@allansantos-dev/smart-tool 0.9.31 → 0.9.33

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.9.33 - beta
+
+- Recommended models prefer the Vertex route. When the gateway lists a model on several routes, `model_defaults` now
+  picks `vertex_ai.*` first, any other route next and `bedrock.*` only when nothing else serves the model (Bedrock was
+  chosen before because ids were taken in alphabetical order). `DEFAULTS_VERSION` is 2, so users who already hold the
+  Bedrock ids get the "New recommended models" offer again and decide whether to apply it.
+- `tests/vertex_route_probe.py` asks the live gateway: every recommended chat id must resolve (Anthropic ones on
+  Vertex) and answer a real request. Result of 2026-10-26 in `docs/research/2026-10-26-rota-vertex-nas-recomendacoes.md`.
+
+## 0.9.32 - beta
+
+- Users who updated are told about the new recommended models. `model_upgrade` compares the saved `router_model`,
+  `scope_model`, `research_model` and `scout_model` with the recommended ones against the gateway's catalog and the
+  Windows tray shows a toast with "Apply now" and "Don't show again". Applying keeps the previous models so they can be
+  restored from the setup page (card "New recommended models"); a role you changed after the offer is never overwritten;
+  closing the toast reminds again after 24 h; declining silences it for this version. Embedding and rerank models are
+  never offered (changing them invalidates every index). Buttons are protocol links run by `notice_action.py`
+  (`pythonw`, no window, HKCU only, no admin), each carrying a nonce of the offer.
+- Model failures are logged and shown. `model_health` records every model call by hour, model and role (and, on
+  failure, tool, route and error text without the request content). A tool answer that hit a failing model now carries
+  a line with the model, the role, the error and the link to `/setup#models`; the Models page shows the last 24 h
+  (failures/calls) and the 20 latest failures; the tray raises one toast per model per day (5+ calls and 50%+ failures
+  in 24 h) with "Switch model" and "Mute 7 days". Endpoint: `GET /setup/models/health`.
+- Tests: `tests/test_model_upgrade.py`, `tests/test_model_health.py`; research note
+  `docs/research/2026-10-24-aviso-de-modelos-novos-e-falhas-de-modelo.md`.
+
 ## 0.9.31 - beta
 
 - `scout_model` is filled by default. The setup screen (and the daemon, when it checks the models) now fills an empty

package/README.md

@@ -16,7 +16,7 @@ registered as the `playwright` server where this machine lets a browser be drive
 An optional hook routes the agent's native Grep/Glob/Read/Bash/WebSearch/WebFetch calls to these tools when they
 are cheaper, or just tells the agent what Smart Tool would do.
 
-**Status:** 0.9.31 beta. Windows only. What changed in each version: [CHANGELOG.md](CHANGELOG.md).
+**Status:** 0.9.33 beta. Windows only. What changed in each version: [CHANGELOG.md](CHANGELOG.md).
 
