{"record":{"id":"597fe95c8b704892","repo":"affaan-m/ECC","slug":"refusing-to-trust-managed-install-state-path-er","errorCode":null,"errorMessage":"Refusing to trust managed install-state path: ${error.message}","messagePattern":"Refusing to trust managed install-state path: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/lib/multi-harness-setup.js","lineNumber":132,"sourceCode":"      + 'recorded root does not match the current install root.'\n    );\n  }\n  if (!pathsMatch(target.installStatePath, plan.installStatePath)) {\n    throw new Error(\n      `Refusing to trust managed install-state at ${plan.installStatePath}: `\n      + 'recorded install-state path does not match the current install-state path.'\n    );\n  }\n}\n\nfunction readOwnedDestinations(plan, dependencies) {\n  if (!plan.installStatePath) {\n    return { destinations: new Set(), stateFingerprint: { exists: false, sha256: null } };\n  }\n  try {\n    assertSafeInstallOperation(plan, { destinationPath: plan.installStatePath });\n  } catch (error) {\n    throw new Error(`Refusing to trust managed install-state path: ${error.message}`);\n  }\n  if (!fs.existsSync(plan.installStatePath)) {\n    return { destinations: new Set(), stateFingerprint: { exists: false, sha256: null } };\n  }\n  const readState = dependencies.readInstallState || require('./install-state').readInstallState;\n  const initialFingerprint = fingerprintFile(plan.installStatePath);\n  const state = readState(plan.installStatePath);\n  const validatedFingerprint = fingerprintFile(plan.installStatePath);\n  if (\n    initialFingerprint.exists !== validatedFingerprint.exists\n    || initialFingerprint.sha256 !== validatedFingerprint.sha256\n  ) {\n    throw new Error(\n      `Refusing to trust install-state that changed during validation: ${plan.installStatePath}.`\n    );\n  }\n  assertPriorInstallStateMatchesPlan(state, plan);\n  const plannedByDestination = new Map(plan.operations.map(operation => [","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/lib/multi-harness-setup.js#L114-L150","documentation":"Thrown by readOwnedDestinations when assertSafeInstallOperation(plan, { destinationPath: plan.installStatePath }) rejects the install-state path itself. assertSafeInstallOperation (from ./install/apply) and assertWithinTrustedRoot enforce that every destination stays inside the trusted project root and is not a dangerous/sensitive path. The original error message is wrapped so the caller sees the install-state path was the reason, preserving the underlying cause in error.message.","triggerScenarios":"Reached at the top of readOwnedDestinations for any plan with installStatePath set. Fires when the install-state path escapes plan.targetRoot (after realpath resolution), targets a protected location, or fails whatever path-safety predicate assertSafeInstallOperation enforces. Typical when homeDir/projectRoot passed to createManagedPlan place installStatePath outside the trusted root, or a symlink resolves outside.","commonSituations":"Custom homeDir pointing outside the project; projectRoot mismatch; installStatePath configured to an absolute path outside targetRoot; symlinked .claude dir resolving to a location outside the trusted root; running with elevated/changed HOME so the state path lands somewhere unexpected.","solutions":["Inspect the wrapped message (error.message after the prefix) to see the exact path-safety violation.","Ensure plan.installStatePath resolves (via realpath) inside plan.targetRoot.","Pass consistent homeDir/projectRoot to createManagedPlan so the install-state path lands inside the trusted root.","Remove symlinks that cause .claude to resolve outside the project, or move the state path inside targetRoot."],"exampleFix":"// before: homeDir set outside project -> installStatePath escapes trusted root\nconst plan = await createManagedPlan(req, {\n  homeDir: '/tmp/elsewhere',\n  projectRoot: '/home/me/app',\n});\nawait applyManaged(plan); // throws [284]: path outside trusted root\n\n// after: keep install state inside the project root\nconst plan = await createManagedPlan(req, {\n  homeDir: os.homedir(),\n  projectRoot: '/home/me/app',\n});\nawait applyManaged(plan);","handlingStrategy":"validation","validationCode":"const path = require('path'); const fs = require('fs');\nfunction assertInstallStateWithinRoot(installStatePath, targetRoot) {\n  const resolved = fs.realpathSync(installStatePath); // throws if missing; guard as needed\n  const root = fs.realpathSync(targetRoot);\n  if (resolved !== root && !resolved.startsWith(root + path.sep)) {\n    throw new Error(`installStatePath ${resolved} escapes targetRoot ${root}; move it inside the project.`);\n  }\n}\n// before applying:\nif (fs.existsSync(plan.installStatePath)) {\n  assertInstallStateWithinRoot(plan.installStatePath, plan.targetRoot);\n}","typeGuard":"null","tryCatchPattern":"try {\n  await applyMultiHarnessPlan(plan);\n} catch (err) {\n  if (/Refusing to trust managed install-state path/.test(err.message)) {\n    // fix plan.installStatePath/homeDir/projectRoot so it resolves inside targetRoot, then retry\n    const fixed = await createManagedPlan(plan.request, { homeDir: os.homedir(), projectRoot: plan.targetRoot });\n    await applyManaged({ preview: preflightManagedPlan(fixed) });\n  } else throw err;\n}","preventionTips":["Keep the install-state path inside the project root; do not point it at /tmp or HOME.","Pass consistent homeDir and projectRoot to createManagedPlan.","Avoid symlinking .claude outside the project.","Resolve realpath of the state path before passing it to the plan."],"tags":["install-state","path-safety","trusted-root","symlink-escape","kimi"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}