@sriinnu/runic 1.0.0

package/Sources/Runic/Core/Stores/OpenRouterTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol OpenRouterTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum OpenRouterTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainOpenRouterTokenStore: OpenRouterTokenStoring {
+    private static let log = RunicLog.logger("openrouter-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "openrouter-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating OpenRouter token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw OpenRouterTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw OpenRouterTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw OpenRouterTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw OpenRouterTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/PerplexityTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol PerplexityTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum PerplexityTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainPerplexityTokenStore: PerplexityTokenStoring {
+    private static let log = RunicLog.logger("perplexity-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "perplexity-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Perplexity token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw PerplexityTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw PerplexityTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw PerplexityTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw PerplexityTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/ProviderToggleStore.swift

@@ -0,0 +1,30 @@
+import RunicCore
+import Foundation
+
+struct ProviderToggleStore {
+    private let userDefaults: UserDefaults
+    private let key = "providerToggles"
+
+    init(userDefaults: UserDefaults = .standard) {
+        self.userDefaults = userDefaults
+    }
+
+    func isEnabled(metadata: ProviderMetadata) -> Bool {
+        self.load()[metadata.cliName] ?? metadata.defaultEnabled
+    }
+
+    func setEnabled(_ enabled: Bool, metadata: ProviderMetadata) {
+        var toggles = self.load()
+        toggles[metadata.cliName] = enabled
+        self.userDefaults.set(toggles, forKey: self.key)
+    }
+
+    private func load() -> [String: Bool] {
+        (self.userDefaults.dictionary(forKey: self.key) as? [String: Bool]) ?? [:]
+    }
+
+    func purgeLegacyKeys() {
+        self.userDefaults.removeObject(forKey: "showCodexUsage")
+        self.userDefaults.removeObject(forKey: "showClaudeUsage")
+    }
+}

package/Sources/Runic/Core/Stores/QwenTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol QwenTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum QwenTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainQwenTokenStore: QwenTokenStoring {
+    private static let log = RunicLog.logger("qwen-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "qwen-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Qwen token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw QwenTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw QwenTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw QwenTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw QwenTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/SambaNovaTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol SambaNovaTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum SambaNovaTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainSambaNovaTokenStore: SambaNovaTokenStoring {
+    private static let log = RunicLog.logger("sambanova-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "sambanova-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating SambaNova token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw SambaNovaTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw SambaNovaTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw SambaNovaTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw SambaNovaTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}