 ## How it works
 
@@ -92,7 +92,7 @@ updating, updated, update failed), and agent sessions get the same line on their
 start when the SessionStart report is on, shown to you too) with the link to the changes. The tray menu has "Update to
 X" (or "Check for updates") on demand and an "Update automatically" switch; `SMART_TOOL_AUTO_UPDATE=off` also turns
 automatic updates off, and the newer-version notice then carries the command to run. Running the command by hand also updates; `~/.smart-tool` is kept. It downloads [uv](https://docs.astral.sh/uv/) (checksum
-verified) and a private Python 3.12 into `~/.smart-tool/runtime`, with nothing added to `PATH` or the registry, then
+verified) and a private Python 3.12 into `~/.smart-tool/runtime`, with nothing added to `PATH` and, in the registry, only two per-user (HKCU) keys that make the notification buttons work, then
 copies Smart Tool to `%LOCALAPPDATA%\Programs\SmartTool` with its own virtual environment,
 installs the web runtime, registers a per-user Scheduled Task that starts the tray at logon and starts the daemon on
 `http://127.0.0.1:8765` (another free port is used, and announced, if 8765 is taken).
@@ -111,8 +111,18 @@ Redirects) and Maintenance (Setup audit, Startup).
    URL ending where the API starts, like the OpenAI SDK `base_url` (`https://api.openai.com/v1`,
    `https://openrouter.ai/api/v1`, `http://localhost:11434/v1`), and an optional API key. Saving tests `/models` first.
 2. **Models**: embedding, rerank (optional; without it results use the hybrid order), the router model (small, no
-   reasoning: web search tier order and result checks), the index classification model (also reviews block patterns) and the research model. Any id the gateway
-   accepts works; the catalog is shown as suggestions.
+   reasoning: web search tier order and result checks), the index classification model (also reviews block patterns), the
+   scout model (the short answer of `smart_scout`) and the research model. Any id the gateway accepts works; the catalog is
+   shown as suggestions. Empty roles are filled with the recommended models the gateway offers.
+
+   When a new version recommends other models than the ones you use, a Windows notification (**Apply now**, **Don't
+   show again**) and the **New recommended models** card on this page offer them: nothing changes until you apply, the
+   models you had are kept, and **Switch back to my previous models** undoes it. The **Model failures (last 24 h)** table
+   lists every failed gateway call by role, model and tool; a model that fails half of its calls (5 or more) also raises a
+   notification and a tray alert. A failure inside a tool call also comes back as a warning line in the tool answer;
+   calls made by a hook or by background work (index scope and profile, block-pattern proposals) have no answer to
+   carry it, so they show only in the table, the log and the notification. The local embedder is not in that table or in
+   the usage meter: it is a sidecar on your machine with no price, and its state is the **Local models** section.
 3. **Agents**: register the MCP server in Claude Code or Codex (runs their official `mcp add` command), install the
    hook and choose its behavior under **Agent rules**. A hook written by an older Smart Tool shows as outdated, with
    what an update changes; updating previews the entry and rewrites only Smart Tool's, after a backup.
@@ -177,11 +187,13 @@ Redirects) and Maintenance (Setup audit, Startup).
    plus changed tests and tests using a pytest fixture whose `conftest.py` imports the changed code, ordered with the
    likeliest failures first, and the command to run them. Changed files are read from disk, so new files and imports
    count before the project is reindexed. `run_all` is true, with
-   the reason, when a configuration or lockfile changed or a changed code file is outside the import graph.
+   the reason, when a configuration or lockfile changed or a changed code file is outside the import graph. Go is read
+   by package: a file that imports a package depends on every file of it, so a changed package selects the tests of every
+   package that imports it (`go test ./pkg ...`); the Go and Rust documentation and duplicate hooks stay silent.
 
    `project_manage` with `action=setup_audit` and a `project_root` (or `python setup_audit.py --project <folder>`)
-   reports what Claude Code and Codex actually load for that folder (settings layers, enabled plugins, hooks, MCP
-   servers, skills, CLAUDE.md and AGENTS.md) and where they collide: several hooks deciding on the same tool in
+   reports what Claude Code and Codex actually load for that folder (settings layers, enabled plugins of both,
+   hooks, MCP servers, skills, CLAUDE.md and AGENTS.md) and where they collide: several hooks deciding on the same tool in
    parallel, hook scripts that do not exist or hide their errors, hooks calling an MCP server that is not configured,
    MCP servers that do not start or offer the same tools twice (a gateway re-exposing a server also registered
    directly), skills sharing a name or over the description budget, an AGENTS.md only Codex reads, broken `@imports`
@@ -251,13 +263,16 @@ fails to load is listed in the setup screen with its error and does not affect t
   everything local.
 - Web queries go to the search sources listed in `NOTICE`. Their free tiers are rate limited per IP address; respect
   each service's terms of use.
-- Logs and metrics are written to `~/.smart-tool/data` and never leave the machine.
+- Logs and metrics are written to `~/.smart-tool/data` and never leave the machine. That includes the model failure log
+  (model, role, tool and the error text, up to 300 characters, which can carry the gateway's error body; never the request).
 
