From a4561b672de96ad55caa0faef749b94d478500da Mon Sep 17 00:00:00 2001
From: Haitao Pan <haitao.pan@xworkmate.ai>
Date: Sat, 6 Jun 2026 22:08:06 +0800
Subject: [PATCH] fix: accept review bridge token from account sync

---
 ...ime_controllers_settings_account_impl.dart | 10 ++-
 ...ime_controllers_settings_account_test.dart | 65 +++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletion(-)

diff --git a/lib/runtime/runtime_controllers_settings_account_impl.dart b/lib/runtime/runtime_controllers_settings_account_impl.dart
index 04314cc3..866b146d 100644
--- a/lib/runtime/runtime_controllers_settings_account_impl.dart
+++ b/lib/runtime/runtime_controllers_settings_account_impl.dart
@@ -273,7 +273,7 @@ Future<AccountSyncResult> syncAccountSettingsInternal(
     final syncPayload = await client.loadXWorkmateProfileSync(
       token: sessionToken,
     );
-    final bridgeToken = _stringValue(syncPayload['BRIDGE_AUTH_TOKEN']);
+    final bridgeToken = _extractBridgeAuthTokenMetadata(syncPayload);
     if (bridgeToken.isEmpty) {
       return _persistAccountSyncContractFailureInternal(
         controller,
@@ -591,6 +591,14 @@ String _extractBridgeServerUrlMetadata(Map<String, dynamic> payload) {
   return '';
 }
 
+String _extractBridgeAuthTokenMetadata(Map<String, dynamic> payload) {
+  final reviewToken = _stringValue(payload['BRIDGE_REVIEW_AUTH_TOKEN']);
+  if (reviewToken.isNotEmpty) {
+    return reviewToken;
+  }
+  return _stringValue(payload['BRIDGE_AUTH_TOKEN']);
+}
+
 AcpBridgeServerEffectiveConfig resolveAcpBridgeServerEffectiveConfigInternal(
   SettingsController controller, {
   required AcpBridgeServerModeConfig config,
diff --git a/test/runtime/runtime_controllers_settings_account_test.dart b/test/runtime/runtime_controllers_settings_account_test.dart
index 5631e00e..7e178b68 100644
--- a/test/runtime/runtime_controllers_settings_account_test.dart
+++ b/test/runtime/runtime_controllers_settings_account_test.dart
@@ -501,6 +501,71 @@ void main() {
       },
     );
 
+    test(
+      'syncAccountSettings prefers review bridge auth token when present',
+      () async {
+        final storeRoot = await Directory.systemTemp.createTemp(
+          'xworkmate-account-review-bridge-token-',
+        );
+        addTearDown(() async {
+          if (await storeRoot.exists()) {
+            await storeRoot.delete(recursive: true);
+          }
+        });
+
+        final store = SecureConfigStore(
+          secretRootPathResolver: () async => '${storeRoot.path}/secrets',
+          appDataRootPathResolver: () async => '${storeRoot.path}/app-data',
+          supportRootPathResolver: () async => '${storeRoot.path}/support',
+          enableSecureStorage: false,
+        );
+        await store.initialize();
+        await store.saveSettingsSnapshot(
+          SettingsSnapshot.defaults().copyWith(
+            accountBaseUrl: 'https://accounts.svc.plus',
+            accountUsername: 'review@svc.plus',
+            assistantExecutionTarget: AssistantExecutionTarget.gateway,
+          ),
+        );
+        await store.saveAccountSessionToken('session-token');
+
+        final client = _FakeAccountRuntimeClient(
+          loginPayload: const <String, dynamic>{},
+          sessionPayload: const <String, dynamic>{
+            'user': <String, dynamic>{
+              'id': 'user-1',
+              'email': 'review@svc.plus',
+            },
+          },
+          syncPayload: <String, dynamic>{
+            'BRIDGE_REVIEW_AUTH_TOKEN': 'review-bridge-token',
+            'BRIDGE_AUTH_TOKEN': 'multi-tenant-bridge-token',
+            'BRIDGE_SERVER_URL': 'https://xworkmate-bridge-review.svc.plus',
+          },
+        );
+        final controller = SettingsController(
+          store,
+          accountClientFactory: (_) => client,
+        );
+        addTearDown(controller.dispose);
+        await controller.initialize();
+
+        final result = await controller.syncAccountSettings(
+          baseUrl: 'https://accounts.svc.plus',
+        );
+
+        expect(result.state, 'ready');
+        expect(
+          await store.loadAccountManagedSecret(
+            target: kAccountManagedSecretTargetBridgeAuthToken,
+          ),
+          'review-bridge-token',
+        );
+        expect(client.loadProfileCallCount, 1);
+        expect(client.loadXWorkmateProfileSyncCallCount, 1);
+      },
+    );
+
     test(
       'managed bridge endpoint stays fixed regardless of synced bridge url metadata',
       () async {