{"record":{"id":"00ba8f5055942b19","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-xai-oauth-path-has-an-invalid-base","errorCode":null,"errorMessage":"Codewhale-owned xAI OAuth path has an invalid basename","messagePattern":"Codewhale-owned xAI OAuth path has an invalid basename","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":418,"sourceCode":"    let token = entry\n        .key\n        .clone()\n        .filter(|token| !token.trim().is_empty())\n        .context(\"xAI OAuth access token is empty\")?;\n    Ok(credentials_from_entry(scope, &entry, token))\n}\n\nfn get_owned_credentials(path: &Path) -> Result<XaiOAuthCredentials> {\n    let directory = codewhale_config::xai_oauth_credentials_dir()?;\n    anyhow::ensure!(\n        path.parent() == Some(directory.as_path()),\n        \"Codewhale-owned xAI OAuth path escaped the credentials directory\"\n    );\n    let name = path\n        .file_name()\n        .and_then(|name| name.to_str())\n        .context(\"Codewhale-owned xAI OAuth path must have a UTF-8 basename\")?;\n    anyhow::ensure!(\n        name == codewhale_config::LEGACY_XAI_OAUTH_FILE_NAME\n            || codewhale_config::is_valid_xai_oauth_generation(name),\n        \"Codewhale-owned xAI OAuth path has an invalid basename\"\n    );\n    codewhale_config::with_xai_oauth_lifecycle_lock(|store| {\n        get_owned_credentials_locked(store, name, refresh_access_token)\n    })\n}\n\nfn get_owned_credentials_locked<F>(\n    store: &codewhale_config::XaiOAuthCredentialStore,\n    name: &str,\n    refresh_access: F,\n) -> Result<XaiOAuthCredentials>\nwhere\n    F: FnOnce(&str, &str, &str) -> Result<TokenResponse>,\n{\n    let path = store.path_for(name)?;","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L400-L436","documentation":"Basename validation guard in get_owned_credentials: the file name component of the Codewhale-owned xAI OAuth credential path does not match the expected credential-file naming pattern (validated by is_valid_xai_oauth_generation). This blocks reading arbitrary files from the credentials directory under an OAuth pretext.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:418 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use only credential file names produced by `codewhale auth xai-device`, matching the valid generation naming scheme.","Remove or rename the malformed file in the xAI OAuth credentials directory.","Re-run `codewhale auth xai-device` to generate a correctly named credential file."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}