stablyai/orca · error
Usage: verify-skill-update-roundtrip.mjs --cli=<version> --a
Error message
Usage: verify-skill-update-roundtrip.mjs --cli=<version> --autocrlf=true|false --shape=symlink|copy --source=<owner/repo> --ref=<git-ref>
What it means
Usage guard at the top of verify-skill-update-roundtrip.mjs: validates the five CLI options (cli version, autocrlf true/false, shape symlink|copy, source owner/repo, ref). It throws if any required option is missing or if source doesn't match the owner/repo regex. The options are also readable from SKILL_UPDATE_SOURCE / SKILL_UPDATE_REF env vars to keep PR-controlled branch refs out of the generated shell command.
Source
Thrown at config/scripts/verify-skill-update-roundtrip.mjs:38
return process.argv.find((value) => value.startsWith(`--${name}=`))?.slice(name.length + 3)
}
const cliVersion = option('cli')
const autocrlf = option('autocrlf')
const shape = option('shape')
// Why: PR branch names are untrusted workflow input. Keep them out of the
// generated shell command and pass them to Node through the environment.
const source = option('source') ?? process.env.SKILL_UPDATE_SOURCE
const ref = option('ref') ?? process.env.SKILL_UPDATE_REF
if (
!cliVersion ||
(autocrlf !== 'true' && autocrlf !== 'false') ||
(shape !== 'symlink' && shape !== 'copy') ||
!source ||
!ref ||
!/^[^/\s]+\/[^/\s]+$/.test(source)
) {
throw new Error(
'Usage: verify-skill-update-roundtrip.mjs --cli=<version> --autocrlf=true|false --shape=symlink|copy --source=<owner/repo> --ref=<git-ref>'
)
}
const sandbox = await mkdtemp(path.join(tmpdir(), 'orca-skill-update-roundtrip-'))
const home = path.join(sandbox, 'home')
const stateHome = path.join(home, '.state')
const fakeBin = path.join(sandbox, 'bin')
const targetName = 'orca-cli'
const controlName = 'orchestration'
const manifest = JSON.parse(await readFile('resources/skills/current-manifest.json', 'utf8'))
const registry = JSON.parse(await readFile('resources/skills/snapshot-registry.json', 'utf8'))
const releaseMapping = JSON.parse(await readFile('resources/skills/release-mapping.json', 'utf8'))
function currentSkill(name) {
const skill = manifest.skills.find((entry) => entry.name === name)
if (!skill) {
throw new Error(`Current manifest is missing ${name}`)View on GitHub (pinned to 1136503c6a)
Solutions
- Supply all five options with valid values: --cli=1.5.20 --autocrlf=false --shape=symlink --source=stablyai/orca --ref=v1.5.20.
- Ensure --autocrlf is exactly 'true' or 'false' and --shape is exactly 'symlink' or 'copy'.
- Ensure --source is owner/repo format (no https://, no trailing .git, no spaces).
- If passing ref via env, set SKILL_UPDATE_REF and SKILL_UPDATE_SOURCE and confirm the options block reads them.
Example fix
# before node config/scripts/verify-skill-update-roundtrip.mjs --cli=1.5.20 # after node config/scripts/verify-skill-update-roundtrip.mjs --cli=1.5.20 --autocrlf=false --shape=symlink --source=stablyai/orca --ref=v1.5.20
Defensive patterns
Strategy: validation
Validate before calling
// Validate options before delegating to the script, mirroring its own checks:
function assertRoundtripArgs({ cliVersion, autocrlf, shape, source, ref }) {
const ok = cliVersion &&
(autocrlf === 'true' || autocrlf === 'false') &&
(shape === 'symlink' || shape === 'copy') &&
typeof source === 'string' && /^[^\/\s]+\/[^\/\s]+$/.test(source) &&
typeof ref === 'string' && ref.length > 0
if (!ok) throw new Error('Invalid verify-skill-update-roundtrip args')
} Prevention
- Pass branch refs via SKILL_UPDATE_REF env, never interpolated into the command string.
- Pin the workflow input enum for --autocrlf and --shape at the workflow level (choice type).
- Validate --source is owner/repo in the workflow before calling the script.
When it happens
Trigger: Omitting one of --cli, --autocrlf, --shape, --source, --ref; passing --autocrlf=yes or --shape=link (invalid enum); passing --source with a bare repo name or full URL instead of owner/repo; passing a ref containing whitespace.
Common situations: Workflow input matrix misconfiguration; upstream caller changed option names; copy-paste of the invocation with a stale option set; ref sourced from an untrusted PR head that contains unexpected characters.
Related errors
- Usage: node config/scripts/verify-release-required-assets.mj
- Usage: node config/scripts/compare-benchmark-artifacts.mjs -
- [verify-packaged-plugin-resources] invalid ${label} at ${pat
- ${name} canonical placement did not update to the PR content
- ${targetName} provider alias was replaced with an independen
AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12).
Data as JSON: /api/errors/267e5176834d4c59.
Report an issue: GitHub.