pi-provider-litellm 1.2.7 → 1.2.8

package/README.md

@@ -44,6 +44,21 @@ You can also run `/login`, select `Use a subscription`, then select `LiteLLM`.
 
 You'll be prompted for the base URL and API key. Credentials are persisted to `~/.pi/agent/auth.json`.
 
+#### Enterprise SSO login
+
+If your LiteLLM proxy requires SSO/OAuth authentication (enterprise deployments), you can authenticate via a browser SSO flow and optionally pair the resulting JWT with a stable virtual key:
+
+1. Run `/login litellm` inside pi
+2. Enter the proxy URL
+3. At the login method prompt, enter `2` for SSO / Enterprise JWT
+4. Your default browser opens the LiteLLM SSO login URL (e.g. `https://litellm.your-domain.com/sso/key/generate`) automatically — the URL is also displayed in case it can't be opened. Authenticate via SSO
+5. Copy your token from the LiteLLM UI and paste it at the prompt (copying a full `Bearer ...` header value is fine — the prefix is stripped automatically)
+6. When prompted to generate a virtual key, press Enter to accept (recommended) or enter `n` to use the JWT directly
+
+When you generate a virtual key, the resulting `sk-...` key is stored as your credential and used for all API requests. If the proxy's key policy attaches an expiry to the generated key, Pi will prompt you to re-authenticate when it nears expiry; otherwise the key is treated as permanent until revoked in LiteLLM.
+
+When using a JWT directly, the extension reads its `exp` claim and Pi will prompt you to re-authenticate when the token nears expiry. Run `/login litellm` again to refresh.
+
 ### Option B — environment variables
 
 ```bash
@@ -100,39 +115,6 @@ If your LiteLLM proxy exposes `/v1/skills`, enabled skills are fetched before ea
 - `litellm_skill_create`
 - `litellm_skill_delete`
 
-## Mocked LiteLLM smoke workflow
-
-The `LiteLLM Smoke` GitHub Actions workflow starts VidaiMock and a real LiteLLM proxy on the runner. LiteLLM exposes OpenAI-compatible and Anthropic routes whose upstreams are served by VidaiMock, then this extension's smoke runner discovers those models through LiteLLM and sends `/v1/chat/completions` requests through the proxy.
-
-This keeps the LiteLLM integration path under test but does not call real LLM APIs. No provider API keys or GitHub Models permission are required. The workflow also runs a non-interactive Pi CLI smoke with `--list-models` and `-p` so extension loading, model discovery, and a real completion path are covered without opening the TUI.
-
-## Development
-
-This package requires Node.js `>=22.19.0`. CI currently uses Node `24.16.0`.
-
-```bash
-npm ci
-npm run check
-npm run clean && npm run build
-```
-
-`npm run check` runs Biome, type checking, and the Vitest suite. Runtime changes must be built before local Pi smoke checks because the extension entrypoint is `./dist/index.js`.
-
-Before changing package contents or dependency policy, also run:
-
-```bash
-npm run supply-chain:guard
-npm pack --dry-run
-```
-
-The published npm package should contain only `dist`, `README.md`, and `LICENSE`.
-
-## Release
-
-Releases are driven by semver tags named `v*.*.*`. The GitHub release workflow installs from the lockfile, runs the checks, builds `dist`, verifies the package tarball, publishes to npm with provenance, and creates a GitHub release.
-
-Before tagging a release, keep `package.json` and `package-lock.json` versions in sync and verify the dry-run package contents.
