pi-provider-litellm 2.2.0 → 2.3.0

package/README.md

@@ -44,12 +44,14 @@ To configure an API key, run `/login`, choose `Sign in with an API key`, then ch
 
 You'll be prompted for the base URL and API key. Credentials are persisted to `~/.pi/agent/auth.json`.
 
+If a proxy URL is already known — from `providers.<name>.baseUrl`, `LITELLM_BASE_URL`, or a previous login — pi offers it as the first option instead of asking you to retype it. Pick `Enter a different URL…` to point at another proxy.
+
 #### Enterprise SSO login
 
 If your LiteLLM proxy requires SSO/OAuth authentication (enterprise deployments), you can authenticate through LiteLLM's CLI SSO flow:
 
 1. Run `/login litellm` inside pi and select `Sign in with LiteLLM SSO`
-2. Enter the proxy URL
+2. Confirm the offered proxy URL, or enter one if this is the first login
 3. Pi displays a verification code and opens the LiteLLM SSO login URL automatically
 4. Authenticate in the browser and confirm the displayed code
 5. If your account belongs to multiple teams, select the team for this session in Pi
@@ -115,6 +117,7 @@ Provider fields:
 | `headers` | `$LITELLM_HEADERS` for `litellm`; unset for aliases | JSON string env reference or inline object of request headers |
 | `displayName` | provider name | Label shown in Pi UI |
 | `enabled` | `true` | Set `false` to skip an alias |
+| `allowInsecureHttp` | `false` | Set `true` to permit plaintext HTTP for this provider, for example `http://host.docker.internal`. Credentials and request data will not be encrypted. Loopback HTTP works without this setting. |
 
 `/login litellm` and Google ADC token auth remain scoped to the default `litellm` provider. Aliases use their configured `apiKey` or manually stored auth entries matching the alias name.
 
@@ -235,6 +238,7 @@ Opening `/model` refreshes configured provider catalogs in the background using
 | Symptom | Likely cause |
 |---|---|
 | "no credentials" warning at startup | Env vars not set and no OAuth credential — run `/login litellm` |
+| `No models available` at startup, gone after a restart | A Pi startup race, not discovery — see [`No models available` at startup](#no-models-available-at-startup) |
 | "discovered no models" | Proxy returned an empty list — check pi's startup log and verify `/model/info`, `/v1/models`, or `/health` responds |
 | `/model/info` returning 401/403/404 | Expected behavior with virtual keys — extension falls back to `/v1/models` |
 | Discovery times out | Increase `LITELLM_DISCOVERY_TIMEOUT_MS` or set `LITELLM_OFFLINE=1` to fall back on cached models |
@@ -247,6 +251,27 @@ Opening `/model` refreshes configured provider catalogs in the background using
 | MCP tools not showing | Verify the proxy exposes `/mcp-rest/tools/list` and open `/model` after fixing the proxy |
 | Skills not affecting prompts | Verify the proxy exposes `/claude-code/marketplace.json` or `/v1/skills` and returns enabled skills |
 
+### `No models available` at startup
+
+Pi 0.84.0 and later can finish startup before the provider availability snapshot is written, so the
+initial model pick sees nothing even though discovery succeeded. The warning is intermittent and a
+restart usually clears it. Nothing is wrong with the catalog: `/model` in the same session still
+lists every discovered model, and picking one there fixes that session.
+
+Scoping models keeps selection off that path, because Pi resolves the scope with its own awaited
+availability pass before it picks a model. In `~/.pi/agent/settings.json`:
+
+```json
+{
+  "enabledModels": ["litellm/*"]
+}
+```
+
+Your `defaultProvider` and `defaultModel` still win as long as they match a pattern. `/model` then
+opens on the scoped list, with a toggle inside the picker for the full catalog.
+
+The extension cannot set this for you — Pi reads `enabledModels` before extensions activate.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/dist/discover.d.ts

