@elisym/cli 0.8.2 → 0.9.0

package/README.md

@@ -169,6 +169,9 @@ then return a concise overview and key points.
 | `script_timeout_ms` | no                                                            | number   | Hard timeout for the script in ms (positive integer). Default: `60000`. Script modes only.                                                                                                 |
 | `tools`             | no                                                            | object[] | External scripts the LLM can call via tool-use. `mode: llm` only.                                                                                                                          |
 | `max_tool_rounds`   | no                                                            | number   | Max LLM-tool interaction rounds per job. Default: `10`. `mode: llm` only.                                                                                                                  |
+| `provider`          | no                                                            | string   | Per-skill LLM provider override (`anthropic` or `openai`). Must be set together with `model`. Falls back to agent-level `llm.provider`. `mode: llm` only.                                  |
+| `model`             | no                                                            | string   | Per-skill model override (e.g. `gpt-5-mini`, `claude-haiku-4-5-20251001`). Must be set together with `provider`. Falls back to agent-level `llm.model`. `mode: llm` only.                  |
+| `max_tokens`        | no                                                            | number   | Per-skill max-tokens override (positive integer, max 200000). Independent of `provider`/`model`. Falls back to agent-level `llm.max_tokens`, then `4096`. `mode: llm` only.                |
 
 ### Tool definition
 
@@ -206,6 +209,12 @@ Everything after the closing `---` becomes the LLM system prompt. Describe the a
 
 When **every** loaded skill is non-LLM, `npx @elisym/cli start` skips the LLM-key check - a fully non-AI provider can run with no `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` configured.
 
+### Per-skill model / provider overrides
+
+Each `mode: llm` skill can route to a different model than the agent default. Declare `provider` + `model` (all-or-nothing) and/or `max_tokens` in the skill's frontmatter; whatever the skill omits inherits from `elisym.yaml` `llm`. If every LLM skill overrides fully, the agent-level `llm` block can be omitted entirely.
+
+API keys live in `secrets.anthropic_api_key` / `secrets.openai_api_key` (encrypted at rest when a passphrase is set), or come from the matching `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` env var. `npx @elisym/cli init` and `profile` let you configure both keys, so a skill that overrides to a non-default provider can ship alongside the agent default. See [`skills-examples/cheap-summarizer/`](./skills-examples/cheap-summarizer/SKILL.md) for a working example.
+
 Minimal non-LLM examples (drop `mode` to fall back to `llm`):
 
 ```markdown

package/dist/index.js

@@ -7,7 +7,6 @@ import { isAddress, createSolanaRpc, address } from '@solana/kit';
 import { generateSecretKey, getPublicKey, nip19, verifyEvent } from 'nostr-tools';
 import YAML from 'yaml';
 import { Command } from 'commander';
-import { isEncrypted } from '@elisym/sdk/node';
 import { createHash } from 'node:crypto';
 import { lookup } from 'node:dns/promises';
 import { Socket } from 'node:net';
@@ -140,16 +139,16 @@ async function cmdInit(nameArg, options = {}) {
     yaml = result.yaml;
     promptedApiKey = result.apiKey;
   }
-  let llmApiKey;
+  let defaultProviderKey;
   if (yaml.llm) {
     const envKey = yaml.llm.provider === "anthropic" ? process.env.ANTHROPIC_API_KEY : process.env.OPENAI_API_KEY;
     if (envKey) {
-      llmApiKey = envKey;
+      defaultProviderKey = envKey;
       console.log(
         `  Using ${yaml.llm.provider === "anthropic" ? "ANTHROPIC" : "OPENAI"}_API_KEY from environment.`
       );
     } else if (promptedApiKey) {
-      llmApiKey = promptedApiKey;
+      defaultProviderKey = promptedApiKey;
     } else {
       const { apiKey } = await inquirer.prompt([
         {
