beta.17: adopt login WebView for API calls, add diagnostics

ClaudeChecker/ContentView.swift

@@ -116,8 +116,8 @@ struct ContentView: View {
             showUpdateSheet = true
         }
         .sheet(isPresented: $showLogin) {
-            LoginSheetView(isPresented: $showLogin) {
-                Task { await vm.reloadAPIWebViewAndRefresh() }
+            LoginSheetView(isPresented: $showLogin) { webView in
+                Task { await vm.adoptAndRefresh(webView) }
             }
         }
         .sheet(isPresented: $showUpdateSheet) {

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.12</string>
+    <string>1.2.1-beta.17</string>
     <key>CFBundleVersion</key>
-    <string>60</string>
+    <string>65</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -4,7 +4,7 @@ import WebKit
 // MARK: - Login Web View
 
 struct LoginWebView: NSViewRepresentable {
-    let onAuthenticated: () -> Void
+    let onAuthenticated: (WKWebView) -> Void
 
     func makeNSView(context: Context) -> WKWebView {
         let config = WKWebViewConfiguration()
@@ -12,6 +12,7 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
+        context.coordinator.webView = webView
 
         // KVO on url catches SPA pushState navigations that don't fire didFinish
         context.coordinator.urlObservation = webView.observe(\.url, options: [.new]) { [weak coordinator = context.coordinator] wv, _ in
@@ -29,20 +30,24 @@ struct LoginWebView: NSViewRepresentable {
     }
 
     class Coordinator: NSObject, WKNavigationDelegate {
-        let onAuthenticated: () -> Void
+        let onAuthenticated: (WKWebView) -> Void
+        weak var webView: WKWebView?
         var didAuthenticate = false
         var urlObservation: NSKeyValueObservation?
 
-        init(onAuthenticated: @escaping () -> Void) {
+        init(onAuthenticated: @escaping (WKWebView) -> Void) {
             self.onAuthenticated = onAuthenticated
         }
 
         func checkCurrentURL(_ url: String?) {
-            guard !didAuthenticate, let url else { return }
+            guard !didAuthenticate, let url, let wv = webView else { return }
+            // Ignore navigations to external OAuth providers (Google, etc.) —
+            // only consider auth complete when we land back on claude.ai/anthropic.com
+            guard url.contains("claude.ai") || url.contains("anthropic.com") else { return }
             if url.contains("/login") || url.contains("/auth") { return }
             didAuthenticate = true
             DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                self.onAuthenticated()
+                self.onAuthenticated(wv)
             }
         }
 
@@ -57,7 +62,7 @@ struct LoginWebView: NSViewRepresentable {
 
 struct LoginSheetView: View {
     @Binding var isPresented: Bool
-    let onDone: () -> Void
+    let onDone: (WKWebView) -> Void
     @State private var authenticated = false
 
     var body: some View {
@@ -67,12 +72,9 @@ struct LoginSheetView: View {
                     .font(.system(size: 13, weight: .semibold))
                 Spacer()
                 if authenticated {
-                    Button("Done") {
-                        isPresented = false
-                        onDone()
-                    }
-                    .buttonStyle(.borderedProminent)
-                    .controlSize(.small)
+                    Button("Done") { isPresented = false }
+                        .buttonStyle(.borderedProminent)
+                        .controlSize(.small)
                 } else {
                     Button("Cancel") { isPresented = false }
                         .buttonStyle(.bordered)
@@ -85,12 +87,13 @@ struct LoginSheetView: View {
 
             Divider()
 
-            LoginWebView {
+            LoginWebView { webView in
                 authenticated = true
-                // Auto-dismiss and refresh after brief delay
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.8) {
+                // Adopt the authenticated WebView immediately (before sheet tears it down),
+                // then auto-dismiss after a moment so the user sees confirmation.
+                onDone(webView)
+                DispatchQueue.main.asyncAfter(deadline: .now() + 1.2) {
                     isPresented = false
-                    onDone()
                 }
             }
         }

ClaudeChecker/UsageViewModel.swift

@@ -30,9 +30,14 @@ class UsageViewModel: ObservableObject {
     private var previousPercents: [String: Double] = [:]
     private var firedThresholds: [String: Set<Int>] = [:]
 
