release 1.3.0: multi-org support, WKWebView JS fetch, diagnostics panel

didFinish only fires for cross-document (full page) navigations. After
loading https://claude.ai/login the SPA redirects authenticated users
via history.pushState to /new — this changes the URL visually but never
fires didFinish, so auth was never detected.

KVO on webView.url fires for every URL change including SPA pushState,
covering the case where the app routes client-side after the initial
page load. Both KVO and didFinish now call the same checkCurrentURL
helper so detection is not missed regardless of navigation type.

ClaudeChecker.xcodeproj/project.pbxproj

@@ -10,6 +10,13 @@
 	<string>77</string>
 	<key>objects</key>
 	<dict>
+		<key>AAAAAA009</key>
+		<dict>
+			<key>isa</key>
+			<string>PBXBuildFile</string>
+			<key>fileRef</key>
+			<string>AAAAAA109</string>
+		</dict>
 		<key>AAAAAA007</key>
 		<dict>
 			<key>isa</key>
@@ -88,6 +95,17 @@
 			<key>sourceTree</key>
 			<string>&lt;group&gt;</string>
 		</dict>
+		<key>AAAAAA109</key>
+		<dict>
+			<key>isa</key>
+			<string>PBXFileReference</string>
+			<key>lastKnownFileType</key>
+			<string>sourcecode.swift</string>
+			<key>path</key>
+			<string>DiagnosticsView.swift</string>
+			<key>sourceTree</key>
+			<string>&lt;group&gt;</string>
+		</dict>
 		<key>AAAAAA101</key>
 		<dict>
 			<key>isa</key>
@@ -179,6 +197,7 @@
 				<string>AAAAAA106</string>
 				<string>AAAAAA107</string>
 				<string>AAAAAA108</string>
+				<string>AAAAAA109</string>
 			</array>
 			<key>path</key>
 			<string>ClaudeChecker</string>
@@ -292,6 +311,7 @@
 				<string>AAAAAA005</string>
 				<string>AAAAAA007</string>
 				<string>AAAAAA008</string>
+				<string>AAAAAA009</string>
 			</array>
 			<key>runOnlyForDeploymentPostprocessing</key>
 			<string>0</string>

ClaudeChecker/ContentView.swift

@@ -40,8 +40,7 @@ struct ContentView: View {
                         .environmentObject(updater)
                         .transition(.move(edge: .trailing).combined(with: .opacity))
                 } else {
-                    ScrollView(.vertical, showsIndicators: false) {
-                        VStack(spacing: 0) {
+                    VStack(spacing: 0) {
                             // Cards grid
                             if vm.limits.isEmpty {
                                 EmptyStateView()
@@ -96,7 +95,6 @@ struct ContentView: View {
                                         .padding(.bottom, 8)
                                 }
                             }
-                        }
                     }
                     .transition(.opacity)
 
@@ -118,8 +116,8 @@ struct ContentView: View {
             showUpdateSheet = true
         }
         .sheet(isPresented: $showLogin) {
-            LoginSheetView(isPresented: $showLogin) {
-                Task { await vm.refresh() }
+            LoginSheetView(isPresented: $showLogin) { webView in
+                Task { await vm.adoptAndRefresh(webView) }
             }
         }
         .sheet(isPresented: $showUpdateSheet) {
@@ -398,12 +396,11 @@ struct DiaryRow: View {
     var body: some View {
         VStack(alignment: .leading, spacing: 5) {
             HStack {
-                AgentIconView(agent: .claude, size: 12)
-                Text("Claude")
-                    .font(.system(size: 12, weight: .medium))
-                    .foregroundColor(color)
+                Text("\(totalSaved) samples")
+                    .font(.system(size: 10.5))
+                    .foregroundColor(.secondary)
                 Spacer()
-                Text("\(totalSaved) samples · Avg Burn Rate: +\(String(format: "%.1f", burnRate))%/h")
+                Text("Avg burn rate: \(String(format: "%.1f", burnRate))%/h")
                     .font(.system(size: 10.5))
                     .foregroundColor(.secondary)
             }
@@ -587,6 +584,7 @@ struct SettingsView: View {
     @Binding var showSettings: Bool
     @Binding var showUpdateSheet: Bool
     @State private var checkingForUpdates = false
+    @State private var showDiagnostics = false
 
     let refreshOptions: [(label: String, seconds: TimeInterval)] = [
         ("1 min",  60),
@@ -773,6 +771,23 @@ struct SettingsView: View {
 
             Divider()
 
+            // Diagnostics
+            HStack {
+                Label("Diagnostics", systemImage: "stethoscope")
+                    .font(.system(size: 12, weight: .medium))
+                    .foregroundColor(.secondary)
+                Spacer()
+                Button("Open") { showDiagnostics = true }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+            }
+            .sheet(isPresented: $showDiagnostics) {
+                DiagnosticsView(isPresented: $showDiagnostics)
+                    .environmentObject(vm)
+            }
+
+            Divider()
+
             // About
             HStack(spacing: 12) {
                 Image(nsImage: NSImage(named: "AppIcon") ?? NSImage())
@@ -914,12 +929,12 @@ struct ErrorBanner: View {
 struct EmptyStateView: View {
     var body: some View {
         VStack(spacing: 10) {
-            Image(systemName: "key.slash")
+            Image(systemName: "person.crop.circle.badge.questionmark")
                 .font(.system(size: 28))
                 .foregroundColor(.secondary)
-            Text("No API key configured")
+            Text("Not signed in")
                 .font(.system(size: 13, weight: .medium))
-            Text("Open Settings to add your Anthropic API key.")
+            Text("Sign in to claude.ai to see your usage.")
                 .font(.system(size: 11.5))
                 .foregroundColor(.secondary)
                 .multilineTextAlignment(.center)

