@ubiquity-os/plugin-sdk 3.6.2 → 3.7.0

package/dist/index.mjs

@@ -1,6 +1,5 @@
 // src/actions.ts
 import * as core from "@actions/core";
-import * as github2 from "@actions/github";
 import { Value as Value3 } from "@sinclair/typebox/value";
 
 // ../../node_modules/@ubiquity-os/ubiquity-os-logger/dist/index.js
@@ -338,8 +337,56 @@ var Logs = class _Logs {
 // src/actions.ts
 import { config } from "dotenv";
 
-// src/helpers/runtime-info.ts
-import github from "@actions/github";
+// src/error.ts
+function getErrorStatus(err) {
+  if (!err || typeof err !== "object") return null;
+  const candidate = err;
+  const directStatus = candidate.status ?? candidate.response?.status;
+  if (typeof directStatus === "number" && Number.isFinite(directStatus)) return directStatus;
+  if (typeof directStatus === "string" && directStatus.trim()) {
+    const parsed = Number.parseInt(directStatus, 10);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  if (err instanceof Error) {
+    const match = /LLM API error:\s*(\d{3})/i.exec(err.message);
+    if (match) {
+      const parsed = Number.parseInt(match[1], 10);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+  }
+  return null;
+}
+function logByStatus(context, message, metadata) {
+  const status = getErrorStatus(metadata.err);
+  const payload = { ...metadata, ...status ? { status } : {} };
+  if (status && status >= 500) return context.logger.error(message, payload);
+  if (status && status >= 400) return context.logger.warn(message, payload);
+  if (status && status >= 300) return context.logger.debug(message, payload);
+  if (status && status >= 200) return context.logger.ok(message, payload);
+  if (status && status >= 100) return context.logger.info(message, payload);
+  return context.logger.error(message, payload);
+}
+function transformError(context, error) {
+  if (error instanceof LogReturn) {
+    return error;
+  }
+  if (error instanceof AggregateError) {
+    const message = error.errors.map((err) => {
+      if (err instanceof LogReturn) {
+        return err.logMessage.raw;
+      }
+      if (err instanceof Error) {
+        return err.message;
+      }
+      return String(err);
+    }).join("\n\n");
+    return logByStatus(context, message, { err: error });
+  }
+  if (error instanceof Error) {
+    return logByStatus(context, error.message, { err: error });
+  }
+  return logByStatus(context, String(error), { err: error });
+}
 
 // ../../node_modules/hono/dist/helper/adapter/index.js
 var env = (c, runtime) => {
@@ -391,6 +438,21 @@ var checkUserAgentEquals = (platform) => {
   return userAgent.startsWith(platform);
 };
 
+// src/helpers/github-context.ts
+import * as github from "@actions/github";
+function getGithubContext() {
+  const override = globalThis.__UOS_GITHUB_CONTEXT__;
+  if (override) {
+    return override;
+  }
+  const module = github;
+  const context = module.context ?? module.default?.context;
+  if (!context) {
+    throw new Error("GitHub context is unavailable.");
+  }
+  return context;
+}
+
 // src/helpers/runtime-info.ts
 var PluginRuntimeInfo = class _PluginRuntimeInfo {
   static _instance = null;
@@ -439,10 +501,11 @@ var CfRuntimeInfo = class extends PluginRuntimeInfo {
 };
 var NodeRuntimeInfo = class extends PluginRuntimeInfo {
   get version() {
-    return github.context.sha;
+    return getGithubContext().sha;
   }
   get runUrl() {
-    return github.context.payload.repository ? `${github.context.payload.repository?.html_url}/actions/runs/${github.context.runId}` : "http://localhost";
+    const context = getGithubContext();
+    return context.payload.repository ? `${context.payload.repository?.html_url}/actions/runs/${context.runId}` : "http://localhost";
