pi-provider-litellm 2.2.0 → 2.2.1

package/README.md

@@ -115,6 +115,7 @@ Provider fields:
 | `headers` | `$LITELLM_HEADERS` for `litellm`; unset for aliases | JSON string env reference or inline object of request headers |
 | `displayName` | provider name | Label shown in Pi UI |
 | `enabled` | `true` | Set `false` to skip an alias |
+| `allowInsecureHttp` | `false` | Set `true` to permit plaintext HTTP for this provider, for example `http://host.docker.internal`. Credentials and request data will not be encrypted. Loopback HTTP works without this setting. |
 
 `/login litellm` and Google ADC token auth remain scoped to the default `litellm` provider. Aliases use their configured `apiKey` or manually stored auth entries matching the alias name.
 

package/dist/discover.d.ts

@@ -1,6 +1,6 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { DiscoveredModel, DiscoveryOptions, DiscoveryResult } from "./types.js";
-export declare function normalizeBaseUrl(input: string): string;
+export declare function normalizeBaseUrl(input: string, allowInsecureHttp?: boolean): string;
 export declare function isMoonshotModel(modelId: string): boolean;
 export declare function isGpt55Model(modelId: string): boolean;
 export declare function shouldSuppressReasoningContent(modelId: string): boolean;

package/dist/discover.js

@@ -4,11 +4,11 @@ const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const KNOWN_PROVIDER_SET = new Set(getProviders());
-export function normalizeBaseUrl(input) {
+export function normalizeBaseUrl(input, allowInsecureHttp = false) {
     const url = new URL(input);
     const hostname = url.hostname.toLowerCase();
     const loopback = hostname === "localhost" || hostname === "[::1]" || (isIP(hostname) === 4 && hostname.startsWith("127."));
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
         throw new Error("LiteLLM base URL must use HTTPS except for loopback hosts");
     }
     return input.replace(/\/+$/, "").replace(/\/v1\/?$/i, "");
@@ -275,7 +275,7 @@ function deduplicateModels(models) {
     });
 }
 export async function discoverModels(baseUrl, apiKey, options = {}) {
-    const base = normalizeBaseUrl(baseUrl);
+    const base = normalizeBaseUrl(baseUrl, options.allowInsecureHttp);
     const progress = options.silent ? undefined : options.onProgress;
     progress?.("Querying /model/info endpoint...");
     const infoResult = await fetchJson(`${base}/model/info`, apiKey, options);

