dashboard/frontend/src/App.svelte

@@ -121,14 +121,12 @@
       // Proxy auth not available, fall through to regular auth
     }
 
-    // Regular token auth check
+    // Regular token auth check — always try refresh to get fresh cookies
-    if (!getToken()) {
+    const refreshed = await tryRefreshSession();
-      const refreshed = await tryRefreshSession();
+    if (!refreshed && !getToken()) {
-      if (!refreshed) {
+      loading = false;
-        loading = false;
+      authorized = false;
-        authorized = false;
+      return;
-        return;
-      }
     }
 
     try {

dashboard/frontend/src/routes/Terminal.svelte

@@ -266,18 +266,14 @@
       }
 
       async function connect(forceRefresh = false) {
-        // Always refresh token before first connection to ensure fresh cookies
         let d = tabData.get(tabId);
-        const isFirstConnect = !d?.hasConnectedOnce;
 
-        if (forceRefresh || isFirstConnect) {
+        if (forceRefresh) {
           const refreshed = await tryRefreshSession();
           if (!refreshed) {
             handleAuthExpired();
             return null;
           }
-          // Mark that we've connected once with fresh token
-          if (d) d.hasConnectedOnce = true;
         }
 
         const ws = new WebSocket(