   }
 };
 var DenoRuntimeInfo = class extends PluginRuntimeInfo {
@@ -532,14 +595,23 @@ function getPluginOptions(options) {
 }
 
 // src/comment.ts
+function logByStatus2(logger, message, status, metadata) {
+  const payload = { ...metadata, ...status ? { status } : {} };
+  if (status && status >= 500) return logger.error(message, payload);
+  if (status && status >= 400) return logger.warn(message, payload);
+  if (status && status >= 300) return logger.debug(message, payload);
+  if (status && status >= 200) return logger.ok(message, payload);
+  if (status && status >= 100) return logger.info(message, payload);
+  return logger.error(message, payload);
+}
 var CommentHandler = class _CommentHandler {
   static HEADER_NAME = "UbiquityOS";
   _lastCommentId = { reviewCommentId: null, issueCommentId: null };
-  async _updateIssueComment(context2, params) {
+  async _updateIssueComment(context, params) {
     if (!this._lastCommentId.issueCommentId) {
-      throw context2.logger.error("issueCommentId is missing");
+      throw context.logger.error("issueCommentId is missing");
     }
-    const commentData = await context2.octokit.rest.issues.updateComment({
+    const commentData = await context.octokit.rest.issues.updateComment({
       owner: params.owner,
       repo: params.repo,
       comment_id: this._lastCommentId.issueCommentId,
@@ -547,11 +619,11 @@ var CommentHandler = class _CommentHandler {
     });
     return { ...commentData.data, issueNumber: params.issueNumber };
   }
-  async _updateReviewComment(context2, params) {
+  async _updateReviewComment(context, params) {
     if (!this._lastCommentId.reviewCommentId) {
-      throw context2.logger.error("reviewCommentId is missing");
+      throw context.logger.error("reviewCommentId is missing");
     }
-    const commentData = await context2.octokit.rest.pulls.updateReviewComment({
+    const commentData = await context.octokit.rest.pulls.updateReviewComment({
       owner: params.owner,
       repo: params.repo,
       comment_id: this._lastCommentId.reviewCommentId,
@@ -559,9 +631,9 @@ var CommentHandler = class _CommentHandler {
     });
     return { ...commentData.data, issueNumber: params.issueNumber };
   }
-  async _createNewComment(context2, params) {
+  async _createNewComment(context, params) {
     if (params.commentId) {
-      const commentData2 = await context2.octokit.rest.pulls.createReplyForReviewComment({
+      const commentData2 = await context.octokit.rest.pulls.createReplyForReviewComment({
         owner: params.owner,
         repo: params.repo,
         pull_number: params.issueNumber,
@@ -571,7 +643,7 @@ var CommentHandler = class _CommentHandler {
       this._lastCommentId.reviewCommentId = commentData2.data.id;
       return { ...commentData2.data, issueNumber: params.issueNumber };
     }
-    const commentData = await context2.octokit.rest.issues.createComment({
+    const commentData = await context.octokit.rest.issues.createComment({
       owner: params.owner,
       repo: params.repo,
       issue_number: params.issueNumber,
@@ -580,54 +652,58 @@ var CommentHandler = class _CommentHandler {
     this._lastCommentId.issueCommentId = commentData.data.id;
     return { ...commentData.data, issueNumber: params.issueNumber };
   }
-  _getIssueNumber(context2) {
-    if ("issue" in context2.payload) return context2.payload.issue.number;
-    if ("pull_request" in context2.payload) return context2.payload.pull_request.number;
-    if ("discussion" in context2.payload) return context2.payload.discussion.number;
+  _getIssueNumber(context) {
+    if ("issue" in context.payload) return context.payload.issue.number;
+    if ("pull_request" in context.payload) return context.payload.pull_request.number;
