From a4aea523224b8d166d5acca203954ee89b7fd250 Mon Sep 17 00:00:00 2001
From: Daniel Salazar <daniel.salazar@puter.com>
Date: Wed, 11 Mar 2026 15:27:30 -0700
Subject: [PATCH] fix: keep bootstrap in url for app to do whatever (#2648)

* fix: only set authToken if present for apps

* fix: keep bootstrap in url for app to do whatever
---
 src/puter-js/src/index.js | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/src/puter-js/src/index.js b/src/puter-js/src/index.js
index 75ac053d7..e8f57dfc8 100644
--- a/src/puter-js/src/index.js
+++ b/src/puter-js/src/index.js
@@ -340,27 +340,9 @@ const puterInit = (function () {
                 const bootstrapAuthToken = normalizeAuthTokenCandidate(
                     URLParams.get('puter.auth.token') ?? URLParams.get('auth_token'),
                 );
-                this.authToken = bootstrapAuthToken;
-                // initialize submodules
-                this.initSubmodules();
                 try {
                     if ( bootstrapAuthToken ) {
                         this.setAuthToken(bootstrapAuthToken);
-
-                        // Token-in-query is bootstrap-only; persist it then scrub from URL.
-                        if ( globalThis.history?.replaceState && globalThis.location?.href ) {
-                            const currentUrl = new URL(globalThis.location.href);
-                            const hadBootstrapToken =
-                                currentUrl.searchParams.has('puter.auth.token')
-                                || currentUrl.searchParams.has('auth_token');
-                            if ( hadBootstrapToken ) {
-                                currentUrl.searchParams.delete('puter.auth.token');
-                                currentUrl.searchParams.delete('auth_token');
-                                const currentUrlSearch = currentUrl.searchParams.toString();
-                                const sanitizedRelativeUrl = `${currentUrl.pathname}${currentUrlSearch ? `?${currentUrlSearch}` : ''}${currentUrl.hash || ''}`;
-                                globalThis.history.replaceState(globalThis.history.state, '', sanitizedRelativeUrl);
-                            }
-                        }
                     } else {
                         const storedAuthToken = normalizeAuthTokenCandidate(
                             localStorage.getItem('puter.auth.token'),
@@ -379,6 +361,7 @@ const puterInit = (function () {
                     // Handle the error here
                     console.error('Error accessing localStorage:', error);
                 }
+                this.initSubmodules();
             }
             // SDK was loaded in a 3rd-party website.
             // When SDK is loaded in GUI the initiation process should start when the DOM is ready. This is because