client/internal/auth/oauth.go (1)

63-86: forceDeviceCodeFlow behavior is correct but the API is getting hard to read

The new forceDeviceCodeFlow flag is wired correctly: it cleanly short-circuits to device code before OS heuristics and keeps existing PKCE → device-code fallback intact.

However, NewOAuthFlow now has two adjacent bool parameters, which is easy to misuse at call sites (isUnixDesktopClient, forceDeviceCodeFlow). Consider moving to an options struct or functional options if you expect further flags here, so callers become self-documenting and less error‑prone.

client/android/login.go (3)

32-37: URLOpener comment should mention the new userCode argument

The URLOpener interface now exposes both url and userCode, but the comment still only talks about showing a URL. Consider updating the comment to reflect that the callback may also be used to display the device/user code (especially for Android TV).

---

150-200: Android login: isAndroidTV wiring is correct; consider improving error propagation

Threading isAndroidTV from Auth.Login into login is clean and non‑intrusive; for non‑TV Android the flow is unchanged, and for Android TV the flag is only used later to steer OAuth.

While you’re touching this function, note that the backoff block:

err = a.withBackOff(a.ctx, func() error {
    err := internal.Login(a.ctx, a.config, "", jwtToken)

    if err == nil {
        go urlOpener.OnLoginSuccess()
    }

    if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
        return nil
    }
    return err
})

swallows InvalidArgument / PermissionDenied by returning nil to the backoff, so login completes without surfacing these errors to ErrListener.OnError. If the intent is to stop retrying and report the failure, you could treat them as permanent errors instead:

-    if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
-        return nil
-    }
-    return err
+    if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
+        // stop retrying but still propagate the error to the caller
+        return backoff.Permanent(err)
+    }
+    return err

This would let Auth.Login call resultListener.OnError(...) when the server rejects the login, instead of treating it as a silent success of the retry loop.

---

202-224: Android foregroundGetTokenInfo: device‑code forcing and userCode exposure look good; minor context tweak possible

Using auth.NewOAuthFlow(a.ctx, a.config, false, isAndroidTV, "") is the right place to honor isAndroidTV: for TV you now force the Device Code flow; for phones/tablets (isAndroidTV == false) behavior stays as before.

Passing both VerificationURIComplete and UserCode into urlOpener.Open enables the UI to render code‑entry instructions, which is exactly what Android TV needs.

One small refinement you might consider for cancellation consistency is to avoid context.TODO() here and reuse a.ctx:

- flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
+ flowInfo, err := oAuthFlow.RequestAuthInfo(a.ctx)

since you already derive the timeout for WaitToken from a.ctx. Not required for correctness, but it would make the function’s context handling more coherent.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

client/internal/auth/oauth.go (1)

63-86: Device‑flow selection logic looks good; update NewOAuthFlow comment to match behavior

The extracted shouldUseDeviceFlow helper correctly handles:

• Forced device‑code flow (forceDeviceCodeFlow == true), and
• Headless Linux/FreeBSD (!isUnixDesktopClient on those GOOS values).

However, the NewOAuthFlow comment still claims it always “starts by initializing the PKCE” even though in these cases it goes straight to Device Code Flow. Consider tightening the comment so it reflects the conditional behavior, for example:

-// It starts by initializing the PKCE.If this process fails, it resorts to the Device Code Flow,
-// and if that also fails, the authentication process is deemed unsuccessful
-//
-// On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow
-// forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV)
+// By default it starts with the PKCE flow and falls back to Device Code Flow on failure.
+// On Linux/FreeBSD without a desktop environment, or when forceDeviceCodeFlow is true,
+// it uses the Device Code Flow directly. If both flows fail, authentication is deemed unsuccessful.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro