invalid Codewhale-owned xAI OAuth generation; expected…

Error message

invalid Codewhale-owned xAI OAuth generation; expected xai-auth-<32 lowercase hex>.json

What it means

validate_xai_oauth_generation checks a generation filename against the strict pattern xai-auth-<32 lowercase hex>.json, where the 32 hex chars are a blake3 hash prefix identifying a stored OAuth generation. It is called by xai_oauth_generation_path and remove_xai_oauth_generation, so any programmatically constructed generation name must match exactly or the library refuses to touch the file.

Solutions

Pass only the bare generation file name, e.g. "xai-auth-3f9a1c...c2.json" (32 lowercase hex chars)
Lowercase and re-truncate any hash you computed to exactly 32 hex chars before calling
Strip any directory prefix from a path obtained by scanning the credentials directory

Example fix

// before
remove_xai_oauth_generation("/home/u/.xai/xai-auth-3F9A1C.json")
// after
remove_xai_oauth_generation("xai-auth-3f9a1c0d7e2b4a6f8d1c3e5a7b9d0f2b.json")

Defensive patterns

Strategy: validation

Validate before calling

fn is_xai_generation(v: &str) -> bool {
    let hex = v.strip_prefix("xai-auth-")
        .and_then(|r| r.strip_suffix(".json"));
    hex.map(|h| h.len() == 32 && h.chars().all(|c| c.is_ascii_hexdigit() && !c.is_ascii_uppercase()))
        .unwrap_or(false)
}

Type guard

fn as_xai_generation(v: &str) -> Option<&str> {
    let hex = v.strip_prefix("xai-auth-")?.strip_suffix(".json")?;
    (hex.len() == 32 && hex.bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase()))
        .then_some(v)
}

Try / catch

match validate_xai_oauth_generation(value) {
    Ok(v) => remove_xai_oauth_generation(v),
    Err(e) => eprintln!("bad generation name '{value}': {e}"),
}

Prevention

Pass bare file names, never full paths
Downcase any hash you compute and truncate to 32 hex chars
Take generation names from the library's own listing APIs, not hand-built strings

When it happens

Trigger: Calling xai_oauth_generation_path or remove_xai_oauth_generation with a value that is not exactly "xai-auth-" + 32 lowercase hex + ".json" — e.g. uppercase hex, wrong length, missing prefix/suffix, or a path instead of the bare generation name.

Common situations: Parsing a directory listing and passing the full path rather than the file name, hand-editing a stored generation reference, or a version change in the hashing scheme producing a different-length digest.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/aa41355fefc55c3d. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/xai_credentials.rs:66

/// failed config mutation restores or retains the prior files; a successful
/// mutation removes them.
#[derive(Debug)]
pub struct XaiOAuthRevocation {
    retired: Vec<(String, String)>,
}

#[must_use]
pub fn is_valid_xai_oauth_generation(value: &str) -> bool {
    is_valid_owned_oauth_generation(
        value,
        XAI_OAUTH_GENERATION_PREFIX,
        XAI_OAUTH_GENERATION_SUFFIX,
    )
}

pub fn validate_xai_oauth_generation(value: &str) -> Result<&str> {
    if !is_valid_xai_oauth_generation(value) {
        bail!(
            "invalid Codewhale-owned xAI OAuth generation; expected xai-auth-<32 lowercase hex>.json"
        );
    }
    Ok(value)
}

#[must_use]
pub fn is_valid_chatgpt_oauth_generation(value: &str) -> bool {
    is_valid_owned_oauth_generation(
        value,
        CHATGPT_OAUTH_GENERATION_PREFIX,
        CHATGPT_OAUTH_GENERATION_SUFFIX,
    )
}

pub fn validate_chatgpt_oauth_generation(value: &str) -> Result<&str> {
    if !is_valid_chatgpt_oauth_generation(value) {
        bail!(

View on GitHub (pinned to 73e0f67d83)