pi-provider-litellm 2.0.6 → 2.2.0

package/README.md

@@ -46,17 +46,17 @@ You'll be prompted for the base URL and API key. Credentials are persisted to `~
 
 #### Enterprise SSO login
 
-If your LiteLLM proxy requires SSO/OAuth authentication (enterprise deployments), you can authenticate via a browser SSO flow and optionally pair the resulting JWT with a stable virtual key:
+If your LiteLLM proxy requires SSO/OAuth authentication (enterprise deployments), you can authenticate through LiteLLM's CLI SSO flow:
 
 1. Run `/login litellm` inside pi and select `Sign in with LiteLLM SSO`
 2. Enter the proxy URL
-3. Your default browser opens the LiteLLM SSO login URL (e.g. `https://litellm.your-domain.com/sso/key/generate`) automatically — the URL is also displayed in case it can't be opened. Authenticate via SSO
-4. Copy your token from the LiteLLM UI and paste it at the prompt (copying a full `Bearer ...` header value is fine — the prefix is stripped automatically)
-5. When prompted to generate a virtual key, press Enter to accept (recommended) or enter `n` to use the JWT directly
+3. Pi displays a verification code and opens the LiteLLM SSO login URL automatically
+4. Authenticate in the browser and confirm the displayed code
+5. If your account belongs to multiple teams, select the team for this session in Pi
 
-When you generate a virtual key, the resulting `sk-...` key is stored as your credential and used for all API requests. If the proxy's key policy attaches an expiry to the generated key, Pi will prompt you to re-authenticate when it nears expiry; otherwise the key is treated as permanent until revoked in LiteLLM.
+Pi polls the proxy until authentication completes and stores the returned short-lived CLI token. Newer proxies advertise the token lifetime; for older proxies, Pi uses `LITELLM_CLI_JWT_EXPIRATION_HOURS` or LiteLLM's 24-hour default. On LiteLLM versions that gate CLI SSO, start the proxy with `EXPERIMENTAL_UI_LOGIN=True`.
 
-When using a JWT directly, the extension reads its `exp` claim and Pi will prompt you to re-authenticate when the token nears expiry. Run `/login litellm` again to refresh.
+Older proxies without `/sso/cli/start` fall back to the legacy browser flow: copy the token from the LiteLLM UI, paste it into Pi, and optionally exchange it for a virtual key. Pi reads JWT expiry claims and prompts you to run `/login litellm` again when re-authentication is required.
 
 ### Option B — environment variables
 
@@ -155,15 +155,13 @@ Treat the configured LiteLLM proxy as trusted: Skills can add instructions to th
 | `GOOGLE_APPLICATION_CREDENTIALS` | Google default ADC path | Optional path to an ADC JSON file used by `LITELLM_GCLOUD_TOKEN_AUTH`. If unset, the extension checks the default gcloud ADC locations. |
 | `LITELLM_OFFLINE` | unset | If `1`, disable all model and MCP discovery, including post-login discovery; use cached models only |
 | `LITELLM_DISCOVERY_TIMEOUT_MS` | `5000` | Background and explicit discovery fetch timeout in ms; `0` disables automatic discovery |
+| `LITELLM_CLI_JWT_EXPIRATION_HOURS` | `24` | CLI SSO token lifetime fallback for older proxies whose poll response omits `expires_in`; mirror a non-default proxy setting locally |
 | `LITELLM_VERBOSE_DISCOVERY` | unset | If `1`, enable progress messages during model and MCP discovery (login, refresh, startup); discovery is silent by default |
-| `LITELLM_MODELS_DEV` | enabled | Set to `0` to disable models.dev metadata enrichment, including its cache and network request; `/v1/models` still uses Pi catalog metadata and defaults |
 
 Only use a trusted `LITELLM_API_KEY_HELPER` or `!command`. Prefer an absolute executable path, keep secrets out of command arguments, and print only the token to stdout without logging it to stderr.
 