-
 ## Slash commands
 
 - `/litellm-refresh` — force re-fetch the model list, ignoring cache
@@ -153,6 +135,8 @@ If the cache is older than 24 hours, the extension refreshes it in the backgroun
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
 | `401 Token expired` | Set `LITELLM_API_KEY_HELPER`. |
 | No models with gcloud auth | Verify `gcloud auth application-default login` has been run or set `GOOGLE_APPLICATION_CREDENTIALS` to an `authorized_user` ADC file |
+| Enterprise SSO login shows "virtual key generation failed" | The LiteLLM instance may lack a database (`/key/generate` requires one), your user account may lack key-generation permission, or the request timed out; the JWT is used directly as a fallback |
+| Enterprise SSO token prompt fails with "SSO token is required" | The token field was left empty — paste the token copied from the LiteLLM UI |
 | MCP tools not showing | Verify the proxy exposes `/mcp-rest/tools/list` and run `/litellm-refresh` after fixing the proxy |
 | Skills not affecting prompts | Verify the proxy exposes `/v1/skills` and returns enabled skills |
 

package/dist/discover.d.ts

@@ -4,4 +4,8 @@ export declare function normalizeBaseUrl(input: string): string;
 export declare function isMoonshotModel(modelId: string): boolean;
 export declare function shouldSuppressReasoningContent(modelId: string): boolean;
 export declare function buildCompat(modelId: string): ProviderModelConfig["compat"];
+export declare function withTimeout(timeoutMs: number, signal?: AbortSignal): {
+    signal: AbortSignal;
+    cancel: () => void;
+};
 export declare function discoverModels(baseUrl: string, apiKey: string, options?: DiscoveryOptions): Promise<DiscoveryResult>;

package/dist/discover.js

@@ -45,22 +45,53 @@ function toKnownProvider(provider) {
 }
 function findCatalogModel(id, ownedBy) {
     const prefixProvider = toKnownProvider(id.split("/")[0]);
-    const candidates = [toKnownProvider(ownedBy), prefixProvider].filter((provider) => provider !== undefined);
+    const lookupIds = catalogLookupIds(id);
+    const candidates = [toKnownProvider(ownedBy), prefixProvider, lookupIds.length > 1 ? "anthropic" : undefined].filter((provider) => provider !== undefined);
     for (const provider of candidates) {
-        const exact = getModels(provider).find((model) => model.id === id);
-        if (exact)
-            return exact;
-        const providerQualified = getModels(provider).find((model) => model.id === `${provider}/${id}`);
-        if (providerQualified)
-            return providerQualified;
+        const match = findCatalogModelInProvider(provider, lookupIds);
+        if (match)
+            return match;
     }
     for (const provider of getProviders()) {
-        const exact = getModels(provider).find((model) => model.id === id);
+        const match = findCatalogModelInProvider(provider, lookupIds);
+        if (match)
+            return match;
+    }
+    return undefined;
+}
+function catalogLookupIds(id) {
+    const lookupIds = new Set([id]);
+    const unprefixed = id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
+    lookupIds.add(unprefixed);
+    const anthropicAlias = unprefixed.toLowerCase().replaceAll(".", "-");
+    const match = /^(?:claude-)?(opus|sonnet|haiku)-(\d+)-(\d+)$/.exec(anthropicAlias);
+    if (match)
+        lookupIds.add(`claude-${match[1]}-${match[2]}-${match[3]}`);
+    return [...lookupIds];
+}
+function findCatalogModelInProvider(provider, lookupIds) {
+    for (const lookupId of lookupIds) {
+        const exact = getModels(provider).find((model) => model.id === lookupId);
         if (exact)
             return exact;
+        const providerQualified = getModels(provider).find((model) => model.id === `${provider}/${lookupId}`);
+        if (providerQualified)
+            return providerQualified;
     }
     return undefined;
 }
+function mapModelInfoCost(info, fallback) {
+    return {
+        input: info.input_cost_per_token !== undefined ? info.input_cost_per_token * 1_000_000 : (fallback?.input ?? 0),
+        output: info.output_cost_per_token !== undefined ? info.output_cost_per_token * 1_000_000 : (fallback?.output ?? 0),
