@sriinnu/runic 1.0.0 → 1.2.0

package/Sources/Runic/Views/Menu/OverviewMenuView.swift

@@ -3,7 +3,8 @@ import Charts
 import RunicCore
 import SwiftUI
 
-/// Overview showing all enabled providers at a glance — usage bars, today's tokens, and a combined chart.
+/// Overview dashboard showing all enabled providers at a glance.
+/// Inspired by Apple Activity app rings, Awwwards dashboard layouts, and Tokex stat cards.
 @MainActor
 struct OverviewMenuView: View {
     struct ProviderSummary: Identifiable {
@@ -15,6 +16,8 @@ struct OverviewMenuView: View {
         let todayTokens: Int
         let brandColor: Color
         let resetDescription: String?
+        let windowLabel: String?       // e.g. "5h" or "Weekly"
+        let topModelContext: String?    // e.g. "200K ctx"
     }
 
     struct DailyPoint: Identifiable {
@@ -22,82 +25,95 @@ struct OverviewMenuView: View {
         let date: Date
         let tokens: Int
         let provider: String
+        let color: Color
     }
 
     let summaries: [ProviderSummary]
     let chartPoints: [DailyPoint]
     let totalTodayTokens: Int
+    let totalProviders: Int
     let width: CGFloat
 
     var body: some View {
         VStack(alignment: .leading, spacing: RunicSpacing.sm) {
-            // Header
-            HStack(alignment: .firstTextBaseline) {
-                Text("Overview")
-                    .font(.system(.title3, design: .rounded))
-                    .fontWeight(.bold)
+            // MARK: - Hero header
+            HStack(alignment: .center, spacing: RunicSpacing.xs) {
+                // Ring indicator showing overall usage
+                ZStack {
+                    Circle()
+                        .stroke(Color(nsColor: .separatorColor).opacity(0.15), lineWidth: 3)
+                    Circle()
+                        .trim(from: 0, to: min(1, self.averageUsedPercent / 100))
+                        .stroke(
+                            AngularGradient(
+                                colors: [RunicColors.chartColor(at: 4), RunicColors.chartColor(at: 0)],
+                                center: .center),
+                            style: StrokeStyle(lineWidth: 3, lineCap: .round))
+                        .rotationEffect(.degrees(-90))
+                }
+                .frame(width: 32, height: 32)
+
+                VStack(alignment: .leading, spacing: 0) {
+                    Text(UsageFormatter.tokenCountString(self.totalTodayTokens))
+                        .font(.system(size: 22, weight: .bold, design: .rounded))
+                    Text("\(self.summaries.count) of \(self.totalProviders) active")
+                        .font(.system(.caption2, design: .rounded))
+                        .foregroundStyle(.tertiary)
+                }
+
                 Spacer()
-                if self.totalTodayTokens > 0 {
-                    Text("\(UsageFormatter.tokenCountString(self.totalTodayTokens)) today")
+
+                VStack(alignment: .trailing, spacing: 2) {
+                    Text("today")
+                        .font(.system(.caption2, design: .rounded))
+                        .foregroundStyle(.tertiary)
+                    Text("\(Int(self.averageUsedPercent))% avg")
                         .font(.system(.caption, design: .rounded))
+                        .fontWeight(.medium)
                         .foregroundStyle(.secondary)
                 }
             }
 
-            // Provider rows
+            Divider().opacity(0.5)
+
+            // MARK: - Provider cards
             if self.summaries.isEmpty {
-                Text("No providers enabled.")
+                Text("No active providers.")
                     .font(.system(.footnote, design: .rounded))
                     .foregroundStyle(.secondary)
+                    .frame(maxWidth: .infinity, alignment: .center)
+                    .padding(.vertical, RunicSpacing.md)
             } else {
-                VStack(spacing: RunicSpacing.xs) {
+                VStack(spacing: RunicSpacing.compact) {
                     ForEach(self.summaries) { summary in
-                        HStack(spacing: RunicSpacing.xs) {
-                            // Provider icon
-                            if let icon = summary.icon {
-                                Image(nsImage: icon)
-                                    .resizable()
-                                    .aspectRatio(contentMode: .fit)
-                                    .frame(width: 16, height: 16)
-                            }
-
-                            // Name
-                            Text(summary.name)
-                                .font(.system(.caption, design: .rounded))
-                                .fontWeight(.medium)
-                                .frame(width: 60, alignment: .leading)
-                                .lineLimit(1)
-
-                            // Mini progress bar
-                            GeometryReader { geo in
-                                ZStack(alignment: .leading) {
-                                    Capsule()
-                                        .fill(Color(nsColor: .separatorColor).opacity(0.2))
-                                    Capsule()
-                                        .fill(summary.brandColor)
-                                        .frame(width: max(0, geo.size.width * min(1, summary.usedPercent / 100)))
-                                }
-                            }
-                            .frame(height: 6)
-
-                            // Percentage
-                            Text("\(Int(summary.usedPercent))%")
-                                .font(.system(size: 10, weight: .medium, design: .rounded))
-                                .foregroundStyle(.secondary)
-                                .frame(width: 30, alignment: .trailing)
-                        }
+                        ProviderRow(summary: summary)
                     }
                 }
             }
 
