{"record":{"id":"100e6f528fb0e708","repo":"stablyai/orca","slug":"verify-packaged-plugin-resources-manifest-identi","errorCode":null,"errorMessage":"[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}","messagePattern":"\\[verify-packaged-plugin-resources\\] manifest identity does not match (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-packaged-plugin-resources.cjs","lineNumber":96,"sourceCode":"    throw new Error('[verify-packaged-plugin-resources] bundled plugin index is empty or invalid')\n  }\n  const resolvedRoot = resolve(launchRoot)\n  for (const entry of index.plugins) {\n    if (\n      typeof entry?.pluginKey !== 'string' ||\n      typeof entry.path !== 'string' ||\n      !/^[0-9a-f]{64}$/.test(entry.contentHash)\n    ) {\n      throw new Error('[verify-packaged-plugin-resources] bundled plugin entry is invalid')\n    }\n    const pluginRoot = resolve(launchRoot, entry.path)\n    const fromRoot = relative(resolvedRoot, pluginRoot)\n    if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {\n      throw new Error('[verify-packaged-plugin-resources] bundled plugin path escapes launch root')\n    }\n    const manifest = readJsonFile(join(pluginRoot, 'orca-plugin.json'), 'plugin manifest')\n    if (`${manifest.publisher}.${manifest.id}` !== entry.pluginKey) {\n      throw new Error(\n        `[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}`\n      )\n    }\n    if (hashPackagedPluginTree(pluginRoot) !== entry.contentHash) {\n      throw new Error(\n        `[verify-packaged-plugin-resources] packaged bytes do not match ${entry.pluginKey}`\n      )\n    }\n  }\n  console.log(\n    `[verify-packaged-plugin-resources] OK — verified ${index.plugins.length} bundled plugin(s)`\n  )\n}\n\nmodule.exports = { verifyPackagedPluginResources }\n","sourceCodeStart":78,"sourceCodeEnd":112,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-packaged-plugin-resources.cjs#L78-L112","documentation":"Thrown by the packaged plugin resource verifier when the plugin manifest (orca-plugin.json) inside the plugin directory has a publisher.id identity that does not match the pluginKey recorded in the bundled-plugins.json index. The check constructs `${manifest.publisher}.${manifest.id}` and compares it to entry.pluginKey. A mismatch means the manifest and index disagree about the plugin's identity, which would cause runtime lookup failures or loading the wrong plugin.","triggerScenarios":"The orca-plugin.json manifest was edited (publisher or id renamed) but bundled-plugins.json was not regenerated; the indexing script computed pluginKey differently from how it appears in the manifest; two plugins were swapped in the directory but the index still references the old identity.","commonSituations":"A plugin was renamed (e.g., publisher changed from 'acme' to 'corp') and only the manifest was updated, not the index; a copy-paste error during plugin scaffolding left the wrong publisher/id in the manifest; the indexing script uses a different field or formatting for pluginKey than the manifest's publisher.id.","solutions":["Compare the manifest's publisher.id with the index's pluginKey for the offending entry: cat <pluginRoot>/orca-plugin.json and grep pluginKey <launchRoot>/bundled-plugins.json.","If the manifest was intentionally renamed, re-run the indexing step so bundled-plugins.json picks up the new identity.","If the index is correct and the manifest is wrong, fix orca-plugin.json to match.","Ensure the indexing script derives pluginKey from the manifest's publisher.id at index time, so they cannot diverge."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before packaging, verify manifest identity matches the index key.\nconst { readFileSync } = require('node:fs')\nconst { join } = require('node:path')\n\nfunction preCheckManifestIdentity(launchRoot, entry) {\n  const manifest = JSON.parse(\n    readFileSync(join(launchRoot, entry.path, 'orca-plugin.json'), 'utf8')\n  )\n  const computedKey = `${manifest.publisher}.${manifest.id}`\n  return { ok: computedKey === entry.pluginKey, computedKey, expected: entry.pluginKey }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Derive pluginKey from the manifest at indexing time so the index and manifest cannot diverge.","If renaming a plugin (publisher or id), update the manifest first, then re-run indexing to regenerate the index.","Add a CI check that compares every manifest's publisher.id against the index's pluginKey before packaging."],"tags":["plugin-packaging","manifest","ci-gate","resource-verification","identity-mismatch"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}