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` disables automatic and explicit refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
-Models.dev metadata is cached in `litellm-models-dev.json` under the Pi agent directory for 28 days. Fresh data avoids the public request; stale data is used immediately while one background refresh updates the cache. Set `LITELLM_MODELS_DEV=0` when your LiteLLM metadata is authoritative and no external enrichment is wanted.
-
 ### Google ADC token auth
 
 When your LiteLLM proxy accepts Google OAuth access tokens, you can let the extension refresh tokens from Application Default Credentials:
@@ -242,6 +240,8 @@ Opening `/model` refreshes configured provider catalogs in the background using
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
 | `401 Token expired` | Set `LITELLM_API_KEY_HELPER`. |
 | No models with gcloud auth | Verify `gcloud auth application-default login` has been run or set `GOOGLE_APPLICATION_CREDENTIALS` to an `authorized_user` ADC file |
+| Enterprise SSO waits for token insertion | The proxy returned 404/405 for `/sso/cli/start`, so Pi used the legacy flow — upgrade LiteLLM or paste the UI token |
+| Enterprise CLI SSO start/poll fails | Check the proxy logs and verify `/sso/cli/start` and `/sso/cli/poll/{login_id}` are reachable; only 404/405 falls back to legacy login |
 | Enterprise SSO login shows "virtual key generation failed" | The LiteLLM instance may lack a database (`/key/generate` requires one), your user account may lack key-generation permission, or the request timed out; the JWT is used directly as a fallback |
 | Enterprise SSO token prompt fails with "SSO token is required" | The token field was left empty — paste the token copied from the LiteLLM UI |
 | MCP tools not showing | Verify the proxy exposes `/mcp-rest/tools/list` and open `/model` after fixing the proxy |

