@sriinnu/runic 1.0.0

package/Packages/Silo/Sources/Silo/LinuxSecretService.swift

@@ -0,0 +1,105 @@
+#if os(Linux)
+import Dispatch
+import Foundation
+
+enum LinuxSecretService {
+    private static let defaultTimeoutSeconds: TimeInterval = 2.0
+
+    static func lookupPassword(applications: [String]) -> String? {
+        guard let tool = secretToolPath() else { return nil }
+        let timeout = secretToolTimeout()
+        for app in applications {
+            if let value = runSecretTool(tool: tool, args: ["lookup", "application", app], timeout: timeout) {
+                return value
+            }
+        }
+        return nil
+    }
+
+    private static func secretToolPath() -> String? {
+        if let override = envValue("SILO_SECRET_TOOL_PATH") {
+            if override.contains("/") {
+                return FileManager.default.isExecutableFile(atPath: override) ? override : nil
+            }
+            if let resolved = resolveToolFromPath(override) {
+                return resolved
+            }
+            return nil
+        }
+
+        let candidates = [
+            "/usr/bin/secret-tool",
+            "/usr/local/bin/secret-tool",
+            "/opt/homebrew/bin/secret-tool",
+        ]
+        for path in candidates where FileManager.default.isExecutableFile(atPath: path) {
+            return path
+        }
+
+        return resolveToolFromPath("secret-tool")
+    }
+
+    private static func resolveToolFromPath(_ tool: String) -> String? {
+        guard let pathValue = ProcessInfo.processInfo.environment["PATH"] else { return nil }
+        for segment in pathValue.split(separator: ":") where !segment.isEmpty {
+            let candidate = URL(fileURLWithPath: String(segment))
+                .appendingPathComponent(tool)
+                .path
+            if FileManager.default.isExecutableFile(atPath: candidate) {
+                return candidate
+            }
+        }
+        return nil
+    }
+
+    private static func secretToolTimeout() -> TimeInterval {
+        if let value = envValue("SILO_SECRET_TOOL_TIMEOUT_MS"), let ms = Double(value) {
+            return max(0, ms) / 1000.0
+        }
+        return defaultTimeoutSeconds
+    }
+
+    private static func envValue(_ key: String) -> String? {
+        guard let raw = ProcessInfo.processInfo.environment[key] else { return nil }
+        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private static func runSecretTool(tool: String, args: [String], timeout: TimeInterval) -> String? {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: tool)
+        process.arguments = args
+        process.environment = ProcessInfo.processInfo.environment
+
+        let stdout = Pipe()
+        process.standardOutput = stdout
+        process.standardError = Pipe()
+
+        let semaphore = DispatchSemaphore(value: 0)
+        process.terminationHandler = { _ in
+            semaphore.signal()
+        }
+
+        do {
+            try process.run()
+        } catch {
+            return nil
+        }
+
+        if timeout > 0 {
+            if semaphore.wait(timeout: .now() + timeout) == .timedOut {
+                process.terminate()
+                _ = semaphore.wait(timeout: .now() + 0.2)
+                return nil
+            }
+        } else {
+            semaphore.wait()
+        }
+
+        guard process.terminationStatus == 0 else { return nil }
+        let data = stdout.fileHandleForReading.readDataToEndOfFile()
+        let value = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return value?.isEmpty == false ? value : nil
+    }
+}
+#endif

