claude-code-hub 0.41.0 → 0.42.0

package/lib/cookies.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// Returns the Cookie header value without the named cookie, or '' when nothing is left.
+function stripCookie(header, name) {
+  if (typeof header !== 'string') return '';
+  return header
+    .split(';')
+    .map((part) => part.trim())
+    .filter((part) => part && part.split('=', 1)[0].trim() !== name)
+    .join('; ');
+}
+
+module.exports = { stripCookie };

package/lib/themes.json

@@ -0,0 +1,548 @@
+[
+ {
+  "id": "ember",
+  "label": "Ember",
+  "dark": {
+   "ember": "#e86f33",
+   "emberGlow": "#f0a070",
+   "emberDim": "rgba(232,111,51,0.25)",
+   "field": "#101114",
+   "surface": "#16181c",
+   "elevated": "#1e2025",
+   "hover": "#282a30",
+   "border": "#363840",
+   "ink1": "#f0f1f3",
+   "ink2": "#c2c4c9",
+   "ink3": "#9a9da5",
+   "inkMuted": "#7d808a"
+  },
+  "light": {
+   "ember": "#e86f33",
+   "emberGlow": "#a0501c",
+   "emberDim": "rgba(184,90,32,0.18)",
+   "field": "#e8e6e3",
+   "surface": "#efede9",
+   "elevated": "#fbfaf9",
+   "hover": "#d2d0cc",
+   "border": "#cfcbc4",
+   "ink1": "#0a0a0a",
+   "ink2": "#2c2c2c",
+   "ink3": "#565656",
+   "inkMuted": "#767676"
+  }
+ },
+ {
+  "id": "gruvbox",
+  "label": "Gruvbox",
+  "dark": {
+   "ember": "#fe8019",
+   "emberGlow": "#f9b27c",
+   "emberDim": "rgba(254,128,25,0.25)",
+   "field": "#1d2021",
+   "surface": "#282828",
+   "elevated": "#32302f",
+   "hover": "#3c3836",
+   "border": "#504945",
+   "ink1": "#ebdbb2",
+   "ink2": "#d5c4a1",
+   "ink3": "#bdae93",
+   "inkMuted": "#928374"
+  },
+  "light": {
+   "ember": "#d65d0e",
+   "emberGlow": "#af3a03",
+   "emberDim": "rgba(214,93,14,0.18)",
+   "field": "#ede7d5",
+   "surface": "#f3eee0",
+   "elevated": "#faf7ec",
+   "hover": "#e4dcc6",
+   "border": "#c9bc9d",
+   "ink1": "#3c3836",
+   "ink2": "#504945",
+   "ink3": "#665c54",
+   "inkMuted": "#7c6f64"
+  }
+ },
+ {
+  "id": "catppuccin",
+  "label": "Catppuccin",
+  "dark": {
+   "ember": "#cba6f7",
+   "emberGlow": "#d8c2fa",
+   "emberDim": "rgba(203,166,247,0.25)",
+   "field": "#11111b",
+   "surface": "#181825",
+   "elevated": "#1e1e2e",
+   "hover": "#313244",
+   "border": "#45475a",
+   "ink1": "#cdd6f4",
+   "ink2": "#bac2de",
+   "ink3": "#a6adc8",
+   "inkMuted": "#7f849c"
+  },
+  "light": {
+   "ember": "#8839ef",
+   "emberGlow": "#6f2dbd",
+   "emberDim": "rgba(136,57,239,0.18)",
+   "field": "#e6e9ef",
+   "surface": "#eff1f5",
+   "elevated": "#ffffff",
+   "hover": "#ccd0da",
+   "border": "#bcc0cc",
+   "ink1": "#4c4f69",
+   "ink2": "#5c5f77",
+   "ink3": "#6c6f85",
+   "inkMuted": "#8c8fa1"
+  }
+ },
+ {
+  "id": "tokyo-night",
+  "label": "Tokyo Night",
+  "dark": {
+   "ember": "#7aa2f7",
+   "emberGlow": "#9ab8ff",
+   "emberDim": "rgba(122,162,247,0.25)",
+   "field": "#16161e",
+   "surface": "#1a1b26",
+   "elevated": "#1f2335",
+   "hover": "#292e42",
+   "border": "#3b4261",
+   "ink1": "#c0caf5",
+   "ink2": "#a9b1d6",
+   "ink3": "#787c99",
+   "inkMuted": "#565f89"
+  },
+  "light": {
+   "ember": "#2e7de9",
+   "emberGlow": "#1659c7",
+   "emberDim": "rgba(46,125,233,0.18)",
+   "field": "#e1e2e7",
+   "surface": "#e9eaf0",
+   "elevated": "#f7f8fc",
+   "hover": "#d0d5e3",
+   "border": "#a8aecb",
+   "ink1": "#343b58",
+   "ink2": "#565a6e",
+   "ink3": "#6c6e75",
+   "inkMuted": "#848cb5"
+  }
+ },
+ {
+  "id": "solarized",
+  "label": "Solarized",
+  "dark": {
+   "ember": "#c96f47",
