Merge remote-tracking branch 'origin/main' into dashboard-progressive-rendering

# Conflicts:
#	agent/skills/dashboard-design/SKILL.md

Author: notSumit25

.github/workflows/codeql.yml

@@ -18,13 +18,19 @@ jobs:
   analyze:
     name: analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
-    # Code scanning is free on public repositories; on a private one it requires
-    # GitHub Advanced Security, which this organisation's free plan does not
-    # include. Without this guard every run fails with a 403 until the repository
-    # is public, and a permanently red workflow trains people to stop reading CI.
-    # DELETE THIS LINE once the repository is public — from then on a failure
-    # here is a real finding rather than a billing state.
-    if: github.event.repository.visibility == 'public'
+    # No visibility guard here, deliberately. A job-level `if:` is evaluated
+    # before the matrix expands, so a skipped run reports a single check under
+    # the raw template name — `analyze (${{ matrix.language }})` — rather than
+    # the two expanded names. That phantom name reached the `Protect main branch`
+    # ruleset as a required check (GitHub's suggestion list offers whatever was
+    # last reported), and once this repository went public and the job began
+    # reporting the real names instead, nothing was left to satisfy the phantom:
+    # every pull request stalled on "Expected — waiting for status to be
+    # reported", unmergeable, with no failing job to point at.
+    #
+    # Code scanning is free while this repository is public. If it ever goes
+    # private without GitHub Advanced Security, drop these contexts from the
+    # ruleset — do not reintroduce an `if:` here.
     permissions:
       # Required to upload results to the code-scanning API.
       security-events: write

AGENTS.md

@@ -199,9 +199,11 @@ only covers cloud-specific, non-obvious caveats.
   hardcodes `ENCRYPTION_KEYS=${ENCRYPTION_KEYS:}`; with the OS env var unset this is a
   circular placeholder reference that fails `EncryptionService` bean creation at boot. The
   local `.env` sets `ENCRYPTION_KEYS=<id>:<base64key>` matching `ENCRYPTION_KEY_ID`.
-- **`SECURITY_AUTH_ENABLED=false`** (set in `.env`) enables the dev auto-admin bypass, so the
-  web UI needs no login. Auth defaults to ON in every profile otherwise (there is no
-  `admin/admin`); a real login needs the localhost admin-bootstrap flow (see README).
+- **`SECURITY_AUTH_ENABLED`** defaults to ON. This Cloud VM’s `.env` sets it
+  `true` and uses a real admin user (`admin@localhost` — create via localhost
+  bootstrap if missing; see `CLAUDE.md`). `SECURITY_AUTH_ENABLED=false` only
+  bypasses JWT/MCP token *validation*; it does not skip the login form or mint
+  an admin. Dev credentials are never `admin/admin`.
 - **The `scheduled_tasks` table and the `vector`/`pg_stat_statements` extensions** come from
   `docker/postgres/init/*.sql`. In the native (non-Docker) setup those were applied by hand;
   they persist in the snapshot. If you ever recreate the vault DB, re-apply
@@ -242,6 +244,21 @@ only covers cloud-specific, non-obvious caveats.
   over `~/.hermes/profiles/u-<user>/config.yaml` and re-POST `/provision`. Symptom
   of a bad profile: Hermes logs `Missed model deployment` and CLI agent returns
   empty / “ended before producing an answer”.
+- **After rotating MCP tokens, restart Hermes webui (and ensure the provisioner is
+  current).** `scripts/local-agent-provisioner.py` writes `DEEPSQL_TOKEN_FILE` +
+  `DEEPSQL_AUTH_TOKEN` into the profile; an old long-lived provisioner process will
+  skip the token-file path. Even with a fresh profile config, Hermes webui can keep
+  a stale MCP subprocess env (no auth token, `DEEPSQL_MCP_USER_ID=deepsql-agent`).
+  Symptom: Agent tab tools return `Unauthorized - Please login` while
+  `/api/agent/session` reports `mcpAuthOk: true`. Fix: restart
+  `scripts/local-agent-provisioner.py`, re-open Agent (re-provision), restart the
+  Hermes webui on `:8787`, and sync default `~/.hermes/config.yaml`
+  `mcp_servers.deepsql.env` from the active `u-<user>` profile if the shared MCP
+  is what webui spawns.
+- **Multi-schema fixture.** This VM’s Postgres also has an ACME-style DB with
+  non-`public` schemas (`crm`, `sales`, `finance`, `hr`, `inventory`) for Brain /
+  MCP cross-schema checks. Prefer schema-qualified SQL (`sales.orders`); bare
+  names follow the role’s `search_path` (usually `public`).
 - **`AGENT_WEBUI_URL` for native runs.** Default is `http://deepsql-agent:8787`
   (Compose DNS). Native local must set `AGENT_WEBUI_URL=http://127.0.0.1:8787` in
   `.env` or CLI/Slack `AgentChatClient` cannot reach the agent API.

