@sriinnu/runic 1.0.0

package/Sources/RunicCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials.swift

@@ -0,0 +1,180 @@
+import Foundation
+#if os(macOS)
+import LocalAuthentication
+import Security
+#endif
+
+public struct ClaudeOAuthCredentials: Sendable {
+    public let accessToken: String
+    public let refreshToken: String?
+    public let expiresAt: Date?
+    public let scopes: [String]
+    public let rateLimitTier: String?
+
+    public init(
+        accessToken: String,
+        refreshToken: String?,
+        expiresAt: Date?,
+        scopes: [String],
+        rateLimitTier: String?)
+    {
+        self.accessToken = accessToken
+        self.refreshToken = refreshToken
+        self.expiresAt = expiresAt
+        self.scopes = scopes
+        self.rateLimitTier = rateLimitTier
+    }
+
+    public var isExpired: Bool {
+        guard let expiresAt else { return true }
+        return Date() >= expiresAt
+    }
+
+    public var expiresIn: TimeInterval? {
+        guard let expiresAt else { return nil }
+        return expiresAt.timeIntervalSinceNow
+    }
+
+    public static func parse(data: Data) throws -> ClaudeOAuthCredentials {
+        let decoder = JSONDecoder()
+        guard let root = try? decoder.decode(Root.self, from: data) else {
+            throw ClaudeOAuthCredentialsError.decodeFailed
+        }
+        guard let oauth = root.claudeAiOauth else {
+            throw ClaudeOAuthCredentialsError.missingOAuth
+        }
+        let accessToken = oauth.accessToken?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        guard !accessToken.isEmpty else {
+            throw ClaudeOAuthCredentialsError.missingAccessToken
+        }
+        let expiresAt = oauth.expiresAt.map { millis in
+            Date(timeIntervalSince1970: millis / 1000.0)
+        }
+        return ClaudeOAuthCredentials(
+            accessToken: accessToken,
+            refreshToken: oauth.refreshToken,
+            expiresAt: expiresAt,
+            scopes: oauth.scopes ?? [],
+            rateLimitTier: oauth.rateLimitTier)
+    }
+
+    private struct Root: Decodable {
+        let claudeAiOauth: OAuth?
+    }
+
+    private struct OAuth: Decodable {
+        let accessToken: String?
+        let refreshToken: String?
+        let expiresAt: Double?
+        let scopes: [String]?
+        let rateLimitTier: String?
+
+        enum CodingKeys: String, CodingKey {
+            case accessToken
+            case refreshToken
+            case expiresAt
+            case scopes
+            case rateLimitTier
+        }
+    }
+}
+
+public enum ClaudeOAuthCredentialsError: LocalizedError, Sendable {
+    case decodeFailed
+    case missingOAuth
+    case missingAccessToken
+    case notFound
+    case keychainError(Int)
+    case readFailed(String)
+
+    public var errorDescription: String? {
+        switch self {
+        case .decodeFailed:
+            "Claude OAuth credentials are invalid."
+        case .missingOAuth:
+            "Claude OAuth credentials missing. Run `claude` to authenticate."
+        case .missingAccessToken:
+            "Claude OAuth access token missing. Run `claude` to authenticate."
+        case .notFound:
+            "Claude OAuth credentials not found. Run `claude` to authenticate."
+        case let .keychainError(status):
+            "Claude OAuth keychain error: \(status)"
+        case let .readFailed(message):
+            "Claude OAuth credentials read failed: \(message)"
+        }
+    }
+}
+
+public enum ClaudeOAuthCredentialsStore {
+    private static let credentialsPath = ".claude/.credentials.json"
+    private static let keychainService = "Claude Code-credentials"
+
+    public static func load() throws -> ClaudeOAuthCredentials {
+        // Prefer Keychain (CLI writes there on macOS), but fall back to the JSON file when missing.
+        var lastError: Error?
+        if let keychainData = try? self.loadFromKeychain() {
+            do {
+                return try ClaudeOAuthCredentials.parse(data: keychainData)
+            } catch {
+                // Keep the Keychain parse error so we can surface it if the file is also invalid.
