authConfig: ctx.cfg.gateway?.auth,

tailscaleMode: ctx.cfg.gateway?.tailscale?.mode ?? "off",

});

const needsToken = auth.mode !== "password" && (auth.mode !== "token" || !auth.token);

// Modes that don't need a token: password, none, trusted-proxy.

// This aligns with hasExplicitGatewayInstallAuthMode() in auth-install-policy.ts.

// Previously, only "password" and "token" (with a token present) were excluded,

// causing doctor --fix to overwrite trusted-proxy/none configs with token mode.

const needsToken =

auth.mode !== "password" &&

auth.mode !== "none" &&

auth.mode !== "trusted-proxy" &&

(auth.mode !== "token" || !auth.token);

if (!needsToken) {

return;

}