pi-provider-litellm 1.2.8 → 1.2.9

package/dist/index.js

@@ -4,15 +4,17 @@ import { join } from "node:path";
 import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { fingerprint, readCache, writeCache } from "./cache.js";
 import { setupLiteLLMCostTracking } from "./cost.js";
-import { discoverModels, normalizeBaseUrl, shouldSuppressReasoningContent, withTimeout } from "./discover.js";
+import { discoverModels, isGpt55Model, normalizeBaseUrl, shouldSuppressReasoningContent, withTimeout, } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
 import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
+const SETTINGS_KEY = "litellm";
 const ENV_BASE_URL = "LITELLM_BASE_URL";
 const ENV_API_KEY = "LITELLM_API_KEY";
 const ENV_API_KEY_HELPER = "LITELLM_API_KEY_HELPER";
+const ENV_HEADERS = "LITELLM_HEADERS";
 const ENV_TIMEOUT = "LITELLM_DISCOVERY_TIMEOUT_MS";
 const ENV_OFFLINE = "LITELLM_OFFLINE";
 const DEFAULT_TIMEOUT_MS = 5000;
@@ -25,14 +27,157 @@ const EXPIRE_TOKEN_IMMEDIATELY = 0;
 function getAuthPath() {
     return join(getAgentDir(), "auth.json");
 }
-function getCachePath() {
-    return join(getAgentDir(), CACHE_FILENAME);
+function sanitizeCacheSegment(value) {
+    return (value
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "provider");
 }
-async function readAuthEntry() {
+function getCachePath(providerName = PROVIDER_NAME) {
+    if (providerName === PROVIDER_NAME)
+        return join(getAgentDir(), CACHE_FILENAME);
+    return join(getAgentDir(), `litellm-models-${sanitizeCacheSegment(providerName)}.json`);
+}
+// Same tolerance as pi core's models.json loader (stripJsonComments in dist/utils/json.js):
+// strip `//` line comments and trailing commas, leaving string literals untouched.
+function stripJsonComments(input) {
+    return input
+        .replace(/"(?:\\.|[^"\\])*"|\/\/[^\n]*/g, (m) => (m[0] === '"' ? m : ""))
+        .replace(/"(?:\\.|[^"\\])*"|,(\s*[}\]])/g, (m, tail) => tail ?? m);
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
+// Mirrors pi core's ModelOverrideSchema: core rejects the whole models.json on invalid values,
+// so anything dropped here would also have been flagged for built-in providers. Headers matter
+// most: pi resolves each header value as a config string, so non-strings break requests.
+const MODEL_OVERRIDE_VALIDATORS = {
+    name: (value) => typeof value === "string",
+    reasoning: (value) => typeof value === "boolean",
+    thinkingLevelMap: (value) => isPlainObject(value) && THINKING_LEVELS.every((level) => value[level] == null || typeof value[level] === "string"),
+    input: (value) => Array.isArray(value) && value.every((entry) => entry === "text" || entry === "image"),
+    contextWindow: (value) => typeof value === "number",
+    maxTokens: (value) => typeof value === "number",
+    headers: (value) => isPlainObject(value) && Object.values(value).every((entry) => typeof entry === "string"),
+    compat: isPlainObject,
+    cost: (value) => isPlainObject(value) && Object.values(value).every((entry) => typeof entry === "number"),
+};
+function sanitizeModelOverride(modelId, raw) {
+    if (!isPlainObject(raw)) {
+        process.stderr.write(`LiteLLM: ignoring model override for ${modelId} in models.json (not an object).\n`);
+        return undefined;
+    }
+    const override = {};
+    const dropped = [];
+    for (const [key, value] of Object.entries(raw)) {
+        const isValid = MODEL_OVERRIDE_VALIDATORS[key];
+        if (isValid?.(value))
+            override[key] = value;
+        else
+            dropped.push(key);
+    }
+    if (dropped.length > 0) {
+        process.stderr.write(`LiteLLM: ignoring invalid model override field(s) for ${modelId} in models.json: ${dropped.join(", ")}.\n`);
+    }
+    return override;
+}
+// Overrides are read per registered provider name, matching pi core's own
+// models.json layout (`providers.<name>.modelOverrides`) so aliases get the
+// same override support as the default provider, not a special case of it.
+async function readModelOverrides(providerName) {
+    let raw;
+    try {
+        raw = await readFile(join(getAgentDir(), "models.json"), "utf8");
+    }
+    catch {
+        return new Map();
+    }
+    try {
+        const config = JSON.parse(stripJsonComments(raw));
+        const overrides = new Map();
+        for (const [id, rawOverride] of Object.entries(config.providers?.[providerName]?.modelOverrides ?? {})) {
+            const override = sanitizeModelOverride(id, rawOverride);
+            if (override)
+                overrides.set(id, override);
+        }
+        return overrides;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`LiteLLM: ignoring model overrides (failed to parse models.json: ${message}).\n`);
+        return new Map();
+    }
+}
+// Merge semantics must match pi core's applyModelOverride/mergeCompat (dist/core/model-registry.js)
+// so the same models.json entry behaves identically for litellm and built-in providers.