package/dist/index.js

@@ -335,7 +335,7 @@ async function resolveCredentials(definition, { executeHelpers = true } = {}) {
         apiKeyConfig = `$${ENV_API_KEY}`;
     }
     return {
-        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase) : undefined,
+        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase, definition.allowInsecureHttp) : undefined,
         apiKey: apiKey || undefined,
         apiKeyConfig,
     };
@@ -393,6 +393,7 @@ function getProviderDefinitions(settings) {
         useDefaultEnv: isDefault,
         useGcloudTokenAuth: isDefault,
         enableOAuth: isDefault,
+        allowInsecureHttp: raw?.allowInsecureHttp === true,
     });
     const definitions = [makeDefinition(PROVIDER_NAME, defaultSettings, true)];
     for (const [name, raw] of Object.entries(providerSettings ?? {})) {
@@ -405,7 +406,7 @@ function getProviderDefinitions(settings) {
     }
     return definitions;
 }
-async function loginApiKey(interaction) {
+async function loginApiKey(interaction, allowInsecureHttp = false) {
     const rawBaseUrl = (await interaction.prompt({
         type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
@@ -416,7 +417,7 @@ async function loginApiKey(interaction) {
     const key = (await interaction.prompt({ type: "secret", message: "Enter API key:" })).trim();
     if (!key)
         throw new Error("Both base URL and API key are required");
-    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl) } };
+    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl, allowInsecureHttp) } };
 }
 async function startCliSso(baseUrl, signal, headers) {
     const response = await fetch(`${baseUrl}/sso/cli/start`, {
@@ -559,7 +560,7 @@ async function loginWithPastedToken(interaction, baseUrl, headers) {
     }
     return { type: "oauth", access, refresh: "", expires, baseUrl };
 }
-async function loginOAuth(interaction, headers) {
+async function loginOAuth(interaction, headers, allowInsecureHttp = false) {
     const rawBaseUrl = (await interaction.prompt({
         type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
@@ -567,7 +568,7 @@ async function loginOAuth(interaction, headers) {
     })).trim();
     if (!rawBaseUrl)
         throw new Error("Base URL is required");
-    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+    const baseUrl = normalizeBaseUrl(rawBaseUrl, allowInsecureHttp);
     const cliSso = await startCliSso(baseUrl, interaction.signal, headers);
     if (!cliSso)
         return loginWithPastedToken(interaction, baseUrl, headers);
@@ -610,7 +611,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
     if (stored) {
         source = "stored credential";
         creds = {
-            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl) : undefined,
+            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) : undefined,
             apiKey: stored,
         };
     }
@@ -647,7 +648,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             }
         }
         if (!creds.baseUrl && baseUrl)
-            creds.baseUrl = normalizeBaseUrl(baseUrl);
+            creds.baseUrl = normalizeBaseUrl(baseUrl, definition.allowInsecureHttp);
     }
     if (!creds.apiKey)
         return undefined;
@@ -657,7 +658,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             baseUrl: creds.baseUrl ? `${creds.baseUrl}/v1` : undefined,
             headers: await resolveHeadersFromContext(definition, ctx.env),
         },
-        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl) } : undefined,
+        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) } : undefined,
         source: source ?? creds.apiKeyConfig ?? ENV_API_KEY,
     };
 }
@@ -665,7 +666,9 @@ function createProviderAuth(definition) {
     return {
         apiKey: {
             name: `${definition.displayName} API key`,
-            login: definition.name === PROVIDER_NAME ? loginApiKey : undefined,
+            login: definition.name === PROVIDER_NAME
+                ? (interaction) => loginApiKey(interaction, definition.allowInsecureHttp)
+                : undefined,
             check: async ({ ctx, credential }) => {
                 const baseUrl = credential?.env?.[ENV_BASE_URL] ??
                     definition.baseUrl ??
@@ -701,14 +704,16 @@ function createProviderAuth(definition) {
             ? {
                 name: "LiteLLM SSO",
                 loginLabel: "Sign in with LiteLLM SSO",
-                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition)),
+                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition), definition.allowInsecureHttp),
                 refresh: async (credential, signal) => ({
                     ...(await refreshLiteLLM(credential, signal)),
                     type: "oauth",
                 }),
                 toAuth: async (credential) => ({
                     apiKey: credential.access,
-                    baseUrl: credential.baseUrl ? `${normalizeBaseUrl(String(credential.baseUrl))}/v1` : undefined,
+                    baseUrl: credential.baseUrl
+                        ? `${normalizeBaseUrl(String(credential.baseUrl), definition.allowInsecureHttp)}/v1`
+                        : undefined,
                     headers: resolveHeaders(definition),
                 }),
             }
@@ -939,23 +944,29 @@ export default async function (pi) {
         const baseUrl = cleanConfig(definition.baseUrl) ??
             (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined) ??
             "https://litellm.example.com";
-        return `${normalizeBaseUrl(baseUrl)}/v1`;
+        return `${normalizeBaseUrl(baseUrl, definition.allowInsecureHttp)}/v1`;
     }
     async function authForCredential(definition, credential, executeHelpers = true) {
         if (credential?.type === "oauth") {
             const baseUrl = typeof credential.baseUrl === "string"
-                ? normalizeBaseUrl(credential.baseUrl)
-                : normalizeBaseUrl(requestBaseUrl(definition));
-            return { baseUrl, apiKey: credential.access, headers: resolveHeaders(definition) };
+                ? normalizeBaseUrl(credential.baseUrl, definition.allowInsecureHttp)
+                : normalizeBaseUrl(requestBaseUrl(definition), definition.allowInsecureHttp);
+            return {
+                baseUrl,
+                apiKey: credential.access,
+                headers: resolveHeaders(definition),
+                allowInsecureHttp: definition.allowInsecureHttp,
+            };
         }
         const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential, executeHelpers);
         if (!resolved?.auth.apiKey) {
             throw new Error(`no credentials for ${definition.name}. Run /login litellm or set env vars.`);
         }
         return {
-            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition)),
+            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition), definition.allowInsecureHttp),
             apiKey: resolved.auth.apiKey,
             headers: resolved.auth.headers,
+            allowInsecureHttp: definition.allowInsecureHttp,
         };
     }
     let registeredMcpIdentity;
@@ -963,7 +974,7 @@ export default async function (pi) {
     let defaultRuntimeAuth;
     function mcpCatalogIdentity(auth) {
         return JSON.stringify({
-            baseUrl: normalizeBaseUrl(auth.baseUrl),
+            baseUrl: normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp),
             apiKey: auth.apiKey,
             headers: Object.entries(auth.headers ?? {}).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
         });
@@ -979,9 +990,10 @@ export default async function (pi) {
             return undefined;
         const headers = Object.fromEntries(Object.entries(auth.auth.headers ?? provider?.headers ?? {}).filter((entry) => typeof entry[1] === "string"));
         return {
-            baseUrl: normalizeBaseUrl(baseUrl),
+            baseUrl: normalizeBaseUrl(baseUrl, definitions[0]?.allowInsecureHttp),
             apiKey,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
+            allowInsecureHttp: definitions[0]?.allowInsecureHttp,
         };
     }
     async function resolveDefaultRuntimeAuth(ctx) {
@@ -1056,11 +1068,12 @@ export default async function (pi) {
             timeoutMs: getDiscoveryTimeoutMs(),
             signal,
             headers: auth.headers,
+            allowInsecureHttp: auth.allowInsecureHttp,
             silent: !isVerboseDiscovery(),
             onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
         });
         signal?.throwIfAborted();
-        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
+        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp)}/v1` };
     }
     // Pi's startup path only ever refreshes with allowNetwork:false, and it returns before the
     // network phase, so the provider would stay empty until the user opens /model. Discover here
@@ -1147,7 +1160,7 @@ export default async function (pi) {
             if (!auth)
                 return;
             defaultRuntimeAuth = auth;
-            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
             section = createSkillsPromptSection(skills);
         }
         catch (error) {

