Hmbown/CodeWhale · error

Codewhale-owned xAI OAuth DACL is not current-user-only

Error message

Codewhale-owned xAI OAuth DACL is not current-user-only

What it means

The final windows DACL check requires the single ACE to identify the current user by SID (TRUSTEE_IS_SID), use SET_ACCESS or GRANT_ACCESS mode, and grant exactly FILE_ALL_ACCESS. Any other trustee, a reduced access mask, or a deny-style entry fails closed — including files whose grant belongs to a different account than the one running codewhale.

Source

Thrown at crates/config/src/xai_credentials.rs:1390

    );
    let mut count = 0;
    let mut entries: *mut EXPLICIT_ACCESS_W = std::ptr::null_mut();
    // SAFETY: `dacl` belongs to the live descriptor; Windows allocates the
    // returned entry array, released by the guard below.
    let result = unsafe { GetExplicitEntriesFromAclW(dacl, &mut count, &mut entries) };
    if result != ERROR_SUCCESS {
        return Err(std::io::Error::from_raw_os_error(result as i32))
            .context("reading Codewhale-owned xAI OAuth DACL entries");
    }
    let _entries = WindowsLocalAllocation(entries.cast());
    anyhow::ensure!(
        count == 1 && !entries.is_null(),
        "Codewhale-owned xAI OAuth DACL must grant only one user"
    );
    // SAFETY: `count == 1` proves the first returned entry is initialized.
    let entry = unsafe { &*entries };
    let trustee_sid: PSID = entry.Trustee.ptstrName.cast();
    anyhow::ensure!(
        entry.Trustee.TrusteeForm == TRUSTEE_IS_SID
            && !trustee_sid.is_null()
            && unsafe { EqualSid(trustee_sid, user.sid()) } != 0
            && matches!(entry.grfAccessMode, SET_ACCESS | GRANT_ACCESS)
            && entry.grfAccessPermissions == FILE_ALL_ACCESS,
        "Codewhale-owned xAI OAuth DACL is not current-user-only"
    );
    Ok(())
}

#[cfg(windows)]
struct CurrentWindowsUser {
    token: windows_sys::Win32::Foundation::HANDLE,
    token_info: Vec<usize>,
}

#[cfg(windows)]
impl CurrentWindowsUser {

View on GitHub (pinned to 8880682c63)

Solutions

1. Delete the credential files in $CODEWHALE_HOME/credentials and run codewhale auth xai-device again on this account
2. Or repair the ACE: icacls <file> /inheritance:r then icacls <file> /grant:r "%USERNAME%:F"
3. Never copy OAuth files between accounts; re-authenticate instead

Example fix

:: before (file copied from another account)
:: after
icacls "%USERPROFILE%\.codewhale\credentials\xai-auth.json" /inheritance:r
icacls "%USERPROFILE%\.codewhale\credentials\xai-auth.json" /grant:r "%USERNAME%:F
codewhale auth xai-device

match login() {
    Ok(v) => v,
    Err(e) if e.to_string().contains("DACL is not current-user-only") => {
        // files copied from another account: delete and re-authenticate
        let _ = std::fs::remove_dir_all(&credentials_dir);
        login()?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: Credential files copied from another user or machine (the SID belongs elsewhere); partial icacls edits leaving a restricted mask; tools writing deny ACEs.

Common situations: Migrating logins between accounts by copying files; manual permission surgery; shared machines.

Related errors

• Codewhale-owned xAI OAuth storage owner is not the current u
• Codewhale-owned xAI OAuth DACL must grant only one user
• Codewhale-owned xAI OAuth storage must have an owner-only DA
• Codewhale credentials directory must be owned by the current
• Codewhale credentials directory cannot be a volume root

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/99a21a3452b79781. Report an issue: GitHub.