What causes "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit" in Hmbown/CodeWhale?

Inspect the file and remove or shrink it to a valid small OAuth JSON payload

Codewhale-owned xAI OAuth file

Error message

Codewhale-owned xAI OAuth file {} exceeds the {} byte limit

What it means

read_to_string reads a Codewhale-owned xAI OAuth file after stat-ing it; it enforces XAI_OAUTH_FILE_LIMIT so a huge or unexpected file is never read into memory. The pre-read size check bails when the file's metadata length exceeds the limit.

Solutions

Inspect the file and remove or shrink it to a valid small OAuth JSON payload
Re-authenticate (logout/login) so Codewhale rewrites a fresh, valid credential file
Verify no other process is writing oversized data into the credentials directory

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

let md = std::fs::metadata(path)?;
assert!(md.len() <= 64 * 1024, "credential file suspiciously large: {}", md.len());

Try / catch

match store.read_to_string(name) {
    Ok(Some(contents)) => { /* use contents */ }
    Ok(None) => { /* not logged in */ }
    Err(e) if e.to_string().contains("byte limit") => {
        // file is corrupt/oversized: force re-login
        store.logout_cleanup()?;
    }
    Err(e) => return Err(e.into()),
}

Prevention

Treat credential files as library-owned; never write your own data there
Re-authenticate rather than hand-editing credential files
Watch the credentials dir for unexpected writers

When it happens

Trigger: Calling read_to_string on an owned auth file whose on-disk size (from file metadata) exceeds XAI_OAUTH_FILE_LIMIT.

Common situations: Corrupted or attacker-planted credential file; a user replaced the OAuth JSON with a large blob; a log or backup file accidentally written under the credentials name.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/ed47791cce6f5db8. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/xai_credentials.rs:230

    #[must_use]
    pub fn directory(&self) -> &Path {
        &self.directory
    }

    pub fn path_for(&self, name: &str) -> Result<PathBuf> {
        validate_owned_auth_name(name)?;
        Ok(self.directory.join(name))
    }

    pub fn read_to_string(&self, name: &str) -> Result<Option<String>> {
        validate_owned_auth_name(name)?;
        let Some(mut file) = self.open_owned_file_for_read(name)? else {
            return Ok(None);
        };
        let metadata = validate_owned_file_handle(&file, &self.directory.join(name))?;
        if metadata.len() > XAI_OAUTH_FILE_LIMIT {
            bail!(
                "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit",
                crate::quote_os_path(&self.directory.join(name)),
                XAI_OAUTH_FILE_LIMIT
            );
        }
        let mut bytes = Vec::with_capacity(metadata.len() as usize);
        (&mut file)
            .take(XAI_OAUTH_FILE_LIMIT + 1)
            .read_to_end(&mut bytes)
            .with_context(|| {
                format!(
                    "reading Codewhale-owned xAI OAuth file {}",
                    crate::quote_os_path(&self.directory.join(name))
                )
            })?;
        if bytes.len() as u64 > XAI_OAUTH_FILE_LIMIT {
            bail!(
                "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit",

View on GitHub (pinned to 73e0f67d83)