stablyai/orca · error · Error

Managed Codex home is missing Orca ownership marker.

Error message

Managed Codex home is missing Orca ownership marker.

What it means

Thrown by assertManagedHomePath when the candidate directory exists but lacks the .orca-managed-home ownership marker file. Orca refuses to read credentials from any directory it did not create, so a present directory without the marker is treated as untrusted/tampered.

Source

Thrown at src/main/codex-accounts/service.ts:1523

          if (!canonicalLinuxPath) {
            throw new Error('Managed Codex home directory does not exist on disk.')
          }
          return toWindowsWslPath(canonicalLinuxPath, wslInfo.distro)
        } catch (error) {
          throw new Error('Managed WSL Codex home is outside Orca account storage.', {
            cause: error
          })
        }
      }

      if (wslInfo.linuxPath.split('/').includes('..')) {
        throw new Error('Managed WSL Codex home is outside Orca account storage.')
      }
      if (!existsSync(candidatePath)) {
        throw new Error('Managed Codex home directory does not exist on disk.')
      }
      if (!existsSync(join(candidatePath, '.orca-managed-home'))) {
        throw new Error('Managed Codex home is missing Orca ownership marker.')
      }
      if (
        expectedAccountId !== undefined &&
        readFileSync(join(candidatePath, '.orca-managed-home'), 'utf-8').trim() !==
          expectedAccountId
      ) {
        throw new Error('Managed WSL Codex home ownership marker does not match its account ID.')
      }
      return candidatePath
    }

    return assertOwnedHostCodexManagedHomePath({
      candidatePath,
      managedAccountsRoot: this.getManagedAccountsRoot(),
      systemCodexHomePath: getSystemCodexHomePath(),
      expectedAccountId
    })
  }

View on GitHub (pinned to 1136503c6a)

Solutions

Re-provision the account so Orca recreates the directory and writes the marker atomically.
If you are certain the home is legitimately Orca-owned, recreate it through Orca's provisioning flow rather than hand-writing the marker.
Check that the backup/sync tool preserves dotfiles (.orca-managed-home) before restoring.

Defensive patterns

Strategy: try-catch

Validate before calling

import { existsSync } from 'node:fs'
import { join } from 'node:path'

function hasOwnershipMarker(homePath: string): boolean {
  return existsSync(join(homePath, '.orca-managed-home'))
}

if (!hasOwnershipMarker(homePath)) {
  // re-provision; do not hand-create the marker
}

Type guard

function isMissingMarkerError(error: unknown): boolean {
  return error instanceof Error && error.message === 'Managed Codex home is missing Orca ownership marker.'
}

Try / catch

try {
  await svc.readIdentityFromHome(homePath, acctId)
} catch (error) {
  if (isMissingMarkerError(error)) {
    await svc.removeAccount(acctId).catch(() => {})
    await svc.addAccount(provisioningOptions)
  } else {
    throw error
  }
}

Prevention

Never recreate managed-home directories manually; always provision through Orca so the marker is written atomically.
Configure sync/backup tools to preserve dotfiles.
Treat a missing marker as evidence of tampering and re-provision, never patch.

When it happens

Trigger: assertManagedHomePath(candidatePath, ...) where existsSync(candidatePath) is true but existsSync(join(candidatePath, '.orca-managed-home')) is false.

Common situations: A partially-completed provisioning (mkdir succeeded, marker write failed); the home was created by an older Orca version that predates markers; a user or another tool recreated the directory manually after a delete; a sync/backup tool skipped dotfiles.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/a92298e61cc60262. Report an issue: GitHub.