pi-provider-litellm 2.1.0 → 2.2.1

package/README.md

@@ -115,6 +115,7 @@ Provider fields:
 | `headers` | `$LITELLM_HEADERS` for `litellm`; unset for aliases | JSON string env reference or inline object of request headers |
 | `displayName` | provider name | Label shown in Pi UI |
 | `enabled` | `true` | Set `false` to skip an alias |
+| `allowInsecureHttp` | `false` | Set `true` to permit plaintext HTTP for this provider, for example `http://host.docker.internal`. Credentials and request data will not be encrypted. Loopback HTTP works without this setting. |
 
 `/login litellm` and Google ADC token auth remain scoped to the default `litellm` provider. Aliases use their configured `apiKey` or manually stored auth entries matching the alias name.
 
@@ -157,14 +158,11 @@ Treat the configured LiteLLM proxy as trusted: Skills can add instructions to th
 | `LITELLM_DISCOVERY_TIMEOUT_MS` | `5000` | Background and explicit discovery fetch timeout in ms; `0` disables automatic discovery |
 | `LITELLM_CLI_JWT_EXPIRATION_HOURS` | `24` | CLI SSO token lifetime fallback for older proxies whose poll response omits `expires_in`; mirror a non-default proxy setting locally |
 | `LITELLM_VERBOSE_DISCOVERY` | unset | If `1`, enable progress messages during model and MCP discovery (login, refresh, startup); discovery is silent by default |
-| `LITELLM_MODELS_DEV` | enabled | Set to `0` to disable models.dev metadata enrichment, including its cache and network request; `/v1/models` still uses Pi catalog metadata and defaults |
 
 Only use a trusted `LITELLM_API_KEY_HELPER` or `!command`. Prefer an absolute executable path, keep secrets out of command arguments, and print only the token to stdout without logging it to stderr.
 
 `LITELLM_DISCOVERY_TIMEOUT_MS=0` disables automatic and explicit refresh model discovery. It does not replace the base URL or API key settings required to send requests when you are not using `/login litellm`.
 
-Models.dev metadata is cached in `litellm-models-dev.json` under the Pi agent directory for 28 days. Fresh data avoids the public request; stale data is used immediately while one background refresh updates the cache. Set `LITELLM_MODELS_DEV=0` when your LiteLLM metadata is authoritative and no external enrichment is wanted.
-
 ### Google ADC token auth
 
 When your LiteLLM proxy accepts Google OAuth access tokens, you can let the extension refresh tokens from Application Default Credentials:

package/dist/discover.d.ts

@@ -1,6 +1,6 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { DiscoveredModel, DiscoveryOptions, DiscoveryResult } from "./types.js";
-export declare function normalizeBaseUrl(input: string): string;
+export declare function normalizeBaseUrl(input: string, allowInsecureHttp?: boolean): string;
 export declare function isMoonshotModel(modelId: string): boolean;
 export declare function isGpt55Model(modelId: string): boolean;
 export declare function shouldSuppressReasoningContent(modelId: string): boolean;

