zeroclaw-labs/zeroclaw · error · anyhow::Error

plugin archive manifest version '{}' does not match registry

Error message

plugin archive manifest version '{}' does not match registry version '{}'

What it means

The second half of verify_manifest_matches_registry: the version in the extracted manifest.toml must equal the version in the registry index entry. A mismatch bails, ensuring the installed version is exactly the reviewed/pinned one.

Source

Thrown at src/plugin_registry.rs:302

    let manifest_path = plugin_dir.join("manifest.toml");
    let manifest_toml = std::fs::read_to_string(&manifest_path)
        .with_context(|| format!("reading {}", manifest_path.display()))?;
    toml::from_str(&manifest_toml).with_context(|| format!("parsing {}", manifest_path.display()))
}

fn verify_manifest_matches_registry(
    entry: &PluginRegistryEntry,
    manifest: &PluginManifest,
) -> Result<()> {
    if manifest.name != entry.name {
        bail!(
            "plugin archive manifest name '{}' does not match registry name '{}'",
            manifest.name,
            entry.name
        );
    }
    if manifest.version != entry.version {
        bail!(
            "plugin archive manifest version '{}' does not match registry version '{}'",
            manifest.version,
            entry.version
        );
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::cell::Cell;
    use std::io::{Cursor, Write};
    use std::rc::Rc;
    use zip::write::SimpleFileOptions;

    struct CountingChunks {
        chunks: Vec<Vec<u8>>,

View on GitHub (pinned to 88bb9c8533)

Solutions

  1. Refresh the registry index and retry — a stale local index referencing an old version is the most common cause
  2. If you publish: bump manifest version, rebuild the archive, and update the entry's version (and sha256) atomically
  3. Verify manually: unzip the artifact, read manifest.toml's version, compare with the index entry
  4. For reproducible installs, prefer entries with exact version + sha256 pins and re-pin after every upstream release

Example fix

# before
# entry: { "version": "0.3.0", "url": ".../p.zip" } ; manifest.toml: version = "0.3.1"
# after: keep them in lockstep
# manifest.toml
version = "0.3.0"        # or update the entry to 0.3.1 + new sha256
# republish both together
Defensive patterns

Strategy: retry

Validate before calling

// Pin-aware pre-check when you fetch entries yourself:
let manifest = toml::from_str::<PluginManifest>(&manifest_src)?;
anyhow::ensure!(manifest.version == registry_entry.version,
    "version drift: entry {} vs manifest {}", registry_entry.version, manifest.version);

Try / catch

// On version mismatch: re-fetch the registry index and retry once — the
// classic cause is a stale index after a publisher bump. If it persists, the
// entry and artifact are out of sync at the source; stop and report.

Prevention

When it happens

Trigger: Installing a plugin where the registry entry says version "0.3.0" but the archive's manifest.toml declares a different version (e.g. "0.3.1" or "0.2.9"). Name check (error 1418) passes first; only the version differs.

Common situations: Publisher rebuilt and overwrote the artifact at the same URL after a version bump without updating the index (or vice versa); release scripts publishing index and artifact out of order; pinning attempts where the entry's version drifted from the artifact.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/c2dbea7f12237063. Report an issue: GitHub.