+        cacheRead: info.cache_read_input_token_cost !== undefined
+            ? info.cache_read_input_token_cost * 1_000_000
+            : (fallback?.cacheRead ?? 0),
+        cacheWrite: info.cache_creation_input_token_cost !== undefined
+            ? info.cache_creation_input_token_cost * 1_000_000
+            : (fallback?.cacheWrite ?? 0),
+    };
+}
 function getFallbackProviderAndModel(id, ownedBy) {
     const [prefix, ...rest] = id.split("/");
     const prefixProvider = toKnownProvider(prefix);
@@ -75,7 +106,7 @@ function findModelsDevModel(catalog, id, ownedBy) {
         return undefined;
     return catalog?.[provider]?.models?.[modelId];
 }
-function withTimeout(timeoutMs, signal) {
+export function withTimeout(timeoutMs, signal) {
     const controller = new AbortController();
     const onAbort = () => controller.abort(signal?.reason);
     if (signal) {
@@ -170,17 +201,13 @@ function mapFromModelInfo(entry) {
     const info = entry.model_info ?? {};
     if (info.mode && info.mode !== "chat")
         return undefined;
+    const catalogModel = findCatalogModel(id);
     return {
         id,
         name: id,
         reasoning: info.supports_reasoning ?? false,
         input: info.supports_vision ? ["text", "image"] : ["text"],
-        cost: {
-            input: (info.input_cost_per_token ?? 0) * 1_000_000,
-            output: (info.output_cost_per_token ?? 0) * 1_000_000,
-            cacheRead: (info.cache_read_input_token_cost ?? 0) * 1_000_000,
-            cacheWrite: (info.cache_creation_input_token_cost ?? 0) * 1_000_000,
-        },
+        cost: mapModelInfoCost(info, catalogModel?.cost),
         contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
         maxTokens: info.max_output_tokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
@@ -192,19 +219,16 @@ function mapFromHealthModelInfo(entry, fallbackId) {
         return model;
     if (entry.model_info?.mode && entry.model_info.mode !== "chat")
         return undefined;
+    const info = entry.model_info ?? {};
+    const catalogModel = findCatalogModel(fallbackId);
     return {
         id: fallbackId,
         name: fallbackId,
-        reasoning: entry.model_info?.supports_reasoning ?? false,
-        input: entry.model_info?.supports_vision ? ["text", "image"] : ["text"],
-        cost: {
-            input: (entry.model_info?.input_cost_per_token ?? 0) * 1_000_000,
-            output: (entry.model_info?.output_cost_per_token ?? 0) * 1_000_000,
-            cacheRead: (entry.model_info?.cache_read_input_token_cost ?? 0) * 1_000_000,
-            cacheWrite: (entry.model_info?.cache_creation_input_token_cost ?? 0) * 1_000_000,
-        },
-        contextWindow: entry.model_info?.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
-        maxTokens: entry.model_info?.max_output_tokens ?? DEFAULT_MAX_TOKENS,
+        reasoning: info.supports_reasoning ?? false,
+        input: info.supports_vision ? ["text", "image"] : ["text"],
+        cost: mapModelInfoCost(info, catalogModel?.cost),
+        contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: info.max_output_tokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(fallbackId),
     };
 }

package/dist/index.js

@@ -1,10 +1,10 @@
-import { execSync } from "node:child_process";
+import { execSync, spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { fingerprint, readCache, writeCache } from "./cache.js";
 import { setupLiteLLMCostTracking } from "./cost.js";
-import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent } from "./discover.js";
+import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent, withTimeout } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
@@ -72,6 +72,45 @@ function tokenExpiresAt(apiKey, opaqueFallback = PERMANENT_TOKEN_EXPIRES_AT) {
         return opaqueFallback;
     }
 }
+function openInBrowser(url) {
+    // Never invoke a shell here: cmd.exe re-parses metacharacters before `start`
+    // runs, which would make URL contents injectable. Launch is best-effort; the
+    // URL is also shown to the user, so launcher failures must not crash the process.
