beta.13: wait for apiWebView didFinish before making JS fetch calls

didFinish only fires for cross-document (full page) navigations. After
loading https://claude.ai/login the SPA redirects authenticated users
via history.pushState to /new — this changes the URL visually but never
fires didFinish, so auth was never detected.

KVO on webView.url fires for every URL change including SPA pushState,
covering the case where the app routes client-side after the initial
page load. Both KVO and didFinish now call the same checkCurrentURL
helper so detection is not missed regardless of navigation type.

ClaudeChecker/ContentView.swift

@@ -117,7 +117,7 @@ struct ContentView: View {
         }
         .sheet(isPresented: $showLogin) {
             LoginSheetView(isPresented: $showLogin) {
-                Task { await vm.refresh() }
+                Task { await vm.reloadAPIWebViewAndRefresh() }
             }
         }
         .sheet(isPresented: $showUpdateSheet) {

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.6</string>
+    <string>1.2.1-beta.13</string>
     <key>CFBundleVersion</key>
-    <string>54</string>
+    <string>61</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -12,6 +12,12 @@ struct LoginWebView: NSViewRepresentable {
 
         let webView = WKWebView(frame: .zero, configuration: config)
         webView.navigationDelegate = context.coordinator
+
+        // KVO on url catches SPA pushState navigations that don't fire didFinish
+        context.coordinator.urlObservation = webView.observe(\.url, options: [.new]) { [weak coordinator = context.coordinator] wv, _ in
+            coordinator?.checkCurrentURL(wv.url?.absoluteString)
+        }
+
         webView.load(URLRequest(url: URL(string: "https://claude.ai/login")!))
         return webView
     }
@@ -25,27 +31,25 @@ struct LoginWebView: NSViewRepresentable {
     class Coordinator: NSObject, WKNavigationDelegate {
         let onAuthenticated: () -> Void
         var didAuthenticate = false
+        var urlObservation: NSKeyValueObservation?
 
         init(onAuthenticated: @escaping () -> Void) {
             self.onAuthenticated = onAuthenticated
         }
 
-        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+        func checkCurrentURL(_ url: String?) {
-            guard !didAuthenticate else { return }
+            guard !didAuthenticate, let url else { return }
-            // Don't fire on the login/auth pages themselves
+            if url.contains("/login") || url.contains("/auth") { return }
-            if let url = webView.url?.absoluteString,
+            didAuthenticate = true
-               url.contains("/login") || url.contains("/auth") { return }
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-
+                self.onAuthenticated()
-            // URL is not a login/auth page, so if any claude.ai cookie exists we're signed in
-            WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
-                guard hasAnyCookie, !self.didAuthenticate else { return }
-                self.didAuthenticate = true
-                DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                    self.onAuthenticated()
-                }
             }
         }
+
+        // Covers full cross-document navigations
+        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+            checkCurrentURL(webView.url?.absoluteString)
+        }
     }
 }
 

ClaudeChecker/UsageViewModel.swift

@@ -30,6 +30,13 @@ class UsageViewModel: ObservableObject {
     private var previousPercents: [String: Double] = [:]
     private var firedThresholds: [String: Set<Int>] = [:]
 
+    // Background WKWebView used for all API calls — runs fetch() in the page's auth context
+    private var apiWebView: WKWebView?
+    private var apiDelegate: APIWebViewDelegate?
+    // Tracks whether the background WebView has finished its current navigation
+    private var apiWebViewLoaded = false
+    private var apiReadyContinuations: [CheckedContinuation<Void, Never>] = []
+
     init() {
         let saved = UserDefaults.standard.double(forKey: "refresh_interval")
         refreshInterval = saved > 0 ? saved : 60
@@ -38,20 +45,86 @@ class UsageViewModel: ObservableObject {
             burnHistoryStore = saved
         }
         loadPlaceholderData()
+        setupAPIWebView()
         Task { await checkInitialSignInState() }
     }
 
