Broaden unsupported-image-input recovery beyond OpenRouter 404s (OpenAI/Anthropic reject with 400)

[tlongwell-block]

Follow-up from #4896 (comment).

#4896 recovers a turn when a provider rejects image input, but the classifier (is_unsupported_image_input_error in crates/buzz-agent/src/llm.rs) only matches the OpenRouter/DeepSeek rejection (No endpoints found that support image input) and only runs on the 404 arms of post() / openrouter_post().

Probed against the real post path: OpenAI- and Claude-style image rejections arrive as 400s, which are classified as AgentError::Llm before the matcher ever runs. So broadening the phrase list alone changes nothing for those providers; real coverage requires:

1. Hoisting the unsupported-image check above the status dispatch (with ordering tests so 401/403/429/5xx handling is unaffected).
2. Per-provider phrases matched against captured rejection bodies — not guessed wording. We currently have a verbatim body only for the OpenRouter/DeepSeek case (from the trial run that motivated fix(agent): recover from unsupported image input instead of poisoning the turn #4896).

Blocked on: capturing a real image-rejection body from OpenAI and Anthropic (send one image request to a text-only model on each and record status + body verbatim).

Risk note for whoever picks this up: a false positive in this classifier strips images from history on a turn where images were fine — prefer narrow matchers over broad ones like contains("not support image").

[tlongwell-block]

Prerequisite partially met: captured a real image-rejection body from Ollama, and reproduced the unfixed failure against a live provider.

Ollama is a supported provider through the openai-compat path (OPENAI_COMPAT_BASE_URL=http://localhost:11434/v1) and needs no credential, so this leg is testable today.

Captured body (verbatim)

POST /v1/chat/completions, ollama 0.32.3, model qwen2.5:0.5b (text-only), 1x1 PNG as image_url:

HTTP 400
{"error":{"message":"{\"error\":{\"code\":400,\"message\":\"Multimodal data provided, but model does not support multimodal requests.\",\"type\":\"invalid_request_error\"}}","type":"invalid_request_error","param":null,"code":null}}

Identical body from the native /api/chat endpoint.

Note the double encoding: the real message is a JSON string nested inside error.message. A structured matcher that reads /error/message gets the escaped blob, not the sentence — contains() on the raw body works, a one-level parse does not.

Live reproduction at #4896 head (5dc1ad10a)

Drove the real buzz-agent binary over ACP with a real MCP emitting an image block, production max_rounds default (0 = unlimited), text-only qwen2.5:3b:

TURN1: error -32000  400 Bad Request ... does not support multimodal requests
TURN2 ("say PING"):  error -32000  same 400
TURN3 ("say PONG"):  error -32000  same 400

History stays poisoned across turns — the exact pre-fix failure mode, still live for this provider.

Controls

Arm	Result
text-only model + image	400, 3/3 turns dead
same rig, no image block	end_turn — image is the variable
vision model (moondream) + same image	HTTP 200, described it — request is well-formed; the 400 is a capability verdict
unknown model, text only	404 model 'x' not found
unknown model, with image	still 404 model-not-found
proxy rewriting that 400 → 404 + OpenRouter phrase	end_turn all 3 turns — recovery fires
same proxy, passthrough	400, 3/3 dead

The last two are the discriminator: same binary, same rig, sole variable is status + phrase. The recovery machinery in #4896 is correct end-to-end against a real provider; it just never gets invoked for Ollama.

Consequence for this issue

The two unknown-model rows matter for the design: Ollama's own 404 means "model not found", so a fix cannot simply add the phrase to the existing 404 arm and cannot loosen the 404 arm generally. Hoisting the unsupported-image check above the status dispatch is necessary here, with a test pinning that Ollama's model-not-found 404 keeps LlmModelNotFound.

Still unmet: verbatim OpenAI and Anthropic bodies. Those remain guesses and should stay out of the matcher until captured.

Reproduction recipe: ollama pull qwen2.5:3b, then BUZZ_AGENT_PROVIDER=openai OPENAI_COMPAT_BASE_URL=http://localhost:11434/v1 OPENAI_COMPAT_API_KEY=ollama OPENAI_COMPAT_MODEL=qwen2.5:3b, MCP with FAKE_MCP_IMAGE_RESULT=1, and leave BUZZ_AGENT_MAX_ROUNDS unset.

[tlongwell-block]

Evidence update — the Ollama leg of this is no longer speculative.

Sami reproduced the original poisoned-history failure live at PR head 5dc1ad10a against a local Ollama (0.32.3, text-only qwen2.5:3b, production max_rounds=0, real MCP image block, actual buzz-agent binary over ACP). Ollama rejects with HTTP 400 and a doubly-encoded body:

HTTP 400
{"error":{"message":"{\"error\":{\"code\":400,\"message\":\"Multimodal data provided, but model does not support multimodal requests.\",\"type\":\"invalid_request_error\"}}","type":"invalid_request_error","param":null,"code":null}}

(The real sentence is a JSON string nested inside error.message — a one-level structured parse reads the escaped blob; contains() on the raw body works.)

Control arms that pin the design:

• Ollama's own 404 is model 'x' not found — model-not-found, even when the request carries an image. So the phrase check must be hoisted above the status dispatch; per-status matching cannot cover this provider, and Ollama 404s must keep LlmModelNotFound.
• A proxy rewriting only that 400 → 404 + the OpenRouter phrase makes recovery fire end-to-end (end_turn, 3/3 turns) on the same rig/binary — the fix(agent): recover from unsupported image input instead of poisoning the turn #4896 machinery is correct, it just never gets invoked for this provider.

Plan: Sami is building this as a stacked PR on top of #4896 — hoist above the status dispatch, add the captured Ollama phrase, ordering tests proving 401/403/429/5xx classification is unaffected, and a discriminating test that Ollama-style model-not-found 404s keep their classification.

Still out of scope pending real captures: OpenAI and Anthropic rejection bodies. Those phrases remain unverified guesses; capturing them is the remaining blocker for full coverage.