pi-provider-litellm 1.2.6 → 1.2.8

package/README.md

@@ -2,7 +2,7 @@
 
 LiteLLM proxy provider extension for [Pi](https://pi.dev).
 
-Discovers models from a self-hosted LiteLLM proxy and registers them under the `litellm` provider. Supports `/login litellm` and `/litellm-refresh`. Tries `/model/info` first (admin endpoint with rich metadata), falls back to `/v1/models` (OpenAI-compatible) on 401/403/404.
+Discovers models from a self-hosted LiteLLM proxy and registers them under the `litellm` provider. Supports `/login litellm`, `/litellm-refresh`, LiteLLM MCP tools, LiteLLM Skills Gateway prompt injection, and Google ADC token auth. Tries `/model/info` first (admin endpoint with rich metadata), falls back to `/v1/models` (OpenAI-compatible) on 401/403/404, then tries `/health` plus per-endpoint `/model/info` for older LiteLLM proxies.
 
 ## Install
 
@@ -44,6 +44,21 @@ You can also run `/login`, select `Use a subscription`, then select `LiteLLM`.
 
 You'll be prompted for the base URL and API key. Credentials are persisted to `~/.pi/agent/auth.json`.
 
+#### Enterprise SSO login
+
+If your LiteLLM proxy requires SSO/OAuth authentication (enterprise deployments), you can authenticate via a browser SSO flow and optionally pair the resulting JWT with a stable virtual key:
+
+1. Run `/login litellm` inside pi
+2. Enter the proxy URL
+3. At the login method prompt, enter `2` for SSO / Enterprise JWT
+4. Your default browser opens the LiteLLM SSO login URL (e.g. `https://litellm.your-domain.com/sso/key/generate`) automatically — the URL is also displayed in case it can't be opened. Authenticate via SSO
+5. Copy your token from the LiteLLM UI and paste it at the prompt (copying a full `Bearer ...` header value is fine — the prefix is stripped automatically)
+6. When prompted to generate a virtual key, press Enter to accept (recommended) or enter `n` to use the JWT directly
+
+When you generate a virtual key, the resulting `sk-...` key is stored as your credential and used for all API requests. If the proxy's key policy attaches an expiry to the generated key, Pi will prompt you to re-authenticate when it nears expiry; otherwise the key is treated as permanent until revoked in LiteLLM.
+
+When using a JWT directly, the extension reads its `exp` claim and Pi will prompt you to re-authenticate when the token nears expiry. Run `/login litellm` again to refresh.
+
 ### Option B — environment variables
 
 ```bash
@@ -64,43 +79,41 @@ Stored pi credentials for `litellm` take precedence over `LITELLM_API_KEY`; the
 | Variable | Default | Effect |
 |---|---|---|
 | `LITELLM_API_KEY_HELPER` | unset | Command that prints a fresh LiteLLM bearer token. Takes precedence over `LITELLM_API_KEY`. Registered as a `!command` provider key; Pi re-runs it on every request (the per-request auth path is uncached), so rotating/short-lived tokens stay fresh. |
+| `LITELLM_GCLOUD_TOKEN_AUTH` | unset | If set to a non-empty value other than `0`, use Google Application Default Credentials as the LiteLLM bearer token source when no stored `/login litellm` credential exists. If ADC is unavailable, the extension falls back to `LITELLM_API_KEY_HELPER` or `LITELLM_API_KEY`. |
+| `GOOGLE_APPLICATION_CREDENTIALS` | Google default ADC path | Optional path to an ADC JSON file used by `LITELLM_GCLOUD_TOKEN_AUTH`. If unset, the extension checks the default gcloud ADC locations. |
 | `LITELLM_OFFLINE` | unset | If `1`, skip discovery on this start; use cache only |
 | `LITELLM_DISCOVERY_TIMEOUT_MS` | `5000` | Discovery fetch timeout in ms; `0` to skip discovery |
 
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` only disables startup and refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
-## Mocked LiteLLM smoke workflow
-
-The `LiteLLM Smoke` GitHub Actions workflow starts VidaiMock and a real LiteLLM proxy on the runner. LiteLLM exposes OpenAI-compatible and Anthropic routes whose upstreams are served by VidaiMock, then this extension's smoke runner discovers those models through LiteLLM and sends `/v1/chat/completions` requests through the proxy.
-
-This keeps the LiteLLM integration path under test but does not call real LLM APIs. No provider API keys or GitHub Models permission are required. The workflow also runs a non-interactive Pi CLI smoke with `--list-models` and `-p` so extension loading, model discovery, and a real completion path are covered without opening the TUI.
+### Google ADC token auth
 
-## Development
-
-This package requires Node.js `>=22.19.0`. CI currently uses Node `24.16.0`.
+When your LiteLLM proxy accepts Google OAuth access tokens, you can let the extension refresh tokens from Application Default Credentials:
 
 ```bash
-npm ci
-npm run check
-npm run clean && npm run build
+gcloud auth application-default login
+export LITELLM_BASE_URL="https://litellm.your-domain.com"
+export LITELLM_GCLOUD_TOKEN_AUTH=1
 ```
 
-`npm run check` runs Biome, type checking, and the Vitest suite. Runtime changes must be built before local Pi smoke checks because the extension entrypoint is `./dist/index.js`.
+Only `authorized_user` ADC files are supported. Service account JSON files are rejected with a warning. Tokens are cached in memory for 50 minutes and are keyed by the ADC identity, so switching `GOOGLE_APPLICATION_CREDENTIALS` or changing `gcloud auth application-default login` users refreshes both request auth and model discovery cache identity. When ADC is available, the registered provider key is a Pi `!command`, so request-time auth resolves a fresh token when Pi sends model requests. If ADC cannot be read, provider registration uses the same helper or environment API key that discovery used.
 
-Before changing package contents or dependency policy, also run:
+## LiteLLM MCP tools
 
-```bash
-npm run supply-chain:guard
-npm pack --dry-run
-```
+If your LiteLLM proxy exposes MCP REST endpoints, this extension discovers tools from:
+
+- `GET /mcp-rest/tools/list`
+- `POST /mcp-rest/tools/call`
 
-The published npm package should contain only `dist`, `README.md`, and `LICENSE`.
