Boot priority: resume the user's active profile instead of the env DB; redact db_url passwords on all schema endpoints

Agent/worker.py

@@ -18,15 +18,25 @@ app = FastAPI(title="Agent Worker")
 # Schema profile registry (dynamic multi-DB support)
 # ---------------------------------------------------------------------------
 try:
-    from .schema_profile import ProfileRegistry
+    from .schema_profile import ProfileRegistry, _redact_db_url
 except Exception:
     import Agent.schema_profile as _sp
     ProfileRegistry = _sp.ProfileRegistry
+    _redact_db_url = _sp._redact_db_url
 
 SCHEMAS_DIR = os.path.join("uploads", "schemas")
 PROFILE_STORE_PATH = os.path.join("chat_store", "schema_profiles.json")
 profile_registry = ProfileRegistry(PROFILE_STORE_PATH)
 
+
+def _safe_profile(entry):
+    """Copy of a registry entry safe for public API responses (password masked)."""
+    if not isinstance(entry, dict):
+        return entry
+    safe = dict(entry)
+    safe["db_url"] = _redact_db_url(safe.get("db_url"))
+    return safe
+
 SUPPORTED_DB_SUFFIXES = {".sqlite", ".db", ".sqlite3", ".csv"}
 
 
@@ -119,7 +129,19 @@ async def startup_event():
     # ------------------------------------------------------------------
     db_url = os.environ.get("DB_CONNECTION_URL")
     active = profile_registry.active()
-    target_uri = db_url or (active or {}).get("db_url") or demo_db_url
+    # Boot priority: 1) the user's last ACTIVATED profile (persisted across
+    # restarts; never the auto-registered demo placeholder), 2) the env
+    # DB_CONNECTION_URL, 3) the bundled demo file. Previously the env secret
+    # ALWAYS won, so every restart silently yanked the engine back to the
+    # owner's default database even when the registry said the user was
+    # working in (e.g.) their car database — engine and registry disagreed
+    # and queries ran against the wrong database.
+    _active_kind = (active or {}).get("kind")
+    target_uri = (
+        (active or {}).get("db_url")
+        if active and _active_kind != "demo"
+        else None
+    ) or db_url or demo_db_url
 
     if target_uri:
         try:
@@ -171,6 +193,23 @@ async def startup_event():
         except Exception as e:
             # Log but continue; agentic_workflow has fallback behavior
             print(f"Worker: initialize_database failed: {e}")
+            # If the persisted profile's DB became unreachable (rotated
+            # credentials, deleted file), retry once with the env DB so the
+            # worker still boots with a usable database.
+            if db_url and target_uri != db_url:
+                try:
+                    print("[WORKER] Falling back to DB_CONNECTION_URL after failed profile boot")
+                    await agent.initialize_database(uri=db_url)
+                    _env_match = next(
+                        (p for p in profile_registry.list()
+                         if ((p.get("db_url") or "").replace("\\", "/") == db_url.replace("\\", "/"))),
+                        None,
+                    )
+                    if _env_match and profile_registry.active_id != _env_match["id"]:
+                        profile_registry.switch(_env_match["id"])
+                        print(f"[WORKER] Active profile switched to '{_env_match['name']}' (env fallback)")
+                except Exception as e2:
+                    print(f"Worker: env fallback failed: {e2}")
     else:
         print("Worker: no database available (no env DB, no profiles, no demo bundle)")
     # Optional Groq Vision health check in cloud mode
@@ -370,7 +409,8 @@ async def upload_image(file: UploadFile = File(...)):
 
 @app.get("/schemas")
 async def schemas_list():
-    return {"profiles": profile_registry.list(), "active_id": profile_registry.active_id}
+    return {"profiles": [_safe_profile(p) for p in profile_registry.list()],
+            "active_id": profile_registry.active_id}
 
 
 @app.post("/schemas/add")
@@ -393,7 +433,7 @@ async def schemas_add_json(req: AddSchemaJsonReq):
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"Profile saved, but DB init failed: {e}")
     # Return full schema digest preview
-    return {"profile": entry, "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize() if agent else None}
+    return {"profile": _safe_profile(entry), "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize() if agent else None}
 
 
 @app.post("/schemas/add-file")
@@ -462,7 +502,7 @@ async def schemas_add_file(file: UploadFile = File(...), name: Optional[str] = F
             await agent.initialize_database(uri=db_url, schema_notes=notes)
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"Profile saved, but DB init failed: {e}")
-    return {"profile": entry, "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize() if agent else None}
+    return {"profile": _safe_profile(entry), "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize() if agent else None}
 
 
 @app.post("/schemas/switch/{profile_id}")
@@ -484,7 +524,7 @@ async def schemas_switch(profile_id: str):
         await agent.initialize_database(uri=entry["db_url"], schema_notes=entry.get("notes"))
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"Switch failed: {e}")
-    return {"profile": entry, "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize()}
+    return {"profile": _safe_profile(entry), "schema": agent.ACTIVE_SCHEMA_PROFILE.summarize()}
 
 
 class SetSchemaNotesReq(BaseModel):