+    if ("discussion" in context.payload) return context.payload.discussion.number;
     return void 0;
   }
-  _getCommentId(context2) {
-    return "pull_request" in context2.payload && "comment" in context2.payload ? context2.payload.comment.id : void 0;
+  _getCommentId(context) {
+    return "pull_request" in context.payload && "comment" in context.payload ? context.payload.comment.id : void 0;
   }
-  _extractIssueContext(context2) {
-    if (!("repository" in context2.payload) || !context2.payload.repository?.owner?.login) {
+  _extractIssueContext(context) {
+    if (!("repository" in context.payload) || !context.payload.repository?.owner?.login) {
       return null;
     }
-    const issueNumber = this._getIssueNumber(context2);
+    const issueNumber = this._getIssueNumber(context);
     if (!issueNumber) return null;
     return {
       issueNumber,
-      commentId: this._getCommentId(context2),
-      owner: context2.payload.repository.owner.login,
-      repo: context2.payload.repository.name
+      commentId: this._getCommentId(context),
+      owner: context.payload.repository.owner.login,
+      repo: context.payload.repository.name
     };
   }
-  _processMessage(context2, message) {
+  _processMessage(context, message) {
     if (message instanceof Error) {
       const metadata2 = {
         message: message.message,
         name: message.name,
         stack: message.stack
       };
-      return { metadata: metadata2, logMessage: context2.logger.error(message.message).logMessage };
+      const status = getErrorStatus(message);
+      const logReturn = logByStatus2(context.logger, message.message, status, metadata2);
+      return { metadata: { ...metadata2, ...status ? { status } : {} }, logMessage: logReturn.logMessage };
     }
+    const stackLine = message.metadata?.error?.stack?.split("\n")[2];
+    const callerMatch = stackLine ? /at (\S+)/.exec(stackLine) : null;
     const metadata = message.metadata ? {
       ...message.metadata,
       message: message.metadata.message,
       stack: message.metadata.stack || message.metadata.error?.stack,
-      caller: message.metadata.caller || message.metadata.error?.stack?.split("\n")[2]?.match(/at (\S+)/)?.[1]
+      caller: message.metadata.caller || callerMatch?.[1]
     } : { ...message };
     return { metadata, logMessage: message.logMessage };
   }
-  _getInstigatorName(context2) {
-    if ("installation" in context2.payload && context2.payload.installation && "account" in context2.payload.installation && context2.payload.installation?.account?.name) {
-      return context2.payload.installation?.account?.name;
+  _getInstigatorName(context) {
+    if ("installation" in context.payload && context.payload.installation && "account" in context.payload.installation && context.payload.installation?.account?.name) {
+      return context.payload.installation?.account?.name;
     }
-    return context2.payload.sender?.login || _CommentHandler.HEADER_NAME;
+    return context.payload.sender?.login || _CommentHandler.HEADER_NAME;
   }
-  _createMetadataContent(context2, metadata) {
+  _createMetadataContent(context, metadata) {
     const jsonPretty = sanitizeMetadata(metadata);
-    const instigatorName = this._getInstigatorName(context2);
+    const instigatorName = this._getInstigatorName(context);
     const runUrl = PluginRuntimeInfo.getInstance().runUrl;
     const version = PluginRuntimeInfo.getInstance().version;
     const callingFnName = metadata.caller || "anonymous";
@@ -644,63 +720,39 @@ var CommentHandler = class _CommentHandler {
   /*
    * Creates the body for the comment, embeds the metadata and the header hidden in the body as well.
