stablyai/orca · error · Error

${response.error.code}: ${response.error.message}

Error message

${response.error.code}: ${response.error.message}

What it means

Thrown when the `pairing.provisionRelay` RPC returns `!response.ok` during credential rotation. The message is the server's own error code and message (e.g. `auth_failed: ...`), surfaced verbatim so the operator can see why the relay server refused to install the new resume token hash.

Source

Thrown at mobile/src/transport/mobile-relay-credential-rotation.ts:57

    })
    // Why: a crash or lost response must leave enough material to query the
    // one global install key before any second authorization attempt.
    await args.writeBundle(bundle)
  }

  const pending = bundle.pending
  if (!pending) {
    throw new Error('relay credential rotation pending state missing')
  }
  let endpoints = await getEndpoints(args.client, pending.reqId)
  if (endpoints.installStatus?.state !== 'committed') {
    const response = await args.client.sendRequest('pairing.provisionRelay', {
      reqId: pending.reqId,
      newResumeTokenHash: pending.hash,
      expectedCurrentHash: bundle.current.hash
    })
    if (!response.ok) {
      throw new Error(`${response.error.code}: ${response.error.message}`)
    }
    const installed = DeviceCredentialInstalledSchema.parse(response.result)
    endpoints = await getEndpoints(args.client, pending.reqId)
    if (
      endpoints.installStatus?.state !== 'committed' ||
      JSON.stringify(endpoints.installStatus.result) !== JSON.stringify(installed)
    ) {
      throw new Error('relay credential rotation was not authoritatively committed')
    }
  }
  if (!endpoints.relay || endpoints.installStatus?.state !== 'committed') {
    throw new Error('relay credential rotation endpoint state missing')
  }
  const installed = endpoints.installStatus.result
  const next = MobileRelayCredentialBundleSchema.parse({
    ...bundle,
    current: {
      token: pending.token,

View on GitHub (pinned to 1136503c6a)

Solutions

  1. Re-read the credential bundle from disk and retry once — another rotation may have advanced `current`.
  2. If the error code indicates `expected_current_hash_mismatch`, abandon the rotation and resync from pairing.
  3. For transient server errors, retry with backoff bounded by the rotation window.

Example fix

// before
try { await rotateMobileRelayCredential({ client, bundle, writeBundle }) }
catch (e) { throw e } // bubbles raw

// after
try { return await rotateMobileRelayCredential({ client, bundle, writeBundle }) }
catch (e) {
  if (e.message.startsWith('expected_current_hash_mismatch')) {
    bundle = await readMobileRelayCredentialBundle(hostId) ?? bundle
    return await rotateMobileRelayCredential({ client, bundle, writeBundle })
  }
  throw e
}
Defensive patterns

Strategy: retry

Validate before calling

// Refresh the bundle before rotation to reduce stale expectedCurrentHash:
bundle = (await readMobileRelayCredentialBundle(hostId)) ?? bundle

Type guard

function isStaleHashError(e: unknown): boolean { return e instanceof Error && e.message.startsWith('expected_current_hash_mismatch') }

Try / catch

try { return await rotateMobileRelayCredential({ client, bundle, writeBundle }) } catch (e) { if (isStaleHashError(e)) { bundle = (await readMobileRelayCredentialBundle(hostId)) ?? bundle; return await rotateMobileRelayCredential({ client, bundle, writeBundle }) } throw e }

Prevention

When it happens

Trigger: Server rejected `provisionRelay` because `expectedCurrentHash` does not match the currently installed credential; the install `reqId` is unknown or already consumed; authorization failure on the device token; transient server error.

Common situations: Concurrent rotation attempts racing on the same `expectedCurrentHash`; a stale bundle whose `current.hash` was already superseded by another rotation; server restart that lost the pending install state.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/4512552e9b148a5d. Report an issue: GitHub.