{"record":{"id":"18dbad443fc2462f","repo":"stablyai/orca","slug":"older-relay-reported-an-authorization-error-pleas","errorCode":null,"errorMessage":"Older relay reported an authorization error; please reconnect to deploy the latest relay. (${err.message})","messagePattern":"Older relay reported an authorization error; please reconnect to deploy the latest relay\\. \\((.+?)\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ipc/worktree-remote.ts","lineNumber":1725,"sourceCode":"  try {\n    await timing.time('git_worktree_add', async () =>\n      provider.addWorktree(\n        repo.path,\n        branchName,\n        remotePath,\n        checkoutExistingBranch\n          ? { checkoutExistingBranch }\n          : { base: baseBranch, ...(sparseDirectories.length > 0 ? { noCheckout: true } : {}) }\n      )\n    )\n  } catch (err) {\n    if (\n      err instanceof Error &&\n      (err.message.includes('No workspace roots registered yet') ||\n        err.message.includes('Path outside authorized workspace'))\n    ) {\n      // Why: only OLD relays (pre-allowlist-removal) throw these; surface an upgrade message. Remove after version floor moves (docs/relay-fs-allowlist-removal.md).\n      throw new Error(\n        `Older relay reported an authorization error; please reconnect to deploy the latest relay. (${err.message})`\n      )\n    }\n    throw err\n  }\n  if (sparseDirectories.length > 0) {\n    try {\n      // Why: SSH providers expose generic git exec, so remote sparse mirrors local addSparseWorktree without a new relay method.\n      await provider.exec(['sparse-checkout', 'init', '--cone'], remotePath)\n      await provider.exec(['sparse-checkout', 'set', '--', ...sparseDirectories], remotePath)\n      await provider.exec(['checkout', branchName], remotePath)\n    } catch (err) {\n      if (!checkoutExistingBranch) {\n        await unsetRemoteWorktreeCreationBase(provider, remotePath, branchName)\n      }\n      await provider\n        .removeWorktree(remotePath, true, {\n          deleteBranch: !checkoutExistingBranch,","sourceCodeStart":1707,"sourceCodeEnd":1743,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/ipc/worktree-remote.ts#L1707-L1743","documentation":"The SSH relay is too old: it threw an authorization error whose message contains 'No workspace roots registered yet' or 'Path outside authorized workspace'. These messages were produced by relays before the filesystem-allowlist removal. Current relays no longer enforce that allowlist, so the fix is to reconnect so Orca deploys the latest relay. The code re-wraps the error with an upgrade hint rather than surfacing the raw relay message.","triggerScenarios":"Remote create's addWorktree/setup call returns an error containing either allowlist message string. Reached in the catch at worktree-remote.ts:1725. Triggered against an SSH host still running a pre-allowlist-removal relay.","commonSituations":"Host connected with an old relay that predates the allowlist-removal version floor; relay auto-update disabled or failed; long-lived SSH connection established before the relay upgrade shipped.","solutions":["Disconnect and reconnect the SSH host so Orca pushes the current relay binary.","If reconnect doesn't update the relay, manually update Orca on the host or redeploy the relay.","Once the version floor moves past the allowlist-removal release, this branch can be removed (see docs/relay-fs-allowlist-removal.md)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check relay version capability before create\nconst relayVersion = await getRelayVersion(connectionId)\nif (relayVersion && relayVersion.lt(ALLOWLIST_REMOVAL_MIN_VERSION)) {\n  await reconnectSsh(connectionId) // triggers relay redeploy\n}","typeGuard":"function isLegacyAllowlistRelayError(err: unknown): boolean {\n  return err instanceof Error && (err.message.includes('No workspace roots registered yet') || err.message.includes('Path outside authorized workspace'))\n}","tryCatchPattern":"catch (err) {\n  if (err instanceof Error && err.message.startsWith('Older relay reported an authorization error')) {\n    promptReconnectToUpgradeRelay(connectionId)\n  } else { throw err }\n}","preventionTips":["Keep relays auto-updating so old allowlist versions don't persist.","Reconnect SSH hosts after upgrading Orca to deploy the matching relay.","Once the version floor passes the allowlist-removal release, remove this branch."],"tags":["worktree-create","ssh","relay","version","authorization"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}