fix(errors): include retry-after in api errors

crates/google-workspace-cli/src/error.rs

@@ -120,6 +120,7 @@ mod tests {
             message: "bad".to_string(),
             reason: "r".to_string(),
             enable_url: None,
+            retry_after: None,
         };
         let label = error_label(&api_err);
         assert!(label.contains("error[api]:"));

crates/google-workspace-cli/src/executor.rs

@@ -462,6 +462,11 @@ pub async fn execute_method(
             .and_then(|v| v.to_str().ok())
             .unwrap_or("")
             .to_string();
+        let retry_after = response
+            .headers()
+            .get(reqwest::header::RETRY_AFTER)
+            .and_then(|v| v.to_str().ok())
+            .map(str::to_string);
 
         if !status.is_success() {
             let error_body = response.text().await.unwrap_or_default();
@@ -472,7 +477,7 @@ pub async fn execute_method(
                 latency_ms = latency_ms,
                 "API error"
             );
-            return handle_error_response(status, &error_body, &auth_method);
+            return handle_error_response(status, &error_body, &auth_method, retry_after);
         }
 
         tracing::debug!(
@@ -754,6 +759,7 @@ fn handle_error_response<T>(
     status: reqwest::StatusCode,
     error_body: &str,
     auth_method: &AuthMethod,
+    retry_after: Option<String>,
 ) -> Result<T, GwsError> {
     // If 401/403 and no auth was provided, give a helpful message
     if (status.as_u16() == 401 || status.as_u16() == 403) && *auth_method == AuthMethod::None {
@@ -800,6 +806,7 @@ fn handle_error_response<T>(
                 message,
                 reason,
                 enable_url,
+                retry_after,
             });
         }
     }
@@ -809,6 +816,7 @@ fn handle_error_response<T>(
         message: error_body.to_string(),
         reason: "httpError".to_string(),
         enable_url: None,
+        retry_after,
     })
 }
 
@@ -1947,6 +1955,7 @@ mod tests {
             reqwest::StatusCode::UNAUTHORIZED,
             "Unauthorized",
             &AuthMethod::None,
+            None,
         )
         .unwrap_err();
         match err {
@@ -1973,6 +1982,7 @@ mod tests {
             reqwest::StatusCode::UNAUTHORIZED,
             &json_err,
             &AuthMethod::OAuth,
+            None,
         )
         .unwrap_err();
         match err {
@@ -2008,6 +2018,7 @@ mod tests {
             reqwest::StatusCode::BAD_REQUEST,
             &json_err,
             &AuthMethod::OAuth,
+            None,
         )
         .unwrap_err();
         match err {
@@ -2024,6 +2035,31 @@ mod tests {
             _ => panic!("Expected Api error"),
         }
     }
+
+    #[test]
+    fn test_handle_error_response_preserves_retry_after_header() {
+        let json_err = json!({
+            "error": {
+                "code": 429,
+                "message": "Quota exceeded",
+                "errors": [{ "reason": "rateLimitExceeded" }]
+            }
+        })
+        .to_string();
+
+        let err = handle_error_response::<()>(
+            reqwest::StatusCode::TOO_MANY_REQUESTS,
+            &json_err,
+            &AuthMethod::OAuth,
+            Some("120".to_string()),
+        )
+        .unwrap_err();
+
+        match err {
+            GwsError::Api { retry_after, .. } => assert_eq!(retry_after.as_deref(), Some("120")),
+            _ => panic!("Expected Api error"),
+        }
+    }
 }
 
 #[tokio::test]
@@ -2156,6 +2192,7 @@ fn test_handle_error_response_non_json() {
         reqwest::StatusCode::INTERNAL_SERVER_ERROR,
         "Internal Server Error Text",
         &AuthMethod::OAuth,
+        None,
     )
     .unwrap_err();
     match err {
@@ -2223,6 +2260,7 @@ fn test_handle_error_response_access_not_configured_with_url() {
         reqwest::StatusCode::FORBIDDEN,
         &json_err,
         &AuthMethod::OAuth,
+        None,
     )
     .unwrap_err();
 
@@ -2260,6 +2298,7 @@ fn test_handle_error_response_access_not_configured_errors_array() {
         reqwest::StatusCode::FORBIDDEN,
         &json_err,
         &AuthMethod::OAuth,
+        None,
     )
     .unwrap_err();
 

crates/google-workspace-cli/src/helpers/calendar.rs

@@ -274,6 +274,7 @@ async fn handle_agenda(matches: &ArgMatches) -> Result<(), GwsError> {
             message: err,
             reason: "calendarList_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 

crates/google-workspace-cli/src/helpers/events/subscribe.rs

@@ -221,6 +221,7 @@ pub(super) async fn handle_subscribe(
                     message: format!("Failed to create Pub/Sub topic: {body}"),
                     reason: "pubsubError".to_string(),
                     enable_url: None,
+                    retry_after: None,
                 });
             }
 
@@ -246,6 +247,7 @@ pub(super) async fn handle_subscribe(
                     message: format!("Failed to create Pub/Sub subscription: {body}"),
                     reason: "pubsubError".to_string(),
                     enable_url: None,
+                    retry_after: None,
                 });
             }
 
@@ -421,6 +423,7 @@ async fn pull_loop(
                 message: format!("Pub/Sub pull failed: {body}"),
                 reason: "pubsubError".to_string(),
                 enable_url: None,
+                retry_after: None,
             });
         }
 

crates/google-workspace-cli/src/helpers/gmail/mod.rs

@@ -438,6 +438,7 @@ pub(super) fn build_api_error(status: u16, body: &str, context: &str) -> GwsErro
         message: format!("{context}: {message}"),
         reason,
         enable_url,
+        retry_after: None,
     }
 }
 