+                lastError = error
+            }
+        }
+        do {
+            let fileData = try self.loadFromFile()
+            return try ClaudeOAuthCredentials.parse(data: fileData)
+        } catch {
+            if let lastError { throw lastError }
+            throw error
+        }
+    }
+
+    public static func loadFromFile() throws -> Data {
+        let home = FileManager.default.homeDirectoryForCurrentUser
+        let url = home.appendingPathComponent(self.credentialsPath)
+        do {
+            return try Data(contentsOf: url)
+        } catch {
+            if (error as NSError).code == NSFileReadNoSuchFileError {
+                throw ClaudeOAuthCredentialsError.notFound
+            }
+            throw ClaudeOAuthCredentialsError.readFailed(error.localizedDescription)
+        }
+    }
+
+    public static func loadFromKeychain() throws -> Data {
+        #if os(macOS)
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.keychainService,
+            kSecUseAuthenticationUI as String: "kSecUseAuthenticationUIFail" as CFString,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+            kSecReturnData as String: true,
+        ]
+        // Avoid surfacing password dialogs during automatic provider refresh.
+        // When interaction would be required, we fall back to the credentials file.
+        let authContext = LAContext()
+        authContext.interactionNotAllowed = true
+        query[kSecUseAuthenticationContext as String] = authContext
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        switch status {
+        case errSecSuccess:
+            guard let data = result as? Data else {
+                throw ClaudeOAuthCredentialsError.readFailed("Keychain item is empty.")
+            }
+            if data.isEmpty { throw ClaudeOAuthCredentialsError.notFound }
+            return data
+        case errSecItemNotFound:
+            throw ClaudeOAuthCredentialsError.notFound
+        case errSecInteractionNotAllowed:
+            throw ClaudeOAuthCredentialsError.notFound
+        default:
+            throw ClaudeOAuthCredentialsError.keychainError(Int(status))
+        }
+        #else
+        throw ClaudeOAuthCredentialsError.notFound
+        #endif
+    }
+}

package/Sources/RunicCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthUsageFetcher.swift

@@ -0,0 +1,137 @@
+import Foundation
+#if canImport(FoundationNetworking)
+import FoundationNetworking
+#endif
+
+public enum ClaudeOAuthFetchError: LocalizedError, Sendable {
+    case unauthorized
+    case invalidResponse
+    case serverError(Int, String?)
+    case networkError(Error)
+
+    public var errorDescription: String? {
+        switch self {
+        case .unauthorized:
+            return "Claude OAuth request unauthorized. Run `claude` to re-authenticate."
+        case .invalidResponse:
+            return "Claude OAuth response was invalid."
+        case let .serverError(code, body):
+            if let body, !body.isEmpty {
+                return "Claude OAuth error: HTTP \(code) – \(body)"
+            }
+            return "Claude OAuth error: HTTP \(code)"
+        case let .networkError(error):
+            return "Claude OAuth network error: \(error.localizedDescription)"
+        }
+    }
+}
+
+enum ClaudeOAuthUsageFetcher {
+    private static let baseURL = "https://api.anthropic.com"
+    private static let usagePath = "/api/oauth/usage"
+    private static let betaHeader = "oauth-2025-04-20"
+
+    static func fetchUsage(accessToken: String) async throws -> OAuthUsageResponse {
+        guard let url = URL(string: baseURL + usagePath) else {
+            throw ClaudeOAuthFetchError.invalidResponse
+        }
+
+        var request = URLRequest(url: url)
+        request.httpMethod = "GET"
+        request.timeoutInterval = 30
+        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
+        request.setValue("application/json", forHTTPHeaderField: "Accept")
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        // OAuth usage endpoint currently requires the beta header.