package/dist/discover.js

@@ -1,20 +1,14 @@
-import { readFile } from "node:fs/promises";
 import { isIP } from "node:net";
 import { getModels, getProviders } from "@earendil-works/pi-ai/compat";
-import { writeJsonAtomic } from "./cache.js";
 const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const KNOWN_PROVIDER_SET = new Set(getProviders());
-const MODELS_DEV_URL = "https://models.dev/api.json";
-const MODELS_DEV_CACHE_TTL_MS = 28 * 24 * 60 * 60 * 1000;
-const modelsDevCaches = new Map();
-const modelsDevRefreshes = new Map();
-export function normalizeBaseUrl(input) {
+export function normalizeBaseUrl(input, allowInsecureHttp = false) {
     const url = new URL(input);
     const hostname = url.hostname.toLowerCase();
     const loopback = hostname === "localhost" || hostname === "[::1]" || (isIP(hostname) === 4 && hostname.startsWith("127."));
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
         throw new Error("LiteLLM base URL must use HTTPS except for loopback hosts");
     }
     return input.replace(/\/+$/, "").replace(/\/v1\/?$/i, "");
@@ -150,42 +144,6 @@ function mapModelInfoCost(info, fallback) {
         ...(fallback?.tiers ? { tiers: fallback.tiers } : {}),
     };
 }
-function getFallbackProviderAndModel(id, ownedBy) {
-    const [prefix, ...rest] = id.split("/");
-    const prefixProvider = toKnownProvider(prefix);
-    if (prefixProvider && rest.length > 0) {
-        return { provider: prefixProvider, modelId: rest.join("/") };
-    }
-    return { provider: toKnownProvider(ownedBy), modelId: id };
-}
-function findModelsDevModel(catalog, id, ownedBy) {
-    const { provider, modelId } = getFallbackProviderAndModel(id, ownedBy);
-    if (!provider)
-        return undefined;
-    const models = catalog?.[provider]?.models;
-    return models && Object.hasOwn(models, modelId) ? models[modelId] : undefined;
-}
-function awaitWithSignal(promise, signal) {
-    if (!signal)
-        return promise;
-    if (signal.aborted)
-        return Promise.reject(signal.reason);
-    return new Promise((resolve, reject) => {
-        const cleanup = () => signal.removeEventListener("abort", onAbort);
-        const onAbort = () => {
-            cleanup();
-            reject(signal.reason);
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-        promise.then((value) => {
-            cleanup();
-            resolve(value);
-        }, (error) => {
-            cleanup();
-            reject(error);
-        });
-    });
-}
 async function fetchJson(url, apiKey, options) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const response = await fetch(url, {
@@ -199,169 +157,6 @@ async function fetchJson(url, apiKey, options) {
     const data = (await response.json());
     return { ok: true, data };
 }
-async function fetchPublicJson(url, options) {
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const response = await fetch(url, {
-        headers: { Accept: "application/json" },
-        signal: options.signal
-            ? AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)])
-            : AbortSignal.timeout(timeoutMs),
-    });
-    if (!response.ok)
-        throw new Error(`${url} returned ${response.status}`);
-    return (await response.json());
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function finiteNumber(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
-}
-function normalizeModelsDevCatalog(value) {
-    if (!isRecord(value))
-        return undefined;
-    const catalog = {};
-    for (const [providerId, providerValue] of Object.entries(value)) {
-        if (!isRecord(providerValue) || !isRecord(providerValue.models))
-            continue;
-        const models = {};
-        for (const [modelId, modelValue] of Object.entries(providerValue.models)) {
-            if (!isRecord(modelValue))
-                continue;
-            const model = {};
-            if (typeof modelValue.name === "string")
-                model.name = modelValue.name;
-            if (typeof modelValue.reasoning === "boolean")
-                model.reasoning = modelValue.reasoning;
-            if (isRecord(modelValue.modalities) && Array.isArray(modelValue.modalities.input)) {
-                const input = modelValue.modalities.input.filter((entry) => typeof entry === "string");
-                if (input.length > 0)
-                    model.modalities = { input };
-            }
-            if (isRecord(modelValue.limit)) {
-                const limit = {};
-                const context = finiteNumber(modelValue.limit.context);
-                const input = finiteNumber(modelValue.limit.input);
-                const output = finiteNumber(modelValue.limit.output);
-                if (context !== undefined)
-                    limit.context = context;
-                if (input !== undefined)
-                    limit.input = input;
-                if (output !== undefined)
-                    limit.output = output;
-                if (Object.keys(limit).length > 0)
-                    model.limit = limit;
-            }
-            if (isRecord(modelValue.cost)) {
-                const cost = {};
-                const input = finiteNumber(modelValue.cost.input);
-                const output = finiteNumber(modelValue.cost.output);
-                const cacheRead = finiteNumber(modelValue.cost.cache_read);
-                const cacheWrite = finiteNumber(modelValue.cost.cache_write);
-                if (input !== undefined)
-                    cost.input = input;
-                if (output !== undefined)
-                    cost.output = output;
-                if (cacheRead !== undefined)
-                    cost.cache_read = cacheRead;
-                if (cacheWrite !== undefined)
-                    cost.cache_write = cacheWrite;
-                if (Object.keys(cost).length > 0)
-                    model.cost = cost;
-            }
-            models[modelId] = model;
-        }
-        catalog[providerId] = { models };
-    }
-    return catalog;
-}
-async function readModelsDevCache(path) {
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        if (!isRecord(parsed) ||
-            typeof parsed.fetchedAt !== "number" ||
-            !Number.isFinite(parsed.fetchedAt) ||
-            parsed.fetchedAt < 0 ||
-            parsed.fetchedAt > Date.now()) {
-            return undefined;
-        }
-        const catalog = normalizeModelsDevCatalog(parsed.catalog);
