beta.14: fix httpShouldHandleCookies=false so Cookie header is actually sent

didFinish only fires for cross-document (full page) navigations. After
loading https://claude.ai/login the SPA redirects authenticated users
via history.pushState to /new — this changes the URL visually but never
fires didFinish, so auth was never detected.

KVO on webView.url fires for every URL change including SPA pushState,
covering the case where the app routes client-side after the initial
page load. Both KVO and didFinish now call the same checkCurrentURL
helper so detection is not missed regardless of navigation type.

ClaudeChecker/ContentView.swift

@@ -911,12 +911,12 @@ struct ErrorBanner: View {
 struct EmptyStateView: View {
     var body: some View {
         VStack(spacing: 10) {
-            Image(systemName: "key.slash")
+            Image(systemName: "person.crop.circle.badge.questionmark")
                 .font(.system(size: 28))
                 .foregroundColor(.secondary)
-            Text("No API key configured")
+            Text("Not signed in")
                 .font(.system(size: 13, weight: .medium))
-            Text("Open Settings to add your Anthropic API key.")
+            Text("Sign in to claude.ai to see your usage.")
                 .font(.system(size: 11.5))
                 .foregroundColor(.secondary)
                 .multilineTextAlignment(.center)

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.2</string>
+    <string>1.2.1-beta.14</string>
     <key>CFBundleVersion</key>
-    <string>50</string>
+    <string>62</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -12,7 +12,13 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
-        webView.load(URLRequest(url: URL(string: "https://claude.ai")!))
+
+        // KVO on url catches SPA pushState navigations that don't fire didFinish
+        context.coordinator.urlObservation = webView.observe(\.url, options: [.new]) { [weak coordinator = context.coordinator] wv, _ in
+            coordinator?.checkCurrentURL(wv.url?.absoluteString)
+        }
+
+        webView.load(URLRequest(url: URL(string: "https://claude.ai/login")!))
         return webView
     }
 
@@ -25,29 +31,25 @@ struct LoginWebView: NSViewRepresentable {
     class Coordinator: NSObject, WKNavigationDelegate {
         let onAuthenticated: () -> Void
         var didAuthenticate = false
+        var urlObservation: NSKeyValueObservation?
 
         init(onAuthenticated: @escaping () -> Void) {
             self.onAuthenticated = onAuthenticated
         }
 
-        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+        func checkCurrentURL(_ url: String?) {
-            guard !didAuthenticate else { return }
+            guard !didAuthenticate, let url else { return }
-            // Don't fire on the login/auth pages themselves
+            if url.contains("/login") || url.contains("/auth") { return }
-            if let url = webView.url?.absoluteString,
+            didAuthenticate = true
-               url.contains("/login") || url.contains("/auth") { return }
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-
+                self.onAuthenticated()
-            WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasSession = cookies.contains {
-                    $0.domain.contains("claude.ai") &&
-                    ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-                }
-                guard hasSession, !self.didAuthenticate else { return }
-                self.didAuthenticate = true
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                    self.onAuthenticated()
-                }
             }
         }
+
+        // Covers full cross-document navigations
+        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+            checkCurrentURL(webView.url?.absoluteString)
+        }
     }
 }
 

ClaudeChecker/UsageViewModel.swift

@@ -43,18 +43,14 @@ class UsageViewModel: ObservableObject {
 
     private func checkInitialSignInState() async {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let hasSession = cookies.contains {
+        if !cookies.isEmpty { isSignedIn = true }
-            $0.domain.contains("claude.ai") &&
-            ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-        }
-        if hasSession { isSignedIn = true }
     }
 
     func signOut() async {
         let store = WKWebsiteDataStore.default()
         let types = WKWebsiteDataStore.allWebsiteDataTypes()
         let records = await store.dataRecords(ofTypes: types)
-        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") }
+        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
         isSignedIn = false
@@ -112,6 +108,7 @@ class UsageViewModel: ObservableObject {
             checkLimitNotifications(for: limits)
         } catch AppError.notAuthenticated {
             isNotAuthenticated = true
+            isSignedIn = false
             errorMessage = "Not signed in"
         } catch let error as DecodingError {
             switch error {
@@ -129,14 +126,39 @@ class UsageViewModel: ObservableObject {
         }
     }
 