+    const [cmd, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+            : ["xdg-open", [url]];
+    spawn(cmd, args, { stdio: "ignore", detached: true })
+        .on("error", () => undefined)
+        .unref();
+}
+async function generateVirtualKey(baseUrl, userToken, signal) {
+    const { signal: boundedSignal, cancel } = withTimeout(LOGIN_TIMEOUT_MS, signal);
+    try {
+        const response = await fetch(`${baseUrl}/key/generate`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${userToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({}),
+            signal: boundedSignal,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`Virtual key generation failed (${response.status}): ${text}`);
+        }
+        const data = (await response.json());
+        if (typeof data.key !== "string" || !data.key)
+            throw new Error("No key in response from /key/generate");
+        const expiresMs = typeof data.expires === "string" ? Date.parse(data.expires) : Number.NaN;
+        return { key: data.key, expiresAt: Number.isNaN(expiresMs) ? undefined : expiresMs };
+    }
+    finally {
+        cancel();
+    }
+}
 function getLiteLLMApiKey(credentials) {
     return credentials.access;
 }
@@ -164,12 +203,63 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
         placeholder: "https://litellm.example.com",
     })).trim();
-    const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
-    if (!rawBaseUrl || !apiKeyInput)
-        throw new Error("Both base URL and API key are required");
+    if (!rawBaseUrl)
+        throw new Error("Base URL is required");
     const baseUrl = normalizeBaseUrl(rawBaseUrl);
-    const refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
-    const apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
+    const method = (await callbacks.onPrompt({
+        message: "Select login method (1 = API key / !command, 2 = SSO / Enterprise JWT):",
+    })).trim();
+    let apiKey;
+    let refresh;
+    let expires;
+    if (method === "2") {
+        callbacks.onAuth?.({
+            url: `${baseUrl}/sso/key/generate`,
+            instructions: "Authenticate via SSO, then copy your token from the LiteLLM UI.",
+        });
+        const rawToken = (await callbacks.onPrompt({ message: "Paste your SSO token from the LiteLLM UI:" }))
+            .trim()
+            .replace(/^Bearer\s+/i, "")
+            .trim();
+        if (!rawToken)
+            throw new Error("SSO token is required");
+        const wantVirtualKey = (await callbacks.onPrompt({ message: "Generate a LiteLLM virtual key from this token? (y/n):" }))
+            .trim()
+            .toLowerCase();
+        if (wantVirtualKey !== "n" && wantVirtualKey !== "no") {
+            try {
+                callbacks.onProgress?.("Generating virtual key...");
+                const generated = await generateVirtualKey(baseUrl, rawToken, callbacks.signal);
+                apiKey = generated.key;
+                refresh = "";
+                expires =
+                    generated.expiresAt === undefined
+                        ? PERMANENT_TOKEN_EXPIRES_AT
+                        : Math.max(Date.now(), generated.expiresAt - TOKEN_REFRESH_LEAD_MS);
+                callbacks.onProgress?.("Virtual key generated and will be used for API calls.");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                callbacks.onProgress?.(`LiteLLM: virtual key generation failed (${message}); using SSO token directly.`);
+                apiKey = rawToken;
+                refresh = "";
+                expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+            }
+        }
+        else {
+            apiKey = rawToken;
+            refresh = "";
+            expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+        }
+    }
+    else {
+        const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
+        if (!apiKeyInput)
+            throw new Error("Both base URL and API key are required");
+        refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
+        apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
+        expires = tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT);
+    }
     const { models, source } = await discoverModels(baseUrl, apiKey, {
         timeoutMs: LOGIN_TIMEOUT_MS,
         signal: callbacks.signal,
@@ -187,13 +277,17 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
     return {
         access: apiKey,
         refresh,
-        expires: tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT),
+        expires,
         baseUrl,
     };
 }
 async function refreshLiteLLM(credentials) {
-    if (!credentials.refresh.startsWith("!"))
