Troubleshooting

Most issues fall into a short list. Run talos-auditor doctor first — it checks watch paths, Ollama, and API reachability all at once.

Events aren't showing up in the dashboard

Symptoms: the agent is running, but no new sessions / spend appear.

Are you still inside a Claude Code session? The tail reader skips all content that existed when the agent started — by design. Generate a new prompt after starting the agent.
Check for flush log lines. The agent prints → flushed N events in Xms every ~30s or every 100 events. If you see nothing, events aren't reaching the buffer. Run TALOS_DEBUG=1 talos-auditor start for verbose watcher logs.
Look for flush failures. A × flush failed status=4xx line means the server rejected the batch. The body is printed under it. A 401 means your token was revoked.
Outbox depth growing? talos-auditor status shows pending count. Persistent non-zero = network or API issue. Events are retried on next flush.

Categorize mode but no categories in the dashboard

Verify your team is actually in categorize mode at /dashboard/settings/team. The agent enforces content redaction based on what the server reports.
If you're in categorize-local: talos-auditor doctor must show Ollama reachable and a llama3.1:8b (or qwen2.5:7b) model pulled.
If you're in categorize-cloud: the server calls Anthropic. Make sure the team admin has a valid ANTHROPIC_API_KEY set as a Worker secret. Agent doesn't need one.
Categorization only runs on role=user events with non-empty content. Tool results and assistant messages are skipped by design.

"Ollama unreachable" warning

The agent emits this when local categorize is active but localhost:11434 isn't responding.

# Start Ollama
ollama serve &

# Ensure a model is pulled
ollama list
ollama pull llama3.1:8b   # if not listed

# Use a different model?
export OLLAMA_MODEL=qwen2.5:7b

# Different host / port?
export OLLAMA_URL=http://127.0.0.1:11435

CLI login hangs on "Waiting for approval..."

The browser page must be on the same Clerk session as the CLI request. If you have multiple workspaces, make sure you're signed into the right one.
Device codes expire in 10 minutes. If you wait too long between terminal + browser, hit Ctrl+C and run talos-auditor login again.
If the browser page says "Deployment not found" — your dashboard URL is pointing to the old hosted subdomain. This only happens in early dev. Set TALOS_API_BASE to your local/staging Workers URL.

CLI says "Logged in" but /v1/agent/ping returns 401

Your token was revoked (admin rotation, or you ran talos-auditor logout on a different machine). Run talos-auditor login again.

Anomaly alerts never fire

The z-score scanner needs at least 12 hours of historical hourly_usage rows per developer before it can compute a meaningful baseline. That's why brand-new teams don't see alerts for the first half-day.

After that, the threshold is z ≥ 3 (i.e. "3 standard deviations above this developer's trailing-7-day hourly average"). The scanner also de-dupes: one alert per developer per 6h. If you need tighter thresholds, ask us and we'll make this configurable per team.

Dashboard shows $0 but I know I've been using Claude Code

Make sure the agent is actually watching the right path. talos-auditor doctor shows which paths have .jsonl files vs empty/missing.
Check that your team in the dashboard matches the one you logged in with. talos-auditor status prints the team ID.
Pricing table in packages/shared/src/pricing.ts must know your model. If Anthropic shipped a new model we haven't added yet, cost will be $0 but token counts will still show. Open an issue.

Worker logs

Team admins can tail the Cloudflare Workers to debug server-side behavior:

npx wrangler tail talos-auditor-api-prod --format=pretty
npx wrangler tail talos-auditor-consumer-prod --format=pretty

Still stuck?

Email info@talosfoundrix.com with the output of talos-auditor doctor and the last 20 lines of your agent terminal. We usually respond within a few hours.