+Each discovered tool is registered as a native Pi tool named `mcp_<server>_<tool>`, with simple JSON Schema parameters mapped to Pi/TypeBox parameters. Complex schemas fall back to a single `args` object. The extension accepts LiteLLM's `tools` response shape with `inputSchema` and `mcp_info`, and executes tools with LiteLLM's `server_id`, `name`, and `arguments` fields. MCP discovery runs after successful live model discovery, `/login litellm`, or `/litellm-refresh`; it does not force network or helper-token access when a fresh model cache is used.
 
-## Release
+## LiteLLM Skills Gateway
 
-Releases are driven by semver tags named `v*.*.*`. The GitHub release workflow installs from the lockfile, runs the checks, builds `dist`, verifies the package tarball, publishes to npm with provenance, and creates a GitHub release.
+If your LiteLLM proxy exposes `/v1/skills`, enabled skills are fetched before each agent turn and appended to the system prompt as a `litellm_skills` section. The extension also registers Pi tools for basic Skills Gateway management:
 
-Before tagging a release, keep `package.json` and `package-lock.json` versions in sync and verify the dry-run package contents.
+- `litellm_skill_list`
+- `litellm_skill_create`
+- `litellm_skill_delete`
 
 ## Slash commands
 
@@ -108,7 +121,7 @@ Before tagging a release, keep `package.json` and `package-lock.json` versions i
 
 ## Cache
 
-The model list is cached at `~/.pi/agent/litellm-models.json` with a keyed fingerprint of the base URL + API key. Changing either invalidates the cache automatically.
+The model list is cached at `~/.pi/agent/litellm-models.json` with the base URL and a keyed fingerprint of the selected auth source. Changing the base URL, API key, helper command, or Google ADC identity invalidates the cache automatically.
 
 If the cache is older than 24 hours, the extension refreshes it in the background on session start (non-blocking). Failures are silent — the cached models remain in use. Run `/litellm-refresh` to force an immediate refresh.
 
@@ -117,10 +130,15 @@ If the cache is older than 24 hours, the extension refreshes it in the backgroun
 | Symptom | Likely cause |
 |---|---|
 | "no credentials" warning at startup | Env vars not set and no OAuth credential — run `/login litellm` |
-| "discovered no models" | Proxy returned an empty list — check pi's startup log for the actual response |
+| "discovered no models" | Proxy returned an empty list — check pi's startup log and verify `/model/info`, `/v1/models`, or `/health` responds |
 | `/model/info` returning 401/403/404 | Expected behavior with virtual keys — extension falls back to `/v1/models` |
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
 | `401 Token expired` | Set `LITELLM_API_KEY_HELPER`. |
+| No models with gcloud auth | Verify `gcloud auth application-default login` has been run or set `GOOGLE_APPLICATION_CREDENTIALS` to an `authorized_user` ADC file |
+| Enterprise SSO login shows "virtual key generation failed" | The LiteLLM instance may lack a database (`/key/generate` requires one), your user account may lack key-generation permission, or the request timed out; the JWT is used directly as a fallback |
+| Enterprise SSO token prompt fails with "SSO token is required" | The token field was left empty — paste the token copied from the LiteLLM UI |
+| MCP tools not showing | Verify the proxy exposes `/mcp-rest/tools/list` and run `/litellm-refresh` after fixing the proxy |
+| Skills not affecting prompts | Verify the proxy exposes `/v1/skills` and returns enabled skills |
 
 ## License
 

package/dist/cache.js

@@ -36,7 +36,7 @@ function isCacheFileShape(value) {
     return (typeof v.baseUrl === "string" &&
         typeof v.apiKeyFingerprint === "string" &&
         typeof v.fetchedAt === "number" &&
-        (v.source === "model_info" || v.source === "models_list") &&
+        (v.source === "model_info" || v.source === "models_list" || v.source === "health") &&
         Array.isArray(v.models));
 }
 export async function writeCache(path, cache) {

package/dist/discover.d.ts

@@ -4,4 +4,8 @@ export declare function normalizeBaseUrl(input: string): string;
 export declare function isMoonshotModel(modelId: string): boolean;
 export declare function shouldSuppressReasoningContent(modelId: string): boolean;
 export declare function buildCompat(modelId: string): ProviderModelConfig["compat"];
+export declare function withTimeout(timeoutMs: number, signal?: AbortSignal): {
+    signal: AbortSignal;
+    cancel: () => void;
+};
 export declare function discoverModels(baseUrl: string, apiKey: string, options?: DiscoveryOptions): Promise<DiscoveryResult>;

package/dist/discover.js

@@ -45,22 +45,53 @@ function toKnownProvider(provider) {
 }
 function findCatalogModel(id, ownedBy) {
     const prefixProvider = toKnownProvider(id.split("/")[0]);
-    const candidates = [toKnownProvider(ownedBy), prefixProvider].filter((provider) => provider !== undefined);
+    const lookupIds = catalogLookupIds(id);
+    const candidates = [toKnownProvider(ownedBy), prefixProvider, lookupIds.length > 1 ? "anthropic" : undefined].filter((provider) => provider !== undefined);
     for (const provider of candidates) {
-        const exact = getModels(provider).find((model) => model.id === id);
-        if (exact)
-            return exact;
-        const providerQualified = getModels(provider).find((model) => model.id === `${provider}/${id}`);
-        if (providerQualified)
-            return providerQualified;
+        const match = findCatalogModelInProvider(provider, lookupIds);
+        if (match)
+            return match;
     }
     for (const provider of getProviders()) {
-        const exact = getModels(provider).find((model) => model.id === id);
+        const match = findCatalogModelInProvider(provider, lookupIds);
+        if (match)
+            return match;
+    }
+    return undefined;
+}
+function catalogLookupIds(id) {
+    const lookupIds = new Set([id]);
+    const unprefixed = id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
+    lookupIds.add(unprefixed);
+    const anthropicAlias = unprefixed.toLowerCase().replaceAll(".", "-");
+    const match = /^(?:claude-)?(opus|sonnet|haiku)-(\d+)-(\d+)$/.exec(anthropicAlias);
