Fix: workflow approve/resume discovery for worktree runs (#1663)

When a workflow paused at an approval gate is resumed via `workflow approve` or
`workflow resume`, the CLI re-invoked `workflowRunCommand` with `run.working_path`
as the discovery cwd. If `working_path` is a worktree or workspace clone that
does not contain the user's local (often untracked) workflow YAML, discovery
failed with "Workflow 'foo' not found" before execution could begin.

Separate the discovery path from the execution path by adding an optional
`discoveryCwd` to `WorkflowRunOptions`. Resume, approve, and reject now look up
the codebase and pass `codebase.default_cwd` as `discoveryCwd`, so the source
repo is searched even when `working_path` lives elsewhere. The execution cwd
and the existing `findResumableRun` keying are unchanged.

Changes:
- Add `WorkflowRunOptions.discoveryCwd`; use it for `loadWorkflows` in
  `workflowRunCommand`
- `workflowResumeCommand`, `workflowApproveCommand`, and `workflowRejectCommand`
  resolve `codebase.default_cwd` (with graceful fallback) and pass it through
- Tests covering discovery from `codebase.default_cwd` and fallback to
  `working_path` when no codebase is available

Fixes #1663

Author: Wirasm

packages/cli/src/commands/workflow.test.ts

@@ -1850,12 +1850,81 @@ describe('workflowResumeCommand', () => {
       // downstream failure is acceptable
     }
 
-    // Verify warn was called (not error — it's a soft fallback)
+    // Verify warn was called (not error — it's a soft fallback). The resume
+    // layer now does its own codebase lookup for `discoveryCwd`, so the warn
+    // is emitted with the resume-specific event name.
     expect(mockLogger.warn).toHaveBeenCalledWith(
       expect.objectContaining({ codebaseId: 'cb-bad' }),
-      'cli.codebase_id_lookup_failed'
+      'cli.workflow_resume_codebase_lookup_failed'
     );
   });
+
+  it('should discover workflows from codebase.default_cwd, not working_path', async () => {
+    // Regression test for #1663: when working_path is a worktree or workspace
+    // clone that lacks the user's local workflow YAML, discovery must fall back
+    // to codebase.default_cwd so the file is still found.
+    const workflowDb = await import('@archon/core/db/workflows');
+    const codebaseDb = await import('@archon/core/db/codebases');
+    const workflowDiscovery = await import('@archon/workflows/workflow-discovery');
+
+    (workflowDb.getWorkflowRun as ReturnType<typeof mock>).mockResolvedValueOnce({
+      id: 'run-1663',
+      workflow_name: 'my-approval-workflow',
+      status: 'failed',
+      user_message: 'go',
+      working_path: '/tmp/worktree-without-yaml',
+      codebase_id: 'cb-with-yaml',
+    });
+
+    (codebaseDb.getCodebase as ReturnType<typeof mock>).mockResolvedValueOnce({
+      id: 'cb-with-yaml',
+      name: 'owner/repo',
+      default_cwd: '/users/me/source-repo-with-yaml',
+    });
+
+    const discoverSpy = workflowDiscovery.discoverWorkflowsWithConfig as ReturnType<typeof mock>;
+    discoverSpy.mockClear();
+    discoverSpy.mockResolvedValueOnce({ workflows: [], errors: [] });
+
+    try {
+      await workflowResumeCommand('run-1663');
+    } catch {
+      // downstream failure is acceptable — we only need to assert the discovery cwd
+    }
+
+    // Discovery must use the codebase source path, NOT working_path
+    expect(discoverSpy).toHaveBeenCalledWith(
+      '/users/me/source-repo-with-yaml',
+      expect.any(Function)
+    );
+  });
+
+  it('should fall back to working_path for discovery when codebase_id is missing', async () => {
+    const workflowDb = await import('@archon/core/db/workflows');
+    const workflowDiscovery = await import('@archon/workflows/workflow-discovery');
+
+    (workflowDb.getWorkflowRun as ReturnType<typeof mock>).mockResolvedValueOnce({
+      id: 'run-no-codebase',
+      workflow_name: 'legacy',
+      status: 'failed',
+      user_message: 'go',
+      working_path: '/tmp/old-worktree',
+      codebase_id: null,
+    });
+
+    const discoverSpy = workflowDiscovery.discoverWorkflowsWithConfig as ReturnType<typeof mock>;
+    discoverSpy.mockClear();
+    discoverSpy.mockResolvedValueOnce({ workflows: [], errors: [] });
+
+    try {
+      await workflowResumeCommand('run-no-codebase');
+    } catch {
+      // downstream failure is acceptable
+    }
+
+    // No codebase → falls back to working_path (preserves existing behavior)
+    expect(discoverSpy).toHaveBeenCalledWith('/tmp/old-worktree', expect.any(Function));
+  });
 });
 
