`workspace create --ui` never produces a workspace - leaves an orphaned `keboola.sandboxes` config behind

[vojvojtech]

Summary

kbagent workspace create --ui fails for us in every combination we tried. It never returns a usable workspace, and each attempt leaves an orphaned keboola.sandboxes configuration in the project that the CLI does not roll back. The headless path (workspace create without --ui) works on the first try, so this is specific to the Queue/sandbox-service route.

Stack: connection.eu-central-1.keboola.com · backend: Snowflake · kbagent v0.93.1 (reported up to date)

Two distinct failure modes

1. With an active dev branch (kbagent branch use --project <alias> --branch <dev-branch-id>)

Error: API error 400 from https://queue.eu-central-1.keboola.com:
Cannot resolve job parameters: Configuration "01m27xypgtn5tv8rymyr1htd8s" not found

The configuration does exist — and it exists in the dev branch. Verified with:

$ kbagent config delete --project <alias> --component-id keboola.sandboxes \
    --config-id 01m27xypgtn5tv8rymyr1htd8s --dry-run
DRY RUN -- would move config keboola.sandboxes/01m27xypgtn5tv8rymyr1htd8s to the
trash (branch <dev-branch-id>) (restorable via 'config restore')

So the config is created in the dev branch, but the Queue job appears to resolve it without branch context.

2. On the default branch (Main)

$ kbagent --json workspace create --project <alias> --name "test" --ui
{"status":"error","error":{"code":"WORKSPACE_NOT_FOUND","error_type":"api",
 "message":"Sandbox job completed but no workspace found for config 01m27y9653cfqqwakbz3bjbtq2",
 "retryable":false}}

Here the job succeeds:

$ kbagent job list --project <alias> --limit 1
Job ID       Status    Component          Config ID   Duration
1019482...   success   keboola.sandboxes  01m27y5...  17s

…but no Storage workspace is ever attached to the config:

$ kbagent config detail --project <alias> --component-id keboola.sandboxes --config-id 01m27y5qfpwxv7w1zaafkxce82
...
Sandbox / Workspace mapping:
  parameters.id (sandbox-service): 985852010
  Storage workspace ID: none (no workspace currently backed by this config -- orphan sandbox)

Reproduction

kbagent workspace create --project <alias> --name "repro" --ui          # Main   -> WORKSPACE_NOT_FOUND
kbagent branch use --project <alias> --branch <dev-branch-id>
kbagent workspace create --project <alias> --name "repro" --ui          # branch -> 400 Cannot resolve job parameters
kbagent workspace create --project <alias> --name "repro"               # works, both branches

Expected

--ui returns a provisioned, UI-visible workspace — or fails without leaving state behind.

Actual

No workspace in either branch. Three attempts left three orphaned keboola.sandboxes configs that had to be cleaned up by hand:

kbagent config delete --project <alias> --component-id keboola.sandboxes --config-id <id>

Note that workspace list --orphaned / workspace gc do not cover this case — they detect the inverse (a workspace row whose sandbox config is gone). Here the config exists and the workspace does not, so the debris is invisible to gc.

Impact

--ui is the only documented way to get a workspace that shows up in the Keboola UI Workspaces tab (Option C in the workspace-workflow reference). With it broken, an agent working under a "every workspace must be visible to the team" rule has no working path and has to fall back to a human creating the workspace by hand in the UI.

Suggested fixes

1. Pass branch context when queuing the sandbox job, so the dev-branch config resolves.
2. Poll/await sandbox-service provisioning before declaring WORKSPACE_NOT_FOUND, or surface the sandbox-service error if provisioning genuinely failed.
3. Roll back (or offer to delete) the keboola.sandboxes config when --ui creation fails, so failed attempts don't accumulate.
4. Optionally extend workspace gc to also detect sandbox configs with no backing workspace.