From 2bae4d2dba8460e1bfd51f23d3f59e39a7f5a2b6 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 15 Jan 2026 08:28:28 +0000
Subject: [PATCH] fix(ui): override token from URL

---
 ui/src/ui/app-settings.ts            | 2 +-
 ui/src/ui/navigation.browser.test.ts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ui/src/ui/app-settings.ts b/ui/src/ui/app-settings.ts
index f3b9d4a7f..2e485307d 100644
--- a/ui/src/ui/app-settings.ts
+++ b/ui/src/ui/app-settings.ts
@@ -64,7 +64,7 @@ export function applySettingsFromUrl(host: SettingsHost) {
 
   if (tokenRaw != null) {
     const token = tokenRaw.trim();
-    if (token && !host.settings.token) {
+    if (token && token !== host.settings.token) {
       applySettings(host, { ...host.settings, token });
     }
     params.delete("token");
diff --git a/ui/src/ui/navigation.browser.test.ts b/ui/src/ui/navigation.browser.test.ts
index e8e11094b..c2f238d49 100644
--- a/ui/src/ui/navigation.browser.test.ts
+++ b/ui/src/ui/navigation.browser.test.ts
@@ -167,7 +167,7 @@ describe("control UI routing", () => {
     expect(window.location.search).toBe("");
   });
 
-  it("strips auth params even when settings already set", async () => {
+  it("hydrates token from URL params even when settings already set", async () => {
     localStorage.setItem(
       "clawdbot.control.settings.v1",
       JSON.stringify({ token: "existing-token" }),
@@ -175,7 +175,7 @@ describe("control UI routing", () => {
     const app = mountApp("/ui/overview?token=abc123");
     await app.updateComplete;
 
-    expect(app.settings.token).toBe("existing-token");
+    expect(app.settings.token).toBe("abc123");
     expect(window.location.pathname).toBe("/ui/overview");
     expect(window.location.search).toBe("");
   });