+    if (match)
+        lookupIds.add(`claude-${match[1]}-${match[2]}-${match[3]}`);
+    return [...lookupIds];
+}
+function findCatalogModelInProvider(provider, lookupIds) {
+    for (const lookupId of lookupIds) {
+        const exact = getModels(provider).find((model) => model.id === lookupId);
         if (exact)
             return exact;
+        const providerQualified = getModels(provider).find((model) => model.id === `${provider}/${lookupId}`);
+        if (providerQualified)
+            return providerQualified;
     }
     return undefined;
 }
+function mapModelInfoCost(info, fallback) {
+    return {
+        input: info.input_cost_per_token !== undefined ? info.input_cost_per_token * 1_000_000 : (fallback?.input ?? 0),
+        output: info.output_cost_per_token !== undefined ? info.output_cost_per_token * 1_000_000 : (fallback?.output ?? 0),
+        cacheRead: info.cache_read_input_token_cost !== undefined
+            ? info.cache_read_input_token_cost * 1_000_000
+            : (fallback?.cacheRead ?? 0),
+        cacheWrite: info.cache_creation_input_token_cost !== undefined
+            ? info.cache_creation_input_token_cost * 1_000_000
+            : (fallback?.cacheWrite ?? 0),
+    };
+}
 function getFallbackProviderAndModel(id, ownedBy) {
     const [prefix, ...rest] = id.split("/");
     const prefixProvider = toKnownProvider(prefix);
@@ -75,7 +106,7 @@ function findModelsDevModel(catalog, id, ownedBy) {
         return undefined;
     return catalog?.[provider]?.models?.[modelId];
 }
-function withTimeout(timeoutMs, signal) {
+export function withTimeout(timeoutMs, signal) {
     const controller = new AbortController();
     const onAbort = () => controller.abort(signal?.reason);
     if (signal) {
@@ -170,19 +201,51 @@ function mapFromModelInfo(entry) {
     const info = entry.model_info ?? {};
     if (info.mode && info.mode !== "chat")
         return undefined;
+    const catalogModel = findCatalogModel(id);
     return {
         id,
         name: id,
         reasoning: info.supports_reasoning ?? false,
         input: info.supports_vision ? ["text", "image"] : ["text"],
-        cost: {
-            input: (info.input_cost_per_token ?? 0) * 1_000_000,
-            output: (info.output_cost_per_token ?? 0) * 1_000_000,
-            cacheRead: (info.cache_read_input_token_cost ?? 0) * 1_000_000,
-            cacheWrite: (info.cache_creation_input_token_cost ?? 0) * 1_000_000,
-        },
+        cost: mapModelInfoCost(info, catalogModel?.cost),
+        contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: info.max_output_tokens ?? DEFAULT_MAX_TOKENS,
+        compat: buildCompat(id),
+    };
+}
+function mapFromHealthModelInfo(entry, fallbackId) {
+    const model = mapFromModelInfo(entry);
+    if (model || !fallbackId)
+        return model;
+    if (entry.model_info?.mode && entry.model_info.mode !== "chat")
+        return undefined;
+    const info = entry.model_info ?? {};
+    const catalogModel = findCatalogModel(fallbackId);
+    return {
+        id: fallbackId,
+        name: fallbackId,
+        reasoning: info.supports_reasoning ?? false,
+        input: info.supports_vision ? ["text", "image"] : ["text"],
+        cost: mapModelInfoCost(info, catalogModel?.cost),
         contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
         maxTokens: info.max_output_tokens ?? DEFAULT_MAX_TOKENS,
+        compat: buildCompat(fallbackId),
+    };
+}
+function mapFromHealthEndpoint(entry) {
+    const id = entry.model;
+    if (!id)
+        return undefined;
+    const catalogModel = findCatalogModel(id);
+    return {
+        id,
+        name: catalogModel?.name ?? id,
+        reasoning: catalogModel?.reasoning ?? false,
+        thinkingLevelMap: catalogModel?.thinkingLevelMap,
+        input: catalogModel?.input ?? ["text"],
+        cost: catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
     };
 }
@@ -204,6 +267,22 @@ function mapFromModelsList(entry, modelsDev) {
         compat: buildCompat(id),
     };
 }
+async function discoverFromHealth(base, apiKey, options) {
+    const healthResult = await fetchJson(`${base}/health`, apiKey, options);
+    if (!healthResult.ok)
+        return [];
+    const endpoints = (healthResult.data.healthy_endpoints ?? []).filter((entry) => entry.model || entry.model_id);
+    const models = await Promise.all(endpoints.map(async (endpoint) => {
+        if (!endpoint.model_id)
+            return mapFromHealthEndpoint(endpoint);
+        const infoResult = await fetchJson(`${base}/model/info?litellm_model_id=${encodeURIComponent(endpoint.model_id)}`, apiKey, options);
+        if (!infoResult.ok)
+            return mapFromHealthEndpoint(endpoint);
+        const entry = infoResult.data.data?.[0];
+        return entry ? mapFromHealthModelInfo(entry, endpoint.model) : mapFromHealthEndpoint(endpoint);
+    }));
+    return models.filter((model) => model !== undefined);
+}
 export async function discoverModels(baseUrl, apiKey, options = {}) {
     const base = normalizeBaseUrl(baseUrl);
     const infoResult = await fetchJson(`${base}/model/info`, apiKey, options);
@@ -218,6 +297,11 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
     }
     const listResult = await fetchJson(`${base}/v1/models`, apiKey, options);
     if (!listResult.ok) {
+        if ([401, 403, 404].includes(listResult.status)) {
+            const models = await discoverFromHealth(base, apiKey, options);
+            if (models.length > 0)
+                return { source: "health", models };
+        }
         throw new Error(`/v1/models returned ${listResult.status}`);
     }
     const modelsDev = await getModelsDevCatalog(options);

package/dist/gcloud-token-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gcloud-token-cli.js

@@ -0,0 +1,8 @@
+import { getGcloudToken } from "./gcloud-token.js";
+const token = await getGcloudToken();
+if (token) {
+    process.stdout.write(token);
+}
+else {
+    process.exitCode = 1;
+}

package/dist/gcloud-token.d.ts

@@ -0,0 +1,7 @@
+export declare const CACHE_TTL_MS: number;
+export declare const GCLOUD_TOKEN_CACHE_KEY = "gcloud-adc";
+export declare function isGcloudTokenAuthEnabled(): boolean;