+        request.setValue(Self.betaHeader, forHTTPHeaderField: "anthropic-beta")
+        request.setValue("Runic", forHTTPHeaderField: "User-Agent")
+
+        do {
+            let (data, response) = try await URLSession.shared.data(for: request)
+            guard let http = response as? HTTPURLResponse else {
+                throw ClaudeOAuthFetchError.invalidResponse
+            }
+            switch http.statusCode {
+            case 200:
+                return try Self.decodeUsageResponse(data)
+            case 401, 403:
+                throw ClaudeOAuthFetchError.unauthorized
+            default:
+                let body = String(data: data, encoding: .utf8)
+                throw ClaudeOAuthFetchError.serverError(http.statusCode, body)
+            }
+        } catch let error as ClaudeOAuthFetchError {
+            throw error
+        } catch {
+            throw ClaudeOAuthFetchError.networkError(error)
+        }
+    }
+
+    static func decodeUsageResponse(_ data: Data) throws -> OAuthUsageResponse {
+        let decoder = JSONDecoder()
+        return try decoder.decode(OAuthUsageResponse.self, from: data)
+    }
+
+    static func parseISO8601Date(_ string: String?) -> Date? {
+        guard let string, !string.isEmpty else { return nil }
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        if let date = formatter.date(from: string) { return date }
+        formatter.formatOptions = [.withInternetDateTime]
+        return formatter.date(from: string)
+    }
+}
+
+struct OAuthUsageResponse: Decodable, Sendable {
+    let fiveHour: OAuthUsageWindow?
+    let sevenDay: OAuthUsageWindow?
+    let sevenDayOAuthApps: OAuthUsageWindow?
+    let sevenDayOpus: OAuthUsageWindow?
+    let sevenDaySonnet: OAuthUsageWindow?
+    let iguanaNecktie: OAuthUsageWindow?
+    let extraUsage: OAuthExtraUsage?
+
+    enum CodingKeys: String, CodingKey {
+        case fiveHour = "five_hour"
+        case sevenDay = "seven_day"
+        case sevenDayOAuthApps = "seven_day_oauth_apps"
+        case sevenDayOpus = "seven_day_opus"
+        case sevenDaySonnet = "seven_day_sonnet"
+        case iguanaNecktie = "iguana_necktie"
+        case extraUsage = "extra_usage"
+    }
+}
+
+struct OAuthUsageWindow: Decodable, Sendable {
+    let utilization: Double?
+    let resetsAt: String?
+
+    enum CodingKeys: String, CodingKey {
+        case utilization
+        case resetsAt = "resets_at"
+    }
+}
+
+struct OAuthExtraUsage: Decodable, Sendable {
+    let isEnabled: Bool?
+    let monthlyLimit: Double?
+    let usedCredits: Double?
+    let utilization: Double?
+    let currency: String?
+
+    enum CodingKeys: String, CodingKey {
+        case isEnabled = "is_enabled"
+        case monthlyLimit = "monthly_limit"
+        case usedCredits = "used_credits"
+        case utilization
+        case currency
+    }
+}
+
+#if DEBUG
+extension ClaudeOAuthUsageFetcher {
+    static func _decodeUsageResponseForTesting(_ data: Data) throws -> OAuthUsageResponse {
+        try self.decodeUsageResponse(data)
+    }
+}
+#endif

package/Sources/RunicCore/Providers/Claude/ClaudeProviderDescriptor.swift

@@ -0,0 +1,207 @@
+import RunicMacroSupport
+import Foundation
+
+@ProviderDescriptorRegistration
+@ProviderDescriptorDefinition
+public enum ClaudeProviderDescriptor {
+    static func makeDescriptor() -> ProviderDescriptor {
+        ProviderDescriptor(
+            id: .claude,
+            metadata: ProviderMetadata(
+                id: .claude,
+                displayName: "Claude",
+                sessionLabel: "Session",
+                weeklyLabel: "Weekly",
+                opusLabel: "Sonnet",
