Hmbown/CodeWhale · error · anyhow::Error

atomically replacing xAI OAuth credentials

Error message

atomically replacing xAI OAuth credentials

What it means

In write_owned_file, after writing a new xAI OAuth credential file to a temp file, persist() renames it over the destination. If the rename fails, the io error is wrapped with the context 'atomically replacing xAI OAuth credentials' and any Windows secret handle is cleaned up before returning. The underlying cause is an OS-level failure to replace the existing file — most often a permission problem or the destination being held open/locked.

Solutions

1. Check permissions on the credentials file and its parent directory; chown/chmod so the current user can replace it
2. Close processes holding the file open (editors, sync clients, antivirus scans) and retry
3. On Windows, retry after the AV/indexer lock clears; or point CODEWHALE/XAI home at a directory not scanned
4. Re-run the OAuth login flow to regenerate credentials in a writable location

Example fix

// diagnose
ls -la ~/.codewhale/xai/
# fix ownership
chown -R $USER ~/.codewhale/xai/

// verify the credentials dir is writable before writing
let dir = path.parent().unwrap();
let probe = dir.join(".write-probe");
std::fs::write(&probe, b"").map_err(|e| anyhow!("credentials dir not writable: {e}"))?;
let _ = std::fs::remove_file(&probe);

match write_owned_file(&path, bytes, AllowReplace::Yes) {
    Err(e) if e.to_string().contains("atomically replacing xAI OAuth credentials") && is_transient(&e) =>
        retry_with_backoff(3, || write_owned_file(&path, bytes, AllowReplace::Yes)),
    r => r,
}

When it happens

Trigger: allow_replace=true and temporary.persist(&path) fails — e.g. the credentials file's parent directory is not writable, the existing file is owned by another user, or on Windows the target is locked by another process (rename-over-open-file).

Common situations: Credential store directory permissions changed after install; running as a different user than the one who created the credentials; antivirus/backup tools briefly locking the file on Windows; read-only mount.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

• installing a new xAI OAuth generation without replacement
• refusing to replace xAI OAuth generation
• restoring retired xAI OAuth file
• restoring retired xAI OAuth file
• agy OAuth token JSON carries no access token member

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/c4e9e3b2db70a5f3. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/xai_credentials.rs:1131

            temporary
                .as_file()
                .sync_all()
                .context("syncing xAI OAuth temporary file")?;
            Ok(())
        })();
        if let Err(error) = write_result {
            return Err(cleanup_windows_secret_after_error(
                &security_handle,
                error,
                "temporary file",
            ));
        }
        let persisted = if allow_replace {
            match temporary.persist(&path) {
                Ok(file) => file,
                Err(error) => {
                    let tempfile::PersistError { error, file } = error;
                    let persistence_error = anyhow::Error::new(error)
                        .context("atomically replacing xAI OAuth credentials");
                    let error = cleanup_windows_secret_after_error(
                        &security_handle,
                        persistence_error,
                        "temporary file",
                    );
                    drop(file);
                    return Err(error);
                }
            }
        } else {
            match temporary.persist_noclobber(&path) {
                Ok(file) => file,
                Err(error) => {
                    let tempfile::PersistError { error, file } = error;
                    let persistence_error = anyhow::Error::new(error)
                        .context("installing a new xAI OAuth generation without replacement");
                    let error = cleanup_windows_secret_after_error(

View on GitHub (pinned to 73e0f67d83)