@@ -1,9 +1,9 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { DiscoveredModel, DiscoveryOptions, DiscoveryResult } from "./types.js";
-export declare function normalizeBaseUrl(input: string): string;
+export declare function normalizeBaseUrl(input: string, allowInsecureHttp?: boolean): string;
 export declare function isMoonshotModel(modelId: string): boolean;
 export declare function isGpt55Model(modelId: string): boolean;
-export declare function shouldSuppressReasoningContent(modelId: string): boolean;
+export declare function emitsThinkTags(modelId: string): boolean;
 export declare function buildCompat(modelId: string): DiscoveredModel["compat"];
 export declare function enrichCachedModel(model: Model<Api>): Model<Api>;
 export declare function discoverModels(baseUrl: string, apiKey: string, options?: DiscoveryOptions & {

package/dist/discover.js

@@ -4,11 +4,11 @@ const DEFAULT_TIMEOUT_MS = 5000;
 const DEFAULT_CONTEXT_WINDOW = 128_000;
 const DEFAULT_MAX_TOKENS = 16_384;
 const KNOWN_PROVIDER_SET = new Set(getProviders());
-export function normalizeBaseUrl(input) {
+export function normalizeBaseUrl(input, allowInsecureHttp = false) {
     const url = new URL(input);
     const hostname = url.hostname.toLowerCase();
     const loopback = hostname === "localhost" || hostname === "[::1]" || (isIP(hostname) === 4 && hostname.startsWith("127."));
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
         throw new Error("LiteLLM base URL must use HTTPS except for loopback hosts");
     }
     return input.replace(/\/+$/, "").replace(/\/v1\/?$/i, "");
@@ -38,7 +38,36 @@ export function isMoonshotModel(modelId) {
 export function isGpt55Model(modelId) {
     return GPT55_MODEL_PATTERN.test(modelId);
 }
-export function shouldSuppressReasoningContent(modelId) {
+const MOONSHOT_ROUTE_PROVIDERS = new Set(["moonshot", "moonshotai"]);
+function isMoonshotRoute(entry) {
+    const params = entry.litellm_params;
+    if (!params)
+        return false;
+    const model = params.model?.trim();
+    if (!model)
+        return false;
+    const providers = [
+        params.custom_llm_provider?.trim(),
+        model.includes("/") ? model.split("/", 1)[0] : undefined,
+    ].filter((provider) => Boolean(provider));
+    return providers.length > 0 && providers.every((provider) => MOONSHOT_ROUTE_PROVIDERS.has(provider.toLowerCase()));
+}
+function shouldSuppressReasoningContent(modelId, entry) {
+    const routeModelId = entry.litellm_params?.model;
+    return (isMoonshotRoute(entry) &&
+        !FORCED_THINKING_MODEL_PATTERN.test(modelId) &&
+        !(routeModelId && FORCED_THINKING_MODEL_PATTERN.test(routeModelId)));
+}
+function aggregateSuppressionEvidence(evidence) {
+    let hasEvidence = false;
+    for (const suppress of evidence) {
+        hasEvidence = true;
+        if (!suppress)
+            return false;
+    }
+    return hasEvidence;
+}
+export function emitsThinkTags(modelId) {
     return isMoonshotModel(modelId) && !FORCED_THINKING_MODEL_PATTERN.test(modelId);
 }
 export function buildCompat(modelId) {
@@ -172,7 +201,7 @@ function mapReasoningEfforts(info) {
         .map(([level, value, supported]) => [level, supported ? value : null]));
     return Object.keys(map).length > 0 ? map : undefined;
 }
-function mapFromModelInfo(entry) {