ClaudeChecker/DiagnosticsView.swift

@@ -0,0 +1,246 @@
+import SwiftUI
+import WebKit
+
+struct DiagnosticsView: View {
+    @EnvironmentObject var vm: UsageViewModel
+    @Binding var isPresented: Bool
+    @State private var liveAllCookies: [HTTPCookie] = []
+    @State private var loadingCookies = false
+    @State private var copied = false
+
+    var body: some View {
+        VStack(spacing: 0) {
+            // Header
+            HStack {
+                Text("Diagnostics")
+                    .font(.system(size: 13, weight: .semibold))
+                Spacer()
+                Button("Copy All") {
+                    NSPasteboard.general.clearContents()
+                    NSPasteboard.general.setString(fullDiagText, forType: .string)
+                    copied = true
+                    DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) { copied = false }
+                }
+                .buttonStyle(.bordered)
+                .controlSize(.small)
+                if copied {
+                    Text("Copied!")
+                        .font(.system(size: 11))
+                        .foregroundColor(.green)
+                }
+                Button("Close") { isPresented = false }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+            }
+            .padding(.horizontal, 14)
+            .padding(.vertical, 10)
+            .background(Color(nsColor: .windowBackgroundColor))
+
+            Divider()
+
+            ScrollView {
+                VStack(alignment: .leading, spacing: 14) {
+
+                    // App info
+                    DiagSection(title: "App") {
+                        DiagRow("Version", Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?")
+                        DiagRow("Build",   Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "?")
+                        DiagRow("Signed in", vm.isSignedIn ? "Yes" : "No")
+                        DiagRow("Email",   vm.userEmail.isEmpty ? "(none)" : vm.userEmail)
+                        DiagRow("Org ID",  UserDefaults.standard.string(forKey: "claude_org_id") ?? "(none)")
+                        DiagRow("lastActiveOrg", vm.diagLastActiveOrg.isEmpty ? "(not read)" : vm.diagLastActiveOrg)
+                        DiagRow("Error",   vm.errorMessage ?? "(none)")
+                    }
+
+                    Divider()
+
+                    // Last request
+                    DiagSection(title: "Last Request") {
+                        DiagRow("Path",    vm.diagLastPath.isEmpty ? "(none)" : vm.diagLastPath)
+                        DiagRow("Status",  vm.diagLastStatus == 0 ? "(none)" : "\(vm.diagLastStatus)")
+                        DiagRow("Error",   vm.diagLastError.isEmpty ? "(none)" : vm.diagLastError)
+                        if let t = vm.diagLastFetch {
+                            DiagRow("Time", t.formatted(date: .omitted, time: .standard))
+                        }
+                    }
+
+                    Divider()
+
+                    // Bootstrap body
+                    if !vm.diagBootstrapBody.isEmpty {
+                        DiagSection(title: "Bootstrap Response (first 500 chars)") {
+                            Text(vm.diagBootstrapBody)
+                                .font(.system(size: 10, design: .monospaced))
+                                .foregroundColor(.secondary)
+                                .textSelection(.enabled)
+                                .frame(maxWidth: .infinity, alignment: .leading)
+                                .padding(8)
+                                .background(Color.primary.opacity(0.04))
+                                .cornerRadius(5)
+                        }
+                        Divider()
+                    }
+
+                    // Response body
+                    if !vm.diagLastBody.isEmpty {
+                        DiagSection(title: "Last API Response (first 500 chars)") {
+                            Text(vm.diagLastBody)
+                                .font(.system(size: 10, design: .monospaced))
+                                .foregroundColor(.secondary)
+                                .textSelection(.enabled)
+                                .frame(maxWidth: .infinity, alignment: .leading)
+                                .padding(8)
+                                .background(Color.primary.opacity(0.04))
+                                .cornerRadius(5)
+                        }
+                        Divider()
+                    }
+
+                    // Cookie summary
+                    DiagSection(title: "Cookie Store") {
+                        DiagRow("Total cookies",       "\(vm.diagCookieCount)")
+                        DiagRow("claude.ai cookies",   "\(vm.diagClaudeCookieCount)")
+                        DiagRow("All domains", vm.diagCookieDomains.isEmpty
+                            ? "(none — never fetched)"
+                            : vm.diagCookieDomains.joined(separator: ", "))
+                    }
+
+                    Divider()
+
+                    // Live cookie list
+                    DiagSection(title: "Live Cookie Names (WKWebsiteDataStore.default)") {
+                        if loadingCookies {
+                            ProgressView().scaleEffect(0.7)
+                        } else if liveAllCookies.isEmpty {
+                            Text("No cookies found")
+                                .font(.system(size: 11))
+                                .foregroundColor(.secondary)
+                        } else {
+                            let claudeCookies = liveAllCookies.filter {
+                                $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com")
+                            }
+                            let otherCookies = liveAllCookies.filter {
+                                !$0.domain.contains("claude.ai") && !$0.domain.contains("anthropic.com")
+                            }
+                            if !claudeCookies.isEmpty {
+                                Text("claude.ai / anthropic.com (\(claudeCookies.count))")
+                                    .font(.system(size: 10, weight: .medium))
+                                    .foregroundColor(.orange)
+                                ForEach(claudeCookies, id: \.name) { c in
+                                    Text("• \(c.domain)  \(c.name)")
+                                        .font(.system(size: 10, design: .monospaced))
+                                        .foregroundColor(.secondary)
+                                }
+                            }
+                            if !otherCookies.isEmpty {
+                                Text("Other domains (\(otherCookies.count))")
+                                    .font(.system(size: 10, weight: .medium))
+                                    .foregroundColor(.secondary)
+                                    .padding(.top, 4)
+                                ForEach(otherCookies.prefix(10), id: \.name) { c in
+                                    Text("• \(c.domain)  \(c.name)")
+                                        .font(.system(size: 10, design: .monospaced))
+                                        .foregroundColor(Color.secondary.opacity(0.6))
+                                }
+                                if otherCookies.count > 10 {
+                                    Text("… and \(otherCookies.count - 10) more")
+                                        .font(.system(size: 10))
+                                        .foregroundColor(Color.secondary.opacity(0.5))
+                                }
+                            }
+                        }
+
+                        Button("Refresh cookies") { loadLiveCookies() }
+                            .buttonStyle(.bordered)
+                            .controlSize(.small)
+                            .padding(.top, 4)
+                    }
+                }
+                .padding(14)
+            }
+        }
+        .frame(width: 480, height: 560)
+        .onAppear { loadLiveCookies() }
+    }
+
+    private func loadLiveCookies() {
+        loadingCookies = true
+        WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
+            DispatchQueue.main.async {
+                liveAllCookies = cookies.sorted { $0.domain < $1.domain }
+                loadingCookies = false
+            }
+        }
+    }
+
+    private var fullDiagText: String {
+        var lines: [String] = []
+        lines.append("=== ClaudeChecker Diagnostics ===")
+        lines.append("Version: \(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?") (\(Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "?"))")
+        lines.append("Signed in: \(vm.isSignedIn ? "Yes" : "No")")
+        lines.append("Email: \(vm.userEmail.isEmpty ? "(none)" : vm.userEmail)")
+        lines.append("Org ID: \(UserDefaults.standard.string(forKey: "claude_org_id") ?? "(none)")")
+        lines.append("lastActiveOrg: \(vm.diagLastActiveOrg.isEmpty ? "(not read)" : vm.diagLastActiveOrg)")
+        lines.append("Error: \(vm.errorMessage ?? "(none)")")
+        lines.append("")
+        lines.append("Last path: \(vm.diagLastPath)")
+        lines.append("Last status: \(vm.diagLastStatus)")
+        lines.append("Last error: \(vm.diagLastError)")
+        lines.append("Total cookies: \(vm.diagCookieCount)")
+        lines.append("Claude cookies: \(vm.diagClaudeCookieCount)")
+        lines.append("Domains: \(vm.diagCookieDomains.joined(separator: ", "))")
+        lines.append("")
+        lines.append("Bootstrap body:")
+        lines.append(vm.diagBootstrapBody)
+        lines.append("")
+        lines.append("Last API response:")
+        lines.append(vm.diagLastBody)
+        lines.append("")
+        lines.append("Live cookies:")
+        for c in liveAllCookies {
+            lines.append("  \(c.domain)  \(c.name)  httpOnly=\(c.isHTTPOnly)  secure=\(c.isSecure)")
+        }
+        return lines.joined(separator: "\n")
+    }
+}
+
+// MARK: - Helpers
+
+private struct DiagSection<Content: View>: View {
+    let title: String
+    @ViewBuilder let content: () -> Content
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            Text(title)
+                .font(.system(size: 11, weight: .semibold))
+                .foregroundColor(.secondary)
+                .textCase(.uppercase)
+            content()
+        }
+    }
+}
+
+private struct DiagRow: View {
+    let label: String
+    let value: String
+
+    init(_ label: String, _ value: String) {
+        self.label = label
+        self.value = value
+    }
+
+    var body: some View {
+        HStack(alignment: .top, spacing: 8) {
+            Text(label)
+                .font(.system(size: 11))
+                .foregroundColor(.secondary)
+                .frame(width: 100, alignment: .leading)
+            Text(value)
+                .font(.system(size: 11, design: .monospaced))
+                .foregroundColor(.primary)
+                .textSelection(.enabled)
+                .frame(maxWidth: .infinity, alignment: .leading)
+        }
+    }
+}

