Hmbown/CodeWhale · error

DeepSeek Harness credentials line

Error message

DeepSeek Harness credentials line {} is not `KEY: value`

What it means

`parse_dsh_deepseek_api_key` parses a dsh credentials document line by line, skipping blanks and `#` comments. Every other line must be `KEY: value`; a line with no colon aborts parsing with the 1-based line number. The document format is enforced strictly so keys can be trusted downstream.

Solutions

  1. Open the credentials document at the reported line number and reformat the line as `KEY: value`.
  2. Remove stray non-credential lines (notes, headers) or prefix them with `#` to make them comments.
  3. If the file came from another tool, re-export it in the dsh `KEY: value` format instead of converting by hand.

Example fix

// credentials file before (line 3 bad)
DEEPSEEK_API_KEY: sk-abc
some stray text
// after
DEEPSEEK_API_KEY: sk-abc
# some stray text
Defensive patterns

Strategy: validation

Validate before calling

// validate the credentials document before import
text.lines()
    .enumerate()
    .filter(|(_, l)| { let l = l.trim(); !l.is_empty() && !l.starts_with('#') })
    .for_each(|(i, l)| assert!(l.contains(':'), "line {} lacks KEY: value", i + 1));

Try / catch

match import_dsh_credentials() {
    Err(e) if e.to_string().contains("is not `KEY: value`") => {
        // open the file at the reported line and fix formatting, then retry
    }
    other => other?,
}

Prevention

When it happens

Trigger: A dsh credentials file/grant document containing a non-empty, non-comment line without a `:` separator — e.g. a stray token, YAML list item (`- foo` without value colon), or prose accidentally saved into the credentials file.

Common situations: Hand-edited credentials file with a typo; pasted text including a header or note line; an exported file from another tool with a different format (JSON/YAML block style) fed into the dsh parser.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/386102874f888bf2. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/dsh_credentials.rs:41

    let Some(text) = crate::external_credentials::read_to_string(grant)? else {
        return Ok(None);
    };
    parse_dsh_deepseek_api_key(&text)
}

/// Strict subset of dsh-credentials-local: a mapping of POSIX identifiers to
/// non-empty strings. Nested values, empty strings, and duplicate keys fail
/// closed. Only `DEEPSEEK_API_KEY` is returned.
pub(crate) fn parse_dsh_deepseek_api_key(text: &str) -> Result<Option<String>> {
    let mut found = None;
    let mut seen = std::collections::BTreeSet::new();
    for (index, raw) in text.lines().enumerate() {
        let line = raw.trim();
        if line.is_empty() || line.starts_with('#') {
            continue;
        }
        let Some((key, value)) = line.split_once(':') else {
            bail!(
                "DeepSeek Harness credentials line {} is not `KEY: value`",
                index + 1
            );
        };
        let key = key.trim();
        if !is_posix_identifier(key) {
            bail!(
                "DeepSeek Harness credentials line {} has a non-identifier key",
                index + 1
            );
        }
        if !seen.insert(key.to_string()) {
            bail!("DeepSeek Harness credentials declare `{key}` more than once");
        }
        let value = unquote_yaml_string(value.trim()).map_err(|reason| {
            anyhow::anyhow!(
                "DeepSeek Harness credentials line {} is invalid: {reason}",
                index + 1

View on GitHub (pinned to 73e0f67d83)