+function mapFromModelInfo(entry, suppressReasoningContent = shouldSuppressReasoningContent(entry.model_name ?? "", entry)) {
     const id = entry.model_name;
     if (!id)
         return undefined;
@@ -195,6 +224,7 @@ function mapFromModelInfo(entry) {
         contextWindow: info.max_input_tokens ?? DEFAULT_CONTEXT_WINDOW,
         maxTokens: info.max_output_tokens ?? DEFAULT_MAX_TOKENS,
         compat: buildCompat(id),
+        ...(suppressReasoningContent ? { suppressReasoningContent: true } : {}),
         ...(responsesMode ? { api: "openai-responses" } : {}),
     };
 }
@@ -266,32 +296,49 @@ async function discoverFromHealth(base, apiKey, options) {
     return models.filter((model) => model !== undefined);
 }
 function deduplicateModels(models) {
-    const seen = new Set();
-    return models.filter((m) => {
-        if (seen.has(m.id))
-            return false;
-        seen.add(m.id);
-        return true;
+    const entries = new Map();
+    for (const model of models) {
+        const existing = entries.get(model.id);
+        if (existing) {
+            existing.suppressions.push(model.suppressReasoningContent === true);
+        }
+        else {
+            entries.set(model.id, { model, suppressions: [model.suppressReasoningContent === true] });
+        }
+    }
+    return [...entries.values()].map(({ model, suppressions }) => {
+        const deduplicated = { ...model };
+        if (aggregateSuppressionEvidence(suppressions))
+            deduplicated.suppressReasoningContent = true;
+        else
+            delete deduplicated.suppressReasoningContent;
+        return deduplicated;
     });
 }
 export async function discoverModels(baseUrl, apiKey, options = {}) {
-    const base = normalizeBaseUrl(baseUrl);
+    const base = normalizeBaseUrl(baseUrl, options.allowInsecureHttp);
     const progress = options.silent ? undefined : options.onProgress;
     progress?.("Querying /model/info endpoint...");
     const infoResult = await fetchJson(`${base}/model/info`, apiKey, options);
     if (infoResult.ok) {
         const entries = new Map();
+        const suppressionEvidence = new Map();
         for (const entry of infoResult.data.data ?? []) {
             if (!entry.model_name)
                 continue;
             const previous = entries.get(entry.model_name);
+            const suppressions = suppressionEvidence.get(entry.model_name) ?? new Set();
+            suppressions.add(shouldSuppressReasoningContent(entry.model_name, entry));
+            suppressionEvidence.set(entry.model_name, suppressions);
             entries.set(entry.model_name, {
                 ...previous,
                 ...entry,
                 model_info: { ...previous?.model_info, ...entry.model_info },
             });
         }
-        let models = [...entries.values()].map(mapFromModelInfo).filter((m) => m !== undefined);
+        let models = [...entries.entries()]
+            .map(([id, entry]) => mapFromModelInfo(entry, aggregateSuppressionEvidence(suppressionEvidence.get(id))))
+            .filter((m) => m !== undefined);
         // LiteLLM's /model/info does NOT expand wildcard model_name entries (e.g.
         // "lemonade/*" backed by model: openai/* + check_provider_endpoint: true)
         // — it returns the literal wildcard only. The discovered ids live in