-        return catalog ? { fetchedAt: parsed.fetchedAt, catalog } : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function refreshModelsDevCatalog(key, options) {
-    const active = modelsDevRefreshes.get(key);
-    if (active)
-        return active;
-    const refresh = (async () => {
-        try {
-            const catalog = normalizeModelsDevCatalog(await fetchPublicJson(MODELS_DEV_URL, options));
-            if (!catalog)
-                return undefined;
-            const cache = { fetchedAt: Date.now(), catalog };
-            modelsDevCaches.set(key, cache);
-            if (options.modelsDevCachePath) {
-                await writeJsonAtomic(options.modelsDevCachePath, cache).catch(() => undefined);
-            }
-            return catalog;
-        }
-        catch {
-            return undefined;
-        }
-        finally {
-            modelsDevRefreshes.delete(key);
-        }
-    })();
-    modelsDevRefreshes.set(key, refresh);
-    return refresh;
-}
-async function getModelsDevCatalog(options) {
-    const key = options.modelsDevCachePath ?? MODELS_DEV_URL;
-    const refreshOptions = { ...options, timeoutMs: DEFAULT_TIMEOUT_MS, signal: undefined };
-    let cache = modelsDevCaches.get(key);
-    if (!cache && options.modelsDevCachePath) {
-        cache = await readModelsDevCache(options.modelsDevCachePath);
-        if (cache)
-            modelsDevCaches.set(key, cache);
-    }
-    if (!cache) {
-        const timeout = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-        return awaitWithSignal(refreshModelsDevCatalog(key, refreshOptions), options.signal ? AbortSignal.any([options.signal, timeout]) : timeout);
-    }
-    if (Date.now() - cache.fetchedAt < MODELS_DEV_CACHE_TTL_MS)
-        return cache.catalog;
-    void refreshModelsDevCatalog(key, refreshOptions);
-    return cache.catalog;
-}
-function mapModelsDevMetadata(model) {
-    if (!model)
-        return {};
-    const metadata = {};
-    if (model.name)
-        metadata.name = model.name;
-    if (model.reasoning !== undefined)
-        metadata.reasoning = model.reasoning;
-    if (model.modalities?.input) {
-        metadata.input = model.modalities.input.includes("image") ? ["text", "image"] : ["text"];
-    }
-    const contextWindow = model.limit?.context ?? model.limit?.input;
-    if (contextWindow !== undefined)
-        metadata.contextWindow = contextWindow;
-    if (model.limit?.output !== undefined)
-        metadata.maxTokens = model.limit.output;
-    if (model.cost) {
-        metadata.cost = {
-            input: model.cost.input ?? 0,
-            output: model.cost.output ?? 0,
-            cacheRead: model.cost.cache_read ?? 0,
-            cacheWrite: model.cost.cache_write ?? 0,
-        };
-    }
-    return metadata;
-}
 function mapReasoningEfforts(info) {
     const flags = [
         ["off", "none", info.supports_none_reasoning_effort],
@@ -428,21 +223,20 @@ function mapFromHealthEndpoint(entry) {
         compat: buildCompat(id),
     };
 }
-function mapFromModelsList(entry, modelsDev) {
+function mapFromModelsList(entry) {
     const id = entry.id;
     if (!id)
         return undefined;
     const catalogModel = findCatalogModel(id, entry.owned_by);
-    const modelsDevMetadata = mapModelsDevMetadata(findModelsDevModel(modelsDev, id, entry.owned_by));
     return {
         id,
-        name: modelsDevMetadata.name ?? catalogModel?.name ?? `${id} (no metadata)`,
-        reasoning: modelsDevMetadata.reasoning ?? catalogModel?.reasoning ?? false,
+        name: catalogModel?.name ?? `${id} (no metadata)`,
+        reasoning: catalogModel?.reasoning ?? false,
         thinkingLevelMap: catalogModel?.thinkingLevelMap,
-        input: modelsDevMetadata.input ?? catalogModel?.input ?? ["text"],
-        cost: modelsDevMetadata.cost ?? catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: modelsDevMetadata.contextWindow ?? catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
-        maxTokens: modelsDevMetadata.maxTokens ?? catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
+        input: catalogModel?.input ?? ["text"],
+        cost: catalogModel?.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: catalogModel?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: catalogModel?.maxTokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
     };
 }
@@ -481,7 +275,7 @@ function deduplicateModels(models) {
     });
 }
 export async function discoverModels(baseUrl, apiKey, options = {}) {
-    const base = normalizeBaseUrl(baseUrl);
+    const base = normalizeBaseUrl(baseUrl, options.allowInsecureHttp);
     const progress = options.silent ? undefined : options.onProgress;
     progress?.("Querying /model/info endpoint...");
     const infoResult = await fetchJson(`${base}/model/info`, apiKey, options);
@@ -507,15 +301,10 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
         // Ref: docs.litellm.ai/docs/proxy/model_discovery
         if (models.some((m) => m.id.includes("*"))) {
             progress?.("/model/info has wildcard entries, expanding via /v1/models...");
-            let modelsDev;
-            if (options.modelsDev !== false) {
-                progress?.("Loading models.dev catalog for metadata enrichment...");
-                modelsDev = await getModelsDevCatalog(options);
-            }
             const listResult = await fetchJson(`${base}/v1/models`, apiKey, options);
             if (listResult.ok) {
                 const expanded = (listResult.data.data ?? [])
-                    .map((entry) => mapFromModelsList(entry, modelsDev))
+                    .map(mapFromModelsList)
                     .filter((m) => m !== undefined && !m.id.includes("*"));
                 const seen = new Set(models.map((m) => m.id));
                 models = [...models.filter((m) => !m.id.includes("*")), ...expanded.filter((m) => !seen.has(m.id))];
@@ -537,13 +326,8 @@ export async function discoverModels(baseUrl, apiKey, options = {}) {
         }
         throw new Error(`/v1/models returned ${listResult.status}`);
     }
-    let modelsDev;
-    if (options.modelsDev !== false) {
-        progress?.("Loading models.dev catalog for metadata enrichment...");
-        modelsDev = await getModelsDevCatalog(options);
-    }
     const models = (listResult.data.data ?? [])
-        .map((entry) => mapFromModelsList(entry, modelsDev))
+        .map(mapFromModelsList)
         .filter((m) => m !== undefined);
     return { source: "models_list", models: deduplicateModels(models) };
 }

