Hmbown/CodeWhale · error

DeepSeek Harness import requires a dsh_cli grant, not

Error message

DeepSeek Harness import requires a dsh_cli grant, not {}

What it means

`deepseek_api_key_from_grant` imports a DeepSeek API key from an external credential grant document. It requires the grant's source to be `DshCli` (the DeepSeek Harness CLI); any other credential source is rejected with this error naming the actual source. This prevents misreading credentials minted for a different provider.

Solutions

1. Grant the credential through the DeepSeek Harness CLI (`dsh`) so the source is `dsh_cli`, then retry the import.
2. Check which credential source is configured/selected and switch to the dsh_cli-sourced grant.
3. If the key genuinely lives in another source, import it through that source's own path instead of the DSH one.

fn is_dsh_cli_grant(grant: &ExternalCredentialReadGrant) -> bool {
    grant.source() == codewhale_config::ExternalCredentialSource::DshCli
}

if !is_dsh_cli_grant(&grant) {
    // route to the correct provider's import path instead of the DSH one
}

When it happens

Trigger: Passing an `ExternalCredentialReadGrant` whose `source()` is not `ExternalCredentialSource::DshCli` into the DeepSeek Harness import path — e.g. wiring a github-cli or other provider's grant to the DSH importer by mistake.

Common situations: Config or routing logic selecting the wrong stored credential; user stored DeepSeek credentials under a generic source; code refactor passing grants between providers without checking source.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• DeepSeek Harness credentials line
• api_key cannot be empty string
• DeepSeek API key not found. 1. Get a key: …
• DeepSeek Harness credentials declare
• DeepSeek Harness credentials line

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/9b5092d2cddc3c37. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/dsh_credentials.rs:18

//! Read-only DeepSeek Harness credential import.
//!
//! Official `dsh` stores API keys as a YAML mapping in
//! `$DSH_HOME/.credentials.yaml`. Codewhale may read `DEEPSEEK_API_KEY` from
//! that exact file only after `codewhale auth external-consent`. The file is
//! never written, refreshed, or loaded into the process environment.

use anyhow::{Result, bail};
use codewhale_config::ExternalCredentialReadGrant;

const DEEPSEEK_API_KEY_REF: &str = "DEEPSEEK_API_KEY";

/// Extract the DeepSeek API key from a granted dsh credentials document.
pub(crate) fn deepseek_api_key_from_grant(
    grant: &ExternalCredentialReadGrant,
) -> Result<Option<String>> {
    if grant.source() != codewhale_config::ExternalCredentialSource::DshCli {
        bail!(
            "DeepSeek Harness import requires a dsh_cli grant, not {}",
            grant.source().as_str()
        );
    }
    let Some(text) = crate::external_credentials::read_to_string(grant)? else {
        return Ok(None);
    };
    parse_dsh_deepseek_api_key(&text)
}

/// Strict subset of dsh-credentials-local: a mapping of POSIX identifiers to
/// non-empty strings. Nested values, empty strings, and duplicate keys fail
/// closed. Only `DEEPSEEK_API_KEY` is returned.
pub(crate) fn parse_dsh_deepseek_api_key(text: &str) -> Result<Option<String>> {
    let mut found = None;
    let mut seen = std::collections::BTreeSet::new();
    for (index, raw) in text.lines().enumerate() {
        let line = raw.trim();

View on GitHub (pinned to 73e0f67d83)