+function mergeCompat(base, override) {
+    if (!override)
+        return base;
+    const merged = { ...base, ...override };
+    for (const key of ["openRouterRouting", "vercelGatewayRouting", "chatTemplateKwargs"]) {
+        const baseValue = base?.[key];
+        const overrideValue = override[key];
+        if (baseValue || overrideValue) {
+            merged[key] = { ...baseValue, ...overrideValue };
+        }
+    }
+    return merged;
+}
+function applyModelOverride(model, override) {
+    const next = { ...model };
+    if (override.name !== undefined)
+        next.name = override.name;
+    if (override.reasoning !== undefined)
+        next.reasoning = override.reasoning;
+    if (override.thinkingLevelMap !== undefined) {
+        next.thinkingLevelMap = { ...model.thinkingLevelMap, ...override.thinkingLevelMap };
+    }
+    if (override.input !== undefined)
+        next.input = override.input;
+    if (override.contextWindow !== undefined)
+        next.contextWindow = override.contextWindow;
+    if (override.maxTokens !== undefined)
+        next.maxTokens = override.maxTokens;
+    if (override.headers !== undefined)
+        next.headers = override.headers;
+    if (override.compat !== undefined)
+        next.compat = mergeCompat(model.compat, override.compat);
+    if (override.cost !== undefined)
+        next.cost = { ...model.cost, ...override.cost };
+    return next;
+}
+function applyModelOverrides(models, overrides) {
+    if (overrides.size === 0)
+        return models;
+    return models.map((model) => {
+        const override = overrides.get(model.id);
+        return override ? applyModelOverride(model, override) : model;
+    });
+}
+// Re-reads models.json on every call so overrides edited mid-session take effect on the next
+// refresh or login, matching pi core's live reload for built-in providers.
+async function applyOverrides(providerName, models) {
+    return applyModelOverrides(models, await readModelOverrides(providerName));
+}
+async function readAuthEntry(providerName = PROVIDER_NAME) {
     try {
         const raw = await readFile(getAuthPath(), "utf8");
         const parsed = JSON.parse(raw);
-        return parsed?.[PROVIDER_NAME];
+        return parsed?.[providerName];
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readGlobalLiteLLMSettings() {
+    try {
+        const raw = await readFile(join(getAgentDir(), "settings.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        const settings = parsed[SETTINGS_KEY];
+        return settings && typeof settings === "object" && !Array.isArray(settings)
+            ? settings
+            : undefined;
     }
     catch {
         return undefined;
@@ -42,6 +187,9 @@ function cleanConfig(raw) {
     const trimmed = raw?.trim();
     return trimmed && trimmed !== "undefined" ? trimmed : undefined;
 }
+function stringSetting(value) {
+    return typeof value === "string" ? cleanConfig(value) : undefined;
+}
 function normalizeCommand(raw) {
     const trimmed = cleanConfig(raw);
     if (!trimmed)
@@ -85,12 +233,13 @@ function openInBrowser(url) {
         .on("error", () => undefined)
         .unref();
 }
-async function generateVirtualKey(baseUrl, userToken, signal) {
+async function generateVirtualKey(baseUrl, userToken, signal, headers) {
     const { signal: boundedSignal, cancel } = withTimeout(LOGIN_TIMEOUT_MS, signal);
     try {
         const response = await fetch(`${baseUrl}/key/generate`, {
             method: "POST",
             headers: {
+                ...headers,
                 Authorization: `Bearer ${userToken}`,
                 "Content-Type": "application/json",
             },
@@ -119,22 +268,149 @@ function resolveOAuthApiKey(credentials) {
         ? executeApiKeyCommand(credentials.refresh)
         : getLiteLLMApiKey(credentials);
 }
-async function resolveCredentials({ executeHelpers = true } = {}) {
-    const entry = await readAuthEntry();
-    const envBase = cleanConfig(process.env[ENV_BASE_URL]);
-    const envKey = cleanConfig(process.env[ENV_API_KEY]);
-    const envHelperCommand = getApiKeyHelperCommand();
-    const useGcloudToken = isGcloudTokenAuthEnabled();
+function resolveTemplateConfigValue(config) {
+    let resolved = "";
+    for (let index = 0; index < config.length;) {
+        const dollarIndex = config.indexOf("$", index);
+        if (dollarIndex === -1)
+            return resolved + config.slice(index);
+        resolved += config.slice(index, dollarIndex);
+        const nextChar = config[dollarIndex + 1];
+        if (nextChar === "$" || nextChar === "!") {
+            resolved += nextChar;
+            index = dollarIndex + 2;
+            continue;
+        }
+        if (nextChar === "{") {
+            const endIndex = config.indexOf("}", dollarIndex + 2);
+            if (endIndex === -1) {
+                resolved += "$";
+                index = dollarIndex + 1;
+                continue;
+            }
+            const name = config.slice(dollarIndex + 2, endIndex);
+            const envValue = process.env[name];
+            if (envValue === undefined)
+                return undefined;
+            resolved += envValue;
+            index = endIndex + 1;
+            continue;
+        }
+        const match = config.slice(dollarIndex + 1).match(/^[A-Za-z_][A-Za-z0-9_]*/);
+        if (!match) {
+            resolved += "$";
+            index = dollarIndex + 1;
+            continue;
+        }
+        const envValue = process.env[match[0]];
+        if (envValue === undefined)
+            return undefined;
+        resolved += envValue;
+        index = dollarIndex + 1 + match[0].length;
+    }
+    return resolved;
+}
+function resolveConfigValue(config, { executeCommands }) {
+    if (config.startsWith("!"))
