@cad0p/pi-usage 0.0.0-stage → 0.11.2

package/src/providers/codex.js

@@ -0,0 +1,151 @@
+/**
+ * OpenAI Codex quota from a Pi OAuth access token.
+ *
+ * Endpoint: GET https://chatgpt.com/backend-api/wham/usage
+ * Required headers: Bearer token, `chatgpt-account-id` (taken from the JWT claim
+ * `https://api.openai.com/auth.chatgpt_account_id`) and the Codex originator.
+ *
+ * Windows: `rate_limit.primary_window` (5h) and `rate_limit.secondary_window`
+ * (weekly), each `{ used_percent, limit_window_seconds, reset_after_seconds, reset_at }`.
+ *
+ * No refresh is attempted: OpenAI rotates the refresh token, so refreshing here
+ * would invalidate the copy Pi has stored.
+ */
+
+import { buildWindow, clampPercent, degradedResult, displayIdentity, finiteNumber, parseReset, parseResetSeconds, stringValue, windowFromSeconds } from "../model.js";
+import { requestJson } from "../http.js";
+import { extractChatGptAccountId } from "../auth/jwt.js";
+
+const USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+
+/**
+ * @param {unknown} value
+ * @returns {Record<string, unknown> | null}
+ */
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? /** @type {Record<string, unknown>} */ (value)
+    : null;
+}
+
+/**
+ * @param {Record<string, unknown>} window
+ * @param {string} fallbackId
+ * @param {number} now
+ * @returns {import("../model.js").QuotaWindow | null}
+ */
+function windowFromRateLimit(window, fallbackId, now) {
+  const used = clampPercent(window.used_percent ?? window.usedPercent);
+  if (used === null) return null;
+
+  const windowSeconds = finiteNumber(window.limit_window_seconds);
+  const derived = windowFromSeconds(windowSeconds);
+  const id = windowSeconds === null ? fallbackId : derived.id;
+  const label = windowSeconds === null
+    ? (fallbackId === "5h" ? "5h window" : "Weekly window")
+    : derived.label;
+
+  const explicitReset = parseReset(window.reset_at, now);
+  const resets = explicitReset.resetsAt !== null
+    ? explicitReset
+    : parseResetSeconds(window.reset_after_seconds, now);
+
+  return buildWindow({
+    id,
+    label,
+    usedPercent: used,
+    resetsAt: resets.resetsAt,
+    windowSeconds,
+    now,
+  });
+}
+
+/**
+ * @param {import("../auth/pi-auth.js").PiCredential} credential
+ * @param {{ now?: number, fetchFn?: typeof fetch, timeoutMs?: number, expiresInMin?: number | null }} [options]
+ * @returns {Promise<import("../model.js").QuotaResult>}
+ */
+export async function fetchQuota(credential, options = {}) {
+  const now = options.now ?? Date.now();
+  const accountId = credential.accountId ?? (credential.access ? extractChatGptAccountId(credential.access) : null);
+  const base = {
+    family: "codex",
+    label: "Codex (Pi)",
+    account: displayIdentity({ ...credential, accountId }),
+    plan: credential.planType,
+    source: credential.source,
+    sourceKind: credential.sourceKind ?? "pi",
+    expiresInMin: options.expiresInMin ?? null,
+  };
+
+  if (!credential.access) {
+    return degradedResult({ ...base, error: "Pi store has no openai-codex access token; run /login openai-codex in Pi" });
+  }
+
+  /** @type {Record<string, string>} */
+  const headers = {
+    Authorization: `Bearer ${credential.access}`,
+    accept: "application/json",
+    originator: "codex_cli_rs",
+  };
+  if (accountId) headers["chatgpt-account-id"] = accountId;
+
+  const response = await requestJson(USAGE_URL, { headers, fetchFn: options.fetchFn, timeoutMs: options.timeoutMs });
+  if (!response.ok) {
+    const error = response.authError
+      ? "Codex token expired or rejected; use any Codex model in Pi to refresh it"
+      : `Codex usage request failed: ${response.error}`;
+    return degradedResult({ ...base, error });
+  }
+
+  const body = record(response.body) ?? {};
+  const rateLimit = record(body.rate_limit) ?? {};
+  const plan = stringValue(body.plan_type) ?? credential.planType ?? null;
+
+  /** @type {import("../model.js").QuotaWindow[]} */
+  const windows = [];
+  const primary = record(rateLimit.primary_window);
+  const secondary = record(rateLimit.secondary_window);
+  if (primary) {
+    const window = windowFromRateLimit(primary, "5h", now);
+    if (window) windows.push(window);
+  }
+  if (secondary) {
+    const window = windowFromRateLimit(secondary, "weekly", now);
+    if (window) windows.push(window);
+  }
+
+  const credits = record(body.credits);
+  if (credits && credits.has_credits === true && credits.unlimited !== true) {
+    const balance = finiteNumber(credits.balance);
+    if (balance !== null && balance > 0) {
+      windows.push(
+        buildWindow({
+          id: "credits",
+          label: "Credits",
+          usedPercent: null,
+          remainingPercent: null,
+          note: `${balance} credits available`,
+          now,
+        }),
+      );
+    }
+  }
+
+  if (windows.length === 0) {
+    return degradedResult({
+      ...base,
+      plan,
+      error: "Codex usage response had no primary/secondary window (API shape may have changed)",
+    });
+  }
+
+  return {
+    ...base,
+    plan,
+    windows,
+    error: null,
+    ok: true,
+    updatedAt: new Date(now).toISOString(),
+  };
+}

package/src/providers/error-kind.js

@@ -0,0 +1,128 @@
+/**
+ * Classify a provider error message so renderers can pick a distinct glyph,
+ * colour and tooltip per cause.
