docs(readme): describe Claude Code on the web sync and phone-side counting

README.ja.md

@@ -64,6 +64,8 @@ PokeTokenBar は、あなたがすでに使っている AI コーディングト
 - **ホーム & ロック画面ウィジェット**:
   - **ホーム画面（中サイズ）**: リアルタイムのトークン使用量、コスト、パートナーアイコン、プロバイダーごとの上限ゲージ。
   - **ロック画面**: 円形パートナースプライト、長方形の進化/経験値バー、インライントークン概要。
+- **Mac がオフでも自前で集計**: Mac が Claude の使用量台帳をプライベート iCloud データベースに公開し、iPhone とウィジェットがそこから今日/週/月のトークン・コスト・burn rate を再計算します — Mac がスリープ中でも数値は最新のままです。
+- **Web 版 Claude Code**: Web 版 Claude Code のセッションは使い捨てのクラウドコンテナで動くため、ログが Mac に届きません。オプションのフックが各ターンの使用量を Mac と iPhone だけが持つ鍵で暗号化してアップロードし、両デバイスがローカルの使用量と合わせて集計します。セットアップは [`docs/reference/cloud-session-sync.md`](docs/reference/cloud-session-sync.md)（Mac 設定 → Claude Code on the web）を参照してください。
 - **iCloud CloudKit & ローカル同期**:
   - **iCloud（デフォルト）**: 更新ごとにプライベート iCloud に軽量スナップショットをプッシュ — 設定不要でセルラー回線や異なる Wi-Fi 間でもシームレスに同期。
   - **ローカルネットワークフォールバック**: 同一 Wi-Fi 環境ではペアリングコード保護されたローカル HTTP/Bonjour エンドポイントをサポート。

README.ko.md

@@ -64,6 +64,8 @@ PokeTokenBar는 당신이 이미 태우고 있는 AI 코딩 토큰(Claude Code 
 - **홈 & 잠금 화면 위젯**:
   - **홈 화면(중간 크기)**: 실시간 토큰 사용량, 비용, companion 아이콘, 프로바이더별 한도 게이지.
   - **잠금 화면**: 원형 companion 스프라이트, 직사각형 진화/경험치 바, 인라인 토큰 요약.
+- **Mac이 꺼져 있어도 직접 집계**: Mac이 Claude 사용량 원장을 개인 iCloud 데이터베이스에 올리고, iPhone과 위젯이 이를 바탕으로 오늘/주/월 토큰·비용·burn rate를 직접 다시 계산합니다 — Mac이 잠자는 동안에도 숫자가 최신으로 유지됩니다.
+- **웹의 Claude Code**: 웹의 Claude Code 세션은 일회용 클라우드 컨테이너에서 실행되어 로그가 Mac에 닿지 않습니다. 선택형 훅이 매 턴의 사용량을 Mac과 iPhone만 가진 키로 암호화해 올리고, 두 기기가 로컬 사용량과 함께 집계합니다. 설정 방법은 [`docs/reference/cloud-session-sync.md`](docs/reference/cloud-session-sync.md)(Mac 설정 → Claude Code on the web)를 참고하세요.
 - **iCloud CloudKit & 로컬 동기화**:
   - **iCloud(기본)**: 갱신 시마다 개인 iCloud 저장소로 암호화된 스냅샷을 푸시 — 별도 설정 없이 셀룰러나 다른 Wi-Fi에서도 완벽 작동.
   - **로컬 네트워크 폴백**: 같은 Wi-Fi 환경에서는 페어링 코드로 보안된 로컬 HTTP/Bonjour 엔드포인트 지원.

README.md

@@ -66,8 +66,23 @@ Take your companion and token metrics wherever you go. This fork includes an uno
 - **iCloud CloudKit & Local Sync**:
   - **iCloud (Default)**: Pushes lightweight snapshots to your private iCloud container on every refresh — works across cellular and different Wi-Fi networks with zero configuration.
   - **Local Network Fallback**: Mac can serve a lightweight local HTTP endpoint with pairing-code security published via Bonjour.
+- **Counts on its own, even with the Mac off**: The Mac publishes a Claude usage ledger to your private iCloud database, and the iPhone and widget recount today/week/month tokens, cost, and burn rate from it — so the numbers stay current while the Mac is asleep.
+- **Claude Code on the web**: Sessions in Claude Code on the web run in disposable cloud containers, so their logs never reach your Mac. An optional hook uploads each turn's usage, encrypted to a key only your Mac and iPhone hold, and both devices count it alongside local usage. See [Claude Code on the web sync](#claude-code-on-the-web-sync) below.
 - **Instant Cold Start & Offline Mode**: Locally caches the latest payload so the app opens instantly with 0ms delay even when offline.
 
+### Claude Code on the web sync
+
+Optional, one-time setup:
+
+1. Deploy the small Cloudflare Worker relay in [`scripts/cloud-session-sync/relay`](scripts/cloud-session-sync/relay). It holds the CloudKit server-to-server key, so no secret lives in the cloud container.
+2. On the Mac, open **Settings → Claude Code on the web → Create key** and copy the public key. The private key stays on the Mac and syncs to your iPhone through your private iCloud database.
+3. In your Claude Code on the web environment, set `PTB_SYNC_PUBLIC_KEY` and `PTB_RELAY_URL`, add the relay token as an **API credential** for the relay's host (the proxy attaches it; sessions never see it), and add this to the setup script:
+   ```bash
+   curl -fsSL https://raw.githubusercontent.com/cte13/PokeTokenBar-iOS/main/scripts/cloud-session-sync/install.sh | bash
+   ```
+
+After each turn the hook trims the transcript to usage lines only (no prompts or code), seals it to your public key, and uploads only the changed chunks. The Mac mirrors those records into its Claude scan, and the iPhone pulls them directly, so cloud turns count toward totals, cost, burn rate, and your companion. Full design, CloudKit schema, and setup details: [`docs/reference/cloud-session-sync.md`](docs/reference/cloud-session-sync.md).
+
 ## Why
 
