Bump version to 1.3.3-beta.1 (build 77)

Every launch now loads claude.ai in a real (off-screen, invisible) NSWindow so
WebKit doesn't throttle JS execution. The nav delegate fires adoptPrimerWebView
once the page loads, replacing the old 1.5 s sleep-then-refresh approach.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -18,12 +18,18 @@ Steps to reproduce the behaviour:
 **Expected behaviour**
 What you expected to happen.
 
+**Diagnostics**
+Open the app → Settings → Diagnostics, then click "Copy All" and paste the output here.
+This shows the error, request state, and cookie info. Email and org IDs are automatically redacted when you click Copy All.
+
 **Screenshots**
 If applicable, add screenshots to help explain your problem.
 
 **Environment**
-- macOS version: [e.g. Sequoia 15.4]
-- ClaudeChecker version: [e.g. 1.1.3]
+- Platform: [macOS / Windows]
+- macOS version: [e.g. Sequoia 15.4] *(if applicable)*
+- Windows version: [e.g. Windows 11 24H2] *(if applicable)*
+- ClaudeChecker version: [e.g. 1.3.2]
 - Claude plan: [e.g. Pro, Max]
 
 **Additional context**

ClaudeChecker.xcodeproj/project.pbxproj

@@ -10,6 +10,13 @@
 	<string>77</string>
 	<key>objects</key>
 	<dict>
+		<key>AAAAAA009</key>
+		<dict>
+			<key>isa</key>
+			<string>PBXBuildFile</string>
+			<key>fileRef</key>
+			<string>AAAAAA109</string>
+		</dict>
 		<key>AAAAAA007</key>
 		<dict>
 			<key>isa</key>
@@ -88,6 +95,17 @@
 			<key>sourceTree</key>
 			<string>&lt;group&gt;</string>
 		</dict>
+		<key>AAAAAA109</key>
+		<dict>
+			<key>isa</key>
+			<string>PBXFileReference</string>
+			<key>lastKnownFileType</key>
+			<string>sourcecode.swift</string>
+			<key>path</key>
+			<string>DiagnosticsView.swift</string>
+			<key>sourceTree</key>
+			<string>&lt;group&gt;</string>
+		</dict>
 		<key>AAAAAA101</key>
 		<dict>
 			<key>isa</key>
@@ -179,6 +197,7 @@
 				<string>AAAAAA106</string>
 				<string>AAAAAA107</string>
 				<string>AAAAAA108</string>
+				<string>AAAAAA109</string>
 			</array>
 			<key>path</key>
 			<string>ClaudeChecker</string>
@@ -292,6 +311,7 @@
 				<string>AAAAAA005</string>
 				<string>AAAAAA007</string>
 				<string>AAAAAA008</string>
+				<string>AAAAAA009</string>
 			</array>
 			<key>runOnlyForDeploymentPostprocessing</key>
 			<string>0</string>

ClaudeChecker/ClaudeCheckerApp.swift

@@ -18,16 +18,43 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     var updateManager = UpdateManager()
     var refreshTimer: Timer?
     var cookiePrimerView: WKWebView?
+    var cookiePrimerWindow: NSWindow?
+    var primerNavDelegate: PrimerNavDelegate?
     var cancellables = Set<AnyCancellable>()
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
 
-        // Hidden WKWebView to prime the shared cookie store
+        // Background WebView that loads claude.ai on every launch.
+        // Anchored in a real (off-screen, invisible) NSWindow so WebKit doesn't throttle
+        // JS execution. When the page finishes loading the nav delegate calls
+        // adoptPrimerWebView, which sets it as the API WebView and runs the first fetch.
         let config = WKWebViewConfiguration()
         config.websiteDataStore = WKWebsiteDataStore.default()
-        cookiePrimerView = WKWebView(frame: .zero, configuration: config)
-        cookiePrimerView?.load(URLRequest(url: URL(string: "https://claude.ai")!))
+        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
+        let win = NSWindow(
+            contentRect: NSRect(x: -9999, y: -9999, width: 1, height: 1),
+            styleMask: [],
+            backing: .buffered,
+            defer: false
+        )
+        win.contentView = wv
+        win.alphaValue = 0
+        win.orderFront(nil)
+        cookiePrimerWindow = win
+        cookiePrimerView = wv
+
+        let delegate = PrimerNavDelegate { [weak self] in
+            guard let self, let wv = self.cookiePrimerView else { return }
+            Task { @MainActor [weak self] in
+                guard let self else { return }
+                await self.usageViewModel.adoptPrimerWebView(wv)
+                await self.updateManager.checkForUpdates()
+            }
+        }
+        primerNavDelegate = delegate
+        wv.navigationDelegate = delegate
+        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
 
         // Status item
         statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
@@ -134,12 +161,6 @@ class AppDelegate: NSObject, NSApplicationDelegate {
             }
         }
 
-        // Initial fetch after cookie primer + update check
-        Task {
-            try? await Task.sleep(nanoseconds: 1_500_000_000)
-            await usageViewModel.refresh()
-            await updateManager.checkForUpdates()
-        }
     }
 
     private func setMenubarIcon(button: NSStatusBarButton) {
@@ -240,4 +261,13 @@ class AppDelegate: NSObject, NSApplicationDelegate {
 