-    // Background WKWebView used for all API calls — runs fetch() in the page's auth context
+    // Background WKWebView for API calls via callAsyncJavaScript.
+    // Hosted in a hidden NSWindow — without a window WebKit suspends the WebView
+    // and JS execution stops working, breaking callAsyncJavaScript.
     private var apiWebView: WKWebView?
     private var apiDelegate: APIWebViewDelegate?
+    private var apiWindow: NSWindow?
+    private var apiWebViewLoaded = false
+    private var apiReadyContinuations: [CheckedContinuation<Void, Never>] = []
 
     init() {
         let saved = UserDefaults.standard.double(forKey: "refresh_interval")
@@ -51,39 +56,82 @@ class UsageViewModel: ObservableObject {
     private func setupAPIWebView() {
         let config = WKWebViewConfiguration()
         config.websiteDataStore = WKWebsiteDataStore.default()
-        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
+        let wv = WKWebView(frame: NSRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
         let del = APIWebViewDelegate()
+        del.onNavigationEnd = { [weak self] in
+            guard let self else { return }
+            self.apiWebViewLoaded = true
+            self.resumeAPIReadyContinuations()
+        }
         wv.navigationDelegate = del
         apiWebView = wv
         apiDelegate = del
+
+        // A WKWebView with no window is suspended by macOS — JS execution won't run.
+        // Hosting it in a 1×1 transparent window keeps WebKit's process alive.
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 1, height: 1),
+            styleMask: .borderless,
+            backing: .buffered,
+            defer: false)
+        window.alphaValue = 0.0
+        window.ignoresMouseEvents = true
+        window.isReleasedWhenClosed = false
+        window.collectionBehavior = [.canJoinAllSpaces, .stationary, .ignoresCycle]
+        window.contentView?.addSubview(wv)
+        window.orderFrontRegardless()
+        apiWindow = window
+
         wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
     }
 
-    // Called after login: reloads the background WebView to pick up the new session, then refreshes.
-    func reloadAPIWebViewAndRefresh() async {
-        guard let wv = apiWebView, let del = apiDelegate else {
-            await refresh()
-            return
+    private func resumeAPIReadyContinuations() {
+        let pending = apiReadyContinuations
+        apiReadyContinuations.removeAll()
+        pending.forEach { $0.resume() }
+    }
+
+    private func waitForAPIWebViewReady() async {
+        guard !apiWebViewLoaded else { return }
+        await withCheckedContinuation { cont in
+            apiReadyContinuations.append(cont)
         }
-        await withCheckedContinuation { (cont: CheckedContinuation<Void, Never>) in
-            del.onDidFinish = { cont.resume() }
-            wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
-        }
-        // Brief pause for the page's JS auth state to settle after navigation
-        try? await Task.sleep(nanoseconds: 500_000_000)
+    }
+
+    // Called after login: adopts the proven-authenticated login WebView for all API calls.
+    // This avoids the background WebView potentially missing auth tokens that only exist
+    // in the login WebView's JS context (localStorage, Service Workers, etc.).
+    func adoptAndRefresh(_ loginWebView: WKWebView) async {
+        loginWebView.removeFromSuperview()
+        loginWebView.frame = NSRect(x: 0, y: 0, width: 1, height: 1)
+        apiWindow?.contentView?.addSubview(loginWebView)
+        apiWebView = loginWebView
+        apiWebViewLoaded = true
+        resumeAPIReadyContinuations()
+        try? await Task.sleep(nanoseconds: 400_000_000)
         await refresh()
     }
 
-    // Runs a fetch() call inside the background WebView's page context (same-origin, credentials included).
+    // Executes a same-origin fetch inside the background WebView's page context.
+    // This includes all credentials the page has (cookies, localStorage tokens, etc.),
+    // which URLSession cannot access — hence using callAsyncJavaScript instead.
     private func webViewFetch(_ path: String) async throws -> (statusCode: Int, body: String) {
-        guard let wv = apiWebView else { throw AppError.networkError }
+        guard let wv = apiWebView else { throw AppError.detail("no webview") }
+        await waitForAPIWebViewReady()
         let js = "const r = await fetch(path, {credentials:'include'}); return {s: r.status, b: await r.text()};"
-        let result = try await wv.callAsyncJavaScript(
-            js, arguments: ["path": path], in: nil, in: .page)
-        guard let d = result as? [String: Any],
-              let s = (d["s"] as? NSNumber)?.intValue,
-              let b = d["b"] as? String else { throw AppError.networkError }
-        return (s, b)
+        do {
+            let result = try await wv.callAsyncJavaScript(js, arguments: ["path": path], in: nil, in: .page)
+            guard let d = result as? [String: Any],
+                  let s = (d["s"] as? NSNumber)?.intValue,
+                  let b = d["b"] as? String else {
+                throw AppError.detail("bad result: \(String(describing: result).prefix(120))")
+            }
+            return (s, b)
+        } catch let e as AppError { throw e }
+        catch {
+            let loc = wv.url?.absoluteString ?? "?"
+            throw AppError.detail("JS err @ \(loc): \(error.localizedDescription.prefix(100))")
+        }
     }
 
     private func checkInitialSignInState() async {
@@ -106,7 +154,7 @@ class UsageViewModel: ObservableObject {
         extraUsage = nil
         prepaidCredits = nil
         overageSpendLimit = nil
-        // Reload background WebView to clear its session too
+        apiWebViewLoaded = false
         apiWebView?.load(URLRequest(url: URL(string: "https://claude.ai")!))
     }
 
