fix(sse): address bot review — tighten local detection, guard null model

- Remove apiKey===null heuristic (too broad — could match cloud providers
  with non-standard auth). Use URL-based detection only.
- Guard local 404 branch with provider && model check — if either is null,
  fall through to standard connection lockout (safer behavior).
- Document LOCAL_HOSTNAMES as module-load-time constant (restart required).
- Document PROVIDER_PROFILES.local as intentionally not yet wired.

open-sse/config/constants.ts

@@ -163,6 +163,9 @@ export const PROVIDER_PROFILES = {
     circuitBreakerThreshold: 5, // More tolerant (occasional 502 is normal)
     circuitBreakerReset: 30000, // 30s reset
   },
+  // Local providers (localhost inference backends like Ollama, LM Studio, oMLX).
+  // Not yet wired into getProviderProfile() — will be used when local provider_nodes
+  // are integrated into the resilience layer. Kept here to avoid a second constants change.
   local: {
     transientCooldown: 2000, // 2s (local — very fast recovery)
     rateLimitCooldown: 5000, // 5s (local — no real rate limits)

open-sse/config/providerRegistry.ts

@@ -1044,6 +1044,7 @@ export function generateAliasMap(): Record<string, string> {
 
 // ── Local Provider Detection ──────────────────────────────────────────────
 
+// Evaluated once at module load time — process restart required for env var changes.
 const LOCAL_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",

src/sse/services/auth.ts

@@ -566,17 +566,15 @@ export async function markAccountUnavailable(
     if (!shouldFallback) return { shouldFallback: false, cooldownMs: 0 };
 
     // ── Local provider 404: model-only lockout, connection stays active ──
+    // Detection: URL-based only (apiKey===null heuristic was too broad — could match
+    // cloud providers with non-standard auth stored in providerSpecificData).
     const connBaseUrl = (conn?.providerSpecificData as Record<string, unknown>)?.baseUrl as
       | string
       | undefined;
-    const isLocal =
-      isLocalProvider(connBaseUrl) || (conn?.apiKey === null && conn?.accessToken === null);
 
-    if (isLocal && status === 404) {
+    if (isLocalProvider(connBaseUrl) && status === 404 && provider && model) {
       const localCooldown = COOLDOWN_MS.notFoundLocal;
-      if (provider && model) {
-        lockModel(provider, connectionId, model, "local_not_found", localCooldown);
-      }
+      lockModel(provider, connectionId, model, "local_not_found", localCooldown);
       log.info(
         "AUTH",
         `Local 404 for ${model} — model-only lockout ${localCooldown / 1000}s (connection stays active)`