claude-code-hub 0.40.0 → 0.42.0

package/README.md

@@ -99,6 +99,26 @@ The hub can run the tools against more than one Claude config dir (`CLAUDE_CONFI
 - Each dir gets its own set of the four tools. When you switch, the hub keeps the old set running, so switching back is instant. `--pool-size` sets how many sets stay alive (default 3). When the pool is full, the hub stops the least recently used set, but not a set whose Kanban has open terminals.
 - The list and the active dir are saved in `~/.claude-hub/config.json`.
 
+## Choose the tools
+
+By default the hub runs all four tools. To turn a tool off or change the tab order, add an `apps` list to `~/.claude-hub/config.json`:
+
+```json
+{
+  "apps": [
+    { "id": "kanban" },
+    { "id": "cost" },
+    { "id": "marketplace", "enabled": false }
+  ]
+}
+```
+
+- The ids are `kanban`, `marketplace`, `cost` and `memory`.
+- The tools you list come first, in list order. The tools you do not list follow in the default order.
+- A tool with `"enabled": false` does not start and gets no tab. Links from other tools to it do nothing.
+- With Kanban off, the embedded terminal is off, and the project palette has no project list. You can still type a path.
+- Restart the hub after you edit the file.
+
 ## Embedded terminal
 
 Under the hub, Kanban has an embedded terminal, on by default, so you can start or resume Claude Code sessions from the board. While a terminal is attached, the hub asks before it closes the window, because <kbd>Ctrl</kbd>+<kbd>W</kbd> meant for the terminal would close it.
@@ -126,6 +146,8 @@ The hub has no visible UI of its own. Use these shortcuts:
 | <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>P</kbd> | Project palette: set the project for all tools |
 | <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>W</kbd> | Config-dir palette: switch, add, or remove a config dir |
 
+<kbd>Alt</kbd>+<kbd>1</kbd> to <kbd>Alt</kbd>+<kbd>4</kbd> follow the tab order, so they change when you [choose the tools](#choose-the-tools).
+
 In a palette, use <kbd>↑</kbd>/<kbd>↓</kbd> or <kbd>Tab</kbd> to move, <kbd>Enter</kbd> to select, and <kbd>Esc</kbd> to close.
 
 The shortcuts also work when focus is inside a tool. Kanban keeps <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>N</kbd> (new session), <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>R</kbd> (resume session), and <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>S</kbd> (previous session) for itself. From Kanban you can also jump to another tool for the selected session:

package/lib/apps.js

@@ -0,0 +1,23 @@
+'use strict';
+
+// Built-in apps in their default tab order.
+const APPS = [
+  { id: 'kanban', dir: 'cck', pkg: 'claude-code-kanban', name: 'Kanban', icon: 'columns', port: 3541 },
+  { id: 'marketplace', dir: 'marketplace', pkg: 'claude-code-marketplace', name: 'Marketplace', icon: 'store', port: 3542 },
+  { id: 'cost', dir: 'cost', pkg: 'claude-code-cost', name: 'Cost', icon: 'dollar-sign', port: 3543 },
+  { id: 'memory', dir: 'memory', pkg: 'claude-code-memory-explorer', name: 'Memory Diagnoser', icon: 'database', port: 3544 },
+];
+
+// `entries` is the hand-edited `apps` list in config.json. Listed apps come first in list order and
+// unlisted ones follow in default order, so an app added in a later release shows up without an edit.
+function selectApps(entries = []) {
+  const listed = entries.filter((e) => typeof e?.id === 'string');
+  const byId = (id) => APPS.find((a) => a.id === id);
+  const unknown = listed.map((e) => e.id).filter((id) => !byId(id));
+  const off = new Set(listed.filter((e) => e.enabled === false).map((e) => e.id));
+  const order = new Set([...listed.map((e) => e.id), ...APPS.map((a) => a.id)]);
+  const apps = [...order].map(byId).filter((a) => a && !off.has(a.id));
+  return { apps, unknown };
+}
+
+module.exports = { selectApps };

package/lib/cookies.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// Returns the Cookie header value without the named cookie, or '' when nothing is left.
+function stripCookie(header, name) {
+  if (typeof header !== 'string') return '';
+  return header
+    .split(';')
+    .map((part) => part.trim())
+    .filter((part) => part && part.split('=', 1)[0].trim() !== name)
+    .join('; ');
+}
+
+module.exports = { stripCookie };

package/lib/net-guard.js

@@ -245,7 +245,7 @@ function createNetGuard(config = {}) {
    * @param {{maxHeaderSize?: number, onUpgrade?: (req: any, socket: any, head: Buffer) => void}} [opts]
    */
   function listenLoopback(app, port, onReady, opts = {}) {
-    const http = require('http');
+    const http = require('node:http');
     const serverOpts = opts.maxHeaderSize ? { maxHeaderSize: opts.maxHeaderSize } : {};
     const makeServer = (handler) => {
       const s = http.createServer(serverOpts, handler);

