@sriinnu/runic 1.0.0

package/Sources/Runic/Core/Stores/CerebrasTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol CerebrasTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum CerebrasTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
+    private static let log = RunicLog.logger("cerebras-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "cerebras-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Cerebras token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw CerebrasTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw CerebrasTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw CerebrasTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw CerebrasTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/CohereTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol CohereTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum CohereTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainCohereTokenStore: CohereTokenStoring {
+    private static let log = RunicLog.logger("cohere-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "cohere-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Cohere token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw CohereTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw CohereTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw CohereTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw CohereTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/CopilotTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol CopilotTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum CopilotTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainCopilotTokenStore: CopilotTokenStoring {
+    private static let log = RunicLog.logger("copilot-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "copilot-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Copilot token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw CopilotTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw CopilotTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw CopilotTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw CopilotTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/CustomProviderStore.swift

@@ -0,0 +1,158 @@
+import Foundation
+import RunicCore
+
+// MARK: - Errors
+
+enum CustomProviderStoreError: LocalizedError {
+    case providerNotFound(id: String)
+    case duplicateProvider(id: String)
+    case invalidData
+    case fileSystemError(String)
+
+    var errorDescription: String? {
+        switch self {
+        case let .providerNotFound(id):
+            return "Provider with ID '\(id)' not found."
+        case let .duplicateProvider(id):
+            return "Provider with ID '\(id)' already exists."
+        case .invalidData:
+            return "Invalid provider data."
+        case let .fileSystemError(message):
+            return "File system error: \(message)"
+        }
+    }
+}
+
+// MARK: - Store
+
+public struct CustomProviderStore {
+    private static let log = RunicLog.logger("custom-provider-store")
+
+    // MARK: - Storage Location
+
+    private static var storageURL: URL {
+        let appSupport = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0]
+        let runicDir = appSupport.appendingPathComponent("Runic", isDirectory: true)
+        try? FileManager.default.createDirectory(at: runicDir, withIntermediateDirectories: true)
+        return runicDir.appendingPathComponent("custom-providers.json")
+    }
+
+    // MARK: - Load/Save
+
+    /// Load all custom providers from disk.
+    public static func load() -> CustomProvidersData {
+        guard FileManager.default.fileExists(atPath: storageURL.path) else {
+            Self.log.info("No custom providers file found, returning empty data.")
+            return CustomProvidersData()
+        }
+
+        do {
+            let data = try Data(contentsOf: storageURL)
+            let decoder = JSONDecoder()
+            decoder.dateDecodingStrategy = .iso8601
+            let providersData = try decoder.decode(CustomProvidersData.self, from: data)
+            Self.log.info("Loaded \(providersData.providers.count) custom provider(s).")
+            return providersData
+        } catch {
+            Self.log.error("Failed to load custom providers: \(error)")
+            return CustomProvidersData()
+        }
+    }
+
+    /// Save all custom providers to disk.
+    public static func save(_ providersData: CustomProvidersData) throws {
+        let encoder = JSONEncoder()
+        encoder.dateEncodingStrategy = .iso8601
+        encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
+
+        do {
+            let data = try encoder.encode(providersData)
+            try data.write(to: storageURL, options: .atomic)
+            Self.log.info("Saved \(providersData.providers.count) custom provider(s).")
+        } catch {
+            Self.log.error("Failed to save custom providers: \(error)")
+            throw CustomProviderStoreError.fileSystemError(error.localizedDescription)
+        }
+    }
+
+    // MARK: - CRUD Operations
+
+    /// Add a new custom provider.
+    ///
+    /// - Parameter provider: The provider configuration to add.
+    /// - Throws: `CustomProviderStoreError.duplicateProvider` if a provider with the same ID already exists.
+    public static func addProvider(_ provider: CustomProviderConfig) throws {
+        var data = Self.load()
+
+        // Check for duplicates
+        if data.providers.contains(where: { $0.id == provider.id }) {
+            Self.log.error("Provider with ID '\(provider.id)' already exists.")
+            throw CustomProviderStoreError.duplicateProvider(id: provider.id)
+        }
+
+        data.providers.append(provider)
+        try Self.save(data)
+        Self.log.info("Added custom provider: \(provider.name) (ID: \(provider.id))")
+    }
+
+    /// Update an existing custom provider.
+    ///
+    /// - Parameter provider: The updated provider configuration.
+    /// - Throws: `CustomProviderStoreError.providerNotFound` if the provider doesn't exist.
+    public static func updateProvider(_ provider: CustomProviderConfig) throws {
+        var data = Self.load()
+
+        guard let index = data.providers.firstIndex(where: { $0.id == provider.id }) else {
+            Self.log.error("Provider with ID '\(provider.id)' not found for update.")
+            throw CustomProviderStoreError.providerNotFound(id: provider.id)
+        }
+
+        var updatedProvider = provider
+        updatedProvider.updatedAt = Date()
+        data.providers[index] = updatedProvider
+        try Self.save(data)
+        Self.log.info("Updated custom provider: \(provider.name) (ID: \(provider.id))")
+    }
+
+    /// Remove a custom provider by ID.
+    ///
+    /// - Parameter id: The ID of the provider to remove.
+    /// - Throws: `CustomProviderStoreError.providerNotFound` if the provider doesn't exist.
+    public static func removeProvider(id: String) throws {
+        var data = Self.load()
+
+        guard let index = data.providers.firstIndex(where: { $0.id == id }) else {
+            Self.log.error("Provider with ID '\(id)' not found for removal.")
+            throw CustomProviderStoreError.providerNotFound(id: id)
+        }
+
+        let removedProvider = data.providers.remove(at: index)
+        try Self.save(data)
+        Self.log.info("Removed custom provider: \(removedProvider.name) (ID: \(id))")
+    }
+
+    /// Get a custom provider by ID.
+    ///
+    /// - Parameter id: The ID of the provider to retrieve.
+    /// - Returns: The provider configuration, or `nil` if not found.
+    public static func getProvider(id: String) -> CustomProviderConfig? {
+        let data = Self.load()
+        return data.providers.first(where: { $0.id == id })
+    }
+
+    /// Get all custom providers.
+    ///
+    /// - Returns: Array of all custom provider configurations.
+    public static func getAllProviders() -> [CustomProviderConfig] {
+        let data = Self.load()
+        return data.providers
+    }
+
+    /// Get only enabled custom providers.
+    ///
+    /// - Returns: Array of enabled custom provider configurations.
+    public static func getEnabledProviders() -> [CustomProviderConfig] {
+        let data = Self.load()
+        return data.providers.filter { $0.enabled }
+    }
+}