CLAUDE.md

@@ -109,6 +109,8 @@ backend/
 src/                # Frontend (React)
   components/       # UI components
     tabs/           # 40+ specialized tabs
+    sections/       # Top-level sidebar destinations (Agent, Dashboards, Brain,
+                    # Performance = Slow Queries + Workload, Editor, Docs)
   lib/
     api/client.js   # Centralized API layer (axios, 25+ modules)
     stores/         # Zustand stores (dashboard, connection, chat, UI)

agent/skills/dashboard-design/SKILL.md

@@ -57,7 +57,7 @@ Hard rules:
 ## Procedure
 
 1. **Ground.** `get_brain_context`, `get_schema`, `list_business_rules`, `get_relationships`. Obey business rules about which table/column/filter/currency a concept uses — quote them; don't guess a similar-looking table.
-2. **Design.** Decide the KPIs, charts, tables, and controls (date range, dropdowns) the request calls for. Give each one a short, stable, kebab-case widget id (e.g. `revenue-trend`) — you'll use the same id in the shell's slot and that widget's own block. Sketch the SQL for each — table-qualified, read-only.
+2. **Design.** Decide the KPIs, charts, tables, and controls (date range, dropdowns) the request calls for. Give each one a short, stable, kebab-case widget id (e.g. `revenue-trend`) — you'll use the same id in the shell's slot and that widget's own block. Sketch the SQL for each — **schema-qualified** (`crm.orders`, not bare `orders` when the DB has multiple schemas), table-qualified columns, read-only.
 3. **Handle dates correctly.** Check the column's type in the schema. If it's a real DATE/DATETIME, filter with `BETWEEN '2026-07-01' AND '2026-07-08'`. **If it's a Unix-epoch integer** (seconds), filter on the epoch: `col >= UNIX_TIMESTAMP('2026-07-01 00:00:00') AND col < UNIX_TIMESTAMP('2026-07-09 00:00:00')`. Build these strings in JS from the picker's values.
 4. **Verify each widget's query BEFORE emitting that widget's block.** Run it with `execute_sql` and READ the rows: date windows bounded and inside range (never the future), KPI value types right (name = text, money = currency), totals plausible vs a `COUNT(*)`. Fix and re-run until correct — only then emit that widget.
 5. **Intent checklist.** Before emitting the shell, list every explicit ask (each chart, each metric, each control like "a date range picker defaulting to today") and confirm your planned widgets cover ALL of them.

backend/src/main/java/com/dbaagent/controller/SchemaController.java

@@ -260,7 +260,8 @@ public ResponseEntity<Map<String, Object>> executeQuery(
         }
     }
 
-    @GetMapping("/tables/{tableName}/indexes")
+    // `{tableName:.+}` keeps schema-qualified ids (`crm.orders`) as one segment.
+    @GetMapping("/tables/{tableName:.+}/indexes")
     public ResponseEntity<Map<String, Object>> getTableIndexes(
             @PathVariable String connectionId,
             @PathVariable String tableName) {
@@ -292,7 +293,7 @@ public ResponseEntity<Map<String, Object>> getTableIndexes(
         }
     }
 
-    @GetMapping("/tables/{tableName}/stats")
+    @GetMapping("/tables/{tableName:.+}/stats")
     public ResponseEntity<Map<String, Object>> getTableStats(
             @PathVariable String connectionId,
             @PathVariable String tableName) {

backend/src/main/java/com/dbaagent/provider/mysql/MySQLIntrospectionProvider.java

