Hmbown/CodeWhale · error · anyhow::Error

current Windows user token has no SID

Error message

current Windows user token has no SID

What it means

Thrown on Windows after OpenProcessToken/GetTokenInformation succeed but the returned TOKEN_USER structure has a null SID pointer — the current process's access token carries no security identifier. This is an OS-level anomaly: the SID is what the xAI credentials ownership checks (ACL verification) key on, so without it the code refuses to proceed.

Source

Thrown at crates/config/src/xai_credentials.rs:1454

            GetTokenInformation(
                token,
                TokenUser,
                token_info.as_mut_ptr().cast(),
                needed,
                &mut needed,
            )
        } == 0
        {
            let error = std::io::Error::last_os_error();
            // SAFETY: the token is owned on this error path.
            unsafe { CloseHandle(token) };
            return Err(error).context("reading current Windows user token information");
        }
        let user = unsafe { &*token_info.as_ptr().cast::<TOKEN_USER>() };
        if user.User.Sid.is_null() {
            // SAFETY: the token is owned on this error path.
            unsafe { CloseHandle(token) };
            bail!("current Windows user token has no SID");
        }
        Ok(Self { token, token_info })
    }

    fn sid(&self) -> windows_sys::Win32::Security::PSID {
        use windows_sys::Win32::Security::TOKEN_USER;
        // SAFETY: the aligned token buffer remains owned by `self`.
        unsafe { (*self.token_info.as_ptr().cast::<TOKEN_USER>()).User.Sid }
    }
}

#[cfg(windows)]
impl Drop for CurrentWindowsUser {
    fn drop(&mut self) {
        // SAFETY: `token` is owned by this guard and closed exactly once.
        unsafe { windows_sys::Win32::Foundation::CloseHandle(self.token) };
    }
}

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Run codewhale from a normal interactive user context (regular cmd/PowerShell/terminal) where the token has a standard SID
2. If this is a service/sandbox, run it as a regular user account with a standard token instead of a restricted one
3. Verify the context has a SID: `whoami /user` should print a SID; if it errors or is empty, fix the host environment before retrying

match credentials_owner::acquire() {
    Ok(owner) => owner,
    Err(err) if err.to_string().contains("no SID") => {
        // environment cannot support owner checks; degrade gracefully
        log::warn!("no user SID in token; skipping owner-verified credential ops");
        return Ok(None);
    }
    Err(err) => return Err(err),
}

When it happens

Trigger: Running under a heavily restricted or synthetic token: sandboxed/AppContainer processes, some service hosts, tokens mangled by security software, or exotic impersonation where the token information query returns a structure without a user SID.

Common situations: Running codewhale inside a restricted job container or sandbox on Windows; unusual terminal/service hosts that strip token groups; security products that proxy process tokens.

Related errors

• xAI OAuth lifecycle lock changed repeatedly while opening
• ${name} is unavailable in Workflow scripts: runs must be det
• new Date()/Date() is unavailable in Workflow scripts: runs m
• parallel(): expected an array of thunks
• refusing unauthenticated app-server bind on non-loopback add

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/fbc71c8d808ff4aa. Report an issue: GitHub.