pi-provider-litellm 1.2.9 → 2.0.0

package/dist/index.js

@@ -1,13 +1,13 @@
-import { execSync, spawn } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { AuthStorage, getAgentDir } from "@earendil-works/pi-coding-agent";
-import { fingerprint, readCache, writeCache } from "./cache.js";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { setupLiteLLMCostTracking } from "./cost.js";
-import { discoverModels, isGpt55Model, normalizeBaseUrl, shouldSuppressReasoningContent, withTimeout, } from "./discover.js";
+import { discoverModels, isGpt55Model, normalizeBaseUrl, shouldSuppressReasoningContent } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
+import { createLiteLLMProvider } from "./provider.js";
 import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
 const SETTINGS_KEY = "litellm";
@@ -17,159 +17,23 @@ const ENV_API_KEY_HELPER = "LITELLM_API_KEY_HELPER";
 const ENV_HEADERS = "LITELLM_HEADERS";
 const ENV_TIMEOUT = "LITELLM_DISCOVERY_TIMEOUT_MS";
 const ENV_OFFLINE = "LITELLM_OFFLINE";
+const ENV_VERBOSE_DISCOVERY = "LITELLM_VERBOSE_DISCOVERY";
+const ENV_MODELS_DEV = "LITELLM_MODELS_DEV";
 const DEFAULT_TIMEOUT_MS = 5000;
 const LOGIN_TIMEOUT_MS = 10_000;
-const CACHE_FILENAME = "litellm-models.json";
-const CACHE_STALE_MS = 24 * 60 * 60 * 1000;
+const MODELS_DEV_CACHE_FILENAME = "litellm-models-dev.json";
 const TOKEN_REFRESH_LEAD_MS = 5 * 60 * 1000;
 const PERMANENT_TOKEN_EXPIRES_AT = Number.MAX_SAFE_INTEGER;
 const EXPIRE_TOKEN_IMMEDIATELY = 0;
-function getAuthPath() {
-    return join(getAgentDir(), "auth.json");
-}
-function sanitizeCacheSegment(value) {
-    return (value
-        .toLowerCase()
-        .replace(/[^a-z0-9._-]+/g, "-")
-        .replace(/^-+|-+$/g, "") || "provider");
-}
-function getCachePath(providerName = PROVIDER_NAME) {
-    if (providerName === PROVIDER_NAME)
-        return join(getAgentDir(), CACHE_FILENAME);
-    return join(getAgentDir(), `litellm-models-${sanitizeCacheSegment(providerName)}.json`);
-}
-// Same tolerance as pi core's models.json loader (stripJsonComments in dist/utils/json.js):
-// strip `//` line comments and trailing commas, leaving string literals untouched.
-function stripJsonComments(input) {
-    return input
-        .replace(/"(?:\\.|[^"\\])*"|\/\/[^\n]*/g, (m) => (m[0] === '"' ? m : ""))
-        .replace(/"(?:\\.|[^"\\])*"|,(\s*[}\]])/g, (m, tail) => tail ?? m);
+function getModelsDevDiscoveryOptions() {
+    return {
+        modelsDev: process.env[ENV_MODELS_DEV] !== "0",
+        modelsDevCachePath: join(getAgentDir(), MODELS_DEV_CACHE_FILENAME),
+    };
 }
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
-// Mirrors pi core's ModelOverrideSchema: core rejects the whole models.json on invalid values,
-// so anything dropped here would also have been flagged for built-in providers. Headers matter
-// most: pi resolves each header value as a config string, so non-strings break requests.
-const MODEL_OVERRIDE_VALIDATORS = {
-    name: (value) => typeof value === "string",
-    reasoning: (value) => typeof value === "boolean",
-    thinkingLevelMap: (value) => isPlainObject(value) && THINKING_LEVELS.every((level) => value[level] == null || typeof value[level] === "string"),
-    input: (value) => Array.isArray(value) && value.every((entry) => entry === "text" || entry === "image"),
-    contextWindow: (value) => typeof value === "number",
-    maxTokens: (value) => typeof value === "number",
-    headers: (value) => isPlainObject(value) && Object.values(value).every((entry) => typeof entry === "string"),
-    compat: isPlainObject,
-    cost: (value) => isPlainObject(value) && Object.values(value).every((entry) => typeof entry === "number"),
-};
-function sanitizeModelOverride(modelId, raw) {
-    if (!isPlainObject(raw)) {
-        process.stderr.write(`LiteLLM: ignoring model override for ${modelId} in models.json (not an object).\n`);
-        return undefined;
-    }
-    const override = {};
-    const dropped = [];
-    for (const [key, value] of Object.entries(raw)) {
-        const isValid = MODEL_OVERRIDE_VALIDATORS[key];
-        if (isValid?.(value))
-            override[key] = value;
-        else
-            dropped.push(key);
-    }
-    if (dropped.length > 0) {
-        process.stderr.write(`LiteLLM: ignoring invalid model override field(s) for ${modelId} in models.json: ${dropped.join(", ")}.\n`);
-    }
-    return override;
-}
-// Overrides are read per registered provider name, matching pi core's own
-// models.json layout (`providers.<name>.modelOverrides`) so aliases get the
-// same override support as the default provider, not a special case of it.
-async function readModelOverrides(providerName) {
-    let raw;
-    try {
-        raw = await readFile(join(getAgentDir(), "models.json"), "utf8");
-    }
-    catch {
-        return new Map();
-    }
-    try {
-        const config = JSON.parse(stripJsonComments(raw));
-        const overrides = new Map();
-        for (const [id, rawOverride] of Object.entries(config.providers?.[providerName]?.modelOverrides ?? {})) {
-            const override = sanitizeModelOverride(id, rawOverride);
-            if (override)
-                overrides.set(id, override);
-        }
-        return overrides;
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`LiteLLM: ignoring model overrides (failed to parse models.json: ${message}).\n`);
-        return new Map();
-    }
-}
-// Merge semantics must match pi core's applyModelOverride/mergeCompat (dist/core/model-registry.js)
-// so the same models.json entry behaves identically for litellm and built-in providers.
-function mergeCompat(base, override) {
-    if (!override)
-        return base;
-    const merged = { ...base, ...override };
-    for (const key of ["openRouterRouting", "vercelGatewayRouting", "chatTemplateKwargs"]) {
-        const baseValue = base?.[key];
-        const overrideValue = override[key];
-        if (baseValue || overrideValue) {
-            merged[key] = { ...baseValue, ...overrideValue };
-        }
-    }
-    return merged;
-}
-function applyModelOverride(model, override) {
-    const next = { ...model };
-    if (override.name !== undefined)
-        next.name = override.name;
-    if (override.reasoning !== undefined)
-        next.reasoning = override.reasoning;
-    if (override.thinkingLevelMap !== undefined) {
-        next.thinkingLevelMap = { ...model.thinkingLevelMap, ...override.thinkingLevelMap };
-    }
-    if (override.input !== undefined)
-        next.input = override.input;
-    if (override.contextWindow !== undefined)
-        next.contextWindow = override.contextWindow;
-    if (override.maxTokens !== undefined)
-        next.maxTokens = override.maxTokens;
-    if (override.headers !== undefined)
-        next.headers = override.headers;
-    if (override.compat !== undefined)
-        next.compat = mergeCompat(model.compat, override.compat);
-    if (override.cost !== undefined)
-        next.cost = { ...model.cost, ...override.cost };
-    return next;
-}
-function applyModelOverrides(models, overrides) {
-    if (overrides.size === 0)
-        return models;
-    return models.map((model) => {
-        const override = overrides.get(model.id);
-        return override ? applyModelOverride(model, override) : model;
-    });
-}
-// Re-reads models.json on every call so overrides edited mid-session take effect on the next
-// refresh or login, matching pi core's live reload for built-in providers.
