{"record":{"id":"3783dc3611fc11f3","repo":"Hmbown/CodeWhale","slug":"codewhale-credentials-directory-cannot-be-a-volume","errorCode":null,"errorMessage":"Codewhale credentials directory cannot be a volume root","messagePattern":"Codewhale credentials directory cannot be a volume root","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/config/src/xai_credentials.rs","lineNumber":967,"sourceCode":"                    .read(true)\n                    .share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE)\n                    .custom_flags(FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT);\n                let handle = options.open(&current).with_context(|| {\n                    format!(\n                        \"opening Codewhale credentials directory component {}\",\n                        crate::quote_os_path(&current)\n                    )\n                })?;\n                validate_windows_handle_path(&handle, &current, true)?;\n                handles.push(handle);\n            }\n            Component::CurDir | Component::ParentDir => bail!(\n                \"Codewhale credentials directory must be lexically normalized: {}\",\n                crate::quote_os_path(directory)\n            ),\n        }\n    }\n    anyhow::ensure!(\n        !handles.is_empty(),\n        \"Codewhale credentials directory cannot be a volume root\"\n    );\n    let mut secure_options = fs::OpenOptions::new();\n    secure_options\n        .access_mode(FILE_GENERIC_READ | WRITE_DAC | WRITE_OWNER)\n        .share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE)\n        .custom_flags(FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT);\n    let final_directory = secure_options.open(directory).with_context(|| {\n        format!(\n            \"opening Codewhale credentials directory for owner-only security: {}\",\n            crate::quote_os_path(directory)\n        )\n    })?;\n    validate_windows_handle_path(&final_directory, directory, true)?;\n    secure_windows_owner_only_handle(&final_directory, true)\n        .context(\"securing Codewhale credentials directory for the current user\")?;\n    verify_windows_owner_only_handle(&final_directory)","sourceCodeStart":949,"sourceCodeEnd":985,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/config/src/xai_credentials.rs#L949-L985","documentation":"When walking the directory's components to open an owned handle per component, the handle list must be non-empty; an empty list means the path was a volume root (e.g. `C:\\` or `/`), which has no per-component handle to secure. Using a volume root as the credential store would give the ownership/DACL guarantees nothing to scope to, so it is refused.","triggerScenarios":"Calling open with the path reduced to a root component — `Path::new(\"/\")`, `Path::new(\"C:\\\\\")`, or a UNC share root like `\\\\server\\share` — after lexical normalization strips CurDir/ParentDir components.","commonSituations":"A config file or env var set to a drive root or `/`; a path-joining bug that dropped all subdirectories; accidentally passing `home_dir()` that resolved to `/` in a container.","solutions":["Point the store at a real subdirectory (e.g. `/home/user/.codewhale/xai`, not `/` or `C:\\` )","Fix the config/env value or the join logic that produced a bare root path","Create the intended credentials subdirectory before opening the store"],"exampleFix":"// before\nlet dir = PathBuf::from(\"C:\\\\\");\n// after\nlet dir = PathBuf::from(\"C:\\\\Users\\\\me\\\\.codewhale\\\\xai\");","handlingStrategy":"validation","validationCode":"fn ensure_not_volume_root(dir: &std::path::Path) -> Result<(), String> {\n    let mut comps = dir.components();\n    if comps.next().is_some() && comps.next().is_none() {\n        return Err(format!(\"{} is a volume root; use a subdirectory\", dir.display()));\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"ensure_not_volume_root(&dir)?;\nstd::fs::create_dir_all(&dir)?;\nlet store = XaiCredentialStore::open(&dir)?;","preventionTips":["Point the store at a dedicated subdirectory like ~/.codewhale/xai, never `/` or `C:\\`","create_dir_all the target before opening the store","Validate configured paths at config-load time"],"tags":["config","filesystem","path"],"backgroundTag":"invalid-argument-value","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}