{"record":{"id":"d624582b3375e3f6","repo":"stablyai/orca","slug":"managed-wsl-codex-home-is-outside-orca-account-sto","errorCode":null,"errorMessage":"Managed WSL Codex home is outside Orca account storage.","messagePattern":"Managed WSL Codex home is outside Orca account storage\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/codex-accounts/service.ts","lineNumber":1463,"sourceCode":"  }\n\n  private pathsEqual(left: string, right: string): boolean {\n    const resolvedLeft = resolve(left)\n    const resolvedRight = resolve(right)\n    if (process.platform === 'win32') {\n      return resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()\n    }\n    return resolvedLeft === resolvedRight\n  }\n\n  private assertManagedHomePath(candidatePath: string, expectedAccountId?: string): string {\n    const wslInfo = parseWslUncPath(candidatePath)\n    if (wslInfo) {\n      if (\n        !wslInfo.linuxPath.includes('/.local/share/orca/codex-accounts/') ||\n        !wslInfo.linuxPath.endsWith('/home')\n      ) {\n        throw new Error('Managed WSL Codex home is outside Orca account storage.')\n      }\n      if (\n        expectedAccountId !== undefined &&\n        !wslInfo.linuxPath.endsWith(`/.local/share/orca/codex-accounts/${expectedAccountId}/home`)\n      ) {\n        throw new Error('Managed WSL Codex home does not match its persisted account ID.')\n      }\n\n      if (process.platform === 'win32') {\n        try {\n          const canonicalLinuxPath = execFileSync(\n            'wsl.exe',\n            [\n              '-d',\n              wslInfo.distro,\n              '--',\n              'bash',\n              '-lc',","sourceCodeStart":1445,"sourceCodeEnd":1481,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/codex-accounts/service.ts#L1445-L1481","documentation":"Thrown by assertManagedHomePath (the WSL branch) when the candidate path parses as a WSL UNC path but its linuxPath does not contain '/.local/share/orca/codex-accounts/' or does not end with '/home'. This is a trust boundary: Orca will only treat a WSL path as a managed Codex home if it lives under the canonical Orca account storage layout. Also rethrown (with cause) at service.ts:1510 when the in-WSL canonicalization check fails, and at service.ts:1517 for path traversal ('..') in the linux path.","triggerScenarios":"A managed home path persisted in settings (or passed to assertManagedHomePath) is a WSL UNC path that is not under the Orca codex-accounts/<id>/home layout, contains '..' traversal, or fails the in-WSSL readlink/marker verification (the catch at 1509).","commonSituations":"Settings file manually edited to point managedHomePath at an arbitrary WSL location; a corrupted or migrated account record whose wslLinuxHomePath drifted; symlink tricks that make readlink -f resolve outside the managed root (caught by the wsl.exe case-statement guard).","solutions":["Do not hand-edit managedHomePath in settings; let Orca create/own these paths under <userData>/codex-accounts and $HOME/.local/share/orca/codex-accounts.","If the path is genuinely stale, remove the account and re-add it so Orca recreates a valid managed home.","For the rethrow-with-cause variant (line 1510), inspect error.cause for the underlying wsl.exe failure (marker missing, readlink failure, distro unreachable).","Ensure no symlinks relocate the managed home outside the managed root."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate a WSL managed-home path layout before trusting it.\nconst info = parseWslUncPath(path)\nif (!info || !info.linuxPath.includes('/.local/share/orca/codex-accounts/') ||\n    !info.linuxPath.endsWith('/home') || info.linuxPath.split('/').includes('..')) {\n  throw new Error('Path is not an Orca-managed WSL Codex home.')\n}","typeGuard":null,"tryCatchPattern":"try {\n  service.assertManagedHomePath?.(path, accountId) // internal; usually reached via service methods\n} catch (error) {\n  if (error instanceof Error && error.message === 'Managed WSL Codex home is outside Orca account storage.') {\n    // remove/re-add the account to recreate a valid managed home\n  } else throw error\n}","preventionTips":["Never hand-edit managedHomePath in settings.","Keep managed homes under the canonical Orca layout; avoid symlinking them outside the root."],"tags":["codex-accounts","wsl","security","path-validation","trust-boundary"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}