stablyai/orca · error · Error

Managed Claude auth storage is not owned by Orca.

Error message

Managed Claude auth storage is not owned by Orca.

What it means

Thrown by RuntimeAuthService.writeManagedCredentials() when getOwnedManagedAuthPath(account) returns null — the account's managedAuthPath no longer resolves as an Orca-owned directory (fails the marker check, realpath check, or path containment check in managed-auth-path.ts). The service refuses to write OAuth credentials to a location it cannot prove it owns.

Source

Thrown at src/main/claude-accounts/runtime-auth-service.ts:1027

  private async readManagedCredentials(account: ClaudeManagedAccount): Promise<string | null> {
    const managedAuthPath = this.getOwnedManagedAuthPath(account)
    if (!managedAuthPath) {
      return null
    }
    if (process.platform === 'darwin') {
      return readManagedClaudeKeychainCredentials(account.id)
    }
    return readClaudeManagedAuthFile(managedAuthPath, '.credentials.json')
  }

  private async writeManagedCredentials(
    account: ClaudeManagedAccount,
    credentialsJson: string
  ): Promise<void> {
    const managedAuthPath = this.getOwnedManagedAuthPath(account)
    if (!managedAuthPath) {
      throw new Error('Managed Claude auth storage is not owned by Orca.')
    }
    if (process.platform === 'darwin') {
      await writeManagedClaudeKeychainCredentials(account.id, credentialsJson)
      return
    }
    writeClaudeManagedAuthFile(managedAuthPath, '.credentials.json', credentialsJson)
  }

  /**
   * Proactively refresh an account's OAuth token and persist the rotation to
   * managed storage. Returns the refreshed credentials JSON, or null when no
   * refresh happened (token valid, no refresh token, or network failure).
   *
   * Caller guarantees this account isn't the live/active one and runs inside the
   * serialized mutation queue, so the single-use refresh token can't rotate concurrently.
   */
  private async refreshManagedAccountTokenIfNeeded(
    account: ClaudeManagedAccount,

View on GitHub (pinned to 1136503c6a)

Solutions

1. Re-add the Claude account so Orca recreates an owned managed auth directory.
2. Restore or recreate the .orca-managed-claude-auth marker file containing the account id, if the directory is otherwise intact.
3. Verify the account.managedAuthPath is still under getClaudeManagedAccountsRoot().
4. Remove the orphaned account from settings before retrying managed operations.

const owned = resolveOwnedClaudeManagedAuthPath(account.id, account.managedAuthPath)
if (!owned) {
  // prompt re-add instead of calling writeManagedCredentials
}

try {
  await writeManagedCredentials(account, json)
} catch (error) {
  if (error instanceof Error && /not owned by Orca/.test(error.message)) {
    await reAddAccount(account.id)
    return
  }
  throw error
}

When it happens

Trigger: The account's managed auth directory was deleted, moved, replaced with a symlink, or its .orca-managed-claude-auth marker was removed/changed. Calling writeManagedCredentials for a stale account whose stored managedAuthPath is now invalid.

Common situations: User deleted the claude-accounts directory manually. A migration moved userData without relocating the marker. Disk cleanup tools removed the account dir. The account record in settings references a path that resolveOwnedClaudeManagedAuthPath now rejects.

Related errors

• Managed Claude auth storage is not owned by Orca.
• Managed Claude auth child file is not owned by Orca.
• No Claude credentials found in ${resolvedDir}. Run `claude l
• Could not create a temporary WSL Claude login directory.
• Managed Claude auth directory does not exist on disk.

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/a3062514f3c13f8d. Report an issue: GitHub.