package/lib/themes.json

@@ -0,0 +1,548 @@
+[
+ {
+  "id": "ember",
+  "label": "Ember",
+  "dark": {
+   "ember": "#e86f33",
+   "emberGlow": "#f0a070",
+   "emberDim": "rgba(232,111,51,0.25)",
+   "field": "#101114",
+   "surface": "#16181c",
+   "elevated": "#1e2025",
+   "hover": "#282a30",
+   "border": "#363840",
+   "ink1": "#f0f1f3",
+   "ink2": "#c2c4c9",
+   "ink3": "#9a9da5",
+   "inkMuted": "#7d808a"
+  },
+  "light": {
+   "ember": "#e86f33",
+   "emberGlow": "#a0501c",
+   "emberDim": "rgba(184,90,32,0.18)",
+   "field": "#e8e6e3",
+   "surface": "#efede9",
+   "elevated": "#fbfaf9",
+   "hover": "#d2d0cc",
+   "border": "#cfcbc4",
+   "ink1": "#0a0a0a",
+   "ink2": "#2c2c2c",
+   "ink3": "#565656",
+   "inkMuted": "#767676"
+  }
+ },
+ {
+  "id": "gruvbox",
+  "label": "Gruvbox",
+  "dark": {
+   "ember": "#fe8019",
+   "emberGlow": "#f9b27c",
+   "emberDim": "rgba(254,128,25,0.25)",
+   "field": "#1d2021",
+   "surface": "#282828",
+   "elevated": "#32302f",
+   "hover": "#3c3836",
+   "border": "#504945",
+   "ink1": "#ebdbb2",
+   "ink2": "#d5c4a1",
+   "ink3": "#bdae93",
+   "inkMuted": "#928374"
+  },
+  "light": {
+   "ember": "#d65d0e",
+   "emberGlow": "#af3a03",
+   "emberDim": "rgba(214,93,14,0.18)",
+   "field": "#ede7d5",
+   "surface": "#f3eee0",
+   "elevated": "#faf7ec",
+   "hover": "#e4dcc6",
+   "border": "#c9bc9d",
+   "ink1": "#3c3836",
+   "ink2": "#504945",
+   "ink3": "#665c54",
+   "inkMuted": "#7c6f64"
+  }
+ },
+ {
+  "id": "catppuccin",
+  "label": "Catppuccin",
+  "dark": {
+   "ember": "#cba6f7",
+   "emberGlow": "#d8c2fa",
+   "emberDim": "rgba(203,166,247,0.25)",
+   "field": "#11111b",
+   "surface": "#181825",
+   "elevated": "#1e1e2e",
+   "hover": "#313244",
+   "border": "#45475a",
+   "ink1": "#cdd6f4",
+   "ink2": "#bac2de",
+   "ink3": "#a6adc8",
+   "inkMuted": "#7f849c"
+  },
+  "light": {
+   "ember": "#8839ef",
+   "emberGlow": "#6f2dbd",
+   "emberDim": "rgba(136,57,239,0.18)",
+   "field": "#e6e9ef",
+   "surface": "#eff1f5",
+   "elevated": "#ffffff",
+   "hover": "#ccd0da",
+   "border": "#bcc0cc",
+   "ink1": "#4c4f69",
+   "ink2": "#5c5f77",
+   "ink3": "#6c6f85",
+   "inkMuted": "#8c8fa1"
+  }
+ },
+ {
+  "id": "tokyo-night",
+  "label": "Tokyo Night",
+  "dark": {
+   "ember": "#7aa2f7",
+   "emberGlow": "#9ab8ff",
+   "emberDim": "rgba(122,162,247,0.25)",
+   "field": "#16161e",
+   "surface": "#1a1b26",
+   "elevated": "#1f2335",
+   "hover": "#292e42",
+   "border": "#3b4261",
+   "ink1": "#c0caf5",
+   "ink2": "#a9b1d6",
+   "ink3": "#787c99",
+   "inkMuted": "#565f89"
+  },
+  "light": {
+   "ember": "#2e7de9",
+   "emberGlow": "#1659c7",
+   "emberDim": "rgba(46,125,233,0.18)",
+   "field": "#e1e2e7",
+   "surface": "#e9eaf0",
+   "elevated": "#f7f8fc",
+   "hover": "#d0d5e3",
+   "border": "#a8aecb",
+   "ink1": "#343b58",
+   "ink2": "#565a6e",
+   "ink3": "#6c6e75",
+   "inkMuted": "#848cb5"
+  }
+ },
+ {
+  "id": "solarized",
+  "label": "Solarized",
+  "dark": {
+   "ember": "#c96f47",
+   "emberGlow": "#d48a6a",
+   "emberDim": "rgba(201,111,71,0.25)",
+   "field": "#002b36",
+   "surface": "#073642",
+   "elevated": "#0a4250",
+   "hover": "#11505f",
+   "border": "#586e75",
+   "ink1": "#e2dfd0",
+   "ink2": "#b7c0bf",
+   "ink3": "#93a1a1",
+   "inkMuted": "#839496"
+  },
+  "light": {
+   "ember": "#2280c2",
+   "emberGlow": "#1b6aa3",
+   "emberDim": "rgba(34,128,194,0.18)",
+   "field": "#eee8d5",
+   "sidebar": "#e6dfc7",
+   "sidebarItem": "#f3ecd6",
+   "surface": "#fdf6e3",
+   "elevated": "#fffbef",
+   "hover": "#efe8d3",
+   "border": "#cdc4ab",
+   "ink1": "#073642",
+   "ink2": "#4f6369",
+   "ink3": "#586e75",
+   "inkMuted": "#728589"
+  }
+ },
+ {
+  "id": "dracula",
+  "label": "Dracula",
+  "dark": {
+   "ember": "#bd93f9",
+   "emberGlow": "#d6b5ff",
+   "emberDim": "rgba(189,147,249,0.25)",
+   "field": "#21222c",
+   "surface": "#282a36",
+   "elevated": "#343746",
+   "hover": "#44475a",
+   "border": "#565a75",
+   "ink1": "#f8f8f2",
+   "ink2": "#d8d8d2",
+   "ink3": "#b0b3c5",
+   "inkMuted": "#6272a4"
+  },
+  "light": {
+   "ember": "#7c3aed",
+   "emberGlow": "#5b21b6",
+   "emberDim": "rgba(124,58,237,0.18)",
+   "field": "#e8e8ee",
+   "surface": "#f0f0f5",
+   "elevated": "#fbfbfd",
+   "hover": "#dfdfe8",
+   "border": "#c9c9d6",
+   "ink1": "#16161e",
+   "ink2": "#34343f",
+   "ink3": "#5a5a68",
+   "inkMuted": "#787885"
+  }
+ },
+ {
+  "id": "nord",
+  "label": "Nord",
+  "dark": {
+   "ember": "#88c0d0",
+   "emberGlow": "#a8d8e8",
+   "emberDim": "rgba(136,192,208,0.25)",
+   "field": "#272c36",
+   "surface": "#2e3440",
+   "elevated": "#3b4252",
+   "hover": "#434c5e",