+export declare function getGcloudTokenCommand(): string;
+export declare function getGcloudTokenCacheKey(): Promise<string | null>;
+export declare function getGcloudToken(): Promise<string | null>;
+export declare function resetGcloudTokenCache(): void;

package/dist/gcloud-token.js

@@ -0,0 +1,133 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+export const CACHE_TTL_MS = 50 * 60 * 1000;
+export const GCLOUD_TOKEN_CACHE_KEY = "gcloud-adc";
+const ADC_FILENAME = "application_default_credentials.json";
+let cachedToken = null;
+let cachedAt = 0;
+let cachedTokenKey = null;
+function isAuthorizedUserCredentials(credentials) {
+    return (credentials.type === "authorized_user" &&
+        typeof credentials.client_id === "string" &&
+        typeof credentials.client_secret === "string" &&
+        typeof credentials.refresh_token === "string");
+}
+export function isGcloudTokenAuthEnabled() {
+    const raw = process.env.LITELLM_GCLOUD_TOKEN_AUTH;
+    return raw !== undefined && raw !== "" && raw !== "0";
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+export function getGcloudTokenCommand() {
+    const cliPath = fileURLToPath(new URL("./gcloud-token-cli.js", import.meta.url));
+    return `!${shellQuote(process.execPath)} ${shellQuote(cliPath)}`;
+}
+function getAdcPath() {
+    const envPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (envPath)
+        return envPath;
+    const candidates = [join(homedir(), ".config", "gcloud", ADC_FILENAME)];
+    if (process.env.APPDATA)
+        candidates.push(join(process.env.APPDATA, "gcloud", ADC_FILENAME));
+    return candidates.find((path) => existsSync(path)) ?? null;
+}
+function getCredentialsCacheKey(credentials) {
+    if (isAuthorizedUserCredentials(credentials)) {
+        return `${GCLOUD_TOKEN_CACHE_KEY}:authorized_user:${credentials.client_id}:${credentials.refresh_token}`;
+    }
+    return null;
+}
+async function readCredentials(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export async function getGcloudTokenCacheKey() {
+    const adcPath = getAdcPath();
+    if (!adcPath) {
+        console.warn("LiteLLM gcloud auth: No Google ADC file found. Set GOOGLE_APPLICATION_CREDENTIALS or run `gcloud auth application-default login`.");
+        return null;
+    }
+    const credentials = await readCredentials(adcPath);
+    if (!credentials) {
+        console.warn(`LiteLLM gcloud auth: Failed to read ADC file: ${adcPath}`);
+        return null;
+    }
+    const cacheKey = getCredentialsCacheKey(credentials);
+    if (cacheKey)
+        return cacheKey;
+    if (credentials.type === "service_account") {
+        console.warn("LiteLLM gcloud auth: Service account credentials are not supported; use authorized_user ADC.");
+        return null;
+    }
+    console.warn(`LiteLLM gcloud auth: Unknown credential type: ${credentials.type ?? "missing"}`);
+    return null;
+}
+async function exchangeRefreshToken(credentials) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: credentials.client_id,
+        client_secret: credentials.client_secret,
+        refresh_token: credentials.refresh_token,
+    }).toString();
+    try {
+        const response = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            console.warn(`LiteLLM gcloud auth: Token exchange failed (${response.status}): ${await response.text()}`);
+            return null;
+        }
+        const data = (await response.json());
+        return typeof data.access_token === "string" && data.access_token ? data.access_token : null;
+    }
+    catch (error) {
+        console.warn(`LiteLLM gcloud auth: Token exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+export async function getGcloudToken() {
+    const adcPath = getAdcPath();
+    if (!adcPath) {
+        console.warn("LiteLLM gcloud auth: No Google ADC file found. Set GOOGLE_APPLICATION_CREDENTIALS or run `gcloud auth application-default login`.");
+        return null;
+    }
+    const credentials = await readCredentials(adcPath);
+    if (!credentials) {
+        console.warn(`LiteLLM gcloud auth: Failed to read ADC file: ${adcPath}`);
+        return null;
+    }
+    const cacheKey = getCredentialsCacheKey(credentials);
+    if (cacheKey && cachedToken && cachedTokenKey === cacheKey && Date.now() - cachedAt < CACHE_TTL_MS)
+        return cachedToken;
+    if (isAuthorizedUserCredentials(credentials)) {
+        const token = await exchangeRefreshToken(credentials);
+        if (token) {
+            cachedToken = token;
+            cachedTokenKey = cacheKey;
+            cachedAt = Date.now();
+        }
+        return token;
+    }
+    if (credentials.type === "service_account") {
+        console.warn("LiteLLM gcloud auth: Service account credentials are not supported; use authorized_user ADC.");
+        return null;
+    }
+    console.warn(`LiteLLM gcloud auth: Unknown credential type: ${credentials.type ?? "missing"}`);
+    return null;
+}
+export function resetGcloudTokenCache() {
+    cachedToken = null;
+    cachedTokenKey = null;
+    cachedAt = 0;
+}

package/dist/index.js

@@ -1,11 +1,14 @@
-import { execSync } from "node:child_process";
+import { execSync, spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { fingerprint, readCache, writeCache } from "./cache.js";
 import { setupLiteLLMCostTracking } from "./cost.js";
-import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent } from "./discover.js";
+import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent, withTimeout } from "./discover.js";
+import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
+import { createMcpToolDefinitions } from "./mcp-tools.js";
+import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
 const ENV_BASE_URL = "LITELLM_BASE_URL";
 const ENV_API_KEY = "LITELLM_API_KEY";
@@ -69,6 +72,45 @@ function tokenExpiresAt(apiKey, opaqueFallback = PERMANENT_TOKEN_EXPIRES_AT) {
         return opaqueFallback;
     }
 }
+function openInBrowser(url) {
+    // Never invoke a shell here: cmd.exe re-parses metacharacters before `start`
+    // runs, which would make URL contents injectable. Launch is best-effort; the
+    // URL is also shown to the user, so launcher failures must not crash the process.