+ *
+ * Every renderer collapses "failed" into one symbol today, which is the
+ * visible symptom the user reported: a provider that is just backing off
+ * reads the same as one whose sign-in has expired. Distinguishing the two
+ * makes the line actionable instead of alarming.
+ *
+ * Categories:
+ *
+ *   `transient` — upstream briefly unavailable (timeout, ECONNRESET, 5xx).
+ *                 mergeLastGood() can substitute the previous good snapshot.
+ *   `throttle`  — the vendor returned 429 and we are in a backoff window.
+ *                 mergeLastGood() can substitute too.
+ *   `expired`   — the stored OAuth/API token is past its expiry. Action
+ *                 required; the line must say so clearly.
+ *   `auth`      — the upstream rejected the credential (401/403) but the
+ *                 token is not yet past its stored expiry. Action required.
+ *   `missing`   — no credential or no cookie was found at all. Tells the
+ *                 user to log in, not that anything is broken.
+ *   `unknown`   — anything else. Better than "!" with no hint.
+ *
+ * The classification is intentionally regex-based and conservative: a
+ * misclassified permanent error masked as transient would hide a real
+ * problem. Only patterns that already exist in the codebase (see
+ * providers/backoff.js for `isAuthFailure`, sticky.js for the
+ * `TRANSIENT` set) qualify.
+ */
+
+export const ERROR_KINDS = ["transient", "throttle", "expired", "auth", "missing", "unknown"];
+
+/** @typedef {"transient" | "throttle" | "expired" | "auth" | "missing" | "unknown"} ErrorKind */
+
+/**
+ * @param {string | null | undefined} error
+ * @returns {ErrorKind}
+ */
+export function errorKind(error) {
+  if (!error || typeof error !== "string") return "unknown";
+  if (
+    /no [a-z-]+ credential|has no (anthropic|openai-codex|antigravity|opencode-go) (access )?token|no key stored|no "auth" cookie|no opencode\.ai session/i.test(
+      error,
+    )
+  ) {
+    return "missing";
+  }
+  if (
+    /token expired|token EXPIRED|token -?\d+m|expires in -\d+|sign-in expired|re-authenticate|expired or rejected|rejected by .* zen|rejected; run \/login|reconnect OpenCode in Pi/i.test(
+      error,
+    )
+  ) {
+    return "expired";
+  }
+  if (/HTTP 401|HTTP 403|401|403|unauthorized|forbidden|invalid_grant|token rejected/i.test(error)) {
+    return "auth";
+  }
+  if (/HTTP 429|rate limited|backing off|throttle/i.test(error)) {
+    return "throttle";
+  }
+  if (/HTTP 5\d\d|timed out|timeout|ECONNRESET|socket|network|fetch failed|ENOTFOUND|ETIMEDOUT|EPIPE|ECONNREFUSED|aborted|hang up/i.test(error)) {
+    return "transient";
+  }
+  return "unknown";
+}
+
+/**
+ * Whether `errorKind()` will let mergeLastGood() keep the previous good
+ * snapshot. Only `transient` and `throttle` qualify; everything else points
+ * at a real problem that must not be masked.
