create-agents quickstart broken: unpinned `dolthub/doltgresql:latest` breaks project push (prepared statements / dolt versioning)

[rvbhavsar]

Summary

A fresh npx @inkeep/create-agents quickstart cannot create/push any project. inkeep push (and the Visual Builder's own /manage/... calls) fail with HTTP 500, root cause role "appuser" does not exist on SELECT * FROM dolt_tags in the Dolt versioning layer.

The underlying cause is that the generated docker-compose.db.yml pins the Manage DB to an unpinned, pull_policy: always image:

doltgres-db:
  image: dolthub/doltgresql:latest
  pull_policy: always

Your maintained root docker-compose.yml pins dolthub/doltgresql:0.56.7, but create-agents-template/docker-compose.db.yml ships :latest. New users pull whatever built that day. Today's :latest (image built 2026-07-10) has a regression in the Dolt versioning/role path that 500s every project-full request.

Environment

• @inkeep/create-agents (latest), packages @inkeep/agents-*@0.80.4
• macOS (Apple Silicon), Node 22.23.1, pnpm 10.32.1, Docker 29.6.1
• dolthub/doltgresql:latest digest sha256:b4628dd35a0b44bbf957afe38d33e7f29bfa1a8dc5b1402fe5fc3237b33b14bd, created=2026-07-10T17:42:31Z

Reproduce

npx @inkeep/create-agents my-agents
cd my-agents
pnpm setup-dev      # completes with "may not have been seeded" warning
pnpm dev            # (or pnpm dev:all)
pnpm exec inkeep push --project src/projects/activities-planner --config src/inkeep.config.ts

setup-dev itself reports the seed failure; the standalone push reproduces it deterministically.

Root cause (verified)

The 500 originates in @inkeep/agents-core/dist/dolt/commit.js → doltListTags → resolveProjectRef:

ERROR (agents-api): Failed query: SELECT * FROM dolt_tags
  caused by: error: role "appuser" does not exist

This is not an app auth/role problem. appuser connects fine and the healthcheck passes. The real issue is the Doltgres image:

On :latest (built today): drizzle-kit migrate succeeds, but the Dolt versioning path 500s with the misleading role "appuser" does not exist on SELECT * FROM dolt_tags.

On tagged stable 0.57.0 / 0.56.7: the versioning layer is fine (SELECT * FROM dolt_tags and dolt_branches work), but Doltgres does not support prepared statements, which node-pg/drizzle-orm use for every query:

$ psql -U appuser -d inkeep_agents -c "PREPARE t AS SELECT * FROM dolt_tags; EXECUTE t;"
ERROR:  PREPARE is not yet supported Please file an issue at https://github.com/dolthub/doltgresql/issues

So drizzle-kit migrate and all app queries fail on the older tags, while the newest :latest build regressed the versioning/role handling. No currently available Doltgres image both supports prepared statements and has a working versioning layer, and the quickstart's unpinned :latest guarantees users hit whichever break shipped that day.

Evidence the SQL itself is fine on 0.57.0: applying all 25 @inkeep/agents-core/drizzle/manage/*.sql migrations directly via psql (simple query protocol) succeeds and creates all 40 tables; only the node-pg/drizzle prepared-statement path fails.

Suggested fix

1. Pin the Manage DB image in create-agents-template/docker-compose.db.yml (and the other template composes using :latest) to a known-good Doltgres tag that supports prepared statements — the same version you validate CI against — instead of dolthub/doltgresql:latest with pull_policy: always.
2. Consider surfacing the real Doltgres error in pnpm db:manage:migrate (scripts/migrate-dolt.ts currently runs drizzle-kit migrate with stdio: 'inherit', and drizzle-kit swallows the failure — it exits 1 with empty stderr, making this very hard to diagnose).

Happy to provide full logs / test any candidate pinned tag.

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}

[rvbhavsar]

Additional decisive evidence — the failure is at the connection layer, not just the dolt_tags query.

Using the exact pg client the app ships with, against a freshly-created, untouched dolthub/doltgresql:latest container (digest sha256:b4628dd…, built 2026-07-10):

appuser@127.0.0.1: FAILED at connect: role "appuser" does not exist
appuser@localhost: FAILED at connect: role "appuser" does not exist
postgres@127.0.0.1: FAILED at connect: role "postgres" does not exist
doltgres@127.0.0.1: FAILED at connect: role "doltgres" does not exist

node-pg cannot open a session as any role. Meanwhile:

• psql -U appuser (used by the container healthcheck) connects fine — its trust path sidesteps the role lookup, which is why setup-dev's healthcheck passes and masks this.
• pg_roles returns 0 rows, yet CREATE ROLE appuser returns role "appuser" already exists — the role catalog is internally inconsistent.
• The same node-pg client connects and runs extended-protocol queries flawlessly against the regular Postgres on 5433 (postgres:18), so the client is fine — Doltgres is the sole problem.

Net: today's dolthub/doltgresql:latest is unusable over the standard Postgres wire protocol that every Node/pg app relies on, and the quickstart pulling it unpinned (pull_policy: always) means every new user is dead on arrival for project creation until a good image is pinned. Also filing on the Doltgres side; pinning create-agents-template to a validated tag would unblock the quickstart immediately.

[rvbhavsar]

Correction / key update — root cause is the connection path, not the image version.

I retested the same running dolthub/doltgresql:latest container two ways:

• Host → container via the mapped port (localhost:5432, Docker Desktop's port-forward proxy) — what pnpm dev / inkeep push use, since the API runs on the host:

  FAILED at connect: role "appuser" does not exist
  

• Container → container over the Docker network (doltgres-db:5432), using the same bundled pg client:

  connect OK
  dolt_tags extended: OK rows=0   ← the query that 500s from the host
  

So node-pg ↔ Doltgres works fine over real container networking; it only breaks when the connection traverses Docker Desktop's host port-forwarding proxy on macOS. That proxy appears to mangle Doltgres's startup/auth handshake (Doltgres's empty pg_roles + trust auth is unusual, and the proxy path surfaces it as role "..." does not exist; psql's simple/trust path happens to survive it).

Implications:

• The dev quickstart (pnpm dev + docker-compose.db.yml) is broken on macOS/Docker Desktop specifically, because the host-run API reaches the DB through the proxy. Pinning the image likely won't fix that path.
• The full containerized docker-compose.yml (API + migrate run in-network) should be unaffected, as should any real deployment (e.g. Railway) that uses container-to-container networking.

Repro is a plain pg.Client against postgresql://appuser:password@localhost:5432/inkeep_agents (fails at connect) vs @doltgres-db:5432 from a container on the same network (succeeds). The same client connects + runs extended-protocol queries fine against the sibling postgres:18 on 5433 through the proxy, so it's specific to Doltgres over the Docker Desktop proxy. Worth surfacing upstream to dolthub/doltgresql as well.