
+    return tools.map((mcpTool) => {
+        const safeServer = sanitizeName(mcpTool.server_name);
+        const safeTool = sanitizeName(mcpTool.name);
+        const parameters = buildParameters(mcpTool.input_schema);
+        return defineTool({
+            name: `mcp_${safeServer}_${safeTool}`,
+            label: `${mcpTool.server_name}: ${mcpTool.name}`,
+            description: `${mcpTool.description} (via ${mcpTool.server_name} MCP server)`,
+            promptSnippet: `${mcpTool.description} via ${mcpTool.server_name} MCP server`,
+            parameters,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                const rawParams = params;
+                const args = Object.keys(rawParams).length === 1 && rawParams.args && typeof rawParams.args === "object"
+                    ? rawParams.args
+                    : rawParams;
+                const text = await executeMcpTool(baseUrl, apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { server: mcpTool.server_name, serverId: mcpTool.server_id, tool: mcpTool.name },
+                };
+            },
+        });
+    });
+}

package/dist/skills.d.ts

@@ -0,0 +1,13 @@
+import { type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { LiteLLMSkill } from "./types.js";
+export declare function listSkills(baseUrl: string, apiKey: string): Promise<LiteLLMSkill[]>;
+export declare function createSkill(baseUrl: string, apiKey: string, input: {
+    name: string;
+    description: string;
+    code: string;
+    inputSchema?: Record<string, unknown>;
+}): Promise<unknown>;
+export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string): Promise<void>;
+export declare function createSkillsPromptSection(skills: LiteLLMSkill[]): string | undefined;
+export declare function createSkillToolDefinitions(baseUrl: string, getApiKey: () => Promise<string>): ToolDefinition[];
+export declare function resetSkillsCache(): void;

package/dist/skills.js

@@ -0,0 +1,145 @@
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { normalizeBaseUrl } from "./discover.js";
+const SKILLS_CACHE_TTL_MS = 60_000;
+let skillsCache;
+function getSkillsFromBody(body) {
+    if (Array.isArray(body))
+        return body;
+    if (body && typeof body === "object") {
+        const record = body;
+        if (Array.isArray(record.data))
+            return record.data;
+        if (Array.isArray(record.skills))
+            return record.skills;
+    }
+    return [];
+}
+export async function listSkills(baseUrl, apiKey) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    if (skillsCache &&
+        skillsCache.baseUrl === normalizedBaseUrl &&
+        skillsCache.apiKey === apiKey &&
+        Date.now() - skillsCache.fetchedAt < SKILLS_CACHE_TTL_MS) {
+        return skillsCache.skills;
+    }
+    try {
+        const response = await fetch(`${normalizedBaseUrl}/v1/skills`, {
+            headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok)
+            return [];
+        const skills = getSkillsFromBody(await response.json());
+        skillsCache = { baseUrl: normalizedBaseUrl, apiKey, fetchedAt: Date.now(), skills };
+        return skills;
+    }
+    catch {
+        return [];
+    }
+}
+export async function createSkill(baseUrl, apiKey, input) {
+    const response = await fetch(`${normalizeBaseUrl(baseUrl)}/v1/skills`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            name: input.name,
+            description: input.description,
+            code: input.code,
+            input_schema: input.inputSchema ?? { type: "object", properties: {} },
+        }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`LiteLLM skill create failed: HTTP ${response.status}`);
+    skillsCache = undefined;
+    return response.json().catch(() => ({}));
+}
+export async function deleteSkill(baseUrl, apiKey, skillId) {
+    const response = await fetch(`${normalizeBaseUrl(baseUrl)}/v1/skills/${encodeURIComponent(skillId)}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok && response.status !== 404)
+        throw new Error(`LiteLLM skill delete failed: HTTP ${response.status}`);
+    skillsCache = undefined;
+}
+function escapeXml(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+export function createSkillsPromptSection(skills) {
+    const enabled = skills.filter((skill) => skill.enabled !== false && skill.name);
+    if (enabled.length === 0)
+        return undefined;
+    const body = enabled
+        .map((skill) => {
+        const description = skill.description?.trim() || "No description provided.";
+        return `<skill name="${escapeXml(skill.name)}">\n${escapeXml(description)}\n</skill>`;
+    })
+        .join("\n");
+    return `LiteLLM Skills Gateway provided these active skills. Use them as additional guidance when relevant.\n<litellm_skills>\n${body}\n</litellm_skills>`;
+}
+function formatSkills(skills) {
+    if (skills.length === 0)
+        return "No LiteLLM skills are registered.";
+    return skills
+        .map((skill) => `- ${skill.name}${skill.enabled === false ? " (disabled)" : ""}: ${skill.description ?? ""}`)
+        .join("\n");
+}
+const CreateSkillParams = Type.Object({
+    name: Type.String({ description: "Skill name" }),
+    description: Type.String({ description: "Skill description" }),
+    code: Type.String({ description: "Skill implementation or prompt code" }),
+    inputSchemaJson: Type.Optional(Type.String({ description: "Optional JSON Schema string for skill inputs" })),
+});
+const DeleteSkillParams = Type.Object({
+    skillId: Type.String({ description: "LiteLLM skill id" }),
+});
+export function createSkillToolDefinitions(baseUrl, getApiKey) {
+    return [
+        defineTool({
+            name: "litellm_skill_list",
+            label: "LiteLLM Skills",
+            description: "List skills registered on the LiteLLM proxy Skills Gateway.",
+            promptSnippet: "List LiteLLM Skills Gateway skills",
+            parameters: Type.Object({}),
+            async execute() {
+                const apiKey = await getApiKey();
+                const skills = await listSkills(baseUrl, apiKey);
+                return { content: [{ type: "text", text: formatSkills(skills) }], details: { count: skills.length } };
+            },
+        }),
+        defineTool({
+            name: "litellm_skill_create",
+            label: "Create LiteLLM Skill",
+            description: "Create a skill on the LiteLLM proxy Skills Gateway.",
+            parameters: CreateSkillParams,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                const inputSchema = params.inputSchemaJson
+                    ? JSON.parse(params.inputSchemaJson)
+                    : undefined;
+                const result = await createSkill(baseUrl, apiKey, { ...params, inputSchema });
+                return { content: [{ type: "text", text: "LiteLLM skill created." }], details: { result } };
+            },
+        }),
+        defineTool({
+            name: "litellm_skill_delete",
+            label: "Delete LiteLLM Skill",
+            description: "Delete a skill from the LiteLLM proxy Skills Gateway.",
+            parameters: DeleteSkillParams,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                await deleteSkill(baseUrl, apiKey, params.skillId);
+                return { content: [{ type: "text", text: `LiteLLM skill deleted: ${params.skillId}` }], details: {} };
+            },
+        }),
+    ];
+}
+export function resetSkillsCache() {
+    skillsCache = undefined;
+}