-            // Combined 7-day chart
+            // MARK: - Combined 7-day chart
             if !self.chartPoints.isEmpty {
-                Divider()
-                    .padding(.vertical, RunicSpacing.xxxs)
+                Divider().opacity(0.5)
 
-                Text("Last 7 days")
-                    .font(.system(.caption2, design: .rounded))
-                    .foregroundStyle(.tertiary)
+                HStack {
+                    Text("7-day activity")
+                        .font(.system(.caption2, design: .rounded))
+                        .foregroundStyle(.tertiary)
+                    Spacer()
+                    // Mini legend dots
+                    HStack(spacing: RunicSpacing.xxs) {
+                        ForEach(self.summaries.prefix(4)) { s in
+                            Circle()
+                                .fill(s.brandColor)
+                                .frame(width: 5, height: 5)
+                        }
+                        if self.summaries.count > 4 {
+                            Text("+\(self.summaries.count - 4)")
+                                .font(.system(size: 8, design: .rounded))
+                                .foregroundStyle(.quaternary)
+                        }
+                    }
+                }
 
                 Chart {
                     ForEach(self.chartPoints) { point in
@@ -105,12 +121,15 @@ struct OverviewMenuView: View {
                             x: .value("Date", point.date, unit: .day),
                             y: .value("Tokens", point.tokens))
                             .foregroundStyle(by: .value("Provider", point.provider))
+                            .cornerRadius(2)
                     }
                 }
                 .chartForegroundStyleScale(range: self.chartColors)
                 .chartLegend(.hidden)
                 .chartYAxis {
                     AxisMarks(position: .trailing, values: .automatic(desiredCount: 3)) { value in
+                        AxisGridLine(stroke: StrokeStyle(lineWidth: 0.3, dash: [3, 3]))
+                            .foregroundStyle(Color(nsColor: .separatorColor).opacity(0.3))
                         AxisValueLabel {
                             if let tokens = value.as(Int.self) {
                                 Text(UsageFormatter.tokenCountString(tokens))
@@ -121,13 +140,13 @@ struct OverviewMenuView: View {
                     }
                 }
                 .chartXAxis {
-                    AxisMarks(values: .automatic(desiredCount: 5)) { _ in
-                        AxisValueLabel(format: .dateTime.weekday(.short))
-                            .font(.system(size: 8, design: .rounded))
+                    AxisMarks(values: .automatic(desiredCount: 7)) { _ in
+                        AxisValueLabel(format: .dateTime.weekday(.narrow))
+                            .font(.system(size: 8, weight: .medium, design: .rounded))
                             .foregroundStyle(Color(nsColor: .tertiaryLabelColor))
                     }
                 }
-                .frame(height: 70)
+                .frame(height: 80)
             }
         }
         .padding(.horizontal, MenuCardMetrics.horizontalPadding)
@@ -135,7 +154,125 @@ struct OverviewMenuView: View {
         .frame(minWidth: self.width, maxWidth: .infinity, alignment: .leading)
     }
 
