fix: make self-host install + demo seed work end-to-end

Customer-style install.sh + DEEPSQL_SEED_DEMO_DATA uncovered several
silent failures:

- demo_shop orders aborted on float||' hours' interval casts (scientific
  notation); seed treated any existing DB as complete and used sslMode
  "disable" (treated as SSL-on) so the connection never saved
- Agent trusted-auth ignored X-Remote-User from the compose bridge
  without HERMES_WEBUI_TRUSTED_PROXY_CIDRS; browser POSTs also needed
  csrf_token from /api/auth/status for the React Agent tab

Verified: five containers healthy, smoke-test green, Demo Shop query
returns 5000 orders, Agent profile/switch + session/new OK.

Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>

Author: cursoragent

agent/docker-entrypoint.sh

@@ -85,7 +85,15 @@ export HERMES_WEBUI_PORT="$API_PORT"
 export HERMES_WEBUI_ALLOWED_ORIGINS="${DEEPSQL_AGENT_ALLOWED_ORIGINS:-${HERMES_WEBUI_ALLOWED_ORIGINS:-http://localhost:3000,http://127.0.0.1:3000,http://frontend}}"
 
 # Trust DeepSQL nginx as an auth gateway (X-Remote-User header).
+# Setting the header name enables the upstream auth gate; without a proxy
+# allowlist only loopback peers are trusted, so every compose-network hop
+# (frontend nginx, backend AgentChatClient) was rejected with
+# "Authentication required". Allow RFC1918 by default — the agent is not
+# published without DeepSQL's own session gate on /agent-api, and the
+# published :8787 port still requires the trusted header from an allowlisted
+# peer (host curls without the header keep getting 401).
 export HERMES_WEBUI_TRUSTED_AUTH_HEADER="${DEEPSQL_AGENT_TRUSTED_AUTH_HEADER:-${HERMES_WEBUI_TRUSTED_AUTH_HEADER:-X-Remote-User}}"
+export HERMES_WEBUI_TRUSTED_PROXY_CIDRS="${DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS:-${HERMES_WEBUI_TRUSTED_PROXY_CIDRS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}}"
 
 log "home=$AGENT_HOME"
 log "model=$MODEL @ $BASE_URL"

agent/webui/apply-overlay.sh

@@ -74,5 +74,44 @@ else
     && grep -qF 'aria-label="DeepSQL Agent"' "$STATIC/index.html" && echo "+ swapped logo to DeepSQL database mark" || echo "! logo swap skipped"
 fi
 
+# 6. Expose csrf_token on GET /api/auth/status so DeepSQL's React Agent tab
+#    (credentials:include fetch with Origin) can send X-Hermes-CSRF-Token.
+#    Upstream only injects the token into the HTML shell; our UI never loads it.
+ROUTES="$WEBUI/api/routes.py"
+CSRF_MARKER="deepsql_csrf_token_on_auth_status"
+if [[ -f "$ROUTES" ]]; then
+  if grep -qF "$CSRF_MARKER" "$ROUTES"; then
+    echo "= auth/status already returns csrf_token"
+  else
+    python3 - "$ROUTES" <<'PY'
+import pathlib, sys
+path = pathlib.Path(sys.argv[1])
+text = path.read_text()
+needle = '        if session_info and session_info.get("auth_type") == "trusted":\n            payload["auth_type"] = session_info.get("auth_type")\n            payload["user"] = session_info.get("username")\n            payload["bound_profile"] = session_info.get("bound_profile")\n        return j(handler, payload)'
+insert = '''        if session_info and session_info.get("auth_type") == "trusted":
+            payload["auth_type"] = session_info.get("auth_type")
+            payload["user"] = session_info.get("username")
+            payload["bound_profile"] = session_info.get("bound_profile")
+        # deepsql_csrf_token_on_auth_status — React Agent tab needs this for
+        # X-Hermes-CSRF-Token on unsafe /agent-api POSTs (profile/switch, chat).
+        try:
+            from api.auth import csrf_token_for_session, parse_cookie
+            cookie_val = getattr(handler, "_trusted_auth_session_cookie_value", None) or parse_cookie(handler)
+            if cookie_val:
+                token = csrf_token_for_session(cookie_val)
+                if token:
+                    payload["csrf_token"] = token
+        except Exception:
+            pass
+        return j(handler, payload)'''
+if needle not in text:
+    print("! could not locate auth/status return to patch csrf_token")
+    sys.exit(0)
+path.write_text(text.replace(needle, insert, 1))
+print("+ auth/status now returns csrf_token for DeepSQL Agent tab")
+PY
+  fi
+fi
+
 echo "✓ Overlay applied to $WEBUI"
 echo "  Default theme/skin set. (Hard-refresh an open tab to clear cached assets.)"

