stablyai/orca · error · Error

post-rebase verify failed for moved user hook ${invalid.newK

Error message

post-rebase verify failed for moved user hook ${invalid.newKey}

What it means

Thrown by repairUserHookTrust after config/batchWrite reapplied trust when the verify hooks/list shows at least one moved hook whose state doesn't match what was requested: either the hook is missing under newKey, its trustStatus !== 'trusted' when wasTrusted, or its enabled flag differs from the captured value. The rebase failed to fully restore trust/enable state, so it aborts rather than report success.

Source

Thrown at src/main/codex/codex-user-hook-trust-rebase-client.ts:190

    }
    await requestRpc('config/batchWrite', { edits, reloadUserConfig: true })

    const verified = await requestRpc('hooks/list', { cwds: [request.hooksListCwd] })
    const verifiedByKey = matchingListings(
      collectCodexHookListings(verified),
      request.moves,
      'newKey'
    )
    const invalid = request.moves.find((move) => {
      const listing = verifiedByKey.get(normalizeHookTrustKeyForLookup(move.newKey))
      return (
        !listing ||
        (listing.trustStatus === 'trusted') !== move.wasTrusted ||
        listing.enabled !== move.enabled
      )
    })
    if (invalid) {
      throw new Error(`post-rebase verify failed for moved user hook ${invalid.newKey}`)
    }
    return {
      outcome: 'repaired',
      repaired: request.moves.filter((move) => move.wasTrusted).length
    }
  })
}

export function runCodexUserHookTrustRebaseSession(
  request: CodexUserHookTrustRebaseRequest
): Promise<CodexUserHookTrustRebaseResult> {
  return request.operation === 'inspect-user-hook-trust'
    ? inspectUserHookTrust(request)
    : repairUserHookTrust(request)
}

View on GitHub (pinned to 1136503c6a)

Solutions

Re-run inspect to capture a fresh currentHash from codex, then repair — don't reuse a stale hash.
Confirm config/batchWrite with reloadUserConfig:true is honored by this codex version.
Check quotedKeyPath escaping for keys containing backslashes/quotes.
Ensure no concurrent hook-trust mutation runs during the verify window.
If codex's trust model changed, update the rebase client to match the new hooks.state schema.

Defensive patterns

Strategy: try-catch

Validate before calling

// Re-capture currentHash from a fresh hooks/list right before batchWrite:
const fresh = collectCodexHookListings(await requestRpc('hooks/list', { cwds: [hooksListCwd] }))
const move = request.moves.find((m) => /* matched by newKey */)
const freshHash = fresh.find((l) => l.key === move.reportedOldKey ?? move.newKey)?.currentHash
if (!freshHash) { /* abort; state changed */ }

Try / catch

try {
  await runCodexUserHookTrustRebaseSession(request)
} catch (error) {
  if (error instanceof Error && error.message.startsWith('post-rebase verify failed for moved user hook')) {
    // re-inspect to get a fresh currentHash; retry repair once with the fresh hash
  } else throw error
}

Prevention

Always capture currentHash immediately before batchWrite, not from a stale inspect.
Confirm reloadUserConfig:true is applied so verify sees the new trust.
Prevent concurrent trust mutations during the verify window.
Verify quotedKeyPath escaping for keys with backslashes or quotes.
Update the rebase client when codex changes its hooks.state/trust schema.

When it happens

Trigger: config/batchWrite's hooks.state edit was rejected or partially applied by codex (e.g., hash mismatch because codex recomputed a different currentHash); the hook's enabled flag didn't stick; a concurrent edit changed trust state between write and verify; codex's trust computation differs from the hash captured at inspect time.

Common situations: codex version changed its trusted_hash algorithm so the captured currentHash no longer verifies; reloadUserConfig didn't fully apply; another tool toggled the hook's enabled/trust between batchWrite and verify; the hooks.state keyPath escaping in quotedKeyPath is wrong for a key with special chars.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/5298d7187d9de8be. Report an issue: GitHub.