+    private var averageUsedPercent: Double {
+        let active = self.summaries.filter { $0.usedPercent > 0 }
+        guard !active.isEmpty else { return 0 }
+        return active.reduce(0) { $0 + $1.usedPercent } / Double(active.count)
+    }
+
     private var chartColors: [Color] {
         self.summaries.map(\.brandColor)
     }
 }
+
+// MARK: - Provider row
+
+private struct ProviderRow: View {
+    let summary: OverviewMenuView.ProviderSummary
+
+    var body: some View {
+        HStack(spacing: RunicSpacing.xs) {
+            // Icon with brand tint
+            if let icon = self.summary.icon {
+                Image(nsImage: icon)
+                    .resizable()
+                    .aspectRatio(contentMode: .fit)
+                    .frame(width: 14, height: 14)
+            }
+
+            // Name
+            Text(self.summary.name)
+                .font(.system(.caption, design: .rounded))
+                .fontWeight(.medium)
+                .frame(width: 58, alignment: .leading)
+                .lineLimit(1)
+
+            // Progress bar with gradient fill
+            GeometryReader { geo in
+                let fillWidth = max(0, geo.size.width * min(1, self.summary.usedPercent / 100))
+                ZStack(alignment: .leading) {
+                    // Track
+                    Capsule()
+                        .fill(Color(nsColor: .separatorColor).opacity(0.12))
+
+                    // Fill with gradient
+                    Capsule()
+                        .fill(
+                            LinearGradient(
+                                colors: [
+                                    self.summary.brandColor.opacity(0.9),
+                                    self.summary.brandColor,
+                                ],
+                                startPoint: .leading,
+                                endPoint: .trailing))
+                        .frame(width: fillWidth)
+
+                    // Gloss overlay on fill
+                    Capsule()
+                        .fill(
+                            LinearGradient(
+                                stops: [
+                                    .init(color: .white.opacity(0.2), location: 0),
+                                    .init(color: .clear, location: 0.5),
+                                ],
+                                startPoint: .top,
+                                endPoint: .bottom))
+                        .frame(width: fillWidth)
+                }
+            }
+            .frame(height: 7)
+
+            // Percentage
+            Text("\(Int(self.summary.usedPercent))%")
+                .font(.system(size: 9, weight: .semibold, design: .rounded))
+                .foregroundStyle(self.summary.usedPercent > 80 ? .primary : .secondary)
+                .frame(width: 28, alignment: .trailing)
+
+            // Today's tokens (if any)
+            if self.summary.todayTokens > 0 {
+                Text(UsageFormatter.tokenCountString(self.summary.todayTokens))
+                    .font(.system(size: 8, design: .rounded))
+                    .foregroundStyle(.tertiary)
+                    .frame(width: 32, alignment: .trailing)
+            }
+        }
+
+        // Second line: window + reset + context
+        let hasSecondLine = self.summary.windowLabel != nil ||
+            self.summary.resetDescription != nil ||
+            self.summary.topModelContext != nil
+
+        if hasSecondLine {
+            HStack(spacing: RunicSpacing.xxs) {
+                // Spacer for icon + name width
+                Color.clear.frame(width: 14 + 58 + RunicSpacing.xs * 2, height: 0)
+
+                if let window = self.summary.windowLabel {
+                    InfoPill(text: window)
+                }
+                if let reset = self.summary.resetDescription {
+                    InfoPill(text: reset)
+                }
+                if let ctx = self.summary.topModelContext {
+                    InfoPill(text: ctx)
+                }
+                Spacer()
+            }
+        }
+    }
+}
+
+private struct InfoPill: View {
+    let text: String
+
+    var body: some View {
+        Text(self.text)
+            .font(.system(size: 8, weight: .medium, design: .rounded))
+            .foregroundStyle(.tertiary)
+            .padding(.horizontal, 4)
+            .padding(.vertical, 1)
+            .background(
+                Capsule(style: .continuous)
+                    .fill(Color(nsColor: .controlBackgroundColor).opacity(RunicColors.Opacity.subtle)))
+    }
+}

package/Sources/Runic/Views/Menu/UsageTimelineChartMenuView.swift

@@ -5,28 +5,23 @@ import SwiftUI
 @MainActor
 struct UsageTimelineChartMenuView: View {
     enum TimeRange: String, CaseIterable {
-        case oneHour = "1h"
-        case sixHours = "6h"
-        case oneDay = "1d"
+        case threeDays = "3d"
         case sevenDays = "7d"
         case thirtyDays = "30d"
+        case quarter = "90d"
+        case year = "1y"
 
         var cutoffInterval: TimeInterval {
             switch self {
-            case .oneHour: return -3600
-            case .sixHours: return -21600
-            case .oneDay: return -86400
+            case .threeDays: return -259200
             case .sevenDays: return -604800
             case .thirtyDays: return -2592000
+            case .quarter: return -7776000
+            case .year: return -31536000
             }
         }
 