-async function applyOverrides(providerName, models) {
-    return applyModelOverrides(models, await readModelOverrides(providerName));
-}
-async function readAuthEntry(providerName = PROVIDER_NAME) {
-    try {
-        const raw = await readFile(getAuthPath(), "utf8");
-        const parsed = JSON.parse(raw);
-        return parsed?.[providerName];
-    }
-    catch {
-        return undefined;
-    }
-}
 async function readGlobalLiteLLMSettings() {
     try {
         const raw = await readFile(join(getAgentDir(), "settings.json"), "utf8");
@@ -199,9 +63,50 @@ function normalizeCommand(raw) {
 function getApiKeyHelperCommand() {
     return normalizeCommand(process.env[ENV_API_KEY_HELPER]);
 }
-function executeApiKeyCommand(commandConfig) {
+function parseApiKeyCommand(commandConfig) {
     const command = commandConfig.startsWith("!") ? commandConfig.slice(1) : commandConfig;
-    const output = execSync(command, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10_000 }).trim();
+    if (/[\n\r;&|<>`$(){}*?~%^!]|\[|\]/.test(command))
+        throw new Error("LiteLLM API key helper shell syntax is not supported");
+    const parts = [];
+    let current = "";
+    let quote;
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        const next = command[index + 1];
+        if (character === "\\" && quote !== "'" && next && (next === "\\" || next === quote || /\s/.test(next))) {
+            current += next;
+            index += 1;
+        }
+        else if ((character === "'" || character === '"') && (!quote || quote === character)) {
+            quote = quote ? undefined : character;
+        }
+        else if (!quote && /\s/.test(character)) {
+            if (current) {
+                parts.push(current);
+                current = "";
+            }
+        }
+        else {
+            current += character;
+        }
+    }
+    if (quote)
+        throw new Error(`LiteLLM API key helper command has an unterminated quote: ${command}`);
+    if (current)
+        parts.push(current);
+    if (parts.length === 0)
+        throw new Error("LiteLLM API key helper command is empty");
+    if (/\.(?:cmd|bat)$/i.test(parts[0]))
+        throw new Error("LiteLLM API key helper shell scripts are not supported; use an executable");
+    return parts;
+}
+function executeApiKeyCommand(commandConfig) {
+    const [command, ...args] = parseApiKeyCommand(commandConfig);
+    const output = execFileSync(command, args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 10_000,
+    }).trim();
     if (!output)
         throw new Error(`LiteLLM API key helper produced no output: ${command}`);
     return output;
@@ -220,53 +125,29 @@ function tokenExpiresAt(apiKey, opaqueFallback = PERMANENT_TOKEN_EXPIRES_AT) {
         return opaqueFallback;
     }
 }
-function openInBrowser(url) {
-    // Never invoke a shell here: cmd.exe re-parses metacharacters before `start`
-    // runs, which would make URL contents injectable. Launch is best-effort; the
-    // URL is also shown to the user, so launcher failures must not crash the process.
-    const [cmd, args] = process.platform === "darwin"
-        ? ["open", [url]]
-        : process.platform === "win32"
-            ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
-            : ["xdg-open", [url]];
-    spawn(cmd, args, { stdio: "ignore", detached: true })
-        .on("error", () => undefined)
-        .unref();
-}
 async function generateVirtualKey(baseUrl, userToken, signal, headers) {
-    const { signal: boundedSignal, cancel } = withTimeout(LOGIN_TIMEOUT_MS, signal);
-    try {
-        const response = await fetch(`${baseUrl}/key/generate`, {
-            method: "POST",
-            headers: {
-                ...headers,
-                Authorization: `Bearer ${userToken}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({}),
-            signal: boundedSignal,
-        });
-        if (!response.ok) {
-            const text = await response.text().catch(() => "");
-            throw new Error(`Virtual key generation failed (${response.status}): ${text}`);
-        }
-        const data = (await response.json());
-        if (typeof data.key !== "string" || !data.key)
-            throw new Error("No key in response from /key/generate");
-        const expiresMs = typeof data.expires === "string" ? Date.parse(data.expires) : Number.NaN;
-        return { key: data.key, expiresAt: Number.isNaN(expiresMs) ? undefined : expiresMs };
-    }
-    finally {
-        cancel();
+    const boundedSignal = signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(LOGIN_TIMEOUT_MS)])
+        : AbortSignal.timeout(LOGIN_TIMEOUT_MS);
+    const response = await fetch(`${baseUrl}/key/generate`, {
+        method: "POST",
+        headers: {
+            ...headers,
+            Authorization: `Bearer ${userToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({}),
+        signal: boundedSignal,
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Virtual key generation failed (${response.status}): ${text}`);
     }
-}
-function getLiteLLMApiKey(credentials) {
-    return credentials.access;
-}
-function resolveOAuthApiKey(credentials) {
-    return credentials.refresh.startsWith("!")
-        ? executeApiKeyCommand(credentials.refresh)
-        : getLiteLLMApiKey(credentials);
+    const data = (await response.json());
+    if (typeof data.key !== "string" || !data.key)
+        throw new Error("No key in response from /key/generate");
+    const expiresMs = typeof data.expires === "string" ? Date.parse(data.expires) : Number.NaN;
+    return { key: data.key, expiresAt: Number.isNaN(expiresMs) ? undefined : expiresMs };
 }
 function resolveTemplateConfigValue(config) {
     let resolved = "";
@@ -310,6 +191,47 @@ function resolveTemplateConfigValue(config) {
     }
     return resolved;
 }
+async function resolveTemplateConfigValueFromContext(config, env) {
+    let resolved = "";
+    for (let index = 0; index < config.length;) {
+        const dollarIndex = config.indexOf("$", index);
+        if (dollarIndex === -1)
+            return resolved + config.slice(index);
+        resolved += config.slice(index, dollarIndex);
+        const nextChar = config[dollarIndex + 1];
+        if (nextChar === "$" || nextChar === "!") {
+            resolved += nextChar;
+            index = dollarIndex + 2;
+            continue;
+        }
+        if (nextChar === "{") {
+            const endIndex = config.indexOf("}", dollarIndex + 2);
+            if (endIndex === -1) {
+                resolved += "$";
+                index = dollarIndex + 1;
+                continue;
+            }
+            const envValue = await env(config.slice(dollarIndex + 2, endIndex));
+            if (envValue === undefined)
+                return undefined;
+            resolved += envValue;
+            index = endIndex + 1;
+            continue;
+        }
+        const match = config.slice(dollarIndex + 1).match(/^[A-Za-z_][A-Za-z0-9_]*/);
+        if (!match) {
+            resolved += "$";
+            index = dollarIndex + 1;
+            continue;
+        }
+        const envValue = await env(match[0]);
+        if (envValue === undefined)
+            return undefined;
+        resolved += envValue;
+        index = dollarIndex + 1 + match[0].length;
+    }
+    return resolved;
+}
 function resolveConfigValue(config, { executeCommands }) {
     if (config.startsWith("!"))
