Troubleshooting

Known situations and what to do about them.

Verbose logs

Set ROLLE_DEBUG=1, pass rolle --debug, or turn on Settings → Advanced → Verbose logging. The desktop app and the CLI then log every provider call.

`ExpiredToken` or the wrong identity after Start

~/.aws/credentials holds static keys under the same profile name, and the AWS credential chain reads those before rolle’s credential_process. rolle does not start a session onto such a profile and marks the profile in the table. Click the mark and choose Remove, run rolle session fix-profile <session>, or give the session another profile name. See Profiles and regions.

The Identity Center token for that portal is expired or revoked. Start in the desktop app and in the tray menu signs in first. On the command line, rolle integration sync <alias> signs in when it must, and rolle integration login <alias> always signs in. The integration’s dot in the sidebar turns gray within thirty seconds of the token going bad.

`gcloud` is not found

An app started from the Dock or the Start menu does not get your shell’s PATH. rolle looks for gcloud on its PATH, then in the Homebrew, Google Cloud SDK installer, and mise install locations. Install the SDK with Homebrew, the official installer, or mise use -g gcloud. Run the sign-in command on the Google Cloud connect step, then press Check again.

TLS errors behind an inspecting proxy

rolle trusts the OS trust store. Install your organization’s root there (Keychain Access on macOS, certmgr on Windows, update-ca-certificates on Linux). For a root in a file, set Settings → Advanced → Extra CA bundle to that PEM. Set HTTPS proxy when the app runs without your shell’s proxy variables.

macOS asks for keychain access

rolle stores refresh tokens and access keys in the login keychain under the service rolle. Choose Always Allow to stop the prompt on every start.

The update asks for an administrator password

The updater replaces the app in place. When an administrator owns the folder that holds the app (/Applications on macOS, Program Files on Windows), the app asks for an administrator name and password. Privilege managers such as BeyondTrust or Jamf Connect can answer that prompt by policy. To avoid the prompt, install where your account has write access: ~/Applications on macOS, or the Windows installer, which installs under your own profile. Run Install command again after a move. When an update fails, the updater writes a log to $TMPDIR/wails-update-<pid>.log on macOS and %TEMP%\wails-update-<pid>.log on Windows. Attach it to an issue with the support bundle.

Windows SmartScreen warning

Windows builds are not code signed. Choose More info → Run anyway.

Linux app does not start

The desktop app needs GTK 4 and WebKitGTK 6.0. On Debian and Ubuntu:

sudo apt-get install libgtk-4-1 libwebkitgtk-6.0-4

Reset

rolle reset

This removes the workspace, every keychain entry, the credential cache, and the AWS profiles rolle wrote. The desktop app runs onboarding again.

Help

Open an issue at github.com/nateships/rolle/issues. Help → Report a problem at the bottom of the sidebar and the tray menu open the bug form with your version and platform filled in.

Attach a support bundle: Help → Support bundle, or rolle support on the command line. It writes a zip to Downloads with your settings, a redacted copy of the workspace, the AWS config, the az and gcloud profile files and tool locations, and the most recent diagnostic lines from every provider. Account IDs, emails, GUIDs, portal hosts, and strings that look like secrets are replaced with placeholders. Keychain entries and cached credentials are not included.