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.1.4-beta.4</string>
+    <string>1.3.0</string>
     <key>CFBundleVersion</key>
-    <string>44</string>
+    <string>74</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -4,7 +4,7 @@ import WebKit
 // MARK: - Login Web View
 
 struct LoginWebView: NSViewRepresentable {
-    let onAuthenticated: () -> Void
+    let onAuthenticated: (WKWebView) -> Void
 
     func makeNSView(context: Context) -> WKWebView {
         let config = WKWebViewConfiguration()
@@ -12,6 +12,13 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
+        context.coordinator.webView = webView
+
+        // KVO on url catches SPA pushState navigations that don't fire didFinish
+        context.coordinator.urlObservation = webView.observe(\.url, options: [.new]) { [weak coordinator = context.coordinator] wv, _ in
+            coordinator?.checkCurrentURL(wv.url?.absoluteString)
+        }
+
         webView.load(URLRequest(url: URL(string: "https://claude.ai/login")!))
         return webView
     }
@@ -23,31 +30,31 @@ struct LoginWebView: NSViewRepresentable {
     }
 
     class Coordinator: NSObject, WKNavigationDelegate {
-        let onAuthenticated: () -> Void
+        let onAuthenticated: (WKWebView) -> Void
+        weak var webView: WKWebView?
         var didAuthenticate = false
+        var urlObservation: NSKeyValueObservation?
 
