Hmbown/CodeWhale · error · anyhow::Error

external credential consent for {}: {error}

Error message

external credential consent for {}: {error}

What it means

Inside external_credential_read_grant(), after a consent record is found it is re-validated by consent.read_grant(kind, source, &consent.path); any failure is wrapped as 'external credential consent for {provider}'. Failures mean the persisted consent record no longer matches the request: wrong source kind, path moved, mode is not read-only, or the record structure is stale.

Source

Thrown at crates/tui/src/config.rs:5990

            .metadata()
            .map(codewhale_config::provider::Provider::kind)
            .context("external credentials are unsupported for this provider")?;
        let consent = self
            .provider_config_for(provider)
            .and_then(|entry| entry.external_credentials.as_ref())
            .with_context(|| {
                format!(
                    "External credentials owned by {} are disabled for {}. To allow read-only access to this exact file, run:\n  codewhale auth external-consent --provider {} --mode read-only --path {}",
                    source.as_str(),
                    provider.display_name(),
                    kind.as_str(),
                    codewhale_config::quote_os_path(suggested_path)
                )
            })?;
        consent
            .read_grant(kind, source, &consent.path)
            .map_err(|error| {
                anyhow::anyhow!(
                    "external credential consent for {}: {error}",
                    provider.display_name()
                )
            })
    }

    /// Whether a structurally valid read-only consent record exists for an
    /// external credential source. This never stats or reads the selected
    /// file and never mints the capability required to do so.
    pub(crate) fn external_credential_read_consent_configured(
        &self,
        provider: ApiProvider,
        source: codewhale_config::ExternalCredentialSource,
    ) -> bool {
        let Some(kind) = provider
            .metadata()
            .map(codewhale_config::provider::Provider::kind)
        else {

View on GitHub (pinned to 8880682c63)

Solutions

1. Re-issue consent for the exact current file: codewhale auth external-consent --provider <provider> --mode read-only --path <file>.
2. Verify the path in the persisted consent record still exists and matches the CLI's real credential file.
3. Remove the stale [external_credentials] entry and grant fresh consent.

Example fix

# before: stale consent path
[external_credentials.xai]
mode = "read-only"
path = "/old/home/.grok/auth.json"

# after: re-grant against the real file
# codewhale auth external-consent --provider xai --mode read-only --path ~/.grok/auth.json

// cheap structural probe before attempting the grant (never stats/reads the file)
if !config.external_credential_read_consent_configured(provider, source) {
    // surface re-consent guidance instead of hitting the wrapped error
    return Ok(None);
}

fn external_consent_usable(config: &Config, provider: ApiProvider, source: ExternalCredentialSource) -> bool {
    config.external_credential_read_consent_configured(provider, source)
}

let grant = match config.external_credential_read_grant(provider, source, &path) {
    Ok(g) => g,
    Err(e) if e.to_string().starts_with("external credential consent for") => {
        // consent record stale/mismatched: prompt the user to re-run
        // codewhale auth external-consent --provider <p> --mode read-only --path <file>
        return Err(e);
    }
    Err(e) => return Err(e),
};

When it happens

Trigger: The external CLI moved or rewrote its credential file after consent was granted; consent recorded for a different ExternalCredentialSource or provider kind; partial/corrupted TOML consent entry; CLI upgrade changed the file path.

Common situations: Grok/Codex CLI reinstalled under a new HOME or new path; consent granted on macOS then synced to Linux; manually edited config files.

Related errors

• external credential access for {} is dormant until that prov
• OpenAI Codex OAuth credentials are unavailable. Codewhale c
• Invalid sandbox_mode '{mode}': expected read-only, workspace
• Kimi CLI credential import is unsupported. Codewhale does no
• Custom endpoint credentials for {route_name} must be bound e

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/36cb5e2db9d8ffe6. Report an issue: GitHub.