From fa63529d04102122ce0f97c399217bd4fef6e0ae Mon Sep 17 00:00:00 2001
From: weishu <twsxtd@gmail.com>
Date: Thu, 25 Dec 2025 15:48:45 +0800
Subject: [PATCH] fix: persist CLI_API_TOKEN from env var to settings when not
 already saved

When CLI_API_TOKEN is provided via environment variable, persist it to settings.json
if not already saved. This prevents token regeneration if the env var fails to load
on subsequent startups, ensuring token consistency across server restarts.
---
 server/src/web/cliApiToken.ts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server/src/web/cliApiToken.ts b/server/src/web/cliApiToken.ts
index e5302f5e..ce392e9b 100644
--- a/server/src/web/cliApiToken.ts
+++ b/server/src/web/cliApiToken.ts
@@ -104,6 +104,14 @@ export async function getOrCreateCliApiToken(dataDir: string): Promise<CliApiTok
         if (isWeakToken(envToken)) {
             console.warn('[WARN] CLI_API_TOKEN appears to be weak. Consider using a stronger secret.')
         }
+
+        // Persist env token to file if not already saved (prevents token loss on env var issues)
+        const settings = await readSettings(settingsFile)
+        if (settings !== null && !settings.cliApiToken) {
+            settings.cliApiToken = envToken
+            await writeSettings(settingsFile, settings)
+        }
+
         return { token: envToken, source: 'env', isNew: false, filePath: settingsFile }
     }