claude-code-hub 0.39.0 → 0.41.0

package/README.md

@@ -99,6 +99,26 @@ The hub can run the tools against more than one Claude config dir (`CLAUDE_CONFI
 - Each dir gets its own set of the four tools. When you switch, the hub keeps the old set running, so switching back is instant. `--pool-size` sets how many sets stay alive (default 3). When the pool is full, the hub stops the least recently used set, but not a set whose Kanban has open terminals.
 - The list and the active dir are saved in `~/.claude-hub/config.json`.
 
+## Choose the tools
+
+By default the hub runs all four tools. To turn a tool off or change the tab order, add an `apps` list to `~/.claude-hub/config.json`:
+
+```json
+{
+  "apps": [
+    { "id": "kanban" },
+    { "id": "cost" },
+    { "id": "marketplace", "enabled": false }
+  ]
+}
+```
+
+- The ids are `kanban`, `marketplace`, `cost` and `memory`.
+- The tools you list come first, in list order. The tools you do not list follow in the default order.
+- A tool with `"enabled": false` does not start and gets no tab. Links from other tools to it do nothing.
+- With Kanban off, the embedded terminal is off, and the project palette has no project list. You can still type a path.
+- Restart the hub after you edit the file.
+
 ## Embedded terminal
 
 Under the hub, Kanban has an embedded terminal, on by default, so you can start or resume Claude Code sessions from the board. While a terminal is attached, the hub asks before it closes the window, because <kbd>Ctrl</kbd>+<kbd>W</kbd> meant for the terminal would close it.
@@ -126,6 +146,8 @@ The hub has no visible UI of its own. Use these shortcuts:
 | <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>P</kbd> | Project palette: set the project for all tools |
 | <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>W</kbd> | Config-dir palette: switch, add, or remove a config dir |
 
+<kbd>Alt</kbd>+<kbd>1</kbd> to <kbd>Alt</kbd>+<kbd>4</kbd> follow the tab order, so they change when you [choose the tools](#choose-the-tools).
+
 In a palette, use <kbd>↑</kbd>/<kbd>↓</kbd> or <kbd>Tab</kbd> to move, <kbd>Enter</kbd> to select, and <kbd>Esc</kbd> to close.
 
 The shortcuts also work when focus is inside a tool. Kanban keeps <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>N</kbd> (new session), <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>R</kbd> (resume session), and <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>S</kbd> (previous session) for itself. From Kanban you can also jump to another tool for the selected session:

package/lib/apps.js

@@ -0,0 +1,23 @@
+'use strict';
+
+// Built-in apps in their default tab order.
+const APPS = [
+  { id: 'kanban', dir: 'cck', pkg: 'claude-code-kanban', name: 'Kanban', icon: 'columns', port: 3541 },
+  { id: 'marketplace', dir: 'marketplace', pkg: 'claude-code-marketplace', name: 'Marketplace', icon: 'store', port: 3542 },
+  { id: 'cost', dir: 'cost', pkg: 'claude-code-cost', name: 'Cost', icon: 'dollar-sign', port: 3543 },
+  { id: 'memory', dir: 'memory', pkg: 'claude-code-memory-explorer', name: 'Memory Diagnoser', icon: 'database', port: 3544 },
+];
+
+// `entries` is the hand-edited `apps` list in config.json. Listed apps come first in list order and
+// unlisted ones follow in default order, so an app added in a later release shows up without an edit.
+function selectApps(entries = []) {
+  const listed = entries.filter((e) => typeof e?.id === 'string');
+  const byId = (id) => APPS.find((a) => a.id === id);
+  const unknown = listed.map((e) => e.id).filter((id) => !byId(id));
+  const off = new Set(listed.filter((e) => e.enabled === false).map((e) => e.id));
+  const order = new Set([...listed.map((e) => e.id), ...APPS.map((a) => a.id)]);
+  const apps = [...order].map(byId).filter((a) => a && !off.has(a.id));
+  return { apps, unknown };
+}
+
+module.exports = { selectApps };