 ## Uninstall
 
 Turn off "Start automatically" in the setup screen, quit from the tray, remove the hook entries from
 `~/.claude/settings.json` / `~/.codex/hooks.json` (the setup screen shows them), run `claude mcp remove smart-tool -s
-user` / `codex mcp remove smart-tool`, then delete `%LOCALAPPDATA%\Programs\SmartTool` and `~/.smart-tool`.
+user` / `codex mcp remove smart-tool`, then delete `%LOCALAPPDATA%\Programs\SmartTool` and `~/.smart-tool`. Turning off "Start automatically" also removes the
+two per-user registry keys of the notification buttons (`HKCU\Software\Classes\smart-tool-action` and
+`HKCU\Software\Classes\AppUserModelId\SmartTool.Notifications`); they come back the next time a notification is shown.
 
 ## License
 

package/affected_tests.py

@@ -22,7 +22,7 @@ RUN_ALL = re.compile(
     r"bun\.lockb?|pyproject\.toml|setup\.cfg|setup\.py|pytest\.ini|tox\.ini|requirements[^/]*\.txt|poetry\.lock|"
     r"uv\.lock|Pipfile(\.lock)?|tsconfig[^/]*\.json|jsconfig\.json|(jest|vitest|vite|babel)\.config\.[^/]+|"
     r"\.babelrc|\.mocharc[^/]*|pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|gradle\.properties|"
-    r"\.env[^/]*)$")
+    r"\.env[^/]*|go\.(mod|sum|work(\.sum)?))$")
 CI_CONFIG = re.compile(r"(^|/)(\.github|\.circleci|\.buildkite)/|(^|/)(\.gitlab-ci\.ya?ml|azure-pipelines\.ya?ml|"
                        r"Jenkinsfile|\.travis\.ya?ml|bitbucket-pipelines\.ya?ml|\.gitignore|\.gitattributes|"
                        r"\.editorconfig|\.mailmap|CODEOWNERS|LICENSE(\.[^/]*)?|\.npmignore)$")
@@ -31,7 +31,7 @@ NOTE = ("Selection from the indexed import graph: tests that load code through s
         "suite before committing; run_all is true when a changed file can change every test (config, lockfile, "
         "unanalyzed code). Changed files and files committed after the last indexing are read from disk, so new "
         "files and imports count before reindexing; pytest fixtures link a test to the conftest.py that defines them.")
-TEST_SOURCES = (".py", ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts", ".java")
+TEST_SOURCES = (".py", ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts", ".java", ".go")
 _PATH_LITERAL = re.compile(r"""['"`]((?:\.{0,2}/)?[\w.-]+(?:/[\w.-]+)*\.(?:py|js|mjs|cjs|ts|mts|cts|java))['"`]""")
 _STRING_LITERAL = re.compile(r"""'([^'\n]*)'|"([^"\n]*)\"""")
 _IMPORT_STATEMENT = re.compile(r"(?:^|;)\s*(?:import|from)\s+([A-Za-z_]\w*(?:\.\w+)*)")
@@ -132,6 +132,9 @@ def _commands(root, tests):
             if runner is None and re.search(rf"\bnode\s+(\./)?{re.escape(local)}\b", scripts):
                 runner = "node-script"
             groups[(folder or "", runner)].append(path)
+        elif lower.endswith(".go"):
+            folder, name = _nearest(root, path, ("go.mod",))
+            groups[(folder or "", "go" if name else None)].append(path)
         elif lower.endswith(".java"):
             folder, name = _nearest(root, path, ("pom.xml", "build.gradle", "build.gradle.kts"))
             groups[(folder or "", "maven" if name == "pom.xml" else "gradle" if name else None)].append(path)
@@ -147,6 +150,8 @@ def _commands(root, tests):
         if runner == "maven":
             names = ",".join(sorted({os.path.basename(f).rsplit(".", 1)[0] for f in files}))
             line = f"mvn test -Dtest={names} -Dsurefire.failIfNoSpecifiedTests=false"
+        elif runner == "go":
+            line = "go test " + " ".join(sorted({"./" + posixpath.dirname(f) if posixpath.dirname(f) else "." for f in local}))
         elif runner == "node-script":
             commands.extend({"cwd": folder or ".", "command": f"node {f}"} for f in sorted(local))
             continue
@@ -260,6 +265,7 @@ _TEST_CASES = {
     ".py": re.compile(r"^\s*(async\s+)?def\s+test\w*\s*\(|^\s*class\s+Test\w*|unittest\.TestCase", re.M),
     ".java": re.compile(r"@(Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate|RunWith|Suite)\b|"
                         r"\bstatic\s+\w*Test\s+suite\s*\(|\bextends\s+TestCase\b|\bvoid\s+test\w*\s*\("),
+    ".go": re.compile(r"^func\s+(Test|Benchmark|Fuzz|Example)\w*\s*\(", re.M),
     "script": re.compile(r"\b(it|test|describe|suite)(\.\w+)?\s*\(|\bDeno\.test\b|\bnode:test\b|\bassert\b"),
 }
 