@@ -153,6 +153,16 @@ public List<TableIndex> getTableIndexes(Connection connection, String database,
         List<TableIndex> indexes = new ArrayList<>();
         Map<String, TableIndex> indexMap = new HashMap<>();
 
+        String schemaName = database;
+        String bareName = tableName;
+        if (tableName != null) {
+            int dot = tableName.lastIndexOf('.');
+            if (dot > 0) {
+                schemaName = tableName.substring(0, dot);
+                bareName = tableName.substring(dot + 1);
+            }
+        }
+
         String query = """
             SELECT INDEX_NAME, COLUMN_NAME, NON_UNIQUE, INDEX_TYPE, SEQ_IN_INDEX
             FROM INFORMATION_SCHEMA.STATISTICS
@@ -161,8 +171,8 @@ public List<TableIndex> getTableIndexes(Connection connection, String database,
             """;
 
         try (PreparedStatement stmt = connection.prepareStatement(query)) {
-            stmt.setString(1, database);
-            stmt.setString(2, tableName);
+            stmt.setString(1, schemaName);
+            stmt.setString(2, bareName);
 
             try (ResultSet rs = stmt.executeQuery()) {
                 while (rs.next()) {

backend/src/main/java/com/dbaagent/provider/postgres/PostgresIntrospectionProvider.java

@@ -204,6 +204,18 @@ public List<TableIndex> getTableIndexes(Connection connection, String database,
         List<TableIndex> indexes = new ArrayList<>();
         Map<String, TableIndex> indexMap = new HashMap<>();
 
+        // Accept bare `orders` or qualified `crm.orders` so multi-schema UIs
+        // don't silently merge indexes from every schema that shares the name.
+        String schemaName = null;
+        String bareName = tableName;
+        if (tableName != null) {
+            int dot = tableName.lastIndexOf('.');
+            if (dot > 0) {
+                schemaName = tableName.substring(0, dot);
+                bareName = tableName.substring(dot + 1);
+            }
+        }
+
         String query = """
             SELECT
                 i.relname AS index_name,
@@ -212,16 +224,21 @@ public List<TableIndex> getTableIndexes(Connection connection, String database,
                 ix.indisprimary AS is_primary,
                 am.amname AS index_type
             FROM pg_class t
+            JOIN pg_namespace n ON n.oid = t.relnamespace
             JOIN pg_index ix ON t.oid = ix.indrelid
             JOIN pg_class i ON i.oid = ix.indexrelid
             JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = ANY(ix.indkey)
             JOIN pg_am am ON i.relam = am.oid
-            WHERE t.relname = ?
+            WHERE t.relkind IN ('r', 'p', 'm', 'v')
+              AND t.relname = ?
+              AND (?::text IS NULL OR n.nspname = ?)
             ORDER BY i.relname, a.attnum
             """;
 
         try (PreparedStatement stmt = connection.prepareStatement(query)) {
-            stmt.setString(1, tableName);
+            stmt.setString(1, bareName);
+            stmt.setString(2, schemaName);
+            stmt.setString(3, schemaName);
 
             try (ResultSet rs = stmt.executeQuery()) {
                 while (rs.next()) {

backend/src/main/java/com/dbaagent/service/DatabaseAdvisorService.java

@@ -281,7 +281,7 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
 
         try (Connection connection = connectionService.getConnection(connectionId, connRequest)) {
 
-            // Query 1: Tables with high sequential scans
+            // Query 1: Tables with high sequential scans (all non-system schemas)
             String query1 = """
                 SELECT
                     schemaname,
@@ -296,7 +296,7 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                         ELSE 0
                     END as avg_seq_tup_read
                 FROM pg_stat_user_tables
-                WHERE schemaname = 'public'
+                WHERE schemaname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
                   AND seq_scan > 1000
                   AND n_live_tup > 10000
                   AND (idx_scan IS NULL OR seq_scan > idx_scan * 2)
@@ -308,11 +308,13 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                  ResultSet rs = stmt.executeQuery(query1)) {
 
                 while (rs.next()) {
+                    String schemaName = rs.getString("schemaname");
                     String tableName = rs.getString("tablename");
                     long seqScans = rs.getLong("seq_scan");
                     long seqTupRead = rs.getLong("seq_tup_read");
                     long liveRows = rs.getLong("n_live_tup");
                     double avgSeqRead = rs.getDouble("avg_seq_tup_read");
+                    String qualifiedTable = "public".equals(schemaName) ? tableName : schemaName + "." + tableName;
 
