fix: load extension source for git installs - #2

📄 CodeRabbit inference engine (AGENTS.md)

tests/**/*.test.ts: Keep tests as Vitest specifications under tests/.
Keep regression and feature tests current for discovery fallbacks, compatibility metadata, and Kimi/Moonshot normalization.

Files:

• tests/terminal-smoke.test.ts
• tests/package.test.ts
• tests/litellm-smoke-workflow.test.ts
• tests/supply-chain-guard.test.ts

📄 CodeRabbit inference engine (AGENTS.md)

Reject install lifecycle scripts, runtime dependencies, non-registry specifications, non-registry lockfile URLs, and unexpected package files.

Files:

• scripts/supply-chain-guard.ts

📄 CodeRabbit inference engine (AGENTS.md)

package.json: Keep Git installs loading ./src/index.ts through pi.extensions and npm consumers using the compiled ./dist/index.js entrypoint.
Keep the Pi gallery image URL exactly as declared unless explicitly requested to change it.
Limit the npm package to src, dist, README.md, and LICENSE; do not include gallery assets unless explicitly requested.
Keep package.json and package-lock.json versions synchronized for releases.
Use a tag-driven v*.*.* release workflow that publishes with npm publish --access public --provenance and creates a GitHub release.

Files:

• package.json

📄 CodeRabbit inference engine (AGENTS.md)

CI must run npm ci and npm run prepublishOnly.

Files:

• .github/workflows/litellm-smoke.yml

📄 CodeRabbit inference engine (AGENTS.md)

.github/workflows/litellm-smoke.yml: LiteLLM smoke tests must use VidaiMock and a real LiteLLM proxy without requiring real provider API keys.
Keep smoke readiness probes bounded with curl --connect-timeout 1 --max-time 3.

Files:

• .github/workflows/litellm-smoke.yml

[warning] 47-47: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(^dist/(?:${sourceModules})\\.(?:js|d\\.ts)$)
Note: [CWE-1333] Inefficient Regular Expression Complexity

(regexp-from-variable)

[warning] 48-48: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(^src/(?:${sourceModules})\\.ts$)
Note: [CWE-1333] Inefficient Regular Expression Complexity

(regexp-from-variable)

[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(detect-child-process-typescript)

[error] 1-1: Vitest failed: Terminal smoke test 'logs in and selects LiteLLM models' ended before visible terminal included "Warning: No models available". Error: TerminalControlError at node_modules/@kitlangton/terminal-control/src/index.ts:331:25

[error] 1-1: Vitest failed: TerminalControlError: session ended before visible terminal included "Warning: No models available" (test "logs in and selects LiteLLM models"). Step/command: "npm test -- tests/terminal-smoke.test.ts".

[style] ~19-~19: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... when changing exported/runtime code. - Use npm run supply-chain:guard and `npm p...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

📄 CodeRabbit inference engine (AGENTS.md)

Keep tests as Vitest specification files under tests/.

Files:

• tests/gcloud-token.test.ts
• tests/litellm-smoke-workflow.test.ts
• tests/provider.test.ts

📄 CodeRabbit inference engine (AGENTS.md)

Run the full test suite with npm test; use npm test -- tests/<file>.test.ts for focused Vitest runs.

Files:

• tests/gcloud-token.test.ts
• src/gcloud-token.ts
• src/provider.ts
• tests/litellm-smoke-workflow.test.ts
• tests/provider.test.ts

📄 CodeRabbit inference engine (AGENTS.md)

Run npm run check before committing code changes; it runs Biome, typechecking, and tests.

Files:

• tests/gcloud-token.test.ts
• src/gcloud-token.ts
• src/provider.ts
• tests/litellm-smoke-workflow.test.ts
• tests/provider.test.ts

📄 CodeRabbit inference engine (AGENTS.md)

CI must run npm ci and npm run prepublishOnly.

Files:

• .github/workflows/litellm-smoke.yml

📄 CodeRabbit inference engine (AGENTS.md)

.github/workflows/litellm-smoke.yml: The LiteLLM smoke workflow must use VidaiMock and a real LiteLLM proxy without requiring real provider API keys.
Keep smoke readiness probes bounded with curl --connect-timeout 1 --max-time 3.

Files:

• .github/workflows/litellm-smoke.yml

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.ts: Keep Pi extension source as TypeScript ESM under src/; the litellm provider is registered from src/index.ts.
Model discovery lives in src/discover.ts; prefer /model/info for rich metadata and fall back to /v1/models only for HTTP 401, 403, or 404.
Keep /v1/models fallback metadata enrichment from the Pi catalog and https://models.dev/api.json covered by current tests.
Preserve documented behavior for LITELLM_OFFLINE and LITELLM_DISCOVERY_TIMEOUT_MS.
Stored Pi /login litellm credentials take precedence over LITELLM_API_KEY.
Store cache data as litellm-models.json under the Pi agent directory, keyed by an API-key fingerprint, with a 24-hour stale refresh window.
In the global before_provider_request hook, mutate provider payloads only when ctx.model?.provider === "litellm".
Do not add user-facing flags or environment variables to hide provider-scoping bugs.
Treat litellm_session_id as optional LiteLLM session metadata; if LiteLLM-routed requests reject it, preserve Pi requests and document the admin recommendation separately.
Normalize Kimi/Moonshot <think> text for Pi in the message_end hook and maintain feature-test coverage.
Put provider-specific request compatibility in discovered model compat metadata rather than broad runtime mutation.
Handle Kimi/Moonshot-style models in buildCompat() and keep regression tests with model discovery changes.
Set cacheControlFormat: "anthropic" for Anthropic-backed aliases so Pi forwards prompt-cache markers through LiteLLM.

Files:

• src/gcloud-token.ts
• src/provider.ts