handling-the-session-cookielisted

# Handling the session cookie ## Overview `ollama-usage` holds the **same `__Secure-session` cookie the user's browser uses**. Anyone with it can read and use their Ollama account session. It is the single highest-stakes value in the codebase, and the whole tool is built so it travels exactly one path: ``` user pastes it → session.json (0600) → Cookie: header to ollama.com → nowhere else ``` Files: `src/ollama_usage/session.py`, `fetch.py`, `cli.py::auth`. ## Rules **Storage.** Only `session.save_cookie` writes it: JSON `{cookie, created_at}` in the data dir, then `chmod(0o600)`. Keep the chmod — it is the only thing stopping other local users from reading it. Never copy it into `cache.json` or `state.json`; those hold usage numbers only and are not permission-restricted. **Transmission.** Only `fetch.fetch_settings` sends it, as `Cookie: __Secure-session=<value>` to the settings URL. Nothing else may attach it to a request — notably not `notify_ntfy` (a public pub/sub topic) and not the GitHub update check. **Display.** It must never reach a terminal, a log, a notification, or an exception message: - The interactive prompt uses `Prompt.ask(..., password=True)` — masked. - `--verbose` prints the settings URL and the response **byte count**, never headers and never the body. Adding a header dump would leak it. - Error messages say *"Session expired. Run `ollama-usage auth`"* — never echo the value that failed. - `--cookie <value>` exists for automation and i