 describe('workflowApproveCommand', () => {
@@ -1971,6 +2040,51 @@ describe('workflowApproveCommand', () => {
     expect(conversationsDb.getConversationById).toHaveBeenCalledWith('db-uuid-original');
     expect(conversationsDb.getOrCreateConversation).toHaveBeenCalledWith('cli', 'cli-original-123');
   });
+
+  it('should discover workflows from codebase.default_cwd, not working_path', async () => {
+    // Regression test for #1663: auto-resume after approve must look up the
+    // workflow YAML in the source repo (codebase.default_cwd), not the
+    // worktree/workspace working_path that may lack the file.
+    const workflowDb = await import('@archon/core/db/workflows');
+    const codebaseDb = await import('@archon/core/db/codebases');
+    const workflowDiscovery = await import('@archon/workflows/workflow-discovery');
+    const core = await import('@archon/core');
+
+    (workflowDb.getWorkflowRun as ReturnType<typeof mock>).mockResolvedValueOnce({
+      id: 'run-approve-1663',
+      workflow_name: 'my-approval-workflow',
+      status: 'paused',
+      user_message: 'go',
+      working_path: '/tmp/worktree-without-yaml',
+      codebase_id: 'cb-with-yaml',
+      metadata: { approval: { nodeId: 'gate', message: 'Approve?' } },
+    });
+
+    (core.createWorkflowStore as ReturnType<typeof mock>).mockReturnValueOnce({
+      createWorkflowEvent: mock(() => Promise.resolve()),
+    });
+
+    (codebaseDb.getCodebase as ReturnType<typeof mock>).mockResolvedValueOnce({
+      id: 'cb-with-yaml',
+      name: 'owner/repo',
+      default_cwd: '/users/me/source-repo-with-yaml',
+    });
+
+    const discoverSpy = workflowDiscovery.discoverWorkflowsWithConfig as ReturnType<typeof mock>;
+    discoverSpy.mockClear();
+    discoverSpy.mockResolvedValueOnce({ workflows: [], errors: [] });
+
+    try {
+      await workflowApproveCommand('run-approve-1663');
+    } catch {
+      // downstream failure is acceptable
+    }
+
+    expect(discoverSpy).toHaveBeenCalledWith(
+      '/users/me/source-repo-with-yaml',
+      expect.any(Function)
+    );
+  });
 });
 
 describe('workflowAbandonCommand', () => {

packages/cli/src/commands/workflow.ts

@@ -63,6 +63,12 @@ export interface WorkflowRunOptions {
   noWorktree?: boolean;
   resume?: boolean;
   codebaseId?: string; // Passed by resume/approve to skip path-based lookup
+  /**
+   * Override the directory used for workflow YAML discovery. Resume/approve
+   * pass `codebase.default_cwd` here so the source repo is searched even when
+   * `working_path` is a worktree or workspace clone that lacks the file.
+   */
+  discoveryCwd?: string;
   quiet?: boolean;
   verbose?: boolean;
   /** Platform conversation ID (e.g. `cli-{ts}-{rand}`), NOT a DB UUID. */
@@ -279,7 +285,7 @@ export async function workflowRunCommand(
   userMessage: string,
   options: WorkflowRunOptions = {}
 ): Promise<void> {
-  const { workflows: workflowEntries, errors } = await loadWorkflows(cwd);
+  const { workflows: workflowEntries, errors } = await loadWorkflows(options.discoveryCwd ?? cwd);
 
