{"record":{"id":"57c141fc53f49506","repo":"langgenius/dify","slug":"accessdenied","errorCode":"AccessDenied","errorMessage":"no workspaces available to switch to","messagePattern":"no workspaces available to switch to","errorType":"error_code","errorClass":"BaseError","httpStatus":null,"severity":"error","filePath":"cli/src/commands/use/workspace/use.ts","lineNumber":72,"sourceCode":"  deps.io.out.write(`${cs.successIcon()} Switched to ${detail.name} (${detail.id})\\n`)\n  return deps.reg\n}\n\nasync function pickWorkspaceId(client: WorkspacesClient, deps: UseWorkspaceDeps): Promise<string> {\n  if (!deps.io.isErrTTY) {\n    throw new BaseError({\n      code: ErrorCode.UsageMissingArg,\n      message: 'a workspace id is required (no TTY)',\n      hint: \"pass the id: 'difyctl use workspace <id>'\",\n    })\n  }\n\n  const list = await runWithSpinner({ io: deps.io, label: 'Loading workspaces' }, () =>\n    client.list(),\n  )\n  const items = list.workspaces.map<Workspace>((w) => ({ id: w.id, name: w.name, role: w.role }))\n  if (items.length === 0) {\n    throw new BaseError({\n      code: ErrorCode.AccessDenied,\n      message: 'no workspaces available to switch to',\n    })\n  }\n\n  const activeId = deps.active.ctx.workspace?.id\n  const picked = await selectFromList<Workspace>({\n    io: deps.io,\n    items,\n    header: 'Select a workspace',\n    render: (w) => `${w.id === activeId ? '* ' : '  '}${w.name} (${w.role})`,\n  })\n  return picked.id\n}\n","sourceCodeStart":54,"sourceCodeEnd":87,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/cli/src/commands/use/workspace/use.ts#L54-L87","documentation":"Thrown after the workspace list is fetched successfully but contains zero entries. The code uses AccessDenied (exit code 4, the Auth bucket) because the account effectively has no workspace it can switch to. It is a server-state condition, not a parser error: client.list() returned an empty workspaces array. Note this fires only on the no-id interactive path; with an explicit id the code skips the list and goes straight to client.switch(id), which would surface a different error if the id is invalid.","triggerScenarios":"Account exists but belongs to no workspaces (new signup before workspace provisioning, removed from all workspaces, or an instance where the user is only a member of the default workspace that was deleted). Reached when `client.list()` resolves with `list.workspaces` of length 0 at use.ts:70-71. The picker is then unreachable because there is nothing to render.","commonSituations":"Freshly created account on a self-hosted Dify instance where workspace provisioning is pending or failed; user was removed from their last workspace; SSO-provisioned account whose workspace mapping hasn't synced; test/staging account that never joined a workspace; a personal workspace that an admin deleted.","solutions":["Have an admin invite the account to a workspace, or accept a pending invitation via the Dify UI/API.","Create a workspace if the account is allowed to (`difyctl workspaces create <name>` if supported), then re-run `difyctl use workspace`.","Confirm the account you logged in with is the one you expect: `difyctl whoami` — a wrong or service account often has no workspaces.","Check the instance endpoint with `difyctl workspaces list -o json` to confirm the empty list isn't a transient API issue; if list itself errors, investigate auth/network first."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// pre-fetch the workspace list and short-circuit on empty with a domain-specific message\nconst list = await client.list()\nif (list.workspaces.length === 0) {\n  // surface a friendlier message than the raw 'no workspaces available'\n  throw new BaseError({ code: ErrorCode.AccessDenied, message: 'account has no workspaces; ask an admin to invite you' })\n}\nconst items = list.workspaces.map((w) => ({ id: w.id, name: w.name, role: w.role }))","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify membership with `difyctl workspaces list` before scripting a switch.","In onboarding flows, ensure workspace provisioning completes before the user runs `use workspace`.","Distinguish 'no workspaces' from 'auth failure' by checking auth state first (`difyctl whoami`)."],"tags":["cli","workspace","auth","access-denied","empty-state"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}