package/dist/index.js

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { setupLiteLLMCostTracking } from "./cost.js";
-import { discoverModels, isGpt55Model, isMoonshotModel, normalizeBaseUrl, shouldSuppressReasoningContent, } from "./discover.js";
+import { discoverModels, emitsThinkTags, isGpt55Model, isMoonshotModel, normalizeBaseUrl } from "./discover.js";
 import { getGcloudToken, getGcloudTokenCacheKey, getGcloudTokenCommand, isGcloudTokenAuthEnabled, } from "./gcloud-token.js";
 import { getSessionIdFromFile } from "./litellm.js";
 import { createMcpToolDefinitions } from "./mcp-tools.js";
@@ -335,7 +335,7 @@ async function resolveCredentials(definition, { executeHelpers = true } = {}) {
         apiKeyConfig = `$${ENV_API_KEY}`;
     }
     return {
-        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase) : undefined,
+        baseUrl: configuredBase ? normalizeBaseUrl(configuredBase, definition.allowInsecureHttp) : undefined,
         apiKey: apiKey || undefined,
         apiKeyConfig,
     };
@@ -393,6 +393,7 @@ function getProviderDefinitions(settings) {
         useDefaultEnv: isDefault,
         useGcloudTokenAuth: isDefault,
         enableOAuth: isDefault,
+        allowInsecureHttp: raw?.allowInsecureHttp === true,
     });
     const definitions = [makeDefinition(PROVIDER_NAME, defaultSettings, true)];
     for (const [name, raw] of Object.entries(providerSettings ?? {})) {
@@ -405,7 +406,51 @@ function getProviderDefinitions(settings) {
     }
     return definitions;
 }
-async function loginApiKey(interaction) {
+const DIFFERENT_BASE_URL = "enter-a-different-url";
+/**
+ * The proxy URL is the one thing a user has to retype on every re-login, and an expired SSO token is
+ * the common reason to re-login. Offer whatever we already know: settings, env, or the credential the
+ * dead session was issued against.
+ */
+function knownBaseUrl(definition) {
+    const stored = readStoredCredential(definition.name, join(getAgentDir(), "auth.json"));
+    const candidates = [
+        [cleanConfig(definition.baseUrl), "configured"],
+        [definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined, `$${ENV_BASE_URL}`],
+        [
+            stored?.type === "oauth"
+                ? cleanConfig(typeof stored.baseUrl === "string" ? stored.baseUrl : undefined)
+                : cleanConfig(stored?.env?.[ENV_BASE_URL]),
+            "previous login",
+        ],
+    ];
+    for (const [candidate, source] of candidates) {
+        if (!candidate)
+            continue;
+        try {
+            return { url: normalizeBaseUrl(candidate, definition.allowInsecureHttp), source };
+        }
+        catch {
+            // A URL we could not use anyway is not worth offering; try the next candidate.
+        }
+    }
+    return undefined;
+}
+async function promptBaseUrl(interaction, definition) {
+    const known = knownBaseUrl(definition);
+    if (known) {
+        const choice = await interaction.prompt({
+            type: "select",
+            message: "LiteLLM proxy URL:",
+            // Pi's login selector renders labels only, so the source has to ride along in the label.
+            options: [
+                { id: known.url, label: `${known.url} (${known.source})` },
+                { id: DIFFERENT_BASE_URL, label: "Enter a different URL…" },
+            ],
+        });
+        if (choice === known.url)
+            return known.url;
+    }
     const rawBaseUrl = (await interaction.prompt({
         type: "text",
         message: "Enter LiteLLM proxy URL (no trailing /v1):",
@@ -413,10 +458,14 @@ async function loginApiKey(interaction) {
     })).trim();
     if (!rawBaseUrl)
         throw new Error("Base URL is required");
+    return normalizeBaseUrl(rawBaseUrl, definition.allowInsecureHttp);
+}
+async function loginApiKey(interaction, definition) {
+    const baseUrl = await promptBaseUrl(interaction, definition);
     const key = (await interaction.prompt({ type: "secret", message: "Enter API key:" })).trim();
     if (!key)
         throw new Error("Both base URL and API key are required");
-    return { type: "api_key", key, env: { [ENV_BASE_URL]: normalizeBaseUrl(rawBaseUrl) } };
+    return { type: "api_key", key, env: { [ENV_BASE_URL]: baseUrl } };
 }
 async function startCliSso(baseUrl, signal, headers) {
     const response = await fetch(`${baseUrl}/sso/cli/start`, {
@@ -559,15 +608,9 @@ async function loginWithPastedToken(interaction, baseUrl, headers) {
     }
     return { type: "oauth", access, refresh: "", expires, baseUrl };
 }
-async function loginOAuth(interaction, headers) {
-    const rawBaseUrl = (await interaction.prompt({
-        type: "text",
-        message: "Enter LiteLLM proxy URL (no trailing /v1):",
