stablyai/orca · error · Error

Access denied: unknown repository path

Error message

Access denied: unknown repository path

What it means

Thrown by assertRegisteredRepo in gitlab.ts:80 when findRegisteredGitLabRepo returns undefined. This is the GitLab filesystem-auth boundary: main-process handlers must never operate on a path the user has not explicitly registered as a repo. resolve(args.repoPath) does not match any store repo path.

Source

Thrown at src/main/ipc/gitlab.ts:87

  const repoId = args.repoId?.trim() || sourceRepoId || null
  if (repoId) {
    const repo = store.getRepo(repoId)
    if (repo) {
      return repo
    }
  }
  const resolvedRepoPath = resolve(args.repoPath)
  return store.getRepos().find((r) => resolve(r.path) === resolvedRepoPath)
}

// Why: mirror github.ts assertRegisteredRepo — main-process handlers
// must never operate on a path the user hasn't explicitly registered as
// a repo (filesystem-auth boundary). Source context adds a host check so a
// task fetched from one machine cannot mutate a same-path repo on another.
function assertRegisteredRepo(args: GitLabRepoSelectorArgs, store: Store): Repo {
  const repo = findRegisteredGitLabRepo(args, store)
  if (!repo) {
    throw new Error('Access denied: unknown repository path')
  }
  if (
    args.sourceContext?.provider === 'gitlab' &&
    args.sourceContext.hostId !== getRepoExecutionHostId(repo)
  ) {
    throw new Error('Access denied: GitLab source host does not match repository host')
  }
  return repo
}

function repoConnectionId(repo: Repo): string | null {
  return repo.connectionId ?? null
}

function localGitOptionArgs(store: Store, repo: Repo): [] | [LocalGitExecOptions] {
  const localGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
  return localGitOptions.wslDistro ? [{ wslDistro: localGitOptions.wslDistro }] : []
}

View on GitHub (pinned to 1136503c6a)

Solutions

  1. Register the repository at the exact path the GitLab operation targets, then retry.
  2. If the path is a symlink, register the canonical resolved path that resolve() will produce.
  3. Drop stale GitLab task references that point at unregistered paths.
  4. Confirm the operation targets a repo on the correct execution host.

Example fix

// before
assertRegisteredRepo({ repoPath: persistedPath }, store)

// after — verify registration shape before calling
if (!store.getRepos().some((r) => resolve(r.path) === resolve(persistedPath))) {
  throw new Error(`re-register repo at ${persistedPath} before retrying`)
}
assertRegisteredRepo({ repoPath: persistedPath }, store)
Defensive patterns

Strategy: validation

Validate before calling

// Before any GitLab IPC call: confirm the path is registered (resolved form)
import { resolve } from 'node:path'

function isGitLabRepoRegistered(store, repoPath) {
  const resolved = resolve(repoPath)
  return store.getRepos().some((r) => resolve(r.path) === resolved)
}

Type guard

export function isGitLabRepoSelectorArgs(
  args: unknown
): args is { repoPath: string; sourceContext?: { provider?: string; hostId?: string } | null } {
  return typeof args === 'object' && args !== null && typeof (args as any).repoPath === 'string'
}

Try / catch

try {
  await ipcRenderer.invoke('gl:something', { repoPath })
} catch (e) {
  if (e instanceof Error && e.message === 'Access denied: unknown repository path') {
    promptReRegister(repoPath); return
  }
  throw e
}

Prevention

When it happens

Trigger: A GitLab IPC handler calls assertRegisteredRepo(args, store) where args.repoPath (after path.resolve) matches none of store.getRepos(). Triggered by GitLab task/PR/MR operations keyed by a repo path that was never added or has since been removed.

Common situations: Repo was unregistered; repo path moved or is symlinked differently than when registered; a GitLab task reference persisted an old path; cross-machine replay where the repo is registered on a different host.

Understand the failure class

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/85bf8e0a56243127. Report an issue: GitHub.