package/lib/net-guard.js

@@ -245,7 +245,7 @@ function createNetGuard(config = {}) {
    * @param {{maxHeaderSize?: number, onUpgrade?: (req: any, socket: any, head: Buffer) => void}} [opts]
    */
   function listenLoopback(app, port, onReady, opts = {}) {
-    const http = require('http');
+    const http = require('node:http');
     const serverOpts = opts.maxHeaderSize ? { maxHeaderSize: opts.maxHeaderSize } : {};
     const makeServer = (handler) => {
       const s = http.createServer(serverOpts, handler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-hub",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "Unified hub for Claude Code tools — Marketplace + Kanban in one PWA",
   "main": "server.js",
   "bin": {
@@ -15,7 +15,11 @@
     "lint:fix": "npx @biomejs/biome check --fix public/app.js server.js",
     "prepare": "husky",
     "check:escaping": "node scripts/check-escaping.mjs",
-    "check:security-lib": "bash scripts/sync-security-lib.sh --check"
+    "check:security-lib": "bash scripts/sync-security-lib.sh --check",
+    "perf": "node scripts/perf.mjs run",
+    "perf:compare": "node scripts/perf.mjs compare",
+    "perf:report": "node scripts/perf.mjs report",
+    "perf:world": "node scripts/perf.mjs gen-world"
   },
   "repository": {
     "type": "git",
@@ -39,10 +43,10 @@
   },
   "homepage": "https://github.com/NikiforovAll/claude-code-hub#readme",
   "dependencies": {
-    "claude-code-cost": "^0.24.0",
-    "claude-code-kanban": "^4.28.0",
-    "claude-code-marketplace": "^0.20.0",
-    "claude-code-memory-explorer": "^0.15.0",
+    "claude-code-cost": "^0.25.0",
+    "claude-code-kanban": "^4.30.0",
+    "claude-code-marketplace": "^0.21.0",
+    "claude-code-memory-explorer": "^0.16.0",
     "express": "^4.21.0",
     "open": "^10.1.0"
   },

package/public/app.js

@@ -294,17 +294,17 @@ function onIframeLoad(appId) {
   loadedApps.add(appId);
   guardedApps.delete(appId);
   if (appId === activeApp) hideLoading();
-  postTo(appId, themeMessage());
-  postProjectTo(appId);
-  postActiveTo(appId);
-  // Posted twice: the shims gate their origin check on window.__HUB__, which they populate from
-  // an async /hub-config fetch that resolves after this load event, so the first post can be
-  // dropped. Safe to repeat — every shim's apply is idempotent.
-  setTimeout(() => {
+  const postState = () => {
     postTo(appId, themeMessage());
     postProjectTo(appId);
     postActiveTo(appId);
-  }, 400);
+    postTo(appId, { type: 'hub:keys', keys: Object.keys(bindings()) });
+  };
+  postState();
+  // Posted twice: the shims gate their origin check on window.__HUB__, which they populate from
+  // an async /hub-config fetch that resolves after this load event, so the first post can be
+  // dropped. Safe to repeat — every shim's apply is idempotent.
+  setTimeout(postState, 400);
 }
 
