frankvoelker
### Affected Component Core Services (Frontend UI/Backend API) ### Describe the bug What happened: I get error "Login failed" Docker logs say ``` pentagi | time="2026-09-30T16:17:51Z" level=error msg="error matching user input password" error="crypto/bcrypt: hashedPassword is not the hash of the given password" pentagi | time="2026-09-30T16:17:51Z" level=warning msg="api error" code=401 error="invalid login or password" message="invalid login or password" ``` ### Steps to Reproduce 1. Install Pentagi using installer 2. Wait for installer to finish 3. visit `https://localhost:8443` 4. try login using credentials `[email protected] // admin` ### System Configuration Pentagi setup using installer running on Kali Linux LLM Provider: Deepseek ### Logs and Artifacts ``` pgexporter | time=2026-09-30T16:16:34.639Z level=WARN source=main.go:85 msg="Error loading config" err="Error opening config file \"postgres_exporter.yml\": open postgres_exporter.yml: no such file or directory" pgexporter | time=2026-09-30T16:16:34.639Z level=INFO source=main.go:95 msg="Excluded databases" databases=[] pgexporter | time=2026-09-30T16:16:34.639Z level=INFO source=tls_config.go:347 msg="Listening on" address=[::]:9187 pgexporter | time=2026-09-30T16:16:34.640Z level=INFO source=tls_config.go:350 msg="TLS is disabled." http2=false address=[::]:9187 scraper | service ssl crt and key already exist scraper | 2026/09/30 16:16:28 Starting server on 0.0.0.0:443 TLS true scraper | INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit) scraper | INFO: Started parent process [9] scraper | INFO: Started server process [34] scraper | INFO: Waiting for application startup. scraper | INFO: Application startup complete. scraper | INFO: Started server process [33] scraper | INFO: Waiting for application startup. scraper | INFO: Application startup complete. scraper | INFO: Started server process [32] scraper | INFO: Waiting for application startup. scraper | INFO: Application startup complete. scraper | INFO: Started server process [35] scraper | INFO: Waiting for application startup. scraper | INFO: Application startup complete. scraper | 2026-09-30T16:16:30.518Z browserless:server Using configuration: scraper | 2026-09-30T16:16:30.521Z browserless:server { scraper | CONNECTION_TIMEOUT: 60000, scraper | MAX_CONCURRENT_SESSIONS: 10, scraper | QUEUE_LENGTH: 10, scraper | SINGLE_RUN: false, scraper | CHROME_REFRESH_TIME: 1800000, scraper | KEEP_ALIVE: false, scraper | DEFAULT_BLOCK_ADS: false, scraper | DEFAULT_HEADLESS: 'new', scraper | DEFAULT_LAUNCH_ARGS: [], scraper | DEFAULT_IGNORE_DEFAULT_ARGS: false, scraper | DEFAULT_IGNORE_HTTPS_ERRORS: false, scraper | DEFAULT_DUMPIO: false, scraper | DEFAULT_STEALTH: false, scraper | DEFAULT_USER_DATA_DIR: undefined, scraper | PREBOOT_CHROME: false, scraper | PREBOOT_QUANTITY: 0, scraper | PRINT_GET_STARTED_LINKS: true, scraper | PRINT_NETWORK_INFO: true, scraper | DEBUG: 'browserless*', pgvector | pgvector | PostgreSQL Database directory appears to contain a database; Skipping initialization pgvector | pgvector | 2026-09-30 16:16:28.951 UTC [1] LOG: starting PostgreSQL 16.3 (Debian 16.3-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit pgvector | 2026-09-30 16:16:28.951 UTC [1] LOG: listening on IPv4 address "0.0.0.0", port 5432 pgvector | 2026-09-30 16:16:28.951 UTC [1] LOG: listening on IPv6 address "::", port 5432 pgvector | 2026-09-30 16:16:28.959 UTC [1] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" pgvector | 2026-09-30 16:16:28.975 UTC [29] LOG: database system was shut down at 2026-09-30 16:06:44 UTC pgvector | 2026-09-30 16:16:28.989 UTC [1] LOG: database system is ready to accept connections pentagi | service ssl crt and key already exist pentagi | time="2026-09-30T16:16:34Z" level=info msg="Starting PentAGI 2.1.0-ce.h6f3d29c" pentagi | time="2026-09-30T16:16:34Z" level=info msg="Instance identity" data_dir=./data installation_id=ab0a21d4-a5c5-3bb0-a1a5-a89951e4f828 schema=public tenant_id= pentagi | 2026/09/30 16:16:34 OK 20260717_120000_tool_call_id_template_default.sql (15.99ms) pentagi | 2026/09/30 16:16:34 OK 20260718_120000_user_session_generation.sql (4.86ms) pentagi | 2026/09/30 16:16:35 OK 20260719_120000_add_mistral_xai_providers.sql (187.24ms) pentagi | 2026/09/30 16:16:35 OK 20260720_120000_toolcalls_call_id_hash_idx.sql (8.54ms) pentagi | 2026/09/30 16:16:35 OK 20260721_120000_autovacuum_churning_tables.sql (2.32ms) pentagi | 2026/09/30 16:16:35 OK 20260722_120000_embedding_metadata_indexes.sql (17.42ms) pentagi | 2026/09/30 16:16:35 goose: successfully migrated database to version: 20260722 pentagi | time="2026-09-30T16:16:35Z" level=info msg="Database schema updated successfully" pentagi | time="2026-09-30T16:16:35Z" level=warning msg="DOCKER_INSIDE=true: agents are given the host daemon, the one running PentAGI itself. An agent that escapes its sandbox can start a privileged container and take the node, PentAGI and the other flows' containers with it. Check the daemon's hardening and whether an authorization plugin is installed, or move sandboxes onto their own daemon with DOCKER_INSIDE_HOST (see examples/guides/worker_node.md)" worker_docker=/var/run/docker.sock pentagi | time="2026-09-30T16:16:35Z" level=error msg="sandbox DISABLED for this deployment: DOCKER_INSIDE_HOST is empty, so a worker would be given whichever daemon this process could autodetect -- possibly the one running PentAGI itself. Agents will run without Docker access until this is fixed; PentAGI keeps running. Setup guide: https://raw.githubusercontent.com/vxcontrol/pentagi/refs/heads/main/examples/guides/worker_node.md" docker_inside_host= pentagi | time="2026-09-30T16:16:35Z" level=error msg="failed to create embedder 'openai'" error="missing the OpenAI API key, set it in the OPENAI_API_KEY environment variable" pentagi | time="2026-09-30T16:16:35Z" level=info msg="flow loaded from DB" flow_id=1 provider_name=ollama provider_type=ollama user_id=1 pentagi | time="2026-09-30T16:16:35Z" level=error msg="failed to get flow provider" error="failed to get provider: provider not found by name 'ollama'" pentagi | time="2026-09-30T16:16:35Z" level=error msg="failed to load flow 1" error="failed to get flow provider: failed to get provider: provider not found by name 'ollama'" pentagi | time="2026-09-30T16:16:36Z" level=info msg="API server listening on 0.0.0.0:8443" scraper | DISABLED_FEATURES: [], scraper | ENABLE_CORS: false, scraper | ENABLE_API_GET: false, scraper | TOKEN: null, scraper | ENABLE_HEAP_DUMP: false, scraper | ALLOW_FILE_PROTOCOL: false, scraper | DISABLE_AUTO_SET_DOWNLOAD_BEHAVIOR: false, scraper | FUNCTION_BUILT_INS: [ 'url' ], scraper | FUNCTION_ENV_VARS: [], scraper | FUNCTION_ENABLE_INCOGNITO_MODE: false, scraper | FUNCTION_EXTERNALS: [ 'lighthouse', 'node-pdftk', 'sharp' ], scraper | WORKSPACE_DIR: '/usr/src/app/workspace', scraper | WORKSPACE_DELETE_EXPIRED: false, scraper | WORKSPACE_EXPIRE_DAYS: 30, scraper | FAILED_HEALTH_URL: null, scraper | QUEUE_ALERT_URL: null, scraper | REJECT_ALERT_URL: null, scraper | TIMEOUT_ALERT_URL: null, scraper | ERROR_ALERT_URL: null, scraper | SESSION_CHECK_FAIL_URL: null, scraper | PRE_REQUEST_HEALTH_CHECK: false, scraper | EXIT_ON_HEALTH_FAILURE: false, scraper | MAX_CPU_PERCENT: 99, scraper | MAX_MEMORY_PERCENT: 99, scraper | METRICS_JSON_PATH: null, scraper | HOST: '0.0.0.0', scraper | PORT: 3000, scraper | SOCKET_CLOSE_METHOD: 'http', scraper | PROXY_URL: undefined, scraper | MAX_PAYLOAD_SIZE: '5mb' scraper | } scraper | 2026-09-30T16:16:30.521Z browserless:server scraper | scraper | Running on port 3000 scraper | Localhost ws:localhost:3000 scraper | Local network ws:172.18.0.3:3000 scraper | 2026-09-30T16:16:30.522Z browserless:server scraper | Get started at https://www.browserless.io/docs/start scraper | Get a license at https://www.browserless.io/sign-up?type=commercial scraper | Get support at https://www.browserless.io/contact scraper | scraper | Happy coding! scraper | pentagi | time="2026-09-30T16:16:36Z" level=info msg="Starting server with TLS enabled" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 1.261966ms | 172.20.0.1 | GET "/" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 777.696µs | 172.20.0.1 | GET "/assets/spinner-CLe-92Ot.