external credential file exceeds the byte safety limit

Error message

external {} credential file {} exceeds the {} byte safety limit

What it means

read_to_string enforces MAX_EXTERNAL_CREDENTIAL_BYTES on every externally-granted credential file before it is accepted. The file is read with a take() bounded one byte past the limit; if that many bytes were read, the file is oversized and the read fails closed rather than loading an unbounded secret file into memory.

Solutions

Check the file size at the path in the message; credentials files should be tiny YAML mappings.
Remove accidental content (backups, appended blobs) from the credentials file so it holds only `KEY: value` lines.
Point the grant/dsh home at the real credentials file, not a larger adjacent file.
If a legitimately larger credential store is needed, that is unsupported — keep only the needed key in `$DSH_HOME/.credentials.yaml`.

Example fix

// before: .credentials.yaml is 2 MB (append-only log of keys)
// after: single small mapping
DEEPSEEK_API_KEY: "sk-..."
$ wc -c ~/.dsh/.credentials.yaml  # must be <= MAX_EXTERNAL_CREDENTIAL_BYTES

Defensive patterns

Strategy: validation

Validate before calling

// Check size before requesting the grant read
let meta = std::fs::metadata(grant.path())?;
if meta.len() > codewhale::tui::external_credentials::MAX_EXTERNAL_CREDENTIAL_BYTES {
    panic!("credential file too large: {}", grant.path().display());
}

Try / catch

match read_to_string(&grant) {
    Ok(Some(text)) => parse(text),
    Ok(None) => println!("credentials file absent"),
    Err(e) if e.to_string().contains("exceeds") => eprintln!("oversized credential file — inspect and trim it"),
    Err(e) => return Err(e),
}

Prevention

Keep `$DSH_HOME/.credentials.yaml` a tiny KEY: value mapping; never append to it.
Point grants at the exact credentials file, not directories or logs.
Monitor credential-file size in provisioning checks.

When it happens

Trigger: Calling `deepseek_api_key_from_grant` (or any reader over ExternalCredentialReadGrant) where the granted file at grant.path() is larger than MAX_EXTERNAL_CREDENTIAL_BYTES after secure open.

Common situations: The credentials file accumulated backups or appended entries; the granted path accidentally points at a large log/data file instead of the YAML credentials; a provisioning tool wrote junk (e.g. concatenated key material) into the credentials file.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/296e9035d74cea09. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/external_credentials.rs:80

        }
    };

    #[cfg(test)]
    increment_side_effect(1);

    let mut bytes = Vec::new();
    file.by_ref()
        .take(MAX_EXTERNAL_CREDENTIAL_BYTES + 1)
        .read_to_end(&mut bytes)
        .with_context(|| {
            format!(
                "reading external {} credential file {}",
                grant.source().as_str(),
                codewhale_config::quote_os_path(grant.path())
            )
        })?;
    if bytes.len() as u64 > MAX_EXTERNAL_CREDENTIAL_BYTES {
        bail!(
            "external {} credential file {} exceeds the {} byte safety limit",
            grant.source().as_str(),
            codewhale_config::quote_os_path(grant.path()),
            MAX_EXTERNAL_CREDENTIAL_BYTES
        );
    }
    let contents = String::from_utf8(bytes).with_context(|| {
        format!(
            "external {} credential file {} is not valid UTF-8",
            grant.source().as_str(),
            codewhale_config::quote_os_path(grant.path())
        )
    })?;
    Ok(Some(contents))
}

/// Read one Codewhale-owned credential file through the same no-follow,
/// bounded I/O boundary used for external grants. On Unix the opened handle

View on GitHub (pinned to 73e0f67d83)