{"record":{"id":"4b5d45607c9d2d83","repo":"Tencent/WeKnora","slug":"connect-owned-remote-sandbox-w","errorCode":null,"errorMessage":"connect owned remote sandbox: %w","messagePattern":"connect owned remote sandbox: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_lifecycle.go","lineNumber":313,"sourceCode":"\t\treturn left.StartedAt.Before(right.StartedAt)\n\t})\n\n\tfor _, summary := range summaries {\n\t\tif summary.ID == \"\" || summary.State == RemoteStateTerminal {\n\t\t\tcontinue\n\t\t}\n\t\tif !metadataMatches(summary.Metadata, metadata) {\n\t\t\treturn nil, false, fmt.Errorf(\n\t\t\t\t\"remote provider returned sandbox %q outside metadata filter\",\n\t\t\t\tsummary.ID,\n\t\t\t)\n\t\t}\n\t\thandle, err := l.client.Connect(ctx, summary.ID)\n\t\tif err != nil {\n\t\t\tif CanReplaceRemoteBinding(err) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\treturn nil, false, fmt.Errorf(\"connect owned remote sandbox: %w\", err)\n\t\t}\n\t\tif err := l.validateHandle(handle, summary.ID); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\tif err := l.cleanupOwnedDuplicates(ctx, summaries, summary.ID, metadata); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\ttemplateID := summary.TemplateID\n\t\tif templateID == \"\" {\n\t\t\ttemplateID = l.createRequest.TemplateID\n\t\t}\n\t\tbinding := l.newBinding(key, summary.ID, templateID, summary.StartedAt)\n\t\tcreated, err := l.bindings.Create(ctx, key, binding)\n\t\tif err != nil {\n\t\t\treturn nil, false, fmt.Errorf(\"bind owned remote sandbox: %w\", err)\n\t\t}\n\t\tif created {\n\t\t\treturn handle, true, nil","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_lifecycle.go#L295-L331","documentation":"This error wraps a failure from client.Connect when attaching to a candidate sandbox found during orphan recovery. The sandbox passed the metadata check, but the connect failed with a non-replaceable error, so recovery aborts with 'connect owned remote sandbox: %w' rather than continuing to the next candidate or silently creating a new sandbox.","triggerScenarios":"client.Connect(ctx, summary.ID) returns an error during the recovery loop where CanReplaceRemoteBinding(err) is false — connection refused/timeout, TLS failures, auth errors, or the sandbox being in a state the provider cannot connect to. Note that replaceable errors just 'continue' to the next summary; this error is raised for everything else.","commonSituations":"Orphaned sandbox whose host was decommissioned or scaled down; network egress blocked to the sandbox endpoint; provider incident; credentials valid for List but not Connect (scoped tokens); sandbox in a failed/errored state not reported as terminal.","solutions":["Inspect the wrapped error; if transient, retry resolution with backoff","Delete or terminate the unreachable orphaned sandbox via the provider console/API so a fresh one is created on next resolve","Check credential scope — token may allow list but not connect","Verify network/firewall egress to the sandbox connect endpoint"],"exampleFix":"// before\nhandle, err := session.Resolve(ctx, key) // connect owned remote sandbox: i/o timeout\n// after\nif err != nil {\n    providerClient.Terminate(ctx, orphanedSandboxID) // remove bad orphan\n    handle, err = session.Resolve(ctx, key)          // creates a fresh sandbox\n}","handlingStrategy":"retry","validationCode":"// pre-check candidate sandboxes are connectable before relying on recovery\nfor _, s := range ownedSummaries {\n    if s.State == sandbox.RemoteStateTerminal { continue } // skip dead orphans\n}","typeGuard":"func recoverable(summary sandbox.RemoteSandboxSummary) bool {\n    return summary.ID != \"\" && summary.State != sandbox.RemoteStateTerminal\n}","tryCatchPattern":"handle, err := session.Resolve(ctx, key)\nif err != nil && strings.HasPrefix(err.Error(), \"connect owned remote sandbox:\") {\n    // terminate the bad orphan then retry; a fresh sandbox will be created\n    _ = terminateOrphans(ctx, client, key)\n    handle, err = session.Resolve(ctx, key)\n}","preventionTips":["Reap orphaned sandboxes periodically via the provider API","Scope tokens to include both list and connect permissions","Monitor egress connectivity to sandbox endpoints","Set sandbox TTLs so dead orphans expire automatically"],"tags":["network","connection","sandbox-recovery","orphaned-sandbox"],"backgroundTag":"connection-refused","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}