diff --git a/miniapp/app.json b/miniapp/app.json
index fe32a86..7c7a7bc 100644
--- a/miniapp/app.json
+++ b/miniapp/app.json
@@ -1,7 +1,7 @@
 {
   "pages": [
-    "pages/chat/index",
     "pages/login/index",
+    "pages/chat/index",
     "pages/sessions/index",
     "pages/space/index",
     "pages/webview/index"
diff --git a/miniapp/pages/chat/index.js b/miniapp/pages/chat/index.js
index 379036f..ca69ce9 100644
--- a/miniapp/pages/chat/index.js
+++ b/miniapp/pages/chat/index.js
@@ -30,10 +30,30 @@ Page({
   },
 
   async onShow() {
+    if (this._authCheckPromise) {
+      await this._authCheckPromise;
+      return;
+    }
+    this._authCheckPromise = this.verifyAccess();
+    try {
+      await this._authCheckPromise;
+    } finally {
+      this._authCheckPromise = null;
+    }
+  },
+
+  async verifyAccess() {
+    if (this._redirectingToLogin) return;
     try {
       const status = await checkAuth();
       if (!status?.authenticated) {
-        wx.redirectTo({ url: '/pages/login/index' });
+        this._redirectingToLogin = true;
+        wx.redirectTo({
+          url: '/pages/login/index',
+          complete: () => {
+            this._redirectingToLogin = false;
+          },
+        });
         return;
       }
       await this.ensureCurrentUser();
@@ -47,7 +67,14 @@ Page({
         await this.refreshSession(this.data.sessionId);
       }
     } catch {
-      wx.redirectTo({ url: '/pages/login/index' });
+      if (this._redirectingToLogin) return;
+      this._redirectingToLogin = true;
+      wx.redirectTo({
+        url: '/pages/login/index',
+        complete: () => {
+          this._redirectingToLogin = false;
+        },
+      });
     }
   },
 
diff --git a/miniapp/pages/chat/index.wxml b/miniapp/pages/chat/index.wxml
index aaa2ffc..1d7c22f 100644
--- a/miniapp/pages/chat/index.wxml
+++ b/miniapp/pages/chat/index.wxml
@@ -17,7 +17,7 @@
     <view wx:for="{{messages}}" wx:key="id" id="msg-{{index}}" class="message-row {{item.role}}">
       <view class="message {{item.role}}">
         <view class="message-body">
-          <block wx:for="{{item.parts}}" wx:for-item="part" wx:for-index="partIndex" wx:key="partIndex">
+          <block wx:for="{{item.parts || []}}" wx:for-item="part" wx:for-index="partIndex" wx:key="partIndex">
             <text wx:if="{{part.type === 'text'}}" class="message-text">{{part.text}}</text>
             <text
               wx:elif="{{part.type === 'link'}}"
@@ -27,7 +27,7 @@
             >{{part.text}}</text>
           </block>
         </view>
-        <view wx:if="{{item.pageLinks.length}}" class="page-links">
+        <view wx:if="{{item.pageLinks && item.pageLinks.length}}" class="page-links">
           <view
             wx:for="{{item.pageLinks}}"
             wx:for-item="page"
diff --git a/miniapp/pages/login/index.js b/miniapp/pages/login/index.js
index 94ee6b6..363d926 100644
--- a/miniapp/pages/login/index.js
+++ b/miniapp/pages/login/index.js
@@ -43,6 +43,10 @@ Page({
     try {
       const status = await checkAuth();
       if (status?.authenticated) {
+        const app = getApp();
+        if (status.user) {
+          app.globalData.user = status.user;
+        }
         wx.switchTab({ url: '/pages/chat/index' });
       }
     } catch {
diff --git a/miniapp/utils/api.js b/miniapp/utils/api.js
index d2f1a2d..3bb6cd0 100644
--- a/miniapp/utils/api.js
+++ b/miniapp/utils/api.js
@@ -1,9 +1,36 @@
 const SESSION_KEY = 'tkmind_session';
-const { createUuid } = require('./config');
+const { createUuid, SESSION_COOKIE_NAME } = require('./config');
 
 let apiBaseUrl = '';
 let cookie = '';
 
