Login attempt was superseded by a newer one. Retry to start

Error message

Login attempt was superseded by a newer one. Retry to start a fresh login.

What it means

Thrown by startOAuth (oauth-bridge.ts:396) when, while waiting for the first auth signal, the session it just created disappears from the sessions map — i.e. it was superseded by a newer startOAuth for the same user/vendor or cancelled. Rather than returning a 200 with a url-less session that would immediately report 'not found' on the first poll, the bridge throws this honest error.

Source

Thrown at packages/core/src/credentials/oauth-bridge.ts:396

    sessions.delete(sessionId);
    if (session.portBusy) {
      // Retryable: the cancel above releases the port as soon as the previous
      // login unwinds (microtasks for pi flows), so "retry shortly" is honest
      // advice — and a restart always clears it (#1963).
      throw new OAuthCallbackPortBusyError(
        `A previous '${provider}' login attempt is still holding the OAuth callback port. ` +
          'Wait a few seconds and retry; if it persists, restart the Archon server.'
      );
    }
    throw new Error(session.detail ?? 'Subscription login failed to start.');
  }

  // Superseded (or cancelled) while still waiting for the first signal — the
  // session is already gone from the map, so a 200 here would hand back a
  // url-less session the first poll immediately reports as "not found".
  // Throw the honest answer instead (S4).
  if (!sessions.has(sessionId)) {
    throw new Error('Login attempt was superseded by a newer one. Retry to start a fresh login.');
  }

  return {
    sessionId,
    mode: externalMode(session),
    url: session.url,
    userCode: session.userCode,
    verificationUri: session.verificationUri,
    expiresIn: Math.round(SESSION_TTL_MS / 1000),
  };
}

/**
 * Poll a login session. For manual-code flows, pass the user's pasted `code`
 * (once) to unblock `login()`. Returns `connected` (and clears the session) on
 * success, `error` on failure/expiry, else `pending`.
 */
export function pollOAuth(sessionId: string, userId: string, code?: string): PollOAuthResult {

View on GitHub (pinned to 0773b97458)

Solutions

Simply retry startOAuth once — the newest attempt wins and will proceed normally.
Serialize login attempts client-side: disable the login button / use a mutex while one is in flight.
Cancel the prior attempt explicitly (cancelOAuth) before starting a new one.
Treat this error as benign/superseded in callers, not a hard failure.

Example fix

// before
await Promise.all([startOAuth(user, 'anthropic'), startOAuth(user, 'anthropic')]);
// after
const result = await loginMutex.runExclusive(() => startOAuth(user, 'anthropic'));

Defensive patterns

Strategy: try-catch

Validate before calling

// Guard: do not issue a concurrent start for the same user/provider
if (pendingLoginByUser.has(userId)) {
  return pendingLoginByUser.get(userId)!; // reuse the in-flight promise
}

Try / catch

try {
  const result = await startOAuth(userId, providerId);
  return result;
} catch (e) {
  if (e instanceof Error && e.message.startsWith('Login attempt was superseded')) {
    return startOAuth(userId, providerId); // retry once; newest attempt wins
  }
  throw e;
}

Prevention

Debounce/disable the login button while a login is initializing.
Serialize startOAuth calls per user with a mutex or in-flight promise map.
Treat supersession as a normal, retryable outcome — not a bug report.
Avoid background health-check callers that re-trigger startOAuth for an active login.

When it happens

Trigger: Two startOAuth calls racing for the same userId (or same callback-server vendor): the older call's session is aborted and deleted by the newer call, and when the older call wakes from its firstSignal race it finds sessions.has(sessionId) === false. Also triggered by cancelOAuth or the expiry sweep landing in that window.

Common situations: A user double-clicking 'Login' in the web UI; a CLI retry fired while the previous attempt is still initializing; automated callers retrying startOAuth without cancelling the previous attempt.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/259040e0465155fc. Report an issue: GitHub.