-        placeholder: "https://litellm.example.com",
-    })).trim();
-    if (!rawBaseUrl)
-        throw new Error("Base URL is required");
-    const baseUrl = normalizeBaseUrl(rawBaseUrl);
+async function loginOAuth(interaction, definition) {
+    const headers = resolveHeaders(definition);
+    const baseUrl = await promptBaseUrl(interaction, definition);
     const cliSso = await startCliSso(baseUrl, interaction.signal, headers);
     if (!cliSso)
         return loginWithPastedToken(interaction, baseUrl, headers);
@@ -610,7 +653,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
     if (stored) {
         source = "stored credential";
         creds = {
-            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl) : undefined,
+            baseUrl: baseUrl ? normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) : undefined,
             apiKey: stored,
         };
     }
@@ -647,7 +690,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             }
         }
         if (!creds.baseUrl && baseUrl)
-            creds.baseUrl = normalizeBaseUrl(baseUrl);
+            creds.baseUrl = normalizeBaseUrl(baseUrl, definition.allowInsecureHttp);
     }
     if (!creds.apiKey)
         return undefined;
@@ -657,7 +700,7 @@ async function resolveApiKeyAuth(definition, ctx, credential, executeHelpers = t
             baseUrl: creds.baseUrl ? `${creds.baseUrl}/v1` : undefined,
             headers: await resolveHeadersFromContext(definition, ctx.env),
         },
-        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl) } : undefined,
+        env: baseUrl ? { [ENV_BASE_URL]: normalizeBaseUrl(baseUrl, definition.allowInsecureHttp) } : undefined,
         source: source ?? creds.apiKeyConfig ?? ENV_API_KEY,
     };
 }
@@ -665,7 +708,7 @@ function createProviderAuth(definition) {
     return {
         apiKey: {
             name: `${definition.displayName} API key`,
-            login: definition.name === PROVIDER_NAME ? loginApiKey : undefined,
+            login: definition.name === PROVIDER_NAME ? (interaction) => loginApiKey(interaction, definition) : undefined,
             check: async ({ ctx, credential }) => {
                 const baseUrl = credential?.env?.[ENV_BASE_URL] ??
                     definition.baseUrl ??
@@ -701,14 +744,16 @@ function createProviderAuth(definition) {
             ? {
                 name: "LiteLLM SSO",
                 loginLabel: "Sign in with LiteLLM SSO",
-                login: (interaction) => loginOAuth(interaction, resolveHeaders(definition)),
+                login: (interaction) => loginOAuth(interaction, definition),
                 refresh: async (credential, signal) => ({
                     ...(await refreshLiteLLM(credential, signal)),
                     type: "oauth",
                 }),
                 toAuth: async (credential) => ({
                     apiKey: credential.access,
-                    baseUrl: credential.baseUrl ? `${normalizeBaseUrl(String(credential.baseUrl))}/v1` : undefined,
+                    baseUrl: credential.baseUrl
+                        ? `${normalizeBaseUrl(String(credential.baseUrl), definition.allowInsecureHttp)}/v1`
+                        : undefined,
                     headers: resolveHeaders(definition),
                 }),
             }
@@ -777,7 +822,9 @@ const REASONING_SUPPRESSION_DEFAULTS = {
     thinking: { type: "disabled" },
 };
 const GEMINI_MODEL_PATTERN = /(?:^|[-_/.:])gemini(?=$|[-_/.:])/i;
-function prepareLiteLLMRequestPayload(payload, modelId, api, sessionId) {
+function prepareLiteLLMRequestPayload(payload, model, sessionId) {
+    const modelId = model?.id;
+    const api = model?.api;
     let next;
     const update = (key, value) => {
         if (payload[key] !== undefined)
@@ -785,7 +832,7 @@ function prepareLiteLLMRequestPayload(payload, modelId, api, sessionId) {
         next ??= { ...payload };
         next[key] = value;
     };
-    if (api !== "openai-responses" && modelId && shouldSuppressReasoningContent(modelId)) {
+    if (api !== "openai-responses" && model?.suppressReasoningContent === true) {
         for (const [key, value] of Object.entries(REASONING_SUPPRESSION_DEFAULTS)) {
             if (key !== "thinking")
                 update(key, value);
@@ -862,7 +909,7 @@ function prepareLiteLLMRequestPayload(payload, modelId, api, sessionId) {
     return next;
 }
 function normalizeThinkTags(message, litellmProviderNames) {
-    if (!litellmProviderNames.has(message.provider) || !shouldSuppressReasoningContent(message.model))
+    if (!litellmProviderNames.has(message.provider) || !emitsThinkTags(message.model))
         return;
     let changed = false;
     const content = [];