+   "emberGlow": "#d48a6a",
+   "emberDim": "rgba(201,111,71,0.25)",
+   "field": "#002b36",
+   "surface": "#073642",
+   "elevated": "#0a4250",
+   "hover": "#11505f",
+   "border": "#586e75",
+   "ink1": "#e2dfd0",
+   "ink2": "#b7c0bf",
+   "ink3": "#93a1a1",
+   "inkMuted": "#839496"
+  },
+  "light": {
+   "ember": "#2280c2",
+   "emberGlow": "#1b6aa3",
+   "emberDim": "rgba(34,128,194,0.18)",
+   "field": "#eee8d5",
+   "sidebar": "#e6dfc7",
+   "sidebarItem": "#f3ecd6",
+   "surface": "#fdf6e3",
+   "elevated": "#fffbef",
+   "hover": "#efe8d3",
+   "border": "#cdc4ab",
+   "ink1": "#073642",
+   "ink2": "#4f6369",
+   "ink3": "#586e75",
+   "inkMuted": "#728589"
+  }
+ },
+ {
+  "id": "dracula",
+  "label": "Dracula",
+  "dark": {
+   "ember": "#bd93f9",
+   "emberGlow": "#d6b5ff",
+   "emberDim": "rgba(189,147,249,0.25)",
+   "field": "#21222c",
+   "surface": "#282a36",
+   "elevated": "#343746",
+   "hover": "#44475a",
+   "border": "#565a75",
+   "ink1": "#f8f8f2",
+   "ink2": "#d8d8d2",
+   "ink3": "#b0b3c5",
+   "inkMuted": "#6272a4"
+  },
+  "light": {
+   "ember": "#7c3aed",
+   "emberGlow": "#5b21b6",
+   "emberDim": "rgba(124,58,237,0.18)",
+   "field": "#e8e8ee",
+   "surface": "#f0f0f5",
+   "elevated": "#fbfbfd",
+   "hover": "#dfdfe8",
+   "border": "#c9c9d6",
+   "ink1": "#16161e",
+   "ink2": "#34343f",
+   "ink3": "#5a5a68",
+   "inkMuted": "#787885"
+  }
+ },
+ {
+  "id": "nord",
+  "label": "Nord",
+  "dark": {
+   "ember": "#88c0d0",
+   "emberGlow": "#a8d8e8",
+   "emberDim": "rgba(136,192,208,0.25)",
+   "field": "#272c36",
+   "surface": "#2e3440",
+   "elevated": "#3b4252",
+   "hover": "#434c5e",
+   "border": "#4c566a",
+   "ink1": "#eceff4",
+   "ink2": "#d8dee9",
+   "ink3": "#aeb6c5",
+   "inkMuted": "#7b88a1"
+  },
+  "light": {
+   "ember": "#5e81ac",
+   "emberGlow": "#44688f",
+   "emberDim": "rgba(94,129,172,0.18)",
+   "field": "#e5e9f0",
+   "surface": "#eceff4",
+   "elevated": "#f8f9fb",
+   "hover": "#d8dee9",
+   "border": "#c2c9d6",
+   "ink1": "#2e3440",
+   "ink2": "#3b4252",
+   "ink3": "#4c566a",
+   "inkMuted": "#6b7589"
+  }
+ },
+ {
+  "id": "rose-pine",
+  "label": "Rosé Pine",
+  "dark": {
+   "ember": "#c4a7e7",
+   "emberGlow": "#d9c4f2",
+   "emberDim": "rgba(196,167,231,0.25)",
+   "field": "#191724",
+   "surface": "#1f1d2e",
+   "elevated": "#26233a",
+   "hover": "#34304e",
+   "border": "#403d52",
+   "ink1": "#e0def4",
+   "ink2": "#c5c2dd",
+   "ink3": "#908caa",
+   "inkMuted": "#6e6a86"
+  },
+  "light": {
+   "ember": "#907aa9",
+   "emberGlow": "#6f598c",
+   "emberDim": "rgba(144,122,169,0.18)",
+   "field": "#f2e9e1",
+   "surface": "#faf4ed",
+   "elevated": "#fffaf3",
+   "hover": "#ebdfd4",
+   "border": "#cecacd",
+   "ink1": "#575279",
+   "ink2": "#635e87",
+   "ink3": "#6e6a88",
+   "inkMuted": "#857f96"
+  }
+ },
+ {
+  "id": "everforest",
+  "label": "Everforest",
+  "dark": {
+   "ember": "#a7c080",
+   "emberGlow": "#c3d6a2",
+   "emberDim": "rgba(167,192,128,0.25)",
+   "field": "#232a2e",
+   "surface": "#2d353b",
+   "elevated": "#343f44",
+   "hover": "#3d484d",
+   "border": "#475258",
+   "ink1": "#d3c6aa",
+   "ink2": "#bfb6a3",
+   "ink3": "#9da9a0",
+   "inkMuted": "#859289"
+  },
+  "light": {
+   "ember": "#6f8352",
+   "emberGlow": "#56683f",
+   "emberDim": "rgba(111,131,82,0.18)",
+   "field": "#ebeadb",
+   "surface": "#f5f4e8",
+   "elevated": "#fbfbf4",
+   "hover": "#e5e4d3",
+   "border": "#d3d2bf",
