Troubleshooting

Find your symptom, try the quick check, and open the full fix if that doesn’t solve it.

Getting started

Symptom	Quick check	Full fix
You want to try CloudThinker before connecting production	Connect a staging or sandbox account with a read-only role first.	Quickstart
You can’t find where to add a connection	In the sidebar, click More → Workspace settings → Connections.	Add a connection
An agent can’t find a connection you added	Connections belong to one workspace. Check the workspace name in the sidebar.	Workspaces
A new connection’s Discovery section is still empty	Discovery runs once per connection, for up to 30 minutes. It pauses if the credit balance is too low.	After you connect
Optimize shows no cost data after a scan	On a new AWS account, Cost Explorer can take up to 24 hours to start, and it lags usage by 24 to 48 hours.	Optimize quickstart

Symptom	Quick check	Full fix
A user can’t sign in after you required SSO	Is the user assigned to the CloudThinker app in your IdP?	SSO
Your IdP reports an invalid ACS or reply URL, or an audience mismatch	The values must match exactly: `https://`, no trailing slash, case-sensitive.	SAML SSO
”Redirect URI mismatch”, Issuer Match or Discovery Reachable fails	Copy `issuer` straight from the discovery document. The issuer must be reachable from the public internet.	OIDC SSO
A user wasn’t provisioned, or someone who left can still sign in	Look for a `FAILED` entry in View sync logs. Unassign leavers on the app itself, not only the group.	SCIM
The invite button says Seats full, or you can’t remove a member	Pending invitations use seats too. Admins can’t remove other Admins or the Owner.	Organization
A teammate can’t see a workspace	Developers and Viewers only see workspaces they were added to.	Workspaces
The person isn’t in the Add Member list	They may not be in the organization yet, or they’re an organization Owner or Admin who already has access.	Workspace members
A Viewer can’t type in the chat	Viewers are read-only. Change their Workspace Role to Developer.	Workspace members

Connections, chat and commands

Symptom	Quick check	Full fix
A connection won’t verify, or shows Error	Open the connection: the detail panel shows the error. Fix the cause at the provider, then click Retry or Replace credentials.	When a connection breaks, then your provider: AWS, Azure, GCP, Kubernetes, GitHub
A command doesn’t expand, or the `/` menu shows Nothing matches	A skill with the same name wins the slug. Check the slug’s spelling on More → Workspace settings → Commands.	Commands
A credential name is rejected, or you can’t see the `$` picker	Keys take uppercase letters, digits and underscores only. The `$` picker needs the workspace Admin role.	Credentials
The Slack bot doesn’t reply, or answers with the wrong account	Is the bot in the channel (`/invite @CloudThinker`), and did you mention it in a new message?	Slack
The Teams bot doesn’t reply, or a team isn’t linked to a workspace	Your Teams admin settings may block custom apps.	Microsoft Teams

Approvals and automations

Symptom	Quick check	Full fix
A write still asks you even though a Rule allows it	The run uses Manual, which asks before every write.	Approvals
You don’t see the Approve button	Viewers can’t approve, and a Rule may send the ask to a group you aren’t in. The card names who can.	Approvers
An automation refused a write instead of asking	Automations default to Auto · Rules + AI · Refuse. Pick an Ask me choice, which works today. An Allow Rule for that write helps only once Rule enforcement is on for your workspace.	Approval mode FAQ
A run sits on Required Approval, or an automation turned itself off	Open the run’s conversation from Runs. Ten failed runs in a row turn an automation off.	Autonomous operations
The run succeeded but nothing posted in Slack	Read the run’s conversation first. Then check Slack is on for Agent alerts in Notifications.	Automation quickstart

Products

Resolve handles production incidents. Its intake layer, Pulse, takes alerts from your tools and groups them into clusters. Review reviews pull requests. Optimize covers cloud cost. Cyber tests your applications for security flaws. Memory is what CloudThinker remembers about your workspace between chats.

