diff --git a/src/auth/oauth_common.rs b/src/auth/oauth_common.rs
index 8724f29d9..3b151b147 100644
--- a/src/auth/oauth_common.rs
+++ b/src/auth/oauth_common.rs
@@ -99,9 +99,8 @@ pub fn detect_url_truncation(input: &str, expected_state_len: usize) -> Option<S
         return Some("URL appears truncated (ends with & but missing parameters)".to_string());
     }
 
-    // Check state parameter length if present
-    if let Some(state_param) = input.split("state=").nth(1) {
-        let state_value = state_param.split('&').next().unwrap_or("");
+    let params = parse_query_params(input);
+    if let Some(state_value) = params.get("state") {
         if state_value.len() < expected_state_len.saturating_sub(5) {
             return Some(format!(
                 "State parameter is shorter than expected (got {}, expected ~{})",
diff --git a/src/main.rs b/src/main.rs
index be9cbda58..fcebdb914 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -41,6 +41,8 @@ use std::io::Write;
 use tracing::{info, warn};
 use tracing_subscriber::{fmt, EnvFilter};
 
+const PROFILE_MISMATCH_PREFIX: &str = "Pending login profile mismatch:";
+
 #[derive(Debug, Clone, ValueEnum)]
 enum QuotaFormat {
     Text,
@@ -1940,7 +1942,8 @@ async fn handle_auth_command(auth_command: AuthCommands, config: &Config) -> Res
 
                         if pending.profile != profile {
                             bail!(
-                                "Pending login profile mismatch: pending={}, requested={}",
+                                "{} pending={}, requested={}",
+                                PROFILE_MISMATCH_PREFIX,
                                 pending.profile,
                                 profile
                             );
@@ -1982,7 +1985,7 @@ async fn handle_auth_command(auth_command: AuthCommands, config: &Config) -> Res
 
                     if let Err(e) = result {
                         // Cleanup pending file on error
-                        if e.to_string().contains("profile mismatch") {
+                        if e.to_string().starts_with(PROFILE_MISMATCH_PREFIX) {
                             clear_pending_oauth_login(config, "openai");
                             eprintln!("❌ {}", e);
                             eprintln!(
@@ -2014,7 +2017,8 @@ async fn handle_auth_command(auth_command: AuthCommands, config: &Config) -> Res
 
                         if pending.profile != profile {
                             bail!(
-                                "Pending login profile mismatch: pending={}, requested={}",
+                                "{} pending={}, requested={}",
+                                PROFILE_MISMATCH_PREFIX,
                                 pending.profile,
                                 profile
                             );
@@ -2058,7 +2062,7 @@ async fn handle_auth_command(auth_command: AuthCommands, config: &Config) -> Res
 
                     if let Err(e) = result {
                         // Cleanup pending file on error
-                        if e.to_string().contains("profile mismatch") {
+                        if e.to_string().starts_with(PROFILE_MISMATCH_PREFIX) {
                             clear_pending_oauth_login(config, "gemini");
                             eprintln!("❌ {}", e);
                             eprintln!(