zeroclaw-labs/zeroclaw · warning · anyhow::Error

`auth login --import` currently supports only --model-provid

Error message

`auth login --import` currently supports only --model-provider openai-codex and xai.

What it means

The Gemini login implementation rejects any call with an import path: `auth login --import` is only implemented for openai-codex and xai (importing existing OAuth tokens from those vendors' CLI config files). Gemini's flow has no import path, so the guard at the top of login bails before doing anything else.

Source

Thrown at crates/zeroclaw-providers/src/auth/mod.rs:1368

                anyhow::Error::msg(format!(
                    "Gemini OAuth requires `oauth_client_secret` on `[providers.models.gemini.{profile}]`.",
                ))
            })?;
        Ok((client_id, client_secret))
    }
}

#[async_trait::async_trait]
impl AuthProviderFlow for GeminiFlow {
    async fn login(
        &self,
        ctx: &AuthFlowContext<'_>,
        profile: &str,
        device_code: bool,
        import: Option<&std::path::Path>,
    ) -> Result<()> {
        if import.is_some() {
            anyhow::bail!(
                "`auth login --import` currently supports only --model-provider openai-codex and xai.",
            );
        }
        let (client_id, client_secret) = Self::alias_creds(ctx.config, profile)?;

        if device_code {
            match crate::auth::gemini_oauth::start_device_code_flow(ctx.client, client_id).await {
                Ok(device) => {
                    println!("Google/Gemini device-code login started.");
                    println!("Visit: {}", device.verification_uri);
                    println!("Code:  {}", device.user_code);
                    if let Some(uri_complete) = &device.verification_uri_complete {
                        println!("Fast link: {uri_complete}");
                    }
                    let token_set = crate::auth::gemini_oauth::poll_device_code_tokens(
                        ctx.client,
                        client_id,
                        client_secret,

View on GitHub (pinned to 88bb9c8533)

Solutions

For Gemini, run the normal browser flow: `zeroclaw auth login --model-provider gemini` (optionally --device-code)
If you meant to import, use a supported provider: `--model-provider openai-codex` or `--model-provider xai` with --import
Drop the --import flag from scripts when the target is gemini

Example fix

# before
zeroclaw auth login --model-provider gemini --import ~/creds.json

# after
zeroclaw auth login --model-provider gemini

Defensive patterns

Strategy: validation

Validate before calling

const IMPORT_CAPABLE: &[&str] = &["openai-codex", "xai"];
if import.is_some() {
    anyhow::ensure!(
        IMPORT_CAPABLE.contains(&model_provider),
        "--import is only supported for openai-codex and xai; got {model_provider}"
    );
}

Type guard

fn supports_import(model_provider: &str) -> bool {
    matches!(model_provider, "openai-codex" | "xai")
}

Try / catch

match provider.login(ctx, profile, false, import_path).await {
    Err(e) if e.to_string().contains("--import` currently supports only") => {
        // retry without import: normal browser flow
        provider.login(ctx, profile, false, None).await
    }
    other => other,
}

Prevention

Gate --import flags on provider capability before invoking login
Keep per-provider auth recipes in scripts instead of one generic command

When it happens

Trigger: Running `zeroclaw auth login --model-provider gemini --import ~/.gemini/oauth_creds.json` (or any --import value) — the import argument alone triggers it, regardless of file contents.

Common situations: Copy-pasting the Codex import command and only changing --model-provider, or scripts that always pass --import when a source file exists.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/55c57c45af276531. Report an issue: GitHub.