+    // MARK: - Background API WebView
+
+    private func setupAPIWebView() {
+        let config = WKWebViewConfiguration()
+        config.websiteDataStore = WKWebsiteDataStore.default()
+        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
+        let del = APIWebViewDelegate()
+        del.onNavigationEnd = { [weak self] in
+            guard let self else { return }
+            self.apiWebViewLoaded = true
+            self.resumeAPIReadyContinuations()
+        }
+        wv.navigationDelegate = del
+        apiWebView = wv
+        apiDelegate = del
+        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
+    }
+
+    private func resumeAPIReadyContinuations() {
+        let pending = apiReadyContinuations
+        apiReadyContinuations.removeAll()
+        pending.forEach { $0.resume() }
+    }
+
+    // Suspends until the background WebView has finished loading.
+    private func waitForAPIWebViewReady() async {
+        guard !apiWebViewLoaded else { return }
+        await withCheckedContinuation { cont in
+            apiReadyContinuations.append(cont)
+        }
+    }
+
+    // Called after login: reloads the background WebView to pick up the new session, then refreshes.
+    func reloadAPIWebViewAndRefresh() async {
+        guard let wv = apiWebView, let del = apiDelegate else {
+            await refresh()
+            return
+        }
+        // Reset readiness and wire up the reload callback before starting the load
+        apiWebViewLoaded = false
+        del.onNavigationEnd = { [weak self] in
+            guard let self else { return }
+            self.apiWebViewLoaded = true
+            self.resumeAPIReadyContinuations()
+        }
+        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
+        await waitForAPIWebViewReady()
+        // Brief pause for the page's JS auth state to settle after navigation
+        try? await Task.sleep(nanoseconds: 500_000_000)
+        await refresh()
+    }
+
+    // Runs a fetch() call inside the background WebView's page context (same-origin, credentials included).
+    private func webViewFetch(_ path: String) async throws -> (statusCode: Int, body: String) {
+        guard let wv = apiWebView else { throw AppError.networkError }
+        // Wait until the WebView has finished loading claude.ai so fetch() has a valid auth context
+        await waitForAPIWebViewReady()
+        let js = "const r = await fetch(path, {credentials:'include'}); return {s: r.status, b: await r.text()};"
+        let result = try await wv.callAsyncJavaScript(
+            js, arguments: ["path": path], in: nil, in: .page)
+        guard let d = result as? [String: Any],
+              let s = (d["s"] as? NSNumber)?.intValue,
+              let b = d["b"] as? String else { throw AppError.networkError }
+        return (s, b)
+    }
+
     private func checkInitialSignInState() async {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
+        if !cookies.isEmpty { isSignedIn = true }
-        if hasAnyCookie { isSignedIn = true }
     }
 
     func signOut() async {
         let store = WKWebsiteDataStore.default()
         let types = WKWebsiteDataStore.allWebsiteDataTypes()
         let records = await store.dataRecords(ofTypes: types)
-        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") }
+        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
         isSignedIn = false
@@ -62,6 +135,16 @@ class UsageViewModel: ObservableObject {
         extraUsage = nil
         prepaidCredits = nil
         overageSpendLimit = nil
+        // Reload background WebView to clear its session too
+        apiWebViewLoaded = false
+        if let del = apiDelegate {
+            del.onNavigationEnd = { [weak self] in
+                guard let self else { return }
+                self.apiWebViewLoaded = true
+                self.resumeAPIReadyContinuations()
+            }
+        }
+        apiWebView?.load(URLRequest(url: URL(string: "https://claude.ai")!))
     }
 
     func refresh() async {
@@ -109,6 +192,7 @@ class UsageViewModel: ObservableObject {
             checkLimitNotifications(for: limits)
         } catch AppError.notAuthenticated {
             isNotAuthenticated = true
+            isSignedIn = false
             errorMessage = "Not signed in"
         } catch let error as DecodingError {
             switch error {
@@ -128,48 +212,27 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Bootstrap (org ID + email + plan label in one call)
 
-    private func claudeAPIRequest(for url: URL) async -> URLRequest {
-        var req = URLRequest(url: url)
-        req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept")
-        req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent")
-        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
-        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
-        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
-        req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode")
-        req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest")
-        if let cookie = await claudeCookieHeader() {
-            req.setValue(cookie, forHTTPHeaderField: "Cookie")
-        }
-        return req
-    }
-
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
-        let url = URL(string: "https://claude.ai/api/bootstrap")!
+        let (status, body) = try await webViewFetch("/api/bootstrap")
-        var req = await claudeAPIRequest(for: url)
+        if status == 401 || status == 403 { throw AppError.notAuthenticated }
-        guard req.value(forHTTPHeaderField: "Cookie") != nil else { throw AppError.notAuthenticated }
+        guard status == 200 else { throw AppError.networkError }
-        let (data, response) = try await URLSession.shared.data(for: req)
+        guard let data = body.data(using: .utf8),
-        guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
-        if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
-        guard http.statusCode == 200 else { throw AppError.networkError }
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             return (nil, nil, nil)
         }
 
         let account  = json["account"] as? [String: Any]
-        // memberships may live under account or at root (older API shape)
         let memberships = (account?["memberships"] ?? json["memberships"]) as? [[String: Any]]
         let firstOrg = memberships?.first?["organization"] as? [String: Any]
 