 }
 
-
+// One-shot WKNavigationDelegate: fires onDone on first finish or error, then goes silent.
+final class PrimerNavDelegate: NSObject, WKNavigationDelegate {
+    private var done = false
+    private let onDone: () -> Void
+    init(_ onDone: @escaping () -> Void) { self.onDone = onDone }
+    private func finish() { guard !done else { return }; done = true; onDone() }
+    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { finish() }
+    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) { finish() }
+    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) { finish() }
+}

ClaudeChecker/ContentView.swift

@@ -116,8 +116,8 @@ struct ContentView: View {
             showUpdateSheet = true
         }
         .sheet(isPresented: $showLogin) {
-            LoginSheetView(isPresented: $showLogin) {
-                Task { await vm.reloadAPIWebViewAndRefresh() }
+            LoginSheetView(isPresented: $showLogin) { webView in
+                Task { await vm.adoptAndRefresh(webView) }
             }
         }
         .sheet(isPresented: $showUpdateSheet) {
@@ -584,6 +584,7 @@ struct SettingsView: View {
     @Binding var showSettings: Bool
     @Binding var showUpdateSheet: Bool
     @State private var checkingForUpdates = false
+    @State private var showDiagnostics = false
 
     let refreshOptions: [(label: String, seconds: TimeInterval)] = [
         ("1 min",  60),
@@ -770,6 +771,23 @@ struct SettingsView: View {
 
             Divider()
 
+            // Diagnostics
+            HStack {
+                Label("Diagnostics", systemImage: "stethoscope")
+                    .font(.system(size: 12, weight: .medium))
+                    .foregroundColor(.secondary)
+                Spacer()
+                Button("Open") { showDiagnostics = true }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+            }
+            .sheet(isPresented: $showDiagnostics) {
+                DiagnosticsView(isPresented: $showDiagnostics)
+                    .environmentObject(vm)
+            }
+
+            Divider()
+
             // About
             HStack(spacing: 12) {
                 Image(nsImage: NSImage(named: "AppIcon") ?? NSImage())