package/dist/discover.js

@@ -1,15 +1,9 @@
-import { readFile } from "node:fs/promises";
 import { isIP } from "node:net";
 import { getModels, getProviders } from "@earendil-works/pi-ai/compat";
-import { writeJsonAtomic } from "./cache.js";
 const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const KNOWN_PROVIDER_SET = new Set(getProviders());
-const MODELS_DEV_URL = "https://models.dev/api.json";
-const MODELS_DEV_CACHE_TTL_MS = 28 * 24 * 60 * 60 * 1000;
-const modelsDevCaches = new Map();
-const modelsDevRefreshes = new Map();
 export function normalizeBaseUrl(input) {
     const url = new URL(input);
     const hostname = url.hostname.toLowerCase();
@@ -150,42 +144,6 @@ function mapModelInfoCost(info, fallback) {
         ...(fallback?.tiers ? { tiers: fallback.tiers } : {}),
     };
 }
-function getFallbackProviderAndModel(id, ownedBy) {
-    const [prefix, ...rest] = id.split("/");
-    const prefixProvider = toKnownProvider(prefix);
-    if (prefixProvider && rest.length > 0) {
-        return { provider: prefixProvider, modelId: rest.join("/") };
-    }
-    return { provider: toKnownProvider(ownedBy), modelId: id };
-}
-function findModelsDevModel(catalog, id, ownedBy) {
-    const { provider, modelId } = getFallbackProviderAndModel(id, ownedBy);
-    if (!provider)
-        return undefined;
-    const models = catalog?.[provider]?.models;
-    return models && Object.hasOwn(models, modelId) ? models[modelId] : undefined;
-}
-function awaitWithSignal(promise, signal) {
-    if (!signal)
-        return promise;
-    if (signal.aborted)
-        return Promise.reject(signal.reason);
-    return new Promise((resolve, reject) => {
-        const cleanup = () => signal.removeEventListener("abort", onAbort);
-        const onAbort = () => {
-            cleanup();
-            reject(signal.reason);
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-        promise.then((value) => {
-            cleanup();
-            resolve(value);
-        }, (error) => {
-            cleanup();
-            reject(error);
-        });
-    });
-}
 async function fetchJson(url, apiKey, options) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const response = await fetch(url, {
@@ -199,169 +157,6 @@ async function fetchJson(url, apiKey, options) {
     const data = (await response.json());
     return { ok: true, data };
 }
-async function fetchPublicJson(url, options) {
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const response = await fetch(url, {
-        headers: { Accept: "application/json" },
-        signal: options.signal
-            ? AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)])
-            : AbortSignal.timeout(timeoutMs),
-    });
-    if (!response.ok)
-        throw new Error(`${url} returned ${response.status}`);
-    return (await response.json());
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function finiteNumber(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
-}
-function normalizeModelsDevCatalog(value) {
-    if (!isRecord(value))
-        return undefined;
-    const catalog = {};
-    for (const [providerId, providerValue] of Object.entries(value)) {
-        if (!isRecord(providerValue) || !isRecord(providerValue.models))
-            continue;
-        const models = {};
-        for (const [modelId, modelValue] of Object.entries(providerValue.models)) {
-            if (!isRecord(modelValue))
-                continue;
-            const model = {};
-            if (typeof modelValue.name === "string")
-                model.name = modelValue.name;
-            if (typeof modelValue.reasoning === "boolean")
-                model.reasoning = modelValue.reasoning;
-            if (isRecord(modelValue.modalities) && Array.isArray(modelValue.modalities.input)) {
-                const input = modelValue.modalities.input.filter((entry) => typeof entry === "string");
-                if (input.length > 0)
-                    model.modalities = { input };
-            }
-            if (isRecord(modelValue.limit)) {
-                const limit = {};
-                const context = finiteNumber(modelValue.limit.context);
-                const input = finiteNumber(modelValue.limit.input);
-                const output = finiteNumber(modelValue.limit.output);
-                if (context !== undefined)
-                    limit.context = context;
-                if (input !== undefined)
-                    limit.input = input;
-                if (output !== undefined)
-                    limit.output = output;
-                if (Object.keys(limit).length > 0)
-                    model.limit = limit;
-            }
-            if (isRecord(modelValue.cost)) {
-                const cost = {};
-                const input = finiteNumber(modelValue.cost.input);
-                const output = finiteNumber(modelValue.cost.output);
-                const cacheRead = finiteNumber(modelValue.cost.cache_read);
-                const cacheWrite = finiteNumber(modelValue.cost.cache_write);
-                if (input !== undefined)
-                    cost.input = input;
-                if (output !== undefined)
-                    cost.output = output;
-                if (cacheRead !== undefined)
-                    cost.cache_read = cacheRead;
-                if (cacheWrite !== undefined)
-                    cost.cache_write = cacheWrite;
-                if (Object.keys(cost).length > 0)
-                    model.cost = cost;
-            }
-            models[modelId] = model;
-        }
-        catalog[providerId] = { models };
-    }
-    return catalog;
-}
-async function readModelsDevCache(path) {
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        if (!isRecord(parsed) ||
-            typeof parsed.fetchedAt !== "number" ||
-            !Number.isFinite(parsed.fetchedAt) ||
-            parsed.fetchedAt < 0 ||
-            parsed.fetchedAt > Date.now()) {
-            return undefined;
-        }
