Chapter 10
Troubleshooting
The messages you may see, in the words the product uses, what each means and what to do.
Start here
Most problems are a copied value with a stray space, or a step done in the wrong order. Find the message, or the symptom, below.
ADVISORY · The reference code
When something fails on Cockpit's side, the message ends with a reference such as Reference: CKP-ab12cd34ef56. Quote it when you write to support@cockpitai.io: every line of that request can be found from it. Send the code and a screenshot. Never send passwords, secrets or keys.
ADVISORY
Starting over is always safe. Any connection can be disconnected and added again. Disconnecting does not delete the app or key in the other tool; revoke those there when you are done.
Sign-in and access
| What you see | What it means | What to do |
|---|---|---|
| Waiting for approval. "Cockpit is in private beta, so request access and we will email you as soon as you are in." | Your address is not approved yet. | Press Request access if you have not asked. Wait for the email. Sign in again with the same address. |
| "You signed in with a hidden Apple email..." | Apple gave Cockpit a relay address that cannot match. | Sign in with Google and the approved address, or add that address to your account and make it primary. |
| Sign-in shows a different Google account | A different browser profile is signed in. | Use a clean browser profile, or choose the right account in Google's chooser. |
| "Enter a valid email address." on Request access | The address is mistyped. | Correct it. |
| "Could not send that. Please try again in a moment." | The request did not reach Cockpit. | Send it again. |
| "Cockpit could not check your access just now. Reload in a moment." | Cockpit could not reach its service for a moment. | Reload the page. |
| "Your 7-day Pro trial has ended. You can still read everything." | The trial is over, so Cockpit is read-only: no new chats, no decisions on approvals, no connection changes. | Press Join the waitlist for paid, or write to support. |
| A connector shows as not enabled by the Captain, with no Connect button | You are in a team and your Captain has not given you that connector. | Ask your Captain (chapter 9). |
| "Your account doesn't have access to Cockpit yet. Request access at cockpitai.io/request-access." | A phone or desktop app signed in with an address that is not approved. | Request access, as in chapter 4. |
| What Google says | What it means | What to do |
|---|---|---|
| admin_policy_enforced, or "This app is blocked" | Your organisation's Google Workspace administrator blocks the app. | Ask your Workspace administrator to allow Cockpit. A personal Gmail account is not affected. |
| org_internal | Cockpit's Google settings only allow people inside one organisation. | Write to support@cockpitai.io: this is ours to fix. |
| access_denied | You pressed Cancel, or Google would not grant the permission. | Try again and press Continue, or use another Google account. |
| redirect_uri_mismatch, invalid_client, disabled_client | Cockpit's Google settings are wrong on our side. | Write to support. You cannot fix it. |
| rate_limit_exceeded | Google is limiting new sign-ins for Cockpit for a while. | Wait an hour and try again, or write to support. |
| disallowed_useragent | Google refuses to sign in inside another app's window. | Open Cockpit in your normal browser, or use the Cockpit app, which opens the browser for you. |
Connecting
After a connect attempt, the Connectors page shows one line saying what happened. These are those lines, and the messages from the vendors that often cause them.
| What you see | What it usually means | What to do |
|---|---|---|
| "No problem: you declined the <system> connection. Nothing was stored." | You pressed Cancel or Deny at the vendor. | Start the connection again if you meant to allow it. |
| "The <system> sign-in expired or didn't match, so nothing was stored. Please start the connection again." | The sign-in took too long, or the page was reloaded part-way. | Start again from Connectors, and finish in one go. |
| "This connection was started from a different Cockpit account." | You are signed in to Cockpit as someone else than when you began. | Sign in as the account that started it, and try again. |
| "<system> didn't accept the sign-in, so nothing was stored. Try again in a moment." | The vendor refused the code exchange. | Wait a moment and retry. For Salesforce, check the Consumer Key and secret. |
| "<system> isn't set up on our side yet, so I can't start that connection." | Cockpit's own app for this system is not configured in this environment. | Tell support. You cannot fix it. For GitHub this is the "app is not configured" case. |
| "<system> didn't accept that client id and secret for that region." | A value was pasted wrongly, or the region is wrong. | Copy both again with no stray spaces. For MuleSoft, check the region matches your Anypoint address bar. |
| "<system> connects through your own app. Enter your app's details first." | No app is saved yet. | Paste the app's client id and secret first. |
| "<system> is already connected. Use Reconnect..." | A connection exists. | Use Reconnect on the card if you want to replace it. |
| "The <system> login worked, but storing it failed. Nothing was saved." | A problem on Cockpit's side. | Try again. If it repeats, send the reference. |
| "Couldn't save your app. Nothing was stored. Check the details and try again." | The app's details were not accepted. | Check each field. |
| "Enter your Salesforce address, for example your-company.my.salesforce.com." | You chose My own domain without an address. | Type the address. |
