[verify-packaged-plugin-resources] manifest identity does…

Error message

[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}

What it means

Thrown by the packaged plugin resource verifier when the plugin manifest (orca-plugin.json) inside the plugin directory has a publisher.id identity that does not match the pluginKey recorded in the bundled-plugins.json index. The check constructs `${manifest.publisher}.${manifest.id}` and compares it to entry.pluginKey. A mismatch means the manifest and index disagree about the plugin's identity, which would cause runtime lookup failures or loading the wrong plugin.

Solutions

Compare the manifest's publisher.id with the index's pluginKey for the offending entry: cat <pluginRoot>/orca-plugin.json and grep pluginKey <launchRoot>/bundled-plugins.json.
If the manifest was intentionally renamed, re-run the indexing step so bundled-plugins.json picks up the new identity.
If the index is correct and the manifest is wrong, fix orca-plugin.json to match.
Ensure the indexing script derives pluginKey from the manifest's publisher.id at index time, so they cannot diverge.

Defensive patterns

Strategy: validation

Validate before calling

// Before packaging, verify manifest identity matches the index key.
const { readFileSync } = require('node:fs')
const { join } = require('node:path')

function preCheckManifestIdentity(launchRoot, entry) {
  const manifest = JSON.parse(
    readFileSync(join(launchRoot, entry.path, 'orca-plugin.json'), 'utf8')
  )
  const computedKey = `${manifest.publisher}.${manifest.id}`
  return { ok: computedKey === entry.pluginKey, computedKey, expected: entry.pluginKey }
}

Prevention

Derive pluginKey from the manifest at indexing time so the index and manifest cannot diverge.
If renaming a plugin (publisher or id), update the manifest first, then re-run indexing to regenerate the index.
Add a CI check that compares every manifest's publisher.id against the index's pluginKey before packaging.

When it happens

Trigger: The orca-plugin.json manifest was edited (publisher or id renamed) but bundled-plugins.json was not regenerated; the indexing script computed pluginKey differently from how it appears in the manifest; two plugins were swapped in the directory but the index still references the old identity.

Common situations: A plugin was renamed (e.g., publisher changed from 'acme' to 'corp') and only the manifest was updated, not the index; a copy-paste error during plugin scaffolding left the wrong publisher/id in the manifest; the indexing script uses a different field or formatting for pluginKey than the manifest's publisher.id.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/100e6f528fb0e708. Report an issue: GitHub.

Appendix: source

Thrown at config/scripts/verify-packaged-plugin-resources.cjs:96

    throw new Error('[verify-packaged-plugin-resources] bundled plugin index is empty or invalid')
  }
  const resolvedRoot = resolve(launchRoot)
  for (const entry of index.plugins) {
    if (
      typeof entry?.pluginKey !== 'string' ||
      typeof entry.path !== 'string' ||
      !/^[0-9a-f]{64}$/.test(entry.contentHash)
    ) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin entry is invalid')
    }
    const pluginRoot = resolve(launchRoot, entry.path)
    const fromRoot = relative(resolvedRoot, pluginRoot)
    if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
      throw new Error('[verify-packaged-plugin-resources] bundled plugin path escapes launch root')
    }
    const manifest = readJsonFile(join(pluginRoot, 'orca-plugin.json'), 'plugin manifest')
    if (`${manifest.publisher}.${manifest.id}` !== entry.pluginKey) {
      throw new Error(
        `[verify-packaged-plugin-resources] manifest identity does not match ${entry.pluginKey}`
      )
    }
    if (hashPackagedPluginTree(pluginRoot) !== entry.contentHash) {
      throw new Error(
        `[verify-packaged-plugin-resources] packaged bytes do not match ${entry.pluginKey}`
      )
    }
  }
  console.log(
    `[verify-packaged-plugin-resources] OK — verified ${index.plugins.length} bundled plugin(s)`
  )
}

module.exports = { verifyPackagedPluginResources }

View on GitHub (pinned to 1136503c6a)