CC Logins v0.1.0

Added

• Tray application showing 5-hour and 7-day quota per Claude Code account, with a
  live tray icon rasterised at runtime rather than a static image.
• Manual and automatic switching between accounts. Auto-switch is off by default and
  gives a 60-second cancellable countdown before it fires.
• Local usage history in SQLite, with burn-rate charts over days and weeks.
• Interactive sign-in that runs claude auth login in an isolated
  CLAUDE_CONFIG_DIR, so the live login is never disturbed.
• In-place re-login for rejected OAuth accounts. The selected slot, alias, and
  account metadata are preserved, and the replacement is accepted only when
  the isolated login resolves to the same account identity.
• WSL awareness on Windows: native and per-distro logins are detected as separate
  environments, and a stopped distro is never woken by a background poll.
• Refresh control on the Accounts screen and in the tray popover, rate-limited in the
  backend so it cannot outpace the poller.
• Day / night / system theme.
• Cross-process file locking for account, credential, and configuration stores, verified by
  Rust/Rust and protocol-level interoperability tests.
• Recoverable account switching with Claude Code-compatible credential/config locks,
  protected before-images, a secret-free durable journal, exact rollback, startup
  recovery, an explicit recoveryRequired UI state, and backend-enforced blocking
  of every credential or account-registry mutation until recovery succeeds.
• Switch-time credential provenance checks: live bytes proven
  to belong to a different or recycled account are preserved in the unclaimed safety
  store and never written over the configured outgoing slot; an unavailable identity
  oracle retains fail-open rotation behavior.
• Active usage attribution: a credential accepted by the usage
  endpoint is not assigned to the configured slot when the profile oracle proves it
  belongs to another account; definitive lineage verdicts are memoized, while partial
  or unavailable oracle results remain retryable.
• Active OAuth recovery: expired or server-rejected active
  generations refresh under Claude-compatible credential locks, recheck account and
  lineage ownership before consuming a grant, and persist the successor to both the live
  credential and its slot backup. Exact invalid_grant results remain generation-bound.
• Active recovery now restores a definitively wiped live OAuth store from the slot backup, keeps
  read failures distinct from genuine absence, and shares the inactive path's per-account lease so
  a concurrent snapshot cannot consume the same rotating grant twice.

Security

• Stored credentials carry a self-describing envelope recording the protection
  actually applied: DPAPI on Windows, Keychain on macOS, and an unencrypted 0600
  file on Linux. Linux is a known gap and the envelope says so rather than implying
  otherwise.
• Builds are unsigned. See SECURITY.md.

---

Install

Pick the file for your platform from the assets below.

Platform	File
Windows	the -setup.exe
macOS (Apple Silicon and Intel)	the .dmg — one universal build covers both
Linux	the .AppImage, or the .deb on Debian/Ubuntu

These builds are unsigned

Windows SmartScreen and macOS Gatekeeper will warn before running them — see the
README's "Signing" section for what that means and why. Because nothing here carries
a signature, SHA256SUMS.txt is the only way to check that a download is the file
this workflow actually produced:

sha256sum --check --ignore-missing SHA256SUMS.txt   # Linux / macOS

# Windows — compare against the matching line in SHA256SUMS.txt
Get-FileHash .\<downloaded-file> -Algorithm SHA256

A checksum proves the file matches this release. It does not prove the release
itself is trustworthy — that still rests on the source in this repository and the
build log for this tag.