-        init(onAuthenticated: @escaping () -> Void) {
+        init(onAuthenticated: @escaping (WKWebView) -> Void) {
             self.onAuthenticated = onAuthenticated
         }
 
-        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-            guard !didAuthenticate else { return }
-            // Don't fire on the login/auth pages themselves
-            if let url = webView.url?.absoluteString,
-               url.contains("/login") || url.contains("/auth") { return }
-
-            WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasSession = cookies.contains {
-                    $0.domain.contains("claude.ai") &&
-                    ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-                }
-                guard hasSession, !self.didAuthenticate else { return }
-                self.didAuthenticate = true
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                    self.onAuthenticated()
-                }
+        func checkCurrentURL(_ url: String?) {
+            guard !didAuthenticate, let url, let wv = webView else { return }
+            // Ignore navigations to external OAuth providers (Google, etc.) —
+            // only consider auth complete when we land back on claude.ai/anthropic.com
+            guard url.contains("claude.ai") || url.contains("anthropic.com") else { return }
+            if url.contains("/login") || url.contains("/auth") { return }
+            didAuthenticate = true
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
+                self.onAuthenticated(wv)
             }
         }
+
+        // Covers full cross-document navigations
+        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+            checkCurrentURL(webView.url?.absoluteString)
+        }
     }
 }
 
@@ -55,7 +62,7 @@ struct LoginWebView: NSViewRepresentable {
 
 struct LoginSheetView: View {
     @Binding var isPresented: Bool
-    let onDone: () -> Void
+    let onDone: (WKWebView) -> Void
     @State private var authenticated = false
 
     var body: some View {
@@ -65,12 +72,9 @@ struct LoginSheetView: View {
                     .font(.system(size: 13, weight: .semibold))
                 Spacer()
                 if authenticated {
-                    Button("Done") {
-                        isPresented = false
-                        onDone()
-                    }
-                    .buttonStyle(.borderedProminent)
-                    .controlSize(.small)
+                    Button("Done") { isPresented = false }
+                        .buttonStyle(.borderedProminent)
+                        .controlSize(.small)
                 } else {
                     Button("Cancel") { isPresented = false }
                         .buttonStyle(.bordered)
@@ -83,12 +87,13 @@ struct LoginSheetView: View {
 
             Divider()
 
-            LoginWebView {
+            LoginWebView { webView in
                 authenticated = true
-                // Auto-dismiss and refresh after brief delay
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.8) {
+                // Adopt the authenticated WebView immediately (before sheet tears it down),
+                // then auto-dismiss after a moment so the user sees confirmation.
+                onDone(webView)
+                DispatchQueue.main.asyncAfter(deadline: .now() + 1.2) {
                     isPresented = false
-                    onDone()
                 }
             }
         }

ClaudeChecker/UsageViewModel.swift

@@ -25,14 +25,28 @@ class UsageViewModel: ObservableObject {
         }
     }
 
-    private var cachedOrgId: String?
     private var burnHistoryStore: [String: [Double]] = [:]
     private let maxHistorySamples = 24
     private var previousPercents: [String: Double] = [:]
     private var firedThresholds: [String: Set<Int>] = [:]
 