                     // Get candidate columns
                     List<String> candidateColumns = getPostgresCandidateColumns(
@@ -325,7 +327,7 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                             .id(UUID.randomUUID().toString())
                             .connectionId(connectionId)
                             .tableName(tableName)
-                            .schemaName("public")
+                            .schemaName(schemaName)
                             .columns(candidateColumns)
                             .indexType("BTREE")
                             .priority(seqScans > 10000 ?
@@ -334,13 +336,13 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                             .reasoning(String.format(
                                 "Table '%s' has %,d sequential scans reading %,d rows (avg %.0f rows/scan). " +
                                 "Current row count: %,d. An index would significantly improve query performance.",
-                                tableName, seqScans, seqTupRead, avgSeqRead, liveRows
+                                qualifiedTable, seqScans, seqTupRead, avgSeqRead, liveRows
                             ))
                             .suggestedSQL(String.format(
                                 "CREATE INDEX CONCURRENTLY idx_%s_%s ON %s(%s)",
                                 tableName,
                                 String.join("_", candidateColumns),
-                                tableName,
+                                qualifiedTable,
                                 String.join(", ", candidateColumns)
                             ))
                             .metrics(IndexRecommendation.IndexRecommendationMetrics.builder()
@@ -358,9 +360,10 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                 }
             }
 
-            // Query 2: Foreign keys without indexes
+            // Query 2: Foreign keys without indexes (all non-system schemas)
             String query2 = """
                 SELECT
+                    tc.table_schema,
                     tc.table_name,
                     kcu.column_name,
                     ccu.table_name AS foreign_table_name
@@ -371,11 +374,11 @@ private List<IndexRecommendation> detectPostgresMissingIndexes(String connection
                 JOIN information_schema.constraint_column_usage AS ccu
                   ON ccu.constraint_name = tc.constraint_name
                 WHERE tc.constraint_type = 'FOREIGN KEY'
-                  AND tc.table_schema = 'public'
+                  AND tc.table_schema NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
                   AND NOT EXISTS (
                       SELECT 1
                       FROM pg_indexes
-                      WHERE schemaname = 'public'
+                      WHERE schemaname = tc.table_schema
                         AND tablename = tc.table_name
                         AND indexdef LIKE '%' || kcu.column_name || '%'
                   )
@@ -385,15 +388,17 @@ AND NOT EXISTS (
                  ResultSet rs = stmt.executeQuery(query2)) {
 
                 while (rs.next()) {
+                    String schemaName = rs.getString("table_schema");
                     String tableName = rs.getString("table_name");
                     String columnName = rs.getString("column_name");
                     String foreignTable = rs.getString("foreign_table_name");
+                    String qualifiedTable = "public".equals(schemaName) ? tableName : schemaName + "." + tableName;
 
                     IndexRecommendation rec = IndexRecommendation.builder()
                         .id(UUID.randomUUID().toString())
                         .connectionId(connectionId)
                         .tableName(tableName)
-                        .schemaName("public")
+                        .schemaName(schemaName)
                         .columns(Collections.singletonList(columnName))
                         .indexType("BTREE")
                         .priority(IndexRecommendation.RecommendationPriority.HIGH)
@@ -404,7 +409,7 @@ AND NOT EXISTS (
                         ))
                         .suggestedSQL(String.format(
                             "CREATE INDEX CONCURRENTLY idx_%s_%s ON %s(%s)",
-                            tableName, columnName, tableName, columnName
+                            tableName, columnName, qualifiedTable, columnName
                         ))
                         .metrics(IndexRecommendation.IndexRecommendationMetrics.builder()
                             .estimatedImprovementPercent(70)