+        return executeCommands ? executeApiKeyCommand(config) : undefined;
+    return resolveTemplateConfigValue(config);
+}
+const warnedUnresolvedApiKeys = new Set();
+function warnUnresolvedApiKeyConfig(providerName, config) {
+    const key = `${providerName} ${config}`;
+    if (warnedUnresolvedApiKeys.has(key))
+        return;
+    warnedUnresolvedApiKeys.add(key);
+    process.stderr.write(`LiteLLM (${providerName}): configured apiKey did not resolve (unset environment variable?); use $$ for a literal $.\n`);
+}
+function parseHeaderRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const headers = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (!key.trim())
+            continue;
+        let resolved;
+        if (typeof raw === "string")
+            resolved = resolveTemplateConfigValue(raw);
+        else if (typeof raw === "number" || typeof raw === "boolean")
+            resolved = String(raw);
+        else {
+            process.stderr.write(`LiteLLM: ignoring non-primitive header value for "${key}".\n`);
+            continue;
+        }
+        if (resolved)
+            headers[key] = resolved;
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
+function parseCustomHeaders(raw) {
+    const trimmed = cleanConfig(raw);
+    if (!trimmed)
+        return undefined;
+    try {
+        return parseHeaderRecord(JSON.parse(trimmed));
+    }
+    catch (error) {
+        process.stderr.write(`LiteLLM: failed to parse custom headers (${error instanceof Error ? error.message : String(error)}).\n`);
+        return undefined;
+    }
+}
+function resolveHeaders(definition) {
+    if (typeof definition.headers === "string")
+        return parseCustomHeaders(resolveTemplateConfigValue(definition.headers));
+    return parseHeaderRecord(definition.headers);
+}
+// Headers can select a different tenant/customer at the same base URL with the
+// same key, so the cache must invalidate on header changes too, not just on
+// baseUrl/apiKey changes, or a stale tenant's models get reused silently.
+function computeHeadersFingerprint(headers) {
+    if (!headers)
+        return undefined;
+    const sorted = Object.keys(headers)
+        .sort()
+        .map((key) => [key, headers[key]]);
+    return fingerprint(JSON.stringify(sorted));
+}
+// Pi core resolves registered header values with the same $VAR/!command syntax
+// at request time, so already-resolved literals must be escaped or they get
+// resolved a second time ($UNSET would then fail every request).
+function escapeConfigValue(value) {
+    const escaped = value.replace(/\$/g, "$$$$");
+    return escaped.startsWith("!") ? `$${escaped}` : escaped;
+}
+function escapeHeaderConfig(headers) {
+    if (!headers)
+        return undefined;
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, escapeConfigValue(value)]));
+}
+async function resolveCredentials(definition, { executeHelpers = true } = {}) {
+    const entry = definition.useSavedAuth ? await readAuthEntry(definition.name) : undefined;
+    const configuredBase = cleanConfig(definition.baseUrl) ?? (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined);
+    const envKey = definition.useDefaultEnv ? cleanConfig(process.env[ENV_API_KEY]) : undefined;
+    const envHelperCommand = definition.useDefaultEnv ? getApiKeyHelperCommand() : undefined;
+    const useGcloudToken = definition.useGcloudTokenAuth && isGcloudTokenAuthEnabled();
     const authBase = entry?.type === "oauth" ? entry.baseUrl?.trim() : undefined;
     const gcloudCacheKey = useGcloudToken && !entry ? ((await getGcloudTokenCacheKey()) ?? undefined) : undefined;
     const authKey = entry?.type === "oauth"
         ? (executeHelpers ? resolveOAuthApiKey(entry) : entry.access).trim()
         : entry?.type === "api_key"
-            ? (await AuthStorage.create(getAuthPath()).getApiKey(PROVIDER_NAME, { includeFallback: false }))?.trim()
+            ? (await AuthStorage.create(getAuthPath()).getApiKey(definition.name, { includeFallback: false }))?.trim()
             : undefined;
     const gcloudKey = executeHelpers && gcloudCacheKey ? (await getGcloudToken())?.trim() : undefined;
-    const helperKey = !authKey && !gcloudKey && executeHelpers && envHelperCommand ? executeApiKeyCommand(envHelperCommand) : undefined;
-    const apiKey = authKey || gcloudKey || helperKey || envKey;
+    // Resolved lazily so a `!command` key is not executed when a
+    // higher-precedence credential (saved auth, gcloud token) already won.
+    let configuredKey;
+    if (!authKey && !gcloudKey && definition.apiKeyConfig) {
+        configuredKey = resolveConfigValue(definition.apiKeyConfig, { executeCommands: executeHelpers });
+        if (configuredKey === undefined && !definition.apiKeyConfig.startsWith("!")) {
+            warnUnresolvedApiKeyConfig(definition.name, definition.apiKeyConfig);
+        }
+    }
+    const helperKey = !authKey && !gcloudKey && !configuredKey && executeHelpers && envHelperCommand
+        ? executeApiKeyCommand(envHelperCommand)
+        : undefined;
+    const apiKey = authKey || gcloudKey || configuredKey || helperKey || envKey;
     let apiKeyFingerprint;
     let apiKeyConfig;
     if (entry?.type === "oauth" && entry.refresh.startsWith("!")) {
@@ -151,6 +427,14 @@ async function resolveCredentials({ executeHelpers = true } = {}) {
         apiKeyFingerprint = fingerprint(gcloudCacheKey);
         apiKeyConfig = getGcloudTokenCommand();
     }
+    else if (configuredKey && definition.apiKeyConfig) {
+        apiKeyFingerprint = fingerprint(definition.apiKeyConfig.startsWith("!") ? definition.apiKeyConfig : configuredKey);
+        apiKeyConfig = definition.apiKeyConfig;
+    }
+    else if (!executeHelpers && definition.apiKeyConfig?.startsWith("!")) {
+        apiKeyFingerprint = fingerprint(definition.apiKeyConfig);
+        apiKeyConfig = definition.apiKeyConfig;
+    }
     else if (helperKey && envHelperCommand) {
         apiKeyFingerprint = fingerprint(envHelperCommand);
         apiKeyConfig = envHelperCommand;
