Fix edge cases: sub-second rate limit durations and UTF-8 BOM

- Primary rate limit: compute time.Until(resetTime) once and check the
  rounded result is >0 before showing 'Retry after X'. This avoids a
  TOCTOU race between the After(time.Now()) guard and the subsequent
  time.Until call, and prevents showing 'Retry after 0s.' when the
  reset time is imminent.

- Secondary rate limit: round RetryAfter first, then check >0.
  Previously, a RetryAfter of e.g. 200ms would pass the >0 guard
  but format as 'Retry after 0s.' after rounding.

- Add tests for both sub-second edge cases.

- Remove UTF-8 BOM accidentally introduced in error_test.go by
  .NET WriteAllText with the default UTF8 encoding.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: danmoseley

pkg/errors/error.go

@@ -165,21 +165,26 @@ func NewGitHubAPIErrorResponse(ctx context.Context, message string, resp *github
 	var rateLimitErr *github.RateLimitError
 	if stderrors.As(err, &rateLimitErr) {
 		resetTime := rateLimitErr.Rate.Reset.Time
-		if !resetTime.IsZero() && resetTime.After(time.Now()) {
+		if !resetTime.IsZero() {
 			retryIn := time.Until(resetTime).Round(time.Second)
-			return utils.NewToolResultError(fmt.Sprintf(
-				"%s: GitHub API rate limit exceeded. Retry after %v.", message, retryIn))
+			if retryIn > 0 {
+				return utils.NewToolResultError(fmt.Sprintf(
+					"%s: GitHub API rate limit exceeded. Retry after %v.", message, retryIn))
+			}
 		}
 		return utils.NewToolResultError(fmt.Sprintf(
 			"%s: GitHub API rate limit exceeded. Wait before retrying.", message))
 	}
 
 	var abuseErr *github.AbuseRateLimitError
 	if stderrors.As(err, &abuseErr) {
-		if abuseErr.RetryAfter != nil && *abuseErr.RetryAfter > 0 {
-			return utils.NewToolResultError(fmt.Sprintf(
-				"%s: GitHub secondary rate limit exceeded. Retry after %v.",
-				message, abuseErr.RetryAfter.Round(time.Second)))
+		if abuseErr.RetryAfter != nil {
+			retryAfter := abuseErr.RetryAfter.Round(time.Second)
+			if retryAfter > 0 {
+				return utils.NewToolResultError(fmt.Sprintf(
+					"%s: GitHub secondary rate limit exceeded. Retry after %v.",
+					message, retryAfter))
+			}
 		}
 		return utils.NewToolResultError(fmt.Sprintf(
 			"%s: GitHub secondary rate limit exceeded. Wait before retrying.", message))

pkg/errors/error_test.go

@@ -1,4 +1,4 @@
-package errors
+package errors
 
 import (
 	"context"
@@ -563,6 +563,24 @@ func TestNewGitHubAPIErrorResponse_RateLimits(t *testing.T) {
 		assertContextHasError(t, ctx, abuseErr)
 	})
 
+	t.Run("AbuseRateLimitError with sub-second RetryAfter falls back to wait message", func(t *testing.T) {
+		ctx := ContextWithGitHubErrors(context.Background())
+
+		// 200ms rounds to 0s, so should fall back to the generic wait message
+		retryAfter := 200 * time.Millisecond
+		abuseErr := &github.AbuseRateLimitError{
+			Response:   &http.Response{StatusCode: 403},
+			Message:    "You have exceeded a secondary rate limit.",
+			RetryAfter: &retryAfter,
+		}
+		resp := &github.Response{Response: abuseErr.Response}
+
+		result := NewGitHubAPIErrorResponse(ctx, "create issue", resp, abuseErr)
+
+		text := requireErrorText(t, result)
+		assert.Contains(t, text, "GitHub secondary rate limit exceeded. Wait before retrying.")
+	})
+
 	t.Run("RateLimitError with reset time in the past falls back to wait message", func(t *testing.T) {
 		ctx := ContextWithGitHubErrors(context.Background())
 
@@ -580,6 +598,24 @@ func TestNewGitHubAPIErrorResponse_RateLimits(t *testing.T) {
 		assert.Contains(t, text, "GitHub API rate limit exceeded. Wait before retrying.")
 	})
 
+	t.Run("RateLimitError with sub-second reset time falls back to wait message", func(t *testing.T) {
+		ctx := ContextWithGitHubErrors(context.Background())
+
+		// 250ms in the future: still positive, but rounds to 0s, so should fall back
+		resetTime := time.Now().Add(250 * time.Millisecond)
+		rateLimitErr := &github.RateLimitError{
+			Rate:     github.Rate{Reset: github.Timestamp{Time: resetTime}},
+			Response: &http.Response{StatusCode: 403},
+			Message:  "API rate limit exceeded",
+		}
+		resp := &github.Response{Response: rateLimitErr.Response}
+
+		result := NewGitHubAPIErrorResponse(ctx, "search code", resp, rateLimitErr)
+
+		text := requireErrorText(t, result)
+		assert.Contains(t, text, "GitHub API rate limit exceeded. Wait before retrying.")
+	})
+
 	t.Run("RateLimitError with zero reset time falls back to wait message", func(t *testing.T) {
 		ctx := ContextWithGitHubErrors(context.Background())