@@ -159,7 +158,38 @@ async function cmdInit(nameArg, options = {}) {
           mask: "*"
         }
       ]);
-      llmApiKey = apiKey || void 0;
+      defaultProviderKey = apiKey || void 0;
+    }
+  }
+  let otherProviderKey;
+  if (yaml.llm && !template) {
+    const otherProvider = yaml.llm.provider === "anthropic" ? "openai" : "anthropic";
+    const otherProviderLabel = otherProvider === "anthropic" ? "Anthropic" : "OpenAI";
+    const otherEnvVar = otherProvider === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY";
+    const otherEnvKey = process.env[otherEnvVar];
+    const { configureOther } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "configureOther",
+        message: `Configure ${otherProviderLabel} API key too (for skills that override the default provider)?`,
+        default: Boolean(otherEnvKey)
+      }
+    ]);
+    if (configureOther) {
+      if (otherEnvKey) {
+        otherProviderKey = otherEnvKey;
+        console.log(`  Using ${otherEnvVar} from environment.`);
+      } else {
+        const { promptedOther } = await inquirer.prompt([
+          {
+            type: "password",
+            name: "promptedOther",
+            message: `${otherProviderLabel} API key:`,
+            mask: "*"
+          }
+        ]);
+        otherProviderKey = promptedOther || void 0;
+      }
     }
   }
   let passphrase = "";
@@ -194,12 +224,15 @@ async function cmdInit(nameArg, options = {}) {
   const nostrPubkey = getPublicKey(nostrSecretBytes);
   const nostrSecretHex = Buffer.from(nostrSecretBytes).toString("hex");
   const created = await createAgentDir({ target, name: agentName, cwd });
+  const anthropicKey = yaml.llm?.provider === "anthropic" ? defaultProviderKey : otherProviderKey;
+  const openaiKey = yaml.llm?.provider === "openai" ? defaultProviderKey : otherProviderKey;
   await writeYaml(created.dir, yaml);
   await writeSecrets(
     created.dir,
     {
       nostr_secret_key: nostrSecretHex,
-      llm_api_key: llmApiKey
+      anthropic_api_key: anthropicKey,
+      openai_api_key: openaiKey
     },
     passphrase || void 0
   );
@@ -490,7 +523,7 @@ async function cmdProfile(name) {
         {
           type: "list",
           name: "llmProvider",
-          message: "LLM provider:",
+          message: "Default LLM provider (used by skills without a `provider:` override):",
           choices: [
             { name: "Anthropic (Claude)", value: "anthropic" },
             { name: "OpenAI (GPT)", value: "openai" }
@@ -498,16 +531,17 @@ async function cmdProfile(name) {
           default: loaded.yaml.llm?.provider ?? "anthropic"
         }
       ]);
+      const otherProvider = llmProvider === "anthropic" ? "openai" : "anthropic";
+      const defaultKeyStatus = describeKeyStatus(loaded.secrets, llmProvider);
       const { apiKey } = await inquirer.prompt([
         {
           type: "password",
           name: "apiKey",
-          message: "API key (leave empty to keep current):",
+          message: `${labelFor(llmProvider)} API key [${defaultKeyStatus}] (leave empty to keep current):`,
           mask: "*"
         }
       ]);
-      const currentKeyPlain = loaded.secrets.llm_api_key && !isEncrypted(loaded.secrets.llm_api_key) ? loaded.secrets.llm_api_key : "";
-      const probeKey = apiKey || currentKeyPlain;
+      const probeKey = apiKey || pickPlainKey(loaded.secrets, llmProvider);
       console.log("  Fetching available models...");
       const { fetchModels: fetchModels2 } = await Promise.resolve().then(() => (init_init(), init_exports));
       const models = await fetchModels2(llmProvider, probeKey);
@@ -528,13 +562,37 @@ async function cmdProfile(name) {
           default: loaded.yaml.llm?.max_tokens ?? 4096
         }
       ]);
+      const otherKeyStatus = describeKeyStatus(loaded.secrets, otherProvider);
+      const { otherApiKey } = await inquirer.prompt([
+        {
+          type: "password",
+          name: "otherApiKey",
+          message: `${labelFor(otherProvider)} API key for skill overrides [${otherKeyStatus}] (leave empty to keep current):`,
+          mask: "*"
+        }
+      ]);
       const nextLlm = { provider: llmProvider, model, max_tokens: maxTokens };
       const nextYaml = { ...loaded.yaml, llm: nextLlm };