@@ -163,7 +447,7 @@ async function resolveCredentials({ executeHelpers = true } = {}) {
         apiKeyFingerprint = fingerprint(envKey);
         apiKeyConfig = `$${ENV_API_KEY}`;
     }
-    const rawBase = authBase || envBase;
+    const rawBase = authBase || configuredBase;
     return {
         baseUrl: rawBase ? normalizeBaseUrl(rawBase) : undefined,
         apiKey: apiKey || undefined,
@@ -186,6 +470,51 @@ function isOffline() {
 function isListModelsMode() {
     return process.argv.includes("--list-models");
 }
+function normalizeProviderSettings(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const record = raw;
+    if (record.enabled === false)
+        return undefined;
+    return record;
+}
+async function getProviderDefinitions() {
+    const settings = await readGlobalLiteLLMSettings();
+    const rawProviders = settings?.providers && typeof settings.providers === "object" ? settings.providers : undefined;
+    const providerSettings = rawProviders;
+    const defaultSettings = normalizeProviderSettings(providerSettings?.[PROVIDER_NAME]);
+    const makeDefinition = (name, raw, isDefault) => ({
+        name,
+        displayName: stringSetting(raw?.displayName) ?? (isDefault ? "LiteLLM" : name),
+        baseUrl: stringSetting(raw?.baseUrl),
+        apiKeyConfig: stringSetting(raw?.apiKey),
+        headers: raw?.headers ?? (isDefault ? `$${ENV_HEADERS}` : undefined),
+        useDefaultEnv: isDefault,
+        useGcloudTokenAuth: isDefault,
+        useSavedAuth: true,
+        enableOAuth: isDefault,
+    });
+    const definitions = [makeDefinition(PROVIDER_NAME, defaultSettings, true)];
+    const usedCacheSegments = new Map();
+    for (const [name, raw] of Object.entries(providerSettings ?? {})) {
+        if (name === PROVIDER_NAME)
+            continue;
+        const normalized = normalizeProviderSettings(raw);
+        if (!normalized)
+            continue;
+        // Distinct alias names can sanitize to the same cache file; registering
+        // both would let their model caches silently clobber each other.
+        const segment = sanitizeCacheSegment(name);
+        const existing = usedCacheSegments.get(segment);
+        if (existing) {
+            process.stderr.write(`LiteLLM: provider alias "${name}" would share a cache file with "${existing}"; skipping it. Rename the alias.\n`);
+            continue;
+        }
+        usedCacheSegments.set(segment, name);
+        definitions.push(makeDefinition(name, normalized, false));
+    }
+    return definitions;
+}
 async function discoverWithFallback(baseUrl, apiKey, options) {
     try {
         return { result: await discoverModels(baseUrl, apiKey, options) };
@@ -198,7 +527,7 @@ async function discoverWithFallback(baseUrl, apiKey, options) {
         };
     }
 }
-async function loginLiteLLM(callbacks, onCacheWrite) {
+async function loginLiteLLM(callbacks, options) {
     const rawBaseUrl = (await callbacks.onPrompt({
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
         placeholder: "https://litellm.example.com",
@@ -229,7 +558,7 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
         if (wantVirtualKey !== "n" && wantVirtualKey !== "no") {
             try {
                 callbacks.onProgress?.("Generating virtual key...");
-                const generated = await generateVirtualKey(baseUrl, rawToken, callbacks.signal);
+                const generated = await generateVirtualKey(baseUrl, rawToken, callbacks.signal, options.headers);
                 apiKey = generated.key;
                 refresh = "";
                 expires =
@@ -263,16 +592,18 @@ async function loginLiteLLM(callbacks, onCacheWrite) {
     const { models, source } = await discoverModels(baseUrl, apiKey, {
         timeoutMs: LOGIN_TIMEOUT_MS,
         signal: callbacks.signal,
+        headers: options.headers,
     });
     const cache = {
         baseUrl,
         apiKeyFingerprint: fingerprint(refresh || apiKey),
+        headersFingerprint: computeHeadersFingerprint(options.headers),
         fetchedAt: Date.now(),
         source,
         models,
     };
-    await writeCache(getCachePath(), cache);
-    onCacheWrite?.(cache);
+    await writeCache(options.cachePath, cache);
+    await options.onCacheWrite?.(cache);
     callbacks.onProgress?.(`LiteLLM: ${models.length} models discovered (source: ${source})`);
     return {
         access: apiKey,
@@ -297,7 +628,18 @@ function modifyLiteLLMModels(models, cred) {
         return models;
     return models.map((m) => (m.provider === PROVIDER_NAME ? { ...m, baseUrl: `${baseUrl}/v1` } : m));
 }
-function prepareLiteLLMRequestPayload(payload, modelId, sessionId) {
+function isReasoningItem(item) {
+    return typeof item === "object" && item !== null && item.type === "reasoning";
+}
+// Reasoning fields LiteLLM forwards to chat-completions providers. The Moonshot
+// path defaults them off; the gpt-5.5 tool path strips them entirely.
+const REASONING_SUPPRESSION_DEFAULTS = {
+    include_reasoning: false,
+    reasoning_content: false,
+    merge_reasoning_content_in_choices: true,
+    thinking: { type: "disabled" },
+};
+function prepareLiteLLMRequestPayload(payload, modelId, api, sessionId) {
     let next;
     const update = (key, value) => {
         if (payload[key] !== undefined)
@@ -305,11 +647,40 @@ function prepareLiteLLMRequestPayload(payload, modelId, sessionId) {
         next ??= { ...payload };
         next[key] = value;
     };
-    if (modelId && shouldSuppressReasoningContent(modelId)) {
-        update("include_reasoning", false);
-        update("reasoning_content", false);
-        update("merge_reasoning_content_in_choices", true);
-        update("thinking", { type: "disabled" });
+    if (api !== "openai-responses" && modelId && shouldSuppressReasoningContent(modelId)) {
+        for (const [key, value] of Object.entries(REASONING_SUPPRESSION_DEFAULTS))
+            update(key, value);
+    }
+    // LiteLLM still routes gpt-5.5 tool+reasoning requests through chat completions.