+    const [cmd, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+            : ["xdg-open", [url]];
+    spawn(cmd, args, { stdio: "ignore", detached: true })
+        .on("error", () => undefined)
+        .unref();
+}
+async function generateVirtualKey(baseUrl, userToken, signal) {
+    const { signal: boundedSignal, cancel } = withTimeout(LOGIN_TIMEOUT_MS, signal);
+    try {
+        const response = await fetch(`${baseUrl}/key/generate`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${userToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({}),
+            signal: boundedSignal,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`Virtual key generation failed (${response.status}): ${text}`);
+        }
+        const data = (await response.json());
+        if (typeof data.key !== "string" || !data.key)
+            throw new Error("No key in response from /key/generate");
+        const expiresMs = typeof data.expires === "string" ? Date.parse(data.expires) : Number.NaN;
+        return { key: data.key, expiresAt: Number.isNaN(expiresMs) ? undefined : expiresMs };
+    }
+    finally {
+        cancel();
+    }
+}
 function getLiteLLMApiKey(credentials) {
     return credentials.access;
 }
@@ -82,27 +124,51 @@ async function resolveCredentials({ executeHelpers = true } = {}) {
     const envBase = cleanConfig(process.env[ENV_BASE_URL]);
     const envKey = cleanConfig(process.env[ENV_API_KEY]);
     const envHelperCommand = getApiKeyHelperCommand();
+    const useGcloudToken = isGcloudTokenAuthEnabled();
     const authBase = entry?.type === "oauth" ? entry.baseUrl?.trim() : undefined;
+    const gcloudCacheKey = useGcloudToken && !entry ? ((await getGcloudTokenCacheKey()) ?? undefined) : undefined;
     const authKey = entry?.type === "oauth"
         ? (executeHelpers ? resolveOAuthApiKey(entry) : entry.access).trim()
         : entry?.type === "api_key"
             ? (await AuthStorage.create(getAuthPath()).getApiKey(PROVIDER_NAME, { includeFallback: false }))?.trim()
             : undefined;
-    const apiKey = authKey || (executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined) || envKey;
-    const apiKeyFingerprint = entry?.type === "oauth" && entry.refresh.startsWith("!")
-        ? fingerprint(entry.refresh)
-        : authKey
-            ? fingerprint(authKey)
-            : envHelperCommand
-                ? fingerprint(envHelperCommand)
-                : envKey
-                    ? fingerprint(envKey)
-                    : undefined;
+    const gcloudKey = executeHelpers && gcloudCacheKey ? (await getGcloudToken())?.trim() : undefined;
+    const helperKey = !authKey && !gcloudKey && executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined;
+    const apiKey = authKey || gcloudKey || helperKey || envKey;
+    let apiKeyFingerprint;
+    let apiKeyConfig;
+    if (entry?.type === "oauth" && entry.refresh.startsWith("!")) {
+        apiKeyFingerprint = fingerprint(entry.refresh);
+    }
+    else if (authKey) {
+        apiKeyFingerprint = fingerprint(authKey);
+    }
+    else if (gcloudKey) {
+        apiKeyFingerprint = fingerprint(gcloudCacheKey ?? gcloudKey);
+        apiKeyConfig = getGcloudTokenCommand();
+    }
+    else if (!executeHelpers && gcloudCacheKey) {
+        apiKeyFingerprint = fingerprint(gcloudCacheKey);
+        apiKeyConfig = getGcloudTokenCommand();
+    }
+    else if (helperKey && envHelperCommand) {
+        apiKeyFingerprint = fingerprint(envHelperCommand);
+        apiKeyConfig = envHelperCommand;
+    }
+    else if (!executeHelpers && envHelperCommand) {
+        apiKeyFingerprint = fingerprint(envHelperCommand);
+        apiKeyConfig = envHelperCommand;
+    }
+    else if (envKey) {
+        apiKeyFingerprint = fingerprint(envKey);
+        apiKeyConfig = `$${ENV_API_KEY}`;
+    }
     const rawBase = authBase || envBase;
     return {
         baseUrl: rawBase ? normalizeBaseUrl(rawBase) : undefined,
         apiKey: apiKey || undefined,
         apiKeyFingerprint,
+        apiKeyConfig,
     };
 }
 function getDiscoveryTimeoutMs() {
@@ -137,12 +203,63 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
         placeholder: "https://litellm.example.com",
     })).trim();
-    const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
-    if (!rawBaseUrl || !apiKeyInput)
-        throw new Error("Both base URL and API key are required");
+    if (!rawBaseUrl)
+        throw new Error("Base URL is required");
     const baseUrl = normalizeBaseUrl(rawBaseUrl);
-    const refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
-    const apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
+    const method = (await callbacks.onPrompt({
+        message: "Select login method (1 = API key / !command, 2 = SSO / Enterprise JWT):",
+    })).trim();
+    let apiKey;
+    let refresh;
+    let expires;
+    if (method === "2") {
+        callbacks.onAuth?.({
+            url: `${baseUrl}/sso/key/generate`,
+            instructions: "Authenticate via SSO, then copy your token from the LiteLLM UI.",
+        });
+        const rawToken = (await callbacks.onPrompt({ message: "Paste your SSO token from the LiteLLM UI:" }))
+            .trim()
+            .replace(/^Bearer\s+/i, "")
+            .trim();
+        if (!rawToken)
+            throw new Error("SSO token is required");
+        const wantVirtualKey = (await callbacks.onPrompt({ message: "Generate a LiteLLM virtual key from this token? (y/n):" }))
+            .trim()
+            .toLowerCase();
+        if (wantVirtualKey !== "n" && wantVirtualKey !== "no") {
+            try {
+                callbacks.onProgress?.("Generating virtual key...");
+                const generated = await generateVirtualKey(baseUrl, rawToken, callbacks.signal);
+                apiKey = generated.key;
+                refresh = "";
+                expires =
+                    generated.expiresAt === undefined
+                        ? PERMANENT_TOKEN_EXPIRES_AT
+                        : Math.max(Date.now(), generated.expiresAt - TOKEN_REFRESH_LEAD_MS);
+                callbacks.onProgress?.("Virtual key generated and will be used for API calls.");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                callbacks.onProgress?.(`LiteLLM: virtual key generation failed (${message}); using SSO token directly.`);
+                apiKey = rawToken;
+                refresh = "";
+                expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+            }
+        }
+        else {
+            apiKey = rawToken;
+            refresh = "";
+            expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+        }
+    }
+    else {
+        const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
+        if (!apiKeyInput)
+            throw new Error("Both base URL and API key are required");
+        refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
+        apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
+        expires = tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT);
+    }
     const { models, source } = await discoverModels(baseUrl, apiKey, {
         timeoutMs: LOGIN_TIMEOUT_MS,
         signal: callbacks.signal,
@@ -160,13 +277,17 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
     return {
         access: apiKey,
         refresh,
-        expires: tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT),
+        expires,
         baseUrl,
     };
 }
 async function refreshLiteLLM(credentials) {
-    if (!credentials.refresh.startsWith("!"))
