[aikins01]

telemetry login registers a new OAuth client on each machine, so telemetry.dev's consent page warns that the app isn't verified. telemetry.dev now serves a client ID metadata document for the CLI (telemetry-dev/telemetry.dev#548). On an https deployment that serves the document, the CLI uses its URL, https://telemetry.dev/oauth/cli.json, as its client_id. The consent page then names telemetry.dev as the app's publisher.

Before it switches, login fetches the document and checks that its client_id is that URL. A deployment that doesn't serve the document keeps the client the CLI registered, so this can be released before or after #548 deploys. That covers production today, where the document is still a 404, and self-hosted deployments. Once the document is served, the next telemetry login drops a client the CLI registered earlier.

A sign-in started with --no-browser and no terminal saves the client it started with along with the pending sign-in, and --finish completes it with that client. The saved client stays paired with the current tokens until the new sign-in finishes. A command that picks up tokens another command saved also takes up the client they were issued to, so a refresh never pairs one client's token with another client's ID.

All CLI installs now share one client ID. telemetry.dev's refresh token reuse detection revokes every token a client holds for a person, so a detected reuse now signs that person out of the CLI on every machine, not only the one that reused the token. Claude and ChatGPT connections already work this way.

The tests' server runs over http, and the MCP client only accepts an https document URL, so the document path isn't covered by the tests. Against production, a sign-in started with a saved registered client kept that client while the document was a 404.

Part of telemetry-dev/telemetry.dev#547.