package/dist/index.js

@@ -2,13 +2,13 @@ import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { setupLiteLLMCostTracking } from "./cost.js";
 import { discoverModels, isGpt55Model, isMoonshotModel, normalizeBaseUrl, shouldSuppressReasoningContent, } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
-import { createLiteLLMProvider } from "./provider.js";
+import { createLiteLLMProvider, toNativeModels } from "./provider.js";
 import { createSkillsPromptSection, createSkillToolDefinitions, listSkills } from "./skills.js";
 const PROVIDER_NAME = "litellm";
 const SETTINGS_KEY = "litellm";
@@ -20,22 +20,15 @@ const ENV_TIMEOUT = "LITELLM_DISCOVERY_TIMEOUT_MS";
 const ENV_CLI_JWT_EXPIRATION_HOURS = "LITELLM_CLI_JWT_EXPIRATION_HOURS";
 const ENV_OFFLINE = "LITELLM_OFFLINE";
 const ENV_VERBOSE_DISCOVERY = "LITELLM_VERBOSE_DISCOVERY";
-const ENV_MODELS_DEV = "LITELLM_MODELS_DEV";
 const DEFAULT_TIMEOUT_MS = 5000;
+const SEED_TIMEOUT_MS = 3000;
 const LOGIN_TIMEOUT_MS = 10_000;
 const CLI_SSO_POLL_INTERVAL_MS = 2_000;
 const CLI_SSO_EXPIRES_IN_SECONDS = 600;
 const DEFAULT_CLI_JWT_EXPIRATION_HOURS = 24;
-const MODELS_DEV_CACHE_FILENAME = "litellm-models-dev.json";
 const TOKEN_REFRESH_LEAD_MS = 5 * 60 * 1000;
 const PERMANENT_TOKEN_EXPIRES_AT = Number.MAX_SAFE_INTEGER;
 const EXPIRE_TOKEN_IMMEDIATELY = 0;
-function getModelsDevDiscoveryOptions() {
-    return {
-        modelsDev: process.env[ENV_MODELS_DEV] !== "0",
-        modelsDevCachePath: join(getAgentDir(), MODELS_DEV_CACHE_FILENAME),
-    };
-}
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -342,7 +335,7 @@ async function resolveCredentials(definition, { executeHelpers = true } = {}) {
         apiKeyConfig = `$${ENV_API_KEY}`;
     }
     return {
-        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase) : undefined,
+        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase, definition.allowInsecureHttp) : undefined,
         apiKey: apiKey || undefined,
         apiKeyConfig,
     };
@@ -359,6 +352,19 @@ function getDiscoveryTimeoutMs() {
 function isOffline() {
     return process.env[ENV_OFFLINE] === "1";
 }
+/** Pi disables all model network access when PI_OFFLINE is set; activation must honour it too. */
+function isHostOffline() {
+    return process.env.PI_OFFLINE !== undefined;
+}
+/**
+ * Absolute budget for activation-time discovery. Pi cannot paint its UI until every extension has
+ * activated, so this is deliberately capped rather than following LITELLM_DISCOVERY_TIMEOUT_MS,
+ * which is a per-request timeout that deployments raise to tens of seconds. Missing the budget only
+ * costs the startup seed; Pi's own refresh and /model still populate the catalog.
+ */
+function getSeedTimeoutMs() {
+    return Math.min(getDiscoveryTimeoutMs(), SEED_TIMEOUT_MS);
+}
 function isVerboseDiscovery() {
     return process.env[ENV_VERBOSE_DISCOVERY] === "1";
 }
@@ -387,6 +393,7 @@ function getProviderDefinitions(settings) {
         useDefaultEnv: isDefault,
         useGcloudTokenAuth: isDefault,
         enableOAuth: isDefault,
+        allowInsecureHttp: raw?.allowInsecureHttp === true,
     });
     const definitions = [makeDefinition(PROVIDER_NAME, defaultSettings, true)];
     for (const [name, raw] of Object.entries(providerSettings ?? {})) {
@@ -399,7 +406,7 @@ function getProviderDefinitions(settings) {
     }
     return definitions;
 }
-async function loginApiKey(interaction) {
+async function loginApiKey(interaction, allowInsecureHttp = false) {
     const rawBaseUrl = (await interaction.prompt({
         type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
@@ -410,7 +417,7 @@ async function loginApiKey(interaction) {
     const key = (await interaction.prompt({ type: "secret", message: "Enter API key:" })).trim();
     if (!key)
         throw new Error("Both base URL and API key are required");
-    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl) } };
+    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl, allowInsecureHttp) } };
 }
 async function startCliSso(baseUrl, signal, headers) {
     const response = await fetch(`${baseUrl}/sso/cli/start`, {
@@ -553,7 +560,7 @@ async function loginWithPastedToken(interaction, baseUrl, headers) {
     }
     return { type: "oauth", access, refresh: "", expires, baseUrl };
 }
-async function loginOAuth(interaction, headers) {
+async function loginOAuth(interaction, headers, allowInsecureHttp = false) {
     const rawBaseUrl = (await interaction.prompt({
         type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
@@ -561,7 +568,7 @@ async function loginOAuth(interaction, headers) {
     })).trim();
     if (!rawBaseUrl)
         throw new Error("Base URL is required");
-    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+    const baseUrl = normalizeBaseUrl(rawBaseUrl, allowInsecureHttp);
     const cliSso = await startCliSso(baseUrl, interaction.signal, headers);
     if (!cliSso)
         return loginWithPastedToken(interaction, baseUrl, headers);
@@ -604,7 +611,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
     if (stored) {
         source = "stored credential";
         creds = {
-            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl) : undefined,
+            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) : undefined,