   if (workflowEntries.length === 0 && errors.length === 0) {
     throw new Error('No workflows found in .archon/workflows/');
@@ -1014,13 +1020,31 @@ export async function workflowResumeCommand(runId: string): Promise<void> {
   console.log(`Path: ${run.working_path}`);
   console.log('');
 
+  // Use the codebase's source path for workflow YAML discovery so the file is
+  // found even when working_path is a worktree or workspace clone that does
+  // not contain the user's local (often untracked) workflow YAML.
+  let discoveryCwd: string | undefined;
+  if (run.codebase_id) {
+    try {
+      const codebase = await codebaseDb.getCodebase(run.codebase_id);
+      if (codebase) discoveryCwd = codebase.default_cwd;
+    } catch (error) {
+      const err = error as Error;
+      getLog().warn(
+        { err, errorType: err.constructor.name, runId, codebaseId: run.codebase_id },
+        'cli.workflow_resume_codebase_lookup_failed'
+      );
+    }
+  }
+
   // Re-execute via workflowRunCommand with --resume.
   // The executor's implicit findResumableRun detects the prior failed run
   // and skips already-completed nodes.
   try {
     await workflowRunCommand(run.working_path, run.workflow_name, run.user_message ?? '', {
       resume: true,
       codebaseId: run.codebase_id ?? undefined,
+      discoveryCwd,
     });
   } catch (error) {
     const err = error as Error;
@@ -1079,11 +1103,29 @@ export async function workflowApproveCommand(runId: string, comment?: string): P
     );
   }
 
+  // Use the codebase's source path for workflow YAML discovery so the file is
+  // found even when working_path is a worktree or workspace clone that does
+  // not contain the user's local (often untracked) workflow YAML.
+  let discoveryCwd: string | undefined;
+  if (result.codebaseId) {
+    try {
+      const codebase = await codebaseDb.getCodebase(result.codebaseId);
+      if (codebase) discoveryCwd = codebase.default_cwd;
+    } catch (error) {
+      const err = error as Error;
+      getLog().warn(
+        { err, errorType: err.constructor.name, runId, codebaseId: result.codebaseId },
+        'cli.workflow_approve_codebase_lookup_failed'
+      );
+    }
+  }
+
   try {
     await workflowRunCommand(result.workingPath, result.workflowName, result.userMessage ?? '', {
       resume: true,
       codebaseId: result.codebaseId ?? undefined,
       conversationId: platformConversationId,
+      discoveryCwd,
     });
   } catch (error) {
     const err = error as Error;
@@ -1139,11 +1181,29 @@ export async function workflowRejectCommand(runId: string, reason?: string): Pro
     );
   }
 
+  // Use the codebase's source path for workflow YAML discovery so the file is
+  // found even when working_path is a worktree or workspace clone that does
+  // not contain the user's local (often untracked) workflow YAML.
+  let discoveryCwd: string | undefined;
+  if (result.codebaseId) {
+    try {
+      const codebase = await codebaseDb.getCodebase(result.codebaseId);
+      if (codebase) discoveryCwd = codebase.default_cwd;
+    } catch (error) {
+      const err = error as Error;
+      getLog().warn(
+        { err, errorType: err.constructor.name, runId, codebaseId: result.codebaseId },
+        'cli.workflow_reject_codebase_lookup_failed'
+      );
+    }
+  }
+
   try {
     await workflowRunCommand(result.workingPath, result.workflowName, result.userMessage ?? '', {
       resume: true,
       codebaseId: result.codebaseId ?? undefined,
       conversationId: platformConversationId,
+      discoveryCwd,
     });
   } catch (error) {
     const err = error as Error;