package/Packages/Silo/Sources/Silo/MacOSChromiumCookieReader.swift

@@ -0,0 +1,191 @@
+#if os(macOS)
+import CommonCrypto
+import Foundation
+import LocalAuthentication
+import Security
+import SQLite3
+
+struct MacOSChromiumCookieReader {
+    func readCookies(
+        store: BrowserCookieStore,
+        decryptionFailurePolicy: BrowserCookieDecryptionFailurePolicy = .bestEffort) throws -> [BrowserCookieRecord]
+    {
+        let reader = ChromiumCookieReader()
+        let decryptor = MacOSChromiumDecryptor(browser: store.browser, databaseURL: store.databaseURL)
+        return try reader.readCookies(
+            store: store,
+            browser: store.browser,
+            decryptor: decryptor,
+            decryptionFailurePolicy: decryptionFailurePolicy,
+            requireKeyForEncrypted: true)
+    }
+}
+
+private struct MacOSChromiumDecryptor: ChromiumCookieDecrypting {
+    private static let salt = "saltysalt".data(using: .utf8) ?? Data()
+    private static let iterations: UInt32 = 1003
+    private static let keyLength = kCCKeySizeAES128
+    private static let chromiumEpoch: Date = {
+        var components = DateComponents()
+        components.year = 1601
+        components.month = 1
+        components.day = 1
+        components.calendar = Calendar(identifier: .gregorian)
+        components.timeZone = TimeZone(secondsFromGMT: 0)
+        return components.date ?? Date(timeIntervalSince1970: 0)
+    }()
+
+    let legacyKey: Data?
+    let gcmKey: Data?
+
+    var hasKey: Bool { self.legacyKey != nil || self.gcmKey != nil }
+
+    init(browser: Browser, databaseURL: URL?) {
+        guard let databaseURL,
+              let serviceName = Self.serviceName(for: browser) else {
+            self.legacyKey = nil
+            self.gcmKey = nil
+            return
+        }
+        let password = Self.readKeychainPassword(service: serviceName)
+        self.legacyKey = password.flatMap { Self.deriveKey(from: $0) }
+        self.gcmKey = Self.readLocalStateKey(databaseURL: databaseURL, legacyKey: self.legacyKey)
+    }
+
+    func decrypt(data: Data) -> String? {
+        guard data.count > 3 else { return nil }
+        let prefix = data.prefix(3)
+        guard let prefixString = String(data: prefix, encoding: .utf8),
+              prefixString == "v10" || prefixString == "v11" else {
+            return nil
+        }
+
+        let payload = Data(data.dropFirst(3))
+        if let gcmKey, let plaintext = Self.decryptGCM(payload: payload, key: gcmKey) {
+            return plaintext
+        }
+        if let legacyKey, let plaintext = Self.decryptCBC(payload: payload, key: legacyKey) {
+            return plaintext
+        }
+        return nil
+    }
+
+    private static func decryptCBC(payload: Data, key: Data) -> String? {
+        let iv = Data(repeating: 0x20, count: kCCBlockSizeAES128)
+        guard let data = CryptoSupport.decryptAESCBC(payload: payload, key: key, iv: iv) else { return nil }
+        return String(decoding: data, as: UTF8.self)
+    }
+
+    private static func decryptGCM(payload: Data, key: Data) -> String? {
+        guard let data = CryptoSupport.decryptAESGCM(payload: payload, key: key) else { return nil }
+        return String(decoding: data, as: UTF8.self)
+    }
+
+    private static func deriveKey(from password: String) -> Data? {
+        let passwordBytes = Array(password.utf8)
+        var key = Data(count: keyLength)
+        let status = key.withUnsafeMutableBytes { keyBytes in
+            CCKeyDerivationPBKDF(
+                CCPBKDFAlgorithm(kCCPBKDF2),
+                passwordBytes,
+                passwordBytes.count,
+                [UInt8](salt),
+                salt.count,
+                CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA1),
+                iterations,
+                keyBytes.bindMemory(to: UInt8.self).baseAddress,
