---
title: "Work session troubleshooting"
description: "Resolve work session refusals, approval waits, expiry, CLI errors, missing accounts, and extension failures. Find the message and the next step to take."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Work session troubleshooting

Find the message you see below. A request refused on submission, a request waiting for review, and an expired session need different actions.

## Your request is refused

Before submitting, check the result card and the server-specific account warnings on the request form. If the session cannot start, review the selected servers, account, and features.

If submission fails, use the error code and message to find the next step:

The CLI also refuses an agent request containing `websh` with `"websh" is not allowed for agent sessions`. Request `command` and use `alpacon exec` instead.

If an approver rejects the request, the page shows "Request denied" with the time it was denied and asks you to make another request if the work still needs doing. The page does not show the reason. Ask the approver before requesting again. See [Access rules](/use/approvals/#access-rules).

## Your request is held

"Waiting for approval" means the session is still . The page shows when approvers were notified and says, "You can start working as soon as it's approved." Wait for the [people authorized to approve](/use/approvals/#who-may-approve-a-request); a scheduled session also needs to reach its start time.

In the CLI, `work-session create --wait` prints `Waiting for approval...`. If it prints `timed out waiting for approval after 5m0s`, the CLI stopped waiting; this does not mean the request was rejected. Check the session's status before submitting again. Use `--wait-approval DURATION` to choose a longer wait when creating a request.

The wait can also end with one of these messages:

| CLI message | Next step |
| --- | --- |
| `work session was rejected` | Ask the approver about the decision. |
| `work session expired while waiting for approval` | Request another session. |
| `work session was revoked` | Ask an administrator before requesting access again. |
| `work session was cancelled` | Submit another request if you still need access. |

To stop your pending request, choose "Cancel request" or run [`alpacon work-session cancel`](/reference/cli/work-session/cancel/). Only the requester or a Superuser can cancel it. A request can also be cancelled automatically if it lapses before review or its requested end time passes.

## The session expired mid-task

A web terminal shows **Your work session expired, so the session ended.**. The API error `work_session_expired` says: **This work session expired, so the access it gave you is gone. Start a new work session to continue.**.

For command execution, the CLI can print:

```text
Error: the command operation requires an active WorkSession on this authentication.
```

The reason is `selected session has expired`, and the command exits with code `3`.

Request another session, wait for any required approval, and reconnect. An expired session cannot be extended. The session's terminal, file transfer, port forwarding, and editor connections close; pending extensions do not keep them open. Review [Session history](/use/audit/sessions/) before continuing the task.

For future work, act on the warning within the last 10 minutes before expiry and [request an extension](/use/work-sessions/detail/#extending-with-approval) while the session is still usable.

## You can't attach from the CLI

These messages identify different attachment problems:

| CLI output | Next step |
| --- | --- |
| `work-session  is in '<status>' state and cannot be used` | Check its status. Wait for approval or activation; if it has ended, request another session. |
| `work-session  is an agent session and is not workspace-attachable; agent sessions run non-interactively via their assigned token` | Pass `--work-session ID` on each agent command instead of using `work-session use` or `--use`. |
| `this CLI runs under an AI agent, and the work session is a user session—create an agent session with 'alpacon work-session create' and pass its ID with --work-session` | Create an agent session and pass its ID on each command. |
| `no WorkSession selected for this shell` | For a person's active session, run `alpacon work-session use ID`. For an agent session, pass `--work-session ID`. |

Access refusals such as `work_session_required` exit with code `3`. Websh requires a user login with `alpacon login` without `-t`. See [`work-session use`](/reference/cli/work-session/use/).

## The account is missing on a server

The session page can disable launch with “No `{account}` account” or “No account of yours”. If no feature can open, it shows **Nothing can run with this session's servers and connect-as account. Ask an admin to create the account, or change the connect-as account.**.

At connection time, `server_username_groupname_invalid` says: **Username or group name is not registered or you don't have permission.**. With `exec` and no `-u`, the CLI can instead say `no execution user was resolved for '<server>' server` and suggest `-u USERNAME`.

Check the chosen account under **Connect as**. Ask an administrator to create it on the affected server, or choose "Change account" on the session page to request another account. The account change takes effect after approval. Adding `-u USERNAME` only selects the execution account; it does not create one or grant permission to use it.

Your own account can be created on first connection on Linux. This does not happen on macOS or Windows. Set your [username](/use/iam/users/username/) if it is missing, and ask an administrator to check the server account. See [Account or permission problems](/use/work-sessions/troubleshoot-connections/#account-does-not-exist-or-you-do-not-have-permission).

## Your extension was rejected

An extension needs a reason, a session that has started and has not expired, and an end time within the workspace limit. These errors occur before the extension can take effect:

The CLI gives more specific instructions for three errors:

| Error | CLI message |
| --- | --- |
| `work_session_extension_reason_required` | `Pass --reason "..." describing why you need more time, and retry.` |
| `work_session_extension_already_pending` | `Work session  already has an extension request pending approval; wait for it to be decided before asking again. Find its id with 'alpacon work-session describe  --output json' (field pending_extension_request.id).` |
| `work_session_admission_denied` | `This workspace refuses this extension outright; ask an admin to adjust the work-session admission policy.` |

An extension that entered the approval queue can still fail:

- An approver rejects it. The notification title is `Your {request_type} on {target} was rejected`, with `work session extension` as the request type. The session page does not show the reason; ask the approver.
- The request lapses, or the session ends before a decision. Its current end time remains in effect. Request an extension again only if the session has not expired; otherwise request another session.
- The connect account becomes linked to another person. Further shells and commands using that account are refused, and the session cannot be extended. Ask an administrator to review the account assignment.

See [Extending with approval](/use/work-sessions/detail/#extending-with-approval) and [Error messages](/reference/error-messages/).

## Related docs

- [Request a session](/use/work-sessions/create/)
- [Use a session](/use/work-sessions/detail/)
- [Live activity](/use/live-activity/)
- [Session history](/use/audit/sessions/)

Source: https://docs.alpacax.com/use/work-sessions/troubleshooting/