Greptile Summary

This PR extracts the inline unbound-scope-clearing predicate from message-handler.ts into the dedicated helper shouldClearUnboundScopesForMissingDeviceIdentity and, in doing so, plugs a gap: authMethod === "trusted-proxy" was not previously listed alongside "token" and "password", so device-less trusted-proxy connects could retain self-declared scopes. The refactoring is clean and the helper is straightforward to reason about.

• The new helper correctly returns true on any non-allow decision (short-circuit), and on the allow path only when none of the explicit preservation guards apply.
• Strict === true on the optional trustedProxyAuthOk boolean is safe; every call site derives it from isTrustedProxyControlUiOperatorAuth, which always returns a proper boolean.
• Test coverage is solid for all five named branches; one minor gap: the trustedProxyAuthOk: true assertion piggy-backs on authMethod: "token" which already makes the condition true, so the trustedProxyAuthOk branch isn't truly isolated (see inline comment).

Confidence Score: 5/5

Safe to merge; the only finding is a minor test-isolation suggestion with no impact on production behaviour.

All remaining feedback is P2 (test-quality style). The logic change is correct, the extraction is clean, and the targeted non-control-UI trusted-proxy scope-clearing behaviour is now consistent with token/password auth.

No files require special attention.

This is a comment left during a code review.
Path: src/gateway/server/ws-connection/connect-policy.test.ts
Line: 344-352

Comment:
**`trustedProxyAuthOk: true` test case doesn't isolate the branch**

The fourth assertion pairs `authMethod: "token"` with `trustedProxyAuthOk: true`. Because `authMethod === "token"` is already sufficient to return `true`, `trustedProxyAuthOk` has no observable effect in this test – dropping it wouldn't change the result. To actually exercise the `trustedProxyAuthOk === true` leaf of the OR condition, the authMethod should be something that matches none of the explicit strings (e.g. `"none"` or `undefined`):

```suggestion
    expect(
      shouldClearUnboundScopesForMissingDeviceIdentity({
        decision: { kind: "allow" },
        controlUiAuthPolicy: nonControlUi,
        preserveInsecureLocalControlUiScopes: false,
        authMethod: undefined,
        trustedProxyAuthOk: true,
      }),
    ).toBe(true);
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "gateway: clear unbound scopes for truste..." | Re-trigger Greptile}

Follow-up: the latest head commit updates the test to isolate the trusted proxy boolean branch by setting authMethod to undefined while trustedProxyAuthOk is true.