{"record":{"id":"0e84ef092632531a","repo":"Hmbown/CodeWhale","slug":"xai-oauth-path-contains-invalid-unicode-and-can","errorCode":null,"errorMessage":"xAI OAuth path {} contains invalid Unicode and cannot be compared safely","messagePattern":"xAI OAuth path (.+?) contains invalid Unicode and cannot be compared safely","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/config/src/xai_credentials.rs","lineNumber":1250,"sourceCode":"        GetFinalPathNameByHandleW(handle, buffer.as_mut_ptr(), buffer.len() as u32, flags)\n    };\n    if written == 0 || written as usize >= buffer.len() {\n        return Err(std::io::Error::last_os_error())\n            .context(\"resolving Codewhale-owned xAI OAuth handle path\");\n    }\n    let actual = OsString::from_wide(&buffer[..written as usize]);\n    anyhow::ensure!(\n        normalize_windows_path_for_comparison(Path::new(&actual))?\n            == normalize_windows_path_for_comparison(expected)?,\n        \"Codewhale-owned xAI OAuth path was redirected while opening\"\n    );\n    Ok(metadata)\n}\n\n#[cfg(windows)]\nfn normalize_windows_path_for_comparison(path: &Path) -> Result<String> {\n    let text = path.to_str().ok_or_else(|| {\n        anyhow::anyhow!(\n            \"xAI OAuth path {} contains invalid Unicode and cannot be compared safely\",\n            crate::quote_os_path(path)\n        )\n    })?;\n    let without_device_prefix = text.strip_prefix(r\"\\\\?\\\").unwrap_or(text);\n    let normalized_prefix = without_device_prefix.strip_prefix(\"UNC\\\\\").map_or_else(\n        || without_device_prefix.to_string(),\n        |rest| format!(r\"\\\\{rest}\"),\n    );\n    Ok(normalized_prefix\n        .replace('/', \"\\\\\")\n        .trim_end_matches('\\\\')\n        .to_lowercase())\n}\n\n#[cfg(windows)]\nfn secure_windows_owner_only_handle(file: &File, inherit_to_children: bool) -> Result<()> {\n    use std::os::windows::io::AsRawHandle as _;","sourceCodeStart":1232,"sourceCodeEnd":1268,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/config/src/xai_credentials.rs#L1232-L1268","documentation":"normalize_windows_path_for_comparison converts both the resolved and expected paths to &str; if either contains unpaired surrogates (invalid UTF-16 as Unicode scalar values) the comparison is impossible and the open fails closed rather than skipping the identity check. Normal Windows APIs refuse to create such names, so this is near-unreachable in practice.","triggerScenarios":"A path component created with unpaired-surrogate characters by low-level/raw NTFS tooling; filesystem corruption producing invalid UTF-16 names.","commonSituations":"Exotic tools writing raw name streams; effectively never seen in normal usage.","solutions":["Rename the offending component (or CODEWHALE_HOME) to valid Unicode","Recreate $CODEWHALE_HOME under an ASCII-safe path and re-authenticate"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if let Err(e) = codewhale_config::with_xai_oauth_lifecycle_lock(&op) {\n    if e.to_string().contains(\"invalid Unicode\") {\n        // cannot compare this path; fall back to a clean ASCII home\n        std::env::set_var(\"CODEWHALE_HOME\", fallback_home.display().to_string());\n        return codewhale_config::with_xai_oauth_lifecycle_lock(&op);\n    }\n    return Err(e);\n}","preventionTips":["Keep CODEWHALE_HOME components ASCII-safe and valid Unicode","Do not create home paths with raw NTFS/low-level tools","If a path triggers this, rename the component or relocate CODEWHALE_HOME"],"tags":["windows","unicode","filesystem","xai-oauth"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}