    */
-  createCommentBody(context2, message, options) {
-    return this._createCommentBody(context2, message, options);
+  createCommentBody(context, message, options) {
+    return this._createCommentBody(context, message, options);
   }
-  _createCommentBody(context2, message, options) {
-    const { metadata, logMessage } = this._processMessage(context2, message);
-    const { header, jsonPretty } = this._createMetadataContent(context2, metadata);
+  _createCommentBody(context, message, options) {
+    const { metadata, logMessage } = this._processMessage(context, message);
+    const { header, jsonPretty } = this._createMetadataContent(context, metadata);
     const metadataContent = this._formatMetadataContent(logMessage, header, jsonPretty);
     return `${options?.raw ? logMessage?.raw : logMessage?.diff}
 
 ${metadataContent}
 `;
   }
-  async postComment(context2, message, options = { updateComment: true, raw: false }) {
-    const issueContext = this._extractIssueContext(context2);
+  async postComment(context, message, options = { updateComment: true, raw: false }) {
+    const issueContext = this._extractIssueContext(context);
     if (!issueContext) {
-      context2.logger.info("Cannot post comment: missing issue context in payload");
+      context.logger.warn("Cannot post comment: missing issue context in payload");
       return null;
     }
-    const body = this._createCommentBody(context2, message, options);
+    const body = this._createCommentBody(context, message, options);
     const { issueNumber, commentId, owner, repo } = issueContext;
     const params = { owner, repo, body, issueNumber };
     if (options.updateComment) {
-      if (this._lastCommentId.issueCommentId && !("pull_request" in context2.payload && "comment" in context2.payload)) {
-        return this._updateIssueComment(context2, params);
+      if (this._lastCommentId.issueCommentId && !("pull_request" in context.payload && "comment" in context.payload)) {
+        return this._updateIssueComment(context, params);
       }
-      if (this._lastCommentId.reviewCommentId && "pull_request" in context2.payload && "comment" in context2.payload) {
-        return this._updateReviewComment(context2, params);
+      if (this._lastCommentId.reviewCommentId && "pull_request" in context.payload && "comment" in context.payload) {
+        return this._updateReviewComment(context, params);
       }
     }
-    return this._createNewComment(context2, { ...params, commentId });
+    return this._createNewComment(context, { ...params, commentId });
   }
 };
 
-// src/error.ts
-function transformError(context2, error) {
-  let loggerError;
-  if (error instanceof AggregateError) {
-    loggerError = context2.logger.error(
-      error.errors.map((err) => {
-        if (err instanceof LogReturn) {
-          return err.logMessage.raw;
-        } else if (err instanceof Error) {
-          return err.message;
-        } else {
-          return err;
-        }
-      }).join("\n\n"),
-      { error }
-    );
-  } else if (error instanceof Error || error instanceof LogReturn) {
-    loggerError = error;
-  } else {
-    loggerError = context2.logger.error(String(error));
-  }
-  return loggerError;
-}
-
 // src/helpers/command.ts
 import { Value } from "@sinclair/typebox/value";
 function getCommand(inputs, pluginOptions) {
@@ -933,7 +985,7 @@ async function verifySignature(publicKeyPem, inputs, signature) {
       ref: inputs.ref,
       command: inputs.command
     };
-    const pemContents = publicKeyPem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").trim();
+    const pemContents = publicKeyPem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace(/\s+/g, "");
     const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
     const publicKey = await crypto.subtle.importKey(
       "spki",
@@ -986,16 +1038,12 @@ var inputSchema = T2.Object({
 
 // src/actions.ts
 config();
-async function handleError(context2, pluginOptions, error) {
+async function handleError(context, pluginOptions, error) {
   console.error(error);
-  const loggerError = transformError(context2, error);
-  if (loggerError instanceof LogReturn) {
-    core.setFailed(loggerError.logMessage.diff);
-  } else if (loggerError instanceof Error) {
-    core.setFailed(loggerError);
-  }
+  const loggerError = transformError(context, error);
+  core.setFailed(loggerError.logMessage.diff);
   if (pluginOptions.postCommentOnError && loggerError) {
-    await context2.commentHandler.postComment(context2, loggerError);
+    await context.commentHandler.postComment(context, loggerError);
   }
 }
 async function createActionsPlugin(handler, options) {
@@ -1005,7 +1053,8 @@ async function createActionsPlugin(handler, options) {
