{"record":{"id":"aaeee4aee7c3dfdf","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-xai-oauth-path-escaped-the-credent","errorCode":null,"errorMessage":"Codewhale-owned xAI OAuth path escaped the credentials directory","messagePattern":"Codewhale-owned xAI OAuth path escaped the credentials directory","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":410,"sourceCode":"        )\n    })?;\n    if !entry_access_token_is_fresh(&entry) {\n        bail!(\n            \"xAI OAuth access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `grok login` again or use `codewhale auth xai-device`.\",\n            codewhale_config::quote_os_path(grant.path())\n        );\n    }\n    let token = entry\n        .key\n        .clone()\n        .filter(|token| !token.trim().is_empty())\n        .context(\"xAI OAuth access token is empty\")?;\n    Ok(credentials_from_entry(scope, &entry, token))\n}\n\nfn get_owned_credentials(path: &Path) -> Result<XaiOAuthCredentials> {\n    let directory = codewhale_config::xai_oauth_credentials_dir()?;\n    anyhow::ensure!(\n        path.parent() == Some(directory.as_path()),\n        \"Codewhale-owned xAI OAuth path escaped the credentials directory\"\n    );\n    let name = path\n        .file_name()\n        .and_then(|name| name.to_str())\n        .context(\"Codewhale-owned xAI OAuth path must have a UTF-8 basename\")?;\n    anyhow::ensure!(\n        name == codewhale_config::LEGACY_XAI_OAUTH_FILE_NAME\n            || codewhale_config::is_valid_xai_oauth_generation(name),\n        \"Codewhale-owned xAI OAuth path has an invalid basename\"\n    );\n    codewhale_config::with_xai_oauth_lifecycle_lock(|store| {\n        get_owned_credentials_locked(store, name, refresh_access_token)\n    })\n}\n\nfn get_owned_credentials_locked<F>(","sourceCodeStart":392,"sourceCodeEnd":428,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L392-L428","documentation":"Path-safety guard in get_owned_credentials: the configured Codewhale-owned xAI OAuth file path's parent directory does not match the canonical xai_oauth_credentials_dir, meaning the path escapes the dedicated credentials directory. This prevents reading or rewriting OAuth tokens outside the secured storage location.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:410 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reset the xAI OAuth credential path configuration so it points inside the default credentials directory.","Run `codewhale auth xai-device` to regenerate credentials at the canonical location.","Inspect config overrides or symlinks that may have redirected the credential path."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}