-        const catalog = normalizeModelsDevCatalog(parsed.catalog);
-        return catalog ? { fetchedAt: parsed.fetchedAt, catalog } : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function refreshModelsDevCatalog(key, options) {
-    const active = modelsDevRefreshes.get(key);
-    if (active)
-        return active;
-    const refresh = (async () => {
-        try {
-            const catalog = normalizeModelsDevCatalog(await fetchPublicJson(MODELS_DEV_URL, options));
-            if (!catalog)
-                return undefined;
-            const cache = { fetchedAt: Date.now(), catalog };
-            modelsDevCaches.set(key, cache);
-            if (options.modelsDevCachePath) {
-                await writeJsonAtomic(options.modelsDevCachePath, cache).catch(() => undefined);
-            }
-            return catalog;
-        }
-        catch {
-            return undefined;
-        }
-        finally {
-            modelsDevRefreshes.delete(key);
-        }
-    })();
-    modelsDevRefreshes.set(key, refresh);
-    return refresh;
-}
-async function getModelsDevCatalog(options) {
-    const key = options.modelsDevCachePath ?? MODELS_DEV_URL;
-    const refreshOptions = { ...options, timeoutMs: DEFAULT_TIMEOUT_MS, signal: undefined };
-    let cache = modelsDevCaches.get(key);
-    if (!cache && options.modelsDevCachePath) {
-        cache = await readModelsDevCache(options.modelsDevCachePath);
-        if (cache)
-            modelsDevCaches.set(key, cache);
-    }
-    if (!cache) {
-        const timeout = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-        return awaitWithSignal(refreshModelsDevCatalog(key, refreshOptions), options.signal ? AbortSignal.any([options.signal, timeout]) : timeout);
-    }
-    if (Date.now() - cache.fetchedAt < MODELS_DEV_CACHE_TTL_MS)
-        return cache.catalog;
-    void refreshModelsDevCatalog(key, refreshOptions);
-    return cache.catalog;
-}
-function mapModelsDevMetadata(model) {
-    if (!model)
-        return {};
-    const metadata = {};
-    if (model.name)
-        metadata.name = model.name;
-    if (model.reasoning !== undefined)
-        metadata.reasoning = model.reasoning;
-    if (model.modalities?.input) {
-        metadata.input = model.modalities.input.includes("image") ? ["text", "image"] : ["text"];
-    }
-    const contextWindow = model.limit?.context ?? model.limit?.input;
-    if (contextWindow !== undefined)
-        metadata.contextWindow = contextWindow;
-    if (model.limit?.output !== undefined)
-        metadata.maxTokens = model.limit.output;
-    if (model.cost) {
-        metadata.cost = {
-            input: model.cost.input ?? 0,
-            output: model.cost.output ?? 0,
-            cacheRead: model.cost.cache_read ?? 0,
-            cacheWrite: model.cost.cache_write ?? 0,
-        };
-    }
-    return metadata;
-}
 function mapReasoningEfforts(info) {
     const flags = [
         ["off", "none", info.supports_none_reasoning_effort],
@@ -428,21 +223,20 @@ function mapFromHealthEndpoint(entry) {
         compat: buildCompat(id),
     };
 }
-function mapFromModelsList(entry, modelsDev) {
+function mapFromModelsList(entry) {
     const id = entry.id;
     if (!id)
         return undefined;
     const catalogModel = findCatalogModel(id, entry.owned_by);
-    const modelsDevMetadata = mapModelsDevMetadata(findModelsDevModel(modelsDev, id, entry.owned_by));
     return {
         id,
-        name: modelsDevMetadata.name ?? catalogModel?.name ?? `${id} (no metadata)`,
-        reasoning: modelsDevMetadata.reasoning ?? catalogModel?.reasoning ?? false,
+        name: catalogModel?.name ?? `${id} (no metadata)`,
+        reasoning: catalogModel?.reasoning ?? false,
         thinkingLevelMap: catalogModel?.thinkingLevelMap,
-        input: modelsDevMetadata.input ?? catalogModel?.input ?? ["text"],
-        cost: modelsDevMetadata.cost ?? catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: modelsDevMetadata.contextWindow ?? catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
-        maxTokens: modelsDevMetadata.maxTokens ?? catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
+        input: catalogModel?.input ?? ["text"],
+        cost: catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
     };
 }
@@ -507,15 +301,10 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
         // Ref: docs.litellm.ai/docs/proxy/model_discovery
         if (models.some((m) => m.id.includes("*"))) {
             progress?.("/model/info has wildcard entries, expanding via /v1/models...");
-            let modelsDev;
-            if (options.modelsDev !== false) {
-                progress?.("Loading models.dev catalog for metadata enrichment...");
-                modelsDev = await getModelsDevCatalog(options);
-            }
             const listResult = await fetchJson(`${base}/v1/models`, apiKey, options);
             if (listResult.ok) {
                 const expanded = (listResult.data.data ?? [])
-                    .map((entry) => mapFromModelsList(entry, modelsDev))
+                    .map(mapFromModelsList)
                     .filter((m) => m !== undefined && !m.id.includes("*"));
                 const seen = new Set(models.map((m) => m.id));
                 models = [...models.filter((m) => !m.id.includes("*")), ...expanded.filter((m) => !seen.has(m.id))];
@@ -537,13 +326,8 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
         }
         throw new Error(`/v1/models returned ${listResult.status}`);
     }
-    let modelsDev;
-    if (options.modelsDev !== false) {
-        progress?.("Loading models.dev catalog for metadata enrichment...");
-        modelsDev = await getModelsDevCatalog(options);
-    }
     const models = (listResult.data.data ?? [])
-        .map((entry) => mapFromModelsList(entry, modelsDev))
+        .map(mapFromModelsList)
         .filter((m) => m !== undefined);
     return { source: "models_list", models: deduplicateModels(models) };
 }