package/dist/mcp-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMMcpTool, LiteLLMRuntimeAuth } from "./types.js";
-export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal): Promise<LiteLLMMcpTool[]>;
-export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>): Promise<string>;
+export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal, allowInsecureHttp?: boolean): Promise<LiteLLMMcpTool[]>;
+export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<string>;
 export declare function createMcpToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>, onProgress?: (message: string) => void, signal?: AbortSignal): Promise<ToolDefinition[]>;

package/dist/mcp-tools.js

@@ -49,11 +49,11 @@ function normalizeMcpTool(value) {
         input_schema: inputSchema,
     };
 }
-export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal) {
+export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal, allowInsecureHttp = false) {
     onProgress?.("Discovering MCP tools from server...");
     try {
         onProgress?.("Querying MCP tools/list endpoint...");
-        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/list`, {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/list`, {
             headers: {
                 ...headers,
                 Authorization: `Bearer ${apiKey}`,
@@ -80,9 +80,9 @@ export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, par
         throw error;
     }
 }
-export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers) {
+export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     for (let attempt = 0; attempt <= MCP_RETRY_ATTEMPTS; attempt++) {
-        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers);
+        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp);
         if (attempt < MCP_RETRY_ATTEMPTS && result.retryable) {
             await sleep(MCP_RETRY_DELAY_MS);
             continue;
@@ -91,11 +91,11 @@ export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args,
     }
     return `Error calling ${toolName} on ${serverId}: retry attempts exhausted`;
 }
-async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers) {
+async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     try {
         let response;
         try {
-            response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/call`, {
+            response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/call`, {
                 method: "POST",
                 headers: {
                     ...headers,
@@ -152,7 +152,7 @@ function buildParameters(inputSchema) {
 }
 export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
     const discoveryAuth = await getAuth();
-    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal);
+    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal, discoveryAuth.allowInsecureHttp);
     return tools.map((mcpTool) => {
         const safeServer = sanitizeName(mcpTool.server_name);
         const safeTool = sanitizeName(mcpTool.name);
@@ -170,7 +170,7 @@ export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
                 const args = Object.keys(rawParams).length === 1 && rawParams.args && typeof rawParams.args === "object"
                     ? rawParams.args
                     : rawParams;
-                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers);
+                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers, auth.allowInsecureHttp);
                 return {
                     content: [{ type: "text", text }],
                     details: { server: mcpTool.server_name, serverId: mcpTool.server_id, tool: mcpTool.name },