         return executeCommands ? executeApiKeyCommand(config) : undefined;
@@ -361,97 +283,56 @@ function resolveHeaders(definition) {
         return parseCustomHeaders(resolveTemplateConfigValue(definition.headers));
     return parseHeaderRecord(definition.headers);
 }
-// Headers can select a different tenant/customer at the same base URL with the
-// same key, so the cache must invalidate on header changes too, not just on
-// baseUrl/apiKey changes, or a stale tenant's models get reused silently.
-function computeHeadersFingerprint(headers) {
-    if (!headers)
-        return undefined;
-    const sorted = Object.keys(headers)
-        .sort()
-        .map((key) => [key, headers[key]]);
-    return fingerprint(JSON.stringify(sorted));
-}
-// Pi core resolves registered header values with the same $VAR/!command syntax
-// at request time, so already-resolved literals must be escaped or they get
-// resolved a second time ($UNSET would then fail every request).
-function escapeConfigValue(value) {
-    const escaped = value.replace(/\$/g, "$$$$");
-    return escaped.startsWith("!") ? `$${escaped}` : escaped;
-}
-function escapeHeaderConfig(headers) {
-    if (!headers)
-        return undefined;
-    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, escapeConfigValue(value)]));
+async function resolveHeadersFromContext(definition, env) {
+    if (typeof definition.headers === "string")
+        return parseCustomHeaders(await resolveTemplateConfigValueFromContext(definition.headers, env));
+    return parseHeaderRecord(definition.headers);
 }
 async function resolveCredentials(definition, { executeHelpers = true } = {}) {
-    const entry = definition.useSavedAuth ? await readAuthEntry(definition.name) : undefined;
     const configuredBase = cleanConfig(definition.baseUrl) ?? (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined);
     const envKey = definition.useDefaultEnv ? cleanConfig(process.env[ENV_API_KEY]) : undefined;
     const envHelperCommand = definition.useDefaultEnv ? getApiKeyHelperCommand() : undefined;
     const useGcloudToken = definition.useGcloudTokenAuth && isGcloudTokenAuthEnabled();
-    const authBase = entry?.type === "oauth" ? entry.baseUrl?.trim() : undefined;
-    const gcloudCacheKey = useGcloudToken && !entry ? ((await getGcloudTokenCacheKey()) ?? undefined) : undefined;
-    const authKey = entry?.type === "oauth"
-        ? (executeHelpers ? resolveOAuthApiKey(entry) : entry.access).trim()
-        : entry?.type === "api_key"
-            ? (await AuthStorage.create(getAuthPath()).getApiKey(definition.name, { includeFallback: false }))?.trim()
-            : undefined;
+    const gcloudCacheKey = useGcloudToken ? ((await getGcloudTokenCacheKey()) ?? undefined) : undefined;
     const gcloudKey = executeHelpers && gcloudCacheKey ? (await getGcloudToken())?.trim() : undefined;
     // Resolved lazily so a `!command` key is not executed when a
     // higher-precedence credential (saved auth, gcloud token) already won.
     let configuredKey;
-    if (!authKey && !gcloudKey && definition.apiKeyConfig) {
+    if (!gcloudKey && definition.apiKeyConfig) {
         configuredKey = resolveConfigValue(definition.apiKeyConfig, { executeCommands: executeHelpers });
         if (configuredKey === undefined && !definition.apiKeyConfig.startsWith("!")) {
             warnUnresolvedApiKeyConfig(definition.name, definition.apiKeyConfig);
         }
     }
-    const helperKey = !authKey && !gcloudKey && !configuredKey && executeHelpers && envHelperCommand
+    const helperKey = !gcloudKey && !configuredKey && executeHelpers && envHelperCommand
         ? executeApiKeyCommand(envHelperCommand)
         : undefined;
-    const apiKey = authKey || gcloudKey || configuredKey || helperKey || envKey;
-    let apiKeyFingerprint;
+    const apiKey = gcloudKey || configuredKey || helperKey || envKey;
     let apiKeyConfig;
-    if (entry?.type === "oauth" && entry.refresh.startsWith("!")) {
-        apiKeyFingerprint = fingerprint(entry.refresh);
-    }
-    else if (authKey) {
-        apiKeyFingerprint = fingerprint(authKey);
-    }
-    else if (gcloudKey) {
-        apiKeyFingerprint = fingerprint(gcloudCacheKey ?? gcloudKey);
+    if (gcloudKey) {
         apiKeyConfig = getGcloudTokenCommand();
     }
     else if (!executeHelpers && gcloudCacheKey) {
-        apiKeyFingerprint = fingerprint(gcloudCacheKey);
         apiKeyConfig = getGcloudTokenCommand();
     }
     else if (configuredKey && definition.apiKeyConfig) {
-        apiKeyFingerprint = fingerprint(definition.apiKeyConfig.startsWith("!") ? definition.apiKeyConfig : configuredKey);
         apiKeyConfig = definition.apiKeyConfig;
     }
     else if (!executeHelpers && definition.apiKeyConfig?.startsWith("!")) {
-        apiKeyFingerprint = fingerprint(definition.apiKeyConfig);
         apiKeyConfig = definition.apiKeyConfig;
     }
     else if (helperKey && envHelperCommand) {
-        apiKeyFingerprint = fingerprint(envHelperCommand);
         apiKeyConfig = envHelperCommand;
     }
     else if (!executeHelpers && envHelperCommand) {
-        apiKeyFingerprint = fingerprint(envHelperCommand);
         apiKeyConfig = envHelperCommand;
     }
     else if (envKey) {
-        apiKeyFingerprint = fingerprint(envKey);
         apiKeyConfig = `$${ENV_API_KEY}`;
     }
-    const rawBase = authBase || configuredBase;
     return {
-        baseUrl: rawBase ? normalizeBaseUrl(rawBase) : undefined,
+        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase) : undefined,
         apiKey: apiKey || undefined,
-        apiKeyFingerprint,
         apiKeyConfig,
     };
 }
@@ -467,8 +348,8 @@ function getDiscoveryTimeoutMs() {
 function isOffline() {
     return process.env[ENV_OFFLINE] === "1";
 }
-function isListModelsMode() {
-    return process.argv.includes("--list-models");
+function isVerboseDiscovery() {
+    return process.env[ENV_VERBOSE_DISCOVERY] === "1";
 }
 function normalizeProviderSettings(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
@@ -478,8 +359,11 @@ function normalizeProviderSettings(raw) {
         return undefined;
     return record;
 }
-async function getProviderDefinitions() {
-    const settings = await readGlobalLiteLLMSettings();
+function isFeatureEnabled(settings, feature) {
+    const raw = settings?.[feature];
+    return !isPlainObject(raw) || raw.enabled !== false;
+}
+function getProviderDefinitions(settings) {
     const rawProviders = settings?.providers && typeof settings.providers === "object" ? settings.providers : undefined;
     const providerSettings = rawProviders;
     const defaultSettings = normalizeProviderSettings(providerSettings?.[PROVIDER_NAME]);
@@ -491,128 +375,81 @@ async function getProviderDefinitions() {
         headers: raw?.headers ?? (isDefault ? `$${ENV_HEADERS}` : undefined),
         useDefaultEnv: isDefault,
         useGcloudTokenAuth: isDefault,
-        useSavedAuth: true,
         enableOAuth: isDefault,
     });
     const definitions = [makeDefinition(PROVIDER_NAME, defaultSettings, true)];
-    const usedCacheSegments = new Map();
     for (const [name, raw] of Object.entries(providerSettings ?? {})) {
         if (name === PROVIDER_NAME)
             continue;
         const normalized = normalizeProviderSettings(raw);
         if (!normalized)
             continue;
-        // Distinct alias names can sanitize to the same cache file; registering
-        // both would let their model caches silently clobber each other.