+   "border": "#4c566a",
+   "ink1": "#eceff4",
+   "ink2": "#d8dee9",
+   "ink3": "#aeb6c5",
+   "inkMuted": "#7b88a1"
+  },
+  "light": {
+   "ember": "#5e81ac",
+   "emberGlow": "#44688f",
+   "emberDim": "rgba(94,129,172,0.18)",
+   "field": "#e5e9f0",
+   "surface": "#eceff4",
+   "elevated": "#f8f9fb",
+   "hover": "#d8dee9",
+   "border": "#c2c9d6",
+   "ink1": "#2e3440",
+   "ink2": "#3b4252",
+   "ink3": "#4c566a",
+   "inkMuted": "#6b7589"
+  }
+ },
+ {
+  "id": "rose-pine",
+  "label": "Rosé Pine",
+  "dark": {
+   "ember": "#c4a7e7",
+   "emberGlow": "#d9c4f2",
+   "emberDim": "rgba(196,167,231,0.25)",
+   "field": "#191724",
+   "surface": "#1f1d2e",
+   "elevated": "#26233a",
+   "hover": "#34304e",
+   "border": "#403d52",
+   "ink1": "#e0def4",
+   "ink2": "#c5c2dd",
+   "ink3": "#908caa",
+   "inkMuted": "#6e6a86"
+  },
+  "light": {
+   "ember": "#907aa9",
+   "emberGlow": "#6f598c",
+   "emberDim": "rgba(144,122,169,0.18)",
+   "field": "#f2e9e1",
+   "surface": "#faf4ed",
+   "elevated": "#fffaf3",
+   "hover": "#ebdfd4",
+   "border": "#cecacd",
+   "ink1": "#575279",
+   "ink2": "#635e87",
+   "ink3": "#6e6a88",
+   "inkMuted": "#857f96"
+  }
+ },
+ {
+  "id": "everforest",
+  "label": "Everforest",
+  "dark": {
+   "ember": "#a7c080",
+   "emberGlow": "#c3d6a2",
+   "emberDim": "rgba(167,192,128,0.25)",
+   "field": "#232a2e",
+   "surface": "#2d353b",
+   "elevated": "#343f44",
+   "hover": "#3d484d",
+   "border": "#475258",
+   "ink1": "#d3c6aa",
+   "ink2": "#bfb6a3",
+   "ink3": "#9da9a0",
+   "inkMuted": "#859289"
+  },
+  "light": {
+   "ember": "#6f8352",
+   "emberGlow": "#56683f",
+   "emberDim": "rgba(111,131,82,0.18)",
+   "field": "#ebeadb",
+   "surface": "#f5f4e8",
+   "elevated": "#fbfbf4",
+   "hover": "#e5e4d3",
+   "border": "#d3d2bf",
+   "ink1": "#3d484e",
+   "ink2": "#55636b",
+   "ink3": "#66705f",
+   "inkMuted": "#7a8577"
+  }
+ },
+ {
+  "id": "kanagawa",
+  "label": "Kanagawa",
+  "dark": {
+   "ember": "#7e9cd8",
+   "emberGlow": "#9fb9ec",
+   "emberDim": "rgba(126,156,216,0.25)",
+   "field": "#16161d",
+   "surface": "#1f1f28",
+   "elevated": "#2a2a37",
+   "hover": "#363646",
+   "border": "#54546d",
+   "ink1": "#dcd7ba",
+   "ink2": "#c8c093",
+   "ink3": "#a6a69c",
+   "inkMuted": "#727169"
+  },
+  "light": {
+   "ember": "#4d699b",
+   "emberGlow": "#38537f",
+   "emberDim": "rgba(77,105,155,0.18)",
+   "field": "#e9e5d6",
+   "surface": "#f3f0e4",
+   "elevated": "#faf8f1",
+   "hover": "#e2ddcb",
+   "border": "#d2ccb6",
+   "ink1": "#545464",
+   "ink2": "#66667a",
+   "ink3": "#716e61",
+   "inkMuted": "#8a8775"
+  }
+ },
+ {
+  "id": "one-dark",
+  "label": "One Dark",
+  "dark": {
+   "ember": "#61afef",
+   "emberGlow": "#8cc7ff",
+   "emberDim": "rgba(97,175,239,0.25)",
+   "field": "#21252b",
+   "surface": "#282c34",
+   "elevated": "#2f343e",
+   "hover": "#3e4452",
+   "border": "#4b5263",
+   "ink1": "#d7dae0",
+   "ink2": "#abb2bf",
+   "ink3": "#8b919e",
+   "inkMuted": "#5c6370"
+  },
+  "light": {
+   "ember": "#4078f2",
+   "emberGlow": "#2c5dd4",
+   "emberDim": "rgba(64,120,242,0.18)",
+   "field": "#eaeaeb",
+   "surface": "#fafafa",
+   "elevated": "#ffffff",
+   "hover": "#e0e0e2",
+   "border": "#d4d4d6",
+   "ink1": "#383a42",
+   "ink2": "#50525a",
+   "ink3": "#696c77",
+   "inkMuted": "#a0a1a7"
+  }
+ },
+ {
+  "id": "night-owl",
+  "label": "Night Owl",
+  "dark": {
+   "ember": "#82aaff",
+   "emberGlow": "#a8c4ff",
+   "emberDim": "rgba(130,170,255,0.25)",
+   "field": "#011627",
+   "surface": "#0b2942",
+   "elevated": "#13344f",
+   "hover": "#1d3b53",
+   "border": "#5f7e97",
+   "ink1": "#d6deeb",
+   "ink2": "#b8c5d6",
+   "ink3": "#8ba3b8",
+   "inkMuted": "#637777"
+  },
+  "light": {
+   "ember": "#0c969b",
+   "emberGlow": "#0a7479",
+   "emberDim": "rgba(12,150,155,0.18)",
+   "field": "#ededed",
+   "surface": "#f6f6f6",
+   "elevated": "#fbfbfb",
+   "hover": "#e2e2e2",
+   "border": "#d0d0d0",
+   "ink1": "#403f53",
+   "ink2": "#545167",
+   "ink3": "#6f6e85",
+   "inkMuted": "#989fb1"
+  }
+ },
+ {
+  "id": "monokai",
+  "label": "Monokai Pro",
+  "dark": {
+   "ember": "#ffd866",
+   "emberGlow": "#ffe6a0",
+   "emberDim": "rgba(255,216,102,0.25)",
+   "field": "#221f22",
+   "surface": "#2d2a2e",
+   "elevated": "#403e41",
+   "hover": "#4a484b",
+   "border": "#5b595c",
+   "ink1": "#fcfcfa",
+   "ink2": "#d9d8d6",
+   "ink3": "#939293",
+   "inkMuted": "#727072"
+  },
+  "light": {
+   "ember": "#c08a00",
+   "emberGlow": "#856000",
+   "emberDim": "rgba(192,138,0,0.18)",
+   "field": "#e9e6e4",
+   "surface": "#f1efed",
+   "elevated": "#fcfbfa",
+   "hover": "#e0dcda",
