@sriinnu/runic 1.0.0

package/Sources/Runic/Core/Stores/TogetherTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol TogetherTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum TogetherTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainTogetherTokenStore: TogetherTokenStoring {
+    private static let log = RunicLog.logger("together-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "together-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Together token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw TogetherTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw TogetherTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw TogetherTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw TogetherTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/UsageStore+Accessors.swift

@@ -0,0 +1,20 @@
+import RunicCore
+import Foundation
+
+extension UsageStore {
+    var codexSnapshot: UsageSnapshot? { self.snapshots[.codex] }
+    var claudeSnapshot: UsageSnapshot? { self.snapshots[.claude] }
+    var lastCodexError: String? { self.errors[.codex] }
+    var lastClaudeError: String? { self.errors[.claude] }
+
+    func error(for provider: UsageProvider) -> String? { self.errors[provider] }
+
+    func status(for provider: UsageProvider) -> ProviderStatus? {
+        guard self.statusChecksEnabled else { return nil }
+        return self.statuses[provider]
+    }
+
+    func statusIndicator(for provider: UsageProvider) -> ProviderStatusIndicator {
+        self.status(for: provider)?.indicator ?? .none
+    }
+}

package/Sources/Runic/Core/Stores/UsageStore+Status.swift

@@ -0,0 +1,189 @@
+import Foundation
+
+extension UsageStore {
+    static func fetchStatus(from baseURL: URL) async throws -> ProviderStatus {
+        let apiURL = baseURL.appendingPathComponent("api/v2/status.json")
+        var request = URLRequest(url: apiURL)
+        request.timeoutInterval = 10
+
+        let (data, _) = try await URLSession.shared.data(for: request, delegate: nil)
+
+        struct Response: Decodable {
+            struct Status: Decodable {
+                let indicator: String
+                let description: String?
+            }
+
+            struct Page: Decodable {
+                let updatedAt: Date?
+
+                private enum CodingKeys: String, CodingKey {
+                    case updatedAt = "updated_at"
+                }
+            }
+
+            let page: Page?
+            let status: Status
+        }
+
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .custom { decoder in
+            let container = try decoder.singleValueContainer()
+            let raw = try container.decode(String.self)
+            let formatter = ISO8601DateFormatter()
+            formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+            if let date = formatter.date(from: raw) { return date }
+            formatter.formatOptions = [.withInternetDateTime]
+            if let date = formatter.date(from: raw) { return date }
+            throw DecodingError.dataCorruptedError(in: container, debugDescription: "Invalid ISO8601 date")
+        }
+
+        let response = try decoder.decode(Response.self, from: data)
+        let indicator = ProviderStatusIndicator(rawValue: response.status.indicator) ?? .unknown
+        return ProviderStatus(
+            indicator: indicator,
+            description: response.status.description,
+            updatedAt: response.page?.updatedAt)
+    }
+
+    static func fetchWorkspaceStatus(productID: String) async throws -> ProviderStatus {
+        guard let url = URL(string: "https://www.google.com/appsstatus/dashboard/incidents.json") else {
+            throw URLError(.badURL)
+        }
+        var request = URLRequest(url: url)
+        request.timeoutInterval = 10
+        let (data, _) = try await URLSession.shared.data(for: request, delegate: nil)
+        return try Self.parseGoogleWorkspaceStatus(data: data, productID: productID)
+    }
+
+    static func parseGoogleWorkspaceStatus(data: Data, productID: String) throws -> ProviderStatus {
+        let decoder = JSONDecoder()
+        decoder.keyDecodingStrategy = .convertFromSnakeCase
+        decoder.dateDecodingStrategy = .custom { decoder in
+            let container = try decoder.singleValueContainer()
+            let raw = try container.decode(String.self)
+            let formatter = ISO8601DateFormatter()
+            formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+            if let date = formatter.date(from: raw) { return date }
+            formatter.formatOptions = [.withInternetDateTime]
+            if let date = formatter.date(from: raw) { return date }
