From 5f9421ed8bbc82d50bc156fff5c261b7e043d8bb Mon Sep 17 00:00:00 2001
From: Simon Strandgaard <neoneye@gmail.com>
Date: Fri, 10 Apr 2026 15:05:17 +0200
Subject: [PATCH 1/4] feat: add User ID override field to demo_run page

Allows admins to run plans as a different user. Leave empty to
use the current user's ID. Works with both POST and GET methods.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend_multi_user/templates/demo_run.html | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/frontend_multi_user/templates/demo_run.html b/frontend_multi_user/templates/demo_run.html
index 634f0af28..202d51ea9 100644
--- a/frontend_multi_user/templates/demo_run.html
+++ b/frontend_multi_user/templates/demo_run.html
@@ -208,14 +208,18 @@ <h1>Demo Run</h1>
         <div class="iframe-container">
             <iframe name="run-iframe" title="Run Page"></iframe>
         </div>
-        <div class="userid-container">User ID: <span>{{ user_id }}</span></div>
+        <div class="userid-container">
+            <label for="user-id-override">User ID override:</label>
+            <input type="text" id="user-id-override" placeholder="{{ user_id }}" style="font-family:monospace; font-size:14px; padding:4px 8px; border:1px solid #ccc; border-radius:4px; width:320px; margin-left:8px;">
+            <span style="font-size:12px; color:#999; margin-left:8px;">Leave empty to use current user</span>
+        </div>
     </div>
 
     <!-- Hidden form used to POST to /run into the iframe -->
     <form id="run-form" action="/run" method="POST" target="run-iframe" style="display: none">
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <input type="hidden" name="prompt" id="form-prompt" value="">
-        <input type="hidden" name="user_id" value="{{ user_id }}">
+        <input type="hidden" name="user_id" id="form-user-id" value="{{ user_id }}">
         <input type="hidden" name="nonce" value="{{ nonce }}">
         <!-- Values are submitted only when enabled (not disabled) -->
         <input type="hidden" name="speed_vs_detail" id="form-speed-vs-detail" value="ping_llm">
@@ -289,14 +293,16 @@ <h1>Demo Run</h1>
             const iframeContainer = document.querySelector('.iframe-container');
             const inputContainer = document.querySelector('.input-container');
             const iframe = iframeContainer.querySelector('iframe');
+            const userIdOverride = document.getElementById('user-id-override').value.trim();
+            const effectiveUserId = userIdOverride || '{{ user_id }}';
 
             if (methodSelect.value === 'GET') {
                 // GET method: build URL with query parameters
-                let url = `/run?prompt=${encodeURIComponent(promptValue)}&user_id={{ user_id }}&nonce={{ nonce }}&speed_vs_detail=${encodeURIComponent(speedVsDetailValue)}&model_profile=${encodeURIComponent(modelProfileValue)}`;
+                let url = `/run?prompt=${encodeURIComponent(promptValue)}&user_id=${encodeURIComponent(effectiveUserId)}&nonce={{ nonce }}&speed_vs_detail=${encodeURIComponent(speedVsDetailValue)}&model_profile=${encodeURIComponent(modelProfileValue)}`;
                 if (developerChecked) {
                     url += '&developer';
                 }
-                
+
                 // Update iframe src with the prompt
                 iframe.src = url;
             } else {
@@ -304,6 +310,7 @@ <h1>Demo Run</h1>
                 const form = document.getElementById('run-form');
                 document.getElementById('form-prompt').value = promptValue;
                 document.getElementById('form-model-profile').value = modelProfileValue;
+                document.getElementById('form-user-id').value = effectiveUserId;
 
                 // Submit flags only when checked (disable when unchecked so they are not submitted)
                 const developerInput = document.getElementById('form-developer');

From 8e8aea416e53016b2676d880a83be7eb726afcdb Mon Sep 17 00:00:00 2001
From: Simon Strandgaard <neoneye@gmail.com>
Date: Fri, 10 Apr 2026 15:09:25 +0200
Subject: [PATCH 2/4] fix: move User ID override between Submit method and
 Submit button