+    // MARK: - HTTP helpers
+
+    // Builds a URLRequest with browser-like headers and cookies from WKWebsiteDataStore.
+    //
+    // httpShouldHandleCookies MUST be false: when true, URLSession replaces any manually-set
+    // Cookie header with its own HTTPCookieStorage (which is empty — claude.ai cookies live in
+    // WKWebsiteDataStore, not HTTPCookieStorage), causing every request to go out with no cookies.
+    private func claudeAPIRequest(for url: URL) async -> URLRequest {
+        var req = URLRequest(url: url)
+        req.httpShouldHandleCookies = false
+        req.setValue("application/json", forHTTPHeaderField: "accept")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "referer")
+        req.setValue(
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+            forHTTPHeaderField: "user-agent")
+        if let cookie = await claudeCookieHeader() {
+            req.setValue(cookie, forHTTPHeaderField: "cookie")
+        }
+        return req
+    }
+
+    private func claudeCookieHeader() async -> String? {
+        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+        guard !cookies.isEmpty else { return nil }
+        return HTTPCookie.requestHeaderFields(with: cookies)["Cookie"]
+    }
+
     // MARK: - Bootstrap (org ID + email + plan label in one call)
 
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
         let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        guard let cookie = await claudeCookieHeader() else { throw AppError.notAuthenticated }
-        req.setValue(cookie, forHTTPHeaderField: "Cookie")
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -146,20 +168,15 @@ class UsageViewModel: ObservableObject {
         }
 
         let account  = json["account"] as? [String: Any]
-        // memberships may live under account or at root (older API shape)
         let memberships = (account?["memberships"] ?? json["memberships"]) as? [[String: Any]]
         let firstOrg = memberships?.first?["organization"] as? [String: Any]
 
-        // org ID — primary path then flat-list fallback then dedicated endpoint
         var orgId: String? = firstOrg?["uuid"] as? String
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
-        if orgId == nil, let cookie = await claudeCookieHeader() {
+        if orgId == nil {
-            // Final fallback: fetch /api/organizations directly
+            let orgsReq = await claudeAPIRequest(for: URL(string: "https://claude.ai/api/organizations")!)
-            var orgsReq = URLRequest(url: URL(string: "https://claude.ai/api/organizations")!)
-            orgsReq.setValue("application/json", forHTTPHeaderField: "accept")
-            orgsReq.setValue(cookie, forHTTPHeaderField: "Cookie")
             if let (orgsData, orgsResp) = try? await URLSession.shared.data(for: orgsReq),
                let orgsHttp = orgsResp as? HTTPURLResponse, orgsHttp.statusCode == 200,
                let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
@@ -169,7 +186,6 @@ class UsageViewModel: ObservableObject {
 
         let email = account?["email_address"] as? String
 
-        // plan label from capabilities e.g. "claude_pro" -> "Pro"
         var planLabel: String? = nil
         if let caps = firstOrg?["capabilities"] as? [String],
            let cap = caps.first(where: { $0.hasPrefix("claude_") }) {
@@ -182,17 +198,9 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Fetch usage
 
-    private func claudeCookieHeader() async -> String? {
-        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
-        return HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"]
-    }
-
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -202,9 +210,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
@@ -212,9 +218,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.1-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.1) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.13-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.13) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,8 +1,10 @@
 ## What's new in v1.2.1
 
 ### Bug fixes
-- Fixed "Not signed in" showing incorrectly on launch when the session was already active
+- Fixed the root cause of "Not signed in" errors: URLSession was silently discarding the manually-set Cookie header because `httpShouldHandleCookies` defaults to `true`, which makes URLSession replace it with its own (empty) HTTPCookieStorage — claude.ai session cookies live in WKWebsiteDataStore, not HTTPCookieStorage. Setting `httpShouldHandleCookies = false` ensures the cookies are actually sent.
-- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
+- Added browser-like request headers (User-Agent, Origin, Referer) matching what Claude's API expects, consistent with the working Windows implementation
-- Fixed Re-authenticate (and Sign In) not detecting an existing session — the login window now loads `claude.ai` directly so already-signed-in users are detected correctly and the window auto-dismisses
+- Removed background WKWebView complexity added in beta.12–13 — reverted to simple URLSession approach with correct cookie handling
-- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
+- Fixed login window auto-closing before the user could sign in — login window loads `/login` so auth is only detected after the actual sign-in redirect
-- Session cookie detection now checks both `sessionKey` and `__Secure-next-auth.session-token` cookie names
+- Fixed login detection for Next.js SPA navigation using KVO on WebView URL (history.pushState doesn't trigger didFinish)
+- Added `/api/organizations` as a final fallback for org ID resolution
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.1",
+  "version": "1.2.1-beta.13",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.1/ClaudeChecker.zip",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.13/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Session cookie detection now checks both `sessionKey` and `__Secure-next-auth.session-token` cookie names"
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed a timing race in the background API WebView — `refresh()` now correctly waits for the WebView to finish loading before making API calls, preventing silent failures on startup\n- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, httpOnly tokens, etc.) are included automatically\n- Fixed \"Not signed in\" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails\n- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish"
 }