@sriinnu/runic 1.0.0

package/Sources/Runic/Core/Stores/XAITokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol XAITokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum XAITokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainXAITokenStore: XAITokenStoring {
+    private static let log = RunicLog.logger("xai-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "xai-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating xAI token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw XAITokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw XAITokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw XAITokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw XAITokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/ZaiTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol ZaiTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum ZaiTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainZaiTokenStore: ZaiTokenStoring {
+    private static let log = RunicLog.logger("zai-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "zai-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating z.ai token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw ZaiTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw ZaiTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw ZaiTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw ZaiTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/UsageExporter.swift

@@ -0,0 +1,193 @@
+import Foundation
+import RunicCore
+
+/// Exports usage data from the ledger as CSV or JSON.
+@MainActor
+enum UsageExporter {
+    enum Format: String {
+        case csv
+        case json
+    }
+
+    /// Build an export string for the given provider in the requested format.
+    static func export(store: UsageStore, provider: UsageProvider, format: Format) -> String {
+        switch format {
+        case .csv:
+            self.exportCSV(store: store, provider: provider)
+        case .json:
+            self.exportJSON(store: store, provider: provider)
+        }
+    }
+
+    // MARK: - CSV
+
+    private static func exportCSV(store: UsageStore, provider: UsageProvider) -> String {
+        var lines: [String] = []
+
+        // Header
+        lines.append("date,input_tokens,output_tokens,cache_creation_tokens,cache_read_tokens,total_tokens,cost_usd,models_used")
+
+        // Daily summaries from token snapshot
+        let daily = store.tokenSnapshot(for: provider)?.daily ?? []
+
+        for day in daily {
+            let costStr = day.costUSD.map { String(format: "%.4f", $0) } ?? ""
+            let modelsStr = Self.csvEscape((day.modelsUsed ?? []).joined(separator: "; "))
+            let input = day.inputTokens ?? 0
+            let output = day.outputTokens ?? 0
+            let cacheCreate = day.cacheCreationTokens ?? 0
+            let cacheRead = day.cacheReadTokens ?? 0
+            let total = day.totalTokens ?? (input + output + cacheCreate + cacheRead)
+            lines.append("\(day.date),\(input),\(output),\(cacheCreate),\(cacheRead),\(total),\(costStr),\(modelsStr)")
+        }
+
+        // If no token snapshot daily data, fall back to ledger daily summary
+        if daily.isEmpty, let summary = store.ledgerDailySummary(for: provider) {
+            let costStr = summary.totals.costUSD.map { String(format: "%.4f", $0) } ?? ""
+            let modelsStr = Self.csvEscape(summary.modelsUsed.joined(separator: "; "))
+            lines.append("\(summary.dayKey),\(summary.totals.inputTokens),\(summary.totals.outputTokens),\(summary.totals.cacheCreationTokens),\(summary.totals.cacheReadTokens),\(summary.totals.totalTokens),\(costStr),\(modelsStr)")
+        }
+
+        return lines.joined(separator: "\n")
+    }
+
+    // MARK: - JSON
+
+    private static func exportJSON(store: UsageStore, provider: UsageProvider) -> String {
+        let metadata = store.metadata(for: provider)
+        let dateFormatter = DateFormatter()
+        dateFormatter.locale = Locale(identifier: "en_US_POSIX")
+        dateFormatter.timeZone = TimeZone.current
+        dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ssZ"
+
+        let nowStr = dateFormatter.string(from: Date())
+
+        var root: [String: Any] = [
+            "provider": provider.rawValue,
+            "providerDisplayName": metadata.displayName,
+            "exportedAt": nowStr,
+        ]
+
+        // Daily summaries from token snapshot
+        var dailyArray: [[String: Any]] = []
+        let daily = store.tokenSnapshot(for: provider)?.daily ?? []
+
+        for day in daily {
+            let input = day.inputTokens ?? 0
+            let output = day.outputTokens ?? 0
+            let cacheCreate = day.cacheCreationTokens ?? 0