+    // WebView used for JS-based API calls (avoids URLSession 403 fingerprinting issues)
+    private var apiWebView: WKWebView?
+    private var navWaiter: WKNavWaiter?
+
+    // Diagnostics
+    @Published var diagCookieCount: Int = 0
+    @Published var diagClaudeCookieCount: Int = 0
+    @Published var diagCookieDomains: [String] = []
+    @Published var diagLastPath: String = ""
+    @Published var diagLastStatus: Int = 0
+    @Published var diagLastBody: String = ""
+    @Published var diagLastError: String = ""
+    @Published var diagLastActiveOrg: String = ""   // lastActiveOrg cookie value from JS
+    @Published var diagBootstrapBody: String = ""   // raw bootstrap response (first 500 chars)
+    @Published var diagLastFetch: Date? = nil
+
     init() {
-        cachedOrgId = UserDefaults.standard.string(forKey: "claude_org_id")
         let saved = UserDefaults.standard.double(forKey: "refresh_interval")
         refreshInterval = saved > 0 ? saved : 60
         showInMenuBar = UserDefaults.standard.object(forKey: "show_in_menubar") as? Bool ?? true
@@ -40,16 +54,162 @@ class UsageViewModel: ObservableObject {
             burnHistoryStore = saved
         }
         loadPlaceholderData()
+        Task { await checkInitialSignInState() }
+    }
+
+    // Called after login: store the webview (already on claude.ai) so jsFetch can use it.
+    func adoptAndRefresh(_ loginWebView: WKWebView) async {
+        for _ in 0..<30 {
+            let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+            if cookies.contains(where: { $0.domain.contains("claude.ai") }) { break }
+            try? await Task.sleep(nanoseconds: 300_000_000)
+        }
+        if loginWebView.url?.host?.hasSuffix("claude.ai") == true {
+            apiWebView = loginWebView
+        } else {
+            await prepareApiWebView()
+        }
+        await refresh()
+    }
+
+    // Creates (or reuses) a background WKWebView navigated to claude.ai for JS fetch.
+    private func prepareApiWebView() async {
+        if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true { return }
+        let config = WKWebViewConfiguration()
+        config.websiteDataStore = WKWebsiteDataStore.default()
+        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
+        apiWebView = wv
+        await withCheckedContinuation { (cont: CheckedContinuation<Void, Never>) in
+            let waiter = WKNavWaiter { cont.resume() }
+            self.navWaiter = waiter
+            wv.navigationDelegate = waiter
+            wv.load(URLRequest(url: URL(string: "https://claude.ai/")!))
+        }
+        wv.navigationDelegate = nil
+        navWaiter = nil
+    }
+
+    // Runs a fetch() inside the live claude.ai WebView — same browser context as the frontend,
+    // so no CORS/fingerprinting issues that URLSession hits.
+    private func jsFetch(_ path: String) async throws -> (Int, String) {
+        guard let wv = apiWebView else { throw AppError.networkError }
+        let js = """
+        const r = await fetch('\(path)', {
+            credentials: 'include',
+            headers: { 'Accept': 'application/json' }
+        });
+        const body = await r.text();
+        return {status: r.status, body: body};
+        """
+        let result: Any? = try await withCheckedThrowingContinuation { cont in
+            wv.callAsyncJavaScript(js, arguments: [:], in: nil, in: .defaultClient) { res in
+                switch res {
+                case .success(let val): cont.resume(returning: val)
+                case .failure(let err): cont.resume(throwing: err)
+                }
+            }
+        }
+        guard let dict = result as? [String: Any],
+              let status = dict["status"] as? Int,
+              let body = dict["body"] as? String else {
+            throw AppError.networkError
+        }
+        diagLastPath = path
+        diagLastFetch = Date()
+        diagLastStatus = status
+        diagLastBody = String(body.prefix(500))
+        diagLastError = status != 200 ? "JS HTTP \(status)" : ""
+        return (status, body)
+    }
+
+    // Use JS fetch when apiWebView is ready on claude.ai, otherwise fall back to URLSession.
+    private func apiFetch(_ path: String) async throws -> (Int, String) {
+        if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true {
+            return try await jsFetch(path)
+        }
+        return try await urlFetch(path)
+    }
+
+    // Fetches an API path via URLSession with browser-like headers.
+    // Claude.ai's API requires sec-fetch-*, Origin, Referer, and a browser User-Agent
+    // to avoid 401 — matching how the Windows version (HttpClient) handles this.
+    private func urlFetch(_ path: String) async throws -> (Int, String) {
+        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+        let claudeCookies = cookies.filter {
+            $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com")
+        }
+
+        // Record cookie diagnostics
+        diagCookieCount = cookies.count
+        diagClaudeCookieCount = claudeCookies.count
+        diagCookieDomains = Array(Set(cookies.map { $0.domain })).sorted()
+        diagLastPath = path
+        diagLastFetch = Date()
+        diagLastError = ""
+
+        guard !claudeCookies.isEmpty else {
+            let msg = "No claude.ai cookies (\(cookies.count) total in store)"
+            diagLastError = msg
+            throw AppError.detail(msg)
+        }
+
+        var req = URLRequest(url: URL(string: "https://claude.ai\(path)")!)
+        req.httpShouldHandleCookies = false
+        // Build cookie header manually (same format as Windows HttpClient) to avoid
+        // any encoding differences from HTTPCookie.requestHeaderFields(with:)
+        let cookieHeader = claudeCookies.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
+        req.setValue(cookieHeader, forHTTPHeaderField: "Cookie")
+        req.setValue("application/json", forHTTPHeaderField: "Accept")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
+        req.setValue("empty",       forHTTPHeaderField: "sec-fetch-dest")
+        req.setValue("cors",        forHTTPHeaderField: "sec-fetch-mode")
+        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
+        req.setValue(
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+            forHTTPHeaderField: "User-Agent")
+        req.setValue(
+            "\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"",
+            forHTTPHeaderField: "sec-ch-ua")
+        req.setValue("?0",        forHTTPHeaderField: "sec-ch-ua-mobile")
+        req.setValue("\"macOS\"", forHTTPHeaderField: "sec-ch-ua-platform")
+        req.setValue("web",       forHTTPHeaderField: "anthropic-client-platform")
+
+        let session = URLSession(configuration: .ephemeral)
+        do {
+            let (data, response) = try await session.data(for: req)
+            guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
+            let body = String(data: data, encoding: .utf8) ?? ""
+            diagLastStatus = http.statusCode
+            diagLastBody   = String(body.prefix(500))
+            if http.statusCode != 200 {
+                diagLastError = "HTTP \(http.statusCode)"
+            }
+            return (http.statusCode, body)
+        } catch let e as AppError { throw e }
+        catch {
+            let msg = error.localizedDescription
+            diagLastError = msg
+            throw AppError.detail(msg)
+        }
+    }
+
+    private func checkInitialSignInState() async {
+        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+        guard cookies.contains(where: { $0.domain.contains("claude.ai") }) else { return }
+        isSignedIn = true
+        await prepareApiWebView()
+        await refresh()
     }
 