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend_multi_user/templates/demo_run.html | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/frontend_multi_user/templates/demo_run.html b/frontend_multi_user/templates/demo_run.html
index 202d51ea9..09923c075 100644
--- a/frontend_multi_user/templates/demo_run.html
+++ b/frontend_multi_user/templates/demo_run.html
@@ -203,16 +203,16 @@ <h1>Demo Run</h1>
                 </select>
                 <span class="method-info" id="method-info">Recommended: payload not captured in logs</span>
             </div>
+            <div class="select-container">
+                <label for="user-id-override">User ID override:</label>
+                <input type="text" id="user-id-override" placeholder="{{ user_id }}" style="font-family:monospace; font-size:14px; padding:4px 8px; border:1px solid #ccc; border-radius:4px; width:320px;">
+                <span style="font-size:12px; color:#999;">Leave empty to use current user</span>
+            </div>
             <button id="submit-button">Submit</button>
         </div>
         <div class="iframe-container">
             <iframe name="run-iframe" title="Run Page"></iframe>
         </div>
-        <div class="userid-container">
-            <label for="user-id-override">User ID override:</label>
-            <input type="text" id="user-id-override" placeholder="{{ user_id }}" style="font-family:monospace; font-size:14px; padding:4px 8px; border:1px solid #ccc; border-radius:4px; width:320px; margin-left:8px;">
-            <span style="font-size:12px; color:#999; margin-left:8px;">Leave empty to use current user</span>
-        </div>
     </div>
 
     <!-- Hidden form used to POST to /run into the iframe -->

From 796474885c31ec999c27e3388cd7500b188c9e69 Mon Sep 17 00:00:00 2001
From: Simon Strandgaard <neoneye@gmail.com>
Date: Fri, 10 Apr 2026 15:12:53 +0200
Subject: [PATCH 3/4] refactor: move demo_run to /admin/demo_run with
 Flask-Admin UI

Route moved from /demo_run to /admin/demo_run, template now extends
admin/master.html for consistent admin navigation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend_multi_user/src/admin_routes.py       |  14 +-
 .../templates/admin/demo_run.html             | 279 +++++++++++++++
 .../templates/admin/index.html                |   2 +-
 frontend_multi_user/templates/demo_run.html   | 330 ------------------
 4 files changed, 289 insertions(+), 336 deletions(-)
 create mode 100644 frontend_multi_user/templates/admin/demo_run.html
 delete mode 100644 frontend_multi_user/templates/demo_run.html

diff --git a/frontend_multi_user/src/admin_routes.py b/frontend_multi_user/src/admin_routes.py
index 8d7169cda..b44504859 100644
--- a/frontend_multi_user/src/admin_routes.py
+++ b/frontend_multi_user/src/admin_routes.py
@@ -406,9 +406,9 @@ def generate():
     return response
 
 
-@admin_routes_bp.route("/demo_run")
+@admin_routes_bp.route("/admin/demo_run")
 @_admin_required
-def demo_run():
+def admin_demo_run():
     from src.app import _model_profile_options, DEMO_FORM_RUN_PROMPT_UUIDS
     user_id = str(current_user.id)
     nonce = "DEMO_" + str(uuid.uuid4())
@@ -417,14 +417,18 @@ def demo_run():
     for prompt_uuid in DEMO_FORM_RUN_PROMPT_UUIDS:
         prompt_item = prompt_catalog.find(prompt_uuid)
         if prompt_item is None:
-            logger.error(f"Prompt item not found for uuid: {prompt_uuid} in demo_run")
+            logger.error(f"Prompt item not found for uuid: {prompt_uuid} in admin_demo_run")
             return "Error: Demo prompt configuration missing.", 500
         prompts.append(prompt_item.prompt)
 