package/autostart.py

@@ -11,6 +11,8 @@ import subprocess
 import sys
 import tempfile
 
+import toast_notice
+
 TASK_NAME = os.environ.get("SMART_TOOL_TASK_NAME", "SmartTool-Tray")
 
 
@@ -188,6 +190,8 @@ def remove():
         pass
     if _remove_startup_shortcut():
         removed.append("startup_folder")
+    if sys.platform == "win32" and toast_notice.unregister():
+        removed.append("toast_registry")
     return {"ok": True, "removed": removed}
 
 

package/code_graph.py

@@ -20,10 +20,11 @@ import index_scope
 import project_identity
 import web_search_adapters
 import web_document_graph
+import code_graph_go
 import document_text
 
-VERSION = 2
-SOURCE_EXTENSIONS = ('.py','.java','.js','.jsx','.ts','.tsx','.mjs','.cjs','.mts','.cts','.json','.html','.htm','.css','.scss','.sass','.less','.md','.markdown')
+VERSION = 3
+SOURCE_EXTENSIONS = ('.py','.go','.mod','.java','.js','.jsx','.ts','.tsx','.mjs','.cjs','.mts','.cts','.json','.html','.htm','.css','.scss','.sass','.less','.md','.markdown')
 MAX_OVERLAY_BYTES = 5 * 1024 * 1024
 MAX_FILES = 3000
 MAX_TEXT = 24 * 1024 * 1024
@@ -284,7 +285,7 @@ def _analyze(path):
 def _analyze_sources(files,sources,diagnostics,truncated):
     merged={'symbols':[],'dependencies':[],'calls':[],'unresolved':[],'diagnostics':diagnostics,'parsed':[]}
     retryable=False
-    for output in (_python_graph(sources),_javascript_graph(sources,[f['path'] for f in files]),_java_graph(sources),web_document_graph.analyze(sources,[f['path'] for f in files])):
+    for output in (_python_graph(sources),_javascript_graph(sources,[f['path'] for f in files]),_java_graph(sources),code_graph_go.analyze(sources),web_document_graph.analyze(sources,[f['path'] for f in files])):
         for key in merged:merged[key].extend(output.get(key,[]))
         truncated |= output.get('truncated',False)
         retryable |= output.get('retryable',False)