backend/src/main/java/com/dbaagent/service/AgentChatClient.java

@@ -61,6 +61,13 @@ public class AgentChatClient {
     @Value("${agent.channel-turn-timeout-seconds:300}")
     private long turnTimeoutSeconds;
 
+    /**
+     * Identity asserted to the agent via {@code X-Remote-User}. The agent only
+     * accepts this header from peers in {@code HERMES_WEBUI_TRUSTED_PROXY_CIDRS}
+     * (the compose bridge). Updated on each {@link #switchProfile(String)}.
+     */
+    private volatile String remoteUser = "admin";
+
     public record AgentReply(boolean ok, String text, List<String> toolSteps, String error) {
         public static AgentReply ok(String text, List<String> steps) { return new AgentReply(true, text, steps, null); }
         public static AgentReply fail(String error) { return new AgentReply(false, null, List.of(), error); }
@@ -126,6 +133,9 @@ private void switchProfile(String profile) throws Exception {
         if (profile == null || profile.isBlank()) {
             throw new IllegalArgumentException("agent profile is required");
         }
+        // Profiles are provisioned as u-<username>; the trusted-auth header is the
+        // bare username (nginx hard-codes X-Remote-User: admin for the browser path).
+        remoteUser = profile.startsWith("u-") ? profile.substring(2) : profile;
         postJson("/api/profile/switch", Map.of("name", profile));
     }
 
@@ -153,6 +163,7 @@ private AgentReply consumeStream(String streamId) {
         String url = webuiUrl + "/api/chat/stream?stream_id=" + URLEncoder.encode(streamId, StandardCharsets.UTF_8);
         HttpRequest req = HttpRequest.newBuilder(URI.create(url))
             .header("Accept", "text/event-stream")
+            .header("X-Remote-User", remoteUser)
             .timeout(Duration.ofSeconds(turnTimeoutSeconds + 10))
             .GET()
             .build();
@@ -217,6 +228,8 @@ private AgentReply consumeStream(String streamId) {
     private JsonNode postJson(String path, Map<String, Object> body) throws Exception {
         HttpRequest req = HttpRequest.newBuilder(URI.create(webuiUrl + path))
             .header("Content-Type", "application/json")
+            // Trusted-proxy identity for the agent auth gate (compose bridge).
+            .header("X-Remote-User", remoteUser)
             .timeout(Duration.ofSeconds(30))
             .POST(HttpRequest.BodyPublishers.ofString(objectMapper.writeValueAsString(body)))
             .build();

docker-compose.yml

@@ -132,6 +132,12 @@ services:
       # Origins allowed by the agent API CSRF check
       DEEPSQL_AGENT_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000},http://frontend
       DEEPSQL_AGENT_TRUSTED_AUTH_HEADER: X-Remote-User
+      # Frontend nginx + backend share the compose bridge; without this the
+      # agent ignores X-Remote-User (peer is not loopback) and every Agent
+      # tab / dashboard call returns 401 Authentication required.
+      DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS: ${DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
+      HERMES_WEBUI_TRUSTED_PROXY_CIDRS: ${DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
+      HERMES_WEBUI_TRUSTED_AUTH_HEADER: X-Remote-User
     ports:
       - "${DEEPSQL_AGENT_PORT:-8787}:8787"
       - "${DEEPSQL_AGENT_PROVISIONER_PORT:-8788}:8788"

docker/postgres/init/10_create_demo_shop.sql

@@ -390,7 +390,7 @@ SELECT
     (RANDOM() * 10000)::integer,
     true,
     true,
-    CURRENT_TIMESTAMP - (RANDOM() * 730 || ' days')::interval
+    CURRENT_TIMESTAMP - (RANDOM() * INTERVAL '730 days')
 FROM generate_series(1, 500) AS seq;
 