       await writeYaml(loaded.dir, nextYaml);
       loaded.yaml = nextYaml;
-      if (apiKey) {
-        await writeSecrets(loaded.dir, { ...loaded.secrets, llm_api_key: apiKey }, passphrase);
-        loaded.secrets = { ...loaded.secrets, llm_api_key: apiKey };
+      if (apiKey || otherApiKey) {
+        const nextSecrets = { ...loaded.secrets };
+        if (apiKey) {
+          if (llmProvider === "anthropic") {
+            nextSecrets.anthropic_api_key = apiKey;
+          } else {
+            nextSecrets.openai_api_key = apiKey;
+          }
+        }
+        if (otherApiKey) {
+          if (otherProvider === "anthropic") {
+            nextSecrets.anthropic_api_key = otherApiKey;
+          } else {
+            nextSecrets.openai_api_key = otherApiKey;
+          }
+        }
+        await writeSecrets(loaded.dir, nextSecrets, passphrase);
+        loaded.secrets = nextSecrets;
       }
       console.log("  LLM updated.\n");
     }
@@ -548,6 +606,17 @@ function truncate(value, max = 40) {
   }
   return value.slice(0, max - 1) + "\u2026";
 }
+function labelFor(provider) {
+  return provider === "anthropic" ? "Anthropic" : "OpenAI";
+}
+function describeKeyStatus(secrets, provider) {
+  const perProviderField = provider === "anthropic" ? "anthropic_api_key" : "openai_api_key";
+  return secrets[perProviderField] ? "set" : "not set";
+}
+function pickPlainKey(secrets, provider) {
+  const perProviderField = provider === "anthropic" ? "anthropic_api_key" : "openai_api_key";
+  return secrets[perProviderField] ?? "";
+}
 var TCP_PROBE_TIMEOUT_MS = 3e3;
 function parseRelayUrl(url) {
   try {
@@ -1095,6 +1164,82 @@ var OpenAIClient = class {
     }));
   }
 };
+
+// src/llm/resolve.ts
+var DEFAULT_MAX_TOKENS = 4096;
+function resolveSkillLlm(input, agentDefault) {
+  const override = input.llmOverride;
+  const overridePairSet = override?.provider !== void 0 && override.model !== void 0;
+  let provider;
+  let model;
+  if (overridePairSet) {
+    provider = override.provider;
+    model = override.model;
+  } else if (agentDefault) {
+    provider = agentDefault.provider;
+    model = agentDefault.model;
+  }
+  if (!provider || !model) {
+    return {
+      error: `Skill "${input.skillName}" at ${input.skillMdPath}: LLM model is required - declare "provider" + "model" in the SKILL.md frontmatter or set agent-level llm via 'npx @elisym/cli profile <agent>'.`
+    };
+  }
+  const maxTokens = override?.maxTokens ?? agentDefault?.max_tokens ?? DEFAULT_MAX_TOKENS;
+  return { provider, model, maxTokens };
+}
+
+// src/llm/cache.ts
+function cacheKeyFor(triple) {
+  return JSON.stringify({
+    provider: triple.provider,
+    model: triple.model,
+    maxTokens: triple.maxTokens
+  });
+}
+function resolveTripleForOverride(override, agentDefault) {
+  const overridePairSet = override?.provider !== void 0 && override.model !== void 0;
+  let provider;
+  let model;
+  if (overridePairSet) {
+    provider = override.provider;
+    model = override.model;
+  } else if (agentDefault) {
+    provider = agentDefault.provider;
+    model = agentDefault.model;
+  }
+  if (!provider || !model) {
+    return void 0;
+  }
+  const maxTokens = override?.maxTokens ?? agentDefault?.max_tokens ?? DEFAULT_MAX_TOKENS;
+  return { provider, model, maxTokens };
+}
+
+// src/llm/keys.ts
+var ENV_VAR_FOR_PROVIDER = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY"
+};
+var SECRET_FIELD_FOR_PROVIDER = {
+  anthropic: "anthropic_api_key",
+  openai: "openai_api_key"
+};
+function resolveProviderApiKey(input) {
+  const { provider, secrets, dependentSkills } = input;
+  const perProviderField = SECRET_FIELD_FOR_PROVIDER[provider];
+  const perProviderValue = secrets[perProviderField];
+  if (perProviderValue) {
+    return { apiKey: perProviderValue, origin: "secrets-per-provider" };
+  }
+  const envVar = ENV_VAR_FOR_PROVIDER[provider];
+  const envValue = process.env[envVar];
+  if (envValue) {
+    return { apiKey: envValue, origin: "env" };
+  }
+  const skillList = dependentSkills.length > 0 ? dependentSkills.join(", ") : "<none>";
+  return {
+    error: `Provider "${provider}" needs an API key (required by skill(s): ${skillList}). Set secrets.${perProviderField} via 'npx @elisym/cli profile <agent>' or export ${envVar}.`