package/dist/index.js

@@ -1,13 +1,14 @@
 import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { setTimeout as delay } from "node:timers/promises";
+import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { setupLiteLLMCostTracking } from "./cost.js";
 import { discoverModels, isGpt55Model, isMoonshotModel, normalizeBaseUrl, shouldSuppressReasoningContent, } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
-import { createLiteLLMProvider } from "./provider.js";
+import { createLiteLLMProvider, toNativeModels } from "./provider.js";
 import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
 const SETTINGS_KEY = "litellm";
@@ -16,21 +17,18 @@ const ENV_API_KEY = "LITELLM_API_KEY";
 const ENV_API_KEY_HELPER = "LITELLM_API_KEY_HELPER";
 const ENV_HEADERS = "LITELLM_HEADERS";
 const ENV_TIMEOUT = "LITELLM_DISCOVERY_TIMEOUT_MS";
+const ENV_CLI_JWT_EXPIRATION_HOURS = "LITELLM_CLI_JWT_EXPIRATION_HOURS";
 const ENV_OFFLINE = "LITELLM_OFFLINE";
 const ENV_VERBOSE_DISCOVERY = "LITELLM_VERBOSE_DISCOVERY";
-const ENV_MODELS_DEV = "LITELLM_MODELS_DEV";
 const DEFAULT_TIMEOUT_MS = 5000;
+const SEED_TIMEOUT_MS = 3000;
 const LOGIN_TIMEOUT_MS = 10_000;
-const MODELS_DEV_CACHE_FILENAME = "litellm-models-dev.json";
+const CLI_SSO_POLL_INTERVAL_MS = 2_000;
+const CLI_SSO_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_CLI_JWT_EXPIRATION_HOURS = 24;
 const TOKEN_REFRESH_LEAD_MS = 5 * 60 * 1000;
 const PERMANENT_TOKEN_EXPIRES_AT = Number.MAX_SAFE_INTEGER;
 const EXPIRE_TOKEN_IMMEDIATELY = 0;
-function getModelsDevDiscoveryOptions() {
-    return {
-        modelsDev: process.env[ENV_MODELS_DEV] !== "0",
-        modelsDevCachePath: join(getAgentDir(), MODELS_DEV_CACHE_FILENAME),
-    };
-}
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -125,10 +123,17 @@ function tokenExpiresAt(apiKey, opaqueFallback = PERMANENT_TOKEN_EXPIRES_AT) {
         return opaqueFallback;
     }
 }
-async function generateVirtualKey(baseUrl, userToken, signal, headers) {
-    const boundedSignal = signal
+function configuredCliJwtExpiresAt() {
+    const configured = Number(process.env[ENV_CLI_JWT_EXPIRATION_HOURS]);
+    const hours = Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_CLI_JWT_EXPIRATION_HOURS;
+    return Date.now() + hours * 60 * 60 * 1_000;
+}
+function boundedLoginSignal(signal) {
+    return signal
         ? AbortSignal.any([signal, AbortSignal.timeout(LOGIN_TIMEOUT_MS)])
         : AbortSignal.timeout(LOGIN_TIMEOUT_MS);
+}
+async function generateVirtualKey(baseUrl, userToken, signal, headers) {
     const response = await fetch(`${baseUrl}/key/generate`, {
         method: "POST",
         headers: {
@@ -137,7 +142,7 @@ async function generateVirtualKey(baseUrl, userToken, signal, headers) {
             "Content-Type": "application/json",
         },
         body: JSON.stringify({}),
-        signal: boundedSignal,
+        signal: boundedLoginSignal(signal),
     });
     if (!response.ok) {
         throw new Error(`Virtual key generation failed (${response.status})`);
@@ -347,6 +352,19 @@ function getDiscoveryTimeoutMs() {
 function isOffline() {
     return process.env[ENV_OFFLINE] === "1";
 }
+/** Pi disables all model network access when PI_OFFLINE is set; activation must honour it too. */
+function isHostOffline() {
+    return process.env.PI_OFFLINE !== undefined;
+}
+/**
+ * Absolute budget for activation-time discovery. Pi cannot paint its UI until every extension has
+ * activated, so this is deliberately capped rather than following LITELLM_DISCOVERY_TIMEOUT_MS,
+ * which is a per-request timeout that deployments raise to tens of seconds. Missing the budget only
+ * costs the startup seed; Pi's own refresh and /model still populate the catalog.
+ */
+function getSeedTimeoutMs() {
+    return Math.min(getDiscoveryTimeoutMs(), SEED_TIMEOUT_MS);
+}
 function isVerboseDiscovery() {
     return process.env[ENV_VERBOSE_DISCOVERY] === "1";
 }
@@ -400,15 +418,108 @@ async function loginApiKey(interaction) {
         throw new Error("Both base URL and API key are required");
     return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl) } };
 }
-async function loginOAuth(interaction, headers) {
-    const rawBaseUrl = (await interaction.prompt({
-        type: "text",
-        message: "Enter LiteLLM proxy URL (no trailing /v1):",
-        placeholder: "https://litellm.example.com",
-    })).trim();
-    if (!rawBaseUrl)
-        throw new Error("Base URL is required");
-    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+async function startCliSso(baseUrl, signal, headers) {
+    const response = await fetch(`${baseUrl}/sso/cli/start`, {
+        method: "POST",
+        headers,
+        signal: boundedLoginSignal(signal),
+    });
+    if (response.status === 404 || response.status === 405)
+        return undefined;
+    if (!response.ok)
+        throw new Error(`LiteLLM CLI SSO start failed (HTTP ${response.status})`);
+    const data = (await response.json());
+    if (typeof data.login_id !== "string" ||
+        !data.login_id ||
+        typeof data.poll_secret !== "string" ||
+        !data.poll_secret ||
+        typeof data.user_code !== "string" ||
+        !data.user_code) {
+        throw new Error("LiteLLM CLI SSO start returned an invalid response");
+    }
+    return {
+        loginId: data.login_id,
+        pollSecret: data.poll_secret,
+        userCode: data.user_code,
+        expiresInSeconds: typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in > 0
+            ? data.expires_in
+            : CLI_SSO_EXPIRES_IN_SECONDS,
+    };
