Troubleshooting
agentbox check on the host and agentgate doctor in the workspace name most of these directly.
| Symptom | Cause | Fix |
|---|---|---|
| Every Git and model call fails with a certificate error about a month after setup | The 30-day development CA and broker certificate expired | agentbox init renews them, then agentbox up --force-recreate |
doctor says the assertion has expired right after you renewed it | The new file was moved over the old name; the workspace mounts the old inode | agentbox assertion FILE |
The assertion is missing after you set AGENTGATE_RUNTIME_ASSERTION_PATH | Compose does not remount a secret whose path changed | agentbox assertion FILE recreates the workspace |
Nothing reaches GitHub or the model provider; egress audit shows upstream-unreachable | Outbound traffic must use the company forward proxy | Set AGENTGATE_CORPORATE_PROXY; see Enterprise networks |
npm, pip, curl, or Git in the workspace fail certificate verification | The company proxy inspects TLS | Set AGENTGATE_CORPORATE_CA_PATH |
Egress audit shows upstream-proxy-refused | The company proxy rejected the tunnel | Put credentials in the proxy URL, or ask the network team to allow the host |
agentbox up builds for minutes, or fails fetching packages | Images are being built from source | Set AGENTGATE_IMAGE and AGENTGATE_WORKSPACE_IMAGE to verified digests |
A file setting is ignored, or check calls it relative | Compose runs from the package directory | Use the absolute path check prints |
| Reopen in Container starts a second stack or rebuilds the workspace | .devcontainer predates a settings change | agentbox up regenerates it; reopen afterwards |
agentbox init says it needs sh and openssl | A Windows prompt outside WSL 2 or Git Bash | Run agentbox inside WSL 2, where Docker Desktop also runs the containers |