+                keyLength)
+        }
+        return status == kCCSuccess ? key : nil
+    }
+
+    private static func readKeychainPassword(service: String) -> String? {
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+        ]
+        // Never trigger an authentication dialog from background refresh loops.
+        // If access requires UI, return nil and let callers fall back gracefully.
+        let authContext = LAContext()
+        authContext.interactionNotAllowed = true
+        query[kSecUseAuthenticationUI as String] = "kSecUseAuthenticationUIFail" as CFString
+        query[kSecUseAuthenticationContext as String] = authContext
+
+        var item: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &item)
+        guard status == errSecSuccess, let data = item as? Data else {
+            return nil
+        }
+        return String(data: data, encoding: .utf8)
+    }
+
+    private static func readLocalStateKey(databaseURL: URL, legacyKey: Data?) -> Data? {
+        guard let localStateURL = localStateURL(for: databaseURL),
+              let data = try? Data(contentsOf: localStateURL),
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let osCrypt = json["os_crypt"] as? [String: Any],
+              let encryptedKeyBase64 = osCrypt["encrypted_key"] as? String,
+              let encryptedKeyData = Data(base64Encoded: encryptedKeyBase64) else {
+            return nil
+        }
+
+        var keyData = encryptedKeyData
+        let dpapiPrefix = "DPAPI".data(using: .utf8) ?? Data()
+        if keyData.starts(with: dpapiPrefix) {
+            keyData = Data(keyData.dropFirst(dpapiPrefix.count))
+        }
+
+        if keyData.count >= 3,
+           let prefix = String(data: keyData.prefix(3), encoding: .utf8),
+           (prefix == "v10" || prefix == "v11"),
+           let legacyKey,
+           let decrypted = CryptoSupport.decryptAESCBC(
+                payload: Data(keyData.dropFirst(3)),
+                key: legacyKey,
+                iv: Data(repeating: 0x20, count: kCCBlockSizeAES128)) {
+            if decrypted.count == 32 {
+                return decrypted
+            }
+        }
+
+        if keyData.count == 32 {
+            return keyData
+        }
+
+        return nil
+    }
+
+    private static func localStateURL(for databaseURL: URL) -> URL? {
+        let parent = databaseURL.deletingLastPathComponent()
+        let profileURL = parent.lastPathComponent == "Network" ? parent.deletingLastPathComponent() : parent
+        let rootURL = profileURL.deletingLastPathComponent()
+        let localStateURL = rootURL.appendingPathComponent("Local State")
+        return FileManager.default.fileExists(atPath: localStateURL.path) ? localStateURL : nil
+    }
+
+    private static func serviceName(for browser: Browser) -> String? {
+        switch browser {
+        case .chrome: return "Chrome Safe Storage"
+        case .chromeBeta: return "Chrome Beta Safe Storage"
+        case .chromeCanary: return "Chrome Canary Safe Storage"
+        case .chromium: return "Chromium Safe Storage"
+        case .brave: return "Brave Safe Storage"
+        case .braveBeta: return "Brave Browser Beta Safe Storage"
+        case .braveNightly: return "Brave Browser Nightly Safe Storage"
+        case .edge: return "Microsoft Edge Safe Storage"
+        case .edgeBeta: return "Microsoft Edge Beta Safe Storage"
+        case .edgeCanary: return "Microsoft Edge Canary Safe Storage"
+        case .arc: return "Arc Safe Storage"
+        case .arcBeta: return "Arc Beta Safe Storage"
+        case .arcCanary: return "Arc Canary Safe Storage"
+        case .vivaldi: return "Vivaldi Safe Storage"
+        case .helium: return "Helium Safe Storage"
+        case .chatgptAtlas: return "ChatGPT Atlas Safe Storage"
+        case .safari, .firefox:
+            return nil
+        }
+    }
+}
+#endif