| "Enter your app's consumer key." / "Enter your connected app's client id and client secret." / "Enter your Slack app's client id and client secret." | A required box is empty. | Fill it in. |
| System | What you see | What it usually means | What to do |
|---|---|---|---|
| Salesforce | redirect_uri_mismatch, or a callback error | The callback URL in the app differs from Cockpit's. | Copy the Callback URL again from step 2 into the app with no spaces, and save. |
| Salesforce | invalid client, or invalid client credentials | The Consumer Key or secret was pasted wrongly, or the app is not switched on yet. | Wait two minutes after creating the app, then copy both values again. |
| Salesforce | An approval error after you sign in | The app's policy does not allow your user. | In the app's policies, allow all users to self-authorize, or approve your user, then retry. |
| MuleSoft | Test fails with 401 or 403 | Wrong region, wrong app type, or missing View scopes. | Check the region against the address bar. Recreate the app as client credentials with the four View and Read scopes. |
| Postman | "That doesn't look like a Postman API key. Nothing was stored." | The key was pasted wrongly, is too short, or was revoked or expired. | Generate a new key and paste it again. |
| Postman | "You are signed out. Sign in again, then paste the key. Nothing was stored." | Your Cockpit session ended. | Sign in, then paste again. |
| Slack | Slack shows a different workspace | You are signed in to the wrong Slack workspace. | Sign out of Slack in the browser, sign in to your test workspace, and retry. |
| Slack | "... returned access to direct messages that wasn't asked for, so nothing was stored." | Slack's grant included direct messages. | Connect again and choose the direct messages step only if you want it. |
On a card, Needs reconnect means the provider refused the saved sign-in or key. Press Reconnect. Not checked yet means Test has not been pressed. Test failed shows the vendor's reason.
Chat and answers
| What you see | What it means | What to do |
|---|---|---|
| "The Copilot couldn't answer this message. Reference: CKP-..." | The AI provider refused or could not read the request. | Send the reference to support. Do not retry more than twice. |
| "The model is busy right now, please try again in a minute. Reference: CKP-..." | The AI provider was overloaded. | Wait a minute and retry. |
| "You've used this month's AI allowance. It starts again on <date>. Reference: CKP-..." | The month's AI budget for your account is used. No message or run was created. | Wait for the date, or write to support. |
| "Before your first chat, agree to Cockpit sending your messages to its AI providers." | You have not agreed, or you withdrew, or the provider list changed. | Press Agree, or Review and agree. The message you typed is put back in the box. |
| "Chat is off until you agree to Cockpit sending your messages to its AI providers." | You pressed Not now. | Press Review and agree. |
| "Cockpit is having trouble right now. Please try again in a moment." | Cockpit's service cannot be reached. | Wait a moment and retry. |
| The Copilot says it cannot read something, "not readable with your access" | The connected user lacks permission, for example View Setup and Configuration. | Reconnect as a user with that permission, or accept the gap. |
| The Copilot says Sandbox is on and nothing was changed | You asked for a change in Sandbox. | Switch to Production mode only if you mean to write (chapter 8). |
| The Copilot says it has no write action for that | That kind of write is not switched on yet. | Check the capability tag on the Connectors card. |
| "The discovery report is not available for that org. Connect it first." / "The Copilot is still working in this chat. Wait for it, then run the report." / "The report could not be started. Try again in a minute." | The report needs a connected org and an idle chat. | Connect the org, wait for the chat to finish, or retry. |
Modes and approvals
| What you see | What it means | What to do |
|---|---|---|
| "This chat is in Sandbox and stays there. Start a new chat to write." | A chat can be tightened but never loosened. | Start a new chat. |
| "Couldn't change the mode. Nothing was changed, and what you see is how it is now." | The change did not reach Cockpit. | Look at the chip: it shows the real state. Retry. |
| "Mode changed, nothing was changed." | You tightened the mode after the card appeared. | Ask again after the mode is as you want. |
| Approval "expired" (or "Approval expired") | The card waited more than 10 minutes. | Ask for the change again. |
| "Approval already approved" / "Approval already denied" | It was decided already, perhaps on another screen. | Refresh. Nothing happens twice. |
| "Always allow is only for plans and reads. Approve or deny this write on its own." | Writes are never always-allowed. | Decide the card. |
| Approve and Deny are greyed out, with the trial-ended sentence | Your trial ended. | See Sign-in and access. |
| "approved for X, but it would now go to Y. Nothing was changed." | The target moved between the card and the approval. | Check the chat's org, and ask again. |
Sandbox, Production and your approval cards
Two different things are called Sandbox and Production, and a card can show both. The mode (Sandbox or Production, the chip at the top) decides whether a card can appear at all. The target on the card names the system the change will land in, and for MuleSoft it also says what kind of environment that is.