-        const segment = sanitizeCacheSegment(name);
-        const existing = usedCacheSegments.get(segment);
-        if (existing) {
-            process.stderr.write(`LiteLLM: provider alias "${name}" would share a cache file with "${existing}"; skipping it. Rename the alias.\n`);
-            continue;
-        }
-        usedCacheSegments.set(segment, name);
         definitions.push(makeDefinition(name, normalized, false));
     }
     return definitions;
 }
-async function discoverWithFallback(baseUrl, apiKey, options) {
-    try {
-        return { result: await discoverModels(baseUrl, apiKey, options) };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return {
-            result: { models: [], source: "models_list" },
-            warning: message,
-        };
-    }
-}
-async function loginLiteLLM(callbacks, options) {
-    const rawBaseUrl = (await callbacks.onPrompt({
+async function loginApiKey(interaction) {
+    const rawBaseUrl = (await interaction.prompt({
+        type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
         placeholder: "https://litellm.example.com",
     })).trim();
     if (!rawBaseUrl)
         throw new Error("Base URL is required");
-    const baseUrl = normalizeBaseUrl(rawBaseUrl);
-    const method = (await callbacks.onPrompt({
-        message: "Select login method (1 = API key / !command, 2 = SSO / Enterprise JWT):",
+    const key = (await interaction.prompt({ type: "secret", message: "Enter API key:" })).trim();
+    if (!key)
+        throw new Error("Both base URL and API key are required");
+    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl) } };
+}
+async function loginOAuth(interaction, headers) {
+    const rawBaseUrl = (await interaction.prompt({
+        type: "text",
+        message: "Enter LiteLLM proxy URL (no trailing /v1):",
+        placeholder: "https://litellm.example.com",
     })).trim();
-    let apiKey;
-    let refresh;
-    let expires;
-    if (method === "2") {
-        callbacks.onAuth?.({
-            url: `${baseUrl}/sso/key/generate`,
-            instructions: "Authenticate via SSO, then copy your token from the LiteLLM UI.",
-        });
-        const rawToken = (await callbacks.onPrompt({ message: "Paste your SSO token from the LiteLLM UI:" }))
-            .trim()
-            .replace(/^Bearer\s+/i, "")
-            .trim();
-        if (!rawToken)
-            throw new Error("SSO token is required");
-        const wantVirtualKey = (await callbacks.onPrompt({ message: "Generate a LiteLLM virtual key from this token? (y/n):" }))
-            .trim()
-            .toLowerCase();
-        if (wantVirtualKey !== "n" && wantVirtualKey !== "no") {
-            try {
-                callbacks.onProgress?.("Generating virtual key...");
-                const generated = await generateVirtualKey(baseUrl, rawToken, callbacks.signal, options.headers);
-                apiKey = generated.key;
-                refresh = "";
-                expires =
-                    generated.expiresAt === undefined
-                        ? PERMANENT_TOKEN_EXPIRES_AT
-                        : Math.max(Date.now(), generated.expiresAt - TOKEN_REFRESH_LEAD_MS);
-                callbacks.onProgress?.("Virtual key generated and will be used for API calls.");
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                callbacks.onProgress?.(`LiteLLM: virtual key generation failed (${message}); using SSO token directly.`);
-                apiKey = rawToken;
-                refresh = "";
-                expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
-            }
+    if (!rawBaseUrl)
+        throw new Error("Base URL is required");
+    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+    interaction.notify({
+        type: "auth_url",
+        url: `${baseUrl}/sso/key/generate`,
+        instructions: "Authenticate via SSO, then copy your token from the LiteLLM UI.",
+    });
+    const rawToken = (await interaction.prompt({ type: "secret", message: "Paste your SSO token from the LiteLLM UI:" }))
+        .trim()
+        .replace(/^Bearer\s+/i, "")
+        .trim();
+    if (!rawToken)
+        throw new Error("SSO token is required");
+    const wantVirtualKey = (await interaction.prompt({ type: "text", message: "Generate a LiteLLM virtual key from this token? (y/n):" }))
+        .trim()
+        .toLowerCase();
+    let access = rawToken;
+    let expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+    if (wantVirtualKey !== "n" && wantVirtualKey !== "no") {
+        try {
+            interaction.notify({ type: "progress", message: "Generating virtual key..." });
+            const generated = await generateVirtualKey(baseUrl, rawToken, interaction.signal, headers);
+            access = generated.key;
+            expires =
+                generated.expiresAt === undefined
+                    ? PERMANENT_TOKEN_EXPIRES_AT
+                    : Math.max(Date.now(), generated.expiresAt - TOKEN_REFRESH_LEAD_MS);
+            interaction.notify({ type: "progress", message: "Virtual key generated and will be used for API calls." });
         }
-        else {
-            apiKey = rawToken;
-            refresh = "";
-            expires = tokenExpiresAt(rawToken, PERMANENT_TOKEN_EXPIRES_AT);
+        catch (error) {
+            if (interaction.signal?.aborted)
+                throw interaction.signal.reason;
+            const message = error instanceof Error ? error.message : String(error);
+            interaction.notify({
+                type: "progress",
+                message: `LiteLLM: virtual key generation failed (${message}); using SSO token directly.`,
+            });
         }
     }
-    else {
-        const apiKeyInput = (await callbacks.onPrompt({ message: "Enter API key:" })).trim();
-        if (!apiKeyInput)
-            throw new Error("Both base URL and API key are required");
-        refresh = apiKeyInput.startsWith("!") ? apiKeyInput : "";
-        apiKey = refresh ? executeApiKeyCommand(refresh) : apiKeyInput;
-        expires = tokenExpiresAt(apiKey, refresh ? EXPIRE_TOKEN_IMMEDIATELY : PERMANENT_TOKEN_EXPIRES_AT);
-    }
-    const { models, source } = await discoverModels(baseUrl, apiKey, {
-        timeoutMs: LOGIN_TIMEOUT_MS,
-        signal: callbacks.signal,
-        headers: options.headers,
-    });
-    const cache = {
-        baseUrl,
-        apiKeyFingerprint: fingerprint(refresh || apiKey),
-        headersFingerprint: computeHeadersFingerprint(options.headers),
-        fetchedAt: Date.now(),
-        source,
-        models,
-    };
-    await writeCache(options.cachePath, cache);
-    await options.onCacheWrite?.(cache);
-    callbacks.onProgress?.(`LiteLLM: ${models.length} models discovered (source: ${source})`);
-    return {
-        access: apiKey,
-        refresh,
-        expires,
-        baseUrl,
-    };
+    return { type: "oauth", access, refresh: "", expires, baseUrl };
 }
-async function refreshLiteLLM(credentials) {
+async function refreshLiteLLM(credentials, _signal) {
     if (!credentials.refresh.startsWith("!")) {
         if (credentials.expires < PERMANENT_TOKEN_EXPIRES_AT) {
             throw new Error("LiteLLM credential cannot be refreshed; run /login litellm again");
@@ -622,11 +459,122 @@ async function refreshLiteLLM(credentials) {
     const access = executeApiKeyCommand(credentials.refresh);
     return { ...credentials, access, expires: tokenExpiresAt(access, EXPIRE_TOKEN_IMMEDIATELY) };
 }
-function modifyLiteLLMModels(models, cred) {
-    const baseUrl = cred.baseUrl;
-    if (!baseUrl)
-        return models;
-    return models.map((m) => (m.provider === PROVIDER_NAME ? { ...m, baseUrl: `${baseUrl}/v1` } : m));
+async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = true) {
+    const baseUrl = cleanConfig(credential?.env?.[ENV_BASE_URL]) ??