+    if (!credentials.refresh.startsWith("!")) {
+        if (credentials.expires < PERMANENT_TOKEN_EXPIRES_AT) {
+            throw new Error("LiteLLM credential cannot be refreshed; run /login litellm again");
+        }
         return credentials;
+    }
     const access = executeApiKeyCommand(credentials.refresh);
     return { ...credentials, access, expires: tokenExpiresAt(access, EXPIRE_TOKEN_IMMEDIATELY) };
 }
@@ -274,6 +395,7 @@ export default async function (pi) {
         getDiscoveryTimeoutMs() > 0 &&
         (!cacheValid || isListModelsMode());
     let credentialWarning;
+    let liveDiscoveryApiKey;
     if (shouldFetch) {
         try {
             creds = await resolveCredentials();
@@ -304,6 +426,7 @@ export default async function (pi) {
         }
         else {
             models = result.models;
+            liveDiscoveryApiKey = creds.apiKey;
             const next = {
                 baseUrl: creds.baseUrl,
                 apiKeyFingerprint: fp,
@@ -330,7 +453,7 @@ export default async function (pi) {
         getApiKey: getLiteLLMApiKey,
         modifyModels: modifyLiteLLMModels,
     };
-    function registerProvider(baseUrl, models) {
+    function registerProvider(baseUrl, models, apiKeyConfig = creds.apiKeyConfig ?? getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`) {
         pi.registerProvider(PROVIDER_NAME, {
             baseUrl: baseUrl ? `${baseUrl}/v1` : "https://litellm.example.com/v1",
             // When LITELLM_API_KEY_HELPER is set we register the helper as a `!command` provider key.
@@ -340,7 +463,7 @@ export default async function (pi) {
             // resolveConfigValue). So a short-lived/rotating helper token stays fresh. The OAuth hooks
             // remain registered for `/login litellm` users. See the regression test
             // "re-runs the helper command on every request" in tests/index.test.ts.
-            apiKey: getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`,
+            apiKey: apiKeyConfig,
             api: "openai-completions",
             models,
             oauth,
@@ -356,6 +479,45 @@ export default async function (pi) {
             return `${ENV_TIMEOUT}=0`;
         return null;
     }
+    async function resolveRuntimeApiKey() {
+        const fresh = await resolveCredentials();
+        if (!fresh.apiKey)
+            throw new Error("no credentials. Run /login litellm or set env vars.");
+        return fresh.apiKey;
+    }
+    function registerSkillTools(baseUrl) {
+        if (!baseUrl)
+            return;
+        for (const tool of createSkillToolDefinitions(baseUrl, resolveRuntimeApiKey)) {
+            pi.registerTool(tool);
+        }
+    }
+    function seededRuntimeApiKey(seed) {
+        let first = seed;
+        return async () => {
+            if (first) {
+                const value = first;
+                first = undefined;
+                return value;
+            }
+            return resolveRuntimeApiKey();
+        };
+    }
+    async function registerMcpTools(baseUrl, discoveryApiKey) {
+        if (!baseUrl || !discoveryApiKey || discoveryDisabledReason())
+            return;
+        try {
+            const tools = await createMcpToolDefinitions(baseUrl, seededRuntimeApiKey(discoveryApiKey));
+            for (const tool of tools) {
+                pi.registerTool(tool);
+            }
+        }
+        catch (error) {
+            process.stderr.write(`LiteLLM: MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
+        }
+    }
+    registerSkillTools(creds.baseUrl);
+    await registerMcpTools(creds.baseUrl, liveDiscoveryApiKey);
     async function refreshModelsAndCosts() {
         const fresh = await resolveCredentials();
         const freshFp = fresh.apiKeyFingerprint;
@@ -371,9 +533,10 @@ export default async function (pi) {
             source: result.source,
             models: result.models,
         });
-        registerProvider(fresh.baseUrl, result.models);
+        registerProvider(fresh.baseUrl, result.models, fresh.apiKeyConfig);
         updateCosts(result.models);
         cacheFetchedAt = now;
+        await registerMcpTools(fresh.baseUrl, fresh.apiKey);
         return { models: result.models, source: result.source };
     }
     function runRefresh() {
@@ -384,7 +547,10 @@ export default async function (pi) {
     }
     async function runLogin(ctx) {
         const credential = await loginLiteLLM({
-            onAuth: () => undefined,
+            onAuth: ({ url, instructions }) => {
+                openInBrowser(url);
+                ctx.ui.notify(instructions ? `${url} — ${instructions}` : url, "info");
+            },
             onDeviceCode: () => undefined,
             onPrompt: async ({ message, placeholder }) => {
                 const value = await ctx.ui.input(message, placeholder);
@@ -402,6 +568,10 @@ export default async function (pi) {
         });
         ctx.modelRegistry.authStorage.set(PROVIDER_NAME, { type: "oauth", ...credential });
         ctx.modelRegistry.refresh();
+        const credentialBaseUrl = credential.baseUrl;
+        const credentialAccess = typeof credential.access === "string" ? credential.access : undefined;
+        registerSkillTools(credentialBaseUrl);
+        await registerMcpTools(credentialBaseUrl, credentialAccess);
         ctx.ui.notify(`Logged in to LiteLLM. Credentials saved to ${getAuthPath()}`, "info");
     }
     pi.on("input", async (event, ctx) => {
@@ -451,6 +621,18 @@ export default async function (pi) {
             return;
         return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, sessionId);
     });
+    pi.on("before_agent_start", async (event) => {
+        if (discoveryDisabledReason())
+            return;
+        const fresh = await resolveCredentials();
+        if (!fresh.baseUrl || !fresh.apiKey)
+            return;
+        const skills = await listSkills(fresh.baseUrl, fresh.apiKey);
+        const section = createSkillsPromptSection(skills);
+        if (!section)
+            return;
+        return { systemPrompt: `${event.systemPrompt}\n\n${section}` };
+    });
     pi.on("message_end", (event) => {
         if (event.message.role !== "assistant")
             return;

package/dist/mcp-tools.d.ts

@@ -0,0 +1,5 @@
+import { type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { LiteLLMMcpTool } from "./types.js";
+export declare function discoverMcpTools(baseUrl: string, apiKey: string): Promise<LiteLLMMcpTool[]>;
+export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>): Promise<string>;
+export declare function createMcpToolDefinitions(baseUrl: string, getApiKey: () => Promise<string>): Promise<ToolDefinition[]>;

package/dist/mcp-tools.js

@@ -0,0 +1,131 @@
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { normalizeBaseUrl } from "./discover.js";
+const LIST_TIMEOUT_MS = 10_000;
+const CALL_TIMEOUT_MS = 30_000;
+function withTimeout(timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`Timed out after ${timeoutMs}ms`)), timeoutMs);
+    return {
+        signal: controller.signal,
+        cancel: () => clearTimeout(timer),
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function normalizeMcpTool(value) {
+    const raw = asRecord(value);
+    if (!raw)
+        return undefined;
+    const name = stringValue(raw.name);
+    const serverName = stringValue(raw.mcp_info?.server_name) ??