     core.setFailed("Error: PLUGIN_GITHUB_TOKEN env is not set");
     return;
   }
-  const body = github2.context.payload.inputs;
+  const githubContext = getGithubContext();
+  const body = githubContext.payload.inputs;
   const inputSchemaErrors = [...Value3.Errors(inputSchema, body)];
   if (inputSchemaErrors.length) {
     console.dir(inputSchemaErrors, { depth: null });
@@ -1043,7 +1092,7 @@ async function createActionsPlugin(handler, options) {
     env2 = process.env;
   }
   const command = getCommand(inputs, pluginOptions);
-  const context2 = {
+  const context = {
     eventName: inputs.eventName,
     payload: inputs.eventPayload,
     command,
@@ -1056,20 +1105,21 @@ async function createActionsPlugin(handler, options) {
     commentHandler: new CommentHandler()
   };
   try {
-    const result = await handler(context2);
+    const result = await handler(context);
     core.setOutput("result", result);
     if (pluginOptions?.returnDataToKernel) {
       await returnDataToKernel(pluginGithubToken, inputs.stateId, result);
     }
   } catch (error) {
-    await handleError(context2, pluginOptions, error);
+    await handleError(context, pluginOptions, error);
   }
 }
 async function returnDataToKernel(repoToken, stateId, output) {
+  const githubContext = getGithubContext();
   const octokit = new customOctokit({ auth: repoToken });
   await octokit.rest.repos.createDispatchEvent({
-    owner: github2.context.repo.owner,
-    repo: github2.context.repo.repo,
+    owner: githubContext.repo.owner,
+    repo: githubContext.repo.repo,
     event_type: "return-data-to-ubiquity-os-kernel",
     client_payload: {
       state_id: stateId,
@@ -1136,7 +1186,7 @@ import { Value as Value4 } from "@sinclair/typebox/value";
 
 // ../../node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
-  return (context2, next) => {
+  return (context, next) => {
     let index = -1;
     return dispatch(0);
     async function dispatch(i) {
@@ -1149,31 +1199,31 @@ var compose = (middleware, onError, onNotFound) => {
       let handler;
       if (middleware[i]) {
         handler = middleware[i][0][0];
-        context2.req.routeIndex = i;
+        context.req.routeIndex = i;
       } else {
         handler = i === middleware.length && next || void 0;
       }
       if (handler) {
         try {
-          res = await handler(context2, () => dispatch(i + 1));
+          res = await handler(context, () => dispatch(i + 1));
         } catch (err) {
           if (err instanceof Error && onError) {
-            context2.error = err;
-            res = await onError(err, context2);
+            context.error = err;
+            res = await onError(err, context);
             isError = true;
           } else {
             throw err;
           }
         }
       } else {
-        if (context2.finalized === false && onNotFound) {
-          res = await onNotFound(context2);
+        if (context.finalized === false && onNotFound) {
+          res = await onNotFound(context);
         }
       }
-      if (res && (context2.finalized === false || isError)) {
-        context2.res = res;
+      if (res && (context.finalized === false || isError)) {
+        context.res = res;
       }
-      return context2;
+      return context;
     }
   };
 };
@@ -1575,7 +1625,7 @@ var raw = (value, callbacks) => {
   escapedString.callbacks = callbacks;
   return escapedString;
 };
-var resolveCallback = async (str, phase, preserveCallbacks, context2, buffer) => {
+var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) => {
   if (typeof str === "object" && !(str instanceof String)) {
     if (!(str instanceof Promise)) {
       str = str.toString();
@@ -1593,9 +1643,9 @@ var resolveCallback = async (str, phase, preserveCallbacks, context2, buffer) =>
   } else {
     buffer = [str];
   }
-  const resStr = Promise.all(callbacks.map((c) => c({ phase, buffer, context: context2 }))).then(
+  const resStr = Promise.all(callbacks.map((c) => c({ phase, buffer, context }))).then(
     (res) => Promise.all(
-      res.filter(Boolean).map((str2) => resolveCallback(str2, phase, false, context2, buffer))
+      res.filter(Boolean).map((str2) => resolveCallback(str2, phase, false, context, buffer))
     ).then(() => buffer[0])
   );
   if (preserveCallbacks) {
@@ -1988,13 +2038,13 @@ var Hono = class {
     const composed = compose(matchResult[0], this.errorHandler, this.#notFoundHandler);
     return (async () => {
       try {
-        const context2 = await composed(c);
-        if (!context2.finalized) {
+        const context = await composed(c);
+        if (!context.finalized) {
           throw new Error(
             "Context is not finalized. Did you forget to return a Response object or `await next()`?"
