release 1.3.2: anchor primer WebView in hidden window for reliable startup fetch

Every launch now loads claude.ai in a real (off-screen, invisible) NSWindow so
WebKit doesn't throttle JS execution. The nav delegate fires adoptPrimerWebView
once the page loads, replacing the old 1.5 s sleep-then-refresh approach.

ClaudeChecker/ClaudeCheckerApp.swift

@@ -18,16 +18,43 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     var updateManager = UpdateManager()
     var refreshTimer: Timer?
     var cookiePrimerView: WKWebView?
+    var cookiePrimerWindow: NSWindow?
+    var primerNavDelegate: PrimerNavDelegate?
     var cancellables = Set<AnyCancellable>()
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
 
-        // Hidden WKWebView to prime the shared cookie store
+        // Background WebView that loads claude.ai on every launch.
+        // Anchored in a real (off-screen, invisible) NSWindow so WebKit doesn't throttle
+        // JS execution. When the page finishes loading the nav delegate calls
+        // adoptPrimerWebView, which sets it as the API WebView and runs the first fetch.
         let config = WKWebViewConfiguration()
         config.websiteDataStore = WKWebsiteDataStore.default()
-        cookiePrimerView = WKWebView(frame: .zero, configuration: config)
-        cookiePrimerView?.load(URLRequest(url: URL(string: "https://claude.ai")!))
+        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
+        let win = NSWindow(
+            contentRect: NSRect(x: -9999, y: -9999, width: 1, height: 1),
+            styleMask: [],
+            backing: .buffered,
+            defer: false
+        )
+        win.contentView = wv
+        win.alphaValue = 0
+        win.orderFront(nil)
+        cookiePrimerWindow = win
+        cookiePrimerView = wv
+
+        let delegate = PrimerNavDelegate { [weak self] in
+            guard let self, let wv = self.cookiePrimerView else { return }
+            Task { @MainActor [weak self] in
+                guard let self else { return }
+                await self.usageViewModel.adoptPrimerWebView(wv)
+                await self.updateManager.checkForUpdates()
+            }
+        }
+        primerNavDelegate = delegate
+        wv.navigationDelegate = delegate
+        wv.load(URLRequest(url: URL(string: "https://claude.ai")!))
 
         // Status item
         statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
@@ -134,12 +161,6 @@ class AppDelegate: NSObject, NSApplicationDelegate {
             }
         }
 
-        // Initial fetch after cookie primer + update check
-        Task {
-            try? await Task.sleep(nanoseconds: 1_500_000_000)
-            await usageViewModel.refresh()
-            await updateManager.checkForUpdates()
-        }
     }
 
     private func setMenubarIcon(button: NSStatusBarButton) {
@@ -240,4 +261,13 @@ class AppDelegate: NSObject, NSApplicationDelegate {
 
 }
 
-
+// One-shot WKNavigationDelegate: fires onDone on first finish or error, then goes silent.
+final class PrimerNavDelegate: NSObject, WKNavigationDelegate {
+    private var done = false
+    private let onDone: () -> Void
+    init(_ onDone: @escaping () -> Void) { self.onDone = onDone }
+    private func finish() { guard !done else { return }; done = true; onDone() }
+    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { finish() }
+    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) { finish() }
+    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) { finish() }
+}

ClaudeChecker/DiagnosticsView.swift

@@ -66,36 +66,6 @@ struct DiagnosticsView: View {
 
                     Divider()
 
-                    // Bootstrap body
-                    if !vm.diagBootstrapBody.isEmpty {
-                        DiagSection(title: "Bootstrap Response (first 500 chars)") {
-                            Text(vm.diagBootstrapBody)
-                                .font(.system(size: 10, design: .monospaced))
-                                .foregroundColor(.secondary)
-                                .textSelection(.enabled)
-                                .frame(maxWidth: .infinity, alignment: .leading)
-                                .padding(8)
-                                .background(Color.primary.opacity(0.04))
-                                .cornerRadius(5)
-                        }
-                        Divider()
-                    }
-
-                    // Response body
-                    if !vm.diagLastBody.isEmpty {
-                        DiagSection(title: "Last API Response (first 500 chars)") {
-                            Text(vm.diagLastBody)
-                                .font(.system(size: 10, design: .monospaced))
-                                .foregroundColor(.secondary)
-                                .textSelection(.enabled)
-                                .frame(maxWidth: .infinity, alignment: .leading)
-                                .padding(8)
-                                .background(Color.primary.opacity(0.04))
-                                .cornerRadius(5)
-                        }
-                        Divider()
-                    }
-
                     // Cookie summary
                     DiagSection(title: "Cookie Store") {
                         DiagRow("Total cookies",       "\(vm.diagCookieCount)")
@@ -190,11 +160,6 @@ struct DiagnosticsView: View {
         lines.append("Claude cookies: \(vm.diagClaudeCookieCount)")
         lines.append("Domains: \(vm.diagCookieDomains.joined(separator: ", "))")
         lines.append("")
-        lines.append("Bootstrap body:")
-        lines.append(vm.diagBootstrapBody)
-        lines.append("")
-        lines.append("Last API response:")
-        lines.append(vm.diagLastBody)
         lines.append("")
         lines.append("Live cookies:")
         for c in liveAllCookies {

