zeroclaw-labs/zeroclaw · warning · anyhow::Error

Pending login profile mismatch: pending={}, requested={}

Error message

Pending login profile mismatch: pending={}, requested={}

What it means

In the OpenAI Codex paste_redirect implementation, the pending login record saved by `auth login` carries the profile name it was started with; when paste-redirect is invoked with a different --profile, the guard `pending.profile != profile` bails with both values. This prevents finishing a login into the wrong profile slot (e.g. saving work credentials under default).

Source

Thrown at crates/zeroclaw-providers/src/auth/mod.rs:1228

        input: Option<&str>,
    ) -> Result<()> {
        let pending = load_pending_oauth_login(ctx.config, "openai")?.ok_or_else(|| {
            ::zeroclaw_log::record!(
                WARN,
                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)
                    .with_outcome(::zeroclaw_log::EventOutcome::Failure)
                    .with_attrs(::serde_json::json!({
                        "oauth_provider": "openai",
                        "profile": profile,
                    })),
                "auth: no pending OpenAI login"
            );
            anyhow::Error::msg(
                "No pending OpenAI login found. Run `zeroclaw auth login --model-provider openai-codex` first.",
            )
        })?;
        if pending.profile != profile {
            anyhow::bail!(
                "Pending login profile mismatch: pending={}, requested={}",
                pending.profile,
                profile,
            );
        }
        let redirect_input = input.ok_or_else(|| {
            ::zeroclaw_log::record!(
                WARN,
                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)
                    .with_outcome(::zeroclaw_log::EventOutcome::Failure)
                    .with_attrs(::serde_json::json!({"oauth_provider": "openai"})),
                "auth: paste-redirect requires URL or code"
            );
            anyhow::Error::msg("paste-redirect requires the redirect URL or OAuth code")
        })?;
        let code = crate::auth::openai_oauth::parse_code_from_redirect(
            redirect_input,
            Some(&pending.state),

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Re-run paste-redirect with the same --profile shown in the `pending=` field of the message
2. Or restart the flow for the intended profile: `zeroclaw auth login --model-provider openai-codex --profile <intended>` then paste-redirect with the same value
3. Check the active profile (`zeroclaw auth status`) before paste-redirect so an omitted --profile resolves to what you expect

Example fix

# before
zeroclaw auth login --model-provider openai-codex --profile work
zeroclaw auth paste-redirect --model-provider openai-codex --profile default   # mismatch

# after
zeroclaw auth paste-redirect --model-provider openai-codex --profile work

// Before paste-redirect, confirm the pending login's profile matches
if let Some(pending) = load_pending_oauth_login(config, "openai-codex", profile).await? {
    anyhow::ensure!(
        pending.profile == requested_profile,
        "login was started for profile '{}'; re-run with --profile {}",
        pending.profile, pending.profile
    );
}

match provider.paste_redirect(ctx, requested_profile, input).await {
    Err(e) if e.to_string().contains("profile mismatch") => {
        // message contains pending=...,requested=... — retry with the pending profile
        let pending_profile = extract_pending_profile(&e.to_string());
        provider.paste_redirect(ctx, &pending_profile, input).await
    }
    other => other,
}

When it happens

Trigger: `zeroclaw auth login --model-provider openai-codex --profile work` followed by `zeroclaw auth paste-redirect --model-provider openai-codex --profile default` (or omitting --profile so it resolves to the active/default profile).

Common situations: Starting login in one shell/profile context and pasting the redirect in another, CI or scripts that assume --profile default while the operator used a named profile, or switching ZEROCLAW_PROFILE between the two commands.

Related errors

• `auth paste-redirect` is not supported for this provider. On
• Pending {} login is missing code verifier
• `auth login` is not supported for this provider. Use `auth p
• `auth refresh` is not supported for this provider. Only Open
• `auth login --import` currently supports only --model-provid

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/544e898becead9fc. Report an issue: GitHub.