           );
         }
-        return context2.res;
+        return context.res;
       } catch (err) {
         return this.#handleError(err, c);
       }
@@ -2053,7 +2103,7 @@ var Node = class {
   #index;
   #varIndex;
   #children = /* @__PURE__ */ Object.create(null);
-  insert(tokens, index, paramMap, context2, pathErrorCheckOnly) {
+  insert(tokens, index, paramMap, context, pathErrorCheckOnly) {
     if (tokens.length === 0) {
       if (this.#index !== void 0) {
         throw PATH_ERROR;
@@ -2091,7 +2141,7 @@ var Node = class {
         }
         node = this.#children[regexpStr] = new Node();
         if (name !== "") {
-          node.#varIndex = context2.varIndex++;
+          node.#varIndex = context.varIndex++;
         }
       }
       if (!pathErrorCheckOnly && name !== "") {
@@ -2111,7 +2161,7 @@ var Node = class {
         node = this.#children[token] = new Node();
       }
     }
-    node.insert(restTokens, index, paramMap, context2, pathErrorCheckOnly);
+    node.insert(restTokens, index, paramMap, context, pathErrorCheckOnly);
   }
   buildRegExpStr() {
     const childKeys = Object.keys(this.#children).sort(compareKey);
@@ -2653,11 +2703,11 @@ var HTTPException = class extends Error {
 };
 
 // src/server.ts
-async function handleError2(context2, pluginOptions, error) {
+async function handleError2(context, pluginOptions, error) {
   console.error(error);
-  const loggerError = transformError(context2, error);
+  const loggerError = transformError(context, error);
   if (pluginOptions.postCommentOnError && loggerError) {
-    await context2.commentHandler.postComment(context2, loggerError);
+    await context.commentHandler.postComment(context, loggerError);
   }
   throw new HTTPException(500, { message: "Unexpected error" });
 }
@@ -2708,7 +2758,7 @@ function createPlugin(handler, manifest, options) {
     const workerName = new URL(inputs.ref).hostname.split(".")[0];
     PluginRuntimeInfo.getInstance({ ...env2, CLOUDFLARE_WORKER_NAME: workerName });
     const command = getCommand(inputs, pluginOptions);
-    const context2 = {
+    const context = {
       eventName: inputs.eventName,
       payload: inputs.eventPayload,
       command,
@@ -2721,96 +2771,195 @@ function createPlugin(handler, manifest, options) {
       commentHandler: new CommentHandler()
     };
     try {
-      const result = await handler(context2);
+      const result = await handler(context);
       return ctx.json({ stateId: inputs.stateId, output: result ?? {} });
     } catch (error) {
-      await handleError2(context2, pluginOptions, error);
+      await handleError2(context, pluginOptions, error);
     }
   });
   return app;
 }
 
 // src/llm/index.ts
+var EMPTY_STRING = "";
 function normalizeBaseUrl(baseUrl) {
-  return baseUrl.trim().replace(/\/+$/, "");
+  let normalized = baseUrl.trim();
+  while (normalized.endsWith("/")) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
+}
+var MAX_LLM_RETRIES = 2;
+var RETRY_BACKOFF_MS = [250, 750];
+function getRetryDelayMs(attempt) {
+  return RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)] ?? 750;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function getEnvString(name) {
-  if (typeof process === "undefined" || !process?.env) return "";
-  return String(process.env[name] ?? "").trim();
+  if (typeof process === "undefined" || !process?.env) return EMPTY_STRING;
+  return String(process.env[name] ?? EMPTY_STRING).trim();
 }
 function getAiBaseUrl(options) {
   if (typeof options.baseUrl === "string" && options.baseUrl.trim()) {
     return normalizeBaseUrl(options.baseUrl);
   }