Symptom	Quick check	Full fix
Resolve: Pulse shows No signals yet	Check your monitoring tool’s delivery log, then paste the webhook URL again and fire a test alert.	Alerts not arriving
Resolve: every alert opens its own cluster	A repeat joins the open cluster only when source, alert type and resource ID all match.	Clusters not forming
Resolve: incidents wait in Not started	On duty is paused. Check the header of Resolve → Investigation.	Investigation not starting
Resolve: analysis failed, or an investigation looks stuck	Click Watch live on the incident. If the timeline is moving, it isn’t stuck.	Investigation stuck
Resolve: a runbook command waits for approval or was blocked	Commands from Confluence, GitHub and GitLab always require approval.	Runbook not running
Review didn’t post on a pull request	Draft PRs aren’t reviewed. Check the repository’s Review switch in Review → Settings → Repositories.	No comment on a new PR
Review shows Reconnect your Git provider	Click the alert’s button and reconnect, or paste a new token with the same scopes.	Provider auth errors
Optimize: a spike you can see in your cloud console isn’t listed	Compare the date with Billing data through. New accounts need 14 finalized days first.	Anomalies
Optimize: the findings total is $0 or doesn’t match Overview	A Service filter on Findings changes the total. Clear it.	Savings
Cyber: target ownership stays at Needs proof, or protected pages aren’t tested	Some DNS providers append the zone name, so the domain appears twice in the TXT record name.	Cyber quickstart
Cyber: a fixed finding came back, or Awaiting retest never clears	A later scan proved the problem again. Open the app’s Runs link to see which run.	Cyber findings
Memory shows Not ready yet, or an edit says the item changed	Click Retry after a few seconds, or Reload and make the edit again.	Memory

Workers and the CLI

Symptom	Quick check	Full fix
The Worker shows Offline, or verification failed	Run `cloudthinker worker status --outpost <name>`, or `cloudthinker worker doctor` in the folder.	Workers
A teammate gets `EXECUTOR_TARGET_PRIVATE`	They tried to use your personal Worker. Create a shared Worker instead.	Workers
`cloudthinker: command not found`	The shell started before `~/.local/bin` was added to `PATH`. Open a new shell.	CLI overview
A command says you are not logged in (exit code 3)	The credential is missing or expired. Run `cloudthinker login`, then `cloudthinker whoami`.	CLI authentication
A headless run exits with code 5	The run paused for an approval. Open its `web_url` and decide.	Headless chat
A headless prompt is rejected as too long	The prompt plus piped input is over 50,000 characters.	Headless chat

Every CLI exit code (0 to 5, and 130) and what to do about it is in Exit codes.

Admin and billing

Symptom	Quick check	Full fix
You don’t see Audit Logs, or the export has fewer rows than expected	Audit Logs needs the organization Admin role. Events older than 90 days are deleted.	Audit logs
A guardrail pattern won’t save, or Guardrails isn’t in Admin Settings	The error names the check that failed. Saving needs the workspace Admin role, and Admin Settings is in the menu only for organization Owners and Admins. A workspace Admin who is neither opens Guardrails from a direct link.	Custom guardrails
You can’t change the workspace BYOK setting	You aren’t a workspace Admin, or the Owner requires the organization key everywhere. The page says which.	BYOK
A workspace kept spending past its credit limit	That’s expected on Notify only, which never blocks. Switch the workspace to Throttle to stop paid spend at the limit.	How enforcement works
A workspace stopped running agents but chat still works	It’s on Throttle and hit its limit, so only free daily credits are left.	Credit limits

Collect diagnostics

Check these before you ask for help. They often show the cause on their own.

Automation run: open it from Runs and read its conversation for the error.
Incident: click Watch live to see each check as it runs.
Connection: open it. The detail panel shows the last error.
Who changed what: Admin Settings → Audit Logs (organization Admin role, Scale plan or higher).
CLI: cloudthinker whoami and cloudthinker auth status show who you’re logged in as and your saved workspaces. For a headless run, cloudthinker chat status <run_id> shows its state.
Worker: cloudthinker worker doctor in the Worker’s folder prints what failed and how to fix it.

Still stuck?

Ask in the CloudThinker Discord or contact us. Include:

Your workspace name
What you expected, and what happened instead
What you clicked, or the command you ran
The exact error text, and the run ID if there is one
When it happened, with your time zone

Glossary

Look up any CloudThinker term.

FAQ

Answers to common questions about plans, data and access.

Start here

Learn the basics

Help

Work where you are

Getting started

Connections, chat and commands

Approvals and automations

Products

Workers and the CLI

Admin and billing

Collect diagnostics

Still stuck?

Glossary

FAQ

​Getting started

​Sign-in, SSO and members

​Connections, chat and commands

​Approvals and automations

​Products

​Workers and the CLI

​Admin and billing

​Collect diagnostics

​Still stuck?

​Related

Glossary

FAQ

Getting started

Sign-in, SSO and members

Connections, chat and commands

Approvals and automations

Products

Workers and the CLI

Admin and billing

Collect diagnostics

Still stuck?

Related