+        cleanConfig(definition.baseUrl) ??
+        (definition.useDefaultEnv ? cleanConfig(await ctx.env(ENV_BASE_URL)) : undefined);
+    const stored = credential?.key
+        ? resolveConfigValue(credential.key, { executeCommands: executeHelpers })?.trim()
+        : undefined;
+    let source;
+    let creds;
+    if (stored) {
+        source = "stored credential";
+        creds = {
+            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl) : undefined,
+            apiKey: stored,
+        };
+    }
+    else {
+        creds = await resolveCredentials({ ...definition, apiKeyConfig: undefined, useDefaultEnv: false }, { executeHelpers });
+        if (!creds.apiKey && definition.apiKeyConfig) {
+            const configured = definition.apiKeyConfig.startsWith("!")
+                ? executeHelpers
+                    ? executeApiKeyCommand(definition.apiKeyConfig)
+                    : undefined
+                : await resolveTemplateConfigValueFromContext(definition.apiKeyConfig, ctx.env);
+            if (configured) {
+                creds.apiKey = configured;
+                creds.apiKeyConfig = definition.apiKeyConfig;
+            }
+            else if (!definition.apiKeyConfig.startsWith("!")) {
+                warnUnresolvedApiKeyConfig(definition.name, definition.apiKeyConfig);
+            }
+        }
+        if (!creds.apiKey && definition.useDefaultEnv) {
+            const helper = normalizeCommand(await ctx.env(ENV_API_KEY_HELPER));
+            if (helper) {
+                creds.apiKey = executeHelpers ? executeApiKeyCommand(helper) : undefined;
+                creds.apiKeyConfig = helper;
+                source = ENV_API_KEY_HELPER;
+            }
+            else {
+                const envKey = cleanConfig(await ctx.env(ENV_API_KEY));
+                if (envKey) {
+                    creds.apiKey = envKey;
+                    creds.apiKeyConfig = ENV_API_KEY;
+                    source = ENV_API_KEY;
+                }
+            }
+        }
+        if (!creds.baseUrl && baseUrl)
+            creds.baseUrl = normalizeBaseUrl(baseUrl);
+    }
+    if (!creds.apiKey)
+        return undefined;
+    return {
+        auth: {
+            apiKey: creds.apiKey,
+            baseUrl: creds.baseUrl ? `${creds.baseUrl}/v1` : undefined,
+            headers: await resolveHeadersFromContext(definition, ctx.env),
+        },
+        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl) } : undefined,
+        source: source ?? creds.apiKeyConfig ?? ENV_API_KEY,
+    };
+}
+function createProviderAuth(definition) {
+    return {
+        apiKey: {
+            name: `${definition.displayName} API key`,
+            login: definition.name === PROVIDER_NAME ? loginApiKey : undefined,
+            check: async ({ ctx, credential }) => {
+                const baseUrl = credential?.env?.[ENV_BASE_URL] ??
+                    definition.baseUrl ??
+                    (definition.useDefaultEnv ? await ctx.env(ENV_BASE_URL) : undefined);
+                if (!cleanConfig(baseUrl))
+                    return undefined;
+                if (credential?.key)
+                    return { type: "api_key", source: "stored credential" };
+                const configured = await resolveCredentials({ ...definition, apiKeyConfig: undefined, useDefaultEnv: false }, { executeHelpers: false });
+                if (configured.apiKey || configured.apiKeyConfig)
+                    return {
+                        type: "api_key",
+                        source: definition.useGcloudTokenAuth && isGcloudTokenAuthEnabled()
+                            ? "gcloud ADC"
+                            : (configured.apiKeyConfig ?? ENV_API_KEY),
+                    };
+                if (definition.apiKeyConfig) {
+                    const configuredKey = definition.apiKeyConfig.startsWith("!")