+}
+async function waitForNextCliSsoPoll(interaction) {
+    try {
+        await delay(CLI_SSO_POLL_INTERVAL_MS, undefined, interaction.signal ? { signal: interaction.signal } : undefined);
+    }
+    catch (error) {
+        if (interaction.signal?.aborted)
+            throw interaction.signal.reason;
+        throw error;
+    }
+}
+async function pollCliSso(baseUrl, start, interaction, headers) {
+    const deadline = Date.now() + start.expiresInSeconds * 1_000;
+    const pollUrl = new URL(`${baseUrl}/sso/cli/poll/${encodeURIComponent(start.loginId)}`);
+    let teamId;
+    while (Date.now() < deadline) {
+        if (teamId)
+            pollUrl.searchParams.set("team_id", teamId);
+        let response;
+        try {
+            response = await fetch(pollUrl, {
+                headers: { ...headers, "x-litellm-cli-poll-secret": start.pollSecret },
+                signal: boundedLoginSignal(interaction.signal),
+            });
+        }
+        catch {
+            if (interaction.signal?.aborted)
+                throw interaction.signal.reason;
+            await waitForNextCliSsoPoll(interaction);
+            continue;
+        }
+        if (response.status === 429 || response.status >= 500) {
+            await waitForNextCliSsoPoll(interaction);
+            continue;
+        }
+        if (response.status === 400)
+            throw new Error("LiteLLM CLI SSO login expired or is invalid");
+        if (!response.ok)
+            throw new Error(`LiteLLM CLI SSO polling failed (HTTP ${response.status})`);
+        const data = (await response.json());
+        if (data.status === "ready" && typeof data.key === "string" && data.key) {
+            return {
+                access: data.key,
+                expiresInSeconds: typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in > 0
+                    ? data.expires_in
+                    : undefined,
+            };
+        }
+        if (data.status === "ready" && data.requires_team_selection === true && !teamId) {
+            const details = Array.isArray(data.team_details) ? data.team_details : [];
+            const teams = details.flatMap((team) => {
+                if (!team || typeof team !== "object")
+                    return [];
+                const record = team;
+                const id = typeof record.team_id === "string" ? record.team_id : record.id;
+                const alias = record.team_alias;
+                return typeof id === "string" && id ? [{ id, label: typeof alias === "string" && alias ? alias : id }] : [];
+            });
+            if (teams.length === 0 && Array.isArray(data.teams))
+                teams.push(...data.teams.flatMap((id) => (typeof id === "string" && id ? [{ id, label: id }] : [])));
+            if (teams.length === 0)
+                throw new Error("LiteLLM CLI SSO requested team selection without any teams");
+            const selected = await interaction.prompt({ type: "select", message: "Select a LiteLLM team:", options: teams });
+            if (!teams.some((team) => team.id === selected))
+                throw new Error("Invalid LiteLLM team selection");
+            teamId = selected;
+            continue;
+        }
+        if (data.status !== "pending")
+            throw new Error("LiteLLM CLI SSO polling returned an invalid response");
+        await waitForNextCliSsoPoll(interaction);
+    }
+    throw new Error("LiteLLM CLI SSO login expired");
+}
+async function loginWithPastedToken(interaction, baseUrl, headers) {
     interaction.notify({
         type: "auth_url",
         url: `${baseUrl}/sso/key/generate`,
@@ -448,6 +559,35 @@ async function loginOAuth(interaction, headers) {
     }
     return { type: "oauth", access, refresh: "", expires, baseUrl };
 }
+async function loginOAuth(interaction, headers) {
+    const rawBaseUrl = (await interaction.prompt({
+        type: "text",
+        message: "Enter LiteLLM proxy URL (no trailing /v1):",
+        placeholder: "https://litellm.example.com",
+    })).trim();
+    if (!rawBaseUrl)
+        throw new Error("Base URL is required");
+    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+    const cliSso = await startCliSso(baseUrl, interaction.signal, headers);
+    if (!cliSso)
+        return loginWithPastedToken(interaction, baseUrl, headers);
+    interaction.notify({
+        type: "device_code",
+        userCode: cliSso.userCode,
+        verificationUri: `${baseUrl}/sso/key/generate?${new URLSearchParams({ source: "litellm-cli", key: cliSso.loginId })}`,
+        expiresInSeconds: cliSso.expiresInSeconds,
+    });
+    const result = await pollCliSso(baseUrl, cliSso, interaction, headers);
+    return {
+        type: "oauth",
+        access: result.access,
+        refresh: "",
+        expires: result.expiresInSeconds
+            ? Date.now() + result.expiresInSeconds * 1_000
+            : tokenExpiresAt(result.access, configuredCliJwtExpiresAt()),
+        baseUrl,
+    };
+}
 async function refreshLiteLLM(credentials, _signal) {
     if (!credentials.refresh.startsWith("!")) {
         if (credentials.expires < PERMANENT_TOKEN_EXPIRES_AT) {
@@ -801,14 +941,14 @@ export default async function (pi) {
             "https://litellm.example.com";
         return `${normalizeBaseUrl(baseUrl)}/v1`;
     }
-    async function authForCredential(definition, credential) {
-        if (credential.type === "oauth") {
+    async function authForCredential(definition, credential, executeHelpers = true) {
+        if (credential?.type === "oauth") {