package/code_graph_go.py

@@ -0,0 +1,85 @@
+"""Imports between Go files, read from the package clause and the import declarations of the indexed snapshot.
+
+A Go package is a directory, so a file that imports a package depends on every non-test file of that directory, and an
+internal test file (`package x` in `x_test.go`) depends on every non-test file of its own directory. Import paths are
+resolved against the nearest `go.mod` module path; with no `go.mod` in the snapshot an import resolves to the longest
+directory whose path ends the import path. No symbols or calls are produced: the doc and duplicate hooks stay silent
+for Go until their thresholds are measured on it, and `affected_tests` selects by package import."""
+import posixpath
+import re
+
+_COMMENT = re.compile(r"//[^\n]*|/\*.*?\*/", re.S)
+_PACKAGE = re.compile(r"^package\s+(\w+)", re.M)
+_IMPORT_BLOCK = re.compile(r"^import\s*\((.*?)^\)", re.M | re.S)
+_IMPORT_ONE = re.compile(r'^import\s+(?:[\w.]+\s+)?"([^"]+)"', re.M)
+_IMPORT_SPEC = re.compile(r'^\s*(?:[\w.]+\s+)?"([^"]+)"', re.M)
+_MODULE = re.compile(r"^module\s+(\S+)", re.M)
+
+
+def _module_roots(sources):
+    """Folder of each go.mod in the snapshot -> its module path."""
+    roots = {}
+    for path, text in sources.items():
+        if posixpath.basename(path) == "go.mod":
+            match = _MODULE.search(_COMMENT.sub("", text))
+            if match:
+                roots[posixpath.dirname(path)] = match.group(1).strip('"')
+    return roots
+
+
+def _enclosing_module(folder, roots):
+    """(module folder, module path) of the nearest go.mod above `folder`, or (None, None)."""
+    while True:
+        if folder in roots:
+            return folder, roots[folder]
+        if not folder:
+            return None, None
+        folder = posixpath.dirname(folder)
+
+
+def _imports(text):
+    """Import paths of one Go file (comments already blanked)."""
+    found = [match.group(1) for match in _IMPORT_ONE.finditer(text)]
+    for block in _IMPORT_BLOCK.finditer(text):
+        found.extend(spec.group(1) for spec in _IMPORT_SPEC.finditer(block.group(1)))
+    return found
+
+
+def analyze(sources):
+    go_files = {path: text for path, text in sources.items() if path.endswith(".go")}
+    parsed = [path for path in sources if path.endswith(".go") or posixpath.basename(path) == "go.mod"]
+    if not go_files:
+        return {"parsed": parsed}
+    roots = _module_roots(sources)
+    packages = {}
+    for path in go_files:
+        if not path.endswith("_test.go"):
+            packages.setdefault(posixpath.dirname(path), []).append(path)
+
+    def package_dir(path, spec):
+        folder, module = _enclosing_module(posixpath.dirname(path), roots)
+        if module is not None:
+            if spec != module and not spec.startswith(module + "/"):
+                return None
+            return folder if spec == module else posixpath.normpath(posixpath.join(folder, spec[len(module) + 1:]))
+        candidates = [d for d in packages if d and (spec == d or spec.endswith("/" + d))]
+        return max(candidates, key=len, default=None)
+
+    dependencies = []
+    for path, text in sorted(go_files.items()):
+        bare = _COMMENT.sub(lambda m: re.sub(r"[^\n]", " ", m.group(0)), text)
+        for spec in _imports(bare):
+            folder = package_dir(path, spec)
+            line = bare[:bare.find(f'"{spec}"')].count("\n") + 1
+            targets = [t for t in packages.get(folder, ()) if t != path] if folder is not None else []
+            if not targets:
+                dependencies.append({"source": path, "target": None, "specifier": spec, "line": line, "kind": "import",
+                                     "resolution": "external"})
+            dependencies.extend({"source": path, "target": target, "specifier": spec, "line": line, "kind": "import",
+                                 "resolution": "resolved"} for target in targets)
+        clause = _PACKAGE.search(bare)
+        if path.endswith("_test.go") and clause and not clause.group(1).endswith("_test"):
+            dependencies.extend({"source": path, "target": target, "specifier": posixpath.dirname(path) or ".",
+                                 "line": 1, "kind": "package", "resolution": "resolved"}
+                                for target in packages.get(posixpath.dirname(path), ()))
+    return {"dependencies": dependencies, "parsed": parsed}

package/config.py

@@ -20,6 +20,9 @@ CONFIG_PATH = os.path.join(CONFIG_DIR, "config.json")
 # RLock: update_config() chama load/save sob o mesmo lock; Lock travaria a própria thread.
 _LOCK = threading.RLock()
 