package/Packages/Silo/Sources/Silo/SQLiteSnapshot.swift

@@ -0,0 +1,41 @@
+import Foundation
+
+struct SQLiteSnapshot {
+    let readURL: URL
+    let cleanup: () -> Void
+
+    static func prepare(from databaseURL: URL) -> SQLiteSnapshot {
+        let fm = FileManager.default
+        let tempURL = fm.temporaryDirectory
+            .appendingPathComponent("silo", isDirectory: true)
+            .appendingPathComponent(UUID().uuidString)
+        let tempParent = tempURL.deletingLastPathComponent()
+        try? fm.createDirectory(at: tempParent, withIntermediateDirectories: true)
+
+        var usedTemp = false
+        do {
+            try fm.copyItem(at: databaseURL, to: tempURL)
+            usedTemp = true
+        } catch {
+            usedTemp = false
+        }
+
+        if usedTemp {
+            let walURL = URL(fileURLWithPath: databaseURL.path + "-wal")
+            let shmURL = URL(fileURLWithPath: databaseURL.path + "-shm")
+            if fm.fileExists(atPath: walURL.path) {
+                try? fm.copyItem(at: walURL, to: URL(fileURLWithPath: tempURL.path + "-wal"))
+            }
+            if fm.fileExists(atPath: shmURL.path) {
+                try? fm.copyItem(at: shmURL, to: URL(fileURLWithPath: tempURL.path + "-shm"))
+            }
+            return SQLiteSnapshot(readURL: tempURL) {
+                try? fm.removeItem(at: URL(fileURLWithPath: tempURL.path + "-wal"))
+                try? fm.removeItem(at: URL(fileURLWithPath: tempURL.path + "-shm"))
+                try? fm.removeItem(at: tempURL)
+            }
+        }
+
+        return SQLiteSnapshot(readURL: databaseURL, cleanup: {})
+    }
+}

package/Packages/Silo/Sources/Silo/WindowsChromiumCookieReader.swift

@@ -0,0 +1,110 @@
+#if os(Windows)
+import Foundation
+import SQLite3
+import WinSDK
+
+struct WindowsChromiumCookieReader {
+    func readCookies(
+        store: BrowserCookieStore,
+        decryptionFailurePolicy: BrowserCookieDecryptionFailurePolicy = .bestEffort) throws -> [BrowserCookieRecord]
+    {
+        let reader = ChromiumCookieReader()
+        let decryptor = WindowsChromiumDecryptor(databaseURL: store.databaseURL)
+        return try reader.readCookies(
+            store: store,
+            browser: store.browser,
+            decryptor: decryptor,
+            decryptionFailurePolicy: decryptionFailurePolicy,
+            requireKeyForEncrypted: false)
+    }
+}
+
+private struct WindowsChromiumDecryptor: ChromiumCookieDecrypting {
+    let masterKey: Data?
+
+    var hasKey: Bool { masterKey != nil }
+
+    init(databaseURL: URL?) {
+        if let databaseURL {
+            self.masterKey = Self.readLocalStateKey(databaseURL: databaseURL)
+        } else {
+            self.masterKey = nil
+        }
+    }
+
+    func decrypt(data: Data) -> String? {
+        guard data.count > 3 else { return nil }
+        let prefix = data.prefix(3)
+        if let prefixString = String(data: prefix, encoding: .utf8),
+           prefixString == "v10" || prefixString == "v11" {
+            guard let masterKey else { return nil }
+            let payload = Data(data.dropFirst(3))
+            guard let plaintext = CryptoSupport.decryptAESGCM(payload: payload, key: masterKey) else { return nil }
+            return String(decoding: plaintext, as: UTF8.self)
+        }
+
+        if let plaintext = Self.decryptDPAPI(data: data) {
+            return String(decoding: plaintext, as: UTF8.self)
+        }
+
+        return nil
+    }
+
+    private static func readLocalStateKey(databaseURL: URL) -> Data? {
+        guard let localStateURL = localStateURL(for: databaseURL),
+              let data = try? Data(contentsOf: localStateURL),
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let osCrypt = json["os_crypt"] as? [String: Any],
+              let encryptedKeyBase64 = osCrypt["encrypted_key"] as? String,
+              let encryptedKeyData = Data(
+                base64Encoded: encryptedKeyBase64,
+                options: .ignoreUnknownCharacters) else {
+            return nil
+        }
+
+        var keyData = encryptedKeyData
+        let dpapiPrefix = "DPAPI".data(using: .utf8) ?? Data()
+        if keyData.starts(with: dpapiPrefix) {
+            keyData = Data(keyData.dropFirst(dpapiPrefix.count))
+        }
+
+        guard let decrypted = decryptDPAPI(data: keyData) else { return nil }
+        return decrypted.count == 32 ? decrypted : nil
+    }
+
+    private static func localStateURL(for databaseURL: URL) -> URL? {
+        let parent = databaseURL.deletingLastPathComponent()
+        let profileURL = parent.lastPathComponent == "Network" ? parent.deletingLastPathComponent() : parent
+        let rootURL = profileURL.deletingLastPathComponent()
+        let localStateURL = rootURL.appendingPathComponent("Local State")
+        return FileManager.default.fileExists(atPath: localStateURL.path) ? localStateURL : nil
+    }
+
+    private static func decryptDPAPI(data: Data) -> Data? {
+        guard !data.isEmpty else { return nil }
+        var input = DATA_BLOB()
+        var output = DATA_BLOB()
+        let copied = [UInt8](data)
+
+        return copied.withUnsafeBytes { buffer in
+            guard let baseAddress = buffer.baseAddress else { return nil }
+            input.pbData = UnsafeMutablePointer<UInt8>(mutating: baseAddress.assumingMemoryBound(to: UInt8.self))
+            input.cbData = UInt32(buffer.count)
+            let result = CryptUnprotectData(
+                &input,
+                nil,
+                nil,
+                nil,
+                nil,
+                CRYPTPROTECT_UI_FORBIDDEN,
+                &output)
+            guard result != 0, let outData = output.pbData else {
+                return nil
+            }
+            let decrypted = Data(bytes: outData, count: Int(output.cbData))
+            LocalFree(UnsafeMutableRawPointer(outData))
+            return decrypted
+        }
+    }
+}
+#endif