+                        ? definition.apiKeyConfig
+                        : await resolveTemplateConfigValueFromContext(definition.apiKeyConfig, ctx.env);
+                    if (configuredKey)
+                        return { type: "api_key", source: definition.apiKeyConfig };
+                }
+                if (definition.useDefaultEnv && cleanConfig(await ctx.env(ENV_API_KEY_HELPER)))
+                    return { type: "api_key", source: ENV_API_KEY_HELPER };
+                return definition.useDefaultEnv && cleanConfig(await ctx.env(ENV_API_KEY))
+                    ? { type: "api_key", source: ENV_API_KEY }
+                    : undefined;
+            },
+            resolve: ({ ctx, credential }) => resolveApiKeyAuth(definition, ctx, credential),
+        },
+        oauth: definition.enableOAuth
+            ? {
+                name: "LiteLLM SSO",
+                loginLabel: "Sign in with LiteLLM SSO",
+                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition)),
+                refresh: async (credential, signal) => ({
+                    ...(await refreshLiteLLM(credential, signal)),
+                    type: "oauth",
+                }),
+                toAuth: async (credential) => ({
+                    apiKey: credential.access,
+                    baseUrl: credential.baseUrl ? `${normalizeBaseUrl(String(credential.baseUrl))}/v1` : undefined,
+                    headers: resolveHeaders(definition),
+                }),
+            }
+            : undefined,
+    };
 }
 function isReasoningItem(item) {
     return typeof item === "object" && item !== null && item.type === "reasoning";
@@ -750,7 +698,10 @@ function normalizeThinkTags(message, litellmProviderNames) {
     return { ...message, content };
 }
 export default async function (pi) {
-    const definitions = await getProviderDefinitions();
+    const settings = await readGlobalLiteLLMSettings();
+    const definitions = getProviderDefinitions(settings);
+    const skillsEnabled = isFeatureEnabled(settings, "skills");
+    const mcpEnabled = isFeatureEnabled(settings, "mcp");
     const providerNames = new Set(definitions.map((definition) => definition.name));
     function discoveryDisabledReason() {
         if (isOffline())
@@ -759,312 +710,173 @@ export default async function (pi) {
             return `${ENV_TIMEOUT}=0`;
         return null;
     }
-    async function loadProviderState(definition) {
-        let creds = await resolveCredentials(definition, { executeHelpers: false });
-        const headers = resolveHeaders(definition);
-        const headersFp = computeHeadersFingerprint(headers);
-        const cache = await readCache(getCachePath(definition.name));
-        let fp = creds.apiKeyFingerprint;
-        let cacheFetchedAt = cache?.fetchedAt ?? 0;
-        const cacheValid = cache !== null &&
-            creds.baseUrl !== undefined &&
-            fp !== undefined &&
-            cache.baseUrl === creds.baseUrl &&
-            cache.apiKeyFingerprint === fp &&
-            cache.headersFingerprint === headersFp;
-        let models = cacheValid && cache ? cache.models : [];
-        const shouldFetch = creds.baseUrl !== undefined &&
-            fp !== undefined &&
-            !isOffline() &&
-            getDiscoveryTimeoutMs() > 0 &&
-            (!cacheValid || isListModelsMode());
-        let credentialWarning;
-        let liveDiscoveryApiKey;
-        if (shouldFetch) {
-            try {
-                creds = await resolveCredentials(definition);
-                fp = creds.apiKeyFingerprint;
-            }
-            catch (error) {
-                // A broken alias must not abort activation for the other providers;
-                // only the default provider keeps the historical fail-fast behavior.
-                if ((!cacheValid || !cache) && definition.useDefaultEnv)
-                    throw error;
-                credentialWarning = error instanceof Error ? error.message : String(error);
-                if (cacheValid && cache) {
-                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${credentialWarning}); using cached models.\n`);
-                    models = cache.models;
-                }
-                else {
-                    process.stderr.write(`LiteLLM (${definition.name}): credential resolution failed (${credentialWarning}); registering provider with no models.\n`);
-                    models = [];
-                }
-            }
+    function requestBaseUrl(definition) {
+        const baseUrl = cleanConfig(definition.baseUrl) ??
+            (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined) ??
+            "https://litellm.example.com";
+        return `${normalizeBaseUrl(baseUrl)}/v1`;
+    }
+    async function authForCredential(definition, credential) {
+        if (credential.type === "oauth") {
+            const baseUrl = typeof credential.baseUrl === "string"
+                ? normalizeBaseUrl(credential.baseUrl)
+                : normalizeBaseUrl(requestBaseUrl(definition));
+            return { baseUrl, apiKey: credential.access, headers: resolveHeaders(definition) };
         }
-        if (shouldFetch && !credentialWarning && creds.baseUrl && creds.apiKey && fp) {
-            const timeoutMs = getDiscoveryTimeoutMs();
-            const { result, warning } = await discoverWithFallback(creds.baseUrl, creds.apiKey, {
-                timeoutMs,
-                headers,
-            });
-            if (warning) {
-                if (cacheValid && cache) {
-                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${warning}); using cached models.\n`);
-                    models = cache.models;
-                }
-                else {
-                    process.stderr.write(`LiteLLM (${definition.name}): discovery failed (${warning}); registering provider with no models.\n`);
-                    models = [];
-                }
-            }
-            else {
-                models = result.models;
-                liveDiscoveryApiKey = creds.apiKey;
-                const next = {
-                    baseUrl: creds.baseUrl,
-                    apiKeyFingerprint: fp,
-                    headersFingerprint: headersFp,
-                    fetchedAt: Date.now(),
-                    source: result.source,
-                    models: result.models,
-                };
-                await writeCache(getCachePath(definition.name), next);
-                cacheFetchedAt = next.fetchedAt;
-                if (isListModelsMode()) {
-                    process.stderr.write(`LiteLLM (${definition.name}): ${result.models.length} models discovered (source: ${result.source}).\n`);
-                }
-            }
+        const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential);
+        if (!resolved?.auth.apiKey) {
+            throw new Error(`no credentials for ${definition.name}. Run /login litellm or set env vars.`);
         }
-        // The cache keeps raw discovery output; overrides are applied freshly at each registration.
-        models = await applyOverrides(definition.name, models);
-        return { definition, creds, headers, models, cacheFetchedAt, liveDiscoveryApiKey, refreshInProgress: null };
-    }
-    const providerStates = await Promise.all(definitions.map(loadProviderState));
-    const defaultState = providerStates.find((state) => state.definition.name === PROVIDER_NAME) ?? providerStates[0];
-    let updateCosts = () => undefined;
-    const providerModelsForCosts = () => providerStates.map((state) => ({ provider: state.definition.name, models: state.models }));
-    const updateAllCosts = () => updateCosts(providerModelsForCosts());
-    function defaultApiKeyConfig(definition) {
-        if (definition.useDefaultEnv) {
-            return definition.apiKeyConfig ?? getApiKeyHelperCommand() ?? `$${ENV_API_KEY}`;
-        }
-        // An alias must never inherit the default provider's env key; leaving the
-        // key unset makes requests fail loudly instead of leaking credentials.
