Greptile Summary

This PR fixes scope loss during gateway reconnection on Windows by reading previously authorized scopes from device-auth.json and replaying them when reconnecting with a stored device token, rather than always defaulting to ["operator.admin"].

• The SelectedConnectAuth type and selectConnectAuth() are extended to surface storedScopes from the loaded DeviceAuthEntry
• sendConnect() now prefers storedScopes over this.opts.scopes ?? ["operator.admin"] when a resolvedDeviceToken is present
• Backward compatibility is maintained: if storedScopes is undefined (e.g. old device-auth.json without a scopes field), the condition short-circuits and the original fallback is used
• One edge case is present: storedScopes = [] (an empty array) is truthy in JavaScript, so the fallback is not triggered when the server previously returned no scopes — the client would then send an empty scopes array on reconnect instead of the intended default

Confidence Score: 3/5

• The fix is logically correct for the common case but has an empty-array edge case that could cause zero scopes to be sent on reconnect.
• The core approach is sound and the minimal diff correctly addresses the described regression. However, the guard condition storedScopes && resolvedDeviceToken does not account for storedScopes = [] being truthy, which can arise when the server response omits the scopes field and storeDeviceAuthToken persists an empty array. In that scenario the fallback to ["operator.admin"] is skipped and an empty scopes list is sent to the server, potentially breaking authentication in the edge case.
• src/gateway/client.ts — specifically line 341–342 where the scope-selection condition should guard against an empty stored-scopes array.

This is a comment left during a code review.
Path: src/gateway/client.ts
Line: 341-342

Comment:
**Empty stored scopes bypass the fallback**

`storedScopes` can be an empty array (`[]`), which is truthy in JavaScript. When `storedScopes = []` and `resolvedDeviceToken` is set, the condition `storedScopes && resolvedDeviceToken` evaluates to truthy, causing `scopes` to be set to `[]` instead of falling back to `this.opts.scopes ?? ["operator.admin"]`.

This can occur because `storeDeviceAuthToken` is called with `scopes: authInfo.scopes ?? []` — if the server's `HelloOk` response doesn't include a `scopes` field, an empty array is persisted. On the next reconnect, `storedScopes = []` and the client sends zero scopes to the server, which may cause the server to reject the connection or grant fewer permissions than expected.

The condition should explicitly guard against the empty array case:

```suggestion
    const scopes =
      storedScopes && storedScopes.length > 0 && resolvedDeviceToken ? storedScopes : (this.opts.scopes ?? ["operator.admin"]);
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 032211c}

Landed via temp rebase onto main.

Gate:

• pnpm test src/gateway/client.test.ts ✅

• pnpm build ✅

• pnpm check ⚠️ blocked by unrelated current-main TypeScript errors in extensions/openrouter/index.test.ts:46 and extensions/openrouter/index.ts:94

• pnpm test src/gateway/server.silent-scope-upgrade-reconnect.poc.test.ts ⚠️ reproduces an unrelated server-side failure in does not let backend reconnect bypass the paired scope baseline

• Land commit: 71f78ef

• Merge commit: 3f1b270

Thanks @caicongyang!