+   "border": "#cdc8c5",
+   "ink1": "#2c292d",
+   "ink2": "#46434a",
+   "ink3": "#6b686d",
+   "inkMuted": "#8d8a8d"
+  }
+ },
+ {
+  "id": "github",
+  "label": "GitHub",
+  "dark": {
+   "ember": "#58a6ff",
+   "emberGlow": "#85bdff",
+   "emberDim": "rgba(88,166,255,0.25)",
+   "field": "#1f2428",
+   "surface": "#24292e",
+   "elevated": "#2b3138",
+   "hover": "#2f363d",
+   "border": "#444d56",
+   "ink1": "#e1e4e8",
+   "ink2": "#d1d5da",
+   "ink3": "#959da5",
+   "inkMuted": "#6a737d"
+  },
+  "light": {
+   "ember": "#0366d6",
+   "emberGlow": "#044289",
+   "emberDim": "rgba(3,102,214,0.18)",
+   "field": "#f0f2f4",
+   "surface": "#f6f8fa",
+   "elevated": "#ffffff",
+   "hover": "#e8eaed",
+   "border": "#d1d5da",
+   "ink1": "#24292e",
+   "ink2": "#444d56",
+   "ink3": "#586069",
+   "inkMuted": "#6a737d"
+  }
+ },
+ {
+  "id": "ayu",
+  "label": "Ayu",
+  "dark": {
+   "ember": "#e6b450",
+   "emberGlow": "#f0cd85",
+   "emberDim": "rgba(230,180,80,0.25)",
+   "field": "#0d1017",
+   "surface": "#10141c",
+   "elevated": "#141821",
+   "hover": "#1d2330",
+   "border": "#2d3343",
+   "ink1": "#bfbdb6",
+   "ink2": "#a8a6a0",
+   "ink3": "#8a9199",
+   "inkMuted": "#6c7380"
+  },
+  "light": {
+   "ember": "#c97612",
+   "emberGlow": "#a65e0c",
+   "emberDim": "rgba(201,118,18,0.18)",
+   "field": "#eff1f3",
+   "surface": "#f8f9fa",
+   "elevated": "#fcfcfc",
+   "hover": "#e7eaed",
+   "border": "#d8dde2",
+   "ink1": "#3d4149",
+   "ink2": "#5c6166",
+   "ink3": "#787b80",
+   "inkMuted": "#8a9199"
+  }
+ },
+ {
+  "id": "vitesse",
+  "label": "Vitesse",
+  "dark": {
+   "ember": "#4d9375",
+   "emberGlow": "#6fb392",
+   "emberDim": "rgba(77,147,117,0.25)",
+   "field": "#121212",
+   "surface": "#181818",
+   "elevated": "#1e1e1e",
+   "hover": "#262626",
+   "border": "#333333",
+   "ink1": "#dbd7ca",
+   "ink2": "#bfbaaa",
+   "ink3": "#8f8f85",
+   "inkMuted": "#758575"
+  },
+  "light": {
+   "ember": "#1c6b48",
+   "emberGlow": "#145236",
+   "emberDim": "rgba(28,107,72,0.18)",
+   "field": "#f0f0f0",
+   "surface": "#f7f7f7",
+   "elevated": "#ffffff",
+   "hover": "#e7e7e7",
+   "border": "#d6d6d6",
+   "ink1": "#393a34",
+   "ink2": "#4e4f47",
+   "ink3": "#6b6d63",
+   "inkMuted": "#a0ada0"
+  }
+ },
+ {
+  "id": "synthwave",
+  "label": "Synthwave '84",
+  "dark": {
+   "ember": "#ff7edb",
+   "emberGlow": "#ffa9e7",
+   "emberDim": "rgba(255,126,219,0.25)",
+   "field": "#241b2f",
+   "surface": "#262335",
+   "elevated": "#322a47",
+   "hover": "#3d3460",
+   "border": "#495495",
+   "ink1": "#ffffff",
+   "ink2": "#d8d6e8",
+   "ink3": "#b6b1d8",
+   "inkMuted": "#848bbd"
+  },
+  "light": {
+   "ember": "#c936a6",
+   "emberGlow": "#9c2381",
+   "emberDim": "rgba(201,54,166,0.18)",
+   "field": "#e6e2f0",
+   "surface": "#efecf6",
+   "elevated": "#fbfafd",
+   "hover": "#ddd7ec",
+   "border": "#c5bcdd",
+   "ink1": "#241b2f",
+   "ink2": "#3d3455",
+   "ink3": "#5c5380",
+   "inkMuted": "#7d76a3"
+  }
+ }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-hub",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "description": "Unified hub for Claude Code tools — Marketplace + Kanban in one PWA",
   "main": "server.js",
   "bin": {
@@ -9,13 +9,18 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node server.js --open",
+    "test": "node --test test/*.test.js",
     "update": "bash scripts/update-submodules.sh",
     "update:check": "bash scripts/update-submodules.sh --check",
     "lint": "npx @biomejs/biome check public/app.js server.js && npm run check:escaping && npm run check:security-lib",
     "lint:fix": "npx @biomejs/biome check --fix public/app.js server.js",
     "prepare": "husky",
     "check:escaping": "node scripts/check-escaping.mjs",
-    "check:security-lib": "bash scripts/sync-security-lib.sh --check"
+    "check:security-lib": "bash scripts/sync-security-lib.sh --check",
+    "perf": "node scripts/perf.mjs run",
+    "perf:compare": "node scripts/perf.mjs compare",
+    "perf:report": "node scripts/perf.mjs report",
+    "perf:world": "node scripts/perf.mjs gen-world"
   },
   "repository": {
     "type": "git",
@@ -39,10 +44,10 @@
   },
   "homepage": "https://github.com/NikiforovAll/claude-code-hub#readme",
   "dependencies": {
-    "claude-code-cost": "^0.24.0",
-    "claude-code-kanban": "^4.29.0",
-    "claude-code-marketplace": "^0.20.0",
-    "claude-code-memory-explorer": "^0.15.0",
+    "claude-code-cost": "^0.26.0",
+    "claude-code-kanban": "^4.31.1",
+    "claude-code-marketplace": "^0.22.0",
+    "claude-code-memory-explorer": "^0.17.0",
     "express": "^4.21.0",
     "open": "^10.1.0"
   },

