Hmbown/CodeWhale · error · std::io::Error

Codewhale-owned credential file DACL must grant only one use

Error message

Codewhale-owned credential file DACL must grant only one user

What it means

Windows DACL check in verify_windows_owner_only_handle: the credential file has no DACL at all, so the required owner-only access policy cannot be verified — the file is rejected with PermissionDenied.

Source

Thrown at crates/tui/src/external_credentials.rs:500

        ));
    }
    if dacl.is_null() {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file must have an owner-only DACL",
        ));
    }
    let mut count = 0;
    let mut entries: *mut EXPLICIT_ACCESS_W = std::ptr::null_mut();
    // SAFETY: `dacl` is owned by the live security descriptor; Windows
    // allocates the returned entries, released below.
    let result = unsafe { GetExplicitEntriesFromAclW(dacl, &mut count, &mut entries) };
    if result != ERROR_SUCCESS {
        return Err(io::Error::from_raw_os_error(result as i32));
    }
    let _entries = WindowsLocalAllocation(entries.cast());
    if count != 1 || entries.is_null() {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file DACL must grant only one user",
        ));
    }
    // SAFETY: `count == 1` proves the first returned entry is initialized.
    let entry = unsafe { &*entries };
    let trustee_sid: PSID = entry.Trustee.ptstrName.cast();
    let current_user_only = entry.Trustee.TrusteeForm == TRUSTEE_IS_SID
        && !trustee_sid.is_null()
        && unsafe { EqualSid(trustee_sid, user.sid()) } != 0
        && matches!(entry.grfAccessMode, SET_ACCESS | GRANT_ACCESS)
        && entry.grfAccessPermissions == FILE_ALL_ACCESS;
    if !current_user_only {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file DACL is not current-user-only",
        ));
    }

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Restore an owner-only DACL on the file (icacls granting only the current user access).
2. Re-run the credential creation flow so the tool recreates the file with the proper ACL.
3. Check the parent directory's ACL inheritance settings.

When it happens

Trigger: Thrown at crates/tui/src/external_credentials.rs:500 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/0b9db43d1e3840f6. Report an issue: GitHub.