stablyai/orca · error · Error

Managed WSL Codex home ownership marker does not match its a

Error message

Managed WSL Codex home ownership marker does not match its account ID.

What it means

Thrown by assertManagedHomePath (off-win32 branch, line 1530) when the .orca-managed-home marker exists but its trimmed content does not equal the expectedAccountId. This prevents one account's home from being read under another account's identity (a credential/account cross-contamination guard).

Source

Thrown at src/main/codex-accounts/service.ts:1530

          })
        }
      }

      if (wslInfo.linuxPath.split('/').includes('..')) {
        throw new Error('Managed WSL Codex home is outside Orca account storage.')
      }
      if (!existsSync(candidatePath)) {
        throw new Error('Managed Codex home directory does not exist on disk.')
      }
      if (!existsSync(join(candidatePath, '.orca-managed-home'))) {
        throw new Error('Managed Codex home is missing Orca ownership marker.')
      }
      if (
        expectedAccountId !== undefined &&
        readFileSync(join(candidatePath, '.orca-managed-home'), 'utf-8').trim() !==
          expectedAccountId
      ) {
        throw new Error('Managed WSL Codex home ownership marker does not match its account ID.')
      }
      return candidatePath
    }

    return assertOwnedHostCodexManagedHomePath({
      candidatePath,
      managedAccountsRoot: this.getManagedAccountsRoot(),
      systemCodexHomePath: getSystemCodexHomePath(),
      expectedAccountId
    })
  }

  private safeRemoveWslManagedHomeCandidate(
    distro: string,
    linuxHomePath: string,
    expectedAccountId: string
  ): void {
    // Why: creation can fail after mkdir/marker but before trust, so cleanup must verify the marker/account ID inside WSL.

View on GitHub (pinned to 1136503c6a)

Solutions

Re-provision the account so a fresh home is created with the correct account ID marker.
If the marker is simply stale and the home genuinely belongs to this account, remove the account and re-add it (do not hand-edit the marker to match).
Audit for duplicated/reused home directories across account rows and deduplicate.

Defensive patterns

Strategy: try-catch

Validate before calling

import { readFileSync, existsSync } from 'node:fs'
import { join } from 'node:path'

function markerMatchesAccountId(homePath: string, expectedAccountId: string): boolean {
  const marker = join(homePath, '.orca-managed-home')
  if (!existsSync(marker)) return false
  return readFileSync(marker, 'utf-8').trim() === expectedAccountId
}

if (!markerMatchesAccountId(homePath, acctId)) {
  // re-provision; do not reuse the home across accounts
}

Type guard

function isAccountIdMismatchError(error: unknown): boolean {
  return error instanceof Error && error.message === 'Managed WSL Codex home ownership marker does not match its account ID.'
}

Try / catch

try {
  await svc.readIdentityFromHome(homePath, acctId)
} catch (error) {
  if (isAccountIdMismatchError(error)) {
    await svc.removeAccount(acctId).catch(() => {})
    await svc.addAccount(provisioningOptions)
  } else {
    throw error
  }
}

Prevention

Never clone or reuse a managed home for a different account; provision a new one.
After a re-login that changes the account ID, re-provision rather than relinking.
Audit account rows for duplicated home paths.

When it happens

Trigger: assertManagedHomePath(candidatePath, expectedAccountId) where expectedAccountId is defined and readFileSync(join(candidatePath, '.orca-managed-home'),'utf-8').trim() !== expectedAccountId.

Common situations: A home directory was reused/cloned for a different account; the account ID changed after a re-login but the old home dir was kept; a backup restore paired a home with the wrong account row; manual editing of the marker file.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/cc8c6e3555024590. Report an issue: GitHub.