+ *
+ * @param {string | null | undefined} error
+ * @returns {boolean}
+ */
+export function isRecoverableError(error) {
+  const kind = errorKind(error);
+  return kind === "transient" || kind === "throttle";
+}
+
+/**
+ * The glyph a renderer should paint when the provider has no usable windows.
+ * Distinct from `?` (which means "no percentage reported, but the provider
+ * answered") so the line is not ambiguous.
+ *
+ * @param {string | null | undefined} error
+ * @returns {string}
+ */
+export function errorGlyph(error) {
+  switch (errorKind(error)) {
+    case "transient":
+      return "~";
+    case "throttle":
+      return "…";
+    case "expired":
+    case "auth":
+      return "!";
+    case "missing":
+      return "·";
+    default:
+      return "?";
+  }
+}
+
+/**
+ * A one-line, user-facing description of the failure, safe to surface in a
+ * tooltip or under a glyph in the compact line. Already redacted upstream.
+ *
+ * @param {string | null | undefined} error
+ * @returns {string}
+ */
+export function errorCaption(error) {
+  const kind = errorKind(error);
+  if (!error) return kind === "unknown" ? "no data" : "no data";
+  switch (kind) {
+    case "throttle":
+      return "rate-limited upstream";
+    case "transient":
+      return "upstream temporarily unavailable";
+    case "expired":
+      return "token expired";
+    case "auth":
+      return "credential rejected";
+    case "missing":
+      return "not configured";
+    default:
+      return "unavailable";
+  }
+}

package/src/providers/github-actions.js

@@ -0,0 +1,379 @@
+/**
+ * GitHub Actions monthly quota from the user's already-authenticated `gh` CLI.
+ *
+ * The GitHub token is never read by piQuota: requests are delegated to `gh api`,
+ * which receives GH_TOKEN/GITHUB_TOKEN only through its child-process environment.
+ * The provider has no Pi-store credential; the engine passes a non-secret descriptor
+ * so normal provider bookkeeping can remain shared without fabricating a token.
+ */
+
+import { runCommand as defaultRunCommand } from "../exec.js";
+import { buildWindow, degradedResult, windowFromSeconds } from "../model.js";
+import { redact } from "../http.js";
+
+const FAMILY = "github-actions";
+const LABEL = "GitHub Actions";
+const SOURCE = "gh CLI";
+const DEFAULT_ORG = "KoralisSoft";
+const ALLOWANCES = { free: 2000, pro: 3000, team: 3000, enterprise_cloud: 50000 };
+const LINUX_MINUTES = 30 * 24 * 60 * 60;
+
+/** @param {unknown} value */
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? /** @type {Record<string, unknown>} */ (value)
+    : null;
+}
+
+/**
+ * Apply the shared redactor plus GitHub-specific token patterns (ghp_/gho_ and
+ * fine-grained github_pat_ tokens are not part of the shared HTTP redactor yet).
+ * @param {unknown} value
+ * @returns {string}
+ */
+function safeText(value) {
+  return redact(value)
+    .replace(/\bgh[pousr]_[A-Za-z0-9_]+/g, "<redacted>")
+    .replace(/\bgithub_pat_[A-Za-z0-9_]+/g, "<redacted>");
+}
+
+/**
+ * @param {string} path
+ * @param {{ runCommand: typeof defaultRunCommand, timeoutMs: number, env: Record<string, string | undefined> }} options
+ * @returns {Promise<{ ok: true, body: unknown } | { ok: false, error: string }>}
+ */
+async function requestGhJson(path, options) {
+  let result;
+  try {
+    result = await options.runCommand(
+      "gh",
+      ["api", "-H", "Accept: application/vnd.github+json", path],
+      { timeoutMs: options.timeoutMs, env: options.env },
+    );
+  } catch (error) {
+    return { ok: false, error: `GitHub Actions could not run the gh CLI: ${safeText(error?.message ?? error)}. Install GitHub CLI from https://cli.github.com/ and try again.` };
+  }
+
+  if (result?.status === null) {
+    return {
+      ok: false,
+      error: "GitHub Actions requires the gh CLI, but it is not installed or could not start; install it from https://cli.github.com/ and try again.",
+    };
+  }
+  if (result?.status !== 0) {
+    const detail = safeText(result?.stderr || result?.error || `gh exited with status ${result?.status ?? "unknown"}`);
+    const lower = detail.toLowerCase();
+    if (/\b404\b|not found/.test(lower)) {
+      return {
+        ok: false,