@@ -939,23 +986,29 @@ export default async function (pi) {
         const baseUrl = cleanConfig(definition.baseUrl) ??
             (definition.useDefaultEnv ? cleanConfig(process.env[ENV_BASE_URL]) : undefined) ??
             "https://litellm.example.com";
-        return `${normalizeBaseUrl(baseUrl)}/v1`;
+        return `${normalizeBaseUrl(baseUrl, definition.allowInsecureHttp)}/v1`;
     }
     async function authForCredential(definition, credential, executeHelpers = true) {
         if (credential?.type === "oauth") {
             const baseUrl = typeof credential.baseUrl === "string"
-                ? normalizeBaseUrl(credential.baseUrl)
-                : normalizeBaseUrl(requestBaseUrl(definition));
-            return { baseUrl, apiKey: credential.access, headers: resolveHeaders(definition) };
+                ? normalizeBaseUrl(credential.baseUrl, definition.allowInsecureHttp)
+                : normalizeBaseUrl(requestBaseUrl(definition), definition.allowInsecureHttp);
+            return {
+                baseUrl,
+                apiKey: credential.access,
+                headers: resolveHeaders(definition),
+                allowInsecureHttp: definition.allowInsecureHttp,
+            };
         }
         const resolved = await resolveApiKeyAuth(definition, { env: async (name) => process.env[name] }, credential, executeHelpers);
         if (!resolved?.auth.apiKey) {
             throw new Error(`no credentials for ${definition.name}. Run /login litellm or set env vars.`);
         }
         return {
-            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition)),
+            baseUrl: normalizeBaseUrl(resolved.auth.baseUrl ?? requestBaseUrl(definition), definition.allowInsecureHttp),
             apiKey: resolved.auth.apiKey,
             headers: resolved.auth.headers,
+            allowInsecureHttp: definition.allowInsecureHttp,
         };
     }
     let registeredMcpIdentity;
@@ -963,7 +1016,7 @@ export default async function (pi) {
     let defaultRuntimeAuth;
     function mcpCatalogIdentity(auth) {
         return JSON.stringify({
-            baseUrl: normalizeBaseUrl(auth.baseUrl),
+            baseUrl: normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp),
             apiKey: auth.apiKey,
             headers: Object.entries(auth.headers ?? {}).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
         });
@@ -979,9 +1032,10 @@ export default async function (pi) {
             return undefined;
         const headers = Object.fromEntries(Object.entries(auth.auth.headers ?? provider?.headers ?? {}).filter((entry) => typeof entry[1] === "string"));
         return {
-            baseUrl: normalizeBaseUrl(baseUrl),
+            baseUrl: normalizeBaseUrl(baseUrl, definitions[0]?.allowInsecureHttp),
             apiKey,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
+            allowInsecureHttp: definitions[0]?.allowInsecureHttp,
         };
     }
     async function resolveDefaultRuntimeAuth(ctx) {
@@ -1056,11 +1110,12 @@ export default async function (pi) {
             timeoutMs: getDiscoveryTimeoutMs(),
             signal,
             headers: auth.headers,
+            allowInsecureHttp: auth.allowInsecureHttp,
             silent: !isVerboseDiscovery(),
             onProgress: isVerboseDiscovery() ? (message) => process.stderr.write(`LiteLLM: ${message}\n`) : undefined,
         });
         signal?.throwIfAborted();
-        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl)}/v1` };
+        return { ...result, baseUrl: `${normalizeBaseUrl(auth.baseUrl, auth.allowInsecureHttp)}/v1` };
     }
     // Pi's startup path only ever refreshes with allowNetwork:false, and it returns before the
     // network phase, so the provider would stay empty until the user opens /model. Discover here
@@ -1133,7 +1188,7 @@ export default async function (pi) {
             return;
         if (typeof event.payload !== "object" || event.payload === null)
             return;
-        return prepareLiteLLMRequestPayload(event.payload, ctx.model?.id, ctx.model?.api, sessionId);
+        return prepareLiteLLMRequestPayload(event.payload, ctx.model, sessionId);
     });
     // Skills enrichment is best-effort: an expired credential or an unreachable proxy must not
     // report an extension error on every turn. The failing model request states the real problem.
@@ -1147,7 +1202,7 @@ export default async function (pi) {
             if (!auth)
                 return;
             defaultRuntimeAuth = auth;
-            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+            const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
             section = createSkillsPromptSection(skills);
         }
         catch (error) {