ClaudeChecker/DiagnosticsView.swift

@@ -0,0 +1,215 @@
+import SwiftUI
+import WebKit
+
+struct DiagnosticsView: View {
+    @EnvironmentObject var vm: UsageViewModel
+    @Binding var isPresented: Bool
+    @State private var liveAllCookies: [HTTPCookie] = []
+    @State private var loadingCookies = false
+    @State private var copied = false
+
+    var body: some View {
+        VStack(spacing: 0) {
+            // Header
+            HStack {
+                Text("Diagnostics")
+                    .font(.system(size: 13, weight: .semibold))
+                Spacer()
+                Button("Copy All") {
+                    NSPasteboard.general.clearContents()
+                    NSPasteboard.general.setString(fullDiagText, forType: .string)
+                    copied = true
+                    DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) { copied = false }
+                }
+                .buttonStyle(.bordered)
+                .controlSize(.small)
+                if copied {
+                    Text("Copied! (IDs redacted)")
+                        .font(.system(size: 11))
+                        .foregroundColor(.green)
+                }
+                Button("Close") { isPresented = false }
+                    .buttonStyle(.bordered)
+                    .controlSize(.small)
+            }
+            .padding(.horizontal, 14)
+            .padding(.vertical, 10)
+            .background(Color(nsColor: .windowBackgroundColor))
+
+            Divider()
+
+            ScrollView {
+                VStack(alignment: .leading, spacing: 14) {
+
+                    // App info
+                    DiagSection(title: "App") {
+                        DiagRow("Version", Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?")
+                        DiagRow("Build",   Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "?")
+                        DiagRow("Signed in", vm.isSignedIn ? "Yes" : "No")
+                        DiagRow("Org ID",  UserDefaults.standard.string(forKey: "claude_org_id") ?? "(none)")
+                        DiagRow("lastActiveOrg", vm.diagLastActiveOrg.isEmpty ? "(not read)" : vm.diagLastActiveOrg)
+                        DiagRow("Error",   vm.errorMessage ?? "(none)")
+                    }
+
+                    Divider()
+
+                    // Last request
+                    DiagSection(title: "Last Request") {
+                        DiagRow("Path",    vm.diagLastPath.isEmpty ? "(none)" : vm.diagLastPath)
+                        DiagRow("Status",  vm.diagLastStatus == 0 ? "(none)" : "\(vm.diagLastStatus)")
+                        DiagRow("Error",   vm.diagLastError.isEmpty ? "(none)" : vm.diagLastError)
+                        if let t = vm.diagLastFetch {
+                            DiagRow("Time", t.formatted(date: .omitted, time: .standard))
+                        }
+                    }
+
+                    Divider()
+
+                    // Cookie summary
+                    DiagSection(title: "Cookie Store") {
+                        DiagRow("Total cookies",       "\(vm.diagCookieCount)")
+                        DiagRow("claude.ai cookies",   "\(vm.diagClaudeCookieCount)")
+                        DiagRow("All domains", vm.diagCookieDomains.isEmpty
+                            ? "(none — never fetched)"
+                            : vm.diagCookieDomains.joined(separator: ", "))
+                    }
+
+                    Divider()
+
+                    // Live cookie list
+                    DiagSection(title: "Live Cookie Names (WKWebsiteDataStore.default)") {
+                        if loadingCookies {
+                            ProgressView().scaleEffect(0.7)
+                        } else if liveAllCookies.isEmpty {
+                            Text("No cookies found")
+                                .font(.system(size: 11))
+                                .foregroundColor(.secondary)
+                        } else {
+                            let claudeCookies = liveAllCookies.filter {
+                                $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com")
+                            }
+                            let otherCookies = liveAllCookies.filter {
+                                !$0.domain.contains("claude.ai") && !$0.domain.contains("anthropic.com")
+                            }
+                            if !claudeCookies.isEmpty {
+                                Text("claude.ai / anthropic.com (\(claudeCookies.count))")
+                                    .font(.system(size: 10, weight: .medium))
+                                    .foregroundColor(.orange)
+                                ForEach(claudeCookies, id: \.name) { c in
+                                    Text("• \(c.domain)  \(c.name)")
+                                        .font(.system(size: 10, design: .monospaced))
+                                        .foregroundColor(.secondary)
+                                }
+                            }
+                            if !otherCookies.isEmpty {
+                                Text("Other domains (\(otherCookies.count))")
+                                    .font(.system(size: 10, weight: .medium))
+                                    .foregroundColor(.secondary)
+                                    .padding(.top, 4)
+                                ForEach(otherCookies.prefix(10), id: \.name) { c in
+                                    Text("• \(c.domain)  \(c.name)")
+                                        .font(.system(size: 10, design: .monospaced))
+                                        .foregroundColor(Color.secondary.opacity(0.6))
+                                }
+                                if otherCookies.count > 10 {
+                                    Text("… and \(otherCookies.count - 10) more")
+                                        .font(.system(size: 10))
+                                        .foregroundColor(Color.secondary.opacity(0.5))
+                                }
+                            }
+                        }
+
+                        Button("Refresh cookies") { loadLiveCookies() }
+                            .buttonStyle(.bordered)
+                            .controlSize(.small)
+                            .padding(.top, 4)
+                    }
+                }
+                .padding(14)
+            }
+        }
+        .frame(width: 480, height: 560)
+        .onAppear { loadLiveCookies() }
+    }
+
+    private func loadLiveCookies() {
+        loadingCookies = true
+        WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
+            DispatchQueue.main.async {
+                liveAllCookies = cookies.sorted { $0.domain < $1.domain }
+                loadingCookies = false
+            }
+        }
+    }
+
+    private var fullDiagText: String {
+        var lines: [String] = []
+        lines.append("=== ClaudeChecker Diagnostics ===")
+        lines.append("Version: \(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?") (\(Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "?"))")
+        lines.append("Signed in: \(vm.isSignedIn ? "Yes" : "No")")
+        lines.append("Email: \(vm.userEmail.isEmpty ? "(none)" : vm.userEmail)")
+        lines.append("Error: \(vm.errorMessage ?? "(none)")")
+        lines.append("")
+        lines.append("Last path: \(vm.diagLastPath)")
+        lines.append("Last status: \(vm.diagLastStatus)")
+        lines.append("Last error: \(vm.diagLastError)")
+        lines.append("Total cookies: \(vm.diagCookieCount)")
+        lines.append("Claude cookies: \(vm.diagClaudeCookieCount)")
+        lines.append("Domains: \(vm.diagCookieDomains.joined(separator: ", "))")
+        lines.append("")
+        lines.append("")
+        lines.append("Live cookies:")
+        for c in liveAllCookies {
+            lines.append("  \(c.domain)  \(c.name)  httpOnly=\(c.isHTTPOnly)  secure=\(c.isSecure)")
+        }
+        return redactUUIDs(lines.joined(separator: "\n"))
+    }
+
+    private func redactUUIDs(_ text: String) -> String {
+        let pattern = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+        guard let regex = try? NSRegularExpression(pattern: pattern) else { return text }
+        let range = NSRange(text.startIndex..., in: text)
+        return regex.stringByReplacingMatches(in: text, range: range, withTemplate: "****")
+    }
+}
+
+// MARK: - Helpers
+
+private struct DiagSection<Content: View>: View {
+    let title: String
+    @ViewBuilder let content: () -> Content
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            Text(title)
+                .font(.system(size: 11, weight: .semibold))
+                .foregroundColor(.secondary)
+                .textCase(.uppercase)
+            content()
+        }
+    }
+}
+
+private struct DiagRow: View {
+    let label: String
+    let value: String
+
+    init(_ label: String, _ value: String) {
+        self.label = label
+        self.value = value
+    }
+
+    var body: some View {
+        HStack(alignment: .top, spacing: 8) {
+            Text(label)
+                .font(.system(size: 11))
+                .foregroundColor(.secondary)
+                .frame(width: 100, alignment: .leading)
+            Text(value)
+                .font(.system(size: 11, design: .monospaced))
+                .foregroundColor(.primary)
+                .textSelection(.enabled)
+                .frame(maxWidth: .infinity, alignment: .leading)
+        }
+    }
+}