+    // Drop reasoning until the gateway honors /v1/responses for this route.
+    if (api !== "openai-responses" &&
+        modelId &&
+        isGpt55Model(modelId) &&
+        Array.isArray(payload.tools) &&
+        payload.tools.length > 0) {
+        const reasoningKeys = ["reasoning", "reasoning_effort", ...Object.keys(REASONING_SUPPRESSION_DEFAULTS)];
+        for (const key of reasoningKeys) {
+            if (payload[key] === undefined)
+                continue;
+            next ??= { ...payload };
+            delete next[key];
+        }
+        const include = (next ?? payload).include;
+        if (Array.isArray(include) && include.includes("reasoning.encrypted_content")) {
+            next ??= { ...payload };
+            const filteredInclude = include.filter((value) => value !== "reasoning.encrypted_content");
+            if (filteredInclude.length === 0)
+                delete next.include;
+            else
+                next.include = filteredInclude;
+        }
+        // Prior turns may have replayed reasoning items (with encrypted_content)
+        // into the input; they are rejected once reasoning is stripped.
+        const input = (next ?? payload).input;
+        if (Array.isArray(input) && input.some(isReasoningItem)) {
+            next ??= { ...payload };
+            next.input = input.filter((item) => !isReasoningItem(item));
+        }
     }
     if (sessionId) {
         next ??= { ...payload };
@@ -317,8 +688,8 @@ function prepareLiteLLMRequestPayload(payload, modelId, sessionId) {
     }
     return next;
 }
-function normalizeThinkTags(message) {
-    if (message.provider !== PROVIDER_NAME || !shouldSuppressReasoningContent(message.model))
+function normalizeThinkTags(message, litellmProviderNames) {
+    if (!litellmProviderNames.has(message.provider) || !shouldSuppressReasoningContent(message.model))
         return;
     let changed = false;
     const content = [];
@@ -379,120 +750,162 @@ function normalizeThinkTags(message) {
     return { ...message, content };
 }
 export default async function (pi) {
-    let creds = await resolveCredentials({ executeHelpers: false });
-    const cache = await readCache(getCachePath());
-    let fp = creds.apiKeyFingerprint;
-    let cacheFetchedAt = cache?.fetchedAt ?? 0;
-    const cacheValid = cache !== null &&
-        creds.baseUrl !== undefined &&
-        fp !== undefined &&
-        cache.baseUrl === creds.baseUrl &&
-        cache.apiKeyFingerprint === fp;
-    let models = cacheValid && cache ? cache.models : [];
-    const shouldFetch = creds.baseUrl !== undefined &&
-        fp !== undefined &&
-        !isOffline() &&
-        getDiscoveryTimeoutMs() > 0 &&
-        (!cacheValid || isListModelsMode());
-    let credentialWarning;
-    let liveDiscoveryApiKey;
-    if (shouldFetch) {
-        try {
-            creds = await resolveCredentials();
-            fp = creds.apiKeyFingerprint;
-        }
-        catch (error) {
-            if (!cacheValid || !cache)
-                throw error;
-            credentialWarning = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`LiteLLM: discovery failed (${credentialWarning}); using cached models.\n`);
-            models = cache.models;
-        }
+    const definitions = await getProviderDefinitions();
+    const providerNames = new Set(definitions.map((definition) => definition.name));
+    function discoveryDisabledReason() {
+        if (isOffline())
+            return `${ENV_OFFLINE}=1`;
+        if (getDiscoveryTimeoutMs() === 0)
+            return `${ENV_TIMEOUT}=0`;
+        return null;
     }
-    if (shouldFetch && !credentialWarning && creds.baseUrl && creds.apiKey && fp) {
-        const timeoutMs = getDiscoveryTimeoutMs();
-        const { result, warning } = await discoverWithFallback(creds.baseUrl, creds.apiKey, {
-            timeoutMs,
-        });
-        if (warning) {
-            if (cacheValid && cache) {
-                process.stderr.write(`LiteLLM: discovery failed (${warning}); using cached models.\n`);
-                models = cache.models;
+    async function loadProviderState(definition) {
+        let creds = await resolveCredentials(definition, { executeHelpers: false });
+        const headers = resolveHeaders(definition);
+        const headersFp = computeHeadersFingerprint(headers);
+        const cache = await readCache(getCachePath(definition.name));
+        let fp = creds.apiKeyFingerprint;
+        let cacheFetchedAt = cache?.fetchedAt ?? 0;
+        const cacheValid = cache !== null &&
+            creds.baseUrl !== undefined &&
+            fp !== undefined &&
+            cache.baseUrl === creds.baseUrl &&
+            cache.apiKeyFingerprint === fp &&
+            cache.headersFingerprint === headersFp;
+        let models = cacheValid && cache ? cache.models : [];
+        const shouldFetch = creds.baseUrl !== undefined &&
+            fp !== undefined &&
+            !isOffline() &&
+            getDiscoveryTimeoutMs() > 0 &&
+            (!cacheValid || isListModelsMode());
+        let credentialWarning;
+        let liveDiscoveryApiKey;
+        if (shouldFetch) {
+            try {
+                creds = await resolveCredentials(definition);
+                fp = creds.apiKeyFingerprint;
             }
-            else {
-                process.stderr.write(`LiteLLM: discovery failed (${warning}); registering provider with no models.\n`);
-                models = [];
+            catch (error) {
+                // A broken alias must not abort activation for the other providers;
+                // only the default provider keeps the historical fail-fast behavior.