+  };
+}
 function resolveLevel(options) {
   if (options.level) {
     return options.level;
@@ -1879,11 +2024,12 @@ var ScriptSkill = class {
   priceSubunits;
   asset;
   mode = "llm";
+  llmOverride;
   image;
   imageFile;
   dir;
   inner;
-  constructor(name, description, capabilities, priceSubunits, assetOrImage, imageOrImageFile, imageFileOrDir, dirOrPrompt, promptOrTools, toolsOrRounds, rounds) {
+  constructor(name, description, capabilities, priceSubunits, assetOrImage, imageOrImageFile, imageFileOrDir, dirOrPrompt, promptOrTools, toolsOrRounds, rounds, llmOverride) {
     let asset;
     let image;
     let imageFile;
@@ -1913,6 +2059,7 @@ var ScriptSkill = class {
     this.capabilities = capabilities;
     this.priceSubunits = priceSubunits;
     this.asset = asset;
+    this.llmOverride = llmOverride;
     this.image = image;
     this.imageFile = imageFile;
     this.dir = skillDir;
@@ -1926,6 +2073,7 @@ var ScriptSkill = class {
       systemPrompt,
       tools,
       maxToolRounds,
+      llmOverride,
       image,
       imageFile
     });
@@ -1950,7 +2098,8 @@ function buildCliSkill(parsed, entryPath) {
         entryPath,
         parsed.systemPrompt,
         parsed.tools,
-        parsed.maxToolRounds
+        parsed.maxToolRounds,
+        parsed.llmOverride
       );
     case "static-file": {
       if (parsed.outputFile === void 0) {
@@ -2036,7 +2185,7 @@ function loadSkillsFromDir(skillsDir) {
   }
   return skills;
 }
-function isEncrypted2(event) {
+function isEncrypted(event) {
   return event.tags.some((t) => t[0] === "encrypted" && t[1] === "nip44");
 }
 var HEALTH_CHECK_IDLE_MS = 30 * 60 * 1e3;
@@ -2070,7 +2219,7 @@ var NostrTransport = class {
         }
         const tags = event.tags.filter((t) => t[0] === "t").map((t) => t[1]);
         const bidTag = event.tags.find((t) => t[0] === "bid");
-        const encrypted = isEncrypted2(event);
+        const encrypted = isEncrypted(event);
         const iTag = event.tags.find((t) => t[0] === "i");
         let inputType = "text";
         if (iTag?.[2]) {
@@ -2399,62 +2548,124 @@ async function cmdStart(nameArg, options = {}) {
     );
     process.exit(1);
   }
-  const hasLlmSkill = allSkills.some((skill) => skill.mode === "llm");
-  let llm;
-  if (hasLlmSkill) {
-    const llmSkillNames = allSkills.filter((skill) => skill.mode === "llm").map((skill) => skill.name);
-    if (!loaded.yaml.llm) {
-      console.error(
-        `  ! No LLM configured, but ${llmSkillNames.length} skill(s) require it: ${llmSkillNames.join(", ")}.`
-      );
-      console.error(
-        `    Add an LLM provider via \`npx @elisym/cli profile ${agentName}\`, or remove those skills from ${skillsDir}.
-`
+  const llmSkills = allSkills.filter((skill) => skill.mode === "llm");
+  const triplesByKey = /* @__PURE__ */ new Map();
+  const dependentSkillsByProvider = /* @__PURE__ */ new Map();
+  let agentDefaultCacheKey;
+  const llmClientCache = /* @__PURE__ */ new Map();
+  if (llmSkills.length > 0) {
+    const resolutionErrors = [];
+    for (const skill of llmSkills) {
+      const skillMdPath = join(skillsDir, skill.name, "SKILL.md");
+      const result = resolveSkillLlm(
+        { skillName: skill.name, skillMdPath, llmOverride: skill.llmOverride },
+        loaded.yaml.llm
       );
+      if ("error" in result) {
+        resolutionErrors.push(result.error);
+        continue;
+      }
+      const cacheKey = cacheKeyFor(result);
+      triplesByKey.set(cacheKey, result);
+      const list = dependentSkillsByProvider.get(result.provider) ?? [];
+      list.push(skill.name);
+      dependentSkillsByProvider.set(result.provider, list);
+    }
+    if (resolutionErrors.length > 0) {
+      for (const message of resolutionErrors) {
+        console.error(`  ! ${message}`);
+      }
+      console.error("");
       process.exit(1);
     }
-    if (!loaded.secrets.llm_api_key) {
-      const keyEnvVar2 = loaded.yaml.llm.provider === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY";
-      console.error(`  ! No LLM API key (required by skill(s): ${llmSkillNames.join(", ")}).`);
-      console.error(
-        `    Set ${keyEnvVar2} or update the agent's secrets via \`npx @elisym/cli profile ${agentName}\`.
