{"record":{"id":"a92298e61cc60262","repo":"stablyai/orca","slug":"managed-codex-home-is-missing-orca-ownership-marke-a92298","errorCode":null,"errorMessage":"Managed Codex home is missing Orca ownership marker.","messagePattern":"Managed Codex home is missing Orca ownership marker\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/codex-accounts/service.ts","lineNumber":1523,"sourceCode":"          if (!canonicalLinuxPath) {\n            throw new Error('Managed Codex home directory does not exist on disk.')\n          }\n          return toWindowsWslPath(canonicalLinuxPath, wslInfo.distro)\n        } catch (error) {\n          throw new Error('Managed WSL Codex home is outside Orca account storage.', {\n            cause: error\n          })\n        }\n      }\n\n      if (wslInfo.linuxPath.split('/').includes('..')) {\n        throw new Error('Managed WSL Codex home is outside Orca account storage.')\n      }\n      if (!existsSync(candidatePath)) {\n        throw new Error('Managed Codex home directory does not exist on disk.')\n      }\n      if (!existsSync(join(candidatePath, '.orca-managed-home'))) {\n        throw new Error('Managed Codex home is missing Orca ownership marker.')\n      }\n      if (\n        expectedAccountId !== undefined &&\n        readFileSync(join(candidatePath, '.orca-managed-home'), 'utf-8').trim() !==\n          expectedAccountId\n      ) {\n        throw new Error('Managed WSL Codex home ownership marker does not match its account ID.')\n      }\n      return candidatePath\n    }\n\n    return assertOwnedHostCodexManagedHomePath({\n      candidatePath,\n      managedAccountsRoot: this.getManagedAccountsRoot(),\n      systemCodexHomePath: getSystemCodexHomePath(),\n      expectedAccountId\n    })\n  }","sourceCodeStart":1505,"sourceCodeEnd":1541,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/codex-accounts/service.ts#L1505-L1541","documentation":"Thrown by assertManagedHomePath when the candidate directory exists but lacks the .orca-managed-home ownership marker file. Orca refuses to read credentials from any directory it did not create, so a present directory without the marker is treated as untrusted/tampered.","triggerScenarios":"assertManagedHomePath(candidatePath, ...) where existsSync(candidatePath) is true but existsSync(join(candidatePath, '.orca-managed-home')) is false.","commonSituations":"A partially-completed provisioning (mkdir succeeded, marker write failed); the home was created by an older Orca version that predates markers; a user or another tool recreated the directory manually after a delete; a sync/backup tool skipped dotfiles.","solutions":["Re-provision the account so Orca recreates the directory and writes the marker atomically.","If you are certain the home is legitimately Orca-owned, recreate it through Orca's provisioning flow rather than hand-writing the marker.","Check that the backup/sync tool preserves dotfiles (.orca-managed-home) before restoring."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"import { existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nfunction hasOwnershipMarker(homePath: string): boolean {\n  return existsSync(join(homePath, '.orca-managed-home'))\n}\n\nif (!hasOwnershipMarker(homePath)) {\n  // re-provision; do not hand-create the marker\n}","typeGuard":"function isMissingMarkerError(error: unknown): boolean {\n  return error instanceof Error && error.message === 'Managed Codex home is missing Orca ownership marker.'\n}","tryCatchPattern":"try {\n  await svc.readIdentityFromHome(homePath, acctId)\n} catch (error) {\n  if (isMissingMarkerError(error)) {\n    await svc.removeAccount(acctId).catch(() => {})\n    await svc.addAccount(provisioningOptions)\n  } else {\n    throw error\n  }\n}","preventionTips":["Never recreate managed-home directories manually; always provision through Orca so the marker is written atomically.","Configure sync/backup tools to preserve dotfiles.","Treat a missing marker as evidence of tampering and re-provision, never patch."],"tags":["codex-accounts","filesystem","integrity","ownership-marker"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}