{"record":{"id":"544e898becead9fc","repo":"zeroclaw-labs/zeroclaw","slug":"pending-login-profile-mismatch-pending-reques","errorCode":null,"errorMessage":"Pending login profile mismatch: pending={}, requested={}","messagePattern":"Pending login profile mismatch: pending=(.+?), requested=(.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"warning","filePath":"crates/zeroclaw-providers/src/auth/mod.rs","lineNumber":1228,"sourceCode":"        input: Option<&str>,\n    ) -> Result<()> {\n        let pending = load_pending_oauth_login(ctx.config, \"openai\")?.ok_or_else(|| {\n            ::zeroclaw_log::record!(\n                WARN,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)\n                    .with_outcome(::zeroclaw_log::EventOutcome::Failure)\n                    .with_attrs(::serde_json::json!({\n                        \"oauth_provider\": \"openai\",\n                        \"profile\": profile,\n                    })),\n                \"auth: no pending OpenAI login\"\n            );\n            anyhow::Error::msg(\n                \"No pending OpenAI login found. Run `zeroclaw auth login --model-provider openai-codex` first.\",\n            )\n        })?;\n        if pending.profile != profile {\n            anyhow::bail!(\n                \"Pending login profile mismatch: pending={}, requested={}\",\n                pending.profile,\n                profile,\n            );\n        }\n        let redirect_input = input.ok_or_else(|| {\n            ::zeroclaw_log::record!(\n                WARN,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)\n                    .with_outcome(::zeroclaw_log::EventOutcome::Failure)\n                    .with_attrs(::serde_json::json!({\"oauth_provider\": \"openai\"})),\n                \"auth: paste-redirect requires URL or code\"\n            );\n            anyhow::Error::msg(\"paste-redirect requires the redirect URL or OAuth code\")\n        })?;\n        let code = crate::auth::openai_oauth::parse_code_from_redirect(\n            redirect_input,\n            Some(&pending.state),","sourceCodeStart":1210,"sourceCodeEnd":1246,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-providers/src/auth/mod.rs#L1210-L1246","documentation":"In the OpenAI Codex paste_redirect implementation, the pending login record saved by `auth login` carries the profile name it was started with; when paste-redirect is invoked with a different --profile, the guard `pending.profile != profile` bails with both values. This prevents finishing a login into the wrong profile slot (e.g. saving work credentials under default).","triggerScenarios":"`zeroclaw auth login --model-provider openai-codex --profile work` followed by `zeroclaw auth paste-redirect --model-provider openai-codex --profile default` (or omitting --profile so it resolves to the active/default profile).","commonSituations":"Starting login in one shell/profile context and pasting the redirect in another, CI or scripts that assume --profile default while the operator used a named profile, or switching ZEROCLAW_PROFILE between the two commands.","solutions":["Re-run paste-redirect with the same --profile shown in the `pending=` field of the message","Or restart the flow for the intended profile: `zeroclaw auth login --model-provider openai-codex --profile <intended>` then paste-redirect with the same value","Check the active profile (`zeroclaw auth status`) before paste-redirect so an omitted --profile resolves to what you expect"],"exampleFix":"# before\nzeroclaw auth login --model-provider openai-codex --profile work\nzeroclaw auth paste-redirect --model-provider openai-codex --profile default   # mismatch\n\n# after\nzeroclaw auth paste-redirect --model-provider openai-codex --profile work","handlingStrategy":"validation","validationCode":"// Before paste-redirect, confirm the pending login's profile matches\nif let Some(pending) = load_pending_oauth_login(config, \"openai-codex\", profile).await? {\n    anyhow::ensure!(\n        pending.profile == requested_profile,\n        \"login was started for profile '{}'; re-run with --profile {}\",\n        pending.profile, pending.profile\n    );\n}","typeGuard":null,"tryCatchPattern":"match provider.paste_redirect(ctx, requested_profile, input).await {\n    Err(e) if e.to_string().contains(\"profile mismatch\") => {\n        // message contains pending=...,requested=... — retry with the pending profile\n        let pending_profile = extract_pending_profile(&e.to_string());\n        provider.paste_redirect(ctx, &pending_profile, input).await\n    }\n    other => other,\n}","preventionTips":["Pass --profile on BOTH auth login and auth paste-redirect; never rely on ambient defaults","Check `zeroclaw auth status` for the pending login's profile before pasting"],"tags":["auth","oauth2","profiles","openai","cli"],"backgroundTag":"oauth-profile-mismatch","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}