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 482.185µs | 172.20.0.1 | GET "/assets/chevron-right-CCVQMZbm.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 5.640356ms | 172.20.0.1 | GET "/fonts/inter-regular.woff2" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 15.261981ms | 172.20.0.1 | GET "/assets/chunk-BV7QT456-DgasEOfP.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 3.657092ms | 172.20.0.1 | GET "/assets/format-Dw_ibuLZ.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 2.414443ms | 172.20.0.1 | GET "/assets/dropdown-menu-CkV5nhjh.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 8.224802ms | 172.20.0.1 | GET "/fonts/inter-500.woff2" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 6.38486ms | 172.20.0.1 | GET "/fonts/inter-600.woff2" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 24.181652ms | 172.20.0.1 | GET "/assets/radix-ui-B-5FGqxk.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 3.923077ms | 172.20.0.1 | GET "/fonts/inter-700.woff2" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 50.22079ms | 172.20.0.1 | GET "/assets/index-Di_mPl9T.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 36.064348ms | 172.20.0.1 | GET "/assets/apollo-client-CZf5Gw48.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 8.707099ms | 172.20.0.1 | GET "/assets/index-tErAUnYe.css" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 392.024µs | 172.20.0.1 | GET "/api/v1/info" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 513.225µs | 172.20.0.1 | GET "/assets/dropdown-menu-CkV5nhjh.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 10.603808ms | 172.20.0.1 | GET "/assets/chunk-BV7QT456-DgasEOfP.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 5.28398ms | 172.20.0.1 | GET "/assets/format-Dw_ibuLZ.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 752.889µs | 172.20.0.1 | GET "/assets/spinner-CLe-92Ot.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 294.329µs | 172.20.0.1 | GET "/assets/chevron-right-CCVQMZbm.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 27.720279ms | 172.20.0.1 | GET "/assets/apollo-client-CZf5Gw48.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 28.813485ms | 172.20.0.1 | GET "/assets/radix-ui-B-5FGqxk.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 49.569414ms | 172.20.0.1 | GET "/assets/index-Di_mPl9T.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 78.296194ms | 172.20.0.1 | GET "/assets/utils-lDBxy5y0.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 79.250474ms | 172.20.0.1 | GET "/assets/rolldown-runtime-z4PIMsjO.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 79.210899ms | 172.20.0.1 | GET "/assets/log-C8Pjx2DA.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 83.22501ms | 172.20.0.1 | GET "/favicon/favicon.svg" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 84.406803ms | 172.20.0.1 | GET "/favicon/apple-touch-icon.png" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 83.176337ms | 172.20.0.1 | GET "/assets/utils-D1Mw6nC_.js" pentagi | [GIN] 2026/09/30 - 16:17:02 | 200 | 83.859684ms | 172.20.0.1 | GET "/assets/react-vendor-CWP9Inff.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 86.133952ms | 172.20.0.1 | GET "/assets/dist-BAlYy0aP.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 8.621465ms | 172.20.0.1 | GET "/assets/login-O_AzDSHf.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 9.863954ms | 172.20.0.1 | GET "/assets/use-app-form-DAoIsztE.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 8.504653ms | 172.20.0.1 | GET "/assets/schemas-B1hNWjfl.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 2.155952ms | 172.20.0.1 | GET "/assets/password-change-form-DEcxJaRP.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 454.763µs | 172.20.0.1 | GET "/assets/eye-D8amr5XX.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 1.746155ms | 172.20.0.1 | GET "/assets/input-group-DwS7_U5d.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 560.795µs | 172.20.0.1 | GET "/assets/form-submit-button-BIMS5bR_.js" pentagi | [GIN] 2026/09/30 - 16:17:03 | 200 | 455.244µs | 172.20.0.1 | GET "/assets/form-DDL4yjd4.