package/dist/mcp-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMMcpTool, LiteLLMRuntimeAuth } from "./types.js";
-export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal): Promise<LiteLLMMcpTool[]>;
-export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>): Promise<string>;
+export declare function discoverMcpTools(baseUrl: string, apiKey: string, headers?: Record<string, string>, onProgress?: (message: string) => void, parentSignal?: AbortSignal, allowInsecureHttp?: boolean): Promise<LiteLLMMcpTool[]>;
+export declare function executeMcpTool(baseUrl: string, apiKey: string, serverId: string, toolName: string, args: Record<string, unknown>, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<string>;
 export declare function createMcpToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>, onProgress?: (message: string) => void, signal?: AbortSignal): Promise<ToolDefinition[]>;

package/dist/mcp-tools.js

@@ -49,11 +49,11 @@ function normalizeMcpTool(value) {
         input_schema: inputSchema,
     };
 }
-export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal) {
+export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, parentSignal, allowInsecureHttp = false) {
     onProgress?.("Discovering MCP tools from server...");
     try {
         onProgress?.("Querying MCP tools/list endpoint...");
-        const response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/list`, {
+        const response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/list`, {
             headers: {
                 ...headers,
                 Authorization: `Bearer ${apiKey}`,
@@ -80,9 +80,9 @@ export async function discoverMcpTools(baseUrl, apiKey, headers, onProgress, par
         throw error;
     }
 }
-export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers) {
+export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     for (let attempt = 0; attempt <= MCP_RETRY_ATTEMPTS; attempt++) {
-        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers);
+        const result = await executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp);
         if (attempt < MCP_RETRY_ATTEMPTS && result.retryable) {
             await sleep(MCP_RETRY_DELAY_MS);
             continue;
@@ -91,11 +91,11 @@ export async function executeMcpTool(baseUrl, apiKey, serverId, toolName, args,
     }
     return `Error calling ${toolName} on ${serverId}: retry attempts exhausted`;
 }
-async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers) {
+async function executeMcpToolOnce(baseUrl, apiKey, serverId, toolName, args, headers, allowInsecureHttp = false) {
     try {
         let response;
         try {
-            response = await fetch(`${normalizeBaseUrl(baseUrl)}/mcp-rest/tools/call`, {
+            response = await fetch(`${normalizeBaseUrl(baseUrl, allowInsecureHttp)}/mcp-rest/tools/call`, {
                 method: "POST",
                 headers: {
                     ...headers,
@@ -152,7 +152,7 @@ function buildParameters(inputSchema) {
 }
 export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
     const discoveryAuth = await getAuth();
-    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal);
+    const tools = await discoverMcpTools(discoveryAuth.baseUrl, discoveryAuth.apiKey, discoveryAuth.headers, onProgress, signal, discoveryAuth.allowInsecureHttp);
     return tools.map((mcpTool) => {
         const safeServer = sanitizeName(mcpTool.server_name);
         const safeTool = sanitizeName(mcpTool.name);
@@ -170,7 +170,7 @@ export async function createMcpToolDefinitions(getAuth, onProgress, signal) {
                 const args = Object.keys(rawParams).length === 1 && rawParams.args && typeof rawParams.args === "object"
                     ? rawParams.args
                     : rawParams;
-                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers);
+                const text = await executeMcpTool(auth.baseUrl, auth.apiKey, mcpTool.server_id ?? mcpTool.server_name, mcpTool.name, args, auth.headers, auth.allowInsecureHttp);
                 return {
                     content: [{ type: "text", text }],
                     details: { server: mcpTool.server_name, serverId: mcpTool.server_id, tool: mcpTool.name },

package/dist/provider.d.ts

@@ -1,5 +1,5 @@
-import { type Credential, type Model, type Provider, type ProviderAuth } from "@earendil-works/pi-ai";
-import type { DiscoveredModel, DiscoveryResult, LiteLLMApi } from "./types.js";
+import { type Credential, type Provider, type ProviderAuth } from "@earendil-works/pi-ai";
+import type { DiscoveredModel, DiscoveryResult, LiteLLMApi, LiteLLMModel } from "./types.js";
 export type LiteLLMProviderOptions = {
     id: string;
     name: string;
@@ -7,10 +7,10 @@ export type LiteLLMProviderOptions = {
     auth: ProviderAuth;
     /** Catalog discovered during activation. Pi's startup refresh never allows network access, so
      * without a seed the provider stays empty until the user opens /model. */
-    models?: readonly Model<LiteLLMApi>[];
+    models?: readonly LiteLLMModel[];
     discover(credential: Credential, signal?: AbortSignal): Promise<DiscoveryResult & {
         baseUrl?: string;
     }>;
 };
-export declare function toNativeModels(provider: string, baseUrl: string, models: readonly DiscoveredModel[]): Model<LiteLLMApi>[];
+export declare function toNativeModels(provider: string, baseUrl: string, models: readonly DiscoveredModel[]): LiteLLMModel[];
 export declare function createLiteLLMProvider(options: LiteLLMProviderOptions): Provider<LiteLLMApi>;

package/dist/skills.d.ts

@@ -1,14 +1,14 @@
 import { type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { LiteLLMRuntimeAuth, LiteLLMSkill } from "./types.js";
-export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>): Promise<LiteLLMSkill[]>;
+export declare function listSkills(baseUrl: string, apiKey: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<LiteLLMSkill[]>;
 export declare function createSkill(baseUrl: string, apiKey: string, input: {
     name: string;
     description?: string;
     source?: Record<string, unknown>;
     code?: string;
     inputSchema?: Record<string, unknown>;
-}, headers?: Record<string, string>): Promise<unknown>;
-export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>): Promise<void>;
+}, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<unknown>;
+export declare function deleteSkill(baseUrl: string, apiKey: string, skillId: string, headers?: Record<string, string>, allowInsecureHttp?: boolean): Promise<void>;
 export declare function createSkillsPromptSection(skills: LiteLLMSkill[]): string | undefined;
 export declare function createSkillToolDefinitions(getAuth: (ctx?: ExtensionContext) => Promise<LiteLLMRuntimeAuth>): ToolDefinition[];
 export declare function resetSkillsCache(): void;