-  const envBaseUrl = getEnvString("UBQ_AI_BASE_URL") || getEnvString("UBQ_AI_URL");
+  const envBaseUrl = getEnvString("UOS_AI_URL") || getEnvString("UOS_AI_BASE_URL");
   if (envBaseUrl) return normalizeBaseUrl(envBaseUrl);
-  return "https://ai.ubq.fi";
+  return "https://ai-ubq-fi.deno.dev";
 }
 async function callLlm(options, input) {
-  const authToken = input?.authToken ?? "";
-  const ubiquityKernelToken = input?.ubiquityKernelToken ?? "";
-  const payload = input?.payload;
-  const owner = payload?.repository?.owner?.login ?? "";
-  const repo = payload?.repository?.name ?? "";
-  const installationId = payload?.installation?.id;
-  if (!authToken) throw new Error("Missing authToken in inputs");
-  const requiresKernelToken = authToken.trim().startsWith("gh");
-  if (requiresKernelToken && !ubiquityKernelToken) {
-    throw new Error("Missing ubiquityKernelToken in inputs (kernel attestation is required for GitHub auth)");
-  }
-  const url = `${getAiBaseUrl(options)}/v1/chat/completions`;
-  const { baseUrl: _baseUrl, model, stream, messages, ...rest } = options;
+  const authToken = String(input.authToken ?? EMPTY_STRING).trim();
+  if (!authToken) {
+    const err = new Error("Missing authToken in input");
+    err.status = 401;
+    throw err;
+  }
+  const kernelToken = "ubiquityKernelToken" in input ? input.ubiquityKernelToken : void 0;
+  const payload = getPayload(input);
+  const { owner, repo, installationId } = getRepoMetadata(payload);
+  ensureKernelToken(authToken, kernelToken);
+  const { baseUrl, model, stream: isStream, messages, ...rest } = options;
+  ensureMessages(messages);
+  const url = buildAiUrl(options, baseUrl);
   const body = JSON.stringify({
     ...rest,
     ...model ? { model } : {},
     messages,
-    stream: stream ?? false
+    stream: isStream ?? false
   });
+  const headers = buildHeaders(authToken, {
+    owner,
+    repo,
+    installationId,
+    ubiquityKernelToken: kernelToken
+  });
+  const response = await fetchWithRetry(url, { method: "POST", headers, body }, MAX_LLM_RETRIES);
+  if (isStream) {
+    if (!response.body) {
+      throw new Error("LLM API error: missing response body for streaming request");
+    }
+    return parseSseStream(response.body);
+  }
+  return response.json();
+}
+function ensureKernelToken(authToken, kernelToken) {
+  const isKernelTokenRequired = authToken.startsWith("gh");
+  if (isKernelTokenRequired && !kernelToken) {
+    const err = new Error("Missing ubiquityKernelToken in input (kernel attestation is required for GitHub auth)");
+    err.status = 401;
+    throw err;
+  }
+}
+function ensureMessages(messages) {
+  if (!Array.isArray(messages) || messages.length === 0) {
+    const err = new Error("messages must be a non-empty array");
+    err.status = 400;
+    throw err;
+  }
+}
+function buildAiUrl(options, baseUrl) {
+  return `${getAiBaseUrl({ ...options, baseUrl })}/v1/chat/completions`;
+}
+async function fetchWithRetry(url, options, maxRetries) {
+  let attempt = 0;
+  let lastError;
+  while (attempt <= maxRetries) {
+    try {
+      const response = await fetch(url, options);
+      if (response.ok) return response;
+      const errText = await response.text();
+      if (response.status >= 500 && attempt < maxRetries) {
+        await sleep(getRetryDelayMs(attempt));
+        attempt += 1;
+        continue;
+      }
+      const error = new Error(`LLM API error: ${response.status} - ${errText}`);
+      error.status = response.status;
+      throw error;
+    } catch (error) {
+      lastError = error;
+      if (attempt >= maxRetries) throw error;
+      await sleep(getRetryDelayMs(attempt));
+      attempt += 1;
