{"record":{"id":"cc8c6e3555024590","repo":"stablyai/orca","slug":"managed-wsl-codex-home-ownership-marker-does-not-m","errorCode":null,"errorMessage":"Managed WSL Codex home ownership marker does not match its account ID.","messagePattern":"Managed WSL Codex home ownership marker does not match its account ID\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/codex-accounts/service.ts","lineNumber":1530,"sourceCode":"          })\n        }\n      }\n\n      if (wslInfo.linuxPath.split('/').includes('..')) {\n        throw new Error('Managed WSL Codex home is outside Orca account storage.')\n      }\n      if (!existsSync(candidatePath)) {\n        throw new Error('Managed Codex home directory does not exist on disk.')\n      }\n      if (!existsSync(join(candidatePath, '.orca-managed-home'))) {\n        throw new Error('Managed Codex home is missing Orca ownership marker.')\n      }\n      if (\n        expectedAccountId !== undefined &&\n        readFileSync(join(candidatePath, '.orca-managed-home'), 'utf-8').trim() !==\n          expectedAccountId\n      ) {\n        throw new Error('Managed WSL Codex home ownership marker does not match its account ID.')\n      }\n      return candidatePath\n    }\n\n    return assertOwnedHostCodexManagedHomePath({\n      candidatePath,\n      managedAccountsRoot: this.getManagedAccountsRoot(),\n      systemCodexHomePath: getSystemCodexHomePath(),\n      expectedAccountId\n    })\n  }\n\n  private safeRemoveWslManagedHomeCandidate(\n    distro: string,\n    linuxHomePath: string,\n    expectedAccountId: string\n  ): void {\n    // Why: creation can fail after mkdir/marker but before trust, so cleanup must verify the marker/account ID inside WSL.","sourceCodeStart":1512,"sourceCodeEnd":1548,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/codex-accounts/service.ts#L1512-L1548","documentation":"Thrown by assertManagedHomePath (off-win32 branch, line 1530) when the .orca-managed-home marker exists but its trimmed content does not equal the expectedAccountId. This prevents one account's home from being read under another account's identity (a credential/account cross-contamination guard).","triggerScenarios":"assertManagedHomePath(candidatePath, expectedAccountId) where expectedAccountId is defined and readFileSync(join(candidatePath, '.orca-managed-home'),'utf-8').trim() !== expectedAccountId.","commonSituations":"A home directory was reused/cloned for a different account; the account ID changed after a re-login but the old home dir was kept; a backup restore paired a home with the wrong account row; manual editing of the marker file.","solutions":["Re-provision the account so a fresh home is created with the correct account ID marker.","If the marker is simply stale and the home genuinely belongs to this account, remove the account and re-add it (do not hand-edit the marker to match).","Audit for duplicated/reused home directories across account rows and deduplicate."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"import { readFileSync, existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nfunction markerMatchesAccountId(homePath: string, expectedAccountId: string): boolean {\n  const marker = join(homePath, '.orca-managed-home')\n  if (!existsSync(marker)) return false\n  return readFileSync(marker, 'utf-8').trim() === expectedAccountId\n}\n\nif (!markerMatchesAccountId(homePath, acctId)) {\n  // re-provision; do not reuse the home across accounts\n}","typeGuard":"function isAccountIdMismatchError(error: unknown): boolean {\n  return error instanceof Error && error.message === 'Managed WSL Codex home ownership marker does not match its account ID.'\n}","tryCatchPattern":"try {\n  await svc.readIdentityFromHome(homePath, acctId)\n} catch (error) {\n  if (isAccountIdMismatchError(error)) {\n    await svc.removeAccount(acctId).catch(() => {})\n    await svc.addAccount(provisioningOptions)\n  } else {\n    throw error\n  }\n}","preventionTips":["Never clone or reuse a managed home for a different account; provision a new one.","After a re-login that changes the account ID, re-provision rather than relinking.","Audit account rows for duplicated home paths."],"tags":["codex-accounts","integrity","account-id","ownership-marker"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}