managed external credential access is unsupported in…

Error message

managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage.

What it means

During external credential consent, --mode managed is refused for this release: no provider has a reviewed schema-safe preservation adapter, so Codewhale will not take over or rewrite an external CLI's credential file. The error directs users to read-only mode or Codewhale-owned storage.

Solutions

Use `--mode read-only` to preview without preservation
Use Codewhale-owned login (`codewhale login`) or API-key storage (`codewhale auth set`) instead
Wait for a release that ships a reviewed preservation adapter for the provider

Example fix

// before
codewhale auth external --provider deepseek --mode managed
// after
codewhale auth external --provider deepseek --mode read-only

Defensive patterns

Strategy: fallback

Try / catch

try { run(['auth','external','--provider',p,'--mode','managed']) } catch { run(['auth','external','--provider',p,'--mode','read-only']) }

Prevention

Prefer --mode read-only for external credential inspection in v0.9.1
Track release notes for when managed preservation adapters land

When it happens

Trigger: Running the external credential consent flow with `--mode managed` after the preview lines are printed (crates/cli/src/lib.rs:4112).

Common situations: Users expecting managed mode to let Codewhale maintain external CLI credentials; automation passing the richest mode by default; attempting managed import during v0.9.1.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/2940df9ff2adcb9c. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/lib.rs:4112

            std::process::exit(if code == std::process::ExitCode::SUCCESS {
                0
            } else {
                1
            })
        }
        AuthCommand::ExternalConsent {
            provider,
            mode,
            path,
            yes,
        } => {
            let (source, path) = external_credential_target(provider, path)?;
            let preview = external_consent_preview_lines(provider, source, &path);
            for line in &preview {
                println!("{line}");
            }
            if mode == ExternalCredentialModeArg::Managed {
                bail!(
                    "managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage."
                );
            }
            confirm_external_consent(yes)?;
            let path_value = path.to_str().context(
                "external credential path cannot be persisted losslessly because it is not valid UTF-8",
            )?;
            let provider_key = provider.provider().provider_config_key();
            codewhale_config::mutate_config_document(store.path(), |document| {
                if matches!(provider, ProviderKind::OpenaiCodex | ProviderKind::Xai) {
                    codewhale_config::set_config_document_value(
                        document,
                        &["providers", provider_key, "auth_mode"],
                        "oauth",
                    )?;
                }
                let prefix = &["providers", provider_key, "external_credentials"];
                codewhale_config::set_config_document_value(

View on GitHub (pinned to 73e0f67d83)