     func signOut() async {
         let store = WKWebsiteDataStore.default()
         let types = WKWebsiteDataStore.allWebsiteDataTypes()
         let records = await store.dataRecords(ofTypes: types)
-        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") }
+        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
-        cachedOrgId = nil
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
+        apiWebView = nil
         isSignedIn = false
         isNotAuthenticated = true
         lastUpdated = nil
@@ -67,29 +227,49 @@ class UsageViewModel: ObservableObject {
         defer { isLoading = false }
 
         do {
-            // Fetch org ID dynamically if not cached
-            if cachedOrgId == nil {
-                let (fetchedOrgId, fetchedPlan) = try await fetchOrgId()
-                cachedOrgId = fetchedOrgId
-                if let id = cachedOrgId {
-                    UserDefaults.standard.set(id, forKey: "claude_org_id")
+            // Read lastActiveOrg cookie from JS — most reliable org source since it's
+            // set by the claude.ai frontend to whichever org is currently active.
+            var cookieOrgId: String? = nil
+            if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true {
+                let js = """
+                return document.cookie.split(';')
+                    .map(c => c.trim().split('='))
+                    .filter(p => p[0] === 'lastActiveOrg')
+                    .map(p => p.slice(1).join('='))[0] || null;
+                """
+                let raw: Any? = try? await withCheckedThrowingContinuation { cont in
+                    wv.callAsyncJavaScript(js, arguments: [:], in: nil, in: .defaultClient) { r in
+                        cont.resume(returning: (try? r.get()) ?? nil)
+                    }
+                }
+                if let v = raw as? String, !v.isEmpty {
+                    cookieOrgId = v
+                    diagLastActiveOrg = v
                 }
-                if let plan = fetchedPlan { planLabel = plan }
             }
-            guard let orgId = cachedOrgId else {
+
+            let (fetchedOrgId, fetchedEmail, fetchedPlan) = try await fetchBootstrap(preferredOrgId: cookieOrgId)
+
+            let orgId: String
+            if let id = cookieOrgId ?? fetchedOrgId {
+                UserDefaults.standard.set(id, forKey: "claude_org_id")
+                orgId = id
+            } else if let cached = UserDefaults.standard.string(forKey: "claude_org_id") {
+                orgId = cached
+            } else {
                 throw AppError.notAuthenticated
             }
 
+            if let email = fetchedEmail { userEmail = email }
+            if let plan = fetchedPlan   { planLabel = plan }
+
             async let usageFetch   = fetchUsage(orgId: orgId)
             async let prepaidFetch = fetchPrepaidCredits(orgId: orgId)
             async let overageFetch = fetchOverageSpendLimit(orgId: orgId)
-            async let emailFetch   = fetchUserEmail()
-            let (usage, prepaid, overage, emailResult) = try await (usageFetch, prepaidFetch, overageFetch, emailFetch)
-            if let email = emailResult.email { userEmail = email }
-            if let plan = emailResult.planLabel { planLabel = plan }
+            let (usage, prepaid, overage) = try await (usageFetch, prepaidFetch, overageFetch)
             limits = buildLimits(from: usage)
-            extraUsage = usage.extraUsage
-            prepaidCredits = prepaid
+            extraUsage        = usage.extraUsage
+            prepaidCredits    = prepaid
             overageSpendLimit = overage
             lastUpdated = Date()
             isSignedIn = true
@@ -106,6 +286,7 @@ class UsageViewModel: ObservableObject {
             checkLimitNotifications(for: limits)
         } catch AppError.notAuthenticated {
             isNotAuthenticated = true
+            isSignedIn = false
             errorMessage = "Not signed in"
         } catch let error as DecodingError {
             switch error {
@@ -123,110 +304,76 @@ class UsageViewModel: ObservableObject {
         }
     }
 
-    // MARK: - Fetch org ID from bootstrap
+    // MARK: - Bootstrap
 
-    private func fetchOrgId() async throws -> (orgId: String?, planLabel: String?) {
-        let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
-        if claudeCookies.isEmpty { throw AppError.notAuthenticated }
-        if let header = HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"] {
-            req.setValue(header, forHTTPHeaderField: "Cookie")
+    private func fetchBootstrap(preferredOrgId: String? = nil) async throws -> (orgId: String?, email: String?, planLabel: String?) {
+        let (status, body) = try await apiFetch("/api/bootstrap")
+        if status == 401 || status == 403 {
+            throw AppError.detail("HTTP \(status) — \(body.prefix(120))")
         }
-        let (data, response) = try await URLSession.shared.data(for: req)
-        guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
-        if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
-        guard http.statusCode == 200 else { throw AppError.networkError }
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else { return (nil, nil) }
-
-        func planFromOrg(_ org: [String: Any]?) -> String? {
-            guard let caps = org?["capabilities"] as? [String] else { return nil }
-            guard let cap = caps.first(where: { $0.hasPrefix("claude_") }) else { return nil }
-            let name = String(cap.dropFirst("claude_".count))
-            return name.prefix(1).uppercased() + name.dropFirst().lowercased()
+        guard status == 200 else { throw AppError.detail("HTTP \(status): \(body.prefix(80))") }
+        guard body.trimmingCharacters(in: .whitespacesAndNewlines).hasPrefix("{") else {
+            throw AppError.detail("Non-JSON response (HTML?): \(body.prefix(80))")
+        }
+        diagBootstrapBody = String(body.prefix(500))
+        guard let data = body.data(using: .utf8),
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            return (nil, nil, nil)
         }
 