+    }
+  }
+  throw lastError ?? new Error("LLM API error: request failed after retries");
+}
+function getPayload(input) {
+  if ("payload" in input) {
+    return input.payload;
+  }
+  return input.eventPayload;
+}
+function getRepoMetadata(payload) {
+  const repoPayload = payload;
+  return {
+    owner: repoPayload?.repository?.owner?.login ?? EMPTY_STRING,
+    repo: repoPayload?.repository?.name ?? EMPTY_STRING,
+    installationId: repoPayload?.installation?.id
+  };
+}
+function buildHeaders(authToken, options) {
   const headers = {
     Authorization: `Bearer ${authToken}`,
     "Content-Type": "application/json"
   };
-  if (owner) headers["X-GitHub-Owner"] = owner;
-  if (repo) headers["X-GitHub-Repo"] = repo;
-  if (typeof installationId === "number" && Number.isFinite(installationId)) {
-    headers["X-GitHub-Installation-Id"] = String(installationId);
-  }
-  if (ubiquityKernelToken) {
-    headers["X-Ubiquity-Kernel-Token"] = ubiquityKernelToken;
+  if (options.owner) headers["X-GitHub-Owner"] = options.owner;
+  if (options.repo) headers["X-GitHub-Repo"] = options.repo;
+  if (typeof options.installationId === "number" && Number.isFinite(options.installationId)) {
+    headers["X-GitHub-Installation-Id"] = String(options.installationId);
   }
-  const response = await fetch(url, { method: "POST", headers, body });
-  if (!response.ok) {
-    const err = await response.text();
-    throw new Error(`LLM API error: ${response.status} - ${err}`);
-  }
-  if (options.stream) {
-    return parseSseStream(response.body);
+  if (options.ubiquityKernelToken) {
+    headers["X-Ubiquity-Kernel-Token"] = options.ubiquityKernelToken;
   }
-  return response.json();
+  return headers;
 }
 async function* parseSseStream(body) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
-  let buffer = "";
+  let buffer = EMPTY_STRING;
   try {
     while (true) {
-      const { value, done } = await reader.read();
-      if (done) break;
+      const { value, done: isDone } = await reader.read();
+      if (isDone) break;
       buffer += decoder.decode(value, { stream: true });
-      const events = buffer.split("\n\n");
-      buffer = events.pop() || "";
+      const { events, remainder } = splitSseEvents(buffer);
+      buffer = remainder;
       for (const event of events) {
-        if (event.startsWith("data: ")) {
-          const data = event.slice(6);
-          if (data === "[DONE]") return;
-          yield JSON.parse(data);
-        }
+        const data = getEventData(event);
+        if (!data) continue;
+        if (data.trim() === "[DONE]") return;
+        yield parseEventData(data);
       }
     }
   } finally {
     reader.releaseLock();
   }
 }
+function splitSseEvents(buffer) {
+  const normalized = buffer.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  const parts = normalized.split("\n\n");
+  const remainder = parts.pop() ?? EMPTY_STRING;
+  return { events: parts, remainder };
+}
+function getEventData(event) {
+  if (!event.trim()) return null;
+  const dataLines = event.split("\n").filter((line) => line.startsWith("data:"));
+  if (!dataLines.length) return null;
+  const data = dataLines.map((line) => line.startsWith("data: ") ? line.slice(6) : line.slice(5).replace(/^ /, EMPTY_STRING)).join("\n");
+  return data || null;
+}
+function parseEventData(data) {
+  try {
+    return JSON.parse(data);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const preview = data.length > 200 ? `${data.slice(0, 200)}...` : data;
+    throw new Error(`LLM stream parse error: ${message}. Data: ${preview}`);
+  }
+}
 export {
   CommentHandler,
   callLlm,