{"record":{"id":"2cf2b38a9d737a22","repo":"coleam00/Archon","slug":"workflow-container-resume-without-backend","errorCode":"workflow.container_resume_without_backend","errorMessage":"Run '${preCreatedRun.id}' executed inside an isolation container. Resume it from the CLI in the same project (`archon workflow approve/reject/resume <id>`), where the container is rediscovered — chat/web resume cannot rewire it.","messagePattern":"Run '(.+?)' executed inside an isolation container\\. Resume it from the CLI in the same project \\(`archon workflow approve/reject/resume <id>`\\), where the container is rediscovered — chat/web resume cannot rewire it\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/workflows/src/executor.ts","lineNumber":1866,"sourceCode":"      throw new Error(\n        `Cannot resume workflow run '${preCreatedRun.id}' with session state from run '${foreignPriorNodeSession.workflow_run_id}' (node '${foreignPriorNodeSession.node_id}')`\n      );\n    }\n  }\n\n  // Guard: a container run MUST be resumed with its container rewired (the CLI does\n  // this via backend.resumeEnv, threading a `container` context). A resume that\n  // reaches here for a container run WITHOUT that context — e.g. approving a\n  // --container run from chat/web, which has no docker backend wired — would run\n  // host-side and SILENTLY skip the write-back apply, losing the approved changes.\n  // Fail loudly and point at the CLI instead; the run stays resumable (failed) so\n  // the CLI can rediscover the container and apply.\n  if (preCreatedRun?.metadata?.isolation === 'container' && !containerCtx) {\n    const msg =\n      `Run '${preCreatedRun.id}' executed inside an isolation container. Resume it from the ` +\n      'CLI in the same project (`archon workflow approve/reject/resume <id>`), where the ' +\n      'container is rediscovered — chat/web resume cannot rewire it.';\n    getLog().warn({ workflowRunId: preCreatedRun.id }, 'workflow.container_resume_without_backend');\n    await safeSendMessage(platform, conversationId, `⚠️ ${msg}`);\n    await requireTerminalStatusWrite(deps.store.failWorkflowRun(preCreatedRun.id, msg), {\n      workflowRunId: preCreatedRun.id,\n      site: 'workflow.container_resume_guard_fail_failed',\n    });\n    return { success: false, workflowRunId: preCreatedRun.id, error: msg };\n  }\n\n  let runConfigMetadata: WorkflowRunConfigMetadata | undefined;\n  let effectiveRunConfig: WorkflowRunConfigInput | undefined;\n  try {\n    if (isContinuation) {\n      runConfigMetadata = readWorkflowRunConfigMetadata(preCreatedRun.metadata);\n      if (runConfigMetadata) {\n        if (!deps.unsealRunConfig) {\n          throw new Error('This Archon build cannot restore persisted workflow run config.');\n        }\n        effectiveRunConfig = {","sourceCodeStart":1848,"sourceCodeEnd":1884,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/workflows/src/executor.ts#L1848-L1884","documentation":"A workflow run that executed inside a container-isolation context can only be resumed where the isolation container can be rediscovered — which only the CLI run in the same project can do. When a resume/approve/reject arrives through a path without a container backend (containerCtx is null) for a run marked metadata.isolation === 'container', the executor refuses: it warns the user, fails the run, and returns failure rather than resuming outside its container.","triggerScenarios":"Attempting resume/approve/reject of a run whose metadata.isolation === 'container' via chat/web platform paths (or any resume without containerCtx) at executor.ts:1866, or running the CLI resume from a different project directory where the container cannot be rediscovered.","commonSituations":"Operator approves a paused container-isolated workflow from Slack/Discord or the Web UI; CLI resume executed from the wrong working directory; the isolation container was deleted so even a correct-channel resume cannot rediscover it.","solutions":["Run `archon workflow approve/reject/resume <runId>` from the CLI in the same project directory where the run originally executed so the container is rediscovered.","Verify the isolation container still exists and is reachable from that project; restore/recreate it if removed.","If the container is unrecoverable, explicitly fail or cancel the run and start a new run.","Treat container-isolated runs as CLI-only for lifecycle operations; hide or redirect chat/web resume actions for them."],"exampleFix":"// before: approving from web/chat -> run fails with this guard\n// after: resume from the original project via CLI\n$ cd /path/to/original/project\n$ archon workflow approve <runId>","handlingStrategy":"validation","validationCode":"// Check isolation metadata and choose the right channel before resuming:\nif (run.metadata?.isolation === 'container' && !isCliResume) {\n  throw new Error('Container-isolated runs must be resumed via CLI in the original project');\n}","typeGuard":"function requiresCliResume(run: { metadata?: { isolation?: string } }): boolean {\n  return run.metadata?.isolation === 'container';\n}","tryCatchPattern":"try {\n  await resumeRun(runId);\n} catch (e) {\n  if (String(e?.message ?? e).includes('isolation container')) {\n    console.error('Resume via: archon workflow resume ' + runId + ' (from the original project directory)');\n  } else {\n    throw e;\n  }\n}","preventionTips":["Only approve/resume container-isolated runs from the CLI in the project that owns the container.","Keep the isolation container alive until all its paused runs are terminal.","Surface isolation metadata in chat/web UIs and disable or redirect resume actions for container runs.","Don't operate on a run from a different project directory than where it executed."],"tags":["workflow","resume","container","isolation"],"backgroundTag":"container-resume-not-supported","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}