pi-provider-litellm 2.0.5 → 2.0.6

package/README.md

@@ -137,6 +137,8 @@ LiteLLM Skills and MCP integration are enabled by default. Disable either featur
 
 Setting `skills.enabled` to `false` disables the Skills Gateway management tools, skill fetching, and system-prompt injection. Setting `mcp.enabled` to `false` disables LiteLLM MCP discovery and tool registration. Restart Pi after changing these settings so previously registered tools are removed.
 
+Treat the configured LiteLLM proxy as trusted: Skills can add instructions to the system prompt, and MCP can expose tools the agent may call. Disable these integrations when the proxy, its administrators, or its configured content are not fully trusted.
+
 ## Use
 
 ```
@@ -156,6 +158,8 @@ Setting `skills.enabled` to `false` disables the Skills Gateway management tools
 | `LITELLM_VERBOSE_DISCOVERY` | unset | If `1`, enable progress messages during model and MCP discovery (login, refresh, startup); discovery is silent by default |
 | `LITELLM_MODELS_DEV` | enabled | Set to `0` to disable models.dev metadata enrichment, including its cache and network request; `/v1/models` still uses Pi catalog metadata and defaults |
 
+Only use a trusted `LITELLM_API_KEY_HELPER` or `!command`. Prefer an absolute executable path, keep secrets out of command arguments, and print only the token to stdout without logging it to stderr.
+
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` disables automatic and explicit refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
 Models.dev metadata is cached in `litellm-models-dev.json` under the Pi agent directory for 28 days. Fresh data avoids the public request; stale data is used immediately while one background refresh updates the cache. Set `LITELLM_MODELS_DEV=0` when your LiteLLM metadata is authoritative and no external enrichment is wanted.

package/dist/discover.js

@@ -1,4 +1,5 @@
 import { readFile } from "node:fs/promises";
+import { isIP } from "node:net";
 import { getModels, getProviders } from "@earendil-works/pi-ai/compat";
 import { writeJsonAtomic } from "./cache.js";
 const DEFAULT_TIMEOUT_MS = 5000;
@@ -10,6 +11,12 @@ const MODELS_DEV_CACHE_TTL_MS = 28 * 24 * 60 * 60 * 1000;
 const modelsDevCaches = new Map();
 const modelsDevRefreshes = new Map();
 export function normalizeBaseUrl(input) {
+    const url = new URL(input);
+    const hostname = url.hostname.toLowerCase();
+    const loopback = hostname === "localhost" || hostname === "[::1]" || (isIP(hostname) === 4 && hostname.startsWith("127."));
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error("LiteLLM base URL must use HTTPS except for loopback hosts");
+    }
     return input.replace(/\/+$/, "").replace(/\/v1\/?$/i, "");
 }
 const RESPONSES_MODE_PATTERN = /^responses?$/i;
@@ -355,6 +362,21 @@ function mapModelsDevMetadata(model) {
     }
     return metadata;
 }
+function mapReasoningEfforts(info) {
+    const flags = [
+        ["off", "none", info.supports_none_reasoning_effort],
+        ["minimal", "minimal", info.supports_minimal_reasoning_effort],
+        ["low", "low", info.supports_low_reasoning_effort],
+        ["medium", "medium", info.supports_medium_reasoning_effort],
+        ["high", "high", info.supports_high_reasoning_effort],
+        ["xhigh", "xhigh", info.supports_xhigh_reasoning_effort],
+        ["max", "max", info.supports_max_reasoning_effort],
+    ];
+    const map = Object.fromEntries(flags
+        .filter(([, , supported]) => supported !== undefined)
+        .map(([level, value, supported]) => [level, supported ? value : null]));
+    return Object.keys(map).length > 0 ? map : undefined;
+}
 function mapFromModelInfo(entry) {
     const id = entry.model_name;
     if (!id)
@@ -364,11 +386,15 @@ function mapFromModelInfo(entry) {
         return undefined;
     const responsesMode = isResponsesMode(info.mode);
     const catalogModel = findCatalogModel(id);
+    const reasoningEffortMap = mapReasoningEfforts(info);
+    const thinkingLevelMap = catalogModel?.thinkingLevelMap || reasoningEffortMap