+            let cacheRead = day.cacheReadTokens ?? 0
+            let total = day.totalTokens ?? (input + output + cacheCreate + cacheRead)
+            var entry: [String: Any] = [
+                "date": day.date,
+                "inputTokens": input,
+                "outputTokens": output,
+                "cacheCreationTokens": cacheCreate,
+                "cacheReadTokens": cacheRead,
+                "totalTokens": total,
+                "models": day.modelsUsed ?? [],
+            ]
+            if let cost = day.costUSD {
+                entry["costUSD"] = cost
+            }
+            dailyArray.append(entry)
+        }
+
+        // Fallback to ledger summary if no token snapshot data
+        if dailyArray.isEmpty, let summary = store.ledgerDailySummary(for: provider) {
+            var entry: [String: Any] = [
+                "date": summary.dayKey,
+                "inputTokens": summary.totals.inputTokens,
+                "outputTokens": summary.totals.outputTokens,
+                "cacheCreationTokens": summary.totals.cacheCreationTokens,
+                "cacheReadTokens": summary.totals.cacheReadTokens,
+                "totalTokens": summary.totals.totalTokens,
+                "models": summary.modelsUsed,
+            ]
+            if let cost = summary.totals.costUSD {
+                entry["costUSD"] = cost
+            }
+            dailyArray.append(entry)
+        }
+
+        root["dailySummaries"] = dailyArray
+
+        // Model breakdowns
+        let modelBreakdowns = store.ledgerModelBreakdown(for: provider)
+        if !modelBreakdowns.isEmpty {
+            root["modelBreakdowns"] = modelBreakdowns.map { model -> [String: Any] in
+                var entry: [String: Any] = [
+                    "model": model.model,
+                    "requestCount": model.entryCount,
+                    "inputTokens": model.totals.inputTokens,
+                    "outputTokens": model.totals.outputTokens,
+                    "totalTokens": model.totals.totalTokens,
+                ]
+                if let cost = model.totals.costUSD {
+                    entry["costUSD"] = cost
+                }
+                if let projectName = model.projectName {
+                    entry["projectName"] = projectName
+                }
+                if let projectID = model.projectID {
+                    entry["projectID"] = projectID
+                }
+                return entry
+            }
+        }
+
+        // Project breakdowns
+        let projectBreakdowns = store.ledgerProjectBreakdown(for: provider)
+        if !projectBreakdowns.isEmpty {
+            root["projectBreakdowns"] = projectBreakdowns.map { project -> [String: Any] in
+                var entry: [String: Any] = [
+                    "projectName": project.displayProjectName,
+                    "requestCount": project.entryCount,
+                    "inputTokens": project.totals.inputTokens,
+                    "outputTokens": project.totals.outputTokens,
+                    "totalTokens": project.totals.totalTokens,
+                    "models": project.modelsUsed,
+                ]
+                if let cost = project.totals.costUSD {
+                    entry["costUSD"] = cost
+                }
+                if let projectID = project.projectID {
+                    entry["projectID"] = projectID
+                }
+                return entry
+            }
+        }
+
+        // Spend forecast
+        if let forecast = store.ledgerSpendForecast(for: provider) {
+            root["spendForecast"] = [
+                "observedDays": forecast.observedDays,
+                "observedCostUSD": forecast.observedCostUSD,
+                "averageDailyCostUSD": forecast.averageDailyCostUSD,
+                "projected30DayCostUSD": forecast.projected30DayCostUSD,
+                "budgetWillBreach": forecast.budgetWillBreach,
+            ] as [String: Any]
+        }
+
+        guard let data = try? JSONSerialization.data(
+            withJSONObject: root,
+            options: [.prettyPrinted, .sortedKeys]),
+              let string = String(data: data, encoding: .utf8) else
+        {
+            return "{}"
+        }
+        return string
+    }
+
+    // MARK: - Helpers
+
+    /// Escape a value for CSV, quoting if it contains commas, quotes, or newlines.
+    private static func csvEscape(_ value: String) -> String {
+        let needsQuoting = value.contains(",") || value.contains("\"") || value.contains("\n")
+        if needsQuoting {
+            let escaped = value.replacingOccurrences(of: "\"", with: "\"\"")
+            return "\"\(escaped)\""
+        }
+        return value
+    }
+}

