affaan-m/ECC · error · Error

Refusing to trust non-managed ownership from install-state a

Error message

Refusing to trust non-managed ownership from install-state at ${plan.installStatePath}.

What it means

Thrown while iterating state.operations in readOwnedDestinations when an operation's ownership field is not the string 'managed'. ECC only trusts install-state entries it itself marked as managed (i.e., files ECC created and controls); unmanaged/preserved entries represent user-owned or externally-owned files and cannot grant ECC permission to overwrite them. Any non-managed entry in a state we are about to trust is treated as corruption or tampering.

Source

Thrown at scripts/lib/multi-harness-setup.js:157

  const state = readState(plan.installStatePath);
  const validatedFingerprint = fingerprintFile(plan.installStatePath);
  if (
    initialFingerprint.exists !== validatedFingerprint.exists
    || initialFingerprint.sha256 !== validatedFingerprint.sha256
  ) {
    throw new Error(
      `Refusing to trust install-state that changed during validation: ${plan.installStatePath}.`
    );
  }
  assertPriorInstallStateMatchesPlan(state, plan);
  const plannedByDestination = new Map(plan.operations.map(operation => [
    canonicalPath(operation.destinationPath),
    operation,
  ]));
  const destinations = new Set();
  for (const operation of state.operations || []) {
    if (operation.ownership !== 'managed') {
      throw new Error(
        `Refusing to trust non-managed ownership from install-state at ${plan.installStatePath}.`
      );
    }
    const destinationPath = operation.destinationPath;
    assertWithinTrustedRoot(destinationPath, plan.targetRoot, 'trust install-state ownership');
    const canonicalDestination = canonicalPath(destinationPath);
    const plannedOperation = plannedByDestination.get(canonicalDestination);
    if (!plannedOperation) continue;
    if (!operationIdentityMatches(operation, plannedOperation)) {
      throw new Error(
        `Refusing unverified ownership from install-state at ${plan.installStatePath}: `
        + `operation identity does not match the current plan for ${destinationPath}.`
      );
    }
    const currentFingerprint = fingerprintFile(destinationPath);
    if (
      !currentFingerprint.exists
      || !/^[a-f0-9]{64}$/i.test(operation.contentSha256 || '')

View on GitHub (pinned to 01e15490f0)

Solutions

  1. Delete plan.installStatePath and re-run the preview so all operations are recorded as managed by the current ECC.
  2. If you edited the state intentionally, stop — ownership is an internal contract; restore from ECC's own writes.
  3. Audit how the state acquired a non-managed value (diff against a known-good state from a fresh preview).
  4. Confirm you are not running two ECC variants with different ownership schemas against the same state.

Example fix

// before: state contains { destinationPath:'/x', ownership:'user' }
for (const op of state.operations) { /* throws [286] on first non-managed */ }

// after: regenerate state so every op is ownership:'managed'
fs.rmSync(plan.installStatePath, { force: true });
const plan2 = await createMultiHarnessPlan(req);
await applyMultiHarnessPlan(plan2);
Defensive patterns

Strategy: validation

Validate before calling

const fs = require('fs');
function assertAllOperationsManaged(statePath) {
  if (!fs.existsSync(statePath)) return;
  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
  const bad = (state.operations || []).filter(op => op.ownership !== 'managed');
  if (bad.length) {
    throw new Error(`Install-state has ${bad.length} non-managed operation(s); delete the state and re-install.`);
  }
}
assertAllOperationsManaged(plan.installStatePath);

Type guard

function stateOperationsAllManaged(state) {
  return Array.isArray(state && state.operations)
    && state.operations.every(op => op && op.ownership === 'managed');
}

Try / catch

try {
  await applyMultiHarnessPlan(plan);
} catch (err) {
  if (/non-managed ownership/.test(err.message)) {
    fs.rmSync(plan.installStatePath, { force: true });
    const fresh = await createMultiHarnessPlan(plan.request);
    await applyMultiHarnessPlan(fresh);
  } else throw err;
}

Prevention

When it happens

Trigger: Fires inside the for-loop over state.operations when operation.ownership !== 'managed'. Occurs if the install-state was hand-edited to change ownership values, if an older/different ECC variant wrote entries with a different ownership vocabulary, or if the JSON schema drifted (e.g., ownership renamed or set to 'user'/'external').

Common situations: Manual edits to install-state.json that changed ownership; a state file produced by a fork or older schema; partial merge of two state files; downstream tooling that 'normalizes' JSON and rewrote ownership values.

Related errors

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/8302a1e8967c532e. Report an issue: GitHub.