{"record":{"id":"043f6c1ceee75efc","repo":"xai-org/grok-build","slug":"failed-to-save-external-auth-credentials-e","errorCode":null,"errorMessage":"failed to save external auth credentials: {e}","messagePattern":"failed to save external auth credentials: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/flow.rs","lineNumber":260,"sourceCode":"    if let Some(task) = stderr_task {\n        let _ = task.await;\n    }\n    let mut auth = parse_output(&output)\n        .map_err(|e| anyhow::anyhow!(\"external auth provider `{command}`: {e}\"))?;\n    let principal_policy =\n        crate::auth::oidc::login_principal_policy(auth_manager.grok_com_config());\n    crate::auth::oidc::enforce_login_principal(\n        principal_policy.as_ref(),\n        crate::auth::oidc::peek_access_token_principal_id(&auth.key).as_deref(),\n    )?;\n    match (over_stale_credential, auth_manager.current_or_expired()) {\n        (true, Some(prev)) => auth.carry_user_profile_from(&prev),\n        _ => auth_manager.enrich_auth_inline(&mut auth).await,\n    }\n    let auth = auth_manager\n        .update(auth)\n        .await\n        .map_err(|e| anyhow::anyhow!(\"failed to save external auth credentials: {e}\"))?;\n    tracing::info!(\n        user_id = %auth.user_id,\n        email = ?auth.email,\n        \"auth: external provider login complete\"\n    );\n    Ok((auth, true))\n}\n/// GUI auth: bridges external provider stderr to `url_tx`, pipes code submission via `code_rx`.\npub(crate) async fn run_auth_flow_with_stderr_bridge(\n    auth_manager: &Arc<AuthManager>,\n    grok_com_config: &GrokComConfig,\n    channels: AuthChannels,\n    reauth: bool,\n    force_interactive: bool,\n    login_override: LoginTransportOverride,\n) -> anyhow::Result<(GrokAuth, bool)> {\n    let url_tx = Rc::new(RefCell::new(channels.url_tx));\n    let stderr_lines: Rc<RefCell<Vec<String>>> = Rc::new(RefCell::new(Vec::new()));","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/flow.rs#L242-L278","documentation":"After a successful external provider run and inline enrichment, auth_manager.update(auth) persists the new credentials to the auth store. If persistence fails (file write, keyring, or storage backend error), the freshly obtained credentials cannot be saved and this error aborts the login. The user authenticated but the session was not stored.","triggerScenarios":"update() returns Err during any external-provider login because the auth store is unwritable: bad permissions on the grok home directory, disk full, keyring/secret-service unavailable, or a corrupted existing auth store.","commonSituations":"Read-only home or NFS mount in CI containers; full disk; headless Linux without a keyring/secret service; corrupted ~/.grok auth file from a previous crash; SELinux/AppArmor denying writes.","solutions":["Check writability of the grok home directory (`ls -ld`, try touching a file) and fix permissions/ownership.","Free disk space if the filesystem is full.","On headless Linux, install/unlock a secret service (gnome-keyring) or configure a file-based auth store.","Back up and remove a corrupted auth store file so update() can recreate it, then log in again."],"exampleFix":"// before\nchmod 555 ~/.grok   # store not writable\n// after\nchmod 700 ~/.grok && chown -R $USER ~/.grok","handlingStrategy":"try-catch","validationCode":"const home = process.env.GROK_HOME || '~/.grok';\nfs.accessSync(home, fs.constants.W_OK); // throws early if store dir is unwritable","typeGuard":null,"tryCatchPattern":"match run_auth_flow(...).await {\n    Err(e) if e.to_string().contains(\"failed to save external auth credentials\") => {\n        eprintln!(\"Login succeeded but saving failed — check disk space, ~/.grok permissions, keyring\");\n    }\n    other => other?,\n}","preventionTips":["Keep the grok home directory writable (700, owned by the user)","Ensure a keyring/secret service is installed on headless Linux","Monitor disk space in CI images","Recreate a corrupted auth store file promptly"],"tags":["auth","persistence","filesystem","credentials"],"backgroundTag":"credentials-save-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}