             apiKey: stored,
         };
     }
@@ -641,7 +648,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             }
         }
         if (!creds.baseUrl && baseUrl)
-            creds.baseUrl = normalizeBaseUrl(baseUrl);
+            creds.baseUrl = normalizeBaseUrl(baseUrl, definition.allowInsecureHttp);
     }
     if (!creds.apiKey)
         return undefined;
@@ -651,7 +658,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             baseUrl: creds.baseUrl ? `${creds.baseUrl}/v1` : undefined,
             headers: await resolveHeadersFromContext(definition, ctx.env),
         },
-        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl) } : undefined,
+        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) } : undefined,
         source: source ?? creds.apiKeyConfig ?? ENV_API_KEY,
     };
 }
@@ -659,7 +666,9 @@ function createProviderAuth(definition) {
     return {
         apiKey: {
             name: `${definition.displayName} API key`,
-            login: definition.name === PROVIDER_NAME ? loginApiKey : undefined,
+            login: definition.name === PROVIDER_NAME
+                ? (interaction) => loginApiKey(interaction, definition.allowInsecureHttp)
+                : undefined,
             check: async ({ ctx, credential }) => {
                 const baseUrl = credential?.env?.[ENV_BASE_URL] ??
                     definition.baseUrl ??
@@ -695,14 +704,16 @@ function createProviderAuth(definition) {
             ? {
                 name: "LiteLLM SSO",
                 loginLabel: "Sign in with LiteLLM SSO",
-                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition)),
+                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition), definition.allowInsecureHttp),
                 refresh: async (credential, signal) => ({
                     ...(await refreshLiteLLM(credential, signal)),
                     type: "oauth",
                 }),
                 toAuth: async (credential) => ({
                     apiKey: credential.access,
-                    baseUrl: credential.baseUrl ? `${normalizeBaseUrl(String(credential.baseUrl))}/v1` : undefined,
+                    baseUrl: credential.baseUrl
+                        ? `${normalizeBaseUrl(String(credential.baseUrl), definition.allowInsecureHttp)}/v1`
+                        : undefined,
                     headers: resolveHeaders(definition),
                 }),
             }
@@ -933,23 +944,29 @@ export default async function (pi) {
         const baseUrl = cleanConfig(definition.baseUrl) ??
             (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined) ??
             "https://litellm.example.com";
-        return `${normalizeBaseUrl(baseUrl)}/v1`;
+        return `${normalizeBaseUrl(baseUrl, definition.allowInsecureHttp)}/v1`;
     }
-    async function authForCredential(definition, credential) {
-        if (credential.type === "oauth") {
+    async function authForCredential(definition, credential, executeHelpers = true) {
+        if (credential?.type === "oauth") {
             const baseUrl = typeof credential.baseUrl === "string"
-                ? normalizeBaseUrl(credential.baseUrl)
-                : normalizeBaseUrl(requestBaseUrl(definition));
-            return { baseUrl, apiKey: credential.access, headers: resolveHeaders(definition) };
+                ? normalizeBaseUrl(credential.baseUrl, definition.allowInsecureHttp)
+                : normalizeBaseUrl(requestBaseUrl(definition), definition.allowInsecureHttp);
+            return {
+                baseUrl,
+                apiKey: credential.access,
+                headers: resolveHeaders(definition),
+                allowInsecureHttp: definition.allowInsecureHttp,
+            };
         }
-        const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential);
+        const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential, executeHelpers);
         if (!resolved?.auth.apiKey) {
             throw new Error(`no credentials for ${definition.name}. Run /login litellm or set env vars.`);
         }
         return {
-            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition)),
+            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition), definition.allowInsecureHttp),
             apiKey: resolved.auth.apiKey,
             headers: resolved.auth.headers,
+            allowInsecureHttp: definition.allowInsecureHttp,
         };
     }
     let registeredMcpIdentity;
@@ -957,7 +974,7 @@ export default async function (pi) {
     let defaultRuntimeAuth;
     function mcpCatalogIdentity(auth) {
         return JSON.stringify({
-            baseUrl: normalizeBaseUrl(auth.baseUrl),
+            baseUrl: normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp),
             apiKey: auth.apiKey,
             headers: Object.entries(auth.headers ?? {}).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
         });
@@ -973,9 +990,10 @@ export default async function (pi) {
             return undefined;
         const headers = Object.fromEntries(Object.entries(auth.auth.headers ?? provider?.headers ?? {}).filter((entry) => typeof entry[1] === "string"));
         return {
-            baseUrl: normalizeBaseUrl(baseUrl),