+# The config fields that select a gateway model; every per-role table (recommended models, failure log) keys on these.
+MODEL_ROLES = ("router_model", "scope_model", "scout_model", "research_model", "embedding_model", "rerank_model")
+
 DEFAULT_CONFIG = {
     "router_model": "",
     "scope_model": "",

package/index_profile.py

@@ -12,10 +12,12 @@ KINDS = ("code", "test", "doc")
 RETRY_AFTER_S = 3600
 MAX_DIRS = 90
 PROSE = {"md", "txt", "docx", "rst", "adoc"}
-# Data and markup inside a documentation folder are reports, not code (GitHub Linguist treats docs/ as documentation).
+# Data and markup inside a documentation, design or data-dump folder are reports and mockups, not code (GitHub Linguist
+# treats docs/ as documentation; a design/ HTML or a probe's JSON result pushed hook_decision.py out of the code block).
 DOC_DATA = {"html", "htm", "json", "csv", "xml", "yaml", "yml", "svg"}
 _NAME_DOC = re.compile(r"(^|/)(readme|changelog|license|licence|contributing|install|history|authors)(\.[^/]*)?$", re.I)
 _DIR_DOC = re.compile(r"(^|/)(docs?|adrs?|documentation)/", re.I)
+_DIR_DOC_DATA = re.compile(r"(^|/)(docs?|adrs?|documentation|designs?|references?|mockups?|prototypes?|data|datasets?|reports?|results?)/", re.I)
 _TEST = re.compile(r"(^|/)(tests?|__tests__|spec|specs|e2e|fixtures?|testdata|test-utils?)(/|$)|(^|/)test_[^/]+\.py$|"
                    r"(^|/)conftest\.py$|_test\.(py|go)$|\.(test|spec)(-d)?\.[cm]?[jt]sx?$|(^|/)[^/]*[a-z0-9](?-i:Tests?)\.java$|"
                    r"(^|/)src/test/|(^|/)test[-_][^/]*\.[cm]?[jt]sx?$|[-_]test\.[cm]?[jt]sx?$", re.I)
@@ -151,7 +153,7 @@ def kind(path, profile):
         return _model_kind(path, groups or [{"path": ".", "kind": "doc"}])
     if _TEST.search(path):
         return "test"
-    if ext in DOC_DATA and _DIR_DOC.search(path) and _explicit_kind(path, groups) != "code":
+    if ext in DOC_DATA and _DIR_DOC_DATA.search(path) and _explicit_kind(path, groups) != "code":
         return "doc"
     if not ext and _NAME_DOC.search(path):
         return "doc"

package/model_client.py

@@ -7,6 +7,7 @@ import urllib.error
 import usage_meter
 
 import gateway
+import model_health
 
 OFFLINE = contextvars.ContextVar("model_offline", default=None)
 _NO_TEMPERATURE = set()
@@ -34,6 +35,7 @@ def fetch(path, token, method="GET", body=None, timeout=15):
         raise
     finally:
         usage_meter.record(path,body,result,headers,failure,time.monotonic()-started)
+        model_health.record(path,body,failure)
 
 
 def _fetch(path, _token, method="GET", body=None, timeout=15):

package/model_defaults.py

@@ -11,7 +11,7 @@ import model_catalog
 # first and price second (docs/research/2026-10-24-modelos-do-scout-e-dos-outros-papeis.md): the router answers pages
 # and the scout reads code excerpts, where Claude Haiku 5.5 answered every request and led the no-index path; scope and
 # research pick the GPT-5.4 nano, as accurate there at about half the price and without the long reasoning of the mini.
-RECOMMENDED_MODELS = {
+_CHOICES = {
     "router_model": ("chat", "claude-haiku-5-5"),
     "scope_model": ("chat", "gpt-5.4-nano"),
     "scout_model": ("chat", "claude-haiku-5-5"),
@@ -19,10 +19,18 @@ RECOMMENDED_MODELS = {
     "embedding_model": ("embedding", "text-embedding-3-small"),
     "rerank_model": ("rerank", "rerank-3-5"),
 }
+RECOMMENDED_MODELS = {role: _CHOICES[role] for role in config.MODEL_ROLES}
+
+
+def _route_rank(model_id):
+    """Vertex first (the owner's gateway is stable there), Bedrock only when nothing else serves the model."""
+    route = re.split(r"[/.:]", model_id)[0].lower()
+    return 0 if route.startswith("vertex") else 2 if route.startswith("bedrock") else 1
 
 
 def _matching(catalog, name):
-    return next((model_id for model_id in sorted(catalog) if re.split(r"[/.:]", model_id)[-1] == name
+    return next((model_id for model_id in sorted(catalog, key=lambda found: (_route_rank(found), found))
+                 if re.split(r"[/.:]", model_id)[-1] == name
                  or model_id.endswith(("/" + name, "." + name)) or model_id == name), None)
 
