fix(agent): surface the real LLM failure cause and hint an unavailable model

[huhamhire]

Problem

A review failing on the LLM call itself showed up as nothing but 所有备选模型均调用失败 (Failed to generate prediction with any model). The actual cause never reached the run card, because pr-agent''s retry_with_fallback_models logs the underlying exception into loguru''s artifact= field, which the default format does not print.

For the local CLI providers this was compounded twice over:

• codex reports failures on stdout, not stderr — turn.failed / error events inside its JSONL stream, with stderr left empty. The shim only read stderr on a non-zero exit, so it raised with an empty reason.
• A turn that dies on a tool/feature failure exits 0 with no assistant message. That empty string flowed downstream into pr-agent''s load_yaml and failed there instead, with no trace of why.

Found while diagnosing a real failure: codex was pinned to a model the account no longer had access to (404 ... The model \x` does not exist or you do not have access to it`), which is precisely the class of failure a user can fix — but only if they are told about it.

Changes

• shim — extract the cause from the codex event stream on a non-zero exit (precedence turn.failed → last error → error item), via a new optional error_extractor spec key; commands without one keep the stderr fallback.
• shim — raise explicitly when a zero exit carries an empty reply, naming any error the stream did report, instead of letting it fail downstream as an empty prompt.
• shim — emit @@MEEBOX_LLM_ERROR@@ {json} on stderr alongside the usage sentinel, so the cause travels past pr-agent''s lossy retry log. Purely additive: the exception still raises and the fallback retry still runs.
• main — prefer that sentinel over the generic stdout marker for errorMessage, and classify it into a new errorHint (currently only model-unavailable).
• renderer — render one localized remedy line under the raw cause (four locales). With a local CLI provider the model comes from that CLI''s own configuration, so the fix lives outside the app and the user has to be pointed at it.

Verification

• lint / typecheck / test / build all pass; four new tests cover the classification, including the negative cases (auth errors, timeouts and empty replies stay unclassified, so no misleading remedy is shown).
• Exercised end to end against the real codex CLI: a genuine 404 model does not exist run raises with the full cause and emits the sentinel; after switching to an available model the same path succeeds and the usage sentinel is unaffected.

🤖 Generated with Claude Code