+        stringValue(raw.server_name) ??
+        stringValue(raw.mcp_info?.server_id) ??
+        stringValue(raw.server_id);
+    if (!name || !serverName)
+        return undefined;
+    const inputSchema = asRecord(raw.inputSchema) ?? asRecord(raw.input_schema) ?? { type: "object", properties: {} };
+    return {
+        name,
+        server_name: serverName,
+        server_id: stringValue(raw.mcp_info?.server_id) ?? stringValue(raw.server_id) ?? serverName,
+        description: stringValue(raw.description) ?? name,
+        input_schema: inputSchema,
+    };
+}
+export async function discoverMcpTools(baseUrl, apiKey) {
+    const { signal, cancel } = withTimeout(LIST_TIMEOUT_MS);
+    try {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/list`, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal,
+        });
+        if (!response.ok)
+            return [];
+        const body = (await response.json());
+        const bodyRecord = asRecord(body);
+        const rawTools = Array.isArray(body) ? body : Array.isArray(bodyRecord?.tools) ? bodyRecord.tools : [];
+        return rawTools.map(normalizeMcpTool).filter((tool) => tool !== undefined);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        cancel();
+    }
+}
+export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args) {
+    const { signal, cancel } = withTimeout(CALL_TIMEOUT_MS);
+    try {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/call`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ server_id: serverId, name: toolName, arguments: args }),
+            signal,
+        });
+        if (!response.ok)
+            return `Error calling ${toolName} on ${serverId}: HTTP ${response.status}`;
+        const body = (await response.json());
+        return JSON.stringify("result" in body ? body.result : body, null, 2);
+    }
+    catch (error) {
+        return `Error calling ${toolName} on ${serverId}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    finally {
+        cancel();
+    }
+}
+function sanitizeName(name) {
+    const sanitized = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "");
+    return sanitized || "tool";
+}
+function buildParameters(inputSchema) {
+    const properties = inputSchema.properties;
+    if (!properties || typeof properties !== "object") {
+        return Type.Object({
+            args: Type.Record(Type.String(), Type.Unknown(), { description: "Tool arguments as key-value pairs" }),
+        });
+    }
+    return Type.Unsafe(inputSchema);
+}
+export async function createMcpToolDefinitions(baseUrl, getApiKey) {
+    const discoveryApiKey = await getApiKey();
+    const tools = await discoverMcpTools(baseUrl, discoveryApiKey);
+    return tools.map((mcpTool) => {
+        const safeServer = sanitizeName(mcpTool.server_name);
+        const safeTool = sanitizeName(mcpTool.name);
+        const parameters = buildParameters(mcpTool.input_schema);
+        return defineTool({
+            name: `mcp_${safeServer}_${safeTool}`,
+            label: `${mcpTool.server_name}: ${mcpTool.name}`,
+            description: `${mcpTool.description} (via ${mcpTool.server_name} MCP server)`,
+            promptSnippet: `${mcpTool.description} via ${mcpTool.server_name} MCP server`,
+            parameters,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                const rawParams = params;
+                const args = Object.keys(rawParams).length === 1 && rawParams.args && typeof rawParams.args === "object"
+                    ? rawParams.args
+                    : rawParams;
+                const text = await executeMcpTool(baseUrl, apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { server: mcpTool.server_name, serverId: mcpTool.server_id, tool: mcpTool.name },
+                };
+            },
+        });
+    });
+}

package/dist/skills.d.ts

@@ -0,0 +1,13 @@
+import { type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { LiteLLMSkill } from "./types.js";
+export declare function listSkills(baseUrl: string, apiKey: string): Promise<LiteLLMSkill[]>;
+export declare function createSkill(baseUrl: string, apiKey: string, input: {
+    name: string;
+    description: string;
+    code: string;
+    inputSchema?: Record<string, unknown>;
+}): Promise<unknown>;
+export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string): Promise<void>;
+export declare function createSkillsPromptSection(skills: LiteLLMSkill[]): string | undefined;
+export declare function createSkillToolDefinitions(baseUrl: string, getApiKey: () => Promise<string>): ToolDefinition[];
+export declare function resetSkillsCache(): void;

package/dist/skills.js

@@ -0,0 +1,145 @@
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { normalizeBaseUrl } from "./discover.js";
+const SKILLS_CACHE_TTL_MS = 60_000;
+let skillsCache;
+function getSkillsFromBody(body) {
+    if (Array.isArray(body))
+        return body;
+    if (body && typeof body === "object") {
+        const record = body;
+        if (Array.isArray(record.data))
+            return record.data;
+        if (Array.isArray(record.skills))
+            return record.skills;
+    }
+    return [];
+}
+export async function listSkills(baseUrl, apiKey) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    if (skillsCache &&
+        skillsCache.baseUrl === normalizedBaseUrl &&
+        skillsCache.apiKey === apiKey &&
+        Date.now() - skillsCache.fetchedAt < SKILLS_CACHE_TTL_MS) {
+        return skillsCache.skills;
+    }
+    try {
+        const response = await fetch(`${normalizedBaseUrl}/v1/skills`, {
+            headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok)
+            return [];
+        const skills = getSkillsFromBody(await response.json());
+        skillsCache = { baseUrl: normalizedBaseUrl, apiKey, fetchedAt: Date.now(), skills };
+        return skills;
+    }
+    catch {
+        return [];
+    }
+}
+export async function createSkill(baseUrl, apiKey, input) {
+    const response = await fetch(`${normalizeBaseUrl(baseUrl)}/v1/skills`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            name: input.name,
+            description: input.description,
+            code: input.code,