-        var usesHourlyData: Bool {
-            switch self {
-            case .oneHour, .sixHours, .oneDay: return true
-            default: return false
-            }
-        }
+        var usesHourlyData: Bool { false }
 
         var label: String { self.rawValue }
     }
@@ -48,7 +43,7 @@ struct UsageTimelineChartMenuView: View {
     private let dailySummaries: [UsageLedgerDailySummary]
     private let hourlySummaries: [UsageLedgerHourlySummary]
     private let width: CGFloat
-    @State private var selectedTimeRange: TimeRange = .oneDay
+    @State private var selectedTimeRange: TimeRange = .sevenDays
     @State private var selectedKey: String?
 
     init(
@@ -65,9 +60,7 @@ struct UsageTimelineChartMenuView: View {
     private static let selectionBandColor = Color(nsColor: .labelColor).opacity(0.1)
 
     var body: some View {
-        let model = self.selectedTimeRange.usesHourlyData
-            ? Self.makeHourlyModel(from: self.hourlySummaries, timeRange: self.selectedTimeRange)
-            : Self.makeDailyModel(from: self.dailySummaries, timeRange: self.selectedTimeRange)
+        let model = Self.makeDailyModel(from: self.dailySummaries, timeRange: self.selectedTimeRange)
 
         VStack(alignment: .leading, spacing: RunicSpacing.xs) {
             // Header on its own line
@@ -262,9 +255,11 @@ struct UsageTimelineChartMenuView: View {
         }
 
         let desiredAxisCount: Int = switch timeRange {
-        case .oneHour, .sixHours, .oneDay: 4
+        case .threeDays: 3
         case .sevenDays: 5
         case .thirtyDays: 6
+        case .quarter: 6
+        case .year: 6
         }
 
         return Model(
@@ -281,54 +276,6 @@ struct UsageTimelineChartMenuView: View {
             isHourly: false)
     }
 
-    // MARK: - Hourly model
-
-    private static func makeHourlyModel(from summaries: [UsageLedgerHourlySummary], timeRange: TimeRange) -> Model {
-        let now = Date()
-        let cutoffDate = now.addingTimeInterval(timeRange.cutoffInterval)
-        let filtered = summaries.filter { $0.hourStart >= cutoffDate }
-        let sorted = filtered.sorted { $0.hourStart < $1.hourStart }
-
-        var points: [Point] = []
-        var pointsByKey: [String: Point] = [:]
-        var dateKeys: [(key: String, date: Date)] = []
-        var peak: Point?
-        var totalTokens = 0
-
-        for summary in sorted {
-            let tokens = summary.totals.totalTokens
-            totalTokens += tokens
-            let point = Point(date: summary.hourStart, totalTokens: tokens, key: summary.hourKey)
-            points.append(point)
-            pointsByKey[summary.hourKey] = point
-            dateKeys.append((summary.hourKey, summary.hourStart))
-
-            if peak == nil || tokens > (peak?.totalTokens ?? 0) {
-                peak = point
-            }
-        }
-
-        let desiredAxisCount: Int = switch timeRange {
-        case .oneHour: 4
-        case .sixHours: 6
-        case .oneDay: 8
-        default: 6
-        }
-
-        return Model(
-            points: points,
-            pointsByKey: pointsByKey,
-            dateKeys: dateKeys,
-            peakPoint: peak,
-            totalTokens: totalTokens,
-            averagePerPeriod: points.isEmpty ? 0 : totalTokens / max(1, points.count),
-            peakTokens: peak?.totalTokens ?? 0,
-            totalCostUSD: nil,
-            desiredAxisCount: desiredAxisCount,
-            xAxisFormat: .dateTime.hour(.defaultDigits(amPM: .narrow)),
-            isHourly: true)
-    }
-
     // MARK: - Interaction
 
     private func selectionBandRect(model: Model, proxy: ChartProxy, geo: GeometryProxy) -> CGRect? {

package/Sources/Runic/Views/Preferences/PreferencesIntegrationsPane.swift

@@ -1,5 +1,6 @@
 import AppKit
 import RunicCore
+import Security
 import SwiftUI
 