 

package/model_health.py

@@ -0,0 +1,163 @@
+"""Failure log and failure rate of the gateway models, per model and role (router, scope, scout, research, embedding,
+rerank). Never stores request content: the model, the role, the tool that was running, the HTTP path, a short error
+text and the time.
+
+Three consumers read it: the tool answer (a warning line when a call of that very tool failed), the setup screen
+(rate table and recent failures) and the tray (one toast per model per day when the rate passes the limit).
+"""
+import contextlib
+import contextvars
+import io
+import os
+import sqlite3
+import time
+
+import config
+import project_store
+
+WINDOW_S = 24 * 3600
+ALERT_MIN_CALLS = 5
+ALERT_RATE = 0.5
+ALERT_EVERY_S = 24 * 3600
+MUTE_S = 7 * 24 * 3600
+KEEP_S = 7 * 24 * 3600
+KEEP_FAILURES = 500
+ERROR_CHARS = 300
+_PATHS = ("/v1/chat/completions", "/v1/embeddings", "/v1/rerank")
+_TOOL = contextvars.ContextVar("model_health_tool", default=None)
+_COLLECTED = contextvars.ContextVar("model_health_collected", default=None)
+_SCHEMA = set()
+
+
+@contextlib.contextmanager
+def tool_call(name):
+    """Marks the model calls made inside the block as run by tool `name` and collects their failures; the block yields
+    the list, which `warning_text` turns into the line appended to the tool answer."""
+    failures = []
+    tool_token, list_token = _TOOL.set(name), _COLLECTED.set(failures)
+    try:
+        yield failures
+    finally:
+        _TOOL.reset(tool_token)
+        _COLLECTED.reset(list_token)
+
+
+def _db():
+    return project_store._db()
+
+
+def _tables(db):
+    if project_store.DB_PATH in _SCHEMA and os.path.isfile(project_store.DB_PATH):
+        return
+    db.execute("CREATE TABLE IF NOT EXISTS model_calls(hour INTEGER,model TEXT,role TEXT,calls INTEGER,errors INTEGER,"
+               "PRIMARY KEY(hour,model,role))")
+    db.execute("CREATE TABLE IF NOT EXISTS model_failures(at REAL,model TEXT,role TEXT,tool TEXT,path TEXT,error TEXT)")
+    db.execute("CREATE TABLE IF NOT EXISTS model_alerts(model TEXT PRIMARY KEY,last_notified REAL,muted_until REAL)")
+    _SCHEMA.add(project_store.DB_PATH)
+
+
+def role_of(model, cfg=None):
+    """Name of the config field that selects `model` ('other' when none does)."""
+    cfg = cfg if cfg is not None else config.load_config()
+    return next((field for field in config.MODEL_ROLES if cfg.get(field) == model), "other")
+
+
+def error_text(exc):
+    """Short text of a failed call. An HTTP error body is read once and put back so the caller can still read it."""
+    text = f"{type(exc).__name__}: {exc}"
+    fp = getattr(exc, "fp", None)
+    if fp is not None and hasattr(exc, "read"):
+        try:
+            detail = exc.read()
+            exc.read = io.BytesIO(detail).read
+            text += " | " + detail.decode("utf-8", "replace")
+        except Exception:
+            pass
+    return " ".join(text.split())[:ERROR_CHARS]
+
+
+def record(path, body, failure=None):
+    """Counts one model call and, when it failed, logs it. Never raises: the log must not change the call's result."""
+    if path not in _PATHS:
+        return
+    try:
+        model = str((body or {}).get("model", "")) if isinstance(body, dict) else ""
+        role = role_of(model)
+        now = time.time()
+        text = error_text(failure) if failure is not None else None
+        with project_store._LOCK, _db() as db:
+            _tables(db)
+            db.execute("INSERT INTO model_calls VALUES(?,?,?,1,?) ON CONFLICT(hour,model,role) DO UPDATE SET "
+                       "calls=calls+1,errors=errors+excluded.errors", (int(now // 3600), model, role, int(text is not None)))
+            if text is not None:
