Tencent · zwliJay · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
@@ -0,0 +1,35 @@
+name: Gitleaks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan Git history
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install and run gitleaks
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=8.30.1
+          archive="gitleaks_${version}_linux_x64.tar.gz"
+          download="https://github.com/gitleaks/gitleaks/releases/download/v${version}/${archive}"
+
+          curl --fail --location --retry 5 --retry-all-errors \
+            --output "${RUNNER_TEMP}/${archive}" "${download}"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  ${RUNNER_TEMP}/${archive}" \
+            | sha256sum --check --strict
+          tar --extract --gzip --file "${RUNNER_TEMP}/${archive}" \
+            --directory "${RUNNER_TEMP}" gitleaks
+
+          "${RUNNER_TEMP}/gitleaks" git --no-banner --redact .
diff --git a/README.md b/README.md
@@ -51,7 +51,7 @@
 
 ## News
 
-- **[2026-08-08] 🚀 Unified LiteLLM gateway.** SkillHone now accepts one
+- **[2026-08-08] Unified LiteLLM gateway.** SkillHone now accepts one
   `provider/model` configuration across Anthropic, DeepSeek, OpenAI, Gemini,
   and other LiteLLM providers—no external Anthropic-compatible endpoint or
   transport switch required. Improver, executor, and synthesis can each use
@@ -247,30 +247,27 @@ assistant these values when you install — it will write the right
 
 | Role | Required? | What it does |
 |---|---|---|
-| **Optimizer** | required | Drives the optimisation loop — proposes patches to the skill. |
-| **Executor** | optional, defaults to Optimizer | Runs the skill being tested on each probe. |
-| **Tester**   | optional, defaults to Optimizer | Scores / judges the executor's output. |
-
-If you use Anthropic directly, just give the assistant your
-Anthropic API key — `claude-agent-sdk` uses Anthropic's official
-endpoint by default. **Only when you route through a third-party
-Anthropic-compatible provider** (e.g. DeepSeek) do you need to
-fill the three fields per role: `base_url` (Anthropic-format),
-`api_key`, `model_name`. Example:
-
-```ini
-base_url   = https://api.deepseek.com/anthropic
-api_key    = sk-xxx
-model_name = deepseek-v4-pro
-```
+| **Improver** | required | Drives the optimisation loop — proposes patches to the skill. |
+| **Executor** | optional, defaults to Improver | Runs the skill being tested on each probe. |
+| **Synthesis** | optional, defaults to Improver | Generates evaluation data when using the synthesis workflow. |
+
+For each role, provide an `api_key` and a LiteLLM `provider/model` name. Add
+`api_base` only when the provider needs a non-default upstream endpoint. Each
+role can use independent credentials and endpoints; omitted optional roles
+reuse the Improver profile.
 
-Model profiles use LiteLLM's `provider/model` naming. SkillHone starts a
-private local bridge and supplies its Anthropic Messages endpoint to Claude
-Agent SDK automatically—no transport switch or external Anthropic-compatible
-endpoint is needed. This also covers Anthropic models (`anthropic/claude-…`):
+SkillHone starts a loopback-only LiteLLM bridge and supplies its Anthropic
+Messages endpoint to Claude Agent SDK automatically. You do not need to run a
+proxy or find an Anthropic-compatible endpoint. The same configuration covers
+DeepSeek, Anthropic, OpenAI, Gemini, and other LiteLLM providers:
 
 ```jsonc
-{"improver":{"model":"deepseek/deepseek-chat","api_key":"sk-xxx","api_base":"https://api.deepseek.com/v1"}}
+{
+  "improver": {
+    "model": "deepseek/deepseek-chat",
+    "api_key": "sk-xxx"
+  }
+}
 ```
 
 Full schema, multi-identity Forgejo tokens, and the `~/.skillhone/`

diff --git a/docs/README.zh.md b/docs/README.zh.md
@@ -50,7 +50,7 @@
 
 ## 最新动态
 
-- **[2026-08-08] 🚀 统一 LiteLLM 模型网关。** SkillHone 现已使用一套
+- **[2026-08-08] 统一 LiteLLM 模型网关。** SkillHone 现已使用一套
   `provider/model` 配置连接 Anthropic、DeepSeek、OpenAI、Gemini 及其他
   LiteLLM provider，无需外部 Anthropic-compatible endpoint，也无需切换
   transport。Improver、Executor 和 Synthesis 可分别使用独立凭据与上游
@@ -229,29 +229,26 @@ AI 助手就行，剩下的 `~/.skillhone/settings.json` 它会自己写。
 