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.13</string>
+    <string>1.3.3-beta.1</string>
     <key>CFBundleVersion</key>
-    <string>61</string>
+    <string>77</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -4,7 +4,7 @@ import WebKit
 // MARK: - Login Web View
 
 struct LoginWebView: NSViewRepresentable {
-    let onAuthenticated: () -> Void
+    let onAuthenticated: (WKWebView) -> Void
 
     func makeNSView(context: Context) -> WKWebView {
         let config = WKWebViewConfiguration()
@@ -12,6 +12,7 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
+        context.coordinator.webView = webView
 
         // KVO on url catches SPA pushState navigations that don't fire didFinish
         context.coordinator.urlObservation = webView.observe(\.url, options: [.new]) { [weak coordinator = context.coordinator] wv, _ in
@@ -29,20 +30,24 @@ struct LoginWebView: NSViewRepresentable {
     }
 
     class Coordinator: NSObject, WKNavigationDelegate {
-        let onAuthenticated: () -> Void
+        let onAuthenticated: (WKWebView) -> Void
+        weak var webView: WKWebView?
         var didAuthenticate = false
         var urlObservation: NSKeyValueObservation?
 
-        init(onAuthenticated: @escaping () -> Void) {
+        init(onAuthenticated: @escaping (WKWebView) -> Void) {
             self.onAuthenticated = onAuthenticated
         }
 
         func checkCurrentURL(_ url: String?) {
-            guard !didAuthenticate, let url else { return }
+            guard !didAuthenticate, let url, let wv = webView else { return }
+            // Ignore navigations to external OAuth providers (Google, etc.) —
+            // only consider auth complete when we land back on claude.ai/anthropic.com
+            guard url.contains("claude.ai") || url.contains("anthropic.com") else { return }
             if url.contains("/login") || url.contains("/auth") { return }
             didAuthenticate = true
             DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                self.onAuthenticated()
+                self.onAuthenticated(wv)
             }
         }
 
@@ -57,7 +62,7 @@ struct LoginWebView: NSViewRepresentable {
 
 struct LoginSheetView: View {
     @Binding var isPresented: Bool
-    let onDone: () -> Void
+    let onDone: (WKWebView) -> Void
     @State private var authenticated = false
 
     var body: some View {
@@ -67,12 +72,9 @@ struct LoginSheetView: View {
                     .font(.system(size: 13, weight: .semibold))
                 Spacer()
                 if authenticated {
-                    Button("Done") {
-                        isPresented = false
-                        onDone()
-                    }
-                    .buttonStyle(.borderedProminent)
-                    .controlSize(.small)
+                    Button("Done") { isPresented = false }
+                        .buttonStyle(.borderedProminent)
+                        .controlSize(.small)
                 } else {
                     Button("Cancel") { isPresented = false }
                         .buttonStyle(.bordered)
@@ -85,12 +87,13 @@ struct LoginSheetView: View {
 
             Divider()
 
-            LoginWebView {
+            LoginWebView { webView in
                 authenticated = true
-                // Auto-dismiss and refresh after brief delay
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.8) {
+                // Adopt the authenticated WebView immediately (before sheet tears it down),
+                // then auto-dismiss after a moment so the user sees confirmation.
+                onDone(webView)
+                DispatchQueue.main.asyncAfter(deadline: .now() + 1.2) {
                     isPresented = false
-                    onDone()
                 }
             }
         }

ClaudeChecker/UsageViewModel.swift

@@ -30,12 +30,18 @@ class UsageViewModel: ObservableObject {
     private var previousPercents: [String: Double] = [:]
     private var firedThresholds: [String: Set<Int>] = [:]
 
-    // Background WKWebView used for all API calls — runs fetch() in the page's auth context
+    // WebView used for JS-based API calls (avoids URLSession 403 fingerprinting issues)
     private var apiWebView: WKWebView?
-    private var apiDelegate: APIWebViewDelegate?
-    // Tracks whether the background WebView has finished its current navigation
-    private var apiWebViewLoaded = false
-    private var apiReadyContinuations: [CheckedContinuation<Void, Never>] = []
+
+    // Diagnostics
+    @Published var diagCookieCount: Int = 0
+    @Published var diagClaudeCookieCount: Int = 0
+    @Published var diagCookieDomains: [String] = []
+    @Published var diagLastPath: String = ""
+    @Published var diagLastStatus: Int = 0
+    @Published var diagLastError: String = ""
+    @Published var diagLastActiveOrg: String = ""   // lastActiveOrg cookie value from JS
+    @Published var diagLastFetch: Date? = nil
 
     init() {
         let saved = UserDefaults.standard.double(forKey: "refresh_interval")
@@ -45,79 +51,136 @@ class UsageViewModel: ObservableObject {
             burnHistoryStore = saved
         }
         loadPlaceholderData()
-        setupAPIWebView()
         Task { await checkInitialSignInState() }
     }
 
