dashboard/frontend/src/App.svelte

@@ -121,15 +121,13 @@
       // Proxy auth not available, fall through to regular auth
     }
 
-    // Regular token auth check
-    if (!getToken()) {
+    // Regular token auth check — always try refresh to get fresh cookies
     const refreshed = await tryRefreshSession();
-      if (!refreshed) {
+    if (!refreshed && !getToken()) {
       loading = false;
       authorized = false;
       return;
     }
-    }
 
     try {
         await fetchUserInfo();

dashboard/frontend/src/routes/Terminal.svelte

@@ -266,18 +266,14 @@
       }
 
       async function connect(forceRefresh = false) {
-        // Always refresh token before first connection to ensure fresh cookies
         let d = tabData.get(tabId);
-        const isFirstConnect = !d?.hasConnectedOnce;
 
-        if (forceRefresh || isFirstConnect) {
+        if (forceRefresh) {
           const refreshed = await tryRefreshSession();
           if (!refreshed) {
             handleAuthExpired();
             return null;
           }
-          // Mark that we've connected once with fresh token
-          if (d) d.hasConnectedOnce = true;
         }
 
         const ws = new WebSocket(