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 269.772µs | 172.20.0.1 | GET "/api/v1/info" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 491.321µs | 172.20.0.1 | GET "/assets/login-O_AzDSHf.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 266.546µs | 172.20.0.1 | GET "/assets/password-change-form-DEcxJaRP.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 457.368µs | 172.20.0.1 | GET "/assets/input-group-DwS7_U5d.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 578.268µs | 172.20.0.1 | GET "/assets/eye-D8amr5XX.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 4.007477ms | 172.20.0.1 | GET "/assets/schemas-B1hNWjfl.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 837.289µs | 172.20.0.1 | GET "/assets/form-submit-button-BIMS5bR_.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 1.187595ms | 172.20.0.1 | GET "/assets/form-DDL4yjd4.js" pentagi | [GIN] 2026/09/30 - 16:17:05 | 200 | 11.580322ms | 172.20.0.1 | GET "/assets/use-app-form-DAoIsztE.js" pentagi | time="2026-09-30T16:17:09Z" level=error msg="error matching user input password" error="crypto/bcrypt: hashedPassword is not the hash of the given password" pentagi | time="2026-09-30T16:17:09Z" level=warning msg="api error" code=401 error="invalid login or password" message="invalid login or password" pentagi | time="2026-09-30T16:17:09Z" level=warning msg="http request handled error" component=api duration=64.323374ms http_host_name="127.0.0.1:8443" http_method=POST http_path=/api/v1/auth/login http_resp_size=102 http_status_code=401 http_uri=/api/v1/auth/login net_peer_ip=172.20.0.1 request="api handled" pentagi | [GIN] 2026/09/30 - 16:17:09 | 401 | 64.350928ms | 172.20.0.1 | POST "/api/v1/auth/login" pentagi | [GIN] 2026/09/30 - 16:17:38 | 200 | 284.69µs | 172.20.0.1 | GET "/" pentagi | [GIN] 2026/09/30 - 16:17:38 | 304 | 111.341µs | 172.20.0.1 | GET "/fonts/inter-regular.woff2" pentagi | [GIN] 2026/09/30 - 16:17:38 | 304 | 74.902µs | 172.20.0.1 | GET "/fonts/inter-500.woff2" pentagi | [GIN] 2026/09/30 - 16:17:38 | 304 | 62.589µs | 172.20.0.1 | GET "/fonts/inter-600.woff2" pentagi | [GIN] 2026/09/30 - 16:17:38 | 304 | 149.443µs | 172.20.0.1 | GET "/fonts/inter-700.woff2" pentagi | [GIN] 2026/09/30 - 16:17:39 | 200 | 584.62µs | 172.20.0.1 | GET "/api/v1/info" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 268.73µs | 172.20.0.1 | GET "/api/v1/info" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 1.472264ms | 172.20.0.1 | GET "/assets/use-app-form-DAoIsztE.js" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 214.447µs | 172.20.0.1 | GET "/assets/password-change-form-DEcxJaRP.js" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 2.648916ms | 172.20.0.1 | GET "/assets/login-O_AzDSHf.js" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 721.147µs | 172.20.0.1 | GET "/assets/input-group-DwS7_U5d.js" pentagi | [GIN] 2026/09/30 - 16:17:40 | 200 | 4.451427ms | 172.20.0.1 | GET "/assets/schemas-B1hNWjfl.js" pentagi | [GIN] 2026/09/30 - 16:17:51 | 401 | 64.564562ms | 172.20.0.1 | POST "/api/v1/auth/login" pentagi | time="2026-09-30T16:17:51Z" level=error msg="error matching user input password" error="crypto/bcrypt: hashedPassword is not the hash of the given password" pentagi | time="2026-09-30T16:17:51Z" level=warning msg="api error" code=401 error="invalid login or password" message="invalid login or password" pentagi | time="2026-09-30T16:17:51Z" level=warning msg="http request handled error" component=api duration=64.526139ms http_host_name="127.0.0.1:8443" http_method=POST http_path=/api/v1/auth/login http_resp_size=102 http_status_code=401 http_uri=/api/v1/auth/login net_peer_ip=172.20.0.1 request="api handled" ``` ### Screenshots or Recordings _No response_ ### Verification - [x] I have checked that this issue hasn't been already reported - [x] I have provided all relevant configuration files (with sensitive data removed) - [x] I have included relevant logs and error messages - [x] I am running the latest version of PentAGI