package/Sources/Runic/Date+RelativeDescription.swift

@@ -0,0 +1,21 @@
+import Foundation
+
+enum RelativeTimeFormatters {
+    @MainActor
+    static let full: RelativeDateTimeFormatter = {
+        let formatter = RelativeDateTimeFormatter()
+        formatter.unitsStyle = .full
+        return formatter
+    }()
+}
+
+extension Date {
+    @MainActor
+    func relativeDescription(now: Date = .now) -> String {
+        let seconds = abs(now.timeIntervalSince(self))
+        if seconds < 15 {
+            return "just now"
+        }
+        return RelativeTimeFormatters.full.localizedString(for: self, relativeTo: now)
+    }
+}

package/Sources/Runic/HiddenWindowView.swift

@@ -0,0 +1,32 @@
+import SwiftUI
+
+struct HiddenWindowView: View {
+    @Environment(\.openSettings) private var openSettings
+
+    var body: some View {
+        Color.clear
+            .frame(width: 20, height: 20)
+            .onReceive(NotificationCenter.default.publisher(for: .runicOpenSettings)) { _ in
+                Task { @MainActor in
+                    self.openSettings()
+                }
+            }
+            .onAppear {
+                if let window = NSApp.windows.first(where: { $0.title == "RunicLifecycleKeepalive" }) {
+                    // Make the keepalive window truly invisible and non-interactive.
+                    window.styleMask = [.borderless]
+                    window.collectionBehavior = [.auxiliary, .ignoresCycle, .transient, .canJoinAllSpaces]
+                    window.isExcludedFromWindowsMenu = true
+                    window.level = .floating
+                    window.isOpaque = false
+                    window.alphaValue = 0
+                    window.backgroundColor = .clear
+                    window.hasShadow = false
+                    window.ignoresMouseEvents = true
+                    window.canHide = false
+                    window.setContentSize(NSSize(width: 1, height: 1))
+                    window.setFrameOrigin(NSPoint(x: -5000, y: -5000))
+                }
+            }
+    }
+}

package/Sources/Runic/InstallOrigin.swift

@@ -0,0 +1,9 @@
+import Foundation
+
+enum InstallOrigin {
+    static func isHomebrewCask(appBundleURL: URL) -> Bool {
+        let resolved = appBundleURL.resolvingSymlinksInPath()
+        let path = resolved.path
+        return path.contains("/Caskroom/") || path.contains("/Homebrew/Caskroom/")
+    }
+}

package/Sources/Runic/KeyboardShortcuts+Names.swift

@@ -0,0 +1,6 @@
+import KeyboardShortcuts
+
+@MainActor
+extension KeyboardShortcuts.Name {
+    static let openMenu = Self("openMenu")
+}

package/Sources/Runic/MouseLocationReader.swift

@@ -0,0 +1,65 @@
+import AppKit
+import SwiftUI
+
+/// Lightweight NSView-based mouse tracking with local coordinates.
+///
+/// Why: SwiftUI's `onHover` doesn't provide location, but we want "hover a bar to see values" on macOS.
+@MainActor
+struct MouseLocationReader: NSViewRepresentable {
+    let onMoved: (CGPoint?) -> Void
+
+    func makeNSView(context: Context) -> TrackingView {
+        let view = TrackingView()
+        view.onMoved = self.onMoved
+        return view
+    }
+
+    func updateNSView(_ nsView: TrackingView, context: Context) {
+        nsView.onMoved = self.onMoved
+    }
+
+    final class TrackingView: NSView {
+        var onMoved: ((CGPoint?) -> Void)?
+        private var trackingArea: NSTrackingArea?
+
+        override func viewDidMoveToWindow() {
+            super.viewDidMoveToWindow()
+            self.window?.acceptsMouseMovedEvents = true
+            self.updateTrackingAreas()
+        }
+
+        override func updateTrackingAreas() {
+            super.updateTrackingAreas()
+            if let trackingArea {
+                self.removeTrackingArea(trackingArea)
+            }
+
+            let options: NSTrackingArea.Options = [
+                // NSMenu popups aren't "key windows", so `.activeInKeyWindow` would drop events and cause hover
+                // state to flicker. `.activeAlways` keeps tracking stable while the menu is open.
+                .activeAlways,
+                .inVisibleRect,
+                .mouseEnteredAndExited,
+                .mouseMoved,
+            ]
+            let area = NSTrackingArea(rect: .zero, options: options, owner: self, userInfo: nil)
+            self.addTrackingArea(area)
+            self.trackingArea = area
+        }
+
+        override func mouseEntered(with event: NSEvent) {
+            super.mouseEntered(with: event)
+            self.onMoved?(self.convert(event.locationInWindow, from: nil))
+        }
+
+        override func mouseMoved(with event: NSEvent) {
+            super.mouseMoved(with: event)
+            self.onMoved?(self.convert(event.locationInWindow, from: nil))
+        }
+
+        override func mouseExited(with event: NSEvent) {
+            super.mouseExited(with: event)
+            self.onMoved?(nil)
+        }
+    }
+}

package/Sources/Runic/Notifications+Runic.swift

@@ -0,0 +1,6 @@
+import Foundation
+
+extension Notification.Name {
+    static let runicOpenSettings = Notification.Name("runicOpenSettings")
+    static let runicDebugBlinkNow = Notification.Name("runicDebugBlinkNow")
+}