Hmbown/CodeWhale · error · anyhow::Error

Codewhale-owned xAI OAuth file {} exceeds the {} byte limit

Error message

Codewhale-owned xAI OAuth file {} exceeds the {} byte limit

What it means

Thrown when reading a Codewhale-owned xAI OAuth file whose on-disk size (from metadata on the opened handle) exceeds XAI_OAUTH_FILE_LIMIT, which is 1 MiB (1024*1024 bytes). A real OAuth token JSON is a few kilobytes, so an oversized file means the wrong file was placed in the credentials directory; the size cap bounds memory and parse exposure.

Source

Thrown at crates/config/src/xai_credentials.rs:193

    #[must_use]
    pub fn directory(&self) -> &Path {
        &self.directory
    }

    pub fn path_for(&self, name: &str) -> Result<PathBuf> {
        validate_owned_auth_name(name)?;
        Ok(self.directory.join(name))
    }

    pub fn read_to_string(&self, name: &str) -> Result<Option<String>> {
        validate_owned_auth_name(name)?;
        let Some(mut file) = self.open_owned_file_for_read(name)? else {
            return Ok(None);
        };
        let metadata = validate_owned_file_handle(&file, &self.directory.join(name))?;
        if metadata.len() > XAI_OAUTH_FILE_LIMIT {
            bail!(
                "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit",
                crate::quote_os_path(&self.directory.join(name)),
                XAI_OAUTH_FILE_LIMIT
            );
        }
        let mut bytes = Vec::with_capacity(metadata.len() as usize);
        (&mut file)
            .take(XAI_OAUTH_FILE_LIMIT + 1)
            .read_to_end(&mut bytes)
            .with_context(|| {
                format!(
                    "reading Codewhale-owned xAI OAuth file {}",
                    crate::quote_os_path(&self.directory.join(name))
                )
            })?;
        if bytes.len() as u64 > XAI_OAUTH_FILE_LIMIT {
            bail!(
                "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit",

View on GitHub (pinned to 0c42157ee5)

Solutions

  1. Delete or move the oversized file out of the credentials directory: ls -l ~/.codewhale/credentials to spot it by size
  2. Re-authenticate through the codewhale xAI OAuth flow so a fresh, correctly sized generation file is written
  3. If you manage credentials with tooling, validate size (< 1 MiB) and shape before installing files

Example fix

# before
~/.codewhale/credentials/xai-auth-<...>.json   # 47 MB (wrong file restored from backup)

# after
rm ~/.codewhale/credentials/xai-auth-<...>.json
codewhale login   # re-run the xAI OAuth flow
Defensive patterns

Strategy: validation

Validate before calling

const XAI_OAUTH_FILE_LIMIT: u64 = 1024 * 1024;

let meta = std::fs::metadata(&path)?;
anyhow::ensure!(
    meta.len() <= XAI_OAUTH_FILE_LIMIT,
    "credential file too large ({} bytes); expected a small OAuth JSON",
    meta.len()
);

Try / catch

match store.read_to_string(&name) {
    Ok(contents) => contents,
    Err(err) if err.to_string().contains("exceeds the") => {
        // wrong file installed; remove it and force re-login
        std::fs::remove_file(store.path_for(&name)?)?;
        anyhow::bail!("credential file was oversized and has been removed; re-run login");
    }
    Err(err) => return Err(err),
}

Prevention

When it happens

Trigger: read_to_string on a credentials file larger than 1 MiB: someone dropped a certificate bundle, concatenated JSON, an editor backup, or a log/JWT-dump file into ~/.codewhale/credentials and named it xai-auth-*.json.

Common situations: Manual recovery attempts that redirected output into the credentials file; sync/copy mistakes bringing in a large lookalike; test fixtures with embedded token plus extra payload.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/ed47791cce6f5db8. Report an issue: GitHub.