-    return render_template(
-        "demo_run.html",
+    admin_ext = current_app.extensions.get("admin", [None])
+    admin_obj = admin_ext[0] if isinstance(admin_ext, list) and admin_ext else None
+    template_args = dict(
         user_id=user_id,
         prompts=prompts,
         nonce=nonce,
         model_profile_options=_model_profile_options(),
     )
+    if admin_obj:
+        return admin_obj.index_view.render("admin/demo_run.html", **template_args)
+    return render_template("admin/demo_run.html", **template_args)
diff --git a/frontend_multi_user/templates/admin/demo_run.html b/frontend_multi_user/templates/admin/demo_run.html
new file mode 100644
index 000000000..4f54cc24d
--- /dev/null
+++ b/frontend_multi_user/templates/admin/demo_run.html
@@ -0,0 +1,279 @@
+{% extends 'admin/master.html' %}
+
+{% block head_css %}
+  {{ super() }}
+  <style>
+    .demo-run-wrap {
+        max-width: 1200px;
+        margin: 0 auto;
+        padding: 1.5rem;
+    }
+    .iframe-container {
+        width: 100%;
+        height: 80vh;
+        border: 1px solid #ddd;
+        border-radius: 8px;
+        overflow: hidden;
+        background-color: white;
+        box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        display: none;
+    }
+    iframe {
+        width: 100%;
+        height: 100%;
+        border: none;
+    }
+    .input-container {
+        background: white;
+        padding: 20px;
+        border-radius: 8px;
+        box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+    }
+    .example-prompt-buttons {
+        display: flex;
+        gap: 10px;
+        margin-bottom: 20px;
+    }
+    .example-prompt-buttons button {
+        padding: 10px 20px;
+        border: none;
+        border-radius: 6px;
+        background-color: #f0f0f0;
+        color: #333;
+        cursor: pointer;
+        transition: all 0.2s ease;
+        font-weight: 500;
+    }
+    .example-prompt-buttons button:hover {
+        background-color: #e0e0e0;
+        transform: translateY(-1px);
+    }
+    #prompt {
+        width: 100%;
+        height: 200px;
+        margin-bottom: 20px;
+        padding: 15px;
+        border: 2px solid #e0e0e0;
+        border-radius: 8px;
+        font-size: 16px;
+        line-height: 1.5;
+        resize: vertical;
+        transition: border-color 0.2s ease;
+        box-sizing: border-box;
+    }
+    #prompt:focus {
+        outline: none;
+        border-color: #0066cc;
+        box-shadow: 0 0 0 3px rgba(0,102,204,0.1);
+    }
+    .checkbox-container {
+        margin-bottom: 20px;
+        display: flex;
+        align-items: center;
+        gap: 10px;
+    }
+    .checkbox-container input[type="checkbox"] {
+        width: 18px;
+        height: 18px;
+        cursor: pointer;
+    }
+    .checkbox-container label {
+        font-size: 16px;
+        font-weight: 500;
+        color: #333;
+        cursor: pointer;
+    }
+    .select-container {
+        margin-bottom: 20px;
+        display: flex;
+        align-items: center;
+        gap: 10px;
+    }
+    .select-container label {
+        font-size: 16px;
+        font-weight: 500;
+        color: #333;
+    }
+    .select-container select {
+        padding: 10px 15px;
+        border: 2px solid #e0e0e0;
+        border-radius: 6px;
+        font-size: 16px;
+        background-color: white;
+        cursor: pointer;
+        transition: border-color 0.2s ease;
+    }
+    .select-container select:focus {
+        outline: none;
+        border-color: #0066cc;
+    }
+    .method-info {
+        font-size: 13px;
+        color: #666;
+        margin-left: 10px;
+        font-style: italic;
+    }
+    #submit-button {
+        display: block;
+        width: 100%;
+        padding: 15px 30px;
+        background-color: #0066cc;
+        color: white;
+        border: none;
+        border-radius: 8px;
+        font-size: 18px;
+        font-weight: 600;
+        cursor: pointer;
+        transition: all 0.2s ease;
+    }
+    #submit-button:hover {
+        background-color: #0052a3;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 8px rgba(0,0,0,0.1);
+    }
+    #submit-button:active {
+        transform: translateY(0);
+        box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+    }
+    .char-count-label {
+        margin-top: 5px;
+        text-align: right;
+        font-size: 12px;
+        color: #666;
+        font-family: monospace;
+    }
+  </style>
+{% endblock %}
+
+{% block body %}
+  {{ super() }}
+  <div class="demo-run-wrap">
+    <div class="input-container">
+        <div class="example-prompt-buttons"></div>
+        <textarea id="prompt"></textarea>
+        <div class="char-count-label" id="char-count">Characters: 0 | Bytes: 0</div>
+        <div class="select-container">
+            <label for="speed-vs-detail-select">Speed vs detail:</label>
+            <select id="speed-vs-detail-select">
+                <option value="fast_but_skip_details">Fast, but fewer details</option>
+                <option value="all_details_but_slow">All details, but slow</option>