 | 角色 | 是否必填 | 作用 |
 |---|---|---|
-| **Optimizer** | 必填 | 驱动优化闭环 —— 给技能写补丁。 |
-| **Executor**  | 可选，不填则与 Optimizer 一致 | 在每条 probe 上运行被测技能。 |
-| **Tester**    | 可选，不填则与 Optimizer 一致 | 给执行结果打分 / 判定。 |
-
-如果直接走 Anthropic 官方,只需要给 AI 助手一个 Anthropic API
-key 即可 —— `claude-agent-sdk` 默认就走 Anthropic 官方 endpoint。
-**只有在你需要把流量转到第三方 Anthropic 兼容代理时**(例如
-DeepSeek),才需要每个角色填三个字段:`base_url`(Anthropic
-格式)、`api_key`、`model_name`。例如:
-
-```ini
-base_url   = https://api.deepseek.com/anthropic
-api_key    = sk-xxx
-model_name = deepseek-v4-pro
-```
+| **Improver** | 必填 | 驱动优化闭环 —— 给技能写补丁。 |
+| **Executor** | 可选，不填则与 Improver 一致 | 在每条 probe 上运行被测技能。 |
+| **Synthesis** | 可选，不填则与 Improver 一致 | 在使用数据合成工作流时生成评测数据。 |
+
+每个角色只需提供 `api_key` 和 LiteLLM 的 `provider/model` 名称；仅当
+provider 需要非默认上游地址时才填写 `api_base`。不同角色可以使用各自
+独立的凭据和上游地址，省略的可选角色会复用 Improver 配置。
 
-模型统一使用 LiteLLM 的 `provider/model` 名称，不再配置 transport。
-SkillHone 会自动启动仅监听本机的转换代理，
-并把 Anthropic Messages 地址注入 Claude Agent SDK，无需用户自行部署
-Anthropic-compatible endpoint：
+SkillHone 会自动启动仅监听本机的 LiteLLM 转换代理，并把 Anthropic
+Messages 地址注入 Claude Agent SDK。用户无需自行运行代理，也无需寻找
+Anthropic-compatible endpoint。同一套配置适用于 DeepSeek、Anthropic、
+OpenAI、Gemini 及其他 LiteLLM provider：
 
 ```jsonc
-{"improver":{"model":"deepseek/deepseek-chat","api_key":"sk-xxx","api_base":"https://api.deepseek.com/v1"}}
+{
+  "improver": {
+    "model": "deepseek/deepseek-chat",
+    "api_key": "sk-xxx"
+  }
+}
 ```
 
 完整字段、多身份 Forgejo token、以及 `~/.skillhone/` 下的目录结构都在

diff --git a/docs/install/developer.md b/docs/install/developer.md
@@ -96,86 +96,64 @@ attributes. Symlinks also work on regular filesystems.
 
 ## 4. Write `~/.skillhone/settings.json`
 
-Save this template, filling in the four bracketed values. The full schema lives
+Save this template with a LiteLLM `provider/model` name and credentials for
+each role. The full schema lives
 at [`skills/skillhone/references/configuration.md`](../../skills/skillhone/references/configuration.md).
 
 ```bash
 mkdir -p ~/.skillhone
 
 cat > ~/.skillhone/settings.json <<'EOF'
 {
-  "api_key": "<YOUR_API_KEY>",
-
   "forgejo": {
     "url":   "http://localhost:3000",
     "owner": "skillhone",
     "token": "<TOKEN_FROM_STEP_2>"
   },
 
   "improver": {
-    "api_base": "<ANTHROPIC_BASE_URL>",
-    "model":    "<IMPROVER_MODEL_NAME>",
+    "api_key":  "<IMPROVER_API_KEY>",
+    "model":    "<PROVIDER/MODEL>",
+    "api_base": "<OPTIONAL_UPSTREAM_ENDPOINT>",
     "sdk_model_alias": "opus",
     "max_turns": 100,
-    "env": {
-      "ANTHROPIC_BASE_URL":  "<ANTHROPIC_BASE_URL>",
-      "ANTHROPIC_API_KEY":   "<YOUR_API_KEY>",
-      "ANTHROPIC_MODEL":     "<IMPROVER_MODEL_NAME>",
-      "ANTHROPIC_DEFAULT_OPUS_MODEL":   "<IMPROVER_MODEL_NAME>",
-      "ANTHROPIC_DEFAULT_SONNET_MODEL": "<IMPROVER_MODEL_NAME>",
-      "ANTHROPIC_AUTH_TOKEN":     "",
-      "ANTHROPIC_CUSTOM_HEADERS": ""
-    }
+    "env": {}
   },
 
   "executor": {
-    "api_base": "<ANTHROPIC_BASE_URL>",
-    "model":    "<EXECUTOR_MODEL_NAME>",
+    "api_key":  "<EXECUTOR_API_KEY>",
+    "model":    "<PROVIDER/MODEL>",
+    "api_base": "<OPTIONAL_UPSTREAM_ENDPOINT>",
     "sdk_model_alias": "haiku",
     "workers": 2,
     "max_iterations": 150,
     "thinking_enabled": true,
     "context_size": 40000,
-    "env": {
-      "ANTHROPIC_BASE_URL":  "<ANTHROPIC_BASE_URL>",
-      "ANTHROPIC_API_KEY":   "<YOUR_API_KEY>",
-      "ANTHROPIC_MODEL":     "<EXECUTOR_MODEL_NAME>",
-      "ANTHROPIC_DEFAULT_HAIKU_MODEL": "<EXECUTOR_MODEL_NAME>",
-      "ANTHROPIC_AUTH_TOKEN":     "",
-      "ANTHROPIC_CUSTOM_HEADERS": ""
-    }
+    "env": {}
   },
 
   "synthesis": {
-    "api_base": "<ANTHROPIC_BASE_URL>",
-    "model":    "<IMPROVER_MODEL_NAME>",
+    "api_key":  "<SYNTHESIS_API_KEY>",
+    "model":    "<PROVIDER/MODEL>",
+    "api_base": "<OPTIONAL_UPSTREAM_ENDPOINT>",
     "workers":  2,
-    "env": {
-      "ANTHROPIC_BASE_URL":  "<ANTHROPIC_BASE_URL>",
-      "ANTHROPIC_API_KEY":   "<YOUR_API_KEY>",
-      "ANTHROPIC_MODEL":     "<IMPROVER_MODEL_NAME>",
-      "ANTHROPIC_AUTH_TOKEN":     "",
-      "ANTHROPIC_CUSTOM_HEADERS": ""
-    }
+    "env": {}
   }
 }
 EOF
 
 chmod 600 ~/.skillhone/settings.json
 ```
 