 -- ============================================================================
@@ -427,7 +427,7 @@ FROM customers c;
 
 INSERT INTO orders (order_number, customer_id, status, shipping_address_id, subtotal, tax_amount, shipping_amount, total_amount, payment_method, payment_status, created_at)
 SELECT 
-    'ORD-' || TO_CHAR(CURRENT_DATE - (seq / 7 || ' days')::interval, 'YYYYMMDD') || '-' || LPAD(seq::text, 5, '0'),
+    'ORD-' || TO_CHAR(CURRENT_DATE - make_interval(days => seq / 7), 'YYYYMMDD') || '-' || LPAD(seq::text, 5, '0'),
     (RANDOM() * 499 + 1)::integer,
     CASE (seq % 10)
         WHEN 0 THEN 'pending'
@@ -457,7 +457,9 @@ SELECT
         WHEN seq % 10 = 9 THEN 'refunded'
         ELSE 'paid'
     END,
-    CURRENT_TIMESTAMP - (seq / 7 || ' days')::interval - (RANDOM() * 6 || ' hours')::interval
+    -- Use interval math, not float||' hours' text casts: RANDOM() floats can
+    -- stringify as scientific notation ("4.6e-05 hours") which ::interval rejects.
+    CURRENT_TIMESTAMP - make_interval(days => seq / 7) - (RANDOM() * INTERVAL '6 hours')
 FROM generate_series(1, 5000) AS seq;
 
 -- Update total_amount
@@ -514,7 +516,7 @@ SELECT
     RANDOM() > 0.3,
     RANDOM() > 0.1,
     (RANDOM() * 50)::integer,
-    CURRENT_TIMESTAMP - (RANDOM() * 365 || ' days')::interval
+    CURRENT_TIMESTAMP - (RANDOM() * INTERVAL '365 days')
 FROM generate_series(1, 1500) AS seq
 CROSS JOIN LATERAL (SELECT id FROM products ORDER BY RANDOM() LIMIT 1) p;
 
@@ -539,7 +541,7 @@ SELECT
     CASE WHEN seq % 5 IN (1,2,3) THEN 'ORD-' || (RANDOM() * 5000 + 1)::integer ELSE NULL END,
     CASE WHEN seq % 5 = 4 THEN 'Inventory count adjustment' ELSE NULL END,
     'system',
-    CURRENT_TIMESTAMP - (RANDOM() * 180 || ' days')::interval
+    CURRENT_TIMESTAMP - (RANDOM() * INTERVAL '180 days')
 FROM generate_series(1, 10000) AS seq
 CROSS JOIN LATERAL (SELECT id FROM products ORDER BY RANDOM() LIMIT 1) p;
 
@@ -571,7 +573,7 @@ SELECT
     CASE (seq % 3) WHEN 0 THEN 'INSERT' WHEN 1 THEN 'UPDATE' ELSE 'INSERT' END,
     '{"status": "updated"}'::jsonb,
     'system',
-    CURRENT_TIMESTAMP - (seq / 100 || ' hours')::interval
+    CURRENT_TIMESTAMP - make_interval(hours => seq / 100)
 FROM generate_series(1, 50000) AS seq;
 