+                <option value="ping_llm" selected>Ping LLM (single request)</option>
+            </select>
+        </div>
+        <div class="select-container">
+            <label for="model-profile-select">Model profile:</label>
+            <select id="model-profile-select">
+                {% for profile_option in model_profile_options %}
+                <option value="{{ profile_option.value }}" {% if profile_option.value == "baseline" %}selected{% endif %}>{{ profile_option.title }} - {{ profile_option.subtitle }}</option>
+                {% endfor %}
+            </select>
+        </div>
+        <div class="checkbox-container">
+            <input type="checkbox" id="developer-checkbox" checked>
+            <label for="developer-checkbox">Developer mode when checked. When unchecked it's production mode.</label>
+        </div>
+        <div class="select-container">
+            <label for="method-select">Submit method:</label>
+            <select id="method-select">
+                <option value="POST" selected>POST</option>
+                <option value="GET">GET</option>
+            </select>
+            <span class="method-info" id="method-info">Recommended: payload not captured in logs</span>
+        </div>
+        <div class="select-container">
+            <label for="user-id-override">User ID override:</label>
+            <input type="text" id="user-id-override" placeholder="{{ user_id }}" style="font-family:monospace; font-size:14px; padding:4px 8px; border:1px solid #ccc; border-radius:4px; width:320px;">
+            <span style="font-size:12px; color:#999;">Leave empty to use current user</span>
+        </div>
+        <button id="submit-button">Submit</button>
+    </div>
+    <div class="iframe-container">
+        <iframe name="run-iframe" title="Run Page"></iframe>
+    </div>
+  </div>
+
+  <form id="run-form" action="/run" method="POST" target="run-iframe" style="display: none">
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+      <input type="hidden" name="prompt" id="form-prompt" value="">
+      <input type="hidden" name="user_id" id="form-user-id" value="{{ user_id }}">
+      <input type="hidden" name="nonce" value="{{ nonce }}">
+      <input type="hidden" name="speed_vs_detail" id="form-speed-vs-detail" value="ping_llm">
+      <input type="hidden" name="model_profile" id="form-model-profile" value="baseline">
+      <input type="hidden" name="developer" id="form-developer" value="true">
+  </form>
+
+  <script>
+      const prompts = {{ prompts|tojson|safe }};
+
+      function updateCharCount() {
+          const textarea = document.getElementById('prompt');
+          const charCountLabel = document.getElementById('char-count');
+          const text = textarea.value;
+          const charCount = text.length;
+          const byteCount = new TextEncoder().encode(text).length;
+          charCountLabel.textContent = `Characters: ${charCount} | Bytes: ${byteCount}`;
+      }
+
+      function updateMethodInfo() {
+          const methodSelect = document.getElementById('method-select');
+          const methodInfo = document.getElementById('method-info');
+          if (methodSelect.value === 'POST') {
+              methodInfo.textContent = 'Recommended: payload not captured in logs';
+          } else {
+              methodInfo.textContent = 'Caution: prompt visible in URL and logs';
+          }
+      }
+
+      window.onload = function() {
+          document.getElementById('prompt').value = prompts[0];
+          updateCharCount();
+          document.getElementById('prompt').addEventListener('input', updateCharCount);
+          document.getElementById('method-select').addEventListener('change', updateMethodInfo);
+
+          const buttonContainer = document.querySelector('.example-prompt-buttons');
+          prompts.forEach((prompt, index) => {
+              const button = document.createElement('button');
+              button.id = `example-${index + 1}-button`;
+              button.textContent = `Example ${index + 1}`;
+              button.addEventListener('click', function() {
+                  document.getElementById('prompt').value = prompts[index];
+                  updateCharCount();
+              });
+              buttonContainer.appendChild(button);
+          });
+      };
+
+      document.getElementById('submit-button').addEventListener('click', function() {
+          const promptValue = document.getElementById('prompt').value;
+          const speedVsDetailValue = document.getElementById('speed-vs-detail-select').value;
+          const modelProfileValue = document.getElementById('model-profile-select').value;
+          const developerChecked = document.getElementById('developer-checkbox').checked;
+          const methodSelect = document.getElementById('method-select');
+          const iframeContainer = document.querySelector('.iframe-container');
+          const inputContainer = document.querySelector('.input-container');
+          const iframe = iframeContainer.querySelector('iframe');