-    // MARK: - Background API WebView
-
-    private func setupAPIWebView() {
-        let config = WKWebViewConfiguration()
-        config.websiteDataStore = WKWebsiteDataStore.default()
-        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
-        let del = APIWebViewDelegate()
-        del.onNavigationEnd = { [weak self] in
-            guard let self else { return }
-            self.apiWebViewLoaded = true
-            self.resumeAPIReadyContinuations()
-        }
-        wv.navigationDelegate = del
+    // Called by AppDelegate once the primer WebView has loaded claude.ai.
+    // Sets it as the API WebView and triggers the first data fetch.
+    func adoptPrimerWebView(_ wv: WKWebView) async {
         apiWebView = wv
-        apiDelegate = del
-        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
-    }
-
-    private func resumeAPIReadyContinuations() {
-        let pending = apiReadyContinuations
-        apiReadyContinuations.removeAll()
-        pending.forEach { $0.resume() }
-    }
-
-    // Suspends until the background WebView has finished loading.
-    private func waitForAPIWebViewReady() async {
-        guard !apiWebViewLoaded else { return }
-        await withCheckedContinuation { cont in
-            apiReadyContinuations.append(cont)
-        }
-    }
-
-    // Called after login: reloads the background WebView to pick up the new session, then refreshes.
-    func reloadAPIWebViewAndRefresh() async {
-        guard let wv = apiWebView, let del = apiDelegate else {
-            await refresh()
-            return
-        }
-        // Reset readiness and wire up the reload callback before starting the load
-        apiWebViewLoaded = false
-        del.onNavigationEnd = { [weak self] in
-            guard let self else { return }
-            self.apiWebViewLoaded = true
-            self.resumeAPIReadyContinuations()
-        }
-        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
-        await waitForAPIWebViewReady()
-        // Brief pause for the page's JS auth state to settle after navigation
-        try? await Task.sleep(nanoseconds: 500_000_000)
         await refresh()
     }
 
-    // Runs a fetch() call inside the background WebView's page context (same-origin, credentials included).
-    private func webViewFetch(_ path: String) async throws -> (statusCode: Int, body: String) {
+    // Called after login: store the login WebView (already on claude.ai) so jsFetch can use it.
+    func adoptAndRefresh(_ loginWebView: WKWebView) async {
+        for _ in 0..<30 {
+            let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+            if cookies.contains(where: { $0.domain.contains("claude.ai") }) { break }
+            try? await Task.sleep(nanoseconds: 300_000_000)
+        }
+        apiWebView = loginWebView
+        await refresh()
+    }
+
+    // Runs a fetch() inside the live claude.ai WebView — same browser context as the frontend,
+    // so no CORS/fingerprinting issues that URLSession hits.
+    private func jsFetch(_ path: String) async throws -> (Int, String) {
         guard let wv = apiWebView else { throw AppError.networkError }
-        // Wait until the WebView has finished loading claude.ai so fetch() has a valid auth context
-        await waitForAPIWebViewReady()
-        let js = "const r = await fetch(path, {credentials:'include'}); return {s: r.status, b: await r.text()};"
-        let result = try await wv.callAsyncJavaScript(
-            js, arguments: ["path": path], in: nil, in: .page)
-        guard let d = result as? [String: Any],
-              let s = (d["s"] as? NSNumber)?.intValue,
-              let b = d["b"] as? String else { throw AppError.networkError }
-        return (s, b)
+        let js = """
+        const r = await fetch('\(path)', {
+            credentials: 'include',
+            headers: { 'Accept': 'application/json' }
+        });
+        const body = await r.text();
+        return {status: r.status, body: body};
+        """
+        let result: Any? = try await withCheckedThrowingContinuation { cont in
+            wv.callAsyncJavaScript(js, arguments: [:], in: nil, in: .defaultClient) { res in
+                switch res {
+                case .success(let val): cont.resume(returning: val)
+                case .failure(let err): cont.resume(throwing: err)
+                }
+            }
+        }
+        guard let dict = result as? [String: Any],
+              let status = dict["status"] as? Int,
+              let body = dict["body"] as? String else {
+            throw AppError.networkError
+        }
+        diagLastPath = path
+        diagLastFetch = Date()
+        diagLastStatus = status
+        diagLastError = status != 200 ? "JS HTTP \(status)" : ""
+        return (status, body)
+    }
+
+    // Use JS fetch when apiWebView is ready on claude.ai, otherwise fall back to URLSession.
+    private func apiFetch(_ path: String) async throws -> (Int, String) {
+        if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true {
+            return try await jsFetch(path)
+        }
+        return try await urlFetch(path)
+    }
+
+    // Fetches an API path via URLSession with browser-like headers.
+    // Claude.ai's API requires sec-fetch-*, Origin, Referer, and a browser User-Agent
+    // to avoid 401 — matching how the Windows version (HttpClient) handles this.
+    private func urlFetch(_ path: String) async throws -> (Int, String) {
+        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+        let claudeCookies = cookies.filter {
+            $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com")
+        }
+
+        // Record cookie diagnostics
+        diagCookieCount = cookies.count
+        diagClaudeCookieCount = claudeCookies.count
+        diagCookieDomains = Array(Set(cookies.map { $0.domain })).sorted()
+        diagLastPath = path
+        diagLastFetch = Date()
+        diagLastError = ""
+
+        guard !claudeCookies.isEmpty else {
+            let msg = "No claude.ai cookies (\(cookies.count) total in store)"
+            diagLastError = msg
+            throw AppError.detail(msg)
+        }
+
+        var req = URLRequest(url: URL(string: "https://claude.ai\(path)")!)
+        req.httpShouldHandleCookies = false
+        // Build cookie header manually (same format as Windows HttpClient) to avoid
+        // any encoding differences from HTTPCookie.requestHeaderFields(with:)
+        let cookieHeader = claudeCookies.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
+        req.setValue(cookieHeader, forHTTPHeaderField: "Cookie")
+        req.setValue("application/json", forHTTPHeaderField: "Accept")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
+        req.setValue("empty",       forHTTPHeaderField: "sec-fetch-dest")
+        req.setValue("cors",        forHTTPHeaderField: "sec-fetch-mode")
+        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
+        req.setValue(
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+            forHTTPHeaderField: "User-Agent")
+        req.setValue(
+            "\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"",
+            forHTTPHeaderField: "sec-ch-ua")
+        req.setValue("?0",        forHTTPHeaderField: "sec-ch-ua-mobile")
+        req.setValue("\"macOS\"", forHTTPHeaderField: "sec-ch-ua-platform")
+        req.setValue("web",       forHTTPHeaderField: "anthropic-client-platform")
+
+        let session = URLSession(configuration: .ephemeral)
+        do {
+            let (data, response) = try await session.data(for: req)
+            guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
+            let body = String(data: data, encoding: .utf8) ?? ""
+            diagLastStatus = http.statusCode
+            if http.statusCode != 200 {
+                diagLastError = "HTTP \(http.statusCode)"
+            }
+            return (http.statusCode, body)
+        } catch let e as AppError { throw e }
+        catch {
+            let msg = error.localizedDescription
+            diagLastError = msg
+            throw AppError.detail(msg)
+        }
     }
 