+   "ink1": "#3d484e",
+   "ink2": "#55636b",
+   "ink3": "#66705f",
+   "inkMuted": "#7a8577"
+  }
+ },
+ {
+  "id": "kanagawa",
+  "label": "Kanagawa",
+  "dark": {
+   "ember": "#7e9cd8",
+   "emberGlow": "#9fb9ec",
+   "emberDim": "rgba(126,156,216,0.25)",
+   "field": "#16161d",
+   "surface": "#1f1f28",
+   "elevated": "#2a2a37",
+   "hover": "#363646",
+   "border": "#54546d",
+   "ink1": "#dcd7ba",
+   "ink2": "#c8c093",
+   "ink3": "#a6a69c",
+   "inkMuted": "#727169"
+  },
+  "light": {
+   "ember": "#4d699b",
+   "emberGlow": "#38537f",
+   "emberDim": "rgba(77,105,155,0.18)",
+   "field": "#e9e5d6",
+   "surface": "#f3f0e4",
+   "elevated": "#faf8f1",
+   "hover": "#e2ddcb",
+   "border": "#d2ccb6",
+   "ink1": "#545464",
+   "ink2": "#66667a",
+   "ink3": "#716e61",
+   "inkMuted": "#8a8775"
+  }
+ },
+ {
+  "id": "one-dark",
+  "label": "One Dark",
+  "dark": {
+   "ember": "#61afef",
+   "emberGlow": "#8cc7ff",
+   "emberDim": "rgba(97,175,239,0.25)",
+   "field": "#21252b",
+   "surface": "#282c34",
+   "elevated": "#2f343e",
+   "hover": "#3e4452",
+   "border": "#4b5263",
+   "ink1": "#d7dae0",
+   "ink2": "#abb2bf",
+   "ink3": "#8b919e",
+   "inkMuted": "#5c6370"
+  },
+  "light": {
+   "ember": "#4078f2",
+   "emberGlow": "#2c5dd4",
+   "emberDim": "rgba(64,120,242,0.18)",
+   "field": "#eaeaeb",
+   "surface": "#fafafa",
+   "elevated": "#ffffff",
+   "hover": "#e0e0e2",
+   "border": "#d4d4d6",
+   "ink1": "#383a42",
+   "ink2": "#50525a",
+   "ink3": "#696c77",
+   "inkMuted": "#a0a1a7"
+  }
+ },
+ {
+  "id": "night-owl",
+  "label": "Night Owl",
+  "dark": {
+   "ember": "#82aaff",
+   "emberGlow": "#a8c4ff",
+   "emberDim": "rgba(130,170,255,0.25)",
+   "field": "#011627",
+   "surface": "#0b2942",
+   "elevated": "#13344f",
+   "hover": "#1d3b53",
+   "border": "#5f7e97",
+   "ink1": "#d6deeb",
+   "ink2": "#b8c5d6",
+   "ink3": "#8ba3b8",
+   "inkMuted": "#637777"
+  },
+  "light": {
+   "ember": "#0c969b",
+   "emberGlow": "#0a7479",
+   "emberDim": "rgba(12,150,155,0.18)",
+   "field": "#ededed",
+   "surface": "#f6f6f6",
+   "elevated": "#fbfbfb",
+   "hover": "#e2e2e2",
+   "border": "#d0d0d0",
+   "ink1": "#403f53",
+   "ink2": "#545167",
+   "ink3": "#6f6e85",
+   "inkMuted": "#989fb1"
+  }
+ },
+ {
+  "id": "monokai",
+  "label": "Monokai Pro",
+  "dark": {
+   "ember": "#ffd866",
+   "emberGlow": "#ffe6a0",
+   "emberDim": "rgba(255,216,102,0.25)",
+   "field": "#221f22",
+   "surface": "#2d2a2e",
+   "elevated": "#403e41",
+   "hover": "#4a484b",
+   "border": "#5b595c",
+   "ink1": "#fcfcfa",
+   "ink2": "#d9d8d6",
+   "ink3": "#939293",
+   "inkMuted": "#727072"
+  },
+  "light": {
+   "ember": "#c08a00",
+   "emberGlow": "#856000",
+   "emberDim": "rgba(192,138,0,0.18)",
+   "field": "#e9e6e4",
+   "surface": "#f1efed",
+   "elevated": "#fcfbfa",
+   "hover": "#e0dcda",
+   "border": "#cdc8c5",
+   "ink1": "#2c292d",
+   "ink2": "#46434a",
+   "ink3": "#6b686d",
+   "inkMuted": "#8d8a8d"
+  }
+ },
+ {
+  "id": "github",
+  "label": "GitHub",
+  "dark": {
+   "ember": "#58a6ff",
+   "emberGlow": "#85bdff",
+   "emberDim": "rgba(88,166,255,0.25)",
+   "field": "#1f2428",
+   "surface": "#24292e",
+   "elevated": "#2b3138",
+   "hover": "#2f363d",
+   "border": "#444d56",
+   "ink1": "#e1e4e8",
+   "ink2": "#d1d5da",
+   "ink3": "#959da5",
+   "inkMuted": "#6a737d"
+  },
+  "light": {
+   "ember": "#0366d6",
+   "emberGlow": "#044289",
+   "emberDim": "rgba(3,102,214,0.18)",
+   "field": "#f0f2f4",