+            baseUrl: normalizeBaseUrl(baseUrl, definitions[0]?.allowInsecureHttp),
             apiKey,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
+            allowInsecureHttp: definitions[0]?.allowInsecureHttp,
         };
     }
     async function resolveDefaultRuntimeAuth(ctx) {
@@ -1045,27 +1063,53 @@ export default async function (pi) {
                 mcpRegistration = undefined;
         }
     }
-    for (const definition of definitions) {
+    async function runDiscovery(auth, signal) {
+        const result = await discoverModels(auth.baseUrl, auth.apiKey, {
+            timeoutMs: getDiscoveryTimeoutMs(),
+            signal,
+            headers: auth.headers,
+            allowInsecureHttp: auth.allowInsecureHttp,
+            silent: !isVerboseDiscovery(),
+            onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
+        });
+        signal?.throwIfAborted();
+        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp)}/v1` };
+    }
+    // Pi's startup path only ever refreshes with allowNetwork:false, and it returns before the
+    // network phase, so the provider would stay empty until the user opens /model. Discover here
+    // instead, the way 1.x did, and hand the catalog over as the provider's baseline models.
+    async function seedModels(definition) {
+        if (discoveryDisabledReason() || isHostOffline())
+            return [];
+        try {
+            const stored = readStoredCredential(definition.name, join(getAgentDir(), "auth.json"));
+            // executeHelpers:false — activation must never run the user's key helper as a side effect,
+            // so helper-backed setups keep waiting for Pi's own refresh.
+            const auth = await authForCredential(definition, stored, false);
+            const result = await runDiscovery(auth, AbortSignal.timeout(getSeedTimeoutMs()));
+            return toNativeModels(definition.name, result.baseUrl, result.models);
+        }
+        catch (error) {
+            // No credentials yet is the normal unconfigured case; anything else is worth one line.
+            if (isVerboseDiscovery()) {
+                process.stderr.write(`LiteLLM (${definition.name}): startup discovery skipped (${error instanceof Error ? error.message : String(error)}).\n`);
+            }
+            return [];
+        }
+    }
+    const seeded = await Promise.all(definitions.map(seedModels));
+    for (const [index, definition] of definitions.entries()) {
         const provider = createLiteLLMProvider({
             id: definition.name,
             name: definition.displayName,
             baseUrl: requestBaseUrl(definition),
             auth: createProviderAuth(definition),
+            models: seeded[index],
             discover: async (credential, signal) => {
                 const disabledReason = discoveryDisabledReason();
                 if (disabledReason)
                     throw new Error(`discovery disabled (${disabledReason})`);
-                const auth = await authForCredential(definition, credential);
-                const result = await discoverModels(auth.baseUrl, auth.apiKey, {
-                    ...getModelsDevDiscoveryOptions(),
-                    timeoutMs: getDiscoveryTimeoutMs(),
-                    signal,
-                    headers: auth.headers,
-                    silent: !isVerboseDiscovery(),
-                    onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
-                });
-                signal?.throwIfAborted();
-                return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
+                return runDiscovery(await authForCredential(definition, credential), signal);
             },
         });
         Object.assign(provider, { headers: resolveHeaders(definition) });
@@ -1104,16 +1148,27 @@ export default async function (pi) {
             return;
         return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, ctx.model?.api, sessionId);
     });
+    // Skills enrichment is best-effort: an expired credential or an unreachable proxy must not
+    // report an extension error on every turn. The failing model request states the real problem.
     pi.on("before_agent_start", async (event, ctx) => {
         defaultRuntimeAuth = undefined;
         if (!skillsEnabled || discoveryDisabledReason())
             return;
-        const auth = await getRuntimeAuth(ctx);
-        if (!auth)
+        let section;
+        try {
+            const auth = await getRuntimeAuth(ctx);
+            if (!auth)
+                return;
+            defaultRuntimeAuth = auth;
+            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
+            section = createSkillsPromptSection(skills);
+        }
+        catch (error) {
+            if (isVerboseDiscovery()) {
+                process.stderr.write(`LiteLLM: skipping Skills (${error instanceof Error ? error.message : String(error)}).\n`);
+            }
             return;
-        defaultRuntimeAuth = auth;
-        const skills = await listSkills(defaultRuntimeAuth.baseUrl, defaultRuntimeAuth.apiKey, defaultRuntimeAuth.headers);
-        const section = createSkillsPromptSection(skills);
+        }
         if (!section)
             return;
         return { systemPrompt: `${event.systemPrompt}\n\n${section}` };

