[verify-packaged-plugin-resources] bundled plugin entry is i

Error message

[verify-packaged-plugin-resources] bundled plugin entry is invalid

What it means

Thrown by the packaged plugin resource verifier when any entry in the bundled-plugins.json plugins array fails field-level validation. Each entry must have: pluginKey as a string, path as a string, and contentHash matching the regex /^[0-9a-f]{64}$/ (a 64-character lowercase hex SHA-256 hash). If any of these checks fail, the entry is considered invalid.

Source

Thrown at config/scripts/verify-packaged-plugin-resources.cjs:87

function verifyPackagedPluginResources(resourcesDir) {
  const launchRoot = join(resourcesDir, 'plugins', 'launch')
  if (!statSync(launchRoot).isDirectory()) {
    throw new Error(`[verify-packaged-plugin-resources] missing launch directory at ${launchRoot}`)
  }
  const index = readJsonFile(join(launchRoot, 'bundled-plugins.json'), 'bundled plugin index')
  readJsonFile(join(launchRoot, 'orca-marketplace.json'), 'marketplace index')
  if (index?.version !== 1 || !Array.isArray(index.plugins) || index.plugins.length === 0) {
    throw new Error('[verify-packaged-plugin-resources] bundled plugin index is empty or invalid')
  }
  const resolvedRoot = resolve(launchRoot)
  for (const entry of index.plugins) {
    if (
      typeof entry?.pluginKey !== 'string' ||
      typeof entry.path !== 'string' ||
      !/^[0-9a-f]{64}$/.test(entry.contentHash)
    ) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin entry is invalid')
    }
    const pluginRoot = resolve(launchRoot, entry.path)
    const fromRoot = relative(resolvedRoot, pluginRoot)
    if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin path escapes launch root')
    }
    const manifest = readJsonFile(join(pluginRoot, 'orca-plugin.json'), 'plugin manifest')
    if (`${manifest.publisher}.${manifest.id}` !== entry.pluginKey) {
      throw new Error(
        `[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}`
      )
    }
    if (hashPackagedPluginTree(pluginRoot) !== entry.contentHash) {
      throw new Error(
        `[verify-packaged-plugin-resources] packaged bytes do not match ${entry.pluginKey}`
      )
    }
  }

View on GitHub (pinned to 1136503c6a)

Solutions

Inspect each entry in bundled-plugins.json and check for missing/null fields: ensure pluginKey and path are strings and contentHash is a 64-char lowercase hex string.
If the hash is the wrong length or format, verify the indexing script uses createHash('sha256').digest('hex') (lowercase hex, 64 chars).
Re-run the plugin indexing step to regenerate the index with correct field values.
If the schema was intentionally changed, update the validation in verify-packaged-plugin-resources.cjs:82-86 to match.

Defensive patterns

Strategy: type-guard

Type guard

// Validate a single bundled plugin entry shape.
function isValidPluginEntry(entry) {
  return (
    typeof entry === 'object' &&
    entry !== null &&
    typeof entry.pluginKey === 'string' &&
    typeof entry.path === 'string' &&
    typeof entry.contentHash === 'string' &&
    /^[0-9a-f]{64}$/.test(entry.contentHash)
  )
}

Prevention

Ensure the indexing script always computes contentHash using createHash('sha256').digest('hex') to guarantee lowercase 64-char hex.
Add unit tests for the indexing script that verify every entry it produces passes the validation regex.
Never manually edit entries in bundled-plugins.json; always regenerate from the indexing pipeline.

When it happens

Trigger: An entry in bundled-plugins.json has a missing or non-string pluginKey (e.g., null, number); path is missing or not a string; contentHash is missing, not a string, uppercase, truncated, or not a valid hex SHA-256 hash (e.g., contains non-hex characters or is the wrong length).

Common situations: The indexing script was modified and stopped generating one of the required fields; a hash was computed with a different algorithm (e.g., MD5 producing 32 chars instead of SHA-256's 64); the hash was uppercased by a JSON serializer or post-processor; a manual edit to bundled-plugins.json corrupted an entry.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/9a9acd9d57b87110. Report an issue: GitHub.