{"record":{"id":"2940df9ff2adcb9c","repo":"Hmbown/CodeWhale","slug":"managed-external-credential-access-is-unsupported","errorCode":null,"errorMessage":"managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage.","messagePattern":"managed external credential access is unsupported in v0\\.9\\.1: no provider has a reviewed schema-safe preservation adapter\\. Use --mode read-only, or use Codewhale-owned login/API-key storage\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/lib.rs","lineNumber":3741,"sourceCode":"                0\n            } else {\n                1\n            })\n        }\n        AuthCommand::ExternalConsent {\n            provider,\n            mode,\n            path,\n            yes,\n        } => {\n            let provider: ProviderKind = provider.into();\n            let (source, path) = external_credential_target(provider, path)?;\n            let preview = external_consent_preview_lines(provider, source, &path);\n            for line in &preview {\n                println!(\"{line}\");\n            }\n            if mode == ExternalCredentialModeArg::Managed {\n                bail!(\n                    \"managed external credential access is unsupported in v0.9.1: no provider has a reviewed schema-safe preservation adapter. Use --mode read-only, or use Codewhale-owned login/API-key storage.\"\n                );\n            }\n            confirm_external_consent(yes)?;\n            let path_value = path.to_str().context(\n                \"external credential path cannot be persisted losslessly because it is not valid UTF-8\",\n            )?;\n            let provider_key = provider.provider().provider_config_key();\n            codewhale_config::mutate_config_document(store.path(), |document| {\n                if matches!(provider, ProviderKind::OpenaiCodex | ProviderKind::Xai) {\n                    codewhale_config::set_config_document_value(\n                        document,\n                        &[\"providers\", provider_key, \"auth_mode\"],\n                        \"oauth\",\n                    )?;\n                }\n                let prefix = &[\"providers\", provider_key, \"external_credentials\"];\n                codewhale_config::set_config_document_value(","sourceCodeStart":3723,"sourceCodeEnd":3759,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/cli/src/lib.rs#L3723-L3759","documentation":"The external-credentials command supports a `--mode` argument, and `managed` mode is intentionally unshipped in v0.9.1: no provider has a reviewed schema-safe adapter that could preserve external credential files while managing them. After printing the consent preview, Codewhale refuses to continue in managed mode and tells you the two supported alternatives: `--mode read-only` or Codewhale-owned login/API-key storage.","triggerScenarios":"Explicitly passing `--mode managed` to the external-credentials command for any provider; UIs or scripts written against a planned managed-mode contract.","commonSituations":"Users expecting Codewhale to maintain/refresh external CLI credentials (rotate, keep schemas in sync) rather than just read them; documentation or muscle memory from a tool where managed credential takeover exists.","solutions":["Re-run with `--mode read-only` for read-only access to the external credential file","Prefer Codewhale-owned storage: `codewhale auth login` or API-key config so Codewhale manages credentials natively","Watch release notes — managed mode requires a reviewed preservation adapter per provider before it ships"],"exampleFix":"# before\n$ codewhale external-credentials --provider grok --mode managed\n# managed external credential access is unsupported in v0.9.1...\n\n# after\n$ codewhale external-credentials --provider grok --mode read-only --yes","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nmode=\"read-only\"   # never request 'managed' on v0.9.x\ncodewhale external-credentials --provider grok --mode \"$mode\" --yes","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat external credential access as read-only until a release notes says managed mode shipped","Prefer `codewhale auth login` / API-key storage when you need Codewhale to own credential lifecycle"],"tags":["credentials","managed-mode","read-only","version-limitation","v0-9-1"],"backgroundTag":"unsupported-operation","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}