 function listenMessages() {
@@ -373,21 +373,40 @@ function handleForwardedKey(d) {
   // The modifier fields are new. A sub-app running an older service-worker-cached bundle sends
   // {key} only; it forwards nothing but the pre-existing bindings, and each of those is
   // unambiguous from the key alone, so normalize instead of dispatching twice.
-  const alt = typeof d.alt === 'boolean' ? d.alt : true;
-  const ctrl = typeof d.alt === 'boolean' ? d.ctrl : d.key.startsWith('Arrow');
-  if (!alt || d.shift === true) return;
-  const k = bindingKey(d);
-  if (!ctrl) {
-    if (/^[1-9]$/.test(k)) switchByIndex(Number(k) - 1);
-    return;
-  }
-  if (k === 'ArrowLeft') cycleTab(-1);
-  else if (k === 'ArrowRight') cycleTab(1);
-  else if (PALETTE_KEYS[k]) togglePalette(PALETTE_KEYS[k]);
+  const legacy = typeof d.alt !== 'boolean';
+  const e = {
+    key: d.key,
+    code: d.code,
+    altKey: legacy || d.alt,
+    ctrlKey: legacy ? d.key.startsWith('Arrow') : d.ctrl,
+    shiftKey: d.shift === true,
+  };
+  bindings()[comboOf(e)]?.run();
+}
+
+// The one keymap. Its combo names are what the hub:keys message lists for the shims.
+// inPalette: the binding still fires while the palette is open.
+function bindings() {
+  const map = {
+    'ctrl+alt+p': { run: () => togglePalette('project'), inPalette: true },
+    'ctrl+alt+w': { run: () => togglePalette('configDir'), inPalette: true },
+    'ctrl+alt+ArrowLeft': { run: () => cycleTab(-1) },
+    'ctrl+alt+ArrowRight': { run: () => cycleTab(1) },
+  };
+  Object.keys(apps)
+    .slice(0, 9)
+    .forEach((id, i) => {
+      map[`alt+${i + 1}`] = { run: () => switchTab(id) };
+    });
+  return map;
 }
 
-// Ctrl+Alt+<letter> bindings. Sub-app shims forward every letter, so this is the one keymap.
-const PALETTE_KEYS = { p: 'project', w: 'configDir' };
+// Each shim's hubCombo() is a copy of this: modifiers in ctrl, alt, shift, meta order, joined by
+// '+' to the key as bindingKey() names it.
+function comboOf(e) {
+  const mods = [e.ctrlKey && 'ctrl', e.altKey && 'alt', e.shiftKey && 'shift', e.metaKey && 'meta'];
+  return [...mods, bindingKey(e)].filter(Boolean).join('+');
+}
 
 // macOS composes Option+<key> into a character — Option+1 is '¡', Option+P is 'π' — and holding
 // Control does not undo it, so e.key alone cannot carry these bindings there. e.code is the
@@ -407,20 +426,13 @@ function cycleTab(delta) {
   switchTab(next);
 }
 
-function switchByIndex(idx) {
-  const ids = Object.keys(apps);
-  if (idx < ids.length) switchTab(ids[idx]);
-}
-
 function listenKeys() {
   document.addEventListener('keydown', (e) => {
-    if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey) {
-      const mode = PALETTE_KEYS[bindingKey(e)];
-      if (mode) {
-        e.preventDefault();
-        togglePalette(mode);
-        return;
-      }
+    const binding = bindings()[comboOf(e)];
+    if (binding?.inPalette) {
+      e.preventDefault();
+      binding.run();
+      return;
     }
     // While the palette is open the input owns the keyboard — don't let tab shortcuts fire
     // mid-path (Alt+digit especially, since Windows paths contain digits). Escape still closes:
@@ -432,26 +444,9 @@ function listenKeys() {
       }
       return;
     }
-    if (e.altKey && !e.ctrlKey && !e.shiftKey && !e.metaKey) {
-      const k = bindingKey(e);
-      if (/^[1-9]$/.test(k)) {
-        e.preventDefault();
-        switchByIndex(Number(k) - 1);
-        return;
-      }
-    }
-    if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey) {
-      if (e.key === 'ArrowLeft') {
-        e.preventDefault();
-        cycleTab(-1);
-        return;
-      }
-      if (e.key === 'ArrowRight') {
-        e.preventDefault();
-        cycleTab(1);
-        return;
-      }
-    }
+    if (!binding) return;
+    e.preventDefault();
+    binding.run();
   });
 }
 