-Two things worth knowing:
-
-- **`ANTHROPIC_BASE_URL` is the prefix only.** The SDK appends `/v1/messages`
-  itself; strip any `/v1/messages` suffix your provider's docs hand you.
-- **The blank `ANTHROPIC_AUTH_TOKEN` / `ANTHROPIC_CUSTOM_HEADERS` is
-  deliberate.** They shadow any inherited shell env so the SDK uses
-  `ANTHROPIC_API_KEY` instead of a stale token from the parent shell — a
-  silent source of `401`s otherwise.
+`api_base` is optional: omit it to use LiteLLM's standard endpoint for the
+provider. For example, DeepSeek can use `deepseek/deepseek-chat` with no
+`api_base`; Anthropic can use an `anthropic/claude-...` model. SkillHone starts
+a loopback-only proxy and injects its Anthropic Messages endpoint into Claude
+Agent SDK automatically. Do not configure `ANTHROPIC_BASE_URL` yourself.
 
-If you talk to Anthropic directly, set `api_base` to `https://api.anthropic.com`
-and the model to a Claude model name. For DeepSeek's Anthropic-compatible
-endpoint, use `https://api.deepseek.com/anthropic` and `deepseek-v4-pro` / etc.
+The Executor and Synthesis sections are optional. Omit either section to reuse
+the Improver model profile. Prefer `api_key_env` over `api_key` when credentials
+are already managed in the process environment.
 
 ---
 

diff --git a/docs/install/skillhone.md b/docs/install/skillhone.md
@@ -78,30 +78,17 @@ SkillHone reads `~/.skillhone/settings.json` for its model credentials.
 The only thing you actually need from the user is **one set of model
 credentials** for the optimisation loop.
 
-**Default — Anthropic direct.** Ask only for an Anthropic API key.
-`claude-agent-sdk` uses Anthropic's official endpoint by default, so
-no `base_url` / `model_name` overrides are needed.
-
-**Third-party Anthropic-compatible providers** (e.g. DeepSeek).
-Only when the user explicitly routes through such a
-provider, ask for three fields:
+Ask for the provider API key and a LiteLLM `provider/model` identifier. Add an
+upstream `api_base` only when the provider does not use LiteLLM's default
+endpoint:
 
 | Required | Optional |
 |---|---|
-| **Optimizer LLM** — `base_url` (Anthropic-format), `api_key`, `model_name`. | **Executor LLM** — same three fields. If omitted, SkillHone reuses the optimizer settings for the eval solver. |
-
-Example values to ask for, in plain English:
-
-```
-base_url   = https://api.deepseek.com/anthropic
-api_key    = sk-xxx
-model_name = deepseek-v4-pro
-```
+| **Improver** — `api_key`, `model` (`provider/model`). | **Executor** and **Synthesis** — independent `api_key`, `model`, and optional `api_base`. Omitted roles reuse the Improver profile. |
 
-**Unified LiteLLM adapter (no Anthropic-compatible endpoint required).** Ask
-for the provider API key and a LiteLLM `provider/model` identifier. SkillHone
-starts and stops a loopback-only proxy automatically. Anthropic uses the same
-schema with an `anthropic/claude-...` model name:
+SkillHone starts and stops a loopback-only LiteLLM proxy automatically. The
+user does not need to run LiteLLM or supply an Anthropic-compatible endpoint.
+Anthropic uses the same schema with an `anthropic/claude-...` model name:
 
 ```jsonc
 {
@@ -118,8 +105,6 @@ schema with an `anthropic/claude-...` model name:
 }
 ```
 
-The user does not need to run LiteLLM or supply `ANTHROPIC_BASE_URL`.
-
 Then write `~/.skillhone/settings.json` yourself, following the schema in
 [`skills/skillhone/references/configuration.md`](../../skills/skillhone/references/configuration.md).