+                supportsOpus: true,
+                supportsCredits: false,
+                creditsHint: "",
+                toggleTitle: "Show Claude Code usage",
+                cliName: "claude",
+                defaultEnabled: false,
+                isPrimaryProvider: true,
+                usesAccountFallback: false,
+                browserCookieOrder: ProviderBrowserCookieDefaults.defaultImportOrder,
+                dashboardURL: "https://console.anthropic.com/settings/billing",
+                subscriptionDashboardURL: "https://claude.ai/settings/usage",
+                statusPageURL: "https://status.claude.com/",
+                usageCoverage: ProviderUsageCoverage(
+                    supportsModelBreakdown: true,
+                    supportsTokenMetrics: true,
+                    supportsProjectAttribution: true)),
+            branding: ProviderBranding(
+                iconStyle: .claude,
+                iconResourceName: "ProviderIcon-claude",
+                color: ProviderColor(red: 204 / 255, green: 124 / 255, blue: 94 / 255)),
+            tokenCost: ProviderTokenCostConfig(
+                supportsTokenCost: true,
+                noDataMessage: self.noDataMessage),
+            fetchPlan: ProviderFetchPlan(
+                sourceModes: [.auto, .web, .cli, .oauth],
+                pipeline: ProviderFetchPipeline(resolveStrategies: self.resolveStrategies)),
+            cli: ProviderCLIConfig(
+                name: "claude",
+                versionDetector: { ClaudeUsageFetcher().detectVersion() }))
+    }
+
+    private static func resolveStrategies(context: ProviderFetchContext) async -> [any ProviderFetchStrategy] {
+        switch context.runtime {
+        case .cli:
+            switch context.sourceMode {
+            case .oauth:
+                return [ClaudeOAuthFetchStrategy()]
+            case .web:
+                return [ClaudeWebFetchStrategy()]
+            case .cli:
+                return [ClaudeCLIFetchStrategy(useWebExtras: false)]
+            case .auto:
+                return [ClaudeWebFetchStrategy(), ClaudeCLIFetchStrategy(useWebExtras: false)]
+            case .api:
+                return []
+            }
+        case .app:
+            let hasWebSession = ClaudeWebAPIFetcher.hasSessionKey()
+            // OAuth usage endpoint requires user:profile scope.
+            let oauthCreds = try? ClaudeOAuthCredentialsStore.load()
+            let hasOAuthCredentials = oauthCreds?.scopes.contains("user:profile") ?? false
+            let settings = context.settings
+            let debugMenuEnabled = settings?.debugMenuEnabled ?? false
+            let claudeSettings = settings?.claude
+            let selected = claudeSettings?.usageDataSource ?? .oauth
+            let webExtrasEnabled = claudeSettings?.webExtrasEnabled ?? false
+            let strategy = Self.resolveUsageStrategy(
+                debugMenuEnabled: debugMenuEnabled,
+                selectedDataSource: selected,
+                webExtrasEnabled: webExtrasEnabled,
+                hasWebSession: hasWebSession,
+                hasOAuthCredentials: hasOAuthCredentials)
+            switch strategy.dataSource {
+            case .oauth:
+                return [ClaudeOAuthFetchStrategy()]
+            case .web:
+                return [ClaudeWebFetchStrategy()]
+            case .cli:
+                return [ClaudeCLIFetchStrategy(useWebExtras: strategy.useWebExtras)]
+            }
+        }
+    }
+
+    private static func noDataMessage() -> String {
+        "No Claude usage logs found in ~/.config/claude/projects or ~/.claude/projects."
