Troubleshooting

Dream big, build fast. Common issues and fixes for admins and end users.

The console / dashboard freezes (“Page unresponsive”, “Wait / Exit page”)

Cause: a browser extension (commonly JumpCloud Password Manager, or other managed extensions) scans the page and calls String methods on element.className. AgentWatch renders icons as inline <svg>, whose className is an SVGAnimatedString object — the extension throws on it and loops on every render, pegging the tab.

Fix: upgrade to 2.0.197+ — AgentWatch ships a compatibility shim that makes those calls safe, so the extension no longer throws. No user action after upgrading.

If it still happens on an old build: open in an Incognito window (extensions off) to confirm, or temporarily disable the offending extension. Reload with Cmd/Ctrl+Shift+R to recover a frozen tab.

The admin console slows down or stops loading while a Connect installer downloads

Who sees this: only a super administrator or tenant administrator who has the AgentWatch admin console (dashboard) open in the same browser that is downloading a Connect installer from the enrollment portal. Employees downloading from the portal are not affected, and neither is anyone else using the console.

Cause: the browser and HTTP/2, not the AgentWatch server. A browser sends every request to one host over a single HTTP/2 connection. The installer is large (60-80 MB), and while it downloads, the dashboard’s requests share that same connection and wait behind installer data that is already queued on it. The dashboard then loads very slowly, or seems not to load at all. The server is not blocked and keeps answering everyone else normally. Measured on 2.0.372: a dashboard load took about 8 s normally and 30-38 s in the same browser during a download. During the same test it still took about 8 s from a separate connection, and about 8 s even with the server delivering the installer at 170-310 MB/s.

Fix: open the admin console in a different browser (for example Edge while the download runs in Chrome). A different browser opens its own connection, so the console works normally. Or wait for the download to finish; the console recovers on its own. No setting or server change is needed.

Expected behavior (2.0.198+): sessions are persistent for 7 days by default (30 days with “Keep me signed in,” checked by default) and survive browser restarts. You should only be re-prompted after that window or on explicit logout.

If you’re re-prompted within minutes, the browser is almost certainly clearing cookies/site-data on exit — common on managed browsers. Check:

Chrome: Settings → Privacy → Cookies → "Clear cookies and site data when you close all windows" — turn off for this site, or
Enterprise policy: ClearBrowsingDataOnExitList / ClearBrowsingDataOnExit in the managed-browser config.

AgentWatch cannot keep a session if the browser deletes its own storage on close — that’s a browser policy, not an app setting. Admins can tune the default session length with AUTH_SESSION_DAYS (default 7) and AUTH_REMEMBER_DAYS (default 30).

See SAML setup guide → Troubleshooting. Most common: an expired IdP certificate (regenerate it in the IdP and re-import), or a build older than 2.0.198 (upgrade — SP-initiated SAML was fixed there).

The “Test” button says “OIDC discovery failed” for a SAML provider

Upgrade to 2.0.198+ — the SSO Test is now protocol-aware and runs a SAML check (validates the IdP URL + certificate) instead of OIDC discovery.

I can only enter a logo URL — can I upload a file?

Yes, on 2.0.198+: the SSO provider wizard has an “upload a logo file” picker (PNG/JPG/SVG/GIF/WebP/ICO, ≤512 KB) — no CDN URL required.

claude.ai web loops on “Performing security verification” (Cloudflare)

claude.ai is behind Cloudflare’s managed bot-challenge. When its traffic is decrypted (MITM) and leaves from a datacenter egress IP (the AgentWatch gateway), Cloudflare flags it and loops the “Verifying…” challenge, so login never completes. This is a property of Cloudflare’s bot protection, not an AgentWatch defect — a server-side MITM egress cannot reliably satisfy the challenge.

What to do:

Fastest: stop intercepting the claude.ai web app — in Admin → Agent Fleet / Tracked Domains, disable claude.ai. The Connect client then stops redirecting it, so it loads normally. You lose claude.ai web-chat content inspection (you keep it for everything else).
To still govern Claude: use the Anthropic API path (route api.anthropic.com through AgentWatch with a gateway key) — API traffic isn’t behind the interactive Cloudflare challenge, so it’s fully inspected and attributed.
Company-managed devices with an on-endpoint (residential) egress are less likely to be challenged than a shared datacenter egress.

A single chat message shows up as several Usage-Insights rows

Fixed in 2.0.204+. A web-chat app fires many background calls per message (autocomplete, model list, prepare/init, stream-status, telemetry); AgentWatch now records only the real message-send turn, so one message = one row. Upgrade to 2.0.204+.