Work session troubleshooting
Find the message you see below. A request refused on submission, a request waiting for review, and an expired session need different actions.
Your request is refused
Before submitting, check the result card and the server-specific account warnings on the request form. If the session cannot start, review the selected servers, account, and features.
If submission fails, use the error code and message to find the next step:
| Code | Meaning | What to do |
|---|---|---|
work_session_admission_denied# | "This workspace's policy doesn't allow a work session on these servers. Ask an admin to review the rule." An access rule refuses the requested session. | Ask a Superuser to review the access rule for these servers. |
approval_no_other_approver# | "This request was rejected because nobody but the requester can approve it. Ask an admin to add another approver or an auto-approve rule." The request needs an approver other than you, but none is available. | Ask a Superuser to add another approver or an auto-approve rule. |
work_session_agent_not_allowed# | "This workspace's approval policy doesn't allow this agent. Use an allowed agent, or ask a security admin to allow it." The requesting AI agent is not allowed. | Use an allowed agent, or ask a security admin to allow this agent. |
work_session_scope_not_allowed# | "This feature isn't in the work session's scope, or the session's requester type can't use it. Check the session's scope on its page." At request time, this can mean an AI agent requested the web terminal. | Remove websh from an agent request; use command and alpacon exec for command execution. |
target_account_other_person# | "This account is linked to another person on at least one of the selected servers, so no session can run as it. Choose your own account or a shared account." | Choose your own account or a shared account. |
work_session_expires_exceeds_max_ttl# | "The session duration exceeds the maximum allowed time limit." | Request less time, or ask a Superuser to raise the maximum in the web console. |
The CLI also refuses an agent request containing websh with "websh" is not allowed for agent sessions. Request command and use alpacon exec instead.
If an approver rejects the request, the page shows “Request denied” with the time it was denied and asks you to make another request if the work still needs doing. The page does not show the reason. Ask the approver before requesting again. See Access rules.
Your request is held
“Waiting for approval” means the session is still Pending. The page shows when approvers were notified and says, “You can start working as soon as it’s approved.” Wait for the people authorized to approve; a scheduled session also needs to reach its start time.
In the CLI, work-session create --wait prints Waiting for approval.... If it prints timed out waiting for approval after 5m0s, the CLI stopped waiting; this does not mean the request was rejected. Check the session’s status before submitting again. Use --wait-approval DURATION to choose a longer wait when creating a request.
The wait can also end with one of these messages:
| CLI message | Next step |
|---|---|
work session was rejected | Ask the approver about the decision. |
work session expired while waiting for approval | Request another session. |
work session was revoked | Ask an administrator before requesting access again. |
work session was cancelled | Submit another request if you still need access. |
To stop your pending request, choose “Cancel request” or run alpacon work-session cancel. Only the requester or a Superuser can cancel it. A request can also be cancelled automatically if it lapses before review or its requested end time passes.
The session expired mid-task
A web terminal shows Your work session expired, so the session ended.. The API error work_session_expired says: This work session expired, so the access it gave you is gone. Start a new work session to continue..
For command execution, the CLI can print:
Error: the command operation requires an active WorkSession on this authentication.The reason is selected session has expired, and the command exits with code 3.
Request another session, wait for any required approval, and reconnect. An expired session cannot be extended. The session’s terminal, file transfer, port forwarding, and editor connections close; pending extensions do not keep them open. Review Session history before continuing the task.
For future work, act on the warning within the last 10 minutes before expiry and request an extension while the session is still usable.
You can’t attach from the CLI
These messages identify different attachment problems:
| CLI output | Next step |
|---|---|
work-session <ID> is in '<status>' state and cannot be used | Check its status. Wait for approval or activation; if it has ended, request another session. |
work-session <ID> is an agent session and is not workspace-attachable; agent sessions run non-interactively via their assigned token | Pass --work-session ID on each agent command instead of using work-session use or --use. |
this CLI runs under an AI agent, and the work session is a user session—create an agent session with 'alpacon work-session create' and pass its ID with --work-session | Create an agent session and pass its ID on each command. |
no WorkSession selected for this shell | For a person’s active session, run alpacon work-session use ID. For an agent session, pass --work-session ID. |
Access refusals such as work_session_required exit with code 3. Websh requires a user login with alpacon login without -t. See work-session use.
The account is missing on a server
The session page can disable launch with “No {account} account” or “No account of yours”. If no feature can open, it shows Nothing can run with this session’s servers and connect-as account. Ask an admin to create the account, or change the connect-as account..
At connection time, server_username_groupname_invalid says: Username or group name is not registered or you don’t have permission.. With exec and no -u, the CLI can instead say no execution user was resolved for '<server>' server and suggest -u USERNAME.
Check the chosen account under Connect as. Ask an administrator to create it on the affected server, or choose “Change account” on the session page to request another account. The account change takes effect after approval. Adding -u USERNAME only selects the execution account; it does not create one or grant permission to use it.
Your own account can be created on first connection on Linux. This does not happen on macOS or Windows. Set your username if it is missing, and ask an administrator to check the server account. See Account or permission problems.
Your extension was rejected
An extension needs a reason, a session that has started and has not expired, and an end time within the workspace limit. These errors occur before the extension can take effect:
| Code | Meaning | What to do |
|---|---|---|
work_session_extension_reason_required# | "A reason is required to request an extension." | Enter a reason; in the CLI, pass --reason "...". |
work_session_extension_already_pending# | "An extension request for this session is already pending approval. Wait for the decision before asking again." | Wait for the pending request to be decided or to lapse. |
work_session_not_started# | "This session hasn't started yet, so it can't be extended. Wait until its start time, then try again." | Wait until the session starts before requesting an extension. |
work_session_expired# | "This work session expired, so the access it gave you is gone. Start a new work session to continue." | Request another session. An expired session cannot be extended. |
work_session_not_active# | "This action requires an active session." The session is pending or has ended. | A pending session must be admitted and started first. For an ended session, request another one. |
work_session_expires_exceeds_max_ttl# | "The session duration exceeds the maximum allowed time limit." The time between the extension request and the proposed end exceeds the workspace maximum. | Choose a shorter duration or an earlier end time. |
work_session_extend_not_later# | "The new expiration must be later than the current one." | Choose an end time later than the session’s current end time. |
work_session_admission_denied# | "This workspace's policy doesn't allow a work session on these servers. Ask an admin to review the rule." The access rule refuses the extension before review. | Ask a Superuser to review the access rule. |
The CLI gives more specific instructions for three errors:
| Error | CLI message |
|---|---|
work_session_extension_reason_required | Pass --reason "..." describing why you need more time, and retry. |
work_session_extension_already_pending | Work session <ID> already has an extension request pending approval; wait for it to be decided before asking again. Find its id with 'alpacon work-session describe <ID> --output json' (field pending_extension_request.id). |
work_session_admission_denied | This workspace refuses this extension outright; ask an admin to adjust the work-session admission policy. |
An extension that entered the approval queue can still fail:
- An approver rejects it. The notification title is
Your {request_type} on {target} was rejected, withwork session extensionas the request type. The session page does not show the reason; ask the approver. - The request lapses, or the session ends before a decision. Its current end time remains in effect. Request an extension again only if the session has not expired; otherwise request another session.
- The connect account becomes linked to another person. Further shells and commands using that account are refused, and the session cannot be extended. Ask an administrator to review the account assignment.
See Extending with approval and Error messages.