{"record":{"id":"a9c6845d41b8b78f","repo":"stablyai/orca","slug":"windows-blocked-updating-your-user-path-access-de","errorCode":null,"errorMessage":"Windows blocked updating your user PATH (access denied). This usually means your PATH environment variable is managed by Group Policy or your organization's device management. ${guidance}","messagePattern":"Windows blocked updating your user PATH \\(access denied\\)\\. This usually means your PATH environment variable is managed by Group Policy or your organization's device management\\. (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/cli/cli-installer.ts","lineNumber":895,"sourceCode":"\n  // Why: raw PowerShell errors reach the UI, so translate denied PATH writes (keeping the original as cause).\n  private async writeWindowsUserPathEntry(\n    value: string,\n    pathDirectory: string,\n    action: 'add' | 'remove'\n  ): Promise<void> {\n    try {\n      await this.userPathWriter(value)\n      this.userPathCacheInvalidator()\n    } catch (error) {\n      if (!isWindowsUserPathPermissionError(error)) {\n        throw error\n      }\n      const guidance =\n        action === 'add'\n          ? `Add this folder to your PATH manually: ${pathDirectory}. Or run Orca as an administrator and try again.`\n          : `Remove this folder from your PATH manually: ${pathDirectory}. Or run Orca as an administrator and try again.`\n      throw new Error(\n        `Windows blocked updating your user PATH (access denied). This usually means your PATH environment variable is managed by Group Policy or your organization's device management. ${guidance}`,\n        { cause: error }\n      )\n    }\n  }\n}\n\nasync function ensureDevLauncher(args: {\n  platform: NodeJS.Platform\n  userDataPath: string\n  execPath: string\n  cliEntryPath: string\n  commandName: string\n}): Promise<string | null> {\n  if (\n    !isAbsoluteForPlatform(args.platform, args.execPath) ||\n    !isAbsolute(args.cliEntryPath) ||\n    !existsSync(args.cliEntryPath)","sourceCodeStart":877,"sourceCodeEnd":913,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/cli/cli-installer.ts#L877-L913","documentation":"Thrown by writeWindowsUserPathEntry when the PATH write is denied. isWindowsUserPathPermissionError detects .NET/ACL markers (UnauthorizedAccessException, SecurityException, 'Access is denied') in the error. The message explains that Group Policy or device management likely controls PATH and provides actionable guidance.","triggerScenarios":"The userPathWriter (PowerShell [Environment]::SetEnvironmentVariable or registry write) throws an access-denied error. isWindowsUserPathPermissionError matches the error text against known permission-denied markers.","commonSituations":"Corporate-managed Windows where Group Policy locks HKCU\\Environment. Device management software (Intune, etc.) restricts environment variable writes. Non-admin user on a locked-down machine. UAC preventing registry writes to certain keys.","solutions":["Manually add/remove the folder from PATH via Windows Settings > Environment Variables.","Run Orca as administrator and retry CLI registration.","Ask your IT admin to allow PATH modifications for your user account.","Use the bundled orca.exe path directly without PATH registration if admin access is unavailable."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await installer.ensureWindowsPathEntry(dir)\n} catch (error) {\n  if (error instanceof Error && error.message.includes('access denied')) {\n    // Provide manual PATH instructions; suggest running as admin\n    showManualPathInstructions(dir, action)\n  } else { throw error }\n}","preventionTips":["On managed Windows, provide manual PATH instructions as a fallback.","Detect Group Policy-managed environments early and skip automatic PATH writes.","Suggest running as administrator when permission errors are likely."],"tags":["cli-installer","windows","path","permissions","group-policy","registry"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}