-        // org ID — primary path then flat-list fallback then dedicated endpoint
         var orgId: String? = firstOrg?["uuid"] as? String
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
         if orgId == nil {
-            // Final fallback: fetch /api/organizations directly
+            if let (orgsStatus, orgsBody) = try? await webViewFetch("/api/organizations"),
-            let orgsReq = await claudeAPIRequest(for: URL(string: "https://claude.ai/api/organizations")!)
+               orgsStatus == 200,
-            if let (orgsData, orgsResp) = try? await URLSession.shared.data(for: orgsReq),
+               let orgsData = orgsBody.data(using: .utf8),
-               let orgsHttp = orgsResp as? HTTPURLResponse, orgsHttp.statusCode == 200,
                let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
                 orgId = orgs.first?["uuid"] as? String
             }
@@ -177,7 +240,6 @@ class UsageViewModel: ObservableObject {
 
         let email = account?["email_address"] as? String
 
-        // plan label from capabilities e.g. "claude_pro" -> "Pro"
         var planLabel: String? = nil
         if let caps = firstOrg?["capabilities"] as? [String],
            let cap = caps.first(where: { $0.hasPrefix("claude_") }) {
@@ -190,35 +252,25 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Fetch usage
 
-    private func claudeCookieHeader() async -> String? {
-        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
-        return HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"]
-    }
-
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
+        let (status, body) = try await webViewFetch("/api/organizations/\(orgId)/usage")
-        let req = await claudeAPIRequest(for: url)
+        if status == 401 || status == 403 { throw AppError.notAuthenticated }
-        let (data, response) = try await URLSession.shared.data(for: req)
+        guard status == 200 else { throw AppError.networkError }
-        guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
+        guard let data = body.data(using: .utf8) else { throw AppError.networkError }
-        if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
-        guard http.statusCode == 200 else { throw AppError.networkError }
         return try JSONDecoder().decode(UsageResponse.self, from: data)
     }
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
+        guard let (status, body) = try? await webViewFetch("/api/organizations/\(orgId)/prepaid/credits"),
-        let req = await claudeAPIRequest(for: url)
+              status == 200,
-        let (data, response) = try await URLSession.shared.data(for: req)
+              let data = body.data(using: .utf8) else { return nil }
-        guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
     }
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
-        let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
+        guard let (status, body) = try? await webViewFetch("/api/organizations/\(orgId)/overage_spend_limit"),
-        let req = await claudeAPIRequest(for: url)
+              status == 200,
-        let (data, response) = try await URLSession.shared.data(for: req)
+              let data = body.data(using: .utf8) else { return nil }
-        guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)
     }
 
@@ -335,6 +387,23 @@ class UsageViewModel: ObservableObject {
     }
 }
 
+// MARK: - API WebView Delegate
+
+private class APIWebViewDelegate: NSObject, WKNavigationDelegate {
+    // Called on every didFinish / didFail — not cleared after firing, so subsequent navigations also trigger it
+    var onNavigationEnd: (() -> Void)?
+
+    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+        onNavigationEnd?()
+    }
+    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
+        onNavigationEnd?()
+    }
+    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
+        onNavigationEnd?()
+    }
+}
+
 enum AppError: LocalizedError {
     case notAuthenticated
     case networkError

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.5-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.5) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.12-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.12) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,9 +1,13 @@
 ## What's new in v1.2.1
 
 ### Bug fixes
+- Fixed a timing race in the background API WebView — `refresh()` now correctly waits for the WebView to finish loading before making API calls, preventing silent failures on startup
+- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, httpOnly tokens, etc.) are included automatically
+- Fixed "Not signed in" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh
 - Fixed "Not signed in" showing incorrectly on launch when the session was already active
 - Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
 - Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
 - Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
 - Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Fixed usage data not loading after sign-in — API requests now include required browser-like headers (Origin, Referer, User-Agent) that Claude's usage endpoints require
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails
+- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.5",
+  "version": "1.2.1-beta.12",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.5/ClaudeChecker.zip",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.12/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it"
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed usage data not loading after sign-in — API calls now run inside a persistent background WebView using the page's own fetch(), so all credentials (cookies, localStorage tokens, etc.) are included automatically\n- Fixed \"Not signed in\" showing after login — the background WebView is now reloaded after sign-in to pick up the new session before the first data refresh\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails\n- Rewrote login detection to use KVO on the WebView URL — correctly detects auth for Next.js SPA navigation (history.pushState) that doesn't trigger didFinish"
 }