package/dist/mcp-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMMcpTool, LiteLLMRuntimeAuth } from "./types.js";
-export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal): Promise<LiteLLMMcpTool[]>;
-export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>): Promise<string>;
+export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal, allowInsecureHttp?: boolean): Promise<LiteLLMMcpTool[]>;
+export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<string>;
 export declare function createMcpToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>, onProgress?: (message: string) => void, signal?: AbortSignal): Promise<ToolDefinition[]>;

package/dist/mcp-tools.js

@@ -49,11 +49,11 @@ function normalizeMcpTool(value) {
         input_schema: inputSchema,
     };
 }
-export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal) {
+export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal, allowInsecureHttp = false) {
     onProgress?.("Discovering MCP tools from server...");
     try {
         onProgress?.("Querying MCP tools/list endpoint...");
-        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/list`, {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/list`, {
             headers: {
                 ...headers,
                 Authorization: `Bearer ${apiKey}`,
@@ -80,9 +80,9 @@ export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, par
         throw error;
     }
 }
-export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers) {
+export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     for (let attempt = 0; attempt <= MCP_RETRY_ATTEMPTS; attempt++) {
-        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers);
+        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp);
         if (attempt < MCP_RETRY_ATTEMPTS && result.retryable) {
             await sleep(MCP_RETRY_DELAY_MS);
             continue;
@@ -91,11 +91,11 @@ export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args,
     }
     return `Error calling ${toolName} on ${serverId}: retry attempts exhausted`;
 }
-async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers) {
+async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     try {
         let response;
         try {
-            response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/call`, {
+            response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/call`, {
                 method: "POST",
                 headers: {
                     ...headers,
@@ -152,7 +152,7 @@ function buildParameters(inputSchema) {
 }
 export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
     const discoveryAuth = await getAuth();
-    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal);
+    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal, discoveryAuth.allowInsecureHttp);
     return tools.map((mcpTool) => {
         const safeServer = sanitizeName(mcpTool.server_name);
         const safeTool = sanitizeName(mcpTool.name);
@@ -170,7 +170,7 @@ export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
                 const args = Object.keys(rawParams).length === 1 && rawParams.args && typeof rawParams.args === "object"
                     ? rawParams.args
                     : rawParams;
-                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers);
+                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers, auth.allowInsecureHttp);
                 return {
                     content: [{ type: "text", text }],
                     details: { server: mcpTool.server_name, serverId: mcpTool.server_id, tool: mcpTool.name },

