stablyai/orca · error · Error

Managed WSL Codex home is outside Orca account storage.

Error message

Managed WSL Codex home is outside Orca account storage.

What it means

Thrown by assertManagedHomePath (the WSL branch) when the candidate path parses as a WSL UNC path but its linuxPath does not contain '/.local/share/orca/codex-accounts/' or does not end with '/home'. This is a trust boundary: Orca will only treat a WSL path as a managed Codex home if it lives under the canonical Orca account storage layout. Also rethrown (with cause) at service.ts:1510 when the in-WSL canonicalization check fails, and at service.ts:1517 for path traversal ('..') in the linux path.

Source

Thrown at src/main/codex-accounts/service.ts:1463

  }

  private pathsEqual(left: string, right: string): boolean {
    const resolvedLeft = resolve(left)
    const resolvedRight = resolve(right)
    if (process.platform === 'win32') {
      return resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
    }
    return resolvedLeft === resolvedRight
  }

  private assertManagedHomePath(candidatePath: string, expectedAccountId?: string): string {
    const wslInfo = parseWslUncPath(candidatePath)
    if (wslInfo) {
      if (
        !wslInfo.linuxPath.includes('/.local/share/orca/codex-accounts/') ||
        !wslInfo.linuxPath.endsWith('/home')
      ) {
        throw new Error('Managed WSL Codex home is outside Orca account storage.')
      }
      if (
        expectedAccountId !== undefined &&
        !wslInfo.linuxPath.endsWith(`/.local/share/orca/codex-accounts/${expectedAccountId}/home`)
      ) {
        throw new Error('Managed WSL Codex home does not match its persisted account ID.')
      }

      if (process.platform === 'win32') {
        try {
          const canonicalLinuxPath = execFileSync(
            'wsl.exe',
            [
              '-d',
              wslInfo.distro,
              '--',
              'bash',
              '-lc',

View on GitHub (pinned to 1136503c6a)

Solutions

Do not hand-edit managedHomePath in settings; let Orca create/own these paths under <userData>/codex-accounts and $HOME/.local/share/orca/codex-accounts.
If the path is genuinely stale, remove the account and re-add it so Orca recreates a valid managed home.
For the rethrow-with-cause variant (line 1510), inspect error.cause for the underlying wsl.exe failure (marker missing, readlink failure, distro unreachable).
Ensure no symlinks relocate the managed home outside the managed root.

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate a WSL managed-home path layout before trusting it.
const info = parseWslUncPath(path)
if (!info || !info.linuxPath.includes('/.local/share/orca/codex-accounts/') ||
    !info.linuxPath.endsWith('/home') || info.linuxPath.split('/').includes('..')) {
  throw new Error('Path is not an Orca-managed WSL Codex home.')
}

Try / catch

try {
  service.assertManagedHomePath?.(path, accountId) // internal; usually reached via service methods
} catch (error) {
  if (error instanceof Error && error.message === 'Managed WSL Codex home is outside Orca account storage.') {
    // remove/re-add the account to recreate a valid managed home
  } else throw error
}

Prevention

Never hand-edit managedHomePath in settings.
Keep managed homes under the canonical Orca layout; avoid symlinking them outside the root.

When it happens

Trigger: A managed home path persisted in settings (or passed to assertManagedHomePath) is a WSL UNC path that is not under the Orca codex-accounts/<id>/home layout, contains '..' traversal, or fails the in-WSSL readlink/marker verification (the catch at 1509).

Common situations: Settings file manually edited to point managedHomePath at an arbitrary WSL location; a corrupted or migrated account record whose wslLinuxHomePath drifted; symlink tricks that make readlink -f resolve outside the managed root (caught by the wsl.exe case-statement guard).

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/d624582b3375e3f6. Report an issue: GitHub.