+        error: `GitHub organization was not found or your account cannot access it (${detail}); verify PI_QUOTA_GITHUB_ORG and your organization membership.`,
+      };
+    }
+    if (/\b401\b|not logged|authentication|unauthorized/.test(lower)) {
+      return {
+        ok: false,
+        error: `GitHub gh CLI is not authenticated (${detail}); run \`gh auth login\` and confirm \`gh auth status\` succeeds.`,
+      };
+    }
+    if (/\b403\b|forbidden|resource not accessible/.test(lower)) {
+      return {
+        ok: false,
+        error: `GitHub denied organization billing access (${detail}); run \`gh auth refresh -h github.com -s read:org,repo,workflow\` and verify you can view the organization's billing usage.`,
+      };
+    }
+    return {
+      ok: false,
+      error: `GitHub Actions gh request failed (${detail}); check \`gh auth status\`, organization membership, and billing access.`,
+    };
+  }
+
+  const stdout = typeof result.stdout === "string" ? result.stdout : "";
+  if (stdout.trim() === "") {
+    return { ok: false, error: `GitHub Actions received an empty response for ${safeText(path)}; verify gh access and retry.` };
+  }
+  try {
+    return { ok: true, body: JSON.parse(stdout) };
+  } catch {
+    return { ok: false, error: `GitHub Actions received malformed JSON for ${safeText(path)}; verify gh access and update piQuota if the API response changed.` };
+  }
+}
+
+/**
+ * @param {unknown} items
+ * @param {"Actions" | "actions"} product
+ * @param {"grossQuantity" | "quantity"} quantityField
+ * @returns {{ total: number, count: number } | null}
+ */
+function sumLinuxMinutes(items, product, quantityField) {
+  if (!Array.isArray(items)) return null;
+  let total = 0;
+  let count = 0;
+  for (const item of items) {
+    const row = record(item);
+    if (!row || row.product !== product || row.unitType !== "minutes") continue;
+    if (typeof row.sku !== "string" || !row.sku.toLowerCase().includes("linux")) continue;
+    const quantity = row[quantityField];
+    if (typeof quantity !== "number" || !Number.isFinite(quantity) || quantity < 0) continue;
+    total += quantity;
+    count += 1;
+  }
+  return { total, count };
+}
+
+/**
+ * @param {unknown} items
+ * @param {string[]} repoFilter
+ * @returns {Array<{ name: string, minutes: number }> | null}
+ */
+function repoAttributions(items, repoFilter) {
+  if (!Array.isArray(items)) return null;
+  const allowed = new Set(repoFilter);
+  const totals = new Map();
+  for (const item of items) {
+    const row = record(item);
+    if (!row || row.product !== "actions" || row.unitType !== "minutes") continue;
+    if (typeof row.sku !== "string" || !row.sku.toLowerCase().includes("linux")) continue;
+    if (typeof row.quantity !== "number" || !Number.isFinite(row.quantity) || row.quantity < 0) continue;
+    if (typeof row.repositoryName !== "string" || row.repositoryName.trim() === "") continue;
+    const name = safeText(row.repositoryName.trim());
+    if (repoFilter.length > 0 && !allowed.has(row.repositoryName.trim())) continue;
+    totals.set(name, (totals.get(name) ?? 0) + row.quantity);
+  }
+  return [...totals].map(([name, minutes]) => ({ name, minutes }))
+    .sort((a, b) => b.minutes - a.minutes || a.name.localeCompare(b.name));
+}
+
+/** @param {number} value */
+function formatMinutes(value) {
+  return String(Number.isInteger(value) ? value : Number(value.toFixed(2)));
+}
+
+/**
+ * @param {number} now
+ * @returns {{ at: string, inSeconds: number }}
+ */
+function nextMonthReset(now) {
+  const current = new Date(now);
+  const reset = new Date(Date.UTC(current.getUTCFullYear(), current.getUTCMonth() + 1, 1));
+  return { at: reset.toISOString(), inSeconds: Math.max(0, Math.round((reset.getTime() - now) / 1000)) };
+}
+
+/**
+ * @param {string} org
+ * @param {{
+ *   now: number,
+ *   env: Record<string, string | undefined>,
+ *   overrideAllowance?: number,
+ *   runCommand: typeof defaultRunCommand,
+ *   timeoutMs: number,
+ *   repoFilter: string[],
+ * }} options
+ * @returns {Promise<{
+ *   ok: true,
+ *   org: string,
+ *   plan: string | null,
+ *   allowance: number,
+ *   usageTotal: number,
+ *   usedPercent: number,
