Hmbown/CodeWhale · error · anyhow::Error

Codewhale-owned xAI OAuth path escaped the credentials direc

Error message

Codewhale-owned xAI OAuth path escaped the credentials directory

What it means

Path-safety guard in get_owned_credentials: the configured Codewhale-owned xAI OAuth file path's parent directory does not match the canonical xai_oauth_credentials_dir, meaning the path escapes the dedicated credentials directory. This prevents reading or rewriting OAuth tokens outside the secured storage location.

Source

Thrown at crates/tui/src/xai_oauth.rs:410

        )
    })?;
    if !entry_access_token_is_fresh(&entry) {
        bail!(
            "xAI OAuth access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `grok login` again or use `codewhale auth xai-device`.",
            codewhale_config::quote_os_path(grant.path())
        );
    }
    let token = entry
        .key
        .clone()
        .filter(|token| !token.trim().is_empty())
        .context("xAI OAuth access token is empty")?;
    Ok(credentials_from_entry(scope, &entry, token))
}

fn get_owned_credentials(path: &Path) -> Result<XaiOAuthCredentials> {
    let directory = codewhale_config::xai_oauth_credentials_dir()?;
    anyhow::ensure!(
        path.parent() == Some(directory.as_path()),
        "Codewhale-owned xAI OAuth path escaped the credentials directory"
    );
    let name = path
        .file_name()
        .and_then(|name| name.to_str())
        .context("Codewhale-owned xAI OAuth path must have a UTF-8 basename")?;
    anyhow::ensure!(
        name == codewhale_config::LEGACY_XAI_OAUTH_FILE_NAME
            || codewhale_config::is_valid_xai_oauth_generation(name),
        "Codewhale-owned xAI OAuth path has an invalid basename"
    );
    codewhale_config::with_xai_oauth_lifecycle_lock(|store| {
        get_owned_credentials_locked(store, name, refresh_access_token)
    })
}

fn get_owned_credentials_locked<F>(

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Reset the xAI OAuth credential path configuration so it points inside the default credentials directory.
2. Run `codewhale auth xai-device` to regenerate credentials at the canonical location.
3. Inspect config overrides or symlinks that may have redirected the credential path.

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:410 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/aaeee4aee7c3dfdf. Report an issue: GitHub.