{"record":{"id":"c2dbea7f12237063","repo":"zeroclaw-labs/zeroclaw","slug":"plugin-archive-manifest-version-does-not-matc","errorCode":null,"errorMessage":"plugin archive manifest version '{}' does not match registry version '{}'","messagePattern":"plugin archive manifest version '(.+?)' does not match registry version '(.+?)'","errorType":"console","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/plugin_registry.rs","lineNumber":302,"sourceCode":"    let manifest_path = plugin_dir.join(\"manifest.toml\");\n    let manifest_toml = std::fs::read_to_string(&manifest_path)\n        .with_context(|| format!(\"reading {}\", manifest_path.display()))?;\n    toml::from_str(&manifest_toml).with_context(|| format!(\"parsing {}\", manifest_path.display()))\n}\n\nfn verify_manifest_matches_registry(\n    entry: &PluginRegistryEntry,\n    manifest: &PluginManifest,\n) -> Result<()> {\n    if manifest.name != entry.name {\n        bail!(\n            \"plugin archive manifest name '{}' does not match registry name '{}'\",\n            manifest.name,\n            entry.name\n        );\n    }\n    if manifest.version != entry.version {\n        bail!(\n            \"plugin archive manifest version '{}' does not match registry version '{}'\",\n            manifest.version,\n            entry.version\n        );\n    }\n    Ok(())\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use std::cell::Cell;\n    use std::io::{Cursor, Write};\n    use std::rc::Rc;\n    use zip::write::SimpleFileOptions;\n\n    struct CountingChunks {\n        chunks: Vec<Vec<u8>>,","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/plugin_registry.rs#L284-L320","documentation":"The second half of verify_manifest_matches_registry: the version in the extracted manifest.toml must equal the version in the registry index entry. A mismatch bails, ensuring the installed version is exactly the reviewed/pinned one.","triggerScenarios":"Installing a plugin where the registry entry says version \"0.3.0\" but the archive's manifest.toml declares a different version (e.g. \"0.3.1\" or \"0.2.9\"). Name check (error 1418) passes first; only the version differs.","commonSituations":"Publisher rebuilt and overwrote the artifact at the same URL after a version bump without updating the index (or vice versa); release scripts publishing index and artifact out of order; pinning attempts where the entry's version drifted from the artifact.","solutions":["Refresh the registry index and retry — a stale local index referencing an old version is the most common cause","If you publish: bump manifest version, rebuild the archive, and update the entry's version (and sha256) atomically","Verify manually: unzip the artifact, read manifest.toml's version, compare with the index entry","For reproducible installs, prefer entries with exact version + sha256 pins and re-pin after every upstream release"],"exampleFix":"# before\n# entry: { \"version\": \"0.3.0\", \"url\": \".../p.zip\" } ; manifest.toml: version = \"0.3.1\"\n# after: keep them in lockstep\n# manifest.toml\nversion = \"0.3.0\"        # or update the entry to 0.3.1 + new sha256\n# republish both together","handlingStrategy":"retry","validationCode":"// Pin-aware pre-check when you fetch entries yourself:\nlet manifest = toml::from_str::<PluginManifest>(&manifest_src)?;\nanyhow::ensure!(manifest.version == registry_entry.version,\n    \"version drift: entry {} vs manifest {}\", registry_entry.version, manifest.version);","typeGuard":null,"tryCatchPattern":"// On version mismatch: re-fetch the registry index and retry once — the\n// classic cause is a stale index after a publisher bump. If it persists, the\n// entry and artifact are out of sync at the source; stop and report.","preventionTips":["Bump entry version and artifact sha256 in the same release commit","Cache indexes with short TTL so stale-version installs fail fast","Automate release publishing so index and archive cannot drift manually"],"tags":["plugin-registry","manifest","version","supply-chain"],"backgroundTag":"package-version-mismatch","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}