             const baseUrl = typeof credential.baseUrl === "string"
                 ? normalizeBaseUrl(credential.baseUrl)
                 : normalizeBaseUrl(requestBaseUrl(definition));
             return { baseUrl, apiKey: credential.access, headers: resolveHeaders(definition) };
         }
-        const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential);
+        const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential, executeHelpers);
         if (!resolved?.auth.apiKey) {
             throw new Error(`no credentials for ${definition.name}. Run /login litellm or set env vars.`);
         }
@@ -911,27 +1051,52 @@ export default async function (pi) {
                 mcpRegistration = undefined;
         }
     }
-    for (const definition of definitions) {
+    async function runDiscovery(auth, signal) {
+        const result = await discoverModels(auth.baseUrl, auth.apiKey, {
+            timeoutMs: getDiscoveryTimeoutMs(),
+            signal,
+            headers: auth.headers,
+            silent: !isVerboseDiscovery(),
+            onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
+        });
+        signal?.throwIfAborted();
+        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
+    }
+    // Pi's startup path only ever refreshes with allowNetwork:false, and it returns before the
+    // network phase, so the provider would stay empty until the user opens /model. Discover here
+    // instead, the way 1.x did, and hand the catalog over as the provider's baseline models.
+    async function seedModels(definition) {
+        if (discoveryDisabledReason() || isHostOffline())
+            return [];
+        try {
+            const stored = readStoredCredential(definition.name, join(getAgentDir(), "auth.json"));
+            // executeHelpers:false — activation must never run the user's key helper as a side effect,
+            // so helper-backed setups keep waiting for Pi's own refresh.
+            const auth = await authForCredential(definition, stored, false);
+            const result = await runDiscovery(auth, AbortSignal.timeout(getSeedTimeoutMs()));
+            return toNativeModels(definition.name, result.baseUrl, result.models);
+        }
+        catch (error) {
+            // No credentials yet is the normal unconfigured case; anything else is worth one line.
+            if (isVerboseDiscovery()) {
+                process.stderr.write(`LiteLLM (${definition.name}): startup discovery skipped (${error instanceof Error ? error.message : String(error)}).\n`);
+            }
+            return [];
+        }
+    }
+    const seeded = await Promise.all(definitions.map(seedModels));
+    for (const [index, definition] of definitions.entries()) {
         const provider = createLiteLLMProvider({
             id: definition.name,
             name: definition.displayName,
             baseUrl: requestBaseUrl(definition),
             auth: createProviderAuth(definition),
+            models: seeded[index],
             discover: async (credential, signal) => {
                 const disabledReason = discoveryDisabledReason();
                 if (disabledReason)
                     throw new Error(`discovery disabled (${disabledReason})`);
-                const auth = await authForCredential(definition, credential);
-                const result = await discoverModels(auth.baseUrl, auth.apiKey, {
-                    ...getModelsDevDiscoveryOptions(),
-                    timeoutMs: getDiscoveryTimeoutMs(),
-                    signal,
-                    headers: auth.headers,
-                    silent: !isVerboseDiscovery(),
-                    onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
-                });
-                signal?.throwIfAborted();
-                return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
+                return runDiscovery(await authForCredential(definition, credential), signal);
             },
         });
         Object.assign(provider, { headers: resolveHeaders(definition) });
@@ -970,16 +1135,27 @@ export default async function (pi) {
             return;
         return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, ctx.model?.api, sessionId);
     });
+    // Skills enrichment is best-effort: an expired credential or an unreachable proxy must not
+    // report an extension error on every turn. The failing model request states the real problem.
     pi.on("before_agent_start", async (event, ctx) => {
         defaultRuntimeAuth = undefined;
         if (!skillsEnabled || discoveryDisabledReason())
             return;
-        const auth = await getRuntimeAuth(ctx);
-        if (!auth)
+        let section;
+        try {
+            const auth = await getRuntimeAuth(ctx);
+            if (!auth)
+                return;
+            defaultRuntimeAuth = auth;
+            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+            section = createSkillsPromptSection(skills);
+        }
+        catch (error) {
+            if (isVerboseDiscovery()) {
+                process.stderr.write(`LiteLLM: skipping Skills (${error instanceof Error ? error.message : String(error)}).\n`);
+            }
             return;
-        defaultRuntimeAuth = auth;
-        const skills = await listSkills(defaultRuntimeAuth.baseUrl, defaultRuntimeAuth.apiKey, defaultRuntimeAuth.headers);
-        const section = createSkillsPromptSection(skills);
+        }
         if (!section)
             return;
         return { systemPrompt: `${event.systemPrompt}\n\n${section}` };