     private func checkInitialSignInState() async {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        if !cookies.isEmpty { isSignedIn = true }
+        guard cookies.contains(where: { $0.domain.contains("claude.ai") }) else { return }
+        isSignedIn = true
+        // AppDelegate's primer WebView will call adoptPrimerWebView once it loads,
+        // which triggers the first real data fetch.
     }
 
     func signOut() async {
@@ -127,6 +190,7 @@ class UsageViewModel: ObservableObject {
         let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
+        apiWebView = nil
         isSignedIn = false
         isNotAuthenticated = true
         lastUpdated = nil
@@ -135,16 +199,6 @@ class UsageViewModel: ObservableObject {
         extraUsage = nil
         prepaidCredits = nil
         overageSpendLimit = nil
-        // Reload background WebView to clear its session too
-        apiWebViewLoaded = false
-        if let del = apiDelegate {
-            del.onNavigationEnd = { [weak self] in
-                guard let self else { return }
-                self.apiWebViewLoaded = true
-                self.resumeAPIReadyContinuations()
-            }
-        }
-        apiWebView?.load(URLRequest(url: URL(string: "https://claude.ai")!))
     }
 
     func refresh() async {
@@ -154,10 +208,31 @@ class UsageViewModel: ObservableObject {
         defer { isLoading = false }
 
         do {
-            let (fetchedOrgId, fetchedEmail, fetchedPlan) = try await fetchBootstrap()
+            // Read lastActiveOrg cookie from JS — most reliable org source since it's
+            // set by the claude.ai frontend to whichever org is currently active.
+            var cookieOrgId: String? = nil
+            if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true {
+                let js = """
+                return document.cookie.split(';')
+                    .map(c => c.trim().split('='))
+                    .filter(p => p[0] === 'lastActiveOrg')
+                    .map(p => p.slice(1).join('='))[0] || null;
+                """
+                let raw: Any? = try? await withCheckedThrowingContinuation { cont in
+                    wv.callAsyncJavaScript(js, arguments: [:], in: nil, in: .defaultClient) { r in
+                        cont.resume(returning: (try? r.get()) ?? nil)
+                    }
+                }
+                if let v = raw as? String, !v.isEmpty {
+                    cookieOrgId = v
+                    diagLastActiveOrg = v
+                }
+            }
+
+            let (fetchedOrgId, fetchedEmail, fetchedPlan) = try await fetchBootstrap(preferredOrgId: cookieOrgId)
 
             let orgId: String
-            if let id = fetchedOrgId {
+            if let id = cookieOrgId ?? fetchedOrgId {
                 UserDefaults.standard.set(id, forKey: "claude_org_id")
                 orgId = id
             } else if let cached = UserDefaults.standard.string(forKey: "claude_org_id") {
@@ -174,8 +249,8 @@ class UsageViewModel: ObservableObject {
             async let overageFetch = fetchOverageSpendLimit(orgId: orgId)
             let (usage, prepaid, overage) = try await (usageFetch, prepaidFetch, overageFetch)
             limits = buildLimits(from: usage)
-            extraUsage = usage.extraUsage
-            prepaidCredits = prepaid
+            extraUsage        = usage.extraUsage
+            prepaidCredits    = prepaid
             overageSpendLimit = overage
             lastUpdated = Date()
             isSignedIn = true
@@ -210,12 +285,17 @@ class UsageViewModel: ObservableObject {
         }
     }
 
