# BusinessInsight Agent Package

This package runs `BusinessInsight.Agent.dll` through `dotnet` from the customer `.cmd` launcher. It does not require `BusinessInsight.Agent.exe`.

Database credentials are not stored in the Business Insight portal or in the company launcher downloaded from signup. Use the graphical `BusinessInsight.Agent.Setup.exe` wizard on the client computer to choose the local database, test the connection, and save it encrypted with Windows DPAPI for that Windows user.

## Files

- `Start-mfg_client_091-Agent.cmd`: Starts the Adventure Works Manufacturing customer profile for tenant `mfg_client_091` after local setup is complete.
- `Start-mtl-agent.cmd`: Starts the MTL / Oracle customer profile.
- `Start-BusinessInsight-Agent.ps1`: Generic launcher that accepts overrides.
- `BusinessInsight.Agent.Setup.exe`: Graphical setup wizard. It reads Tenant ID and Agent ID from the company launcher in this folder, discovers local SQL Server instances and ODBC DSNs, tests the connection, and saves the connection string encrypted on this computer.
- `BusinessInsight.Agent.Setup.cmd`: Convenience launcher for the setup wizard.
- `appsettings.json`: Default control-plane and tenant connection settings.

## Run Steps

1. Extract the zip to a permanent folder such as `C:\BusinessInsight.Agent`.
2. Make sure `.NET 9 x64` is installed. If `dotnet --info` fails, install the .NET 9 runtime or SDK.
3. Copy the company-specific launcher downloaded after signup into this folder.
4. Run `BusinessInsight.Agent.Setup.exe`. The wizard reads the company Tenant ID and Agent ID automatically from the downloaded launcher.
5. Choose the database type. For SQL Server, select from discovered local servers and click `Find databases`. For SQLite, Access, Excel, FoxPro, or another file/ODBC source, use the `...` browse button or select an existing ODBC DSN.
6. Click `Test connection`, then `Save and finish`. Use a read-only database account whenever username/password is required.
7. Start the required customer launcher. For Adventure Works Manufacturing, run `Start-mfg_client_091-Agent.cmd`.
   - `Start-mfg_client_091-Agent.cmd`
   - `Start-mtl-agent.cmd`
8. Leave the PowerShell window open while the agent is connected.

## Supported Database Types

- SQL Server / MSSQL
- PostgreSQL
- MySQL / MariaDB
- Oracle
- SQLite
- ODBC for Microsoft Access, Excel, FoxPro, and other local data sources with an installed Windows ODBC driver

For Access, Excel, FoxPro, and similar file-based sources, choose `Odbc` and use the `...` browse button, or create a Windows ODBC DSN first and select that DSN.

## Security Model

- Database credentials stay on the client computer.
- `agent-connections.local.json` stores connection strings encrypted with Windows DPAPI CurrentUser scope.
- The encrypted profile cannot be decrypted by copying it to another computer or another Windows user profile.
- Business Insight receives only read-only query results needed for dashboards.
- The Agent validates SQL and blocks write operations such as `INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, `TRUNCATE`, `MERGE`, `EXEC`, and `CREATE`.
- The safest database setup is a dedicated read-only database user restricted to reporting tables/views.

## Useful Commands

Use the generic launcher when you need to override the tenant identity values.

```powershell
.\Start-BusinessInsight-Agent.ps1 -TenantId "mfg_client_091" -AgentId "agent-mfg_client_091"
```

Use the MTL launcher with a one-off Oracle connection string override when needed.

```powershell
.\Start-mtl-agent.ps1 -ConnectionString "User Id=...;Password=...;Data Source=host:1521/service"
```

Use the MFG PowerShell launcher with the values already stored in `appsettings.json`.

```powershell
.\Start-mfg_client_091-Agent.ps1 -UseConfigConnection
```

## Kaspersky / Antivirus Exclusions

1. Extract the package to a fixed folder before the first run.
2. In Kaspersky, open `Settings`.
3. Open `Security settings` > `Threats and Exclusions`.
4. Add the extracted Agent folder as an exclusion.
5. If Kaspersky still blocks the launch, open `Security settings` > `Network settings` > `Configure trusted applications` and add `dotnet.exe` for this package.
6. If PowerShell scripts are blocked in your environment, start the `.cmd` launchers instead of running the `.ps1` files directly.

## Notes

- The package is configured by the company launcher and local encrypted profile.
- Keep the package folder name stable after adding antivirus exclusions.
- If you change `appsettings.json`, restart the launcher so the new values are used.
- If the control plane returns HTTP `500` during `/api/v1/agent-tunnel/connect`, the tenant and AgentId usually are not registered together in the live BusinessInsight company catalog yet. Register or update that tenant in the Admin Companies flow before retrying the launcher.