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
-export type DiscoverySource = "model_info" | "models_list";
+export type DiscoverySource = "model_info" | "models_list" | "health";
 export interface CacheFile {
     baseUrl: string;
     apiKeyFingerprint: string;
@@ -32,6 +32,14 @@ export interface ModelInfoEntry {
 export interface ModelInfoResponse {
     data?: ModelInfoEntry[];
 }
+export interface HealthModelEntry {
+    model?: string;
+    model_id?: string;
+    api_base?: string;
+}
+export interface HealthResponse {
+    healthy_endpoints?: HealthModelEntry[];
+}
 export interface ModelsListEntry {
     id?: string;
     owned_by?: string;
@@ -53,4 +61,20 @@ export interface ResolvedCredentials {
     baseUrl?: string;
     apiKey?: string;
     apiKeyFingerprint?: string;
+    apiKeyConfig?: string;
+}
+export interface LiteLLMMcpTool {
+    name: string;
+    server_name: string;
+    server_id?: string;
+    description: string;
+    input_schema: Record<string, unknown>;
+}
+export interface LiteLLMSkill {
+    id?: string;
+    name: string;
+    description?: string;
+    enabled?: boolean;
+    input_schema?: Record<string, unknown>;
+    code?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -64,11 +64,11 @@
     "protobufjs": "8.2.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.78.1",
-    "@earendil-works/pi-coding-agent": "^0.78.1",
+    "@earendil-works/pi-ai": "^0.79.1",
+    "@earendil-works/pi-coding-agent": "^0.79.1",
     "@biomejs/biome": "^2.4.15",
     "@types/node": "^25.9.1",
-    "@typescript/native-preview": "7.0.0-dev.20260607.1",
+    "@typescript/native-preview": "7.0.0-dev.20260610.1",
     "shx": "^0.4.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",