-`
-      );
+    if (loaded.yaml.llm) {
+      const agentDefaultTriple = {
+        provider: loaded.yaml.llm.provider,
+        model: loaded.yaml.llm.model,
+        maxTokens: loaded.yaml.llm.max_tokens
+      };
+      const agentKey = cacheKeyFor(agentDefaultTriple);
+      if (triplesByKey.has(agentKey)) {
+        agentDefaultCacheKey = agentKey;
+      }
+    }
+    const keyByProvider = /* @__PURE__ */ new Map();
+    const keyErrors = [];
+    for (const [provider, dependents] of dependentSkillsByProvider) {
+      const keyResult = resolveProviderApiKey({
+        provider,
+        secrets: loaded.secrets,
+        dependentSkills: dependents
+      });
+      if ("error" in keyResult) {
+        keyErrors.push(keyResult.error);
+        continue;
+      }
+      keyByProvider.set(provider, keyResult.apiKey);
+    }
+    if (keyErrors.length > 0) {
+      for (const message of keyErrors) {
+        console.error(`  ! ${message}`);
+      }
+      console.error("");
       process.exit(1);
     }
-    const llmProvider = loaded.yaml.llm.provider;
-    const keyEnvVar = llmProvider === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY";
-    process.stdout.write(`  Verifying ${llmProvider} API key... `);
-    const verification = await verifyLlmApiKey(llmProvider, loaded.secrets.llm_api_key);
-    if (verification.ok) {
-      console.log("ok");
-    } else if (verification.reason === "invalid") {
-      console.log("INVALID");
-      console.error(`  ! ${llmProvider} rejected the API key (HTTP ${verification.status}).`);
-      console.error(
-        `    Update it via \`npx @elisym/cli profile\` or set ${keyEnvVar} to a valid key.
+    for (const provider of keyByProvider.keys()) {
+      const apiKey = keyByProvider.get(provider);
+      if (!apiKey) {
+        continue;
+      }
+      const envVar = provider === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY";
+      process.stdout.write(`  Verifying ${provider} API key... `);
+      const verification = await verifyLlmApiKey(provider, apiKey);
+      if (verification.ok) {
+        console.log("ok");
+      } else if (verification.reason === "invalid") {
+        console.log("INVALID");
+        console.error(`  ! ${provider} rejected the API key (HTTP ${verification.status}).`);
+        console.error(
+          `    Update it via \`npx @elisym/cli profile ${agentName}\` or set ${envVar} to a valid key.
 `
-      );
-      process.exit(1);
-    } else {
-      console.log("unavailable");
-      console.warn(
-        `  ! Could not verify ${llmProvider} API key (${verification.error}). Continuing - jobs will fail if the key is invalid.
+        );
+        process.exit(1);
+      } else {
+        console.log("unavailable");
+        console.warn(
+          `  ! Could not verify ${provider} API key (${verification.error}). Continuing - jobs will fail if the key is invalid.
 `
-      );
+        );
+      }
+    }
+    for (const [cacheKey, triple] of triplesByKey) {
+      const apiKey = keyByProvider.get(triple.provider);
+      if (!apiKey) {
+        console.error(`  ! Internal error: no API key for provider "${triple.provider}".
+`);
+        process.exit(1);
+      }
+      const config = {
+        provider: triple.provider,
+        apiKey,
+        model: triple.model,
+        maxTokens: triple.maxTokens,
+        logUsage: true
+      };
+      llmClientCache.set(cacheKey, createLlmClient(config));
     }
-    llm = createLlmClient({
-      provider: loaded.yaml.llm.provider,
-      apiKey: loaded.secrets.llm_api_key,
-      model: loaded.yaml.llm.model,
-      maxTokens: loaded.yaml.llm.max_tokens,
-      logUsage: true
-    });
   } else {
     console.log("  No LLM skills loaded; skipping LLM key check.\n");
   }
+  const agentDefaultClient = agentDefaultCacheKey !== void 0 ? llmClientCache.get(agentDefaultCacheKey) : void 0;
+  const getLlm = (override) => {
+    const triple = resolveTripleForOverride(override, loaded.yaml.llm);
+    if (!triple) {
+      return void 0;
+    }
+    return llmClientCache.get(cacheKeyFor(triple));
+  };
   const skillCtx = {
-    llm,
+    llm: agentDefaultClient,
+    getLlm,
     agentName,
     agentDescription: loaded.yaml.description ?? ""
   };
@@ -2754,9 +2965,9 @@ async function loadAgentWithPrompt(name, cwd) {
   try {
     return await loadAgent(name, cwd, envPassphrase);
   } catch (e) {
-    const isEncrypted3 = /encrypted secrets/i.test(e?.message ?? "");
+    const isEncrypted2 = /encrypted secrets/i.test(e?.message ?? "");
     const isWrongPassphrase = /Decryption failed/i.test(e?.message ?? "");
-    if (!isEncrypted3 && !isWrongPassphrase) {
+    if (!isEncrypted2 && !isWrongPassphrase) {
       throw e;
     }
     if (!process.stdin.isTTY) {