+                db.execute("INSERT INTO model_failures VALUES(?,?,?,?,?,?)", (now, model, role, _TOOL.get() or "", path, text))
+                db.execute("DELETE FROM model_failures WHERE at<? OR rowid NOT IN "
+                           "(SELECT rowid FROM model_failures ORDER BY at DESC LIMIT ?)", (now - KEEP_S, KEEP_FAILURES))
+                db.execute("DELETE FROM model_calls WHERE hour<?", (int((now - KEEP_S) // 3600),))
+        collected = _COLLECTED.get()
+        if text is not None and collected is not None:
+            collected.append({"model": model, "role": role, "error": text})
+    except Exception:
+        pass
+
+
+def warning_text(failures, setup_url):
+    """The line a tool answer carries when a model call inside it failed ('' when none did)."""
+    if not failures:
+        return ""
+    first = failures[0]
+    more = f" (+{len(failures) - 1} more)" if len(failures) > 1 else ""
+    return (f"\n\nSmart Tool model warning: {first['role']} `{first['model']}` failed in this call{more}: "
+            f"{first['error']}. Pick another model: {setup_url}/setup#models")
+
+
+def summary(now=None):
+    """Per model and role over the last 24 h, plus the 20 latest failures."""
+    now = now or time.time()
+    with project_store._LOCK, _db() as db:
+        _tables(db)
+        db.row_factory = sqlite3.Row
+        models = [dict(row) for row in db.execute(
+            "SELECT model,role,SUM(calls) AS calls,SUM(errors) AS errors FROM model_calls WHERE hour>=? "
+            "GROUP BY model,role ORDER BY SUM(errors) DESC,SUM(calls) DESC", (int((now - WINDOW_S) // 3600),))]
+        failures = [dict(row) for row in db.execute(
+            "SELECT at,model,role,tool,path,error FROM model_failures WHERE at>=? ORDER BY at DESC LIMIT 20", (now - WINDOW_S,))]
+        for row in models:
+            last = db.execute("SELECT error FROM model_failures WHERE model=? AND role=? ORDER BY at DESC LIMIT 1",
+                              (row["model"], row["role"])).fetchone()
+            row["last_error"] = last[0] if last else ""
+    for row in models:
+        row["rate"] = round(row["errors"] / row["calls"], 3) if row["calls"] else 0.0
+        row["failing"] = row["calls"] >= ALERT_MIN_CALLS and row["rate"] >= ALERT_RATE
+    return {"window_hours": WINDOW_S // 3600, "models": models, "failures": failures}
+
+
+def alerts_due(now=None):
+    """Models over the failure limit that are neither muted nor already announced in the last 24 h; marks them
+    announced, so a second call in the same day returns nothing."""
+    now = now or time.time()
+    due = []
+    for row in summary(now)["models"]:
+        if not row["failing"]:
+            continue
+        with project_store._LOCK, _db() as db:
+            _tables(db)
+            seen = db.execute("SELECT last_notified,muted_until FROM model_alerts WHERE model=?", (row["model"],)).fetchone()
+            if seen and (seen[1] > now or now - seen[0] < ALERT_EVERY_S):
+                continue
+            db.execute("INSERT INTO model_alerts VALUES(?,?,0) ON CONFLICT(model) DO UPDATE SET last_notified=excluded.last_notified",
+                       (row["model"], now))
+        due.append(row)
+    return due
+
+
+def mute(model, now=None):
+    """Silences the failure toast for `model` for 7 days (the failures stay in the log)."""
+    if not model:
+        raise ValueError("No model to mute.")
+    now = now or time.time()
+    with project_store._LOCK, _db() as db:
+        _tables(db)
+        db.execute("INSERT INTO model_alerts VALUES(?,?,?) ON CONFLICT(model) DO UPDATE SET muted_until=excluded.muted_until",
+                   (model, now, now + MUTE_S))
+    return f"failure alerts for {model} muted for 7 days"