package/README.md

@@ -0,0 +1,109 @@
+# Runic
+
+<div align="center">
+
+<img src="runic.png" alt="Runic — infinity symbol with usage bars" width="160" />
+
+**AI usage monitoring for your Mac menubar.**
+
+Track usage, costs, and quotas across 26 AI providers in real time.
+
+![macOS 14+](https://img.shields.io/badge/macOS-14%2B-000?logo=apple)
+![Swift 6.2](https://img.shields.io/badge/Swift-6.2-F05138?logo=swift&logoColor=white)
+![License MIT](https://img.shields.io/badge/license-MIT-blue)
+
+</div>
+
+---
+
+## What it does
+
+Runic sits in your menubar and shows how much of your AI subscription you've used, what it's costing, and when your limits reset. One click gives you charts, breakdowns, and forecasts across all your providers.
+
+## Supported Providers
+
+| | | |
+|---|---|---|
+| Claude | Codex | Cursor |
+| Gemini | Copilot | z.ai |
+| OpenRouter | Groq | DeepSeek |
+| Fireworks | Mistral | Perplexity |
+| Kimi | Together | Cohere |
+| xAI | Cerebras | SambaNova |
+| Azure OpenAI | Bedrock | Vertex AI |
+| Qwen | MiniMax | Auggie |
+| Antigravity | Factory (Droid) | |
+
+## Features
+
+**Menu dropdown**
+- Provider tab bar with brand icons
+- Hero stat with today's token count and cost
+- Inline line chart (1h / 6h / 1d / 7d / 30d)
+- Glassmorphism stat cards with sparklines
+- Usage progress bars with sheen animation
+- Live "Updated Xs ago" timestamp
+
+**Charts**
+- Usage timeline (area + line)
+- Today by hour (24-bar)
+- Last 7 days (weekly bars)
+- Subscription utilization (Daily / Weekly / Monthly)
+- Usage window comparison (session vs weekly)
+- Model breakdown (donut)
+- Project breakdown (bar)
+
+**Analytics**
+- Token usage (input, output, cache)
+- Cost estimation with per-model pricing
+- Spend forecasting and budget alerts
+- Project and model attribution
+
+**Export & Notifications**
+- Export as CSV or JSON
+- Budget breach alerts via macOS notifications
+- macOS widgets
+- CLI tool (`RunicCLI`)
+
+**Design**
+- Dark / Light / System theme
+- Liquid UI with glass materials and animated progress bars
+- SF Rounded typography
+- VoiceOver accessible
+- Sparkle auto-updates
+
+## Install
+
+```bash
+git clone https://github.com/sriinnu/Runic.git
+cd Runic
+./Scripts/compile_and_run.sh
+```
+
+Builds the app, signs it, installs to `/Applications`, and launches. The infinity icon appears in your menubar.
+
+## Configure
+
+Open **Preferences** from the menubar. Each provider has its own settings:
+
+- **API-based** (Groq, Mistral, z.ai, etc.): Paste your API key
+- **CLI-based** (Claude, Codex): Detected automatically
+- **Cloud** (Bedrock, Vertex AI): Set environment variables
+
+All tokens stored in macOS Keychain — no password prompts.
+
+## Privacy
+
+Zero telemetry. No analytics. No crash reporting. All data stays on your Mac.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+---
+
+<div align="center">
+
+Built by [Srinivas Pendela](https://github.com/sriinnu)
+
+</div>

