fix: use WebView JS fetch for auth detection; send all cookies to API

Cookie domain filtering was wrong — the session token domain is unknown
and was never found by claude.ai/anthropic.com filters.

LoginView: replace getAllCookies domain check with callAsyncJavaScript
that fetches /api/bootstrap directly from the WebView. The WebView uses
its own full session (all cookies, any domain) so auth is detected
correctly regardless of where the token lives.

UsageViewModel: claudeCookieHeader now sends all cookies from the app's
WKWebsiteDataStore instead of filtering by domain. checkInitialSignInState
likewise checks for any cookie.

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.4</string>
+    <string>1.2.1-beta.8</string>
     <key>CFBundleVersion</key>
-    <string>52</string>
+    <string>56</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -12,7 +12,7 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
-        webView.load(URLRequest(url: URL(string: "https://claude.ai")!))
+        webView.load(URLRequest(url: URL(string: "https://claude.ai/login")!))
         return webView
     }
 
@@ -36,17 +36,23 @@ struct LoginWebView: NSViewRepresentable {
             if let url = webView.url?.absoluteString,
                url.contains("/login") || url.contains("/auth") { return }
 
-            // URL is not a login/auth page, so if any claude.ai cookie exists we're signed in
-            WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
-                guard hasAnyCookie, !self.didAuthenticate else { return }
+            // Ask the WebView itself whether we're authenticated — it uses its own
+            // session (cookies, localStorage, etc.) so we don't need to know the
+            // cookie domain or name.
+            webView.callAsyncJavaScript(
+                "const r = await fetch('/api/bootstrap', {credentials: 'include'}); return r.status;",
+                arguments: [:], in: nil, in: .defaultClient
+            ) { [weak self] result in
+                guard let self, !self.didAuthenticate else { return }
+                if case .success(let val) = result, let status = val as? Int, status == 200 {
                     self.didAuthenticate = true
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
+                    DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) {
                         self.onAuthenticated()
                     }
                 }
             }
         }
+    }
 }
 
 // MARK: - Login Sheet View

ClaudeChecker/UsageViewModel.swift

@@ -43,15 +43,14 @@ class UsageViewModel: ObservableObject {
 
     private func checkInitialSignInState() async {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
-        if hasAnyCookie { isSignedIn = true }
+        if !cookies.isEmpty { isSignedIn = true }
     }
 
     func signOut() async {
         let store = WKWebsiteDataStore.default()
         let types = WKWebsiteDataStore.allWebsiteDataTypes()
         let records = await store.dataRecords(ofTypes: types)
-        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") }
+        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
         isSignedIn = false
@@ -109,6 +108,7 @@ class UsageViewModel: ObservableObject {
             checkLimitNotifications(for: limits)
         } catch AppError.notAuthenticated {
             isNotAuthenticated = true
+            isSignedIn = false
             errorMessage = "Not signed in"
         } catch let error as DecodingError {
             switch error {
@@ -128,12 +128,25 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Bootstrap (org ID + email + plan label in one call)
 
+    private func claudeAPIRequest(for url: URL) async -> URLRequest {
+        var req = URLRequest(url: url)
+        req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept")
+        req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
+        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
+        req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode")
+        req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest")
+        if let cookie = await claudeCookieHeader() {
+            req.setValue(cookie, forHTTPHeaderField: "Cookie")
+        }
+        return req
+    }
+
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
         let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        guard let cookie = await claudeCookieHeader() else { throw AppError.notAuthenticated }
-        req.setValue(cookie, forHTTPHeaderField: "Cookie")
+        var req = await claudeAPIRequest(for: url)
+        guard req.value(forHTTPHeaderField: "Cookie") != nil else { throw AppError.notAuthenticated }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -152,11 +165,9 @@ class UsageViewModel: ObservableObject {
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
-        if orgId == nil, let cookie = await claudeCookieHeader() {
+        if orgId == nil {
             // Final fallback: fetch /api/organizations directly
-            var orgsReq = URLRequest(url: URL(string: "https://claude.ai/api/organizations")!)
-            orgsReq.setValue("application/json", forHTTPHeaderField: "accept")
-            orgsReq.setValue(cookie, forHTTPHeaderField: "Cookie")
+            let orgsReq = await claudeAPIRequest(for: URL(string: "https://claude.ai/api/organizations")!)
             if let (orgsData, orgsResp) = try? await URLSession.shared.data(for: orgsReq),
                let orgsHttp = orgsResp as? HTTPURLResponse, orgsHttp.statusCode == 200,
                let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
@@ -181,15 +192,15 @@ class UsageViewModel: ObservableObject {
 
     private func claudeCookieHeader() async -> String? {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
-        return HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"]
+        guard !cookies.isEmpty else { return nil }
+        // Send all cookies from the app's WebView store — the session token may be
+        // on any domain (claude.ai, anthropic.com, or an auth sub-service).
+        return HTTPCookie.requestHeaderFields(with: cookies)["Cookie"]
     }
 
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -199,9 +210,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
@@ -209,9 +218,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.3-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.3) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.7-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.7) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -3,7 +3,10 @@
 ### Bug fixes
 - Fixed "Not signed in" showing incorrectly on launch when the session was already active
 - Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
-- Fixed Re-authenticate (and Sign In) not detecting an existing session — the login window now loads `claude.ai` directly so already-signed-in users are detected correctly and the window auto-dismisses
+- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
 - Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
 - Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Session cookie detection now checks both `sessionKey` and `__Secure-next-auth.session-token` cookie names
+- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails
+- Rewrote login detection to use the WebView's own fetch call instead of inspecting cookie domains — correctly detects auth regardless of which domain the session token is stored on
+- Fixed API requests not including session cookies — now sends all cookies from the app's WebView store rather than filtering by domain

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.3",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.3/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed Re-authenticate (and Sign In) not detecting an existing session — the login window now loads `claude.ai` directly so already-signed-in users are detected correctly and the window auto-dismisses\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Session cookie detection now checks both `sessionKey` and `__Secure-next-auth.session-token` cookie names"
+  "version": "1.2.1-beta.7",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.7/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)\n- Fixed sign-in detection and cookie handling for accounts whose session cookies are on the `anthropic.com` domain rather than `claude.ai`\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails"
 }