fix: NSNumber cast and use .page world in callAsyncJavaScript auth check

callAsyncJavaScript returns JS numbers as NSNumber (Double-backed).
'val as? Int' silently returns nil for 200.0, so onAuthenticated never
fired. Fixed with 'val as? NSNumber then .intValue == 200'.

Also switched content world from .defaultClient to .page so the fetch
runs in the same JS context as the loaded page.

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.8</string>
+    <string>1.2.1-beta.9</string>
     <key>CFBundleVersion</key>
-    <string>56</string>
+    <string>57</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -41,10 +41,12 @@ struct LoginWebView: NSViewRepresentable {
             // cookie domain or name.
             webView.callAsyncJavaScript(
                 "const r = await fetch('/api/bootstrap', {credentials: 'include'}); return r.status;",
-                arguments: [:], in: nil, in: .defaultClient
+                arguments: [:], in: nil, in: .page
             ) { [weak self] result in
                 guard let self, !self.didAuthenticate else { return }
-                if case .success(let val) = result, let status = val as? Int, status == 200 {
+                // JS numbers arrive as NSNumber (Double-backed), not Swift Int
+                if case .success(let val) = result,
+                   let n = val as? NSNumber, n.intValue == 200 {
                     self.didAuthenticate = true
                     DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) {
                         self.onAuthenticated()

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.7-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.7) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.8-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.8) <!-- BETA_BADGE -->
 
 </div>
 

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1-beta.7",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.7/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)\n- Fixed sign-in detection and cookie handling for accounts whose session cookies are on the `anthropic.com` domain rather than `claude.ai`\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails"
+  "version": "1.2.1-beta.8",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.8/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)\n- Fixed Settings incorrectly showing \"Signed in\" after a failed refresh — sign-in state now resets when authentication fails\n- Rewrote login detection to use the WebView's own fetch call instead of inspecting cookie domains — correctly detects auth regardless of which domain the session token is stored on\n- Fixed API requests not including session cookies — now sends all cookies from the app's WebView store rather than filtering by domain"
 }