+   "surface": "#f6f8fa",
+   "elevated": "#ffffff",
+   "hover": "#e8eaed",
+   "border": "#d1d5da",
+   "ink1": "#24292e",
+   "ink2": "#444d56",
+   "ink3": "#586069",
+   "inkMuted": "#6a737d"
+  }
+ },
+ {
+  "id": "ayu",
+  "label": "Ayu",
+  "dark": {
+   "ember": "#e6b450",
+   "emberGlow": "#f0cd85",
+   "emberDim": "rgba(230,180,80,0.25)",
+   "field": "#0d1017",
+   "surface": "#10141c",
+   "elevated": "#141821",
+   "hover": "#1d2330",
+   "border": "#2d3343",
+   "ink1": "#bfbdb6",
+   "ink2": "#a8a6a0",
+   "ink3": "#8a9199",
+   "inkMuted": "#6c7380"
+  },
+  "light": {
+   "ember": "#c97612",
+   "emberGlow": "#a65e0c",
+   "emberDim": "rgba(201,118,18,0.18)",
+   "field": "#eff1f3",
+   "surface": "#f8f9fa",
+   "elevated": "#fcfcfc",
+   "hover": "#e7eaed",
+   "border": "#d8dde2",
+   "ink1": "#3d4149",
+   "ink2": "#5c6166",
+   "ink3": "#787b80",
+   "inkMuted": "#8a9199"
+  }
+ },
+ {
+  "id": "vitesse",
+  "label": "Vitesse",
+  "dark": {
+   "ember": "#4d9375",
+   "emberGlow": "#6fb392",
+   "emberDim": "rgba(77,147,117,0.25)",
+   "field": "#121212",
+   "surface": "#181818",
+   "elevated": "#1e1e1e",
+   "hover": "#262626",
+   "border": "#333333",
+   "ink1": "#dbd7ca",
+   "ink2": "#bfbaaa",
+   "ink3": "#8f8f85",
+   "inkMuted": "#758575"
+  },
+  "light": {
+   "ember": "#1c6b48",
+   "emberGlow": "#145236",
+   "emberDim": "rgba(28,107,72,0.18)",
+   "field": "#f0f0f0",
+   "surface": "#f7f7f7",
+   "elevated": "#ffffff",
+   "hover": "#e7e7e7",
+   "border": "#d6d6d6",
+   "ink1": "#393a34",
+   "ink2": "#4e4f47",
+   "ink3": "#6b6d63",
+   "inkMuted": "#a0ada0"
+  }
+ },
+ {
+  "id": "synthwave",
+  "label": "Synthwave '84",
+  "dark": {
+   "ember": "#ff7edb",
+   "emberGlow": "#ffa9e7",
+   "emberDim": "rgba(255,126,219,0.25)",
+   "field": "#241b2f",
+   "surface": "#262335",
+   "elevated": "#322a47",
+   "hover": "#3d3460",
+   "border": "#495495",
+   "ink1": "#ffffff",
+   "ink2": "#d8d6e8",
+   "ink3": "#b6b1d8",
+   "inkMuted": "#848bbd"
+  },
+  "light": {
+   "ember": "#c936a6",
+   "emberGlow": "#9c2381",
+   "emberDim": "rgba(201,54,166,0.18)",
+   "field": "#e6e2f0",
+   "surface": "#efecf6",
+   "elevated": "#fbfafd",
+   "hover": "#ddd7ec",
+   "border": "#c5bcdd",
+   "ink1": "#241b2f",
+   "ink2": "#3d3455",
+   "ink3": "#5c5380",
+   "inkMuted": "#7d76a3"
+  }
+ }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-hub",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "description": "Unified hub for Claude Code tools — Marketplace + Kanban in one PWA",
   "main": "server.js",
   "bin": {
@@ -9,6 +9,7 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node server.js --open",
+    "test": "node --test test/*.test.js",
     "update": "bash scripts/update-submodules.sh",
     "update:check": "bash scripts/update-submodules.sh --check",
     "lint": "npx @biomejs/biome check public/app.js server.js && npm run check:escaping && npm run check:security-lib",
@@ -43,10 +44,10 @@
   },
   "homepage": "https://github.com/NikiforovAll/claude-code-hub#readme",
   "dependencies": {
-    "claude-code-cost": "^0.25.0",
-    "claude-code-kanban": "^4.30.0",
-    "claude-code-marketplace": "^0.21.0",
-    "claude-code-memory-explorer": "^0.16.0",
+    "claude-code-cost": "^0.26.0",
+    "claude-code-kanban": "^4.31.1",
+    "claude-code-marketplace": "^0.22.0",
+    "claude-code-memory-explorer": "^0.17.0",
     "express": "^4.21.0",
     "open": "^10.1.0"
   },

