{"record":{"id":"bf91e822b07c762a","repo":"stablyai/orca","slug":"managed-wsl-claude-auth-storage-is-outside-orca-ac","errorCode":null,"errorMessage":"Managed WSL Claude auth storage is outside Orca account storage.","messagePattern":"Managed WSL Claude auth storage is outside Orca account storage\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/claude-accounts/service.ts","lineNumber":964,"sourceCode":"      wslDistro: distro,\n      wslLinuxAuthPath\n    }\n  }\n\n  private getManagedAccountsRoot(): string {\n    const root = getClaudeManagedAccountsRoot()\n    mkdirSync(root, { recursive: true })\n    return root\n  }\n\n  private assertManagedAuthPath(candidatePath: string, expectedAccountId?: string): string {\n    const wslInfo = parseWslUncPath(candidatePath)\n    if (wslInfo) {\n      if (\n        !wslInfo.linuxPath.includes('/.local/share/orca/claude-accounts/') ||\n        !wslInfo.linuxPath.endsWith('/auth')\n      ) {\n        throw new Error('Managed WSL Claude auth storage is outside Orca account storage.')\n      }\n      if (process.platform === 'win32') {\n        try {\n          const canonicalLinuxPath = execFileSync(\n            'wsl.exe',\n            [\n              '-d',\n              wslInfo.distro,\n              '--',\n              'bash',\n              '-lc',\n              buildEncodedWslBashCommand(\n                [\n                  'set -euo pipefail',\n                  `candidate=${shellQuote(wslInfo.linuxPath)}`,\n                  'managed_root=\"${HOME%/}/.local/share/orca/claude-accounts\"',\n                  'candidate_real=$(readlink -f -- \"$candidate\")',\n                  'managed_root_real=$(readlink -f -- \"$managed_root\")',","sourceCodeStart":946,"sourceCodeEnd":982,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/claude-accounts/service.ts#L946-L982","documentation":"Thrown by assertManagedAuthPath when a candidate WSL UNC path passes parseWslUncPath but its linuxPath does not contain '/.local/share/orca/claude-accounts/' or does not end with '/auth'. This is a path-containment guard: Orca will only operate on auth directories under its own managed root structure.","triggerScenarios":"Calling assertManagedAuthPath with a WSL UNC path (\\\\wsl.localhost\\<distro>\\...) whose Linux portion points outside ~/.local/share/orca/claude-accounts/ or is not an .../auth directory. Happens when a stored managedAuthPath is corrupted, manually relocated, or when parseWslUncPath matches a path that was crafted/edited externally.","commonSituations":"A user manually moved the claude-accounts directory. A symlink or drvfs path causes parseWslUncPath to produce a linuxPath that no longer contains the expected segment. Stale config from an older Orca version with a different directory layout.","solutions":["Inspect the candidatePath being passed; confirm it matches the form \\\\wsl.localhost\\<distro>\\home\\<user>\\.local\\share\\orca\\claude-accounts\\<accountId>\\auth.","If the path was relocated, move the directory back under ~/.local/share/orca/claude-accounts/<accountId>/auth inside WSL.","Remove the stale account from Orca's account list and re-add it so a fresh managed auth path is created.","Check that the accountId in the path matches an existing account."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { parseWslUncPath } from '@orca/shared/wsl-paths'\n\nfunction isValidManagedWslAuthPath(path: string): boolean {\n  const wslInfo = parseWslUncPath(path)\n  if (!wslInfo) return false\n  return wslInfo.linuxPath.includes('/.local/share/orca/claude-accounts/') &&\n         wslInfo.linuxPath.endsWith('/auth')\n}","typeGuard":null,"tryCatchPattern":"try {\n  assertManagedAuthPath(candidatePath, expectedAccountId)\n} catch (error) {\n  if (error instanceof Error && error.message.includes('outside Orca account storage')) {\n    // Path was tampered with or corrupted; prompt re-add of account\n    promptReAddAccount()\n  } else { throw error }\n}","preventionTips":["Never manually relocate the claude-accounts directory.","Validate UNC paths match the expected structure before passing to assertManagedAuthPath.","Keep accountId consistent between directory name and expectedAccountId parameter."],"tags":["wsl","windows","claude-accounts","path-validation","security"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}