Hmbown/CodeWhale · error · std::io::Error

Codewhale-owned credential file DACL is not current-user-onl

Error message

Codewhale-owned credential file DACL is not current-user-only

What it means

Windows DACL entry check in verify_windows_owner_only_handle: GetExplicitEntriesFromAclW returned an entry count other than one (or a null entries pointer), so the DACL grants access to more than a single trustee and the file fails the owner-only requirement.

Source

Thrown at crates/tui/src/external_credentials.rs:514

        return Err(io::Error::from_raw_os_error(result as i32));
    }
    let _entries = WindowsLocalAllocation(entries.cast());
    if count != 1 || entries.is_null() {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file DACL must grant only one user",
        ));
    }
    // SAFETY: `count == 1` proves the first returned entry is initialized.
    let entry = unsafe { &*entries };
    let trustee_sid: PSID = entry.Trustee.ptstrName.cast();
    let current_user_only = entry.Trustee.TrusteeForm == TRUSTEE_IS_SID
        && !trustee_sid.is_null()
        && unsafe { EqualSid(trustee_sid, user.sid()) } != 0
        && matches!(entry.grfAccessMode, SET_ACCESS | GRANT_ACCESS)
        && entry.grfAccessPermissions == FILE_ALL_ACCESS;
    if !current_user_only {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file DACL is not current-user-only",
        ));
    }
    Ok(())
}

#[cfg(windows)]
struct CurrentWindowsUser {
    token: windows_sys::Win32::Foundation::HANDLE,
    token_info: Vec<usize>,
}

#[cfg(windows)]
impl CurrentWindowsUser {
    fn open() -> io::Result<Self> {
        use windows_sys::Win32::Foundation::{GetLastError, HANDLE};
        use windows_sys::Win32::Security::{

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Reset the file's ACL to grant only the current user access (e.g. icacls /inheritance:r plus a single grant).
2. Re-create the credential via the secure auth flow so a correct owner-only DACL is applied.
3. Move the credential file out of directories that inject inherited ACEs.

When it happens

Trigger: Thrown at crates/tui/src/external_credentials.rs:514 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/ba9f6fe23668db01. Report an issue: GitHub.