-    // MARK: - Bootstrap (org ID + email + plan label in one call)
+    // MARK: - Bootstrap
 
-    private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
-        let (status, body) = try await webViewFetch("/api/bootstrap")
-        if status == 401 || status == 403 { throw AppError.notAuthenticated }
-        guard status == 200 else { throw AppError.networkError }
+    private func fetchBootstrap(preferredOrgId: String? = nil) async throws -> (orgId: String?, email: String?, planLabel: String?) {
+        let (status, body) = try await apiFetch("/api/bootstrap")
+        if status == 401 || status == 403 {
+            throw AppError.detail("HTTP \(status) — \(body.prefix(120))")
+        }
+        guard status == 200 else { throw AppError.detail("HTTP \(status): \(body.prefix(80))") }
+        guard body.trimmingCharacters(in: .whitespacesAndNewlines).hasPrefix("{") else {
+            throw AppError.detail("Non-JSON response (HTML?): \(body.prefix(80))")
+        }
         guard let data = body.data(using: .utf8),
               let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             return (nil, nil, nil)
@@ -223,14 +303,15 @@ class UsageViewModel: ObservableObject {
 
         let account  = json["account"] as? [String: Any]
         let memberships = (account?["memberships"] ?? json["memberships"]) as? [[String: Any]]
-        let firstOrg = memberships?.first?["organization"] as? [String: Any]
+        let allOrgs = memberships?.compactMap { $0["organization"] as? [String: Any] } ?? []
+        let firstOrg = allOrgs.first
 
         var orgId: String? = firstOrg?["uuid"] as? String
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
         if orgId == nil {
-            if let (orgsStatus, orgsBody) = try? await webViewFetch("/api/organizations"),
+            if let (orgsStatus, orgsBody) = try? await apiFetch("/api/organizations"),
                orgsStatus == 200,
                let orgsData = orgsBody.data(using: .utf8),
                let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
@@ -240,8 +321,10 @@ class UsageViewModel: ObservableObject {
 
         let email = account?["email_address"] as? String
 
+        // Read capabilities from the preferred (active) org, falling back to first org.
+        let capOrg = preferredOrgId.flatMap { id in allOrgs.first(where: { $0["uuid"] as? String == id }) } ?? firstOrg
         var planLabel: String? = nil
-        if let caps = firstOrg?["capabilities"] as? [String],
+        if let caps = capOrg?["capabilities"] as? [String],
            let cap = caps.first(where: { $0.hasPrefix("claude_") }) {
             let name = String(cap.dropFirst("claude_".count))
             planLabel = name.prefix(1).uppercased() + name.dropFirst().lowercased()
@@ -253,22 +336,22 @@ class UsageViewModel: ObservableObject {
     // MARK: - Fetch usage
 
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
-        let (status, body) = try await webViewFetch("/api/organizations/\(orgId)/usage")
-        if status == 401 || status == 403 { throw AppError.notAuthenticated }
+        let (status, body) = try await apiFetch("/api/organizations/\(orgId)/usage")
+        if status == 401 || status == 403 { throw AppError.detail("usage \(status): \(body.prefix(200))") }
         guard status == 200 else { throw AppError.networkError }
         guard let data = body.data(using: .utf8) else { throw AppError.networkError }
         return try JSONDecoder().decode(UsageResponse.self, from: data)
     }
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
-        guard let (status, body) = try? await webViewFetch("/api/organizations/\(orgId)/prepaid/credits"),
+        guard let (status, body) = try? await apiFetch("/api/organizations/\(orgId)/prepaid/credits"),
               status == 200,
               let data = body.data(using: .utf8) else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
     }
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
-        guard let (status, body) = try? await webViewFetch("/api/organizations/\(orgId)/overage_spend_limit"),
+        guard let (status, body) = try? await apiFetch("/api/organizations/\(orgId)/overage_spend_limit"),
               status == 200,
               let data = body.data(using: .utf8) else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)
@@ -387,30 +470,17 @@ class UsageViewModel: ObservableObject {
     }
 }
 
-// MARK: - API WebView Delegate
 
-private class APIWebViewDelegate: NSObject, WKNavigationDelegate {
-    // Called on every didFinish / didFail — not cleared after firing, so subsequent navigations also trigger it
-    var onNavigationEnd: (() -> Void)?
-
-    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-        onNavigationEnd?()
-    }
-    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
-        onNavigationEnd?()
-    }
-    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-        onNavigationEnd?()
-    }
-}
 
 enum AppError: LocalizedError {
     case notAuthenticated
     case networkError
+    case detail(String)
     var errorDescription: String? {
         switch self {
-        case .notAuthenticated: return "Not signed into claude.ai — open claude.ai in your browser first."
-        case .networkError:     return "Network error fetching usage data."
+        case .notAuthenticated:   return "Not signed into claude.ai — open claude.ai in your browser first."
+        case .networkError:       return "Network error fetching usage data."
+        case .detail(let msg):    return msg
         }
     }
 }

