What causes "Refusing to place the disposable validation root inside the primary home (${primaryHome}). Pass --temp-parent or set ORCA_CODEX_VALIDATION_TEMP_PARENT to a directory outside it." in stablyai/orca?

Pass --temp-parent pointing to a directory outside your home, e.g. --temp-parent /var/tmp on Linux or a drive root on Windows.

stablyai/orca · error · Error

Refusing to place the disposable validation root inside the

Error message

Refusing to place the disposable validation root inside the primary home (${primaryHome}). Pass --temp-parent <dir> or set ORCA_CODEX_VALIDATION_TEMP_PARENT to a directory outside it.

What it means

Thrown by the Codex real-account validation harness when the disposable validation root would be placed inside (or identical to) the primary home directory. The guard resolves both paths via realpath to defeat symlink smuggling, then rejects if tempParent equals or is contained within primaryHome. This prevents the validation's throwaway HOME from polluting the user's real home. On Windows the default %TEMP% lives inside %USERPROFILE%, so the guard fires there unless overridden.

Source

Thrown at config/scripts/run-codex-real-account-validation.mjs:101

    ORCA_USER_DATA_PATH: layout.userDataDir
  }
}

export async function createValidationLayout(options = {}) {
  const primaryHome = path.resolve(options.primaryHome ?? os.homedir())
  const envTempParent = process.env.ORCA_CODEX_VALIDATION_TEMP_PARENT?.trim()
  const tempParent = path.resolve(options.tempParent ?? (envTempParent || os.tmpdir()))
  // Why: guards must compare canonical paths — a symlinked temp parent must
  // not smuggle the disposable root inside the primary home.
  const [primaryHomeReal, tempParentReal] = await Promise.all([
    resolveRealPath(primaryHome),
    resolveRealPath(tempParent)
  ])
  // Why: on Windows the default %TEMP% lives inside %USERPROFILE%, which the
  // disposable-home guard below rightly refuses. Fail before creating anything
  // and point at the overrides instead of aborting with an opaque guard error.
  if (samePath(tempParentReal, primaryHomeReal) || isWithin(tempParentReal, primaryHomeReal)) {
    throw new Error(
      `Refusing to place the disposable validation root inside the primary home (${primaryHome}). ` +
        'Pass --temp-parent <dir> or set ORCA_CODEX_VALIDATION_TEMP_PARENT to a directory outside it.'
    )
  }
  const tempRoot = await mkdtemp(path.join(tempParent, 'orca-codex-real-'))
  const homeDir = path.join(tempRoot, 'home')
  const userDataDir = path.join(tempRoot, 'user-data')
  await Promise.all([
    mkdir(homeDir, { recursive: true, mode: 0o700 }),
    mkdir(userDataDir, { recursive: true, mode: 0o700 })
  ])
  const homeDirReal = await resolveRealPath(homeDir)
  if (samePath(primaryHomeReal, homeDirReal) || isWithin(homeDirReal, primaryHomeReal)) {
    throw new Error('Refusing to place the disposable validation home inside the primary home')
  }
  return { primaryHome, tempRoot, homeDir, userDataDir }
}

View on GitHub (pinned to 1136503c6a)

Solutions

Pass --temp-parent <dir> pointing to a directory outside your home, e.g. --temp-parent /var/tmp on Linux or a drive root on Windows.
Set ORCA_CODEX_VALIDATION_TEMP_PARENT to an external directory.

Example fix

// before (Windows: %TEMP% is under %USERPROFILE%)
node config/scripts/run-codex-real-account-validation.mjs
// after
node config/scripts/run-codex-real-account-validation.mjs --temp-parent C:\BuildTemp

Defensive patterns

Strategy: validation

Validate before calling

const [primaryHomeReal, tempParentReal] = await Promise.all([
  resolveRealPath(primaryHome), resolveRealPath(tempParent)
])
if (samePath(tempParentReal, primaryHomeReal) || isWithin(tempParentReal, primaryHomeReal)) {
  throw new Error('tempParent must be outside the primary home')
}

Type guard

function isOutsideHome(candidateReal, homeReal) {
  return !samePath(candidateReal, homeReal) && !isWithin(candidateReal, homeReal)
}

Prevention

On Windows, always pass --temp-parent or ORCA_CODEX_VALIDATION_TEMP_PARENT since %TEMP% lives under %USERPROFILE%.
Resolve both paths with realpath before comparing to defeat symlink-based smuggling.
Fail before creating any directories so partial state is never left behind.

When it happens

Trigger: Running on Windows without --temp-parent or ORCA_CODEX_VALIDATION_TEMP_PARENT (since %TEMP% is under %USERPROFILE%). Also fires if os.tmpdir() resolves inside the home on any platform, or if a custom tempParent is a subdirectory of the home.

Common situations: A Windows developer runs the harness for the first time; the default temp dir trips the guard. Or a symlinked temp parent resolves into the home after realpath.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/bb7b263cc120fede. Report an issue: GitHub.