Update app.js

app.js

@@ -23,6 +23,17 @@ app.use(express.static(path.join(__dirname, 'public')));
 // ── Session store ─────────────────────────────────────────────────────────────
 const sessions = new Set();
 
+// Persistent auto-token derived from SECRET_KEY — survives restarts on the
+// client side (stored in sessionStorage) and is always valid server-side.
+const AUTO_TOKEN = crypto.createHash('sha256').update(`auto:${SECRET_KEY}`).digest('hex');
+sessions.add(AUTO_TOKEN);
+
+// Unauthenticated endpoint — lets the frontend self-authenticate after a
+// container restart without the user having to type the key again.
+app.get('/api/auto-token', (_req, res) => {
+  res.json({ token: AUTO_TOKEN });
+});
+
 // ── ANSI stripper ─────────────────────────────────────────────────────────────
 function stripAnsi(str) {
   // eslint-disable-next-line no-control-regex
@@ -340,7 +351,8 @@ app.get('/api/shellular/qr-data', requireAuth, (_req, res) => {
 // ── Start ──────────────────────────────────────────────────────────────────────
 app.listen(PORT, '0.0.0.0', () => {
   console.log(`Shellular Web UI → http://0.0.0.0:${PORT}`);
-  startSyncPy(); // 🐍 Launch sync.py on server start
+  startSyncPy();     // 🐍 Launch sync.py on server start
+  startShellular();  // 🚀 Auto-start shellular on boot so QR is ready immediately
 });
 
 // ── Graceful shutdown ──────────────────────────────────────────────────────────