Hmbown/CodeWhale · error · anyhow::Error

Codewhale-owned xAI OAuth path has an invalid basename

Error message

Codewhale-owned xAI OAuth path has an invalid basename

What it means

Basename validation guard in get_owned_credentials: the file name component of the Codewhale-owned xAI OAuth credential path does not match the expected credential-file naming pattern (validated by is_valid_xai_oauth_generation). This blocks reading arbitrary files from the credentials directory under an OAuth pretext.

Source

Thrown at crates/tui/src/xai_oauth.rs:418

    let token = entry
        .key
        .clone()
        .filter(|token| !token.trim().is_empty())
        .context("xAI OAuth access token is empty")?;
    Ok(credentials_from_entry(scope, &entry, token))
}

fn get_owned_credentials(path: &Path) -> Result<XaiOAuthCredentials> {
    let directory = codewhale_config::xai_oauth_credentials_dir()?;
    anyhow::ensure!(
        path.parent() == Some(directory.as_path()),
        "Codewhale-owned xAI OAuth path escaped the credentials directory"
    );
    let name = path
        .file_name()
        .and_then(|name| name.to_str())
        .context("Codewhale-owned xAI OAuth path must have a UTF-8 basename")?;
    anyhow::ensure!(
        name == codewhale_config::LEGACY_XAI_OAUTH_FILE_NAME
            || codewhale_config::is_valid_xai_oauth_generation(name),
        "Codewhale-owned xAI OAuth path has an invalid basename"
    );
    codewhale_config::with_xai_oauth_lifecycle_lock(|store| {
        get_owned_credentials_locked(store, name, refresh_access_token)
    })
}

fn get_owned_credentials_locked<F>(
    store: &codewhale_config::XaiOAuthCredentialStore,
    name: &str,
    refresh_access: F,
) -> Result<XaiOAuthCredentials>
where
    F: FnOnce(&str, &str, &str) -> Result<TokenResponse>,
{
    let path = store.path_for(name)?;

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Use only credential file names produced by `codewhale auth xai-device`, matching the valid generation naming scheme.
2. Remove or rename the malformed file in the xAI OAuth credentials directory.
3. Re-run `codewhale auth xai-device` to generate a correctly named credential file.

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:418 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/00ba8f5055942b19. Report an issue: GitHub.