diff --git a/src/__celerity_resource_map__.php b/src/__celerity_resource_map__.php
index bfc4488c0f..b9b29d4975 100644
--- a/src/__celerity_resource_map__.php
+++ b/src/__celerity_resource_map__.php
@@ -1348,7 +1348,7 @@ celerity_register_resource_map(array(
   ),
   'javelin-behavior-dark-console' =>
   array(
-    'uri' => '/res/635a9422/rsrc/js/core/behavior-dark-console.js',
+    'uri' => '/res/1e2c7a5e/rsrc/js/core/behavior-dark-console.js',
     'type' => 'js',
     'requires' =>
     array(
@@ -4050,7 +4050,7 @@ celerity_register_resource_map(array(
       'uri' => '/res/pkg/26980a1c/core.pkg.js',
       'type' => 'js',
     ),
-    '6d1d1e99' =>
+    '4ccfeb47' =>
     array(
       'name' => 'darkconsole.pkg.js',
       'symbols' =>
@@ -4058,7 +4058,7 @@ celerity_register_resource_map(array(
         0 => 'javelin-behavior-dark-console',
         1 => 'javelin-behavior-error-log',
       ),
-      'uri' => '/res/pkg/6d1d1e99/darkconsole.pkg.js',
+      'uri' => '/res/pkg/4ccfeb47/darkconsole.pkg.js',
       'type' => 'js',
     ),
     '8aaacd1b' =>
@@ -4228,7 +4228,7 @@ celerity_register_resource_map(array(
     'javelin-behavior-aphront-drag-and-drop-textarea' => '27c55b30',
     'javelin-behavior-aphront-form-disable-on-submit' => '26980a1c',
     'javelin-behavior-audit-preview' => 'f96657b8',
-    'javelin-behavior-dark-console' => '6d1d1e99',
+    'javelin-behavior-dark-console' => '4ccfeb47',
     'javelin-behavior-device' => '26980a1c',
     'javelin-behavior-differential-accept-with-errors' => '27c55b30',
     'javelin-behavior-differential-add-reviewers-and-ccs' => '27c55b30',
@@ -4244,7 +4244,7 @@ celerity_register_resource_map(array(
     'javelin-behavior-differential-user-select' => '27c55b30',
     'javelin-behavior-diffusion-commit-graph' => 'f96657b8',
     'javelin-behavior-diffusion-pull-lastmodified' => 'f96657b8',
-    'javelin-behavior-error-log' => '6d1d1e99',
+    'javelin-behavior-error-log' => '4ccfeb47',
     'javelin-behavior-global-drag-and-drop' => '26980a1c',
     'javelin-behavior-history-install' => '26980a1c',
     'javelin-behavior-konami' => '26980a1c',
diff --git a/src/aphront/console/DarkConsoleCore.php b/src/aphront/console/DarkConsoleCore.php
index 90c5ec3ca8..310fe04c7d 100644
--- a/src/aphront/console/DarkConsoleCore.php
+++ b/src/aphront/console/DarkConsoleCore.php
@@ -83,6 +83,14 @@ final class DarkConsoleCore {
     return $key;
   }
 
+  public function getColor() {
+    foreach ($this->getPlugins() as $plugin) {
+      if ($plugin->getColor()) {
+        return $plugin->getColor();
+      }
+    }
+  }
+
   public function render(AphrontRequest $request) {
     $user = $request->getUser();
     $visible = $user ? $user->getConsoleVisible() : true;
@@ -94,6 +102,7 @@ final class DarkConsoleCore {
         'class' => 'dark-console',
         'style' => $visible ? '' : 'display: none;',
         'data-console-key' => $this->getKey($request),
+        'data-console-color' => $this->getColor(),
       ),
       '');
   }
diff --git a/src/aphront/console/DarkConsoleDataController.php b/src/aphront/console/DarkConsoleDataController.php
index e5f1cd9e84..af5364fea6 100644
--- a/src/aphront/console/DarkConsoleDataController.php
+++ b/src/aphront/console/DarkConsoleDataController.php
@@ -51,7 +51,8 @@ final class DarkConsoleDataController extends PhabricatorController {
         $panel = $obj->renderPanel();
 
         if (!empty($_COOKIE['phsid'])) {
-          $panel = str_replace(
+          $panel = PhutilSafeHTML::applyFunction(
+            'str_replace',
             $_COOKIE['phsid'],
             '(session-key)',
             $panel);
diff --git a/src/aphront/response/AphrontAjaxResponse.php b/src/aphront/response/AphrontAjaxResponse.php
index c1431e7ed8..61542225ad 100644
--- a/src/aphront/response/AphrontAjaxResponse.php
+++ b/src/aphront/response/AphrontAjaxResponse.php
@@ -42,6 +42,7 @@ final class AphrontAjaxResponse extends AphrontResponse {
         array(
           'uri'     => (string)$this->getRequest()->getRequestURI(),
           'key'     => $console->getKey($this->getRequest()),
+          'color'   => $console->getColor(),
         ));
     }
 
diff --git a/webroot/rsrc/js/core/behavior-dark-console.js b/webroot/rsrc/js/core/behavior-dark-console.js
index c740efc5ab..02c61d0d61 100644
--- a/webroot/rsrc/js/core/behavior-dark-console.js
+++ b/webroot/rsrc/js/core/behavior-dark-console.js
@@ -12,6 +12,11 @@ JX.behavior('dark-console', function(config, statics) {
   var root = statics.root || setup_console();
 
   config.key = config.key || root.getAttribute('data-console-key');
+
+  if (!('color' in config)) {
+    config.color = root.getAttribute('data-console-color');
+  }
+
   add_request(config);
 
   // Do first-time setup.
@@ -71,7 +76,7 @@ JX.behavior('dark-console', function(config, statics) {
       href: '#'
     };
 
-    var link = JX.$N('a', attr, config.uri);
+    var link = JX.$N('a', attr, [get_bullet(config.color), ' ', config.uri]);
     statics.el.reqs.appendChild(link);
     statics.req.all[config.key] = link;
 
@@ -81,6 +86,14 @@ JX.behavior('dark-console', function(config, statics) {
   }
 
 
+  function get_bullet(color) {
+    if (!color) {
+      return null;
+    }
+    return JX.$N('span', {style: {color: color}}, "\u2022");
+  }
+
+
   // Select a request (on load, or when the user clicks one).
   function select_request(key) {
     var req = statics.req;
@@ -155,12 +168,7 @@ JX.behavior('dark-console', function(config, statics) {
         href: '#'
       };
 
-      var bullet = null;
-      if (tab.color) {
-        bullet = JX.$N('span', {style: {color: tab.color}}, "\u2022");
-      }
-
-      var link = JX.$N('a', attr, [bullet, ' ', tab.name]);
+      var link = JX.$N('a', attr, [get_bullet(tab.color), ' ', tab.name]);
       links.push(link);
       statics.tab.all[tab['class']] = link;
       first = first || tab['class'];