fix: preserve private upload settings on token rotation

scripts/manage_mcp_service.py

@@ -27,6 +27,17 @@ DEFAULT_CONFIG_PATH = "config.json"
 DEFAULT_TOKEN_BYTES = 32
 DEFAULT_UV_CACHE_DIR = "/tmp/uv-cache"
 DEFAULT_UPLOAD_MAX_BYTES = 25 * 1024 * 1024
+MANAGED_ENV_NAMES = frozenset(
+    {
+        "NOCOBASE_MCP_TOKEN",
+        "NOCOBASE_MCP_HOST",
+        "NOCOBASE_MCP_PORT",
+        "NOCOBASE_MCP_PATH",
+        "NOCOBASE_MCP_ENV",
+        "NOCOBASE_MCP_CONFIG",
+        "NOCOBASE_MCP_UPLOAD_MAX_BYTES",
+    }
+)
 
 
 @dataclass(frozen=True)
@@ -116,6 +127,7 @@ def write_token_env_file(
     nb_env: str = DEFAULT_NB_ENV,
     config_path: str = DEFAULT_CONFIG_PATH,
 ) -> None:
+    preserved_lines = _operator_env_lines(env_path)
     env_path.parent.mkdir(parents=True, exist_ok=True)
     env_path.parent.chmod(0o700)
     fd = os.open(env_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
@@ -127,9 +139,25 @@ def write_token_env_file(
         env_file.write(f"NOCOBASE_MCP_ENV={nb_env}\n")
         env_file.write(f"NOCOBASE_MCP_CONFIG={config_path}\n")
         env_file.write(f"NOCOBASE_MCP_UPLOAD_MAX_BYTES={DEFAULT_UPLOAD_MAX_BYTES}\n")
+        if preserved_lines:
+            env_file.write("\n")
+            env_file.write("\n".join(preserved_lines))
+            env_file.write("\n")
     env_path.chmod(0o600)
 
 
+def _operator_env_lines(env_path: Path) -> list[str]:
+    if not env_path.exists():
+        return []
+    preserved_lines: list[str] = []
+    for raw_line in env_path.read_text(encoding="utf-8").splitlines():
+        key, separator, _value = raw_line.strip().partition("=")
+        if separator and key.strip() in MANAGED_ENV_NAMES:
+            continue
+        preserved_lines.append(raw_line)
+    return preserved_lines
+
+
 def read_service_env_file(env_path: Path) -> dict[str, str]:
     if not env_path.exists():
         raise RuntimeError(