{"record":{"id":"ed47791cce6f5db8","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-xai-oauth-file-exceeds-the-b","errorCode":null,"errorMessage":"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit","messagePattern":"Codewhale-owned xAI OAuth file (.+?) exceeds the (.+?) byte limit","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/config/src/xai_credentials.rs","lineNumber":193,"sourceCode":"\n    #[must_use]\n    pub fn directory(&self) -> &Path {\n        &self.directory\n    }\n\n    pub fn path_for(&self, name: &str) -> Result<PathBuf> {\n        validate_owned_auth_name(name)?;\n        Ok(self.directory.join(name))\n    }\n\n    pub fn read_to_string(&self, name: &str) -> Result<Option<String>> {\n        validate_owned_auth_name(name)?;\n        let Some(mut file) = self.open_owned_file_for_read(name)? else {\n            return Ok(None);\n        };\n        let metadata = validate_owned_file_handle(&file, &self.directory.join(name))?;\n        if metadata.len() > XAI_OAUTH_FILE_LIMIT {\n            bail!(\n                \"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit\",\n                crate::quote_os_path(&self.directory.join(name)),\n                XAI_OAUTH_FILE_LIMIT\n            );\n        }\n        let mut bytes = Vec::with_capacity(metadata.len() as usize);\n        (&mut file)\n            .take(XAI_OAUTH_FILE_LIMIT + 1)\n            .read_to_end(&mut bytes)\n            .with_context(|| {\n                format!(\n                    \"reading Codewhale-owned xAI OAuth file {}\",\n                    crate::quote_os_path(&self.directory.join(name))\n                )\n            })?;\n        if bytes.len() as u64 > XAI_OAUTH_FILE_LIMIT {\n            bail!(\n                \"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit\",","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/config/src/xai_credentials.rs#L175-L211","documentation":"Thrown when reading a Codewhale-owned xAI OAuth file whose on-disk size (from metadata on the opened handle) exceeds XAI_OAUTH_FILE_LIMIT, which is 1 MiB (1024*1024 bytes). A real OAuth token JSON is a few kilobytes, so an oversized file means the wrong file was placed in the credentials directory; the size cap bounds memory and parse exposure.","triggerScenarios":"read_to_string on a credentials file larger than 1 MiB: someone dropped a certificate bundle, concatenated JSON, an editor backup, or a log/JWT-dump file into ~/.codewhale/credentials and named it xai-auth-*.json.","commonSituations":"Manual recovery attempts that redirected output into the credentials file; sync/copy mistakes bringing in a large lookalike; test fixtures with embedded token plus extra payload.","solutions":["Delete or move the oversized file out of the credentials directory: ls -l ~/.codewhale/credentials to spot it by size","Re-authenticate through the codewhale xAI OAuth flow so a fresh, correctly sized generation file is written","If you manage credentials with tooling, validate size (< 1 MiB) and shape before installing files"],"exampleFix":"# before\n~/.codewhale/credentials/xai-auth-<...>.json   # 47 MB (wrong file restored from backup)\n\n# after\nrm ~/.codewhale/credentials/xai-auth-<...>.json\ncodewhale login   # re-run the xAI OAuth flow","handlingStrategy":"validation","validationCode":"const XAI_OAUTH_FILE_LIMIT: u64 = 1024 * 1024;\n\nlet meta = std::fs::metadata(&path)?;\nanyhow::ensure!(\n    meta.len() <= XAI_OAUTH_FILE_LIMIT,\n    \"credential file too large ({} bytes); expected a small OAuth JSON\",\n    meta.len()\n);","typeGuard":null,"tryCatchPattern":"match store.read_to_string(&name) {\n    Ok(contents) => contents,\n    Err(err) if err.to_string().contains(\"exceeds the\") => {\n        // wrong file installed; remove it and force re-login\n        std::fs::remove_file(store.path_for(&name)?)?;\n        anyhow::bail!(\"credential file was oversized and has been removed; re-run login\");\n    }\n    Err(err) => return Err(err),\n}","preventionTips":["Sanity-check credential file sizes in provisioning scripts (< 1 MiB, really < 10 KB for OAuth JSON)","Never restore credentials from unverified backups by copy-without-check"],"tags":["rust","oauth","credentials","file-size","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}