package/public/app.js

@@ -3,7 +3,6 @@ let activeApp = null;
 const iframes = {};
 const loadedApps = new Set();
 const guardedApps = new Set();
-let allowedOrigins = new Set();
 // {theme: 'dark'|'light', colorTheme: '<id>', colorThemes: {<configDir>: '<id>'}} — survives hub
 // reloads so late-loading iframes and fresh sessions get the last chosen theme. Light/dark is
 // global; the color theme is per config dir, and colorTheme is the last one picked anywhere, which
@@ -55,7 +54,7 @@ function themeMessage() {
 }
 
 // {<themeId>: {dark, light}}, each a map of CSS variables, from /api/config, which derives it from
-// scripts/themes.json — the same registry that generates each sub-app's themes.css. Empty until
+// lib/themes.json — the same registry that generates each sub-app's themes.css. Empty until
 // config arrives, and empty if the registry is unreadable; then the hub keeps index.html's colors.
 let themePalettes = {};
 // The last applied variables, so the loading screen paints in the theme before /api/config lands.
@@ -151,7 +150,7 @@ async function init() {
   showLoading();
   const res = await fetch('/api/config');
   const config = await res.json();
-  setApps(config.apps);
+  apps = config.apps;
   defaultConfigDir = config.defaultConfigDir ?? null;
   activeConfigDir = config.activeConfigDir ?? null;
   applyTitle(config.activeConfigDir);
@@ -172,11 +171,6 @@ function applyTitle(dir) {
   document.title = dir && dir !== defaultConfigDir ? basename(dir) : 'Claude Code Hub';
 }
 
-function setApps(next) {
-  apps = next;
-  allowedOrigins = new Set(Object.values(apps).map((a) => new URL(a.url).origin));
-}
-
 // After a config-dir switch every child is a new process, possibly on a new port. Reloading each
 // iframe from scratch also drops the sub-apps' in-memory project state, which belonged to the old
 // dir; the hub's own projectState is cleared for the same reason.
@@ -294,17 +288,17 @@ function onIframeLoad(appId) {
   loadedApps.add(appId);
   guardedApps.delete(appId);
   if (appId === activeApp) hideLoading();
-  postTo(appId, themeMessage());
-  postProjectTo(appId);
-  postActiveTo(appId);
-  // Posted twice: the shims gate their origin check on window.__HUB__, which they populate from
-  // an async /hub-config fetch that resolves after this load event, so the first post can be
-  // dropped. Safe to repeat — every shim's apply is idempotent.
-  setTimeout(() => {
+  const postState = () => {
     postTo(appId, themeMessage());
     postProjectTo(appId);
     postActiveTo(appId);
-  }, 400);
+    postTo(appId, { type: 'hub:keys', keys: Object.keys(bindings()) });
+  };
+  postState();
+  // Posted twice: the shims gate their origin check on window.__HUB__, which they populate from
+  // an async /hub-config fetch that resolves after this load event, so the first post can be
+  // dropped. Safe to repeat — every shim's apply is idempotent.
+  setTimeout(postState, 400);
 }
 
 function listenMessages() {
@@ -312,7 +306,8 @@ function listenMessages() {
     if (guardedApps.size) e.preventDefault();
   });
   window.addEventListener('message', (e) => {
-    if (!allowedOrigins.has(e.origin)) return;
+    const appId = appIdOf(e.source);
+    if (!appId || e.origin !== originOf(appId)) return;
     const data = e.data ?? {};
     if (data.type === 'hub:navigate') {
       if (!apps[data.app]) return;
@@ -324,14 +319,10 @@ function listenMessages() {
     } else if (data.type === 'hub:keydown') {
       handleForwardedKey(data);
     } else if (data.type === 'hub:closeGuard') {
-      const appId = appIdOf(e.source);
-      if (!appId) return;
       if (data.on === true) guardedApps.add(appId);
       else guardedApps.delete(appId);
     } else if (data.type === 'hub:terminalToken') {
       // This hub page may have outlived the restart too, so the cached token is not trusted.
-      const appId = appIdOf(e.source);
-      if (!appId) return;
       sendJson('GET', '/api/config')
         .then((cfg) => {
           const token = cfg.apps?.[appId]?.terminalToken;
@@ -373,21 +364,40 @@ function handleForwardedKey(d) {
   // The modifier fields are new. A sub-app running an older service-worker-cached bundle sends
   // {key} only; it forwards nothing but the pre-existing bindings, and each of those is
   // unambiguous from the key alone, so normalize instead of dispatching twice.
-  const alt = typeof d.alt === 'boolean' ? d.alt : true;
-  const ctrl = typeof d.alt === 'boolean' ? d.ctrl : d.key.startsWith('Arrow');
-  if (!alt || d.shift === true) return;
-  const k = bindingKey(d);
-  if (!ctrl) {
-    if (/^[1-9]$/.test(k)) switchByIndex(Number(k) - 1);
-    return;
-  }
-  if (k === 'ArrowLeft') cycleTab(-1);
-  else if (k === 'ArrowRight') cycleTab(1);
-  else if (PALETTE_KEYS[k]) togglePalette(PALETTE_KEYS[k]);
+  const legacy = typeof d.alt !== 'boolean';
+  const e = {
+    key: d.key,
+    code: d.code,
+    altKey: legacy || d.alt,
+    ctrlKey: legacy ? d.key.startsWith('Arrow') : d.ctrl,
+    shiftKey: d.shift === true,
+  };
+  bindings()[comboOf(e)]?.run();
 }
 