package/server.js

@@ -8,6 +8,7 @@ const http = require('http');
 const tcp = require('net');
 const os = require('os');
 const path = require('path');
+const { selectApps } = require('./lib/apps');
 const { createNetGuard } = require('./lib/net-guard');
 
 function getArg(name) {
@@ -19,13 +20,8 @@ function getArg(name) {
 }
 
 const HUB_PORT = parseInt(getArg('port') || process.env.PORT || '3540', 10);
-const MARKETPLACE_PORT = parseInt(getArg('marketplace-port') || '3542', 10);
-const KANBAN_PORT = parseInt(getArg('kanban-port') || '3541', 10);
-const COST_PORT = parseInt(getArg('cost-port') || '3543', 10);
-const MEMORY_PORT = parseInt(getArg('memory-port') || '3544', 10);
 
 const POOL_SIZE = Math.max(1, parseInt(getArg('pool-size') || '3', 10));
-const DEFAULT_PORTS = { marketplace: MARKETPLACE_PORT, kanban: KANBAN_PORT, cost: COST_PORT, memory: MEMORY_PORT };
 const RESTART_DELAY_MS = 500;
 // A rate window, not a total: a child may die and recover all session, but one that cannot stay up
 // stops being restarted. A consecutive counter cannot express that — anything that starts at all
@@ -87,6 +83,7 @@ function loadHubConfig() {
   const config = { configDirs: dirs, activeConfigDir: active };
   // Hand-edited only; kept verbatim so a rewrite of the file does not drop it.
   if (saved.terminal && typeof saved.terminal === 'object') config.terminal = saved.terminal;
+  if (Array.isArray(saved.apps)) config.apps = saved.apps;
   // Configs saved before canonicalization can hold one dir under two spellings; persist the merge.
   if (serializeConfig(config) !== raw) writeHubConfig(config);
   return config;
@@ -107,6 +104,25 @@ function saveHubConfig() {
 
 const hubConfig = loadHubConfig();
 
+const { apps: ENABLED_APPS, unknown: unknownApps } = selectApps(hubConfig.apps);
+for (const id of unknownApps) console.log(`Unknown app "${id}" in ${HUB_CONFIG_FILE}, ignored`);
+if (!ENABLED_APPS.length) {
+  console.error(`Every app is disabled in ${HUB_CONFIG_FILE}. Enable at least one.`);
+  process.exit(1);
+}
+const appEnabled = (id) => ENABLED_APPS.some((a) => a.id === id);
+
+// Every keystroke into cck's terminal passes through the upgrade proxy below. Windows only, for the
+// reasons in cck/lib/priority.js; the children spawned after this still start at normal.
+if (process.platform === 'win32' && process.env.CCK_PRIORITY_BOOST !== '0') {
+  try {
+    if (os.getPriority() > os.constants.priority.PRIORITY_ABOVE_NORMAL)
+      os.setPriority(os.constants.priority.PRIORITY_ABOVE_NORMAL);
+  } catch {
+    /* keep the default priority */
+  }
+}
+
 // Created before spawnApp so the same host/allowed-hosts decision reaches the
 // children. Without that propagation, `--host 0.0.0.0` would expose the hub shell
 // while every iframe 403'd on its own Host check.
@@ -118,7 +134,8 @@ const net = createNetGuard({ appName: 'Claude Code Hub' });
 // the WebSocket. cck applies the rest of its policy (exposure refusal, Origin, session cap) itself.
 const TERMINAL = {
   ...(hubConfig.terminal || {}),
-  enabled: !process.argv.includes('--disable-terminal') && hubConfig.terminal?.enabled !== false,
+  enabled:
+    appEnabled('kanban') && !process.argv.includes('--disable-terminal') && hubConfig.terminal?.enabled !== false,
 };
 const TERMINAL_TOKEN = TERMINAL.enabled ? crypto.randomBytes(32).toString('hex') : null;
 