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.3.0</string>
+    <string>1.3.2</string>
     <key>CFBundleVersion</key>
-    <string>74</string>
+    <string>76</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/UsageViewModel.swift

@@ -32,7 +32,6 @@ class UsageViewModel: ObservableObject {
 
     // WebView used for JS-based API calls (avoids URLSession 403 fingerprinting issues)
     private var apiWebView: WKWebView?
-    private var navWaiter: WKNavWaiter?
 
     // Diagnostics
     @Published var diagCookieCount: Int = 0
@@ -40,10 +39,8 @@ class UsageViewModel: ObservableObject {
     @Published var diagCookieDomains: [String] = []
     @Published var diagLastPath: String = ""
     @Published var diagLastStatus: Int = 0
-    @Published var diagLastBody: String = ""
     @Published var diagLastError: String = ""
     @Published var diagLastActiveOrg: String = ""   // lastActiveOrg cookie value from JS
-    @Published var diagBootstrapBody: String = ""   // raw bootstrap response (first 500 chars)
     @Published var diagLastFetch: Date? = nil
 
     init() {
@@ -57,38 +54,24 @@ class UsageViewModel: ObservableObject {
         Task { await checkInitialSignInState() }
     }
 
-    // Called after login: store the webview (already on claude.ai) so jsFetch can use it.
+    // Called by AppDelegate once the primer WebView has loaded claude.ai.
+    // Sets it as the API WebView and triggers the first data fetch.
+    func adoptPrimerWebView(_ wv: WKWebView) async {
+        apiWebView = wv
+        await refresh()
+    }
+
+    // Called after login: store the login WebView (already on claude.ai) so jsFetch can use it.
     func adoptAndRefresh(_ loginWebView: WKWebView) async {
         for _ in 0..<30 {
             let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
             if cookies.contains(where: { $0.domain.contains("claude.ai") }) { break }
             try? await Task.sleep(nanoseconds: 300_000_000)
         }
-        if loginWebView.url?.host?.hasSuffix("claude.ai") == true {
         apiWebView = loginWebView
-        } else {
-            await prepareApiWebView()
-        }
         await refresh()
     }
 
-    // Creates (or reuses) a background WKWebView navigated to claude.ai for JS fetch.
-    private func prepareApiWebView() async {
-        if let wv = apiWebView, wv.url?.host?.hasSuffix("claude.ai") == true { return }
-        let config = WKWebViewConfiguration()
-        config.websiteDataStore = WKWebsiteDataStore.default()
-        let wv = WKWebView(frame: CGRect(x: 0, y: 0, width: 1, height: 1), configuration: config)
-        apiWebView = wv
-        await withCheckedContinuation { (cont: CheckedContinuation<Void, Never>) in
-            let waiter = WKNavWaiter { cont.resume() }
-            self.navWaiter = waiter
-            wv.navigationDelegate = waiter
-            wv.load(URLRequest(url: URL(string: "https://claude.ai/")!))
-        }
-        wv.navigationDelegate = nil
-        navWaiter = nil
-    }
-
     // Runs a fetch() inside the live claude.ai WebView — same browser context as the frontend,
     // so no CORS/fingerprinting issues that URLSession hits.
     private func jsFetch(_ path: String) async throws -> (Int, String) {
@@ -117,7 +100,6 @@ class UsageViewModel: ObservableObject {
         diagLastPath = path
         diagLastFetch = Date()
         diagLastStatus = status
-        diagLastBody = String(body.prefix(500))
         diagLastError = status != 200 ? "JS HTTP \(status)" : ""
         return (status, body)
     }
@@ -181,7 +163,6 @@ class UsageViewModel: ObservableObject {
             guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
             let body = String(data: data, encoding: .utf8) ?? ""
             diagLastStatus = http.statusCode
-            diagLastBody   = String(body.prefix(500))
             if http.statusCode != 200 {
                 diagLastError = "HTTP \(http.statusCode)"
             }
@@ -198,8 +179,8 @@ class UsageViewModel: ObservableObject {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
         guard cookies.contains(where: { $0.domain.contains("claude.ai") }) else { return }
         isSignedIn = true
-        await prepareApiWebView()
-        await refresh()
+        // AppDelegate's primer WebView will call adoptPrimerWebView once it loads,
+        // which triggers the first real data fetch.
     }
 