+function buildSessionCookie(token) {
+  const value = String(token ?? '').trim();
+  if (!value) return '';
+  return `${SESSION_COOKIE_NAME}=${encodeURIComponent(value)}`;
+}
+
+function applySessionToken(token) {
+  const nextCookie = buildSessionCookie(token);
+  if (!nextCookie) return;
+  cookie = nextCookie;
+  const previous = getStoredSession() || {};
+  saveSession({ ...previous, cookie: nextCookie });
+}
+
+function restoreSessionCookie() {
+  try {
+    const session = wx.getStorageSync(SESSION_KEY);
+    if (session?.cookie) {
+      cookie = session.cookie;
+    }
+  } catch {
+    // Ignore storage read errors during cold start.
+  }
+}
+
+restoreSessionCookie();
+
 function setApiBaseUrl(value) {
   apiBaseUrl = String(value || '').replace(/\/$/, '');
 }
@@ -68,14 +95,34 @@ function clearSession() {
 function normalizeSetCookie(headers = {}) {
   const raw = headers['Set-Cookie'] || headers['set-cookie'];
   if (!raw) return '';
-  if (Array.isArray(raw)) {
-    return raw.map((item) => String(item).split(';')[0]).join('; ');
+  const items = Array.isArray(raw) ? raw : [String(raw)];
+  let sessionCookie = '';
+  for (const item of items) {
+    const firstPart = String(item).trim().split(';')[0].trim();
+    const separator = firstPart.indexOf('=');
+    if (separator <= 0) continue;
+    const name = firstPart.slice(0, separator);
+    const value = firstPart.slice(separator + 1);
+    if (name === SESSION_COOKIE_NAME && value) {
+      sessionCookie = `${name}=${value}`;
+    }
+  }
+  return sessionCookie;
+}
+
+function persistLoginResult(result, loginType) {
+  if (result?.sessionToken) {
+    applySessionToken(result.sessionToken);
+  }
+  saveSession({
+    cookie,
+    user: result?.user || null,
+    loginType,
+  });
+  const app = getApp?.();
+  if (app && result?.user) {
+    app.globalData.user = result.user;
   }
-  return String(raw)
-    .split(/,(?=\s*[^;,]+=)/)
-    .map((item) => item.trim().split(';')[0])
-    .filter(Boolean)
-    .join('; ');
 }
 
 function request(path, options = {}) {
@@ -140,7 +187,7 @@ async function loginWithPassword(username, password) {
     method: 'POST',
     body: { username, password }
   });
-  saveSession({ cookie, user: result?.user || result || null, loginType: 'password' });
+  persistLoginResult(result, 'password');
   return result;
 }
 
@@ -169,7 +216,7 @@ async function loginWithWechatCode(loginPath) {
     method: 'POST',
     body: { code }
   });
-  saveSession({ cookie, user: result?.user || result || null, loginType: 'wechat' });
+  persistLoginResult(result, 'wechat');
   return result;
 }
 
diff --git a/miniapp/utils/config.js b/miniapp/utils/config.js
index 7200644..f6efee0 100644
--- a/miniapp/utils/config.js
+++ b/miniapp/utils/config.js
@@ -16,6 +16,7 @@ function createUuid() {
 const defaults = {
   API_BASE_URL: LOCAL_DEV ? 'http://127.0.0.1:8081' : 'https://m.tkmind.cn',
   MINIAPP_LOGIN_PATH: '/auth/wechat-miniapp/login',
+  SESSION_COOKIE_NAME: 'tkmind_user_session',
   SELECTED_SESSION_KEY: 'tkmind_selected_session_id',
   AGENT_RUN_POLL_MS: 1200,
   AGENT_RUN_MAX_POLLS: 120,
diff --git a/server.mjs b/server.mjs
index 277a760..ec97526 100644
--- a/server.mjs
+++ b/server.mjs
@@ -897,7 +897,12 @@ app.post('/auth/login', jsonBody, async (req, res) => {
       return res.status(401).json({ message: result.message });
     }
     setUserLoginCookies(res, req, result.token);
-    return res.json({ authenticated: true, user: result.user, mode: 'user' });
+    return res.json({
+      authenticated: true,
+      user: result.user,
+      mode: 'user',
+      sessionToken: result.token,
+    });
   }
 
   if (!legacyAuth) {
@@ -950,6 +955,7 @@ app.post('/auth/wechat-miniapp/login', jsonBody, async (req, res) => {
       user: result.user,
       mode: 'user',
       isNewUser: Boolean(result.isNewUser),
+      sessionToken: result.token,
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : '微信登录失败';