-        // account.memberships[0].organization.uuid
-        if let account = json["account"] as? [String: Any],
-           let memberships = account["memberships"] as? [[String: Any]],
-           let org = memberships.first?["organization"] as? [String: Any],
-           let uuid = org["uuid"] as? String {
-            return (uuid, planFromOrg(org))
+        let account  = json["account"] as? [String: Any]
+        let memberships = (account?["memberships"] ?? json["memberships"]) as? [[String: Any]]
+        let allOrgs = memberships?.compactMap { $0["organization"] as? [String: Any] } ?? []
+        let firstOrg = allOrgs.first
+
+        var orgId: String? = firstOrg?["uuid"] as? String
+        if orgId == nil {
+            orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
-        // root memberships (older API shape)
-        if let memberships = json["memberships"] as? [[String: Any]],
-           let org = memberships.first?["organization"] as? [String: Any],
-           let uuid = org["uuid"] as? String {
-            return (uuid, planFromOrg(org))
+        if orgId == nil {
+            if let (orgsStatus, orgsBody) = try? await apiFetch("/api/organizations"),
+               orgsStatus == 200,
+               let orgsData = orgsBody.data(using: .utf8),
+               let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
+                orgId = orgs.first?["uuid"] as? String
+            }
         }
-        // root organizations array
-        if let orgs = json["organizations"] as? [[String: Any]],
-           let uuid = orgs.first?["uuid"] as? String {
-            return (uuid, planFromOrg(orgs.first))
-        }
-        return (nil, nil)
-    }
 
-    // MARK: - Fetch usage
+        let email = account?["email_address"] as? String
 
-    private func claudeCookieHeader() async -> String? {
-        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
-        return HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"]
-    }
-
-    private func fetchUsage(orgId: String) async throws -> UsageResponse {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
-        let (data, response) = try await URLSession.shared.data(for: req)
-        guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
-        if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
-        guard http.statusCode == 200 else { throw AppError.networkError }
-        return try JSONDecoder().decode(UsageResponse.self, from: data)
-    }
-
-    private func fetchUserEmail() async throws -> (email: String?, planLabel: String?) {
-        let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
-        let (data, response) = try await URLSession.shared.data(for: req)
-        guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return (nil, nil) }
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-              let account = json["account"] as? [String: Any] else { return (nil, nil) }
-        let email = account["email_address"] as? String
+        // Read capabilities from the preferred (active) org, falling back to first org.
+        let capOrg = preferredOrgId.flatMap { id in allOrgs.first(where: { $0["uuid"] as? String == id }) } ?? firstOrg
         var planLabel: String? = nil
-        if let memberships = account["memberships"] as? [[String: Any]],
-           let org = memberships.first?["organization"] as? [String: Any],
-           let caps = org["capabilities"] as? [String],
+        if let caps = capOrg?["capabilities"] as? [String],
            let cap = caps.first(where: { $0.hasPrefix("claude_") }) {
             let name = String(cap.dropFirst("claude_".count))
             planLabel = name.prefix(1).uppercased() + name.dropFirst().lowercased()
         }
-        return (email, planLabel)
+
+        return (orgId, email, planLabel)
+    }
+
+    // MARK: - Fetch usage
+
+    private func fetchUsage(orgId: String) async throws -> UsageResponse {
+        let (status, body) = try await apiFetch("/api/organizations/\(orgId)/usage")
+        if status == 401 || status == 403 { throw AppError.detail("usage \(status): \(body.prefix(200))") }
+        guard status == 200 else { throw AppError.networkError }
+        guard let data = body.data(using: .utf8) else { throw AppError.networkError }
+        return try JSONDecoder().decode(UsageResponse.self, from: data)
     }
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
-        let (data, response) = try await URLSession.shared.data(for: req)
-        guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
+        guard let (status, body) = try? await apiFetch("/api/organizations/\(orgId)/prepaid/credits"),
+              status == 200,
+              let data = body.data(using: .utf8) else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
     }
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
-        let (data, response) = try await URLSession.shared.data(for: req)
-        guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
+        guard let (status, body) = try? await apiFetch("/api/organizations/\(orgId)/overage_spend_limit"),
+              status == 200,
+              let data = body.data(using: .utf8) else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)
     }
 
@@ -343,13 +490,27 @@ class UsageViewModel: ObservableObject {
     }
 }
 
+
+// Navigation delegate that resolves a continuation on first finish/error (idempotent).
+private class WKNavWaiter: NSObject, WKNavigationDelegate {
+    private var done = false
+    private let onDone: () -> Void
+    init(_ onDone: @escaping () -> Void) { self.onDone = onDone }
+    private func finish() { guard !done else { return }; done = true; onDone() }
+    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { finish() }
+    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) { finish() }
+    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) { finish() }
+}
+
 enum AppError: LocalizedError {
     case notAuthenticated
     case networkError
+    case detail(String)
     var errorDescription: String? {
         switch self {
-        case .notAuthenticated: return "Not signed into claude.ai — open claude.ai in your browser first."
-        case .networkError:     return "Network error fetching usage data."
+        case .notAuthenticated:   return "Not signed into claude.ai — open claude.ai in your browser first."
+        case .networkError:       return "Network error fetching usage data."
+        case .detail(let msg):    return msg
         }
     }
 }