     func signOut() async {
@@ -315,7 +296,6 @@ class UsageViewModel: ObservableObject {
         guard body.trimmingCharacters(in: .whitespacesAndNewlines).hasPrefix("{") else {
             throw AppError.detail("Non-JSON response (HTML?): \(body.prefix(80))")
         }
-        diagBootstrapBody = String(body.prefix(500))
         guard let data = body.data(using: .utf8),
               let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             return (nil, nil, nil)
@@ -491,16 +471,6 @@ class UsageViewModel: ObservableObject {
 }
 
 
-// Navigation delegate that resolves a continuation on first finish/error (idempotent).
-private class WKNavWaiter: NSObject, WKNavigationDelegate {
-    private var done = false
-    private let onDone: () -> Void
-    init(_ onDone: @escaping () -> Void) { self.onDone = onDone }
-    private func finish() { guard !done else { return }; done = true; onDone() }
-    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { finish() }
-    func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) { finish() }
-    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) { finish() }
-}
 
 enum AppError: LocalizedError {
     case notAuthenticated

README.md

@@ -8,9 +8,9 @@
 
 [![macOS](https://img.shields.io/badge/macOS-13.0+-000000?style=flat&logo=apple&logoColor=white)](https://www.apple.com/macos/)
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
-[![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
+[![Version](https://img.shields.io/badge/version-1.3.1-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.25-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.25) <!-- BETA_BADGE -->
+<!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,12 +1,4 @@
-## What's new in v1.3.0
+## What's new in v1.3.2
 
-### Multi-org support
-- App now uses the `lastActiveOrg` cookie to identify which organisation is active, matching exactly what the claude.ai frontend does. Previously the app always picked the first org returned by bootstrap, which is the personal "Individual Org" for users with multiple organisations — causing persistent 403 errors on all usage endpoints.
-- Plan label (e.g. **Max**, **Pro**, **Team**) now reads capabilities from the active org, not the first membership.
-
-### Reliable API access via WebView
-- All API calls now run through `WKWebView.callAsyncJavaScript`, making real same-origin browser requests instead of URLSession. Claude.ai's org-specific endpoints reject native HTTP clients (403) even with correct cookies and headers; running inside the browser context passes all server-side checks.
-- A background WebView is created at startup when session cookies are detected, so usage data loads immediately without requiring a manual sign-in.
-
-### Diagnostics
-- New **Diagnostics** panel in Settings shows cookie store, last API request/response, bootstrap body, and the `lastActiveOrg` cookie value — making it easy to report issues.
+### Reliability
+- Data now loads automatically on every app launch without requiring manual re-authentication. The background WebView is anchored in a hidden window so macOS no longer throttles its JavaScript execution.

version.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.0",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.0/ClaudeChecker.zip",
-  "notes": "## What's new in v1.2.0\n\n### Bug fixes\n- App now works for all users — org ID is fetched dynamically from the API instead of being hardcoded\n- Plan name (e.g. Pro, Max) now updates correctly on every refresh\n\n### Improvements\n- Plan name is read from the API rather than hardcoded\n- Bootstrap API call consolidated — org ID, email, and plan name fetched in a single request per refresh\n- Main panel no longer scrolls — popover auto-sizes to fit content\n- Session Diary card redesigned — sample count and avg burn rate shown left/right above the sparkline, Claude header removed"
+  "version": "1.3.1",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.3.1/ClaudeChecker.zip",
+  "notes": "## What's new in v1.3.1\n\n### Privacy\n- Diagnostics panel no longer displays API response bodies, which could contain account and financial data. Status codes, error messages, cookie names, and request paths are still shown."
 }