+ *   remainingPercent: number,
+ *   reset: { at: string, inSeconds: number },
+ *   window: { id: string, label: string },
+ *   note: string,
+ * } | { ok: false, error: string }>}
+ */
+async function fetchOrgQuota(org, { now, env, overrideAllowance, runCommand, timeoutMs, repoFilter }) {
+  let allowance;
+  let plan = null;
+  let isUser = false;
+
+  if (overrideAllowance !== undefined) {
+    allowance = overrideAllowance;
+  } else {
+    let organization = await requestGhJson(`/orgs/${encodeURIComponent(org)}`, { runCommand, timeoutMs, env });
+    if (!organization.ok) {
+      const user = await requestGhJson(`/users/${encodeURIComponent(org)}`, { runCommand, timeoutMs, env });
+      if (user.ok) {
+        organization = user;
+        isUser = true;
+      } else {
+        return { ok: false, error: organization.error };
+      }
+    }
+    const organizationBody = record(organization.body);
+    const rawPlan = record(organizationBody?.plan)?.name;
+    const normalizedPlan = typeof rawPlan === "string" ? rawPlan.toLowerCase() : "";
+    const planAllowance = ALLOWANCES[normalizedPlan];
+    if (!planAllowance) {
+      return { ok: false, error: `GitHub organization plan is missing or unsupported; set PI_QUOTA_GITHUB_ACTIONS_MINUTES to a positive monthly allowance (supported plans: free, pro, team, enterprise_cloud).` };
+    }
+    allowance = planAllowance;
+    plan = normalizedPlan;
+  }
+
+  const encodedOrg = encodeURIComponent(org);
+  const basePath = isUser ? `/users/${encodedOrg}` : `/organizations/${encodedOrg}`;
+  const summary = await requestGhJson(
+    `${basePath}/settings/billing/usage/summary?product=Actions`,
+    { runCommand, timeoutMs, env },
+  );
+  if (!summary.ok) return { ok: false, error: summary.error };
+  const summaryBody = record(summary.body);
+  if (!summaryBody || !Array.isArray(summaryBody.usageItems)) {
+    return { ok: false, error: "GitHub Actions usage summary was empty or malformed; verify organization billing access and the GitHub API response shape." };
+  }
+  const usage = sumLinuxMinutes(summaryBody.usageItems, "Actions", "grossQuantity");
+  if (!usage) {
+    return { ok: false, error: "GitHub Actions usage summary contained no Linux minute rows; verify organization billing access and the GitHub API response shape." };
+  }
+
+  const current = new Date(now);
+  const year = current.getUTCFullYear();
+  const month = current.getUTCMonth() + 1;
+  const detailed = await requestGhJson(
+    `${basePath}/settings/billing/usage?year=${year}&month=${month}`,
+    { runCommand, timeoutMs, env },
+  );
+  if (!detailed.ok) return { ok: false, error: detailed.error };
+  const detailedBody = record(detailed.body);
+  if (!detailedBody || !Array.isArray(detailedBody.usageItems)) {
+    return { ok: false, error: "GitHub Actions detailed usage payload was empty or malformed; verify organization billing access and the GitHub API response shape." };
+  }
+
+  const attributions = repoAttributions(detailedBody.usageItems, repoFilter);
+  if (!attributions) {
+    return { ok: false, error: "GitHub Actions detailed usage payload was malformed; verify organization billing access and the GitHub API response shape." };
+  }
+
+  const usedPercent = Math.min(100, Math.max(0, Math.round((usage.total / allowance) * 100 * 100) / 100));
+  const remainingPercent = Math.min(100, Math.max(0, 100 - usedPercent));
+  const reset = nextMonthReset(now);
+  const window = windowFromSeconds(LINUX_MINUTES);
+  const left = Math.max(0, allowance - usage.total);
+  const multipleReposExist = attributions.length > 1;
+  const topRepos = repoFilter.length > 0 || multipleReposExist
+    ? attributions.slice(0, 3).map(({ name, minutes }) => `${name} ${formatMinutes(minutes)}`)
+    : [];
+  const note = `${formatMinutes(usage.total)} of ${formatMinutes(allowance)} min used | ${formatMinutes(left)} left${topRepos.length ? ` · ${topRepos.join(" · ")}` : ""}`;
+
+  return {
+    ok: true,
+    org,
+    plan,
+    allowance,
+    usageTotal: usage.total,
+    usedPercent,
+    remainingPercent,
+    reset,
+    window,
+    note,
+  };
+}
+
+/**
+ * @param {unknown} credential Unused; GitHub authentication belongs to the gh CLI.