 - **The usage tracker you actually enjoy opening.** Your spend raises a Pokémon that hatches, evolves, graduates, and fills a Pokédex — and every shiny is a reason to check back.
@@ -210,7 +225,8 @@ Reset countdowns include the clock time, and the colored percentage stays aligne
 - **Several Claude accounts** — Claude Code logins kept in their own config folder (`CLAUDE_CONFIG_DIR`) each get a tab under the official limits, with their own gauges, Rare Candy, alerts, and today/month tokens. `~/.claude-*` folders and an exported `CLAUDE_CONFIG_DIR` are found automatically; add others in Settings → Advanced. The menu bar percentage, companion mood, and forecast follow the account you used last (Settings → General → Tracked Claude account). Each account can take its own claude.ai session key (Settings → Advanced), so its limits keep refreshing without the Keychain.
 - **Burn-rate forecast** — projects when the current 5h window hits 100%.
 - **In-app updates** — one-click update check; current version shown in Settings.
-- **iOS companion app** *(this fork)* — syncs from the Mac app via iCloud (or your local network) and shows token usage and cost (today/week/month), burn-rate forecast, rate limits per provider (Claude, Codex, OpenCode Go, Antigravity) with the Mac's own warning thresholds, your companion with its status line and evolution line, plus read-only Shop, Bag, and Collection tabs. UI localized in English, Korean, Japanese, and Spanish.
+- **iOS companion app** *(this fork)* — syncs from the Mac app via iCloud (or your local network), recounts Claude usage itself from an iCloud ledger when the Mac is off, and shows token usage and cost (today/week/month), burn-rate forecast, rate limits per provider (Claude, Codex, OpenCode Go, Antigravity) with the Mac's own warning thresholds, your companion with its status line and evolution line, plus read-only Shop, Bag, and Collection tabs. UI localized in English, Korean, Japanese, and Spanish.
+- **Claude Code on the web** *(this fork)* — an optional hook uploads cloud-session usage, encrypted end to end, so it counts on the Mac and iPhone like local sessions.
 - **WidgetKit extension** *(this fork)* — a medium home-screen widget with your companion sprite, today/week usage, cost, and a utilization bar per rate-limit window (with reset countdowns) — no network required once data is synced.
 - **Usage recap** — a Pokédex-style recap of any week, month or year you step back to (total, meters, comparison with the previous period, day for day while it is still running, best day, best streak, graduations). History is kept locally for this year and the last.
 
@@ -303,6 +319,7 @@ If a provider's logs live **outside** those built-in paths, add the folder in **
 - **Outbound requests.** The app is not fully offline. It talks to thirteen hosts: `pokeapi.co` and `graphql.pokeapi.co` (species/evolution), `raw.githubusercontent.com` (sprites), `api.anthropic.com` (Claude official limits), `claude.ai` (Claude official limits when you save an optional claude.ai session key in Settings — the key only, no prompts or project paths), `cursor.com` (Cursor usage summary when you are signed into Cursor locally — session credential only, no prompts or project paths), `api2.cursor.sh` (Cursor official monthly included usage — Bearer JWT only, same credential class as the IDE login), `cloudcode-pa.googleapis.com` and `daily-cloudcode-pa.googleapis.com` (Antigravity official limits) plus `oauth2.googleapis.com` (their token refresh), `status.claude.com` and `status.openai.com` (incident banner — off switch in Settings), and `api.github.com` (update check). **None of them carry your usage logs, prompts, or project paths** — only the request itself (Cursor sends your session cookie to fetch your own usage rows, same as the web dashboard).
 - **Keychain (optional).** The Claude OAuth credential is read **only when you press a refresh button** (Settings, or the limits row in the popover). Automatic polling never touches the Keychain, so it never raises a password prompt; when `~/.claude/.credentials.json` is present, each poll re-reads it, so an in-place `/login` to another account is picked up without pressing refresh. The token is held in memory only — the app creates no Keychain item of its own. If there is no credentials file, limits stay on the cached token until it expires or you refresh. Turn it off in Settings — the limits section simply hides. With several Claude accounts, a refresh also reads each other config folder's own item, once per folder, and a declined prompt stops the remaining ones.
 - **iPhone companion server (optional, off by default).** Turning it on opens an HTTP listener on port 7845 that serves your usage, limits, plan tier, and companion state. It binds every interface and advertises itself over Bonjour, because the phone reaches it across the local network — so it is protected by a **pairing code** instead. The Mac shows the code in **Settings → iPhone Connection**; enter it once on the phone. Requests without the code get `401`, and the response carries no CORS header, so a web page you visit cannot read it either. Regenerate the code any time it may have been seen.
+- **Claude Code on the web sync (optional, off until you set it up).** The hook in the cloud container sends usage lines only — token counts, model, timestamps, and ids; no prompts, code, or file contents — sealed with X25519 + AES-256-GCM to a public key whose private half exists only on your Mac and in your private iCloud database. The relay and CloudKit's public database only ever see ciphertext. The container holds no secret: the public key is not sensitive, and the relay token is attached by the environment's proxy.
 - **Pokémon data and assets** are fetched at runtime from PokéAPI and cached only under `~/Library/Application Support/PokeTokenBar/`. Generated individual values (such as IVs, gender, ability and known moves) are stored in the local companion save so they remain stable. The app binary and its release artifacts contain no Pokémon assets.
 
 ## Contributors