@@ -173,7 +221,7 @@ class UsageViewModel: ObservableObject {
         }
     }
 
-    // MARK: - Bootstrap (org ID + email + plan label in one call)
+    // MARK: - Bootstrap
 
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
         let (status, body) = try await webViewFetch("/api/bootstrap")
@@ -353,26 +401,28 @@ class UsageViewModel: ObservableObject {
 // MARK: - API WebView Delegate
 
 private class APIWebViewDelegate: NSObject, WKNavigationDelegate {
-    var onDidFinish: (() -> Void)?
+    var onNavigationEnd: (() -> Void)?
 
     func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-        let cb = onDidFinish; onDidFinish = nil; cb?()
+        onNavigationEnd?()
     }
     func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
-        let cb = onDidFinish; onDidFinish = nil; cb?()
+        onNavigationEnd?()
     }
     func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-        let cb = onDidFinish; onDidFinish = nil; cb?()
+        onNavigationEnd?()
     }
 }
 
 enum AppError: LocalizedError {
     case notAuthenticated
     case networkError
+    case detail(String)
     var errorDescription: String? {
         switch self {
-        case .notAuthenticated: return "Not signed into claude.ai — open claude.ai in your browser first."
-        case .networkError:     return "Network error fetching usage data."
+        case .notAuthenticated:   return "Not signed into claude.ai — open claude.ai in your browser first."
+        case .networkError:       return "Network error fetching usage data."
+        case .detail(let msg):    return msg
         }
     }
 }

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.11-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.11) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.16-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.16) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,12 +1,14 @@
+## What's new in v1.2.1-beta.17
+
+### Bug fixes
+- Fixed "Not signed in" after login by adopting the login WebView directly for API calls — the login WebView is proven-authenticated (user just completed sign-in in it), so reusing it eliminates the problem where a separately-loaded background WebView might not have the full auth context (localStorage tokens, Service Worker state) that claude.ai requires
+- Added diagnostic error messages: JS errors, WebView URL, and unexpected response types are now surfaced in the error banner to aid future debugging
+
 ## What's new in v1.2.1
 
 ### Bug fixes
-- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, localStorage tokens, etc.) are included automatically
-- Fixed "Not signed in" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh
-- Fixed "Not signed in" showing incorrectly on launch when the session was already active
-- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
-- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
-- Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
-- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails
-- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish
+- Fixed the root cause of "Not signed in" after being clearly signed in: claude.ai's auth requires credentials beyond plain HTTP cookies (localStorage tokens, Service Worker state, etc.) that URLSession cannot access. All API calls now run via callAsyncJavaScript inside a background WKWebView, using the same fetch path the page itself uses — credentials are included automatically.
+- Fixed WebKit suspending the background WKWebView: a WKWebView with no window is throttled/suspended by macOS, preventing JS execution. The background WebView is now anchored in a transparent 1×1 NSWindow, keeping it active.
+- Fixed login window auto-closing before sign-in completes — login window loads `/login` and only detects auth when back on claude.ai (not on OAuth provider redirects)
+- Added `/api/organizations` as a final fallback for org ID resolution
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.11",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.11/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails\n- Rewrote login detection to use the WebView's own fetch call instead of inspecting cookie domains — correctly detects auth regardless of which domain the session token is stored on\n- Fixed API requests not including session cookies — now sends all cookies from the app's WebView store rather than filtering by domain"
+  "version": "1.2.1-beta.16",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.16/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed the root cause of \"Not signed in\" after being clearly signed in: claude.ai's auth requires credentials beyond plain HTTP cookies (localStorage tokens, Service Worker state, etc.) that URLSession cannot access. All API calls now run via callAsyncJavaScript inside a background WKWebView, using the same fetch path the page itself uses — credentials are included automatically.\n- Fixed WebKit suspending the background WKWebView: a WKWebView with no window is throttled/suspended by macOS, preventing JS execution. The background WebView is now anchored in a transparent 1×1 NSWindow, keeping it active.\n- Fixed login window auto-closing before sign-in completes — login window loads `/login` and only detects auth when back on claude.ai (not on OAuth provider redirects)\n- Added `/api/organizations` as a final fallback for org ID resolution\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh"
 }