 -- ============================================================================

scripts/self-host/seed-demo-data.sh

@@ -55,24 +55,54 @@ echo "=========================================="
 if [[ "$DEEPSQL_SEED_SKIP_DEMO_DB" != "1" ]]; then
     echo ""
     echo "Step 1: Creating demo_shop database..."
-    
-    # Check if demo_shop already exists
+
+    demo_sql="$ROOT_DIR/docker/postgres/init/10_create_demo_shop.sql"
     demo_exists="$(compose exec -T postgres psql -U postgres -At -c "SELECT 1 FROM pg_database WHERE datname = 'demo_shop'" 2>/dev/null || echo "")"
-    
+    # Presence alone is not enough: a failed init leaves an empty-ish catalog
+    # (products/customers seeded, orders aborted on interval cast) and the old
+    # skip path permanently left customers with a half-built demo.
+    order_count="0"
     if [[ "$demo_exists" == "1" ]]; then
-        echo "  demo_shop database already exists. Skipping creation."
-        echo "  (Set DEEPSQL_SEED_SKIP_DEMO_DB=1 to always skip, or drop the database to recreate)"
+        order_count="$(compose exec -T postgres psql -U postgres -d demo_shop -At -c "SELECT COUNT(*) FROM orders" 2>/dev/null || echo "0")"
+    fi
+
+    recreate_demo=0
+    if [[ "${DEEPSQL_SEED_FORCE_DEMO_DB:-0}" == "1" ]]; then
+        recreate_demo=1
+    elif [[ "$demo_exists" == "1" && "${order_count:-0}" -lt 1000 ]]; then
+        # Full seed inserts 5000 orders. Anything well below that means the
+        # init script aborted mid-file (historically: float||' hours' interval
+        # casts) — treat it as incomplete and rebuild.
+        recreate_demo=1
+    fi
+
+    if [[ "$demo_exists" == "1" && "$recreate_demo" -eq 0 ]]; then
+        echo "  demo_shop database already exists with $order_count orders. Skipping creation."
+        echo "  (Set DEEPSQL_SEED_FORCE_DEMO_DB=1 to drop and recreate, or DEEPSQL_SEED_SKIP_DEMO_DB=1 to skip)"
+    elif [[ ! -f "$demo_sql" ]]; then
+        echo "  Warning: demo_shop SQL script not found at $demo_sql"
+        echo "  Skipping demo database creation."
     else
-        demo_sql="$ROOT_DIR/docker/postgres/init/10_create_demo_shop.sql"
-        if [[ -f "$demo_sql" ]]; then
-            echo "  Running demo_shop creation script..."
-            compose exec -T postgres psql -U postgres -f /docker-entrypoint-initdb.d/10_create_demo_shop.sql >/dev/null 2>&1 || \
-                compose exec -T postgres psql -U postgres < "$demo_sql"
-            echo "  demo_shop database created successfully."
+        if [[ "$demo_exists" == "1" ]]; then
+            echo "  demo_shop exists but looks incomplete (orders=${order_count:-0}). Recreating…"
+            # DROP DATABASE cannot run inside a multi-statement -c transaction.
+            compose exec -T postgres psql -U postgres -v ON_ERROR_STOP=1 -c \
+                "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = 'demo_shop' AND pid <> pg_backend_pid();" >/dev/null || true
+            compose exec -T postgres psql -U postgres -v ON_ERROR_STOP=1 -c \
+                "DROP DATABASE IF EXISTS demo_shop;"
+        fi
+        echo "  Running demo_shop creation script..."
+        # Prefer the bind-mounted init script so recreate matches first-boot.
+        # ON_ERROR_STOP so a mid-file failure cannot look like success.
+        # The SQL file itself starts with DROP/CREATE DATABASE — run it against
+        # the postgres maintenance DB, not demo_shop.
+        if compose exec -T postgres test -f /docker-entrypoint-initdb.d/10_create_demo_shop.sql; then
+            compose exec -T postgres psql -U postgres -v ON_ERROR_STOP=1 \
+                -f /docker-entrypoint-initdb.d/10_create_demo_shop.sql
         else
-            echo "  Warning: demo_shop SQL script not found at $demo_sql"
-            echo "  Skipping demo database creation."
+            compose exec -T postgres psql -U postgres -v ON_ERROR_STOP=1 < "$demo_sql"
         fi
+        echo "  demo_shop database created successfully."
     fi
 else
     echo "Step 1: Skipping demo_shop database creation (DEEPSQL_SEED_SKIP_DEMO_DB=1)"
@@ -146,18 +176,25 @@ else
   "password": "${DB_PASSWORD}",
   "cloudProvider": "self-hosted",
   "ssl": false,
-  "sslMode": "disable",
+  "sslMode": "none",
   "sshEnabled": false
 }
 JSON
 )
 
