Hmbown/CodeWhale · error · anyhow::Error

Codewhale-owned credential file {} exceeds the {} byte safet

Error message

Codewhale-owned credential file {} exceeds the {} byte safety limit

What it means

Codewhale refuses to load a Codewhale-owned credential file larger than MAX_EXTERNAL_CREDENTIAL_BYTES (1 MiB, defined in crates/tui/src/external_credentials.rs:18). The reader takes at most limit+1 bytes, so any file over the limit is detected without reading it fully. The guard exists because a multi-megabyte 'credential' almost always means the path points at the wrong file (a JSON dump, a keychain export, a log), not a token.

Source

Thrown at crates/tui/src/external_credentials.rs:138

                format!(
                    "securely opening Codewhale-owned credential file {}",
                    codewhale_config::quote_os_path(path)
                )
            });
        }
    };
    let mut bytes = Vec::new();
    file.by_ref()
        .take(MAX_EXTERNAL_CREDENTIAL_BYTES + 1)
        .read_to_end(&mut bytes)
        .with_context(|| {
            format!(
                "reading Codewhale-owned credential file {}",
                codewhale_config::quote_os_path(path)
            )
        })?;
    if bytes.len() as u64 > MAX_EXTERNAL_CREDENTIAL_BYTES {
        bail!(
            "Codewhale-owned credential file {} exceeds the {} byte safety limit",
            codewhale_config::quote_os_path(path),
            MAX_EXTERNAL_CREDENTIAL_BYTES
        );
    }
    String::from_utf8(bytes).map(Some).with_context(|| {
        format!(
            "Codewhale-owned credential file {} is not valid UTF-8",
            codewhale_config::quote_os_path(path)
        )
    })
}

#[cfg(unix)]
fn open_secure_regular_file(path: &Path, require_owner_only: bool) -> io::Result<File> {
    use std::ffi::CString;
    use std::os::fd::FromRawFd;
    use std::os::unix::ffi::OsStrExt;

View on GitHub (pinned to 0c42157ee5)

Solutions

Inspect the file size and head bytes (ls -l, head -c 200) to confirm it is not actually a raw credential
Re-create the file containing only the credential value (printf '%s' "$TOKEN" > file), no trailing newline dump or JSON wrapper unless the loader expects it
Check the configured path in settings for typos or a wrong symlink target
If a legitimate credential genuinely exceeds 1 MiB, raise MAX_EXTERNAL_CREDENTIAL_BYTES and rebuild, but treat this as a red flag first

Example fix

# before
$ ls -l ~/.config/codewhale/credentials/provider.token
-rw-r--r-- 1 user user 48210311 ...  # wrong file

# after
$ printf '%s' "$PROVIDER_TOKEN" > ~/.config/codewhale/credentials/provider.token
$ ls -l ~/.config/codewhale/credentials/provider.token
-rw-r--r-- 1 user user 217 ...

Defensive patterns

Strategy: validation

Validate before calling

use std::fs;

const MAX_EXTERNAL_CREDENTIAL_BYTES: u64 = 1024 * 1024;

fn credential_file_size_ok(path: &std::path::Path) -> bool {
    fs::metadata(path)
        .map(|m| m.len() <= MAX_EXTERNAL_CREDENTIAL_BYTES)
        .unwrap_or(false)
}

Try / catch

if let Err(err) = load_credential(&path) {
    if err.to_string().contains("exceeds the") {
        eprintln!("credential file too large; check {} for the wrong file", path.display());
    }
    return Err(err);
}

Prevention

Write credential files with printf '%s' "$TOKEN" instead of echoing API responses into them
Alert when a credential file grows past a few KiB; tokens are small
Never point the credential setting at directory listing dumps or keychain exports

When it happens

Trigger: Calling the external-credential loader with a Codewhale-owned credential path whose file size exceeds 1 MiB: e.g. a credential file that was overwritten with a full API response, a certificate bundle, or a symlink to a large file.

Common situations: Pointing the credential setting at an oauth token JSON that embeds a refresh cookie jar; accidentally saving the provider's entire /credentials endpoint response instead of just the token; a rotated file that appends instead of truncating.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/3862f358869afa9c. Report an issue: GitHub.