@@ -3614,6 +3615,7 @@ mod tests {
                 message,
                 reason,
                 enable_url,
+                ..
             } => {
                 assert_eq!(code, 403);
                 assert!(message.contains("Test context"));

crates/google-workspace-cli/src/helpers/gmail/triage.rs

@@ -65,6 +65,7 @@ pub async fn handle_triage(matches: &ArgMatches) -> Result<(), GwsError> {
             message: err,
             reason: "list_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 

crates/google-workspace-cli/src/helpers/gmail/watch.rs

@@ -67,6 +67,7 @@ pub(super) async fn handle_watch(
                     message: format!("Failed to create Pub/Sub topic: {body}"),
                     reason: "pubsubError".to_string(),
                     enable_url: None,
+                    retry_after: None,
                 });
             }
 
@@ -132,6 +133,7 @@ pub(super) async fn handle_watch(
                 message: format!("Failed to create Pub/Sub subscription: {body}"),
                 reason: "pubsubError".to_string(),
                 enable_url: None,
+                retry_after: None,
             });
         }
 
@@ -168,6 +170,7 @@ pub(super) async fn handle_watch(
                 ),
                 reason: "gmailError".to_string(),
                 enable_url: None,
+                retry_after: None,
             });
         }
 
@@ -301,6 +304,7 @@ async fn watch_pull_loop(
                 message: format!("Pub/Sub pull failed: {body}"),
                 reason: "pubsubError".to_string(),
                 enable_url: None,
+                retry_after: None,
             });
         }
 

crates/google-workspace-cli/src/helpers/workflows.rs

@@ -251,6 +251,7 @@ async fn get_json(
             message: body,
             reason: "workflow_request_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 
@@ -517,6 +518,7 @@ async fn handle_email_to_task(matches: &ArgMatches) -> Result<(), GwsError> {
             message: body,
             reason: "task_create_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 
@@ -676,6 +678,7 @@ async fn handle_file_announce(matches: &ArgMatches) -> Result<(), GwsError> {
             message: body,
             reason: "chat_send_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 

crates/google-workspace-cli/src/timezone.rs

@@ -92,6 +92,7 @@ async fn fetch_account_timezone(client: &reqwest::Client, token: &str) -> Result
             message: body,
             reason: "timezone_fetch_failed".to_string(),
             enable_url: None,
+            retry_after: None,
         });
     }
 

crates/google-workspace/src/error.rs

@@ -26,6 +26,8 @@ pub enum GwsError {
         reason: String,
         /// For `accessNotConfigured` errors: the GCP console URL to enable the API.
         enable_url: Option<String>,
+        /// Raw Retry-After response header, when provided by the API.
+        retry_after: Option<String>,
     },
 
     #[error("{0}")]
@@ -71,6 +73,7 @@ impl GwsError {
                 message,
                 reason,
                 enable_url,
+                retry_after,
             } => {
                 let mut error_obj = json!({
                     "code": code,
@@ -80,6 +83,9 @@ impl GwsError {
                 if let Some(url) = enable_url {
                     error_obj["enable_url"] = json!(url);
                 }
+                if let Some(value) = retry_after {
+                    error_obj["retry_after"] = json!(value);
+                }
                 json!({ "error": error_obj })
             }
             GwsError::Validation(msg) => json!({
@@ -125,6 +131,7 @@ mod tests {
             message: "Not Found".to_string(),
             reason: "notFound".to_string(),
             enable_url: None,
+            retry_after: None,
         };
         assert_eq!(err.exit_code(), GwsError::EXIT_CODE_API);
     }
@@ -185,6 +192,7 @@ mod tests {
             message: "Not Found".to_string(),
             reason: "notFound".to_string(),
             enable_url: None,
+            retry_after: None,
         };
         let json = err.to_json();
         assert_eq!(json["error"]["code"], 404);
@@ -193,6 +201,19 @@ mod tests {
         assert!(json["error"]["enable_url"].is_null());
     }
 
+    #[test]
+    fn test_error_to_json_api_includes_retry_after() {
+        let err = GwsError::Api {
+            code: 429,
+            message: "Quota exceeded".to_string(),
+            reason: "rateLimitExceeded".to_string(),
+            enable_url: None,
+            retry_after: Some("120".to_string()),
+        };
+        let json = err.to_json();
+        assert_eq!(json["error"]["retry_after"], "120");
+    }
+
     #[test]
     fn test_error_to_json_validation() {
         let err = GwsError::Validation("Invalid input".to_string());
@@ -236,6 +257,7 @@ mod tests {
             message: "Gmail API has not been used in project 549352339482 before or it is disabled.".to_string(),
             reason: "accessNotConfigured".to_string(),
             enable_url: Some("https://console.developers.google.com/apis/api/gmail.googleapis.com/overview?project=549352339482".to_string()),
+            retry_after: None,
         };
         let json = err.to_json();
         assert_eq!(json["error"]["code"], 403);
@@ -253,6 +275,7 @@ mod tests {
             message: "API not enabled.".to_string(),
             reason: "accessNotConfigured".to_string(),
             enable_url: None,
+            retry_after: None,
         };
         let json = err.to_json();
         assert_eq!(json["error"]["code"], 403);