Function readSSE

internal/llm/llm.go:468–536

readSSE reads OpenAI SSE frames until [DONE] or EOF, forwarding content/reasoning/tool-call events to out. Returns the final assistant message (content + accumulated tool calls), the server completion and prompt token counts, and any scanner error. parent is threaded through so sends abort on cancel

(parent context.Context, body io.Reader, budget cloud.BudgetStatus, out chan<- Event, onFrame func())

		// Drain before the deferred Close so the keep-alive connection returns
		// to the pool instead of being discarded, same as the 402/default arms.
		_, _ = io.Copy(io.Discard, resp.Body)
		return nil, cloud.BudgetStatus{}, nil, cloud.ErrUnauthorized
	case 402:
		// Pass depleted. Body ignored: the status code is the whole signal,
		// the UI banner is fixed text, the returned snapshot reflects it.
		_, _ = io.Copy(io.Discard, resp.Body)
		return nil, cloud.BudgetStatus{Set: true, Remaining: 0}, nil, cloud.ErrBudgetExhausted
	default:
		b, _ := io.ReadAll(resp.Body)
		return nil, cloud.BudgetStatus{}, b, &httpStatusError{status: resp.StatusCode, msg: errorMessageFromBody(b)}
	}
}

// httpStatusError preserves the HTTP status behind the user-facing message so
// retryable can classify transience; Error() keeps the exact "status: message"
// string the error banner has always shown.
type httpStatusError struct {
	status int
	msg    string
}

func (e *httpStatusError) Error() string { return fmt.Sprintf("%d: %s", e.status, e.msg) }

// retryable reports whether a pre-stream failure is worth resending: transport
// errors and the statuses that signal a transient server state. 404 is
// semantically permanent, but LiteLLM-style proxies emit it for transient
// upstream misses (the Agnes-AI freeze in issue #7), and the rising backoff
// bounds the cost of a truly permanent one. 401/402 arrive as typed sentinels
// the UI handles; 400 and other client errors fail identically on every
// resend.
func retryable(err error) bool {
	var un cloud.ErrUnreachable
	if errors.As(err, &un) {
		return true
	}
	var hs *httpStatusError
	if errors.As(err, &hs) {
		return hs.status == 404 || hs.status == 408 || hs.status == 429 || hs.status >= 500
	}
	return false
}

// errorMessageFromBody extracts the user-facing string from a non-2xx body.
// hamrpass wraps errors as `{"error":{"message":...,"provider_hint":...}}`; we
// prefer provider_hint (providers stash the human diagnostic there), fall back
// to message, then to the raw first line so non-hamrpass backends still surface
// whatever they emit.
func errorMessageFromBody(b []byte) string {
	var env struct {
		Error struct {
			Message      string `json:"message"`
			ProviderHint string `json:"provider_hint"`
		} `json:"error"`
	}
	if json.Unmarshal(b, &env) == nil {
		if env.Error.ProviderHint != "" {
			return env.Error.ProviderHint
		}