package/public/app.js

@@ -3,7 +3,6 @@ let activeApp = null;
 const iframes = {};
 const loadedApps = new Set();
 const guardedApps = new Set();
-let allowedOrigins = new Set();
 // {theme: 'dark'|'light', colorTheme: '<id>', colorThemes: {<configDir>: '<id>'}} — survives hub
 // reloads so late-loading iframes and fresh sessions get the last chosen theme. Light/dark is
 // global; the color theme is per config dir, and colorTheme is the last one picked anywhere, which
@@ -55,7 +54,7 @@ function themeMessage() {
 }
 
 // {<themeId>: {dark, light}}, each a map of CSS variables, from /api/config, which derives it from
-// scripts/themes.json — the same registry that generates each sub-app's themes.css. Empty until
+// lib/themes.json — the same registry that generates each sub-app's themes.css. Empty until
 // config arrives, and empty if the registry is unreadable; then the hub keeps index.html's colors.
 let themePalettes = {};
 // The last applied variables, so the loading screen paints in the theme before /api/config lands.
@@ -151,7 +150,7 @@ async function init() {
   showLoading();
   const res = await fetch('/api/config');
   const config = await res.json();
-  setApps(config.apps);
+  apps = config.apps;
   defaultConfigDir = config.defaultConfigDir ?? null;
   activeConfigDir = config.activeConfigDir ?? null;
   applyTitle(config.activeConfigDir);
@@ -172,11 +171,6 @@ function applyTitle(dir) {
   document.title = dir && dir !== defaultConfigDir ? basename(dir) : 'Claude Code Hub';
 }
 
