Hmbown/CodeWhale · error · anyhow::Error

refusing oversized xAI OAuth credential payload

Error message

refusing oversized xAI OAuth credential payload

What it means

XaiOAuthCredentialStore::write enforces XAI_OAUTH_FILE_LIMIT (1 MiB, 1024*1024) on any credential payload before writing, refusing oversized writes so credential files stay small, parseable, and cannot be abused as a data dump. The check mirrors the read-side limit applied in the reader.

Source

Thrown at crates/config/src/xai_credentials.rs:226

            })?;
        if bytes.len() as u64 > XAI_OAUTH_FILE_LIMIT {
            bail!(
                "Codewhale-owned xAI OAuth file {} exceeds the {} byte limit",
                crate::quote_os_path(&self.directory.join(name)),
                XAI_OAUTH_FILE_LIMIT
            );
        }
        String::from_utf8(bytes).map(Some).map_err(|_| {
            anyhow::anyhow!(
                "Codewhale-owned xAI OAuth file {} is not valid UTF-8",
                crate::quote_os_path(&self.directory.join(name))
            )
        })
    }

    pub fn write(&self, name: &str, bytes: &[u8], allow_replace: bool) -> Result<()> {
        validate_owned_auth_name(name)?;
        anyhow::ensure!(
            bytes.len() as u64 <= XAI_OAUTH_FILE_LIMIT,
            "refusing oversized xAI OAuth credential payload"
        );
        self.write_owned_file(name, bytes, allow_replace)
    }

    pub fn remove(&self, name: &str) -> Result<bool> {
        validate_owned_auth_name(name)?;
        self.remove_raw(name)
    }

    pub fn clear_all(&self) -> Result<usize> {
        let mut removed = 0;
        for name in self.owned_auth_names()? {
            if self.remove(&name)? {
                removed += 1;
            }
        }

View on GitHub (pinned to 8880682c63)

Solutions

1. Shrink the payload: persist only the required token fields, not embedded certificates or the full response envelope
2. Check for double-encoding bugs such as applying serde_json::to_string twice
3. If a legitimate OAuth payload must exceed 1 MiB, file an issue; XAI_OAUTH_FILE_LIMIT is the single knob

Example fix

// before: storing the entire discovery document alongside the token
store.write("token.json", &serde_json::to_vec(&full_discovery_and_token)?)?;

// after: persist only the token response
store.write("token.json", &serde_json::to_vec(&token_response)?)?;

// Mirror the store's limit before writing:
const XAI_OAUTH_FILE_LIMIT: u64 = 1024 * 1024;
fn oauth_payload_fits(bytes: &[u8]) -> bool {
    bytes.len() as u64 <= XAI_OAUTH_FILE_LIMIT
}

On Err, shrink the payload (drop embedded certs or envelopes) and retry once; do not chunk or split the file, since the store expects one coherent document per name.

When it happens

Trigger: Writing an OAuth document whose byte length exceeds 1,048,576: a token response embedding large JWK sets or certificates, a bug double-encoding JSON inside JSON, or a caller trying to store unrelated data through this API.

Common situations: Custom enterprise OAuth servers with very large id_token or claim sets; accidental serialization of the whole credential store into a single entry; tooling using the OAuth directory as scratch storage.

Related errors

• xAI OAuth lifecycle lock was poisoned
• Codewhale-owned xAI OAuth file {} is not valid UTF-8
• xAI OAuth credentials not found. Options: 1. Run `codewhale
• ${name} is unavailable in Workflow scripts: runs must be det
• new Date()/Date() is unavailable in Workflow scripts: runs m

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/58805af9f2394bf9. Report an issue: GitHub.