-    save_json="$(curl -fsS -b "$cookie_jar" -H 'Content-Type: application/json' \
-        -X POST "$base/connections" -d "$payload" 2>/dev/null || echo "{}")"
+    # Match smoke-test.sh: sslMode must be "none" (not "disable"). Any other value
+    # is treated as SSL-on by ConnectionRequest.getEffectiveSsl(), and the vault
+    # Postgres image rejects SSL — so the connection test fails and the seed
+    # used to report only an opaque "{}".
+    http_code="$(curl -sS -o /tmp/deepsql-seed-conn.json -w '%{http_code}' -b "$cookie_jar" \
+        -H 'Content-Type: application/json' \
+        -X POST "$base/connections" -d "$payload" || true)"
+    save_json="$(cat /tmp/deepsql-seed-conn.json 2>/dev/null || echo "{}")"
+    rm -f /tmp/deepsql-seed-conn.json
     connection_id="$(printf '%s' "$save_json" | sed -n 's/.*"connectionId":"\([^"]*\)".*/\1/p')"
 
     if [[ -z "$connection_id" ]]; then
-        echo "  Warning: Could not create demo connection."
+        echo "  Warning: Could not create demo connection (HTTP ${http_code:-?})."
         echo "  Response: $save_json"
         echo "  Continuing with other seed data..."
     else

scripts/self-host/smoke-test.sh

@@ -18,6 +18,7 @@ source "$ENV_FILE"
 set +a
 
 : "${DEEPSQL_BACKEND_PORT:=8080}"
+: "${DEEPSQL_FRONTEND_PORT:=3000}"
 : "${DB_PASSWORD:=postgres}"
 : "${DEEPSQL_INITIAL_ADMIN_EMAIL:=}"
 : "${DEEPSQL_INITIAL_ADMIN_PASSWORD:=}"
@@ -87,7 +88,19 @@ trap 'rm -f "$cookie_jar"' EXIT
 login_json=""
 login_deadline=$((SECONDS + 120))
 while (( SECONDS < login_deadline )); do
-  if login_json="$(curl -fsS -c "$cookie_jar" -H 'Content-Type: application/json' -X POST "$base/auth/login" -d "{\"email\":\"${DEEPSQL_SMOKE_EMAIL}\",\"password\":\"${DEEPSQL_SMOKE_PASSWORD}\"}" 2>/dev/null)"; then
+  # Login through the frontend proxy so the cookie jar matches the Host the
+  # browser (and /agent-api auth_request) will use. A jar filled against
+  # :8080 alone has made nginx's auth_request return 401 even when /auth/me
+  # on the backend would succeed with the same cookie.
+  if login_json="$(curl -fsS -c "$cookie_jar" -H 'Content-Type: application/json' \
+       -X POST "http://localhost:${DEEPSQL_FRONTEND_PORT}/api/auth/login" \
+       -d "{\"email\":\"${DEEPSQL_SMOKE_EMAIL}\",\"password\":\"${DEEPSQL_SMOKE_PASSWORD}\"}" 2>/dev/null)"; then
+    break
+  fi
+  # Fall back to hitting the backend directly (older installs / no frontend).
+  if login_json="$(curl -fsS -c "$cookie_jar" -H 'Content-Type: application/json' \
+       -X POST "$base/auth/login" \
+       -d "{\"email\":\"${DEEPSQL_SMOKE_EMAIL}\",\"password\":\"${DEEPSQL_SMOKE_PASSWORD}\"}" 2>/dev/null)"; then
     break
   fi
   echo "Waiting for the backend to accept logins..."
@@ -227,10 +240,13 @@ if [[ "$DEEPSQL_SMOKE_AGENT" == "1" ]]; then
   fi
 
