Hmbown/CodeWhale · error · anyhow::Error

external {} credential file {} exceeds the {} byte safety li

Error message

external {} credential file {} exceeds the {} byte safety limit

What it means

Thrown by external_credentials::read_to_string when the granted credential file is larger than MAX_EXTERNAL_CREDENTIAL_BYTES (1 MiB, crates/tui/src/external_credentials.rs:18). The read is deliberately bounded with take(limit + 1) so a replaced regular file cannot turn read-only consent into unbounded memory use; exceeding the cap fails closed.

Source

Thrown at crates/tui/src/external_credentials.rs:80

        }
    };

    #[cfg(test)]
    increment_side_effect(1);

    let mut bytes = Vec::new();
    file.by_ref()
        .take(MAX_EXTERNAL_CREDENTIAL_BYTES + 1)
        .read_to_end(&mut bytes)
        .with_context(|| {
            format!(
                "reading external {} credential file {}",
                grant.source().as_str(),
                codewhale_config::quote_os_path(grant.path())
            )
        })?;
    if bytes.len() as u64 > MAX_EXTERNAL_CREDENTIAL_BYTES {
        bail!(
            "external {} credential file {} exceeds the {} byte safety limit",
            grant.source().as_str(),
            codewhale_config::quote_os_path(grant.path()),
            MAX_EXTERNAL_CREDENTIAL_BYTES
        );
    }
    let contents = String::from_utf8(bytes).with_context(|| {
        format!(
            "external {} credential file {} is not valid UTF-8",
            grant.source().as_str(),
            codewhale_config::quote_os_path(grant.path())
        )
    })?;
    Ok(Some(contents))
}

/// Open the exact granted file through the secure boundary (regular file
/// only, no symlink/reparse leaf) without requiring UTF-8. Used by binary

View on GitHub (pinned to 0c42157ee5)

Solutions

Verify the granted path really is the credentials document, not a database or log
Regenerate the credential file so it is a small text/JSON document under 1 MiB
Re-create the grant pointing at the corrected path and retry the import

Defensive patterns

Strategy: validation

Validate before calling

const MAX_CREDENTIAL_BYTES: u64 = 1024 * 1024;

// Check the granted file before importing:
let meta = std::fs::metadata(grant.path())?;
if meta.len() > MAX_CREDENTIAL_BYTES {
    return Err(anyhow::anyhow!(
        "granted file {} is {} bytes; expected a small credentials document",
        grant.path().display(),
        meta.len()
    ));
}

Prevention

Double-check the consented path points at the credentials text file, not a database or log
Keep credential documents minimal; a KEY: value file is a few hundred bytes
Regenerate grants after any tool changes what it stores at the granted path

When it happens

Trigger: The grant path resolves to a large file — e.g. a database (state.vscdb), a log, or a bundled export — instead of the small credentials document expected. Any source (dsh_cli or other) goes through this boundary.

Common situations: Consenting to the wrong path when creating the grant; a symlinked credentials file replaced by something big; tooling writing a huge JSON blob where a tiny KEY: value doc was expected.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/296e9035d74cea09. Report an issue: GitHub.