README.md

@@ -8,9 +8,9 @@
 
 [![macOS](https://img.shields.io/badge/macOS-13.0+-000000?style=flat&logo=apple&logoColor=white)](https://www.apple.com/macos/)
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
-[![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
+[![Version](https://img.shields.io/badge/version-1.3.2-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.12-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.12) <!-- BETA_BADGE -->
+<!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,13 +1,4 @@
-## What's new in v1.2.1
+## What's new in v1.3.2
 
-### Bug fixes
-- Fixed a timing race in the background API WebView — `refresh()` now correctly waits for the WebView to finish loading before making API calls, preventing silent failures on startup
-- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, httpOnly tokens, etc.) are included automatically
-- Fixed "Not signed in" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh
-- Fixed "Not signed in" showing incorrectly on launch when the session was already active
-- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
-- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
-- Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
-- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails
-- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish
+### Reliability
+- Data now loads automatically on every app launch without requiring manual re-authentication. The background WebView is anchored in a hidden window so macOS no longer throttles its JavaScript execution.

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.12",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.12/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, localStorage tokens, etc.) are included automatically\n- Fixed \"Not signed in\" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails\n- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish"
+  "version": "1.2.1-beta.25",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.25/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1-beta.18\n\n### Bug fixes\n- Replaced callAsyncJavaScript fetch approach with WebKit navigation: instead of running `fetch()` in the page's JS context (which was returning 401 because it bypasses the SPA's auth interceptors), each API call now navigates the WebView to the API URL directly. WebKit sends full browser headers and cookies automatically at the HTTP layer, the same way a real browser navigation works. This is more reliable regardless of what server-side auth mechanism claude.ai uses.\n- API calls are now sequential to share a single WebView for all navigations\n- Added redirect detection: if WebKit follows a 302 to /login, the response is treated as an auth failure rather than returning HTML to the JSON parser\n\n## What's new in v1.2.1-beta.17\n\n### Bug fixes\n- Fixed \"Not signed in\" after login by adopting the login WebView directly for API calls\n- Added diagnostic error messages for JS errors and unexpected responses\n\n## What's new in v1.2.1\n\n### Bug fixes\n- Fixed WebKit suspending the background WKWebView: anchored in a transparent 1×1 NSWindow\n- Fixed login window auto-closing before sign-in completes\n- Added /api/organizations as a final fallback for org ID resolution\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh"
 }

version-windows-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.1-beta.49",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/win-v0.0.1-beta.49/ClaudeChecker-Windows.zip",
-  "notes": "## What's new in beta.36\r\n\r\n### Bug fixes\r\n- Settings no longer incorrectly shows \"Not signed in\" when limits are working\r\n- Session Diary now shows correctly after the first successful refresh\r\n- Extra Usage Credits section now restored from cache on startup\r\n- Plan name, overage, and prepaid credits are now cached and shown immediately on launch\r\n- App now loads cached state instantly on startup before the background refresh completes"
+  "version": "0.0.1-beta.51",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/win-v0.0.1-beta.51/ClaudeChecker-Windows.zip",
+  "notes": "## What's new in beta.49\r\n\r\n### Architecture\r\n- All data (usage, plan, overage, prepaid credits) now fetched via the persistent background WebView2 — the same always-live session as the macOS app, so Cloudflare cookies never expire between refreshes\r\n- HttpClient path kept only as a brief startup fallback before the browser is ready\r\n- Settings file simplified: only stores session signal, burn history, and user preferences — no more cached API responses\r\n\r\n### Bug fixes\r\n- Plan label (e.g. \"Pro\") now updates on every refresh, not just at login\r\n- Extra Usage Credits values now correct (were 100× too large)\r\n- Limit and balance now update live on every refresh\r\n- Refresh interval dropdown now shows \"1 min\", \"2 min\" etc. correctly\r\n- ComboBox no longer flashes bright blue when clicked\r\n- Buttons now show a visible pressed state\r\n- Footer \"Updated X ago\" counter now ticks every second; shows \"X min, Y sec ago\" past 60 s\r\n- Removed stray sparkline bars from the 5 h and 7 d limit cards\r\n- App window now shown on launch\r\n\r\n### UI improvements\r\n- Gauge percentage larger, \"used\" label removed\r\n- Each limit card now shows an \"after reset\" or \"today HH:MM\" badge\r\n- Session Diary card redesigned to match macOS layout (stats row + sparkline, no Claude header)\r\n- Reset date moved inline with time remaining"
 }

version.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.0",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.0/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.0\n\n### Bug fixes\n- App now works for all users — org ID is fetched dynamically from the API instead of being hardcoded\n- Plan name (e.g. Pro, Max) now updates correctly on every refresh\n\n### Improvements\n- Plan name is read from the API rather than hardcoded\n- Bootstrap API call consolidated — org ID, email, and plan name fetched in a single request per refresh\n- Main panel no longer scrolls — popover auto-sizes to fit content\n- Session Diary card redesigned — sample count and avg burn rate shown left/right above the sparkline, Claude header removed"
+  "version": "1.3.2",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.3.2/ClaudeChecker.zip",
+  "notes": "## What's new in v1.3.2\n\n### Reliability\n- Data now loads automatically on every app launch without requiring manual re-authentication. The background WebView is anchored in a hidden window so macOS no longer throttles its JavaScript execution."
 }