   # Browser path through nginx: profile switch must not 403 (Host/Origin CSRF).
+  # Do NOT send Origin here — that trips the agent's browser CSRF gate, which
+  # expects X-Hermes-CSRF-Token (the React Agent tab fetches that from
+  # /api/auth/status). Smoke validates the nginx auth_request + trusted-header
+  # path the way non-browser clients (and our curl diagnostics) do.
   switch_code="$(curl -sS -o /tmp/deepsql-agent-switch.json -w '%{http_code}' \
     -b "$cookie_jar" -c "$cookie_jar" \
     -H 'Content-Type: application/json' \
-    -H "Origin: http://localhost:${DEEPSQL_FRONTEND_PORT}" \
     -X POST "http://localhost:${DEEPSQL_FRONTEND_PORT}/agent-api/api/profile/switch" \
     -d '{"name":"u-admin"}' || true)"
   if [[ "$switch_code" != "200" ]]; then
@@ -246,22 +262,21 @@ if [[ "$DEEPSQL_SMOKE_AGENT" == "1" ]]; then
     switch_code="$(curl -sS -o /tmp/deepsql-agent-switch.json -w '%{http_code}' \
       -b "$cookie_jar" -c "$cookie_jar" \
       -H 'Content-Type: application/json' \
-      -H "Origin: http://localhost:${DEEPSQL_FRONTEND_PORT}" \
       -X POST "http://localhost:${DEEPSQL_FRONTEND_PORT}/agent-api/api/profile/switch" \
       -d "{\"name\":\"${profile}\"}" || true)"
   else
     profile="u-admin"
   fi
   if [[ "$switch_code" != "200" ]]; then
     echo "Error: /agent-api/api/profile/switch → HTTP ${switch_code} (expected 200)." >&2
-    echo "       Common cause: nginx Host header dropping :${DEEPSQL_FRONTEND_PORT} (CSRF)." >&2
+    echo "       Common cause: nginx Host header dropping :${DEEPSQL_FRONTEND_PORT} (CSRF)," >&2
+    echo "       or DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS missing the compose bridge." >&2
     cat /tmp/deepsql-agent-switch.json 2>/dev/null >&2 || true
     exit 1
   fi
 
   session_json="$(curl -fsS -b "$cookie_jar" -c "$cookie_jar" \
     -H 'Content-Type: application/json' \
-    -H "Origin: http://localhost:${DEEPSQL_FRONTEND_PORT}" \
     -X POST "http://localhost:${DEEPSQL_FRONTEND_PORT}/agent-api/api/session/new" \
     -d "{\"profile\":\"${profile}\",\"enabled_toolsets\":[\"deepsql\",\"skills\"]}")"
   session_id="$(printf '%s' "$session_json" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("session",{}).get("session_id") or "")' 2>/dev/null || true)"
@@ -272,11 +287,16 @@ if [[ "$DEEPSQL_SMOKE_AGENT" == "1" ]]; then
   fi
 
   # Backend→agent session (dashboard path) — same as AgentChatClient.ensureSession.
+  # X-Remote-User is required once HERMES_WEBUI_TRUSTED_AUTH_HEADER is set; the
+  # compose bridge is allowlisted via DEEPSQL_AGENT_TRUSTED_PROXY_CIDRS.
+  remote_user="${profile#u-}"
   backend_switch="$(compose exec -T backend sh -c \
     "curl -fsS -c /tmp/hc.jar -H 'Content-Type: application/json' \
+      -H 'X-Remote-User: ${remote_user}' \
       -X POST '${AGENT_WEBUI_URL}/api/profile/switch' \
       -d '{\"name\":\"${profile}\"}' >/dev/null && \
      curl -fsS -b /tmp/hc.jar -c /tmp/hc.jar -H 'Content-Type: application/json' \
+      -H 'X-Remote-User: ${remote_user}' \
       -X POST '${AGENT_WEBUI_URL}/api/session/new' \
       -d '{\"profile\":\"${profile}\",\"enabled_toolsets\":[\"deepsql\",\"skills\"]}'")"
   if [[ "$backend_switch" != *"session_id"* ]]; then