stablyai/orca · error · Error

Older relay reported an authorization error; please reconnec

Error message

Older relay reported an authorization error; please reconnect to deploy the latest relay. (${err.message})

What it means

The SSH relay is too old: it threw an authorization error whose message contains 'No workspace roots registered yet' or 'Path outside authorized workspace'. These messages were produced by relays before the filesystem-allowlist removal. Current relays no longer enforce that allowlist, so the fix is to reconnect so Orca deploys the latest relay. The code re-wraps the error with an upgrade hint rather than surfacing the raw relay message.

Source

Thrown at src/main/ipc/worktree-remote.ts:1725

  try {
    await timing.time('git_worktree_add', async () =>
      provider.addWorktree(
        repo.path,
        branchName,
        remotePath,
        checkoutExistingBranch
          ? { checkoutExistingBranch }
          : { base: baseBranch, ...(sparseDirectories.length > 0 ? { noCheckout: true } : {}) }
      )
    )
  } catch (err) {
    if (
      err instanceof Error &&
      (err.message.includes('No workspace roots registered yet') ||
        err.message.includes('Path outside authorized workspace'))
    ) {
      // Why: only OLD relays (pre-allowlist-removal) throw these; surface an upgrade message. Remove after version floor moves (docs/relay-fs-allowlist-removal.md).
      throw new Error(
        `Older relay reported an authorization error; please reconnect to deploy the latest relay. (${err.message})`
      )
    }
    throw err
  }
  if (sparseDirectories.length > 0) {
    try {
      // Why: SSH providers expose generic git exec, so remote sparse mirrors local addSparseWorktree without a new relay method.
      await provider.exec(['sparse-checkout', 'init', '--cone'], remotePath)
      await provider.exec(['sparse-checkout', 'set', '--', ...sparseDirectories], remotePath)
      await provider.exec(['checkout', branchName], remotePath)
    } catch (err) {
      if (!checkoutExistingBranch) {
        await unsetRemoteWorktreeCreationBase(provider, remotePath, branchName)
      }
      await provider
        .removeWorktree(remotePath, true, {
          deleteBranch: !checkoutExistingBranch,

View on GitHub (pinned to 1136503c6a)

Solutions

1. Disconnect and reconnect the SSH host so Orca pushes the current relay binary.
2. If reconnect doesn't update the relay, manually update Orca on the host or redeploy the relay.
3. Once the version floor moves past the allowlist-removal release, this branch can be removed (see docs/relay-fs-allowlist-removal.md).

// Check relay version capability before create
const relayVersion = await getRelayVersion(connectionId)
if (relayVersion && relayVersion.lt(ALLOWLIST_REMOVAL_MIN_VERSION)) {
  await reconnectSsh(connectionId) // triggers relay redeploy
}

function isLegacyAllowlistRelayError(err: unknown): boolean {
  return err instanceof Error && (err.message.includes('No workspace roots registered yet') || err.message.includes('Path outside authorized workspace'))
}

catch (err) {
  if (err instanceof Error && err.message.startsWith('Older relay reported an authorization error')) {
    promptReconnectToUpgradeRelay(connectionId)
  } else { throw err }
}

When it happens

Trigger: Remote create's addWorktree/setup call returns an error containing either allowlist message string. Reached in the catch at worktree-remote.ts:1725. Triggered against an SSH host still running a pre-allowlist-removal relay.

Common situations: Host connected with an old relay that predates the allowlist-removal version floor; relay auto-update disabled or failed; long-lived SSH connection established before the relay upgrade shipped.

Related errors

• SSH relay providers were not ready for target "${targetId}".
• SSH Git provider is not available. Reconnect to this target
• SSH host platform is unavailable. Reconnect the SSH target b
• SSH_TERMINATE_RECONNECT_REQUIRED
• Failed to terminate SSH host sessions: ${shutdownFailures.jo

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/18dbad443fc2462f. Report an issue: GitHub.