package/dist/provider.d.ts

@@ -5,6 +5,9 @@ export type LiteLLMProviderOptions = {
     name: string;
     baseUrl: string;
     auth: ProviderAuth;
+    /** Catalog discovered during activation. Pi's startup refresh never allows network access, so
+     * without a seed the provider stays empty until the user opens /model. */
+    models?: readonly Model<LiteLLMApi>[];
     discover(credential: Credential, signal?: AbortSignal): Promise<DiscoveryResult & {
         baseUrl?: string;
     }>;

package/dist/provider.js

@@ -15,7 +15,7 @@ export function createLiteLLMProvider(options) {
         name: options.name,
         baseUrl: options.baseUrl,
         auth: options.auth,
-        models: [],
+        models: options.models ?? [],
         async fetchModels(context) {
             if (!context.credential)
                 throw new Error("LiteLLM model discovery requires a credential");

package/dist/types.d.ts

@@ -17,8 +17,6 @@ export interface DiscoveryOptions {
     timeoutMs?: number;
     signal?: AbortSignal;
     headers?: Record<string, string>;
-    modelsDev?: boolean;
-    modelsDevCachePath?: string;
 }
 export interface ModelInfoEntry {
     model_name?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "2.0.6",
+  "version": "2.2.0",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",

package/dist/cache.d.ts

@@ -1 +0,0 @@
-export declare function writeJsonAtomic(path: string, value: unknown): Promise<void>;

package/dist/cache.js

@@ -1,8 +0,0 @@
-import { mkdir, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-export async function writeJsonAtomic(path, value) {
-    await mkdir(dirname(path), { recursive: true });
-    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
-    await rename(tmp, path);
-}