-function setApps(next) {
-  apps = next;
-  allowedOrigins = new Set(Object.values(apps).map((a) => new URL(a.url).origin));
-}
-
 // After a config-dir switch every child is a new process, possibly on a new port. Reloading each
 // iframe from scratch also drops the sub-apps' in-memory project state, which belonged to the old
 // dir; the hub's own projectState is cleared for the same reason.
@@ -312,7 +306,8 @@ function listenMessages() {
     if (guardedApps.size) e.preventDefault();
   });
   window.addEventListener('message', (e) => {
-    if (!allowedOrigins.has(e.origin)) return;
+    const appId = appIdOf(e.source);
+    if (!appId || e.origin !== originOf(appId)) return;
     const data = e.data ?? {};
     if (data.type === 'hub:navigate') {
       if (!apps[data.app]) return;
@@ -324,14 +319,10 @@ function listenMessages() {
     } else if (data.type === 'hub:keydown') {
       handleForwardedKey(data);
     } else if (data.type === 'hub:closeGuard') {
-      const appId = appIdOf(e.source);
-      if (!appId) return;
       if (data.on === true) guardedApps.add(appId);
       else guardedApps.delete(appId);
     } else if (data.type === 'hub:terminalToken') {
       // This hub page may have outlived the restart too, so the cached token is not trusted.
-      const appId = appIdOf(e.source);
-      if (!appId) return;
       sendJson('GET', '/api/config')
         .then((cfg) => {
           const token = cfg.apps?.[appId]?.terminalToken;
@@ -785,7 +776,7 @@ async function commitConfigDir(row) {
   if (target === palette.configDirs.active) return;
   showLoading();
   try {
-    setApps((await sendJson('POST', '/api/config-dirs/activate', { path: target })).apps);
+    apps = (await sendJson('POST', '/api/config-dirs/activate', { path: target })).apps;
     // The palette renders from this cache before its refetch lands, and initialSel keys off it.
     palette.configDirs.active = target;
     activeConfigDir = target;

package/server.js

@@ -9,6 +9,7 @@ const tcp = require('net');
 const os = require('os');
 const path = require('path');
 const { selectApps } = require('./lib/apps');
+const { stripCookie } = require('./lib/cookies');
 const { createNetGuard } = require('./lib/net-guard');
 
 function getArg(name) {
@@ -20,6 +21,7 @@ function getArg(name) {
 }
 
 const HUB_PORT = parseInt(getArg('port') || process.env.PORT || '3540', 10);
+let hubPort = HUB_PORT;
 
 const POOL_SIZE = Math.max(1, parseInt(getArg('pool-size') || '3', 10));
 const RESTART_DELAY_MS = 500;
@@ -191,7 +193,7 @@ function childEnv(pool, name) {
     PORT: '0',
     CLAUDE_CONFIG_DIR: pool.dir,
     CLAUDE_HUB: '1',
-    HUB_URL: `http://localhost:${HUB_PORT}`,
+    HUB_URL: `http://localhost:${hubPort}`,
     HOST: net.BIND_HOST,
     ALLOWED_HOSTS: net.ALLOWED_HOSTS,
   };
@@ -530,10 +532,14 @@ function forward(name, req, res, childPort, headers, replayable, onUpstream) {
 // Host is forwarded untouched so the child's hostGuard still sees what the browser sent. Origin is
 // the one header the child cannot judge on its own: its guard compares the port to its own
 // ephemeral one, so the public-port spelling is mapped to the child's; anything else passes
-// through as-is and the child rejects it.
+// through as-is and the child rejects it. Cookies on localhost are shared across ports, so the
+// browser sends the hub's own token cookie to every app; it never reaches a child.
 function proxyHandler(name) {
   return async (req, res) => {
     const headers = { ...req.headers };
+    const cookie = stripCookie(headers.cookie, TOKEN_COOKIE);
+    if (cookie) headers.cookie = cookie;
+    else delete headers.cookie;
     // req is consumed by the first attempt, so only a request with no body can be re-sent. Waiting
     // for a port is not a replay — nothing has been sent yet — so every method gets the same wait.
     const replayable = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';
@@ -562,6 +568,9 @@ function proxyHandler(name) {
         sendUnavailable(req, res, name, 502, err.message);
         return;
       }
+      console.warn(
+        `[${name}] ${req.method} ${req.url.split('?')[0]} to 127.0.0.1:${childPort} failed (${err.code}), retrying`,
+      );
       await delay(ATTEMPT_DELAY_MS);
     }
   };
@@ -580,24 +589,46 @@ function proxyUpgrade(name) {
     }
     const lines = [`${req.method} ${req.url} HTTP/${req.httpVersion}`];
     for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      const header = req.rawHeaders[i].toLowerCase();
       let value = req.rawHeaders[i + 1];
-      if (req.rawHeaders[i].toLowerCase() === 'origin') value = rewriteOrigin(value, publicPorts[name], childPort);
+      if (header === 'origin') value = rewriteOrigin(value, publicPorts[name], childPort);
+      if (header === 'cookie' && !(value = stripCookie(value, TOKEN_COOKIE))) continue;
       lines.push(`${req.rawHeaders[i]}: ${value}`);
     }
-    const upstream = tcp.connect(childPort, '127.0.0.1', () => {
-      clearTimeout(connectTimer);
-      upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
-      if (head?.length) upstream.write(head);
-      upstream.pipe(socket);
-      socket.pipe(upstream);
-    });
-    const connectTimer = setTimeout(() => upstream.destroy(), CONNECT_TIMEOUT_MS);
-    upstream.on('error', () => socket.destroy());
-    socket.on('close', () => upstream.destroy());
-    upstream.on('close', () => socket.destroy());
+    tunnel(name, childPort, `${lines.join('\r\n')}\r\n\r\n`, head, socket, 1);
   };
 }
 