package/dist/skills.js

@@ -17,8 +17,8 @@ function getSkillsFromBody(body) {
     }
     return [];
 }
-export async function listSkills(baseUrl, apiKey, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function listSkills(baseUrl, apiKey, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     if (skillsCache &&
         skillsCache.baseUrl === normalizedBaseUrl &&
         skillsCache.apiKey === apiKey &&
@@ -46,10 +46,10 @@ export async function listSkills(baseUrl, apiKey, headers) {
     skillsCache = { baseUrl: normalizedBaseUrl, apiKey, fetchedAt: Date.now(), skills };
     return skills;
 }
-export async function createSkill(baseUrl, apiKey, input, headers) {
+export async function createSkill(baseUrl, apiKey, input, headers, allowInsecureHttp = false) {
     if (!input.source && !input.code)
         throw new Error("code is required when source is omitted");
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let usedSkillHub = input.source !== undefined;
     const skillHubPayload = input.source
         ? {
@@ -105,8 +105,8 @@ export async function createSkill(baseUrl, apiKey, input, headers) {
     }
     return response.json().catch(() => ({}));
 }
-export async function deleteSkill(baseUrl, apiKey, skillId, headers) {
-    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+export async function deleteSkill(baseUrl, apiKey, skillId, headers, allowInsecureHttp = false) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl, allowInsecureHttp);
     let skillHubError;
     const skillHubResponse = await fetch(`${normalizedBaseUrl}/claude-code/plugins/${encodeURIComponent(skillId)}`, {
         method: "DELETE",
@@ -182,7 +182,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: Type.Object({}),
             async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers);
+                const skills = await listSkills(auth.baseUrl, auth.apiKey, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: formatSkills(skills) }], details: { count: skills.length } };
             },
         }),
@@ -203,7 +203,7 @@ export function createSkillToolDefinitions(getAuth) {
                     source,
                     code: params.code,
                     inputSchema,
-                }, auth.headers);
+                }, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: "LiteLLM skill created." }], details: { result } };
             },
         }),
@@ -214,7 +214,7 @@ export function createSkillToolDefinitions(getAuth) {
             parameters: DeleteSkillParams,
             async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
                 const auth = await getAuth(ctx);
-                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers);
+                await deleteSkill(auth.baseUrl, auth.apiKey, params.skillId, auth.headers, auth.allowInsecureHttp);
                 return { content: [{ type: "text", text: `LiteLLM skill deleted: ${params.skillId}` }], details: {} };
             },
         }),

package/dist/types.d.ts

@@ -5,9 +5,14 @@ export type LiteLLMRuntimeAuth = {
     baseUrl: string;
     apiKey: string;
     headers?: Record<string, string>;
+    allowInsecureHttp?: boolean;
 };
 export type DiscoveredModel = Omit<Model<"openai-completions">, "provider" | "api" | "baseUrl"> & {
     api?: LiteLLMApi;
+    suppressReasoningContent?: boolean;
+};
+export type LiteLLMModel = Model<LiteLLMApi> & {
+    suppressReasoningContent?: boolean;
 };
 export interface DiscoveryResult {
     models: DiscoveredModel[];
@@ -17,9 +22,14 @@ export interface DiscoveryOptions {
     timeoutMs?: number;
     signal?: AbortSignal;
     headers?: Record<string, string>;
+    allowInsecureHttp?: boolean;
 }
 export interface ModelInfoEntry {
     model_name?: string;
+    litellm_params?: {
+        model?: string;
+        custom_llm_provider?: string;
+    };
     model_info?: {
         mode?: string | null;
         input_cost_per_token?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-provider-litellm",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "LiteLLM proxy provider extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -46,7 +46,7 @@
     "typecheck": "tsgo --noEmit",
     "lint": "biome check --error-on-warnings .",
     "format": "biome check --write .",
-    "test": "vitest --run",
+    "test": "vitest --run --dir tests",
     "supply-chain:guard": "tsx scripts/supply-chain-guard.ts",
     "check": "npm run lint && npm run typecheck && npm test",
     "prepublishOnly": "npm run check && npm run clean && npm run build && npm run supply-chain:guard"