+ * @param {{
+ *   now?: number,
+ *   env?: Record<string, string | undefined>,
+ *   timeoutMs?: number,
+ *   runCommand?: typeof defaultRunCommand,
+ * }} [options]
+ * @returns {Promise<import("../model.js").QuotaResult>}
+ */
+export async function fetchQuota(credential, options = {}) {
+  void credential;
+  const now = options.now ?? Date.now();
+  const env = options.env ?? process.env;
+  const envOrgs = env.PI_QUOTA_GITHUB_ORG?.trim();
+  const orgList = envOrgs
+    ? envOrgs.split(",").map((s) => safeText(s.trim())).filter(Boolean)
+    : [DEFAULT_ORG];
+  const orgs = orgList.length > 0 ? orgList : [DEFAULT_ORG];
+
+  const primaryOrg = orgs.join(", ");
+  const base = { family: FAMILY, label: LABEL, account: primaryOrg, plan: null, source: SOURCE };
+  const fail = (error) => degradedResult({ ...base, error: safeText(error), now });
+  const runCommand = options.runCommand ?? defaultRunCommand;
+  const timeoutMs = options.timeoutMs ?? 15_000;
+
+  try {
+    let overrideAllowance;
+    const override = env.PI_QUOTA_GITHUB_ACTIONS_MINUTES;
+    if (override !== undefined) {
+      const numericOverride = Number(override);
+      if (!Number.isFinite(numericOverride) || !Number.isInteger(numericOverride) || numericOverride <= 0) {
+        return fail("PI_QUOTA_GITHUB_ACTIONS_MINUTES must be a positive finite integer; set it to a valid monthly minutes allowance.");
+      }
+      overrideAllowance = numericOverride;
+    }
+
+    const repoFilter = (env.PI_QUOTA_GITHUB_ACTIONS_REPOS ?? "")
+      .split(",")
+      .map((name) => name.trim())
+      .filter(Boolean);
+
+    if (orgs.length === 1) {
+      const org = orgs[0];
+      const res = await fetchOrgQuota(org, { now, env, overrideAllowance, runCommand, timeoutMs, repoFilter });
+      if (!res.ok) return fail(res.error);
+      return {
+        ...base,
+        account: org,
+        plan: res.plan,
+        windows: [buildWindow({
+          id: res.window.id,
+          label: res.window.label,
+          usedPercent: res.usedPercent,
+          remainingPercent: res.remainingPercent,
+          resetsAt: res.reset.at,
+          resetsInSec: res.reset.inSeconds,
+          note: res.note,
+          now,
+        })],
+        error: null,
+        ok: true,
+        updatedAt: new Date(now).toISOString(),
+      };
+    }
+
+    const windows = [];
+    const plans = [];
+    const errors = [];
+    for (let i = 0; i < orgs.length; i++) {
+      const org = orgs[i];
+      const res = await fetchOrgQuota(org, { now, env, overrideAllowance, runCommand, timeoutMs, repoFilter });
+      if (!res.ok) {
+        errors.push(`${org}: ${res.error}`);
+        continue;
+      }
+      if (res.plan) plans.push(res.plan);
+      const windowId = i === 0 ? "monthly" : `monthly-${org.toLowerCase().replace(/[^a-z0-9-]/g, "-")}`;
+      windows.push(buildWindow({
+        id: windowId,
+        label: `${org} monthly`,
+        usedPercent: res.usedPercent,
+        remainingPercent: res.remainingPercent,
+        resetsAt: res.reset.at,
+        resetsInSec: res.reset.inSeconds,
+        note: `${org}: ${res.note}`,
+        now,
+      }));
+    }
+
+    if (windows.length === 0) {
+      return fail(errors.join("; "));
+    }
+
+    const uniquePlans = Array.from(new Set(plans));
+    return {
+      ...base,
+      account: orgs.join(", "),
+      plan: uniquePlans.join(", ") || null,
+      windows,
+      error: null,
+      ok: true,
+      updatedAt: new Date(now).toISOString(),
+    };
+  } catch (error) {
+    return fail(`GitHub Actions provider could not complete the gh CLI request; check gh installation, authentication, and organization billing access. ${safeText(error?.message ?? error)}`);
+  }
+}