+// A fresh loopback connect to a child sometimes fails at once with ETIMEDOUT on Windows (cause
+// unknown, seen only on a just-started hub), so a connect that never opened is tried once more.
+function tunnel(name, childPort, request, head, socket, retries) {
+  let connected = false;
+  const upstream = tcp.connect(childPort, '127.0.0.1', () => {
+    connected = true;
+    clearTimeout(connectTimer);
+    upstream.write(request);
+    if (head?.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  const connectTimer = setTimeout(() => upstream.destroy(), CONNECT_TIMEOUT_MS);
+  const onSocketClose = () => upstream.destroy();
+  socket.on('close', onSocketClose);
+  upstream.on('error', (err) => {
+    if (connected || socket.destroyed || retries < 1) {
+      if (!connected) console.warn(`[${name}] upgrade connect to 127.0.0.1:${childPort} failed (${err.code})`);
+      socket.destroy();
+      return;
+    }
+    console.warn(`[${name}] upgrade connect to 127.0.0.1:${childPort} failed (${err.code}), retrying`);
+    clearTimeout(connectTimer);
+    socket.off('close', onSocketClose);
+    upstream.removeAllListeners('close');
+    tunnel(name, childPort, request, head, socket, retries - 1);
+  });
+  upstream.on('close', () => socket.destroy());
+}
+
 function listenWithFallback(handler, port, onReady, label, onUpgrade) {
   const opts = { maxHeaderSize: HDR_BYTES, onUpgrade };
   const server = net.listenLoopback(handler, port, onReady, opts);
@@ -621,8 +652,6 @@ for (const [name, port] of Object.entries(publicPorts)) {
   );
 }
 
-ensurePool(hubConfig.activeConfigDir);
-
 const app = express();
 
 // Mounted before the routes below, which are registered ahead of the first
@@ -649,7 +678,7 @@ const hubVars = (p) => ({
 });
 const themePalettes = (() => {
   try {
-    const themes = JSON.parse(fs.readFileSync(path.join(__dirname, 'scripts/themes.json'), 'utf8'));
+    const themes = JSON.parse(fs.readFileSync(path.join(__dirname, 'lib/themes.json'), 'utf8'));
     return Object.fromEntries(themes.map((t) => [t.id, { dark: hubVars(t.dark), light: hubVars(t.light) }]));
   } catch {
     // Palette falls back to the --accent in index.html; not worth failing startup over.
@@ -770,7 +799,11 @@ app.get('/api/resolve-path', (req, res) => {
 
 app.use(express.static(path.join(__dirname, 'public')));
 
+// Children get HUB_URL at spawn and trust only that origin, so the first pool waits for the port
+// the hub actually bound: HUB_PORT may be busy and fall back to a random one.
 const onReady = (actual) => {
+  hubPort = actual;
+  ensurePool(hubConfig.activeConfigDir);
   printBanner(actual);
   if (process.argv.includes('--open')) {
     import('open').then((m) => m.default(accessUrl(actual)));