package/dist/provider.d.ts

@@ -5,6 +5,9 @@ export type LiteLLMProviderOptions = {
     name: string;
     baseUrl: string;
     auth: ProviderAuth;
+    /** Catalog discovered during activation. Pi's startup refresh never allows network access, so
+     * without a seed the provider stays empty until the user opens /model. */
+    models?: readonly Model<LiteLLMApi>[];
     discover(credential: Credential, signal?: AbortSignal): Promise<DiscoveryResult & {
         baseUrl?: string;
     }>;

package/dist/provider.js

@@ -15,7 +15,7 @@ export function createLiteLLMProvider(options) {
         name: options.name,
         baseUrl: options.baseUrl,
         auth: options.auth,
-        models: [],
+        models: options.models ?? [],
         async fetchModels(context) {
             if (!context.credential)
                 throw new Error("LiteLLM model discovery requires a credential");

package/dist/skills.d.ts

@@ -1,14 +1,14 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMRuntimeAuth, LiteLLMSkill } from "./types.js";
-export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>): Promise<LiteLLMSkill[]>;
+export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<LiteLLMSkill[]>;
 export declare function createSkill(baseUrl: string, apiKey: string, input: {
     name: string;
     description?: string;
     source?: Record<string, unknown>;
     code?: string;
     inputSchema?: Record<string, unknown>;
-}, headers?: Record<string, string>): Promise<unknown>;
-export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>): Promise<void>;
+}, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<unknown>;
+export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<void>;
 export declare function createSkillsPromptSection(skills: LiteLLMSkill[]): string | undefined;
 export declare function createSkillToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>): ToolDefinition[];
 export declare function resetSkillsCache(): void;

package/dist/skills.js

@@ -17,8 +17,8 @@ function getSkillsFromBody(body) {
     }
     return [];
 }
-export async function listSkills(baseUrl, apiKey, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function listSkills(baseUrl, apiKey, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     if (skillsCache &&
         skillsCache.baseUrl === normalizedBaseUrl &&
         skillsCache.apiKey === apiKey &&
@@ -46,10 +46,10 @@ export async function listSkills(baseUrl, apiKey, headers) {
     skillsCache = { baseUrl: normalizedBaseUrl, apiKey, fetchedAt: Date.now(), skills };
     return skills;
 }
-export async function createSkill(baseUrl, apiKey, input, headers) {
+export async function createSkill(baseUrl, apiKey, input, headers, allowInsecureHttp = false) {
     if (!input.source && !input.code)
         throw new Error("code is required when source is omitted");
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let usedSkillHub = input.source !== undefined;
     const skillHubPayload = input.source
         ? {
@@ -105,8 +105,8 @@ export async function createSkill(baseUrl, apiKey, input, headers) {
     }
     return response.json().catch(() => ({}));
 }
-export async function deleteSkill(baseUrl, apiKey, skillId, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function deleteSkill(baseUrl, apiKey, skillId, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let skillHubError;
     const skillHubResponse = await fetch(`${normalizedBaseUrl}/claude-code/plugins/${encodeURIComponent(skillId)}`, {
         method: "DELETE",
@@ -182,7 +182,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: Type.Object({}),
             async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: formatSkills(skills) }], details: { count: skills.length } };
             },
         }),
@@ -203,7 +203,7 @@ export function createSkillToolDefinitions(getAuth) {
                     source,
                     code: params.code,
                     inputSchema,
-                }, auth.headers);
+                }, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: "LiteLLM skill created." }], details: { result } };
             },
         }),
@@ -214,7 +214,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: DeleteSkillParams,
             async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers);
+                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: `LiteLLM skill deleted: ${params.skillId}` }], details: {} };
             },
         }),

package/dist/types.d.ts

@@ -5,6 +5,7 @@ export type LiteLLMRuntimeAuth = {
     baseUrl: string;
     apiKey: string;
     headers?: Record<string, string>;
+    allowInsecureHttp?: boolean;
 };
 export type DiscoveredModel = Omit<Model<"openai-completions">, "provider" | "api" | "baseUrl"> & {
     api?: LiteLLMApi;
@@ -17,8 +18,7 @@ export interface DiscoveryOptions {
     timeoutMs?: number;
     signal?: AbortSignal;
     headers?: Record<string, string>;
-    modelsDev?: boolean;
-    modelsDevCachePath?: string;
+    allowInsecureHttp?: boolean;
 }
 export interface ModelInfoEntry {
     model_name?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",

package/dist/cache.d.ts

@@ -1 +0,0 @@
-export declare function writeJsonAtomic(path: string, value: unknown): Promise<void>;

package/dist/cache.js

@@ -1,8 +0,0 @@
-import { mkdir, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-export async function writeJsonAtomic(path, value) {
-    await mkdir(dirname(path), { recursive: true });
-    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
-    await rename(tmp, path);
-}