-        return definition.apiKeyConfig;
+        return {
+            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition)),
+            apiKey: resolved.auth.apiKey,
+            headers: resolved.auth.headers,
+        };
     }
-    function registerProvider(state, models = state.models, apiKeyConfig = state.creds.apiKeyConfig) {
-        const definition = state.definition;
-        pi.registerProvider(definition.name, {
-            name: definition.displayName,
-            baseUrl: state.creds.baseUrl ? `${state.creds.baseUrl}/v1` : "https://litellm.example.com/v1",
-            apiKey: apiKeyConfig ?? defaultApiKeyConfig(definition),
-            api: "openai-completions",
-            headers: escapeHeaderConfig(state.headers),
-            models,
-            oauth: definition.enableOAuth ? oauth : undefined,
+    let registeredMcpIdentity;
+    let mcpRegistration;
+    let defaultRuntimeAuth;
+    function mcpCatalogIdentity(auth) {
+        return JSON.stringify({
+            baseUrl: normalizeBaseUrl(auth.baseUrl),
+            apiKey: auth.apiKey,
+            headers: Object.entries(auth.headers ?? {}).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
         });
     }
-    function defaultLoginOptions() {
+    async function getRuntimeAuth(ctx) {
+        const auth = await ctx.modelRegistry.getProviderAuth(PROVIDER_NAME);
+        if (!auth)
+            return undefined;
+        const provider = ctx.modelRegistry.getProvider(PROVIDER_NAME);
+        const baseUrl = auth.auth.baseUrl ?? provider?.baseUrl;
+        const apiKey = auth.auth.apiKey;
+        if (!baseUrl || !apiKey)
+            return undefined;
+        const headers = Object.fromEntries(Object.entries(auth.auth.headers ?? provider?.headers ?? {}).filter((entry) => typeof entry[1] === "string"));
         return {
-            cachePath: getCachePath(PROVIDER_NAME),
-            headers: defaultState.headers,
-            onCacheWrite: async (next) => {
-                defaultState.cacheFetchedAt = next.fetchedAt;
-                const overridden = await applyOverrides(PROVIDER_NAME, next.models);
-                defaultState.models = overridden;
-                defaultState.creds = {
-                    ...defaultState.creds,
-                    baseUrl: next.baseUrl,
-                    apiKeyFingerprint: next.apiKeyFingerprint,
-                };
-                registerProvider(defaultState, overridden);
-                updateAllCosts();
-            },
+            baseUrl: normalizeBaseUrl(baseUrl),
+            apiKey,
+            headers: Object.keys(headers).length > 0 ? headers : undefined,
         };
     }
-    const oauth = {
-        name: "LiteLLM",
-        login: (callbacks) => loginLiteLLM(callbacks, defaultLoginOptions()),
-        refreshToken: refreshLiteLLM,
-        getApiKey: getLiteLLMApiKey,
-        modifyModels: modifyLiteLLMModels,
-    };
-    for (const state of providerStates)
-        registerProvider(state);
-    updateCosts = setupLiteLLMCostTracking(pi, providerModelsForCosts());
-    async function resolveRuntimeApiKey(state = defaultState) {
-        const fresh = await resolveCredentials(state.definition);
-        if (!fresh.apiKey)
-            throw new Error(`no credentials for ${state.definition.name}. Run /login litellm or set env vars.`);
-        return fresh.apiKey;
+    async function resolveDefaultRuntimeAuth(ctx) {
+        if (ctx?.modelRegistry) {
+            const auth = await getRuntimeAuth(ctx);
+            if (auth)
+                return auth;
+            throw new Error("no credentials for litellm. Run /login litellm or set env vars.");
+        }
+        if (!defaultRuntimeAuth)
+            throw new Error("no credentials for litellm. Run /login litellm or set env vars.");
+        return defaultRuntimeAuth;
+    }
+    function waitForMcpRegistration(registration, signal) {
+        if (!signal)
+            return registration.catch(() => undefined);
+        signal.throwIfAborted();
+        return new Promise((resolve, reject) => {
+            const onAbort = () => {
+                signal.removeEventListener("abort", onAbort);
+                reject(signal.reason);
+            };
+            const onComplete = () => {
+                signal.removeEventListener("abort", onAbort);
+                resolve();
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (signal.aborted)
+                onAbort();
+            else
+                registration.then(onComplete, onComplete);
+        });
     }
-    function registerSkillTools(state = defaultState) {
-        if (!state.creds.baseUrl)
+    async function registerMcpTools(auth, signal) {
+        if (!mcpEnabled || discoveryDisabledReason())
             return;
-        for (const tool of createSkillToolDefinitions(state.creds.baseUrl, () => resolveRuntimeApiKey(state), state.headers)) {
-            pi.registerTool(tool);
+        const identity = mcpCatalogIdentity(auth);
+        while (mcpRegistration) {
+            await waitForMcpRegistration(mcpRegistration, signal);
+            signal?.throwIfAborted();
+            if (registeredMcpIdentity === identity)
+                return;
         }
-    }
-    function seededRuntimeApiKey(state, seed) {
-        let first = seed;
-        return async () => {
-            if (first) {
-                const value = first;
-                first = undefined;
-                return value;
-            }
-            return resolveRuntimeApiKey(state);
-        };
-    }
-    async function registerMcpTools(state) {
-        if (!state.creds.baseUrl || !state.liveDiscoveryApiKey || discoveryDisabledReason())
+        if (registeredMcpIdentity === identity)
             return;
-        try {
-            const tools = await createMcpToolDefinitions(state.creds.baseUrl, seededRuntimeApiKey(state, state.liveDiscoveryApiKey), state.headers);
-            for (const tool of tools) {
-                pi.registerTool(tool);
+        const registration = (async () => {
+            try {
+                signal?.throwIfAborted();
+                const tools = await createMcpToolDefinitions((ctx) => (ctx?.modelRegistry ? resolveDefaultRuntimeAuth(ctx) : Promise.resolve(auth)), isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM MCP: ${message}\n`) : undefined, signal);
+                signal?.throwIfAborted();
+                for (const tool of tools)
+                    pi.registerTool(tool);
+                registeredMcpIdentity = identity;
             }
+            catch (error) {
+                if (signal?.aborted)
+                    throw signal.reason;
+                process.stderr.write(`LiteLLM (${PROVIDER_NAME}): MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
+            }
+        })();
+        mcpRegistration = registration;
+        try {
+            await registration;
         }
-        catch (error) {
-            process.stderr.write(`LiteLLM (${state.definition.name}): MCP tool discovery failed (${error instanceof Error ? error.message : String(error)}).\n`);
-        }
-    }
-    registerSkillTools(defaultState);
-    await registerMcpTools(defaultState);
-    async function refreshModelsAndCosts(state) {
-        const fresh = await resolveCredentials(state.definition);
-        const freshFp = fresh.apiKeyFingerprint;
-        if (!fresh.baseUrl || !fresh.apiKey || !freshFp) {
-            throw new Error(`no credentials for ${state.definition.name}. Run /login litellm or set env vars.`);
+        finally {
+            if (mcpRegistration === registration)
+                mcpRegistration = undefined;
         }
-        const result = await discoverModels(fresh.baseUrl, fresh.apiKey, {
-            timeoutMs: getDiscoveryTimeoutMs(),
-            headers: state.headers,
-        });
-        const now = Date.now();
-        await writeCache(getCachePath(state.definition.name), {
-            baseUrl: fresh.baseUrl,
-            apiKeyFingerprint: freshFp,
-            headersFingerprint: computeHeadersFingerprint(state.headers),
-            fetchedAt: now,
-            source: result.source,
-            models: result.models,
-        });
-        const overridden = await applyOverrides(state.definition.name, result.models);
-        state.creds = fresh;
-        state.models = overridden;
-        state.liveDiscoveryApiKey = fresh.apiKey;
-        state.cacheFetchedAt = now;
-        registerProvider(state, overridden, fresh.apiKeyConfig);
-        updateAllCosts();