+            throw DecodingError.dataCorruptedError(in: container, debugDescription: "Invalid ISO8601 date")
+        }
+
+        let incidents = try decoder.decode([GoogleWorkspaceIncident].self, from: data)
+        let active = incidents.filter { $0.isRelevant(productID: productID) && $0.isActive }
+        guard !active.isEmpty else {
+            return ProviderStatus(indicator: .none, description: nil, updatedAt: nil)
+        }
+
+        var best: (
+            indicator: ProviderStatusIndicator,
+            incident: GoogleWorkspaceIncident,
+            update: GoogleWorkspaceUpdate?)
+        best = (indicator: .none, incident: active[0], update: active[0].mostRecentUpdate ?? active[0].updates?.last)
+
+        for incident in active {
+            let update = incident.mostRecentUpdate ?? incident.updates?.last
+            let indicator = Self.workspaceIndicator(
+                status: update?.status ?? incident.statusImpact,
+                severity: incident.severity)
+            if Self.indicatorRank(indicator) <= Self.indicatorRank(best.indicator) { continue }
+            best = (indicator: indicator, incident: incident, update: update)
+        }
+
+        let description = Self.workspaceSummary(from: best.update?.text ?? best.incident.externalDesc)
+        let updatedAt = best.update?.when ?? best.incident.modified ?? best.incident.begin
+        return ProviderStatus(indicator: best.indicator, description: description, updatedAt: updatedAt)
+    }
+
+    private static func indicatorRank(_ indicator: ProviderStatusIndicator) -> Int {
+        switch indicator {
+        case .none: 0
+        case .maintenance: 1
+        case .minor: 2
+        case .major: 3
+        case .critical: 4
+        case .unknown: 1
+        }
+    }
+
+    private static func workspaceIndicator(status: String?, severity: String?) -> ProviderStatusIndicator {
+        switch status?.uppercased() {
+        case "AVAILABLE": return .none
+        case "SERVICE_INFORMATION": return .minor
+        case "SERVICE_DISRUPTION": return .major
+        case "SERVICE_OUTAGE": return .critical
+        case "SERVICE_MAINTENANCE", "SCHEDULED_MAINTENANCE": return .maintenance
+        default: break
+        }
+
+        switch severity?.lowercased() {
+        case "low": return .minor
+        case "medium": return .major
+        case "high": return .critical
+        default: return .minor
+        }
+    }
+
+    private static func workspaceSummary(from text: String?) -> String? {
+        guard let text else { return nil }
+        let normalized = text
+            .replacingOccurrences(of: "\r\n", with: "\n")
+            .replacingOccurrences(of: "\r", with: "\n")
+        let lines = normalized.split(separator: "\n", omittingEmptySubsequences: true)
+        for rawLine in lines {
+            let trimmed = rawLine.trimmingCharacters(in: .whitespacesAndNewlines)
+            if trimmed.isEmpty { continue }
+            let lower = trimmed.lowercased()
+            if lower.hasPrefix("**summary") || lower.hasPrefix("**description") || lower == "summary" {
+                continue
+            }
+            var cleaned = trimmed.replacingOccurrences(of: "**", with: "")
+            cleaned = cleaned.replacingOccurrences(
+                of: #"\[([^\]]+)\]\([^)]+\)"#,
+                with: "$1",
+                options: .regularExpression)
+            if cleaned.hasPrefix("- ") {
+                cleaned.removeFirst(2)
+            }
+            cleaned = cleaned.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !cleaned.isEmpty { return cleaned }
+        }
+        return nil
+    }
+
+    private struct GoogleWorkspaceIncident: Decodable {
+        let begin: Date?
+        let end: Date?
+        let modified: Date?
+        let externalDesc: String?
+        let statusImpact: String?
+        let severity: String?
+        let affectedProducts: [GoogleWorkspaceProduct]?
+        let currentlyAffectedProducts: [GoogleWorkspaceProduct]?
+        let mostRecentUpdate: GoogleWorkspaceUpdate?
+        let updates: [GoogleWorkspaceUpdate]?
+
+        var isActive: Bool {
+            self.end == nil
+        }
+
+        func isRelevant(productID: String) -> Bool {
+            if let current = currentlyAffectedProducts {
+                return current.contains(where: { $0.id == productID })
+            }
+            return self.affectedProducts?.contains(where: { $0.id == productID }) ?? false
+        }
+    }
+
+    private struct GoogleWorkspaceProduct: Decodable {
+        let title: String?
+        let id: String
+    }
+
+    private struct GoogleWorkspaceUpdate: Decodable {
+        let when: Date?
+        let status: String?
+        let text: String?
+    }
+}

