affaan-m/ECC · error · Error

Refusing to trust managed install-state at ${plan.installSta

Error message

Refusing to trust managed install-state at ${plan.installStatePath}: recorded install-state path does not match the current install-state path.

What it means

Thrown by assertPriorInstallStateMatchesPlan when the install-state's recorded target.installStatePath (canonicalized) does not equal the current plan.installStatePath. This is a self-referential integrity check: the state file must point to itself at the exact path ECC is reading it from. A mismatch implies the state was moved/renamed or two state files are cross-referencing, so its ownership claims are not trustworthy.

Source

Thrown at scripts/lib/multi-harness-setup.js:118

  const adapter = plan.adapter || {};
  if (
    target.id !== adapter.id
    || target.target !== adapter.target
    || target.kind !== adapter.kind
  ) {
    throw new Error(
      `Refusing to trust managed install-state at ${plan.installStatePath}: `
      + 'target identity does not match the current Kimi install plan.'
    );
  }
  if (!pathsMatch(target.root, plan.targetRoot)) {
    throw new Error(
      `Refusing to trust managed install-state at ${plan.installStatePath}: `
      + 'recorded root does not match the current install root.'
    );
  }
  if (!pathsMatch(target.installStatePath, plan.installStatePath)) {
    throw new Error(
      `Refusing to trust managed install-state at ${plan.installStatePath}: `
      + 'recorded install-state path does not match the current install-state path.'
    );
  }
}

function readOwnedDestinations(plan, dependencies) {
  if (!plan.installStatePath) {
    return { destinations: new Set(), stateFingerprint: { exists: false, sha256: null } };
  }
  try {
    assertSafeInstallOperation(plan, { destinationPath: plan.installStatePath });
  } catch (error) {
    throw new Error(`Refusing to trust managed install-state path: ${error.message}`);
  }
  if (!fs.existsSync(plan.installStatePath)) {
    return { destinations: new Set(), stateFingerprint: { exists: false, sha256: null } };
  }

View on GitHub (pinned to 01e15490f0)

Solutions

  1. Remove the install-state at plan.installStatePath and re-run the preview so the self-reference is written for the current path.
  2. If you pass custom homeDir/projectRoot to createManagedPlan, keep them identical between preview and apply.
  3. Never copy install-state files between projects; let ECC generate them.
  4. Confirm plan.installStatePath matches the file you actually want to trust.

Example fix

// before: state copied from another project, self-reference points elsewhere
// state.target.installStatePath = '/other/project/.claude/install-state.json'
// plan.installStatePath        = '/this/project/.claude/install-state.json'
await applyMultiHarnessPlan(plan); // throws [283]

// after: regenerate state in place
fs.rmSync(plan.installStatePath, { force: true });
const plan2 = await createMultiHarnessPlan(req);
await applyMultiHarnessPlan(plan2);
Defensive patterns

Strategy: validation

Validate before calling

const fs = require('fs'); const path = require('path');
function assertStateSelfReferenceMatches(statePath) {
  if (!fs.existsSync(statePath)) return;
  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
  const recorded = path.resolve(state.target && state.target.installStatePath || '');
  if (recorded !== path.resolve(statePath)) {
    throw new Error(`Install-state self-reference ${recorded} != ${statePath}; regenerate the state in place.`);
  }
}
assertStateSelfReferenceMatches(plan.installStatePath);

Type guard

null

Try / catch

try {
  await applyMultiHarnessPlan(plan);
} catch (err) {
  if (/recorded install-state path does not match/.test(err.message)) {
    fs.rmSync(plan.installStatePath, { force: true });
    const fresh = await createMultiHarnessPlan(plan.request);
    await applyMultiHarnessPlan(fresh);
  } else throw err;
}

Prevention

When it happens

Trigger: Fires when pathsMatch(target.installStatePath, plan.installStatePath) is false. Occurs if the install-state file was relocated (renamed, moved into a different .claude subdir), if plan.installStatePath is computed from a different home/project layout than when the state was written, or if a state file was copied from another project without updating its self-reference.

Common situations: Renaming the project's .claude directory or moving the state file; a custom homeDir/projectRoot passed to createManagedPlan that yields a different installStatePath than the original run; copying another project's install-state as a template; ECC version change that altered the installStatePath layout.

Related errors

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/40ffd609a3392aba. Report an issue: GitHub.