[gulshngill]

What

nansen login now sends client_id: 'nansen-cli' on /auth/device/authorize, next to the existing client_label.

Compatibility

• An authorization server that does not recognise the field ignores it.
• Existing sessions keep working; nothing about stored sessions changes.
• validateSession does not reject extra token claims.

Testing

• auth-device.test.js asserts the exact authorize body (failed first, then passed).
• npm test and npm run lint pass.
• Changeset: patch.

🤖 Generated with Claude Code

[nansen-pr-reviewer]

nansen-pr-reviewer summary

Adds the requested fixed client_id to device authorization requests, with matching unit-test coverage and a changeset. The change is narrowly scoped and no correctness or security issue is evident.

Deterministic check: success — No issues found

Risk: 3/5 (Elevated) — raised by: security-sensitive paths (auth/crypto/token/session)

✅ Auto-approved — Deterministic gates passed: severity thresholds met, recommendation "approve", risk level 3/5 within threshold 3.

---

Token usage: 12,529 input, 353 output, 2,004 cache read | Usage Guide

Cooldown: for the next 10 minutes (counting from when this review finished), new pushes to this PR will not trigger another review — the next push after the window expires will. Need a fresh review sooner? Comment @nansen-pr-reviewer[bot] re-review.

[nansen-pr-reviewer]

✅ Auto-approved by Nansen review

Deterministic gates passed: severity thresholds met, recommendation "approve", risk level 3/5 within threshold 3.

• The deterministic severity check passed: No issues found
• Risk level 3/5 (Elevated)
• The model recommended: approve

Approval was decided by deterministic gates, not by the model. The model's recommendation can block auto-approval but never cause it.