{"record":{"id":"a3062514f3c13f8d","repo":"stablyai/orca","slug":"managed-claude-auth-storage-is-not-owned-by-orca","errorCode":null,"errorMessage":"Managed Claude auth storage is not owned by Orca.","messagePattern":"Managed Claude auth storage is not owned by Orca\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/claude-accounts/runtime-auth-service.ts","lineNumber":1027,"sourceCode":"\n  private async readManagedCredentials(account: ClaudeManagedAccount): Promise<string | null> {\n    const managedAuthPath = this.getOwnedManagedAuthPath(account)\n    if (!managedAuthPath) {\n      return null\n    }\n    if (process.platform === 'darwin') {\n      return readManagedClaudeKeychainCredentials(account.id)\n    }\n    return readClaudeManagedAuthFile(managedAuthPath, '.credentials.json')\n  }\n\n  private async writeManagedCredentials(\n    account: ClaudeManagedAccount,\n    credentialsJson: string\n  ): Promise<void> {\n    const managedAuthPath = this.getOwnedManagedAuthPath(account)\n    if (!managedAuthPath) {\n      throw new Error('Managed Claude auth storage is not owned by Orca.')\n    }\n    if (process.platform === 'darwin') {\n      await writeManagedClaudeKeychainCredentials(account.id, credentialsJson)\n      return\n    }\n    writeClaudeManagedAuthFile(managedAuthPath, '.credentials.json', credentialsJson)\n  }\n\n  /**\n   * Proactively refresh an account's OAuth token and persist the rotation to\n   * managed storage. Returns the refreshed credentials JSON, or null when no\n   * refresh happened (token valid, no refresh token, or network failure).\n   *\n   * Caller guarantees this account isn't the live/active one and runs inside the\n   * serialized mutation queue, so the single-use refresh token can't rotate concurrently.\n   */\n  private async refreshManagedAccountTokenIfNeeded(\n    account: ClaudeManagedAccount,","sourceCodeStart":1009,"sourceCodeEnd":1045,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/claude-accounts/runtime-auth-service.ts#L1009-L1045","documentation":"Thrown by RuntimeAuthService.writeManagedCredentials() when getOwnedManagedAuthPath(account) returns null — the account's managedAuthPath no longer resolves as an Orca-owned directory (fails the marker check, realpath check, or path containment check in managed-auth-path.ts). The service refuses to write OAuth credentials to a location it cannot prove it owns.","triggerScenarios":"The account's managed auth directory was deleted, moved, replaced with a symlink, or its .orca-managed-claude-auth marker was removed/changed. Calling writeManagedCredentials for a stale account whose stored managedAuthPath is now invalid.","commonSituations":"User deleted the claude-accounts directory manually. A migration moved userData without relocating the marker. Disk cleanup tools removed the account dir. The account record in settings references a path that resolveOwnedClaudeManagedAuthPath now rejects.","solutions":["Re-add the Claude account so Orca recreates an owned managed auth directory.","Restore or recreate the .orca-managed-claude-auth marker file containing the account id, if the directory is otherwise intact.","Verify the account.managedAuthPath is still under getClaudeManagedAccountsRoot().","Remove the orphaned account from settings before retrying managed operations."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const owned = resolveOwnedClaudeManagedAuthPath(account.id, account.managedAuthPath)\nif (!owned) {\n  // prompt re-add instead of calling writeManagedCredentials\n}","typeGuard":null,"tryCatchPattern":"try {\n  await writeManagedCredentials(account, json)\n} catch (error) {\n  if (error instanceof Error && /not owned by Orca/.test(error.message)) {\n    await reAddAccount(account.id)\n    return\n  }\n  throw error\n}","preventionTips":["Periodically validate account.managedAuthPath via resolveOwnedClaudeManagedAuthPath.","Keep the .orca-managed-claude-auth marker intact.","Do not move/delete the claude-accounts directory manually.","Remove orphaned accounts from settings before operating on them."],"tags":["managed-auth","ownership","claude-accounts","filesystem"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}