package/RuniciOS/App/RuniciOSApp.swift

@@ -0,0 +1,105 @@
+import SwiftUI
+import RunicCore
+
+@main
+struct RuniciOSApp: App {
+    @StateObject private var usageStore = iOSUsageStore()
+    @StateObject private var settingsStore = SettingsStore()
+    @StateObject private var alertManager = AlertManager()
+    @StateObject private var syncEngine = iCloudSyncEngine()
+
+    init() {
+        // Configure app on launch
+        configureAppearance()
+        registerBackgroundTasks()
+    }
+
+    var body: some Scene {
+        WindowGroup {
+            ContentView()
+                .environmentObject(usageStore)
+                .environmentObject(settingsStore)
+                .environmentObject(alertManager)
+                .environmentObject(syncEngine)
+                .onAppear {
+                    Task {
+                        await usageStore.initialRefresh()
+                        await syncEngine.startSync()
+                    }
+                }
+                .onReceive(NotificationCenter.default.publisher(for: UIApplication.willEnterForegroundNotification)) { _ in
+                    Task {
+                        await usageStore.refresh()
+                    }
+                }
+        }
+    }
+
+    private func configureAppearance() {
+        // Configure navigation bar appearance
+        let appearance = UINavigationBarAppearance()
+        appearance.configureWithOpaqueBackground()
+        UINavigationBar.appearance().standardAppearance = appearance
+        UINavigationBar.appearance().scrollEdgeAppearance = appearance
+    }
+
+    private func registerBackgroundTasks() {
+        // Register background refresh task
+        // BGTaskScheduler.shared.register(forTaskWithIdentifier: "com.sriinnu.runic.refresh") { ... }
+    }
+}
+
+// MARK: - Content View
+
+struct ContentView: View {
+    @EnvironmentObject var usageStore: iOSUsageStore
+    @EnvironmentObject var alertManager: AlertManager
+    @State private var selectedTab = 0
+
+    var body: some View {
+        TabView(selection: $selectedTab) {
+            // Main providers list
+            ProviderListView()
+                .tabItem {
+                    Label("Providers", systemImage: "server.rack")
+                }
+                .tag(0)
+
+            // Model usage breakdown
+            ModelUsageView()
+                .tabItem {
+                    Label("Models", systemImage: "cpu")
+                }
+                .tag(1)
+
+            // Project tracking
+            ProjectTrackingView()
+                .tabItem {
+                    Label("Projects", systemImage: "folder")
+                }
+                .tag(2)
+
+            // Alerts
+            AlertsView()
+                .tabItem {
+                    Label("Alerts", systemImage: "bell.badge")
+                }
+                .badge(alertManager.activeAlerts.count)
+                .tag(3)
+
+            // Settings
+            SettingsView()
+                .tabItem {
+                    Label("Settings", systemImage: "gearshape")
+                }
+                .tag(4)
+        }
+        .overlay(alignment: .top) {
+            // Active alerts banner
+            if let alert = alertManager.activeAlerts.first {
+                AlertBannerView(alert: alert)
+                    .transition(.move(edge: .top).combined(with: .opacity))
+            }
+        }
+    }
+}