Plugin '${manifest.name}' integrity mismatch: expected ${int

Error message

Plugin '${manifest.name}' integrity mismatch: expected ${integrityField}, got ${actual}

What it means

Error "Plugin '${manifest.name}' integrity mismatch: expected ${integrityField}, got ${actual}" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/plugins/loader.ts:159

export async function loadPlugin(
  entryPoint: string,
  manifest: PluginManifestWithDefaults
): Promise<LoadedPlugin> {
  // Integrity check: if the manifest declares an integrity field, verify the entry point.
  // Missing integrity is OK for backward compatibility; mismatched integrity is a fatal error.
  const integrityField = (manifest as unknown as Record<string, unknown>).integrity;
  if (typeof integrityField === "string" && integrityField.length > 0) {
    let source: string;
    try {
      source = await readFile(entryPoint, "utf-8");
    } catch (err: unknown) {
      throw new Error(
        `Plugin '${manifest.name}' integrity check failed: cannot read entry point — ${err instanceof Error ? err.message : String(err)}`
      );
    }
    const actual = computeIntegrity(source);
    if (actual !== integrityField) {
      throw new Error(
        `Plugin '${manifest.name}' integrity mismatch: expected ${integrityField}, got ${actual}`
      );
    }
  }

  const permissions = manifest.requires.permissions;

  // IMPORTANT-6: Write the host script with O_EXCL (wx flag) so the open fails if
  // anything already exists at that path, defeating symlink/pre-create races (TOCTOU).
  // mode 0o600 ensures no other OS user can read or replace the script.
  // On EEXIST collision (astronomically unlikely with UUID but theoretically possible),
  // retry once with a fresh UUID.
  let hostScriptPath: string;
  {
    // .mjs extension forces ESM execution regardless of package.json type field
    const tryWrite = async (id: string): Promise<string> => {
      const p = join(tmpdir(), `omniroute-plugin-host-${id}.mjs`);
      await writeFile(p, PLUGIN_HOST_SCRIPT, { encoding: "utf-8", mode: 0o600, flag: "wx" });

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/plugins/loader.ts:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/ad575884237d67a2. Report an issue: GitHub.