Merge branch 'main' into embedded-vnc

client/internal/auth/auth.go

@@ -369,6 +369,7 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.EnableSSHLocalPortForwarding,
 		a.config.EnableSSHRemotePortForwarding,
 		a.config.DisableSSHAuth,
+		a.config.RemoteJobsAllowed,
 	)
 }
 

client/internal/auth/device_flow.go

@@ -304,6 +304,16 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}
 
+			// Same as the PKCE flow: the account the token belongs to is what
+			// callers store to send back as the login_hint. Without it a client
+			// driven through the device flow — Android TV and tvOS — never binds
+			// an account to its profile and every later login goes out blind.
+			if email, err := parseEmailFromIDToken(tokenInfo.IDToken); err != nil {
+				log.Warnf("failed to parse email from ID token: %v", err)
+			} else {
+				tokenInfo.Email = email
+			}
+
 			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
 			return tokenInfo, err
 		}