+    }
+
+    public static func resolveUsageStrategy(
+        debugMenuEnabled: Bool,
+        selectedDataSource: ClaudeUsageDataSource,
+        webExtrasEnabled: Bool,
+        hasWebSession: Bool,
+        hasOAuthCredentials: Bool) -> ClaudeUsageStrategy
+    {
+        if debugMenuEnabled {
+            if selectedDataSource == .oauth {
+                return ClaudeUsageStrategy(dataSource: .oauth, useWebExtras: false)
+            }
+            if selectedDataSource == .web, !hasWebSession {
+                return ClaudeUsageStrategy(dataSource: .cli, useWebExtras: false)
+            }
+            let useWebExtras = selectedDataSource == .cli && webExtrasEnabled && hasWebSession
+            return ClaudeUsageStrategy(dataSource: selectedDataSource, useWebExtras: useWebExtras)
+        }
+
+        if hasOAuthCredentials {
+            return ClaudeUsageStrategy(dataSource: .oauth, useWebExtras: false)
+        }
+        if hasWebSession {
+            return ClaudeUsageStrategy(dataSource: .web, useWebExtras: false)
+        }
+        return ClaudeUsageStrategy(dataSource: .cli, useWebExtras: false)
+    }
+}
+
+public struct ClaudeUsageStrategy: Equatable, Sendable {
+    public let dataSource: ClaudeUsageDataSource
+    public let useWebExtras: Bool
+}
+
+struct ClaudeOAuthFetchStrategy: ProviderFetchStrategy {
+    let id: String = "claude.oauth"
+    let kind: ProviderFetchKind = .oauth
+
+    func isAvailable(_: ProviderFetchContext) async -> Bool {
+        guard let creds = try? ClaudeOAuthCredentialsStore.load() else { return false }
+        // Usage endpoint requires user:profile scope.
+        return creds.scopes.contains("user:profile")
+    }
+
+    func fetch(_ context: ProviderFetchContext) async throws -> ProviderFetchResult {
+        let fetcher = ClaudeUsageFetcher(dataSource: .oauth, useWebExtras: false)
+        let usage = try await fetcher.loadLatestUsage(model: "sonnet")
+        return self.makeResult(
+            usage: Self.snapshot(from: usage),
+            sourceLabel: "oauth")
+    }
+
+    func shouldFallback(on _: Error, context _: ProviderFetchContext) -> Bool {
+        false
+    }
+
+    fileprivate static func snapshot(from usage: ClaudeUsageSnapshot) -> UsageSnapshot {
+        let identity = ProviderIdentitySnapshot(
+            providerID: .claude,
+            accountEmail: usage.accountEmail,
+            accountOrganization: usage.accountOrganization,
+            loginMethod: usage.loginMethod)
+        return UsageSnapshot(
+            primary: usage.primary,
+            secondary: usage.secondary,
+            tertiary: usage.opus,
+            providerCost: usage.providerCost,
+            updatedAt: usage.updatedAt,
+            identity: identity)
+    }
+}
+
+struct ClaudeWebFetchStrategy: ProviderFetchStrategy {
+    let id: String = "claude.web"
+    let kind: ProviderFetchKind = .web
+
+    func isAvailable(_: ProviderFetchContext) async -> Bool {
+        ClaudeWebAPIFetcher.hasSessionKey()
+    }
+
+    func fetch(_: ProviderFetchContext) async throws -> ProviderFetchResult {
+        let fetcher = ClaudeUsageFetcher(dataSource: .web, useWebExtras: false)
+        let usage = try await fetcher.loadLatestUsage(model: "sonnet")
+        return self.makeResult(
+            usage: ClaudeOAuthFetchStrategy.snapshot(from: usage),
+            sourceLabel: "web")
+    }
+
+    func shouldFallback(on error: Error, context: ProviderFetchContext) -> Bool {
+        guard context.sourceMode == .auto else { return false }
+        if let fetchError = error as? ClaudeWebAPIFetcher.FetchError {
+            if case .noSessionKeyFound = fetchError { return true }
+        }
+        return false
+    }
+}
+
+struct ClaudeCLIFetchStrategy: ProviderFetchStrategy {
+    let id: String = "claude.cli"
+    let kind: ProviderFetchKind = .cli
+    let useWebExtras: Bool
+
+    func isAvailable(_: ProviderFetchContext) async -> Bool { true }
+
+    func fetch(_: ProviderFetchContext) async throws -> ProviderFetchResult {
+        let fetcher = ClaudeUsageFetcher(dataSource: .cli, useWebExtras: self.useWebExtras)
+        let usage = try await fetcher.loadLatestUsage(model: "sonnet")
+        return self.makeResult(
+            usage: ClaudeOAuthFetchStrategy.snapshot(from: usage),
+            sourceLabel: "claude")
+    }
+
+    func shouldFallback(on _: Error, context _: ProviderFetchContext) -> Bool {
+        false
+    }
+}