+                if ((!cacheValid || !cache) && definition.useDefaultEnv)
+                    throw error;
+                credentialWarning = error instanceof Error ? error.message : String(error);
+                if (cacheValid && cache) {
+                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${credentialWarning}); using cached models.\n`);
+                    models = cache.models;
+                }
+                else {
+                    process.stderr.write(`LiteLLM (${definition.name}): credential resolution failed (${credentialWarning}); registering provider with no models.\n`);
+                    models = [];
+                }
             }
         }
-        else {
-            models = result.models;
-            liveDiscoveryApiKey = creds.apiKey;
-            const next = {
-                baseUrl: creds.baseUrl,
-                apiKeyFingerprint: fp,
-                fetchedAt: Date.now(),
-                source: result.source,
-                models: result.models,
-            };
-            await writeCache(getCachePath(), next);
-            cacheFetchedAt = next.fetchedAt;
-            if (isListModelsMode()) {
-                process.stderr.write(`LiteLLM: ${result.models.length} models discovered (source: ${result.source}).\n`);
+        if (shouldFetch && !credentialWarning && creds.baseUrl && creds.apiKey && fp) {
+            const timeoutMs = getDiscoveryTimeoutMs();
+            const { result, warning } = await discoverWithFallback(creds.baseUrl, creds.apiKey, {
+                timeoutMs,
+                headers,
+            });
+            if (warning) {
+                if (cacheValid && cache) {
+                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${warning}); using cached models.\n`);
+                    models = cache.models;
+                }
+                else {
+                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${warning}); registering provider with no models.\n`);
+                    models = [];
+                }
+            }
+            else {
+                models = result.models;
+                liveDiscoveryApiKey = creds.apiKey;
+                const next = {
+                    baseUrl: creds.baseUrl,
+                    apiKeyFingerprint: fp,
+                    headersFingerprint: headersFp,
+                    fetchedAt: Date.now(),
+                    source: result.source,
+                    models: result.models,
+                };
+                await writeCache(getCachePath(definition.name), next);
+                cacheFetchedAt = next.fetchedAt;
+                if (isListModelsMode()) {
+                    process.stderr.write(`LiteLLM (${definition.name}): ${result.models.length} models discovered (source: ${result.source}).\n`);
+                }
             }
         }
+        // The cache keeps raw discovery output; overrides are applied freshly at each registration.
+        models = await applyOverrides(definition.name, models);
+        return { definition, creds, headers, models, cacheFetchedAt, liveDiscoveryApiKey, refreshInProgress: null };
     }
+    const providerStates = await Promise.all(definitions.map(loadProviderState));
+    const defaultState = providerStates.find((state) => state.definition.name === PROVIDER_NAME) ?? providerStates[0];
     let updateCosts = () => undefined;
+    const providerModelsForCosts = () => providerStates.map((state) => ({ provider: state.definition.name, models: state.models }));
+    const updateAllCosts = () => updateCosts(providerModelsForCosts());
+    function defaultApiKeyConfig(definition) {
+        if (definition.useDefaultEnv) {
+            return definition.apiKeyConfig ?? getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`;
+        }
+        // An alias must never inherit the default provider's env key; leaving the
+        // key unset makes requests fail loudly instead of leaking credentials.
+        return definition.apiKeyConfig;
+    }
+    function registerProvider(state, models = state.models, apiKeyConfig = state.creds.apiKeyConfig) {
+        const definition = state.definition;
+        pi.registerProvider(definition.name, {
+            name: definition.displayName,
+            baseUrl: state.creds.baseUrl ? `${state.creds.baseUrl}/v1` : "https://litellm.example.com/v1",
+            apiKey: apiKeyConfig ?? defaultApiKeyConfig(definition),
+            api: "openai-completions",
+            headers: escapeHeaderConfig(state.headers),
+            models,
+            oauth: definition.enableOAuth ? oauth : undefined,
+        });
+    }
+    function defaultLoginOptions() {
+        return {
+            cachePath: getCachePath(PROVIDER_NAME),
+            headers: defaultState.headers,
+            onCacheWrite: async (next) => {
+                defaultState.cacheFetchedAt = next.fetchedAt;
+                const overridden = await applyOverrides(PROVIDER_NAME, next.models);
+                defaultState.models = overridden;
+                defaultState.creds = {
+                    ...defaultState.creds,
+                    baseUrl: next.baseUrl,
+                    apiKeyFingerprint: next.apiKeyFingerprint,
+                };
+                registerProvider(defaultState, overridden);
+                updateAllCosts();
+            },
+        };
+    }
     const oauth = {
         name: "LiteLLM",
-        login: (callbacks) => loginLiteLLM(callbacks, (next) => {
-            cacheFetchedAt = next.fetchedAt;
-            registerProvider(next.baseUrl, next.models);
-            updateCosts(next.models);
-        }),
+        login: (callbacks) => loginLiteLLM(callbacks, defaultLoginOptions()),
         refreshToken: refreshLiteLLM,
         getApiKey: getLiteLLMApiKey,
         modifyModels: modifyLiteLLMModels,
     };
-    function registerProvider(baseUrl, models, apiKeyConfig = creds.apiKeyConfig ?? getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`) {
-        pi.registerProvider(PROVIDER_NAME, {
-            baseUrl: baseUrl ? `${baseUrl}/v1` : "https://litellm.example.com/v1",
-            // When LITELLM_API_KEY_HELPER is set we register the helper as a `!command` provider key.
-            // Pi's per-request auth path (ModelRegistry.getApiKeyAndHeaders) resolves provider keys via
-            // resolveConfigValueOrThrow -> resolveConfigValueUncached, i.e. the command is re-executed on
-            // every request (it does NOT use the process-lifetime command cache, which only applies to
-            // resolveConfigValue). So a short-lived/rotating helper token stays fresh. The OAuth hooks
-            // remain registered for `/login litellm` users. See the regression test
-            // "re-runs the helper command on every request" in tests/index.test.ts.