 @MainActor
@@ -9,7 +10,7 @@ struct IntegrationsPane: View {
 
     @AppStorage("vaayuAPIServerEnabled") private var vaayuAPIServerEnabled = false
     @AppStorage("vaayuAPIServerPort") private var vaayuAPIServerPort = 3000
-    @AppStorage("vaayuAPIKey") private var vaayuAPIKey = ""
+    @State private var vaayuAPIKey = ""
     @AppStorage("defaultWebhookURL") private var defaultWebhookURL = ""
     @AppStorage("webhookFormat") private var webhookFormat = "slack"
     @AppStorage("githubIntegrationEnabled") private var githubIntegrationEnabled = false
@@ -319,6 +320,22 @@ struct IntegrationsPane: View {
         }
         .onAppear {
             self.loadMCPServers()
+            self.vaayuAPIKey = VaayuKeychainHelper.load() ?? ""
+            // Migrate any existing value out of UserDefaults
+            let defaults = UserDefaults.standard
+            if let legacyKey = defaults.string(forKey: "vaayuAPIKey"), !legacyKey.isEmpty {
+                if VaayuKeychainHelper.save(legacyKey) {
+                    self.vaayuAPIKey = legacyKey
+                    defaults.removeObject(forKey: "vaayuAPIKey")
+                }
+            }
+        }
+        .onChange(of: self.vaayuAPIKey) { _, newValue in
+            if newValue.isEmpty {
+                VaayuKeychainHelper.delete()
+            } else {
+                VaayuKeychainHelper.save(newValue)
+            }
         }
         .sheet(isPresented: self.$showingAddServerSheet) {
             AddMCPServerSheet(
@@ -495,3 +512,56 @@ private struct AddMCPServerSheet: View {
         .onAppear { self.isNameFocused = true }
     }
 }
+
+// MARK: - Vaayu API Key Keychain Helper
+
+private enum VaayuKeychainHelper {
+    private static let service = "com.sriinnu.athena.Runic"
+    private static let account = "vaayu-api-key"
+
+    static func load() -> String? {
+        var result: CFTypeRef?
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+            kSecReturnData as String: true,
+            kSecUseAuthenticationUI as String: kSecUseAuthenticationUIFail,
+        ]
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        guard status == errSecSuccess,
+              let data = result as? Data,
+              let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !token.isEmpty
+        else {
+            return nil
+        }
+        return token
+    }
+
+    @discardableResult
+    static func save(_ value: String) -> Bool {
+        delete()
+        let data = Data(value.utf8)
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+        return SecItemAdd(query as CFDictionary, nil) == errSecSuccess
+    }
+
+    @discardableResult
+    static func delete() -> Bool {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+        ]
+        let status = SecItemDelete(query as CFDictionary)
+        return status == errSecSuccess || status == errSecItemNotFound
+    }
+}

package/Sources/RunicCore/CustomProviders/GenericProviderFetcher.swift

@@ -144,6 +144,10 @@ public actor GenericProviderFetcher {
             throw FetchError.invalidURL(urlString)
         }
 
+        guard url.scheme?.lowercased() == "https" else {
+            throw FetchError.insecureURL(urlString)
+        }
+
         return url
     }
 
@@ -562,6 +566,7 @@ public enum FetchError: LocalizedError, Sendable {
     case missingToken(String)
     case invalidDateRange
     case extractionFailed(String)
+    case insecureURL(String)
 
     public var errorDescription: String? {
         switch self {
@@ -583,6 +588,8 @@ public enum FetchError: LocalizedError, Sendable {
             return "Failed to calculate date range for URL template"
         case .extractionFailed(let field):
             return "Failed to extract field '\(field)' from response"
+        case .insecureURL(let url):
+            return "Only HTTPS URLs are allowed. Got: \(url)"
         }
     }
 