-// Ctrl+Alt+<letter> bindings. Sub-app shims forward every letter, so this is the one keymap.
-const PALETTE_KEYS = { p: 'project', w: 'configDir' };
+// The one keymap. Its combo names are what the hub:keys message lists for the shims.
+// inPalette: the binding still fires while the palette is open.
+function bindings() {
+  const map = {
+    'ctrl+alt+p': { run: () => togglePalette('project'), inPalette: true },
+    'ctrl+alt+w': { run: () => togglePalette('configDir'), inPalette: true },
+    'ctrl+alt+ArrowLeft': { run: () => cycleTab(-1) },
+    'ctrl+alt+ArrowRight': { run: () => cycleTab(1) },
+  };
+  Object.keys(apps)
+    .slice(0, 9)
+    .forEach((id, i) => {
+      map[`alt+${i + 1}`] = { run: () => switchTab(id) };
+    });
+  return map;
+}
+
+// Each shim's hubCombo() is a copy of this: modifiers in ctrl, alt, shift, meta order, joined by
+// '+' to the key as bindingKey() names it.
+function comboOf(e) {
+  const mods = [e.ctrlKey && 'ctrl', e.altKey && 'alt', e.shiftKey && 'shift', e.metaKey && 'meta'];
+  return [...mods, bindingKey(e)].filter(Boolean).join('+');
+}
 
 // macOS composes Option+<key> into a character — Option+1 is '¡', Option+P is 'π' — and holding
 // Control does not undo it, so e.key alone cannot carry these bindings there. e.code is the
@@ -407,20 +417,13 @@ function cycleTab(delta) {
   switchTab(next);
 }
 
-function switchByIndex(idx) {
-  const ids = Object.keys(apps);
-  if (idx < ids.length) switchTab(ids[idx]);
-}
-
 function listenKeys() {
   document.addEventListener('keydown', (e) => {
-    if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey) {
-      const mode = PALETTE_KEYS[bindingKey(e)];
-      if (mode) {
-        e.preventDefault();
-        togglePalette(mode);
-        return;
-      }
+    const binding = bindings()[comboOf(e)];
+    if (binding?.inPalette) {
+      e.preventDefault();
+      binding.run();
+      return;
     }
     // While the palette is open the input owns the keyboard — don't let tab shortcuts fire
     // mid-path (Alt+digit especially, since Windows paths contain digits). Escape still closes:
@@ -432,26 +435,9 @@ function listenKeys() {
       }
       return;
     }
-    if (e.altKey && !e.ctrlKey && !e.shiftKey && !e.metaKey) {
-      const k = bindingKey(e);
-      if (/^[1-9]$/.test(k)) {
-        e.preventDefault();
-        switchByIndex(Number(k) - 1);
-        return;
-      }
-    }
-    if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey) {
-      if (e.key === 'ArrowLeft') {
-        e.preventDefault();
-        cycleTab(-1);
-        return;
-      }
-      if (e.key === 'ArrowRight') {
-        e.preventDefault();
-        cycleTab(1);
-        return;
-      }
-    }
+    if (!binding) return;
+    e.preventDefault();
+    binding.run();
   });
 }
 
@@ -790,7 +776,7 @@ async function commitConfigDir(row) {
   if (target === palette.configDirs.active) return;
   showLoading();
   try {
-    setApps((await sendJson('POST', '/api/config-dirs/activate', { path: target })).apps);
+    apps = (await sendJson('POST', '/api/config-dirs/activate', { path: target })).apps;
     // The palette renders from this cache before its refetch lands, and initialSel keys off it.
     palette.configDirs.active = target;
     activeConfigDir = target;

package/server.js

@@ -8,6 +8,8 @@ const http = require('http');
 const tcp = require('net');
 const os = require('os');
 const path = require('path');
+const { selectApps } = require('./lib/apps');
+const { stripCookie } = require('./lib/cookies');
 const { createNetGuard } = require('./lib/net-guard');
 
 function getArg(name) {
@@ -19,13 +21,9 @@ function getArg(name) {
 }
 
 const HUB_PORT = parseInt(getArg('port') || process.env.PORT || '3540', 10);
-const MARKETPLACE_PORT = parseInt(getArg('marketplace-port') || '3542', 10);
-const KANBAN_PORT = parseInt(getArg('kanban-port') || '3541', 10);
-const COST_PORT = parseInt(getArg('cost-port') || '3543', 10);
-const MEMORY_PORT = parseInt(getArg('memory-port') || '3544', 10);
+let hubPort = HUB_PORT;
 
 const POOL_SIZE = Math.max(1, parseInt(getArg('pool-size') || '3', 10));
-const DEFAULT_PORTS = { marketplace: MARKETPLACE_PORT, kanban: KANBAN_PORT, cost: COST_PORT, memory: MEMORY_PORT };
 const RESTART_DELAY_MS = 500;
 // A rate window, not a total: a child may die and recover all session, but one that cannot stay up
 // stops being restarted. A consecutive counter cannot express that — anything that starts at all
@@ -87,6 +85,7 @@ function loadHubConfig() {
   const config = { configDirs: dirs, activeConfigDir: active };
   // Hand-edited only; kept verbatim so a rewrite of the file does not drop it.
   if (saved.terminal && typeof saved.terminal === 'object') config.terminal = saved.terminal;
+  if (Array.isArray(saved.apps)) config.apps = saved.apps;
   // Configs saved before canonicalization can hold one dir under two spellings; persist the merge.
   if (serializeConfig(config) !== raw) writeHubConfig(config);
   return config;
@@ -107,6 +106,14 @@ function saveHubConfig() {
 
 const hubConfig = loadHubConfig();
 
