Hmbown/CodeWhale · error

external credential consent was not saved: non-interactive u

Error message

external credential consent was not saved: non-interactive use requires explicit --yes after reviewing the preview

What it means

`confirm_external_consent` guards credential-consent writes: if `--yes` was not passed and stdin is not a terminal (piped, redirected, CI, daemon), Codewhale refuses to save consent rather than hang on an invisible prompt. The fix named in the message is to review the printed preview lines and pass an explicit `--yes`.

Source

Thrown at crates/cli/src/lib.rs:3959

            "  access: read_only ({})",
            codewhale_config::EXTERNAL_CREDENTIAL_READ_ONLY_SEMANTICS
        ),
        "  managed: unavailable (no reviewed schema-safe preservation adapter)".to_string(),
        format!(
            "  revoke: codewhale auth external-revoke --provider {}",
            provider.as_str()
        ),
    ]
}

fn confirm_external_consent(yes: bool) -> Result<()> {
    use std::io::IsTerminal;

    if yes {
        return Ok(());
    }
    if !std::io::stdin().is_terminal() {
        bail!(
            "external credential consent was not saved: non-interactive use requires explicit --yes after reviewing the preview"
        );
    }
    confirm_external_consent_answer(&mut std::io::stdin().lock(), &mut std::io::stdout().lock())
}

fn confirm_external_consent_answer(
    reader: &mut impl std::io::BufRead,
    writer: &mut impl std::io::Write,
) -> Result<()> {
    write!(writer, "Type 'yes' to grant this exact read-only access: ")?;
    writer.flush()?;
    let mut answer = String::new();
    reader
        .read_line(&mut answer)
        .context("reading external credential consent confirmation")?;
    if answer.trim() != "yes" {
        bail!("external credential consent cancelled; no configuration was changed");

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Add `--yes` after reviewing the consent preview the command prints
2. Run the command in an interactive terminal and type `yes` at the prompt
3. For scripts, capture the preview in a log first, then re-run with `--yes` so the grant is auditable

Example fix

# before (CI job, stdin not a tty)
$ codewhale external-credentials --provider grok --mode read-only < /dev/null
# external credential consent was not saved...

# after
$ codewhale external-credentials --provider grok --mode read-only --yes

#!/usr/bin/env bash
if [ ! -t 0 ]; then
  # non-interactive context: consent must be pre-approved
  exec codewhale external-credentials --provider grok --mode read-only --yes
fi
exec codewhale external-credentials --provider grok --mode read-only

When it happens

Trigger: Running the external-credentials command without `--yes` in CI, cron, Docker, or with stdin piped from a file/heredoc; SSH one-liners without a TTY; scripts calling the command non-interactively.

Common situations: Automation pipelines that were tested interactively first; containerized runs where /dev/null is stdin; `curl | sh`-style bootstrap scripts.

Related errors

• external credential consent cancelled; no configuration was
• external credential path escapes its absolute root: {}
• external credential access is disabled for {}
• managed external credential access is unsupported for {}; no
• external credential consent for {} uses unsupported version

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/232c4793f797c9f3. Report an issue: GitHub.