Hmbown/CodeWhale · error · std::io::Error

Codewhale-owned credential file owner is not the current use

Error message

Codewhale-owned credential file owner is not the current user

What it means

Windows ownership check in verify_windows_owner_only_handle: GetSecurityInfo succeeded but the file's owner SID is null or does not equal the current user's SID, so the credential file is not owner-only and is rejected with PermissionDenied.

Source

Thrown at crates/tui/src/external_credentials.rs:485

            &mut owner,
            std::ptr::null_mut(),
            &mut dacl,
            std::ptr::null_mut(),
            &mut descriptor,
        )
    };
    if result != ERROR_SUCCESS {
        return Err(io::Error::from_raw_os_error(result as i32));
    }
    let _descriptor = WindowsLocalAllocation(descriptor.cast());
    if owner.is_null() || unsafe { EqualSid(owner, user.sid()) } == 0 {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file owner is not the current user",
        ));
    }
    if dacl.is_null() {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file must have an owner-only DACL",
        ));
    }
    let mut count = 0;
    let mut entries: *mut EXPLICIT_ACCESS_W = std::ptr::null_mut();
    // SAFETY: `dacl` is owned by the live security descriptor; Windows
    // allocates the returned entries, released below.
    let result = unsafe { GetExplicitEntriesFromAclW(dacl, &mut count, &mut entries) };
    if result != ERROR_SUCCESS {
        return Err(io::Error::from_raw_os_error(result as i32));
    }
    let _entries = WindowsLocalAllocation(entries.cast());
    if count != 1 || entries.is_null() {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "Codewhale-owned credential file DACL must grant only one user",
        ));

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Re-create the credential file as the current user so ownership is set correctly (e.g. re-run the auth flow).
2. Use takeown/icacls or File Explorer to reset ownership to the current user.
3. Avoid copying credential files across user accounts; let the owning tool create them.

When it happens

Trigger: Thrown at crates/tui/src/external_credentials.rs:485 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/23845c18ff20c2f0. Report an issue: GitHub.