+        ? { ...catalogModel?.thinkingLevelMap, ...reasoningEffortMap }
+        : undefined;
     return {
         id,
         name: id,
         reasoning: info.supports_reasoning ?? false,
-        ...(catalogModel?.thinkingLevelMap ? { thinkingLevelMap: catalogModel.thinkingLevelMap } : {}),
+        ...(thinkingLevelMap ? { thinkingLevelMap } : {}),
         input: info.supports_vision ? ["text", "image"] : ["text"],
         cost: mapModelInfoCost(info, catalogModel?.cost),
         contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,

package/dist/gcloud-token.js

@@ -85,7 +85,7 @@ async function exchangeRefreshToken(credentials) {
             signal: AbortSignal.timeout(10_000),
         });
         if (!response.ok) {
-            console.warn(`LiteLLM gcloud auth: Token exchange failed (${response.status}): ${await response.text()}`);
+            console.warn(`LiteLLM gcloud auth: Token exchange failed (${response.status})`);
             return null;
         }
         const data = (await response.json());

package/dist/index.js

@@ -140,8 +140,7 @@ async function generateVirtualKey(baseUrl, userToken, signal, headers) {
         signal: boundedSignal,
     });
     if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        throw new Error(`Virtual key generation failed (${response.status}): ${text}`);
+        throw new Error(`Virtual key generation failed (${response.status})`);
     }
     const data = (await response.json());
     if (typeof data.key !== "string" || !data.key)
@@ -948,11 +947,7 @@ export default async function (pi) {
                     context.credential) {
                     const auth = await authForCredential(definition, context.credential);
                     defaultRuntimeAuth = auth;
-                    const registration = registerMcpTools(auth, context.signal);
-                    if (context.signal)
-                        await registration;
-                    else
-                        void registration.catch(() => undefined);
+                    void registerMcpTools(auth, context.signal).catch(() => undefined);
                 }
             }
         };

package/dist/provider.js

@@ -34,14 +34,7 @@ export function createLiteLLMProvider(options) {
         ...provider,
         refreshModels: (context) => refreshModels({
             ...context,
-            store: {
-                async read() {
-                    const entry = await context.store.read();
-                    return entry && { ...entry, models: entry.models.map(enrichCachedModel) };
-                },
-                write: (entry) => context.store.write(entry),
-                delete: () => context.store.delete(),
-            },
+            stored: context.stored && { ...context.stored, models: context.stored.models.map(enrichCachedModel) },
         }),
     };
 }

package/dist/types.d.ts

@@ -31,6 +31,13 @@ export interface ModelInfoEntry {
         max_input_tokens?: number;
         max_output_tokens?: number;
         supports_reasoning?: boolean;
+        supports_none_reasoning_effort?: boolean;
+        supports_minimal_reasoning_effort?: boolean;
+        supports_low_reasoning_effort?: boolean;
+        supports_medium_reasoning_effort?: boolean;
+        supports_high_reasoning_effort?: boolean;
+        supports_xhigh_reasoning_effort?: boolean;
+        supports_max_reasoning_effort?: boolean;
         supports_vision?: boolean;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -68,13 +68,14 @@
   },
   "overrides": {
     "basic-ftp": "6.0.1",
+    "nanoid": "3.3.18",
     "protobufjs": "8.7.1",
     "undici": "8.9.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.15",
-    "@earendil-works/pi-ai": "^0.83.0",
-    "@earendil-works/pi-coding-agent": "^0.83.0",
+    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
     "@kitlangton/terminal-control": "0.6.0",
     "@types/node": "^26.0.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",