Troubleshooting Code Guardian

Diagnose and resolve common Code Guardian installation, token authentication, and enrollment issues.

Enrollment failure — hooks_config.json missing

Code Guardian enrolled with Agent Identity Security but the per-agent configuration file was not written correctly. The agent will not appear in the Registry until resolved.

Common causes:

  • Bootstrap token has expired or reached its maximum API key generation limit.
  • Bootstrap token belongs to a different tenant.
  • Endpoint cannot reach the API base URL (https://ais.appvx.com).
  • Tenant subdomain is missing or incorrect.
  • API base URL is incorrect or not using HTTPS.

Diagnostic Steps

  • Check whether the deployment configuration file exists: 
    Get-Content "C:\ProgramData\Agent Identity SecurityCodeGuardian\ais-guardian-install.json"
  • Inspect the install log for enrollment errors: 
    Select-String -Path "C:\ProgramData\Agent Identity SecurityCodeGuardian\claude\install.log" -Pattern "enroll"

Per-user activation did not run

The MSI custom action activates Code Guardian for the currently logged-in user. If no user was logged in during installation (for example, during Windows Autopilot OOBE), the shared payload is installed but hooks may not be registered for any user session.

Resolution

Per-user activation runs automatically during the next upgrade when an active user session is present. To activate immediately, run the configuration script manually under the user profile: 
& "$env:USERPROFILE\.claude\ais-claude-marketplace\configure_ais_claude_guardian_windows.ps1" -Action install

Detection script reports not installed

Microsoft Intune reports the application as not installed even though the installer completed.

Diagnostic Steps

  • Run the detection script manually on the endpoint to identify the failure point: 
    powershell.exe -ExecutionPolicy Bypass -File Detect-CodeGuardian.ps1 -Products "claude" -MinVersion "0.1.0"
  • Verify the Registry key: 
    Get-ItemProperty "HKLM:\SOFTWARE\Agent Identity SecurityCyber\CodeGuardian\claude" -ErrorAction SilentlyContinue
  • Verify the Payload existence: 
    Test-Path "C:\ProgramData\Agent Identity SecurityCodeGuardian\claude\ais-claude-marketplace\plugins\ais-claude-plugin\hooks\hooks.json"
  • Verify the Configuration existence: 
    Test-Path "C:\ProgramData\Agent Identity SecurityCodeGuardian\claude\ais-claude-marketplace\plugins\ais-claude-plugin\hooks\config\hooks_config.json"

Wrong exit code in MDM

MDM reports an unexpected exit code or failure status during installation.

Diagnostic Steps

  • Inspect the last 100 lines of the installer log: 
    Get-Content "C:\ProgramData\Agent Identity SecurityCodeGuardian\installer\CodeGuardianInstall.log" -Tail 100
  • Look for errors related to network connectivity, token validation, or file permission issues and resolve them before re-deploying.
    Tip: If the issue is not resolved, open a support request and include the full content of CodeGuardianInstall.log and the install.log for the affected agent.