{"record":{"id":"296e9035d74cea09","repo":"Hmbown/CodeWhale","slug":"external-credential-file-exceeds-the-byte","errorCode":null,"errorMessage":"external {} credential file {} exceeds the {} byte safety limit","messagePattern":"external (.+?) credential file (.+?) exceeds the (.+?) byte safety limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/external_credentials.rs","lineNumber":80,"sourceCode":"        }\n    };\n\n    #[cfg(test)]\n    increment_side_effect(1);\n\n    let mut bytes = Vec::new();\n    file.by_ref()\n        .take(MAX_EXTERNAL_CREDENTIAL_BYTES + 1)\n        .read_to_end(&mut bytes)\n        .with_context(|| {\n            format!(\n                \"reading external {} credential file {}\",\n                grant.source().as_str(),\n                codewhale_config::quote_os_path(grant.path())\n            )\n        })?;\n    if bytes.len() as u64 > MAX_EXTERNAL_CREDENTIAL_BYTES {\n        bail!(\n            \"external {} credential file {} exceeds the {} byte safety limit\",\n            grant.source().as_str(),\n            codewhale_config::quote_os_path(grant.path()),\n            MAX_EXTERNAL_CREDENTIAL_BYTES\n        );\n    }\n    let contents = String::from_utf8(bytes).with_context(|| {\n        format!(\n            \"external {} credential file {} is not valid UTF-8\",\n            grant.source().as_str(),\n            codewhale_config::quote_os_path(grant.path())\n        )\n    })?;\n    Ok(Some(contents))\n}\n\n/// Read one Codewhale-owned credential file through the same no-follow,\n/// bounded I/O boundary used for external grants. On Unix the opened handle","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/external_credentials.rs#L62-L98","documentation":"read_to_string enforces MAX_EXTERNAL_CREDENTIAL_BYTES on every externally-granted credential file before it is accepted. The file is read with a take() bounded one byte past the limit; if that many bytes were read, the file is oversized and the read fails closed rather than loading an unbounded secret file into memory.","triggerScenarios":"Calling `deepseek_api_key_from_grant` (or any reader over ExternalCredentialReadGrant) where the granted file at grant.path() is larger than MAX_EXTERNAL_CREDENTIAL_BYTES after secure open.","commonSituations":"The credentials file accumulated backups or appended entries; the granted path accidentally points at a large log/data file instead of the YAML credentials; a provisioning tool wrote junk (e.g. concatenated key material) into the credentials file.","solutions":["Check the file size at the path in the message; credentials files should be tiny YAML mappings.","Remove accidental content (backups, appended blobs) from the credentials file so it holds only `KEY: value` lines.","Point the grant/dsh home at the real credentials file, not a larger adjacent file.","If a legitimately larger credential store is needed, that is unsupported — keep only the needed key in `$DSH_HOME/.credentials.yaml`."],"exampleFix":"// before: .credentials.yaml is 2 MB (append-only log of keys)\n// after: single small mapping\nDEEPSEEK_API_KEY: \"sk-...\"\n$ wc -c ~/.dsh/.credentials.yaml  # must be <= MAX_EXTERNAL_CREDENTIAL_BYTES","handlingStrategy":"validation","validationCode":"// Check size before requesting the grant read\nlet meta = std::fs::metadata(grant.path())?;\nif meta.len() > codewhale::tui::external_credentials::MAX_EXTERNAL_CREDENTIAL_BYTES {\n    panic!(\"credential file too large: {}\", grant.path().display());\n}","typeGuard":null,"tryCatchPattern":"match read_to_string(&grant) {\n    Ok(Some(text)) => parse(text),\n    Ok(None) => println!(\"credentials file absent\"),\n    Err(e) if e.to_string().contains(\"exceeds\") => eprintln!(\"oversized credential file — inspect and trim it\"),\n    Err(e) => return Err(e),\n}","preventionTips":["Keep `$DSH_HOME/.credentials.yaml` a tiny KEY: value mapping; never append to it.","Point grants at the exact credentials file, not directories or logs.","Monitor credential-file size in provisioning checks."],"tags":["credentials","file-size","security","fail-closed"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}