Security advisory — Malicious litellm versions 1.82.7 and 1.82.8 were removed from PyPI (potential API key exfiltration). Uninstall them, rotate exposed credentials, and upgrade to a safe release (e.g. 1.82.9+). Run pip show litellm to verify. PyPI · README

Troubleshooting Guide

Common issues and remediations. Fuller script notes: ../scripts/README.md.

Troubleshooting Guide

Common issues and remediations. Fuller script notes: ../scripts/README.md.


Startup and environment

SymptomCauseRemedy
start-dev.sh reports missing AUTH_JWT_*bootstrap not run, or PEM deletedbash scripts/bootstrap.sh
Portal chat history operation failedPG/Redis not runningbash scripts/start-dev-with-infra.sh
Port 3000/3001/8088 in useleftover processlsof -i :8088 then kill
Turbo TUI Ctrl+C does nothingTUI captures the signalEsc then q, or --ui=stream
Manual pnpm portal login missing JWT key*_FILE not expandedSee local-dev.md for the manual export

Login and IAM

SymptomCauseRemedy
admin password rejectedpassword env changed after seedRe-run bootstrap or reset-dev-data.sh --with-seed
staff@... Invalid credentialsno such seed userUse owner, or create the user from admin
Portal has no models to selectno visible models assigned / PG emptyAdmin model services + user-visible models; or migrate:legacy-runtime
IAM 403insufficient scopeSee rbac/scopes.md

Gateway and models

SymptomCauseRemedy
Only mock repliesno KeyConfigure a Provider in admin, or set env *_API_KEY
Policy not blockingwrong snapshot path / unpublishedConfirm the policy-snapshot path; publish in admin; restart gateway
Rule saved but still inactiveplaceholder userIds do not matchLeave applies_to empty, or fill real ids
blocked=false but Block was selectedtest API used the old action in the DBUse /api/policy/test, which merges the form preview
Channel unhealthywrong GATEWAY_INTERNAL_BASE_URL portAlign 8088 and the internal token

Policy and audit

SymptomCauseRemedy
After reset --full, no policy hitssnapshot clearedRe-publish in admin + restart gateway
Admin has audit, PG pending growingPG briefly unavailablerunbooks/audit-pg-backfill.md
Department audit 403missing audit:read:deptUpgrade role scopes

SSO

SymptomCauseRemedy
SSO button not shownNEXT_PUBLIC_SSO_PROVIDERS not setSet the env and fully restart the Next process
oidc.discovery_failedissuer unreachable or placeholderSelf-check with pnpm sso:oidc-smoke
Changing SSO env has no effectNext hot reload does not read envFully restart admin + portal

Runbooks: sso-oidc-setup.md · sso-saml-setup.md


Vercel split deployment

SymptomCauseRemedy
Gateway empty providerswrong GATEWAY_REMOTE_* URL / token mismatchinternal-api.md
Portal 0 history rows, admin has datadifferent DATABASE_URLCheck Vercel env
Token always 0usage not written backConfirm gateway DATABASE_URL and portal share the same DB

Checklist: deployment/vercel-env-checklist.md


E2E / visual

SymptomCauseRemedy
chromium not foundPlaywright not installedpnpm visual-tour:install
visual-tour timeoutdev server not up / passwords not exportedRun start-dev.sh first, then export the login passwords

Log locations

ComponentLog
Gateway audit JSONLapps/gateway/.runtime/audit/
Gateway metering JSONLGATEWAY_USAGE_LOG or apps/gateway/.runtime/usage.jsonl
PG pending auditapps/gateway/.runtime/audit/.pg-pending
Local quota.runtime/gateway/quota-usage.json

Database migrations

db:migrate fails with almost no error in the terminal

Symptom: pnpm --filter @agenticx/db-schema db:migrate or bootstrap.sh exits at the migrate stage with

Exit status 1 / ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL. The terminal only shows a one-line failure summary — no concrete SQL error.

If the log stops here:

text
1postgres is ready
2running db:migrate
3...
4ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL ... drizzle-kit migrate

Docker and Postgres are already up; the failure is the database migration. Do not keep re-running bootstrap.sh. Get the underlying error first.

Step 1: Read the on-disk script logs

bash
1cd enterprise
2ls -lt .runtime/logs/
3tail -n 120 .runtime/logs/bootstrap-*.log
4tail -n 120 .runtime/logs/db-migrate-*.log 2>/dev/null || true
5docker logs --tail=120 agenticx-postgres-dev

The terminal summary is not the root cause. The real PostgreSQL error is usually in .runtime/logs/bootstrap-*.log, db-migrate-*.log, or the Postgres container logs.

Step 2: Check whether you only removed the image, not the database

Docker images and Postgres data volumes are different things. After docker rmi or “clear images”, old database data usually remains in the Docker volume. Old tables, half-finished migrations, or old migration records can still make db:migrate fail.

If a development / POC environment can wipe the database, take the rebuild path:

bash
1cd enterprise
2bash scripts/bootstrap.sh --reset-db
3bash scripts/start-dev-with-infra.sh --ui=stream

--reset-db deletes the local Postgres data volume and recreates the database. Do not use this in environments that must keep data.

Step 3: When you cannot wipe the database, keep the scene and keep investigating

bash
1cd enterprise
2docker ps
3docker exec -it agenticx-postgres-dev psql -U postgres -d agenticx -c '\dt'
4docker exec -it agenticx-postgres-dev psql -U postgres -d agenticx -c 'select * from drizzle.__drizzle_migrations order by created_at desc limit 5;'

If drizzle.__drizzle_migrations is missing or the schema does not match expectations, send the output together with the logs.

Step 4: Check for concurrent migrations

If you see many CREATE TABLE waiting or too many clients already at the same time, see the PostgreSQL DDL lock-wait Runbook. This is usually multiple processes / replicas running migrations at once, not normal application traffic.


Getting help

  1. Confirm DATABASE_URL points at the expected database (especially since reset scripts echo the URL)
  2. curl --noproxy '*' http://127.0.0.1:8088/healthz
  3. Admin GET /api/gateway/health
  4. Gateway process logs (--ui=stream mode)

Made-with: Damon Li