README.md

@@ -8,9 +8,9 @@
 
 [![macOS](https://img.shields.io/badge/macOS-13.0+-000000?style=flat&logo=apple&logoColor=white)](https://www.apple.com/macos/)
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
-[![Version](https://img.shields.io/badge/version-1.1.3-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
+[![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.1.4--beta.2-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.1.4-beta.2) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.25-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.25) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,4 +1,12 @@
-## What's new in v1.1.4-beta.4
+## What's new in v1.3.0
 
-### Bug fix
-- Plan name now updates correctly on every refresh (was only set on first launch)
+### Multi-org support
+- App now uses the `lastActiveOrg` cookie to identify which organisation is active, matching exactly what the claude.ai frontend does. Previously the app always picked the first org returned by bootstrap, which is the personal "Individual Org" for users with multiple organisations — causing persistent 403 errors on all usage endpoints.
+- Plan label (e.g. **Max**, **Pro**, **Team**) now reads capabilities from the active org, not the first membership.
+
+### Reliable API access via WebView
+- All API calls now run through `WKWebView.callAsyncJavaScript`, making real same-origin browser requests instead of URLSession. Claude.ai's org-specific endpoints reject native HTTP clients (403) even with correct cookies and headers; running inside the browser context passes all server-side checks.
+- A background WebView is created at startup when session cookies are detected, so usage data loads immediately without requiring a manual sign-in.
+
+### Diagnostics
+- New **Diagnostics** panel in Settings shows cookie store, last API request/response, bootstrap body, and the `lastActiveOrg` cookie value — making it easy to report issues.

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.4-beta.2",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.1.4-beta.2/ClaudeChecker.zip",
-  "notes": "## What's new in v1.1.4-beta.2\n\n### Improvements\n- Plan name (e.g. Pro, Max) is now read from the API instead of being hardcoded"
+  "version": "1.2.1-beta.25",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.25/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1-beta.18\n\n### Bug fixes\n- Replaced callAsyncJavaScript fetch approach with WebKit navigation: instead of running `fetch()` in the page's JS context (which was returning 401 because it bypasses the SPA's auth interceptors), each API call now navigates the WebView to the API URL directly. WebKit sends full browser headers and cookies automatically at the HTTP layer, the same way a real browser navigation works. This is more reliable regardless of what server-side auth mechanism claude.ai uses.\n- API calls are now sequential to share a single WebView for all navigations\n- Added redirect detection: if WebKit follows a 302 to /login, the response is treated as an auth failure rather than returning HTML to the JSON parser\n\n## What's new in v1.2.1-beta.17\n\n### Bug fixes\n- Fixed \"Not signed in\" after login by adopting the login WebView directly for API calls\n- Added diagnostic error messages for JS errors and unexpected responses\n\n## What's new in v1.2.1\n\n### Bug fixes\n- Fixed WebKit suspending the background WKWebView: anchored in a transparent 1×1 NSWindow\n- Fixed login window auto-closing before sign-in completes\n- Added /api/organizations as a final fallback for org ID resolution\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh"
 }

version-windows-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.1-beta.35",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/win-v0.0.1-beta.35/ClaudeChecker-Windows.zip",
-  "notes": "## What's new in beta.10\r\n\r\n### Bug fixes\r\n- Limits now update correctly on each refresh cycle\r\n- Session expiry is detected and prompts re-authentication instead of silently showing stale data\r\n- Plan name (e.g. Pro, Max) is now read from the API instead of being hardcoded"
+  "version": "0.0.1-beta.49",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/win-v0.0.1-beta.49/ClaudeChecker-Windows.zip",
+  "notes": "## What's new in beta.36\r\n\r\n### Bug fixes\r\n- Settings no longer incorrectly shows \"Not signed in\" when limits are working\r\n- Session Diary now shows correctly after the first successful refresh\r\n- Extra Usage Credits section now restored from cache on startup\r\n- Plan name, overage, and prepaid credits are now cached and shown immediately on launch\r\n- App now loads cached state instantly on startup before the background refresh completes"
 }

version.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.3",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.1.3/ClaudeChecker.zip",
-  "notes": "## What's new in v1.1.3\n\n### UI polish\n- Limit headers now read \"5 Hour Limit\" and \"7 Day Limit\"\n- Tapping anywhere on the blue update banner opens the update window\n\n### Session Diary fix\n- Burn history is persisted across app launches — the sparkline populates immediately on first open instead of requiring a manual refresh\n\n### Window sizing fixes\n- The popover now resizes correctly when switching between the main view and settings\n- Background colour no longer shows through during the resize animation"
+  "version": "1.2.0",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.0/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.0\n\n### Bug fixes\n- App now works for all users — org ID is fetched dynamically from the API instead of being hardcoded\n- Plan name (e.g. Pro, Max) now updates correctly on every refresh\n\n### Improvements\n- Plan name is read from the API rather than hardcoded\n- Bootstrap API call consolidated — org ID, email, and plan name fetched in a single request per refresh\n- Main panel no longer scrolls — popover auto-sizes to fit content\n- Session Diary card redesigned — sample count and avg burn rate shown left/right above the sparkline, Claude header removed"
 }