| What you see | What it means | What to do |
|---|---|---|
| You asked for a change and no card appeared; the Copilot says Sandbox is on and nothing was changed | In Sandbox mode no approval is possible. The request is turned away before any card is made. | If you mean to write, switch to Production mode first (chapter 8), then ask again. |
| A card appears in Production mode, with the target line "MuleSoft ... environment <name> (sandbox)" | The kind of environment is in brackets, as Anypoint reports it. Cockpit changes MuleSoft sandbox and design environments only. | Check the environment name and the kind in brackets before you approve. |
| The Copilot says an environment "is a production environment" (or another kind) and that Cockpit changes sandbox and design environments only, and nothing was changed | A MuleSoft write was asked for in an environment that is not a sandbox or design one. No card is made. | Choose a sandbox or design environment. |
| You tightened the mode after a card appeared, and Approve says "Mode changed, nothing was changed." | Approving a card after the mode was tightened is refused, and nothing is changed. | Ask again after the mode is as you want. |
[Screenshot: A MuleSoft approval card whose target names the environment and its type]Figure 39
Limits in one run
Each kind of write can be asked for only a few times in one chat run, so a loop cannot fill your screen with cards. The Copilot tells you in the chat in the limit's own words, for example "exchange_publish: at most 6 calls in one chat run (a limit set for this environment)."
CAUTION · It counts cards asked, not changes made
The count goes up when the Copilot asks, before you decide. A card you deny, a card that expires and a write that fails all count. So "at most 6 calls" can be used up with nothing published at all. Nothing is sent and no card is made once the limit is reached.
| What you see | What it means | What to do |
|---|---|---|
| "... at most N <things> in one chat run." (for example 6 calls for publishing an asset, publishing a jar and deploying, 3 policies applied, 2 pull requests; the numbers differ by environment) | The Copilot has already asked for that kind of write the most times allowed in this run. | Tell the Copilot what you want done next, in a new message. A new message starts a new run with a fresh count. |
| The limit message appears although you approved nothing | Earlier cards in the same run were denied, expired or failed, and they still count. | Check the Approvals tab of the Brain panel to see them, then send a new message. |
In Sandbox mode a write is turned away before it is counted, so a refused write does not use up a limit.
Writes
| What you see | What it means | What to do |
|---|---|---|
| "... refused the change (HTTP 4xx), so nothing was changed." | The system said no (a missing permission, a bad value, a validation rule). | Read the reason after it, fix the request, ask again. |
| "... did not confirm the change ... may or may not have been applied. Cockpit did not try again." | The connection dropped or the system errored after the write was sent. | Check the system. Only ask again if the change is not there. |
| "the Salesforce org this chat uses is not connected. Reconnect it on the Connections page. Nothing was changed." | The org was disconnected. | Reconnect it. |
| "Slack is not connected. Connect it on the Connections page. Nothing was posted." | No Slack connection. | Connect Slack. |
| "your GitHub login cannot push to owner/repo, so Cockpit cannot open a pull request there. Nothing was changed." | The connected GitHub user has no write access. | Use a repository you can write to. |
| "owner/repo is archived" / "was not found, or your GitHub login cannot see it" / "the branch X does not exist" | The repository or base branch is unavailable. | Check the name and branch. |
| "the branch cockpit/... already exists ... Choose another branch name." | An earlier attempt created it. | Delete the branch on GitHub, or ask for another name. |
| "GitHub failed while the commit was being prepared ... No branch and no pull request were created." | GitHub failed before the branch existed. | Nothing is left behind. Ask again. |
Microphone and apps
| What you see | What to do |
|---|---|
| "Cockpit cannot use the microphone..." | Allow the microphone for the site in browser settings. |
| No microphone button | Your browser has no speech recognition. Type. |
| Mac: a prompt about an app downloaded from the internet | Click Open. It appears the first time. |
| App opens but does not sign in | Click Enter Cockpit again. The browser signs you in, then hands back to the app through cockpit://. |
| Desktop app: "Cockpit can't be reached. Check your internet connection. Cockpit will try again by itself." | The app could not reach Cockpit (no internet, a slow network or a blocked address). Check the connection. It tries again by itself, or press Try again now. |
| Desktop app: a team member cannot sign in with Google | A team member signs in at the team door, with email and password. On the sign-in screen press Sign in to a team (chapter 9). |
| Support asks for your version | In the app choose Help, then Copy Diagnostics, and paste it into your message (chapter 5). It holds versions only. |
| No Download button | It shows only to approved accounts, on a Mac or Windows computer, and not inside the apps. |
If nothing here helps
Before writing to support checklist
- I have the reference code (CKP-...) if the message showed one.
- I know which step I was on and what I expected.
- I have a screenshot with no secret in it.
- I did not retry more than twice.