Hmbown/CodeWhale · error · anyhow::Error

Codewhale credentials directory must be owned by the current

Error message

Codewhale credentials directory must be owned by the current user

What it means

The unix opener requires the pinned credentials directory uid to equal the effective uid (geteuid). 0700 owner-only permissions are meaningless if another account owns the directory, so the store refuses to read or write OAuth tokens through a directory a different principal controls.

Source

Thrown at crates/config/src/xai_credentials.rs:540

                    "opening Codewhale credentials directory without following links: {}",
                    crate::quote_os_path(directory)
                )
            });
        }
        // SAFETY: `fd` is a newly owned descriptor on the success path above.
        current = unsafe { File::from_raw_fd(fd) };
    }
    let metadata = current.metadata().with_context(|| {
        format!(
            "inspecting Codewhale credentials directory {}",
            crate::quote_os_path(directory)
        )
    })?;
    anyhow::ensure!(
        metadata.is_dir(),
        "Codewhale credentials path must be a directory"
    );
    anyhow::ensure!(
        metadata.uid() == unsafe { libc::geteuid() },
        "Codewhale credentials directory must be owned by the current user"
    );
    current
        .set_permissions(fs::Permissions::from_mode(0o700))
        .with_context(|| {
            format!(
                "securing Codewhale credentials directory {}",
                crate::quote_os_path(directory)
            )
        })?;
    Ok(XaiOAuthCredentialStore {
        directory: directory.to_path_buf(),
        directory_handle: current,
    })
}

#[cfg(unix)]

View on GitHub (pinned to 8880682c63)

Solutions

1. Take ownership: sudo chown -R "$(id -u):$(id -g)" "${CODEWHALE_HOME:-$HOME/.codewhale}"
2. Or remove the store and re-authenticate: rm -rf "${CODEWHALE_HOME:-$HOME/.codewhale}/credentials" && codewhale auth xai-device
3. Never run codewhale under sudo; run it as the account that owns the home directory
4. In containers, match the volume uid to the container user (--user "$(id -u):$(id -g)")

Example fix

# before
sudo codewhale auth xai-device   # credentials dir now owned by root

# after
sudo chown -R "$(id -u):$(id -g)" "$HOME/.codewhale"
codewhale auth xai-device

#[cfg(unix)]
fn owned_by_current_user(p: &std::path::Path) -> std::io::Result<bool> {
    use std::os::unix::fs::MetadataExt as _;
    let euid = unsafe { libc::geteuid() };
    Ok(std::fs::metadata(p)?.uid() == euid)
}

When it happens

Trigger: Running codewhale once under sudo so root creates .codewhale/credentials, then running as the normal user; a home restore that preserved different uid values; NFS id-mapping or root-squash mismatches; containers where a bind-mounted volume is owned by a host uid different from the container uid.

Common situations: `sudo codewhale ...` first runs; docker/k8s volumes with mismatched uids; account migrations on multi-user machines; WSL/embedded filesystems with odd ownership mapping.

Related errors

• Codewhale credentials path must be a directory
• xAI OAuth path must be a regular file
• xAI OAuth file must not have multiple filesystem links
• invalid Codewhale-owned xAI OAuth basename
• xAI OAuth private basename must be one UTF-8 path component

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/e26ed09e9c68bc01. Report an issue: GitHub.