+            input_schema: input.inputSchema ?? { type: "object", properties: {} },
+        }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`LiteLLM skill create failed: HTTP ${response.status}`);
+    skillsCache = undefined;
+    return response.json().catch(() => ({}));
+}
+export async function deleteSkill(baseUrl, apiKey, skillId) {
+    const response = await fetch(`${normalizeBaseUrl(baseUrl)}/v1/skills/${encodeURIComponent(skillId)}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok && response.status !== 404)
+        throw new Error(`LiteLLM skill delete failed: HTTP ${response.status}`);
+    skillsCache = undefined;
+}
+function escapeXml(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+export function createSkillsPromptSection(skills) {
+    const enabled = skills.filter((skill) => skill.enabled !== false && skill.name);
+    if (enabled.length === 0)
+        return undefined;
+    const body = enabled
+        .map((skill) => {
+        const description = skill.description?.trim() || "No description provided.";
+        return `<skill name="${escapeXml(skill.name)}">\n${escapeXml(description)}\n</skill>`;
+    })
+        .join("\n");
+    return `LiteLLM Skills Gateway provided these active skills. Use them as additional guidance when relevant.\n<litellm_skills>\n${body}\n</litellm_skills>`;
+}
+function formatSkills(skills) {
+    if (skills.length === 0)
+        return "No LiteLLM skills are registered.";
+    return skills
+        .map((skill) => `- ${skill.name}${skill.enabled === false ? " (disabled)" : ""}: ${skill.description ?? ""}`)
+        .join("\n");
+}
+const CreateSkillParams = Type.Object({
+    name: Type.String({ description: "Skill name" }),
+    description: Type.String({ description: "Skill description" }),
+    code: Type.String({ description: "Skill implementation or prompt code" }),
+    inputSchemaJson: Type.Optional(Type.String({ description: "Optional JSON Schema string for skill inputs" })),
+});
+const DeleteSkillParams = Type.Object({
+    skillId: Type.String({ description: "LiteLLM skill id" }),
+});
+export function createSkillToolDefinitions(baseUrl, getApiKey) {
+    return [
+        defineTool({
+            name: "litellm_skill_list",
+            label: "LiteLLM Skills",
+            description: "List skills registered on the LiteLLM proxy Skills Gateway.",
+            promptSnippet: "List LiteLLM Skills Gateway skills",
+            parameters: Type.Object({}),
+            async execute() {
+                const apiKey = await getApiKey();
+                const skills = await listSkills(baseUrl, apiKey);
+                return { content: [{ type: "text", text: formatSkills(skills) }], details: { count: skills.length } };
+            },
+        }),
+        defineTool({
+            name: "litellm_skill_create",
+            label: "Create LiteLLM Skill",
+            description: "Create a skill on the LiteLLM proxy Skills Gateway.",
+            parameters: CreateSkillParams,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                const inputSchema = params.inputSchemaJson
+                    ? JSON.parse(params.inputSchemaJson)
+                    : undefined;
+                const result = await createSkill(baseUrl, apiKey, { ...params, inputSchema });
+                return { content: [{ type: "text", text: "LiteLLM skill created." }], details: { result } };
+            },
+        }),
+        defineTool({
+            name: "litellm_skill_delete",
+            label: "Delete LiteLLM Skill",
+            description: "Delete a skill from the LiteLLM proxy Skills Gateway.",
+            parameters: DeleteSkillParams,
+            async execute(_toolCallId, params) {
+                const apiKey = await getApiKey();
+                await deleteSkill(baseUrl, apiKey, params.skillId);
+                return { content: [{ type: "text", text: `LiteLLM skill deleted: ${params.skillId}` }], details: {} };
+            },
+        }),
+    ];
+}
+export function resetSkillsCache() {
+    skillsCache = undefined;
+}

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
-export type DiscoverySource = "model_info" | "models_list";
+export type DiscoverySource = "model_info" | "models_list" | "health";
 export interface CacheFile {
     baseUrl: string;
     apiKeyFingerprint: string;
@@ -32,6 +32,14 @@ export interface ModelInfoEntry {
 export interface ModelInfoResponse {
     data?: ModelInfoEntry[];
 }
+export interface HealthModelEntry {
+    model?: string;
+    model_id?: string;
+    api_base?: string;
+}
+export interface HealthResponse {
+    healthy_endpoints?: HealthModelEntry[];
+}
 export interface ModelsListEntry {
     id?: string;
     owned_by?: string;
@@ -53,4 +61,20 @@ export interface ResolvedCredentials {
     baseUrl?: string;
     apiKey?: string;
     apiKeyFingerprint?: string;
+    apiKeyConfig?: string;
+}
+export interface LiteLLMMcpTool {
+    name: string;
+    server_name: string;
+    server_id?: string;
+    description: string;
+    input_schema: Record<string, unknown>;
+}
+export interface LiteLLMSkill {
+    id?: string;
+    name: string;
+    description?: string;
+    enabled?: boolean;
+    input_schema?: Record<string, unknown>;
+    code?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -40,7 +40,7 @@
     "image": "https://raw.githubusercontent.com/balcsida/pi-provider-litellm/refs/heads/main/assets/pi_litellm_gallery.png"
   },
   "scripts": {
-    "clean": "shx rm -rf dist",
+    "clean": "rm -rf dist",
     "build": "tsgo -p tsconfig.build.json",
     "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",
     "typecheck": "tsgo --noEmit",
@@ -64,14 +64,12 @@
     "protobufjs": "8.2.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.78.1",
-    "@earendil-works/pi-coding-agent": "^0.78.1",
+    "@earendil-works/pi-ai": "^0.79.1",
+    "@earendil-works/pi-coding-agent": "^0.79.1",
     "@biomejs/biome": "^2.4.15",
     "@types/node": "^25.9.1",
-    "@typescript/native-preview": "7.0.0-dev.20260607.1",
-    "shx": "^0.4.0",
+    "@typescript/native-preview": "7.0.0-dev.20260617.2",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.3",
     "vitest": "^4.1.7"
   }
 }