Hmbown/CodeWhale · error · anyhow::Error

DeepSeek Harness credentials line {} is not `KEY: value`

Error message

DeepSeek Harness credentials line {} is not `KEY: value`

What it means

Thrown by parse_dsh_deepseek_api_key when a non-blank, non-comment line in the dsh credentials document has no ':' separator, so split_once(':') fails. The parser accepts a strict subset of dsh-credentials-local: each meaningful line must look like KEY: value; the error reports the 1-based line number.

Source

Thrown at crates/tui/src/dsh_credentials.rs:41

    let Some(text) = crate::external_credentials::read_to_string(grant)? else {
        return Ok(None);
    };
    parse_dsh_deepseek_api_key(&text)
}

/// Strict subset of dsh-credentials-local: a mapping of POSIX identifiers to
/// non-empty strings. Nested values, empty strings, and duplicate keys fail
/// closed. Only `DEEPSEEK_API_KEY` is returned.
pub(crate) fn parse_dsh_deepseek_api_key(text: &str) -> Result<Option<String>> {
    let mut found = None;
    let mut seen = std::collections::BTreeSet::new();
    for (index, raw) in text.lines().enumerate() {
        let line = raw.trim();
        if line.is_empty() || line.starts_with('#') {
            continue;
        }
        let Some((key, value)) = line.split_once(':') else {
            bail!(
                "DeepSeek Harness credentials line {} is not `KEY: value`",
                index + 1
            );
        };
        let key = key.trim();
        if !is_posix_identifier(key) {
            bail!(
                "DeepSeek Harness credentials line {} has a non-identifier key",
                index + 1
            );
        }
        if !seen.insert(key.to_string()) {
            bail!("DeepSeek Harness credentials declare `{key}` more than once");
        }
        let value = unquote_yaml_string(value.trim()).map_err(|reason| {
            anyhow::anyhow!(
                "DeepSeek Harness credentials line {} is invalid: {reason}",
                index + 1

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Rewrite the offending line as KEY: value (colon separator)
2. Remove stray non-entry lines or prefix them with '#' to comment them out
3. Validate the file format with a YAML linter if unsure

Example fix

# before (line 3)
DEEPSEEK_API_KEY=sk-abc

# after
DEEPSEEK_API_KEY: sk-abc

fn lint_dsh_credentials(text: &str) -> Result<()> {
    for (index, raw) in text.lines().enumerate() {
        let line = raw.trim();
        if line.is_empty() || line.starts_with('#') {
            continue;
        }
        if line.split_once(':').is_none() {
            return Err(anyhow::anyhow!("line {}: expected 'KEY: value', got {line:?}", index + 1));
        }
    }
    Ok(())
}

When it happens

Trigger: A line like "DEEPSEEK_API_KEY=sk-abc" (equals instead of colon) or a stray prose line such as "credentials for prod" in the granted file.

Common situations: Hand-editing the credentials file in .env syntax instead of the KEY: value YAML-ish form; pasting a JSON fragment or note into the file.

Related errors

• DeepSeek Harness credentials line {} has a non-identifier ke
• DeepSeek Harness credentials declare `{key}` more than once
• DeepSeek Harness credentials line {} has an empty value
• DeepSeek Harness import requires a dsh_cli grant, not {}
• DeepSeek Harness credentials line {} is invalid: {reason}

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/386102874f888bf2. Report an issue: GitHub.