-            apiKey: apiKeyConfig,
-            api: "openai-completions",
-            models,
-            oauth,
-        });
-    }
-    registerProvider(creds.baseUrl, models);
-    updateCosts = setupLiteLLMCostTracking(pi, models);
-    let refreshInProgress = null;
-    function discoveryDisabledReason() {
-        if (isOffline())
-            return `${ENV_OFFLINE}=1`;
-        if (getDiscoveryTimeoutMs() === 0)
-            return `${ENV_TIMEOUT}=0`;
-        return null;
-    }
-    async function resolveRuntimeApiKey() {
-        const fresh = await resolveCredentials();
+    for (const state of providerStates)
+        registerProvider(state);
+    updateCosts = setupLiteLLMCostTracking(pi, providerModelsForCosts());
+    async function resolveRuntimeApiKey(state = defaultState) {
+        const fresh = await resolveCredentials(state.definition);
         if (!fresh.apiKey)
-            throw new Error("no credentials. Run /login litellm or set env vars.");
+            throw new Error(`no credentials for ${state.definition.name}. Run /login litellm or set env vars.`);
         return fresh.apiKey;
     }
-    function registerSkillTools(baseUrl) {
-        if (!baseUrl)
+    function registerSkillTools(state = defaultState) {
+        if (!state.creds.baseUrl)
             return;
-        for (const tool of createSkillToolDefinitions(baseUrl, resolveRuntimeApiKey)) {
+        for (const tool of createSkillToolDefinitions(state.creds.baseUrl, () => resolveRuntimeApiKey(state), state.headers)) {
             pi.registerTool(tool);
         }
     }
-    function seededRuntimeApiKey(seed) {
+    function seededRuntimeApiKey(state, seed) {
         let first = seed;
         return async () => {
             if (first) {
@@ -500,50 +913,59 @@ export default async function (pi) {
                 first = undefined;
                 return value;
             }
-            return resolveRuntimeApiKey();
+            return resolveRuntimeApiKey(state);
         };
     }
-    async function registerMcpTools(baseUrl, discoveryApiKey) {
-        if (!baseUrl || !discoveryApiKey || discoveryDisabledReason())
+    async function registerMcpTools(state) {
+        if (!state.creds.baseUrl || !state.liveDiscoveryApiKey || discoveryDisabledReason())
             return;
         try {
-            const tools = await createMcpToolDefinitions(baseUrl, seededRuntimeApiKey(discoveryApiKey));
+            const tools = await createMcpToolDefinitions(state.creds.baseUrl, seededRuntimeApiKey(state, state.liveDiscoveryApiKey), state.headers);
             for (const tool of tools) {
                 pi.registerTool(tool);
             }
         }
         catch (error) {
-            process.stderr.write(`LiteLLM: MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
+            process.stderr.write(`LiteLLM (${state.definition.name}): MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
         }
     }
-    registerSkillTools(creds.baseUrl);
-    await registerMcpTools(creds.baseUrl, liveDiscoveryApiKey);
-    async function refreshModelsAndCosts() {
-        const fresh = await resolveCredentials();
+    registerSkillTools(defaultState);
+    await registerMcpTools(defaultState);
+    async function refreshModelsAndCosts(state) {
+        const fresh = await resolveCredentials(state.definition);
         const freshFp = fresh.apiKeyFingerprint;
         if (!fresh.baseUrl || !fresh.apiKey || !freshFp) {
-            throw new Error("no credentials. Run /login litellm or set env vars.");
+            throw new Error(`no credentials for ${state.definition.name}. Run /login litellm or set env vars.`);
         }
-        const result = await discoverModels(fresh.baseUrl, fresh.apiKey, { timeoutMs: getDiscoveryTimeoutMs() });
+        const result = await discoverModels(fresh.baseUrl, fresh.apiKey, {
+            timeoutMs: getDiscoveryTimeoutMs(),
+            headers: state.headers,
+        });
         const now = Date.now();
-        await writeCache(getCachePath(), {
+        await writeCache(getCachePath(state.definition.name), {
             baseUrl: fresh.baseUrl,
             apiKeyFingerprint: freshFp,
+            headersFingerprint: computeHeadersFingerprint(state.headers),
             fetchedAt: now,
             source: result.source,
             models: result.models,
         });
-        registerProvider(fresh.baseUrl, result.models, fresh.apiKeyConfig);
-        updateCosts(result.models);
-        cacheFetchedAt = now;
-        await registerMcpTools(fresh.baseUrl, fresh.apiKey);
-        return { models: result.models, source: result.source };
-    }
-    function runRefresh() {
-        refreshInProgress ??= refreshModelsAndCosts().finally(() => {
-            refreshInProgress = null;
+        const overridden = await applyOverrides(state.definition.name, result.models);
+        state.creds = fresh;
+        state.models = overridden;
+        state.liveDiscoveryApiKey = fresh.apiKey;
+        state.cacheFetchedAt = now;
+        registerProvider(state, overridden, fresh.apiKeyConfig);
+        updateAllCosts();
+        if (state.definition.name === PROVIDER_NAME)
+            await registerMcpTools(state);
+        return { providerName: state.definition.name, models: overridden, source: result.source };
+    }
+    function runRefresh(state) {
+        state.refreshInProgress ??= refreshModelsAndCosts(state).finally(() => {
+            state.refreshInProgress = null;
         });
-        return refreshInProgress;
+        return state.refreshInProgress;
     }
     async function runLogin(ctx) {
         const credential = await loginLiteLLM({
@@ -561,17 +983,15 @@ export default async function (pi) {
             onProgress: (message) => ctx.ui.notify(message, "info"),
             onSelect: async () => undefined,
             signal: ctx.signal,
-        }, (next) => {
-            cacheFetchedAt = next.fetchedAt;