+const { apps: ENABLED_APPS, unknown: unknownApps } = selectApps(hubConfig.apps);
+for (const id of unknownApps) console.log(`Unknown app "${id}" in ${HUB_CONFIG_FILE}, ignored`);
+if (!ENABLED_APPS.length) {
+  console.error(`Every app is disabled in ${HUB_CONFIG_FILE}. Enable at least one.`);
+  process.exit(1);
+}
+const appEnabled = (id) => ENABLED_APPS.some((a) => a.id === id);
+
 // Every keystroke into cck's terminal passes through the upgrade proxy below. Windows only, for the
 // reasons in cck/lib/priority.js; the children spawned after this still start at normal.
 if (process.platform === 'win32' && process.env.CCK_PRIORITY_BOOST !== '0') {
@@ -129,7 +136,8 @@ const net = createNetGuard({ appName: 'Claude Code Hub' });
 // the WebSocket. cck applies the rest of its policy (exposure refusal, Origin, session cap) itself.
 const TERMINAL = {
   ...(hubConfig.terminal || {}),
-  enabled: !process.argv.includes('--disable-terminal') && hubConfig.terminal?.enabled !== false,
+  enabled:
+    appEnabled('kanban') && !process.argv.includes('--disable-terminal') && hubConfig.terminal?.enabled !== false,
 };
 const TERMINAL_TOKEN = TERMINAL.enabled ? crypto.randomBytes(32).toString('hex') : null;
 
@@ -185,7 +193,7 @@ function childEnv(pool, name) {
     PORT: '0',
     CLAUDE_CONFIG_DIR: pool.dir,
     CLAUDE_HUB: '1',
-    HUB_URL: `http://localhost:${HUB_PORT}`,
+    HUB_URL: `http://localhost:${hubPort}`,
     HOST: net.BIND_HOST,
     ALLOWED_HOSTS: net.ALLOWED_HOSTS,
   };
@@ -367,10 +375,7 @@ function resolveApp(submoduleDir, npmPackage) {
   return require.resolve(`${npmPackage}/server.js`);
 }
 
-const marketplacePath = resolveApp('marketplace', 'claude-code-marketplace');
-const kanbanPath = resolveApp('cck', 'claude-code-kanban');
-const costPath = resolveApp('cost', 'claude-code-cost');
-const memoryPath = resolveApp('memory', 'claude-code-memory-explorer');
+const appPaths = Object.fromEntries(ENABLED_APPS.map((a) => [a.id, resolveApp(a.dir, a.pkg)]));
 
 // Raise header size limit to 64KB — localhost cookies from sibling apps can pile up and
 // trip Node's default 16KB limit, breaking iframes with HTTP 431.
@@ -381,13 +386,12 @@ const NODE_HDR = `--max-http-header-size=${HDR_BYTES}`;
 // localStorage is keyed by origin, so the sub-app origin has to stay put across switches or the
 // user loses pins and filters every time the active set changes.
 function spawnChildren(pool) {
-  spawnApp(pool, 'marketplace', process.execPath, [NODE_HDR, marketplacePath]);
-  spawnApp(pool, 'kanban', process.execPath, [NODE_HDR, kanbanPath]);
-  spawnApp(pool, 'cost', process.execPath, [NODE_HDR, costPath]);
-  spawnApp(pool, 'memory', process.execPath, [NODE_HDR, memoryPath]);
+  for (const a of ENABLED_APPS) spawnApp(pool, a.id, process.execPath, [NODE_HDR, appPaths[a.id]]);
 }
 
-const publicPorts = { ...DEFAULT_PORTS };
+const publicPorts = Object.fromEntries(
+  ENABLED_APPS.map((a) => [a.id, parseInt(getArg(`${a.id}-port`) || String(a.port), 10)]),
+);
 
 function rewriteOrigin(origin, publicPort, childPort) {
   try {
@@ -432,6 +436,7 @@ async function waitForPort(name, deadline) {
     const pool = activePool();
     const port = pool?.ports[name];
     if (port) return port;
+    if (pool && !pool.children.has(name)) return null;
     const remaining = deadline - Date.now();
     if (remaining <= 0) return null;
     await Promise.race([pool?.children.get(name)?.ready, delay(Math.min(remaining, 250))]);
@@ -527,10 +532,14 @@ function forward(name, req, res, childPort, headers, replayable, onUpstream) {
 // Host is forwarded untouched so the child's hostGuard still sees what the browser sent. Origin is
 // the one header the child cannot judge on its own: its guard compares the port to its own
 // ephemeral one, so the public-port spelling is mapped to the child's; anything else passes
-// through as-is and the child rejects it.
+// through as-is and the child rejects it. Cookies on localhost are shared across ports, so the
+// browser sends the hub's own token cookie to every app; it never reaches a child.
 function proxyHandler(name) {
   return async (req, res) => {
     const headers = { ...req.headers };
+    const cookie = stripCookie(headers.cookie, TOKEN_COOKIE);
+    if (cookie) headers.cookie = cookie;
+    else delete headers.cookie;
     // req is consumed by the first attempt, so only a request with no body can be re-sent. Waiting
     // for a port is not a replay — nothing has been sent yet — so every method gets the same wait.
     const replayable = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';
@@ -559,6 +568,9 @@ function proxyHandler(name) {
         sendUnavailable(req, res, name, 502, err.message);
         return;
       }
+      console.warn(
+        `[${name}] ${req.method} ${req.url.split('?')[0]} to 127.0.0.1:${childPort} failed (${err.code}), retrying`,
+      );
       await delay(ATTEMPT_DELAY_MS);
     }
   };
@@ -577,24 +589,46 @@ function proxyUpgrade(name) {
     }
     const lines = [`${req.method} ${req.url} HTTP/${req.httpVersion}`];
     for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      const header = req.rawHeaders[i].toLowerCase();
       let value = req.rawHeaders[i + 1];
-      if (req.rawHeaders[i].toLowerCase() === 'origin') value = rewriteOrigin(value, publicPorts[name], childPort);
+      if (header === 'origin') value = rewriteOrigin(value, publicPorts[name], childPort);
+      if (header === 'cookie' && !(value = stripCookie(value, TOKEN_COOKIE))) continue;
       lines.push(`${req.rawHeaders[i]}: ${value}`);
     }
-    const upstream = tcp.connect(childPort, '127.0.0.1', () => {
-      clearTimeout(connectTimer);
-      upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
-      if (head?.length) upstream.write(head);
-      upstream.pipe(socket);
-      socket.pipe(upstream);
-    });
-    const connectTimer = setTimeout(() => upstream.destroy(), CONNECT_TIMEOUT_MS);
-    upstream.on('error', () => socket.destroy());
-    socket.on('close', () => upstream.destroy());
-    upstream.on('close', () => socket.destroy());
+    tunnel(name, childPort, `${lines.join('\r\n')}\r\n\r\n`, head, socket, 1);
   };
 }
 