@@ -356,10 +373,7 @@ function resolveApp(submoduleDir, npmPackage) {
   return require.resolve(`${npmPackage}/server.js`);
 }
 
-const marketplacePath = resolveApp('marketplace', 'claude-code-marketplace');
-const kanbanPath = resolveApp('cck', 'claude-code-kanban');
-const costPath = resolveApp('cost', 'claude-code-cost');
-const memoryPath = resolveApp('memory', 'claude-code-memory-explorer');
+const appPaths = Object.fromEntries(ENABLED_APPS.map((a) => [a.id, resolveApp(a.dir, a.pkg)]));
 
 // Raise header size limit to 64KB — localhost cookies from sibling apps can pile up and
 // trip Node's default 16KB limit, breaking iframes with HTTP 431.
@@ -370,13 +384,12 @@ const NODE_HDR = `--max-http-header-size=${HDR_BYTES}`;
 // localStorage is keyed by origin, so the sub-app origin has to stay put across switches or the
 // user loses pins and filters every time the active set changes.
 function spawnChildren(pool) {
-  spawnApp(pool, 'marketplace', process.execPath, [NODE_HDR, marketplacePath]);
-  spawnApp(pool, 'kanban', process.execPath, [NODE_HDR, kanbanPath]);
-  spawnApp(pool, 'cost', process.execPath, [NODE_HDR, costPath]);
-  spawnApp(pool, 'memory', process.execPath, [NODE_HDR, memoryPath]);
+  for (const a of ENABLED_APPS) spawnApp(pool, a.id, process.execPath, [NODE_HDR, appPaths[a.id]]);
 }
 
-const publicPorts = { ...DEFAULT_PORTS };
+const publicPorts = Object.fromEntries(
+  ENABLED_APPS.map((a) => [a.id, parseInt(getArg(`${a.id}-port`) || String(a.port), 10)]),
+);
 
 function rewriteOrigin(origin, publicPort, childPort) {
   try {
@@ -421,6 +434,7 @@ async function waitForPort(name, deadline) {
     const pool = activePool();
     const port = pool?.ports[name];
     if (port) return port;
+    if (pool && !pool.children.has(name)) return null;
     const remaining = deadline - Date.now();
     if (remaining <= 0) return null;
     await Promise.race([pool?.children.get(name)?.ready, delay(Math.min(remaining, 250))]);
@@ -595,7 +609,7 @@ function listenWithFallback(handler, port, onReady, label, onUpgrade) {
   return server;
 }
 
-for (const [name, port] of Object.entries(DEFAULT_PORTS)) {
+for (const [name, port] of Object.entries(publicPorts)) {
   listenWithFallback(
     proxyHandler(name),
     port,
@@ -644,14 +658,13 @@ const themePalettes = (() => {
 })();
 
 function appsConfig() {
-  const kanban = { name: 'Kanban', url: `http://localhost:${publicPorts.kanban}`, icon: 'columns' };
-  if (TERMINAL_TOKEN) kanban.terminalToken = TERMINAL_TOKEN;
-  return {
-    kanban,
-    marketplace: { name: 'Marketplace', url: `http://localhost:${publicPorts.marketplace}`, icon: 'store' },
-    cost: { name: 'Cost', url: `http://localhost:${publicPorts.cost}`, icon: 'dollar-sign' },
-    memory: { name: 'Memory Diagnoser', url: `http://localhost:${publicPorts.memory}`, icon: 'database' },
-  };
+  return Object.fromEntries(
+    ENABLED_APPS.map((a) => {
+      const entry = { name: a.name, url: `http://localhost:${publicPorts[a.id]}`, icon: a.icon };
+      if (a.id === 'kanban' && TERMINAL_TOKEN) entry.terminalToken = TERMINAL_TOKEN;
+      return [a.id, entry];
+    }),
+  );
 }
 
 app.get('/api/config', (_req, res) => {