+    if (!credentials.refresh.startsWith("!")) {
+        if (credentials.expires < PERMANENT_TOKEN_EXPIRES_AT) {
+            throw new Error("LiteLLM credential cannot be refreshed; run /login litellm again");
+        }
         return credentials;
+    }
     const access = executeApiKeyCommand(credentials.refresh);
     return { ...credentials, access, expires: tokenExpiresAt(access, EXPIRE_TOKEN_IMMEDIATELY) };
 }
@@ -453,7 +547,10 @@ export default async function (pi) {
     }
     async function runLogin(ctx) {
         const credential = await loginLiteLLM({
-            onAuth: () => undefined,
+            onAuth: ({ url, instructions }) => {
+                openInBrowser(url);
+                ctx.ui.notify(instructions ? `${url} — ${instructions}` : url, "info");
+            },
             onDeviceCode: () => undefined,
             onPrompt: async ({ message, placeholder }) => {
                 const value = await ctx.ui.input(message, placeholder);

package/dist/mcp-tools.js

@@ -92,37 +92,6 @@ function sanitizeName(name) {
         .replace(/^_+|_+$/g, "");
     return sanitized || "tool";
 }
-function isMappableSchema(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const schema = value;
-    if ("$ref" in schema || "anyOf" in schema || "oneOf" in schema || "allOf" in schema)
-        return false;
-    if (["string", "number", "integer", "boolean"].includes(String(schema.type)))
-        return true;
-    if (schema.type === "array") {
-        const items = schema.items;
-        return items?.type === "string";
-    }
-    return false;
-}
-function mapPropertySchema(name, schema) {
-    const description = typeof schema.description === "string" ? schema.description : name;
-    switch (schema.type) {
-        case "string":
-            return Type.String({ description });
-        case "number":
-            return Type.Number({ description });
-        case "integer":
-            return Type.Integer({ description });
-        case "boolean":
-            return Type.Boolean({ description });
-        case "array":
-            return Type.Array(Type.String(), { description });
-        default:
-            return Type.Unknown({ description });
-    }
-}
 function buildParameters(inputSchema) {
     const properties = inputSchema.properties;
     if (!properties || typeof properties !== "object") {
@@ -130,20 +99,7 @@ function buildParameters(inputSchema) {
             args: Type.Record(Type.String(), Type.Unknown(), { description: "Tool arguments as key-value pairs" }),
         });
     }
-    const required = Array.isArray(inputSchema.required)
-        ? inputSchema.required.filter((key) => typeof key === "string")
-        : [];
-    const mapped = {};
-    for (const [key, property] of Object.entries(properties)) {
-        if (!isMappableSchema(property)) {
-            return Type.Object({
-                args: Type.Record(Type.String(), Type.Unknown(), { description: "Tool arguments as key-value pairs" }),
-            });
-        }
-        const field = mapPropertySchema(key, property);
-        mapped[key] = required.includes(key) ? field : Type.Optional(field);
-    }
-    return Type.Object(mapped);
+    return Type.Unsafe(inputSchema);
 }
 export async function createMcpToolDefinitions(baseUrl, getApiKey) {
     const discoveryApiKey = await getApiKey();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -40,7 +40,7 @@
     "image": "https://raw.githubusercontent.com/balcsida/pi-provider-litellm/refs/heads/main/assets/pi_litellm_gallery.png"
   },
   "scripts": {
-    "clean": "shx rm -rf dist",
+    "clean": "rm -rf dist",
     "build": "tsgo -p tsconfig.build.json",
     "dev": "tsgo -p tsconfig.build.json --watch --preserveWatchOutput",
     "typecheck": "tsgo --noEmit",
@@ -68,10 +68,8 @@
     "@earendil-works/pi-coding-agent": "^0.79.1",
     "@biomejs/biome": "^2.4.15",
     "@types/node": "^25.9.1",
-    "@typescript/native-preview": "7.0.0-dev.20260610.1",
-    "shx": "^0.4.0",
+    "@typescript/native-preview": "7.0.0-dev.20260617.2",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.3",
     "vitest": "^4.1.7"
   }
 }