{"record":{"id":"ecc191dd2ff4efc9","repo":"decolua/9router","slug":"xai-oauth-session-not-found-restart-the-login-flo","errorCode":null,"errorMessage":"xAI OAuth session not found; restart the login flow and paste the code again","messagePattern":"xAI OAuth session not found; restart the login flow and paste the code again","errorType":"exception","errorClass":"Error","httpStatus":500,"severity":"error","filePath":"src/app/api/oauth/[provider]/[action]/route.js","lineNumber":43,"sourceCode":"  clearTraeSession,\n  startWindsurfProxy,\n  stopWindsurfProxy,\n  registerWindsurfSession,\n  getWindsurfSessionStatus,\n  clearWindsurfSession,\n  startZedProxy,\n  stopZedProxy,\n  registerZedSession,\n  getZedSessionStatus,\n  clearZedSession,\n} from \"@/lib/oauth/utils/server\";\nimport { detectIdeInstalled } from \"@/lib/oauth/utils/ideDetect\";\nimport { ZED_HOSTED_CONFIG } from \"@/lib/oauth/constants/oauth\";\n\nasync function completeXaiManualCode(code, state) {\n  const session = state ? getXaiSessionStatus(state) : null;\n  if (!session) {\n    throw new Error(\"xAI OAuth session not found; restart the login flow and paste the code again\");\n  }\n  if (!code) throw new Error(\"Missing xAI authorization code\");\n\n  try {\n    const tokenData = await exchangeTokens(\n      \"xai\",\n      code,\n      session.redirectUri,\n      session.codeVerifier,\n      state\n    );\n    const connection = await createProviderConnection({\n      provider: \"xai\",\n      authType: \"oauth\",\n      ...tokenData,\n      expiresAt: tokenData.expiresIn\n        ? new Date(Date.now() + tokenData.expiresIn * 1000).toISOString()\n        : null,","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/app/api/oauth/[provider]/[action]/route.js#L25-L61","documentation":"completeXaiManualCode is the manual-code branch of the xAI OAuth callback: it looks up the pending login session by the state parameter. If state is missing or no session exists for that state, the exchange cannot proceed (no redirect_uri / verifier), so this error is thrown and the user must restart the login flow.","triggerScenarios":"Calling /api/oauth/xai/<action> with a code but an empty, expired, or already-consumed state; restarting the server between starting login and pasting the code; pasting the code twice; or tampering with the state query param.","commonSituations":"Dev restarts the gateway mid-login (in-memory session store lost), user takes too long so the session expired, or the same manual code flow is retried after the first attempt already consumed the session.","solutions":["Restart the xAI OAuth login flow from the dashboard and paste a fresh authorization code with its new state value.","Do not reuse a state/code pair that was already submitted.","If the server was restarted, redo the whole flow — sessions are not persisted across restarts."],"exampleFix":"// before\nfetch(\"/api/oauth/xai/callback?code=NEW_CODE&state=OLD_STATE\")\n// after\nfetch(\"/api/oauth/xai/callback?code=NEW_CODE&state=STATE_FROM_NEW_LOGIN\")","handlingStrategy":"try-catch","validationCode":"const session = state ? getXaiSessionStatus(state) : null;\nif (!session) {\n  throw new Error(\"No active xAI session for this state — restart login first\");\n}","typeGuard":"const hasActiveXaiSession = (state) =>\n  typeof state === \"string\" && state.length > 0 && getXaiSessionStatus(state) != null;","tryCatchPattern":"try {\n  await completeXaiLogin(code, state);\n} catch (e) {\n  if (e.message.includes(\"session not found\")) {\n    startNewXaiLoginFlow(); // regenerate state + session\n  } else throw e;\n}","preventionTips":["Always send the state value returned when the login flow started","Complete the code paste in one sitting — don't restart the server mid-flow","Never reuse a state that was already exchanged for tokens","Copy state and code together from the same redirect URL"],"tags":["oauth","xai","session"],"backgroundTag":"oauth-session-not-found","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}