@@ -596,6 +603,8 @@ public enum FetchError: LocalizedError, Sendable {
             return "The response is not valid JSON or has unexpected structure"
         case .extractionFailed(let field):
             return "The field '\(field)' was not found in the response or has wrong type"
+        case .insecureURL:
+            return "The URL scheme is not HTTPS"
         default:
             return nil
         }
@@ -615,6 +624,8 @@ public enum FetchError: LocalizedError, Sendable {
             return "You have been rate limited. Try again later."
         case .invalidJSON:
             return "Check the API endpoint URL and response mapping configuration"
+        case .insecureURL:
+            return "Change the provider URL to use HTTPS (e.g., https://api.example.com)"
         default:
             return nil
         }

package/Sources/RunicCore/Logging/OSLogLogHandler.swift

@@ -42,17 +42,17 @@ struct OSLogLogHandler: LogHandler {
 
         switch level {
         case .trace:
-            self.logger.debug("\(msg, privacy: .public)")
+            self.logger.debug("\(msg, privacy: .auto)")
         case .debug:
-            self.logger.debug("\(msg, privacy: .public)")
+            self.logger.debug("\(msg, privacy: .auto)")
         case .info, .notice:
-            self.logger.info("\(msg, privacy: .public)")
+            self.logger.info("\(msg, privacy: .auto)")
         case .warning:
-            self.logger.warning("\(msg, privacy: .public)")
+            self.logger.warning("\(msg, privacy: .auto)")
         case .error:
-            self.logger.error("\(msg, privacy: .public)")
+            self.logger.error("\(msg, privacy: .auto)")
         case .critical:
-            self.logger.fault("\(msg, privacy: .public)")
+            self.logger.fault("\(msg, privacy: .auto)")
         }
     }
 

package/Sources/RunicCore/Providers/Azure/AzureUsageFetcher.swift

@@ -94,6 +94,8 @@ struct AzureUsageFetcher {
         if !normalized.contains("://") {
             normalized = "https://\(normalized)"
         }
+        // Enforce HTTPS — reject http:// to prevent cleartext token leakage.
+        guard normalized.lowercased().hasPrefix("https://") else { return nil }
         guard let baseURL = URL(string: normalized),
               var components = URLComponents(url: baseURL, resolvingAgainstBaseURL: false)
         else {

package/Sources/RunicCore/Providers/Codex/CodexOAuth/CodexOAuthCredentials.swift

@@ -133,6 +133,7 @@ public enum CodexOAuthCredentialsStore {
         let directory = url.deletingLastPathComponent()
         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
         try data.write(to: url, options: .atomic)
+        try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
     }
 
     private static func parseLastRefresh(from raw: Any?) -> Date? {

package/Sources/RunicCore/Providers/Codex/CodexOAuth/CodexOAuthUsageFetcher.swift

@@ -192,12 +192,23 @@ public enum CodexOAuthUsageFetcher {
         self.resolveUsageURL(env: ProcessInfo.processInfo.environment, configContents: nil)
     }
 
+    private static let allowedHostSuffixes = ["openai.com", "chatgpt.com"]
+
     private static func resolveUsageURL(env: [String: String], configContents: String?) -> URL {
         let baseURL = self.resolveChatGPTBaseURL(env: env, configContents: configContents)
         let normalized = self.normalizeChatGPTBaseURL(baseURL)
         let path = normalized.contains("/backend-api") ? Self.chatGPTUsagePath : Self.codexUsagePath
         let full = normalized + path
-        return URL(string: full) ?? URL(string: Self.defaultChatGPTBaseURL + Self.chatGPTUsagePath)!
+        guard let url = URL(string: full), self.isAllowedHost(url) else {
+            return URL(string: Self.defaultChatGPTBaseURL + Self.chatGPTUsagePath)!
+        }
+        return url
+    }
+
+    private static func isAllowedHost(_ url: URL) -> Bool {
+        guard url.scheme?.lowercased() == "https" else { return false }
+        guard let host = url.host?.lowercased() else { return false }
+        return allowedHostSuffixes.contains { host == $0 || host.hasSuffix("." + $0) }
     }
 
     private static func resolveChatGPTBaseURL(env: [String: String], configContents: String?) -> String {

package/Sources/RunicCore/Providers/Cursor/CursorStatusProbe.swift

@@ -375,6 +375,7 @@ public actor CursorSessionStore {
             return
         }
         try? data.write(to: self.fileURL)
+        try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: self.fileURL.path)
     }
 
     private func loadFromDisk() {

package/Sources/RunicCore/Providers/Factory/FactoryStatusProbe.swift

@@ -464,6 +464,7 @@ public actor FactorySessionStore {
             return
         }
         try? data.write(to: self.fileURL)
+        try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: self.fileURL.path)
     }
 
     private func loadFromDisk() {