-            registerProvider(next.baseUrl, next.models);
-            updateCosts(next.models);
-        });
+        }, defaultLoginOptions());
         ctx.modelRegistry.authStorage.set(PROVIDER_NAME, { type: "oauth", ...credential });
         ctx.modelRegistry.refresh();
         const credentialBaseUrl = credential.baseUrl;
         const credentialAccess = typeof credential.access === "string" ? credential.access : undefined;
-        registerSkillTools(credentialBaseUrl);
-        await registerMcpTools(credentialBaseUrl, credentialAccess);
+        defaultState.creds = { ...defaultState.creds, baseUrl: credentialBaseUrl };
+        defaultState.liveDiscoveryApiKey = credentialAccess;
+        registerSkillTools(defaultState);
+        await registerMcpTools(defaultState);
         ctx.ui.notify(`Logged in to LiteLLM. Credentials saved to ${getAuthPath()}`, "info");
     }
     pi.on("input", async (event, ctx) => {
@@ -591,43 +1011,75 @@ export default async function (pi) {
     });
     pi.registerCommand("litellm-refresh", {
         description: "Re-discover models from the LiteLLM proxy.",
-        handler: async (_args, ctx) => {
+        handler: async (args, ctx) => {
             const disabledReason = discoveryDisabledReason();
             if (disabledReason) {
                 ctx.ui.notify(`LiteLLM refresh disabled (${disabledReason})`, "warning");
                 return;
             }
-            try {
-                const result = await runRefresh();
-                ctx.ui.notify(`LiteLLM: ${result.models.length} models refreshed (source: ${result.source})`, "info");
+            const requestedProvider = args.trim();
+            const statesToRefresh = requestedProvider
+                ? providerStates.filter((state) => state.definition.name === requestedProvider)
+                : providerStates;
+            if (statesToRefresh.length === 0) {
+                ctx.ui.notify(`LiteLLM refresh failed: unknown provider ${requestedProvider}`, "error");
+                return;
             }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                ctx.ui.notify(`LiteLLM refresh failed: ${message}`, "error");
+            const settled = await Promise.allSettled(statesToRefresh.map(runRefresh));
+            const succeeded = settled.filter((result) => result.status === "fulfilled").map((result) => result.value);
+            const failed = settled
+                .map((result, index) => ({ result, name: statesToRefresh[index].definition.name }))
+                .filter(({ result }) => result.status === "rejected")
+                .map(({ result, name }) => {
+                const reason = result.reason;
+                return { name, message: reason instanceof Error ? reason.message : String(reason) };
+            });
+            if (failed.length === 0) {
+                if (succeeded.length === 1) {
+                    const result = succeeded[0];
+                    ctx.ui.notify(`LiteLLM: ${result.models.length} models refreshed (source: ${result.source})`, "info");
+                    return;
+                }
+                ctx.ui.notify(`LiteLLM: ${succeeded.length} providers refreshed (${succeeded
+                    .map((result) => `${result.providerName}: ${result.models.length} models`)
+                    .join(", ")})`, "info");
+                return;
             }
+            const failures = failed.map(({ name, message }) => (settled.length === 1 ? message : `${name}: ${message}`));
+            if (succeeded.length === 0) {
+                ctx.ui.notify(`LiteLLM refresh failed: ${failures.join("; ")}`, "error");
+                return;
+            }
+            ctx.ui.notify(`LiteLLM: refreshed ${succeeded
+                .map((result) => `${result.providerName}: ${result.models.length} models`)
+                .join(", ")}; failed ${failures.join("; ")}`, "warning");
         },
     });
     let sessionId;
     pi.on("session_start", (_event, ctx) => {
         sessionId = getSessionIdFromFile(ctx.sessionManager.getSessionFile());
-        if (discoveryDisabledReason() || !cacheFetchedAt || Date.now() - cacheFetchedAt <= CACHE_STALE_MS)
+        if (discoveryDisabledReason())
             return;
-        void runRefresh().catch(() => undefined);
+        for (const state of providerStates) {
+            if (!state.cacheFetchedAt || Date.now() - state.cacheFetchedAt <= CACHE_STALE_MS)
+                continue;
+            void runRefresh(state).catch(() => undefined);
+        }
     });
     pi.on("before_provider_request", (event, ctx) => {
-        if (ctx.model?.provider !== PROVIDER_NAME)
+        if (!ctx.model?.provider || !providerNames.has(ctx.model.provider))
             return;
         if (typeof event.payload !== "object" || event.payload === null)
             return;
-        return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, sessionId);
+        return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, ctx.model?.api, sessionId);
     });
     pi.on("before_agent_start", async (event) => {
         if (discoveryDisabledReason())
             return;
-        const fresh = await resolveCredentials();
+        const fresh = await resolveCredentials(defaultState.definition);
         if (!fresh.baseUrl || !fresh.apiKey)
             return;
-        const skills = await listSkills(fresh.baseUrl, fresh.apiKey);
+        const skills = await listSkills(fresh.baseUrl, fresh.apiKey, defaultState.headers);
         const section = createSkillsPromptSection(skills);
         if (!section)
             return;
@@ -636,7 +1088,7 @@ export default async function (pi) {
     pi.on("message_end", (event) => {
         if (event.message.role !== "assistant")
             return;
-        const message = normalizeThinkTags(event.message);
+        const message = normalizeThinkTags(event.message, providerNames);
         if (!message)
             return;
         return { message };