package/Sources/Runic/Core/Stores/UsageStore+TokenCost.swift

@@ -0,0 +1,33 @@
+import RunicCore
+import Foundation
+
+extension UsageStore {
+    func tokenSnapshot(for provider: UsageProvider) -> CostUsageTokenSnapshot? {
+        self.tokenSnapshots[provider]
+    }
+
+    func tokenError(for provider: UsageProvider) -> String? {
+        self.tokenErrors[provider]
+    }
+
+    func tokenLastAttemptAt(for provider: UsageProvider) -> Date? {
+        self.lastTokenFetchAt[provider]
+    }
+
+    func isTokenRefreshInFlight(for provider: UsageProvider) -> Bool {
+        self.tokenRefreshInFlight.contains(provider)
+    }
+
+    nonisolated static func costUsageCacheDirectory(
+        fileManager: FileManager = .default) -> URL
+    {
+        let root = fileManager.urls(for: .cachesDirectory, in: .userDomainMask).first!
+        return root
+            .appendingPathComponent("Runic", isDirectory: true)
+            .appendingPathComponent("cost-usage", isDirectory: true)
+    }
+
+    nonisolated static func tokenCostNoDataMessage(for provider: UsageProvider) -> String {
+        ProviderDescriptorRegistry.descriptor(for: provider).tokenCost.noDataMessage()
+    }
+}

package/Sources/Runic/Core/Stores/UsageStore+WidgetSnapshot.swift

@@ -0,0 +1,67 @@
+import RunicCore
+import Foundation
+#if canImport(WidgetKit)
+import WidgetKit
+#endif
+
+extension UsageStore {
+    func persistWidgetSnapshot(reason: String) {
+        let snapshot = self.makeWidgetSnapshot()
+        Task.detached(priority: .utility) {
+            WidgetSnapshotStore.save(snapshot)
+            #if canImport(WidgetKit)
+            await MainActor.run {
+                WidgetCenter.shared.reloadAllTimelines()
+            }
+            #endif
+        }
+    }
+
+    private func makeWidgetSnapshot() -> WidgetSnapshot {
+        let enabledProviders = self.enabledProviders()
+        let entries = UsageProvider.allCases.compactMap { provider in
+            self.makeWidgetEntry(for: provider)
+        }
+        return WidgetSnapshot(entries: entries, enabledProviders: enabledProviders, generatedAt: Date())
+    }
+
+    private func makeWidgetEntry(for provider: UsageProvider) -> WidgetSnapshot.ProviderEntry? {
+        guard let snapshot = self.snapshots[provider] else { return nil }
+
+        let tokenSnapshot = self.tokenSnapshots[provider]
+        let dailyUsage = tokenSnapshot?.daily.map { entry in
+            WidgetSnapshot.DailyUsagePoint(
+                dayKey: entry.date,
+                totalTokens: entry.totalTokens,
+                costUSD: entry.costUSD)
+        } ?? []
+
+        let tokenUsage = Self.widgetTokenUsageSummary(from: tokenSnapshot)
+        let creditsRemaining = provider == .codex ? self.credits?.remaining : nil
+        let codeReviewRemaining = provider == .codex ? self.openAIDashboard?.codeReviewRemainingPercent : nil
+
+        return WidgetSnapshot.ProviderEntry(
+            provider: provider,
+            updatedAt: snapshot.updatedAt,
+            primary: snapshot.primary,
+            secondary: snapshot.secondary,
+            tertiary: snapshot.tertiary,
+            creditsRemaining: creditsRemaining,
+            codeReviewRemainingPercent: codeReviewRemaining,
+            tokenUsage: tokenUsage,
+            dailyUsage: dailyUsage)
+    }
+
+    private nonisolated static func widgetTokenUsageSummary(
+        from snapshot: CostUsageTokenSnapshot?) -> WidgetSnapshot.TokenUsageSummary?
+    {
+        guard let snapshot else { return nil }
+        let fallbackTokens = snapshot.daily.compactMap(\.totalTokens).reduce(0, +)
+        let monthTokensValue = snapshot.last30DaysTokens ?? (fallbackTokens > 0 ? fallbackTokens : nil)
+        return WidgetSnapshot.TokenUsageSummary(
+            sessionCostUSD: snapshot.sessionCostUSD,
+            sessionTokens: snapshot.sessionTokens,
+            last30DaysCostUSD: snapshot.last30DaysCostUSD,
+            last30DaysTokens: monthTokensValue)
+    }
+}