stablyai/orca · error · Error

Managed WSL Claude auth storage is outside Orca account stor

Error message

Managed WSL Claude auth storage is outside Orca account storage.

What it means

Thrown by assertManagedAuthPath when a candidate WSL UNC path passes parseWslUncPath but its linuxPath does not contain '/.local/share/orca/claude-accounts/' or does not end with '/auth'. This is a path-containment guard: Orca will only operate on auth directories under its own managed root structure.

Source

Thrown at src/main/claude-accounts/service.ts:964

      wslDistro: distro,
      wslLinuxAuthPath
    }
  }

  private getManagedAccountsRoot(): string {
    const root = getClaudeManagedAccountsRoot()
    mkdirSync(root, { recursive: true })
    return root
  }

  private assertManagedAuthPath(candidatePath: string, expectedAccountId?: string): string {
    const wslInfo = parseWslUncPath(candidatePath)
    if (wslInfo) {
      if (
        !wslInfo.linuxPath.includes('/.local/share/orca/claude-accounts/') ||
        !wslInfo.linuxPath.endsWith('/auth')
      ) {
        throw new Error('Managed WSL Claude auth storage is outside Orca account storage.')
      }
      if (process.platform === 'win32') {
        try {
          const canonicalLinuxPath = execFileSync(
            'wsl.exe',
            [
              '-d',
              wslInfo.distro,
              '--',
              'bash',
              '-lc',
              buildEncodedWslBashCommand(
                [
                  'set -euo pipefail',
                  `candidate=${shellQuote(wslInfo.linuxPath)}`,
                  'managed_root="${HOME%/}/.local/share/orca/claude-accounts"',
                  'candidate_real=$(readlink -f -- "$candidate")',
                  'managed_root_real=$(readlink -f -- "$managed_root")',

View on GitHub (pinned to 1136503c6a)

Solutions

Inspect the candidatePath being passed; confirm it matches the form \\wsl.localhost\<distro>\home\<user>\.local\share\orca\claude-accounts\<accountId>\auth.
If the path was relocated, move the directory back under ~/.local/share/orca/claude-accounts/<accountId>/auth inside WSL.
Remove the stale account from Orca's account list and re-add it so a fresh managed auth path is created.
Check that the accountId in the path matches an existing account.

Defensive patterns

Strategy: validation

Validate before calling

import { parseWslUncPath } from '@orca/shared/wsl-paths'

function isValidManagedWslAuthPath(path: string): boolean {
  const wslInfo = parseWslUncPath(path)
  if (!wslInfo) return false
  return wslInfo.linuxPath.includes('/.local/share/orca/claude-accounts/') &&
         wslInfo.linuxPath.endsWith('/auth')
}

Try / catch

try {
  assertManagedAuthPath(candidatePath, expectedAccountId)
} catch (error) {
  if (error instanceof Error && error.message.includes('outside Orca account storage')) {
    // Path was tampered with or corrupted; prompt re-add of account
    promptReAddAccount()
  } else { throw error }
}

Prevention

Never manually relocate the claude-accounts directory.
Validate UNC paths match the expected structure before passing to assertManagedAuthPath.
Keep accountId consistent between directory name and expectedAccountId parameter.

When it happens

Trigger: Calling assertManagedAuthPath with a WSL UNC path (\\wsl.localhost\<distro>\...) whose Linux portion points outside ~/.local/share/orca/claude-accounts/ or is not an .../auth directory. Happens when a stored managedAuthPath is corrupted, manually relocated, or when parseWslUncPath matches a path that was crafted/edited externally.

Common situations: A user manually moved the claude-accounts directory. A symlink or drvfs path causes parseWslUncPath to produce a linuxPath that no longer contains the expected segment. Stale config from an older Orca version with a different directory layout.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/bf91e822b07c762a. Report an issue: GitHub.