-        if (state.definition.name === PROVIDER_NAME)
-            await registerMcpTools(state);
-        return { providerName: state.definition.name, models: overridden, source: result.source };
-    }
-    function runRefresh(state) {
-        state.refreshInProgress ??= refreshModelsAndCosts(state).finally(() => {
-            state.refreshInProgress = null;
-        });
-        return state.refreshInProgress;
     }
-    async function runLogin(ctx) {
-        const credential = await loginLiteLLM({
-            onAuth: ({ url, instructions }) => {
-                openInBrowser(url);
-                ctx.ui.notify(instructions ? `${url} — ${instructions}` : url, "info");
-            },
-            onDeviceCode: () => undefined,
-            onPrompt: async ({ message, placeholder }) => {
-                const value = await ctx.ui.input(message, placeholder);
-                if (value === undefined)
-                    throw new Error("Login cancelled");
-                return value;
+    for (const definition of definitions) {
+        const provider = createLiteLLMProvider({
+            id: definition.name,
+            name: definition.displayName,
+            baseUrl: requestBaseUrl(definition),
+            auth: createProviderAuth(definition),
+            discover: async (credential, signal) => {
+                const disabledReason = discoveryDisabledReason();
+                if (disabledReason)
+                    throw new Error(`discovery disabled (${disabledReason})`);
+                const auth = await authForCredential(definition, credential);
+                const result = await discoverModels(auth.baseUrl, auth.apiKey, {
+                    ...getModelsDevDiscoveryOptions(),
+                    timeoutMs: getDiscoveryTimeoutMs(),
+                    signal,
+                    headers: auth.headers,
+                    silent: !isVerboseDiscovery(),
+                    onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
+                });
+                signal?.throwIfAborted();
+                return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
             },
-            onProgress: (message) => ctx.ui.notify(message, "info"),
-            onSelect: async () => undefined,
-            signal: ctx.signal,
-        }, defaultLoginOptions());
-        ctx.modelRegistry.authStorage.set(PROVIDER_NAME, { type: "oauth", ...credential });
-        ctx.modelRegistry.refresh();
-        const credentialBaseUrl = credential.baseUrl;
-        const credentialAccess = typeof credential.access === "string" ? credential.access : undefined;
-        defaultState.creds = { ...defaultState.creds, baseUrl: credentialBaseUrl };
-        defaultState.liveDiscoveryApiKey = credentialAccess;
-        registerSkillTools(defaultState);
-        await registerMcpTools(defaultState);
-        ctx.ui.notify(`Logged in to LiteLLM. Credentials saved to ${getAuthPath()}`, "info");
-    }
-    pi.on("input", async (event, ctx) => {
-        if (event.text.trim() !== `/login ${PROVIDER_NAME}`)
-            return { action: "continue" };
-        if (!ctx.hasUI)
-            return { action: "continue" };
-        try {
-            await runLogin(ctx);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (message !== "Login cancelled")
-                ctx.ui.notify(`LiteLLM login failed: ${message}`, "error");
-        }
-        return { action: "handled" };
-    });
-    pi.registerCommand("litellm-refresh", {
-        description: "Re-discover models from the LiteLLM proxy.",
-        handler: async (args, ctx) => {
-            const disabledReason = discoveryDisabledReason();
-            if (disabledReason) {
-                ctx.ui.notify(`LiteLLM refresh disabled (${disabledReason})`, "warning");
-                return;
-            }
-            const requestedProvider = args.trim();
-            const statesToRefresh = requestedProvider
-                ? providerStates.filter((state) => state.definition.name === requestedProvider)
-                : providerStates;
-            if (statesToRefresh.length === 0) {
-                ctx.ui.notify(`LiteLLM refresh failed: unknown provider ${requestedProvider}`, "error");
-                return;
+        });
+        Object.assign(provider, { headers: resolveHeaders(definition) });
+        const refreshModels = provider.refreshModels;
+        provider.refreshModels = async (context) => {
+            try {
+                await refreshModels(context);
             }
-            const settled = await Promise.allSettled(statesToRefresh.map(runRefresh));
-            const succeeded = settled.filter((result) => result.status === "fulfilled").map((result) => result.value);
-            const failed = settled
-                .map((result, index) => ({ result, name: statesToRefresh[index].definition.name }))
-                .filter(({ result }) => result.status === "rejected")
-                .map(({ result, name }) => {
-                const reason = result.reason;
-                return { name, message: reason instanceof Error ? reason.message : String(reason) };
-            });
-            if (failed.length === 0) {
-                if (succeeded.length === 1) {
-                    const result = succeeded[0];
-                    ctx.ui.notify(`LiteLLM: ${result.models.length} models refreshed (source: ${result.source})`, "info");
-                    return;
+            finally {
+                if (definition.name === PROVIDER_NAME &&
+                    context.allowNetwork &&
+                    !discoveryDisabledReason() &&
+                    context.credential) {
+                    const auth = await authForCredential(definition, context.credential);
+                    defaultRuntimeAuth = auth;
+                    await registerMcpTools(auth, context.signal);
                 }
-                ctx.ui.notify(`LiteLLM: ${succeeded.length} providers refreshed (${succeeded
-                    .map((result) => `${result.providerName}: ${result.models.length} models`)
-                    .join(", ")})`, "info");
-                return;
-            }
-            const failures = failed.map(({ name, message }) => (settled.length === 1 ? message : `${name}: ${message}`));
-            if (succeeded.length === 0) {
-                ctx.ui.notify(`LiteLLM refresh failed: ${failures.join("; ")}`, "error");
-                return;
             }
-            ctx.ui.notify(`LiteLLM: refreshed ${succeeded
-                .map((result) => `${result.providerName}: ${result.models.length} models`)
-                .join(", ")}; failed ${failures.join("; ")}`, "warning");
-        },
-    });
+        };
+        pi.registerProvider(provider);
+    }
+    setupLiteLLMCostTracking(pi, [...providerNames]);
+    if (skillsEnabled) {
+        for (const tool of createSkillToolDefinitions(resolveDefaultRuntimeAuth)) {
+            pi.registerTool(tool);
+        }
+    }
     let sessionId;
     pi.on("session_start", (_event, ctx) => {
         sessionId = getSessionIdFromFile(ctx.sessionManager.getSessionFile());
-        if (discoveryDisabledReason())
-            return;
-        for (const state of providerStates) {
-            if (!state.cacheFetchedAt || Date.now() - state.cacheFetchedAt <= CACHE_STALE_MS)
-                continue;
-            void runRefresh(state).catch(() => undefined);
-        }
     });
     pi.on("before_provider_request", (event, ctx) => {
         if (!ctx.model?.provider || !providerNames.has(ctx.model.provider))
@@ -1073,13 +885,15 @@ export default async function (pi) {
             return;
         return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, ctx.model?.api, sessionId);
     });
-    pi.on("before_agent_start", async (event) => {
-        if (discoveryDisabledReason())
+    pi.on("before_agent_start", async (event, ctx) => {
+        defaultRuntimeAuth = undefined;
+        if (!skillsEnabled || discoveryDisabledReason())
             return;
-        const fresh = await resolveCredentials(defaultState.definition);
-        if (!fresh.baseUrl || !fresh.apiKey)
+        const auth = await getRuntimeAuth(ctx);
+        if (!auth)
             return;
-        const skills = await listSkills(fresh.baseUrl, fresh.apiKey, defaultState.headers);
+        defaultRuntimeAuth = auth;
+        const skills = await listSkills(defaultRuntimeAuth.baseUrl, defaultRuntimeAuth.apiKey, defaultRuntimeAuth.headers);
         const section = createSkillsPromptSection(skills);
         if (!section)
             return;