package/dist/skills.d.ts

@@ -1,14 +1,14 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMRuntimeAuth, LiteLLMSkill } from "./types.js";
-export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>): Promise<LiteLLMSkill[]>;
+export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<LiteLLMSkill[]>;
 export declare function createSkill(baseUrl: string, apiKey: string, input: {
     name: string;
     description?: string;
     source?: Record<string, unknown>;
     code?: string;
     inputSchema?: Record<string, unknown>;
-}, headers?: Record<string, string>): Promise<unknown>;
-export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>): Promise<void>;
+}, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<unknown>;
+export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<void>;
 export declare function createSkillsPromptSection(skills: LiteLLMSkill[]): string | undefined;
 export declare function createSkillToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>): ToolDefinition[];
 export declare function resetSkillsCache(): void;

package/dist/skills.js

@@ -17,8 +17,8 @@ function getSkillsFromBody(body) {
     }
     return [];
 }
-export async function listSkills(baseUrl, apiKey, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function listSkills(baseUrl, apiKey, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     if (skillsCache &&
         skillsCache.baseUrl === normalizedBaseUrl &&
         skillsCache.apiKey === apiKey &&
@@ -46,10 +46,10 @@ export async function listSkills(baseUrl, apiKey, headers) {
     skillsCache = { baseUrl: normalizedBaseUrl, apiKey, fetchedAt: Date.now(), skills };
     return skills;
 }
-export async function createSkill(baseUrl, apiKey, input, headers) {
+export async function createSkill(baseUrl, apiKey, input, headers, allowInsecureHttp = false) {
     if (!input.source && !input.code)
         throw new Error("code is required when source is omitted");
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let usedSkillHub = input.source !== undefined;
     const skillHubPayload = input.source
         ? {
@@ -105,8 +105,8 @@ export async function createSkill(baseUrl, apiKey, input, headers) {
     }
     return response.json().catch(() => ({}));
 }
-export async function deleteSkill(baseUrl, apiKey, skillId, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function deleteSkill(baseUrl, apiKey, skillId, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let skillHubError;
     const skillHubResponse = await fetch(`${normalizedBaseUrl}/claude-code/plugins/${encodeURIComponent(skillId)}`, {
         method: "DELETE",
@@ -182,7 +182,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: Type.Object({}),
             async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: formatSkills(skills) }], details: { count: skills.length } };
             },
         }),
@@ -203,7 +203,7 @@ export function createSkillToolDefinitions(getAuth) {
                     source,
                     code: params.code,
                     inputSchema,
-                }, auth.headers);
+                }, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: "LiteLLM skill created." }], details: { result } };
             },
         }),
@@ -214,7 +214,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: DeleteSkillParams,
             async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers);
+                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: `LiteLLM skill deleted: ${params.skillId}` }], details: {} };
             },
         }),

package/dist/types.d.ts

@@ -5,6 +5,7 @@ export type LiteLLMRuntimeAuth = {
     baseUrl: string;
     apiKey: string;
     headers?: Record<string, string>;
+    allowInsecureHttp?: boolean;
 };
 export type DiscoveredModel = Omit<Model<"openai-completions">, "provider" | "api" | "baseUrl"> & {
     api?: LiteLLMApi;
@@ -17,6 +18,7 @@ export interface DiscoveryOptions {
     timeoutMs?: number;
     signal?: AbortSignal;
     headers?: Record<string, string>;
+    allowInsecureHttp?: boolean;
 }
 export interface ModelInfoEntry {
     model_name?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",