+// A fresh loopback connect to a child sometimes fails at once with ETIMEDOUT on Windows (cause
+// unknown, seen only on a just-started hub), so a connect that never opened is tried once more.
+function tunnel(name, childPort, request, head, socket, retries) {
+  let connected = false;
+  const upstream = tcp.connect(childPort, '127.0.0.1', () => {
+    connected = true;
+    clearTimeout(connectTimer);
+    upstream.write(request);
+    if (head?.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  const connectTimer = setTimeout(() => upstream.destroy(), CONNECT_TIMEOUT_MS);
+  const onSocketClose = () => upstream.destroy();
+  socket.on('close', onSocketClose);
+  upstream.on('error', (err) => {
+    if (connected || socket.destroyed || retries < 1) {
+      if (!connected) console.warn(`[${name}] upgrade connect to 127.0.0.1:${childPort} failed (${err.code})`);
+      socket.destroy();
+      return;
+    }
+    console.warn(`[${name}] upgrade connect to 127.0.0.1:${childPort} failed (${err.code}), retrying`);
+    clearTimeout(connectTimer);
+    socket.off('close', onSocketClose);
+    upstream.removeAllListeners('close');
+    tunnel(name, childPort, request, head, socket, retries - 1);
+  });
+  upstream.on('close', () => socket.destroy());
+}
+
 function listenWithFallback(handler, port, onReady, label, onUpgrade) {
   const opts = { maxHeaderSize: HDR_BYTES, onUpgrade };
   const server = net.listenLoopback(handler, port, onReady, opts);
@@ -606,7 +640,7 @@ function listenWithFallback(handler, port, onReady, label, onUpgrade) {
   return server;
 }
 
-for (const [name, port] of Object.entries(DEFAULT_PORTS)) {
+for (const [name, port] of Object.entries(publicPorts)) {
   listenWithFallback(
     proxyHandler(name),
     port,
@@ -618,8 +652,6 @@ for (const [name, port] of Object.entries(DEFAULT_PORTS)) {
   );
 }
 
-ensurePool(hubConfig.activeConfigDir);
-
 const app = express();
 
 // Mounted before the routes below, which are registered ahead of the first
@@ -646,7 +678,7 @@ const hubVars = (p) => ({
 });
 const themePalettes = (() => {
   try {
-    const themes = JSON.parse(fs.readFileSync(path.join(__dirname, 'scripts/themes.json'), 'utf8'));
+    const themes = JSON.parse(fs.readFileSync(path.join(__dirname, 'lib/themes.json'), 'utf8'));
     return Object.fromEntries(themes.map((t) => [t.id, { dark: hubVars(t.dark), light: hubVars(t.light) }]));
   } catch {
     // Palette falls back to the --accent in index.html; not worth failing startup over.
@@ -655,14 +687,13 @@ const themePalettes = (() => {
 })();
 
 function appsConfig() {
-  const kanban = { name: 'Kanban', url: `http://localhost:${publicPorts.kanban}`, icon: 'columns' };
-  if (TERMINAL_TOKEN) kanban.terminalToken = TERMINAL_TOKEN;
-  return {
-    kanban,
-    marketplace: { name: 'Marketplace', url: `http://localhost:${publicPorts.marketplace}`, icon: 'store' },
-    cost: { name: 'Cost', url: `http://localhost:${publicPorts.cost}`, icon: 'dollar-sign' },
-    memory: { name: 'Memory Diagnoser', url: `http://localhost:${publicPorts.memory}`, icon: 'database' },
-  };
+  return Object.fromEntries(
+    ENABLED_APPS.map((a) => {
+      const entry = { name: a.name, url: `http://localhost:${publicPorts[a.id]}`, icon: a.icon };
+      if (a.id === 'kanban' && TERMINAL_TOKEN) entry.terminalToken = TERMINAL_TOKEN;
+      return [a.id, entry];
+    }),
+  );
 }
 
 app.get('/api/config', (_req, res) => {
@@ -768,7 +799,11 @@ app.get('/api/resolve-path', (req, res) => {
 
 app.use(express.static(path.join(__dirname, 'public')));
 
+// Children get HUB_URL at spawn and trust only that origin, so the first pool waits for the port
+// the hub actually bound: HUB_PORT may be busy and fall back to a random one.
 const onReady = (actual) => {
+  hubPort = actual;
+  ensurePool(hubConfig.activeConfigDir);
   printBanner(actual);
   if (process.argv.includes('--open')) {
     import('open').then((m) => m.default(accessUrl(actual)));