[verify-packaged-plugin-resources] manifest identity does no

Error message

[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}

What it means

Thrown by the packaged plugin resource verifier when the plugin manifest (orca-plugin.json) inside the plugin directory has a publisher.id identity that does not match the pluginKey recorded in the bundled-plugins.json index. The check constructs `${manifest.publisher}.${manifest.id}` and compares it to entry.pluginKey. A mismatch means the manifest and index disagree about the plugin's identity, which would cause runtime lookup failures or loading the wrong plugin.

Source

Thrown at config/scripts/verify-packaged-plugin-resources.cjs:96

    throw new Error('[verify-packaged-plugin-resources] bundled plugin index is empty or invalid')
  }
  const resolvedRoot = resolve(launchRoot)
  for (const entry of index.plugins) {
    if (
      typeof entry?.pluginKey !== 'string' ||
      typeof entry.path !== 'string' ||
      !/^[0-9a-f]{64}$/.test(entry.contentHash)
    ) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin entry is invalid')
    }
    const pluginRoot = resolve(launchRoot, entry.path)
    const fromRoot = relative(resolvedRoot, pluginRoot)
    if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin path escapes launch root')
    }
    const manifest = readJsonFile(join(pluginRoot, 'orca-plugin.json'), 'plugin manifest')
    if (`${manifest.publisher}.${manifest.id}` !== entry.pluginKey) {
      throw new Error(
        `[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}`
      )
    }
    if (hashPackagedPluginTree(pluginRoot) !== entry.contentHash) {
      throw new Error(
        `[verify-packaged-plugin-resources] packaged bytes do not match ${entry.pluginKey}`
      )
    }
  }
  console.log(
    `[verify-packaged-plugin-resources] OK — verified ${index.plugins.length} bundled plugin(s)`
  )
}

module.exports = { verifyPackagedPluginResources }

View on GitHub (pinned to 1136503c6a)

Solutions

Compare the manifest's publisher.id with the index's pluginKey for the offending entry: cat <pluginRoot>/orca-plugin.json and grep pluginKey <launchRoot>/bundled-plugins.json.
If the manifest was intentionally renamed, re-run the indexing step so bundled-plugins.json picks up the new identity.
If the index is correct and the manifest is wrong, fix orca-plugin.json to match.
Ensure the indexing script derives pluginKey from the manifest's publisher.id at index time, so they cannot diverge.

Defensive patterns

Strategy: validation

Validate before calling

// Before packaging, verify manifest identity matches the index key.
const { readFileSync } = require('node:fs')
const { join } = require('node:path')

function preCheckManifestIdentity(launchRoot, entry) {
  const manifest = JSON.parse(
    readFileSync(join(launchRoot, entry.path, 'orca-plugin.json'), 'utf8')
  )
  const computedKey = `${manifest.publisher}.${manifest.id}`
  return { ok: computedKey === entry.pluginKey, computedKey, expected: entry.pluginKey }
}

Prevention

Derive pluginKey from the manifest at indexing time so the index and manifest cannot diverge.
If renaming a plugin (publisher or id), update the manifest first, then re-run indexing to regenerate the index.
Add a CI check that compares every manifest's publisher.id against the index's pluginKey before packaging.

When it happens

Trigger: The orca-plugin.json manifest was edited (publisher or id renamed) but bundled-plugins.json was not regenerated; the indexing script computed pluginKey differently from how it appears in the manifest; two plugins were swapped in the directory but the index still references the old identity.

Common situations: A plugin was renamed (e.g., publisher changed from 'acme' to 'corp') and only the manifest was updated, not the index; a copy-paste error during plugin scaffolding left the wrong publisher/id in the manifest; the indexing script uses a different field or formatting for pluginKey than the manifest's publisher.id.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/100e6f528fb0e708. Report an issue: GitHub.