+          const userIdOverride = document.getElementById('user-id-override').value.trim();
+          const effectiveUserId = userIdOverride || '{{ user_id }}';
+
+          if (methodSelect.value === 'GET') {
+              let url = `/run?prompt=${encodeURIComponent(promptValue)}&user_id=${encodeURIComponent(effectiveUserId)}&nonce={{ nonce }}&speed_vs_detail=${encodeURIComponent(speedVsDetailValue)}&model_profile=${encodeURIComponent(modelProfileValue)}`;
+              if (developerChecked) {
+                  url += '&developer';
+              }
+              iframe.src = url;
+          } else {
+              const form = document.getElementById('run-form');
+              document.getElementById('form-prompt').value = promptValue;
+              document.getElementById('form-model-profile').value = modelProfileValue;
+              document.getElementById('form-user-id').value = effectiveUserId;
+              const developerInput = document.getElementById('form-developer');
+              developerInput.disabled = !developerChecked;
+              document.getElementById('form-speed-vs-detail').value = speedVsDetailValue;
+              form.submit();
+          }
+
+          iframeContainer.style.display = 'block';
+          inputContainer.style.display = 'none';
+      });
+  </script>
+{% endblock %}
diff --git a/frontend_multi_user/templates/admin/index.html b/frontend_multi_user/templates/admin/index.html
index 19f98f384..e3428f8df 100644
--- a/frontend_multi_user/templates/admin/index.html
+++ b/frontend_multi_user/templates/admin/index.html
@@ -67,7 +67,7 @@ <h2>Primary links</h2>
     Ping LLMs
     <div class="description">Check if they are all running</div>
   </a>
-  <a href="/demo_run">
+  <a href="/admin/demo_run">
     Demo Run - End to end test
     <div class="description">Wraps the Run page inside an &lt;iframe&gt;.</div>
   </a>
diff --git a/frontend_multi_user/templates/demo_run.html b/frontend_multi_user/templates/demo_run.html
deleted file mode 100644
index 09923c075..000000000
--- a/frontend_multi_user/templates/demo_run.html
+++ /dev/null
@@ -1,330 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Demo Run</title>
-    <style>
-        body {
-            margin: 0;
-            padding: 20px;
-            font-family: Arial, sans-serif;
-            background-color: #f5f5f5;
-        }
-        .container {
-            max-width: 1200px;
-            margin: 0 auto;
-        }
-        h1 {
-            color: #333;
-            margin-bottom: 20px;
-        }
-        .iframe-container {
-            width: 100%;
-            height: 80vh;
-            border: 1px solid #ddd;
-            border-radius: 8px;
-            overflow: hidden;
-            background-color: white;
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-            display: none; /* Initially hidden */
-        }
-        iframe {
-            width: 100%;
-            height: 100%;
-            border: none;
-        }
-        .input-container {
-            background: white;
-            padding: 20px;
-            border-radius: 8px;
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-        }
-        .example-prompt-buttons {
-            display: flex;
-            gap: 10px;
-            margin-bottom: 20px;
-        }
-        .example-prompt-buttons button {
-            padding: 10px 20px;
-            border: none;
-            border-radius: 6px;
-            background-color: #f0f0f0;
-            color: #333;
-            cursor: pointer;
-            transition: all 0.2s ease;
-            font-weight: 500;
-        }
-        .example-prompt-buttons button:hover {
-            background-color: #e0e0e0;
-            transform: translateY(-1px);
-        }
-        #prompt {
-            width: 100%;
-            height: 200px;
-            margin-bottom: 20px;
-            padding: 15px;
-            border: 2px solid #e0e0e0;
-            border-radius: 8px;
-            font-size: 16px;
-            line-height: 1.5;
-            resize: vertical;
-            transition: border-color 0.2s ease;
-            box-sizing: border-box;
-        }
-        #prompt:focus {
-            outline: none;
-            border-color: #0066cc;
-            box-shadow: 0 0 0 3px rgba(0,102,204,0.1);
-        }
-        .checkbox-container {
-            margin-bottom: 20px;
-            display: flex;
-            align-items: center;
-            gap: 10px;
-        }
-        .checkbox-container input[type="checkbox"] {
-            width: 18px;
-            height: 18px;
-            cursor: pointer;
-        }
-        .checkbox-container label {
-            font-size: 16px;
-            font-weight: 500;
-            color: #333;
-            cursor: pointer;
-        }
-        .select-container {
-            margin-bottom: 20px;
-            display: flex;
-            align-items: center;
-            gap: 10px;
-        }
-        .select-container label {
-            font-size: 16px;
-            font-weight: 500;
-            color: #333;
-        }
-        .select-container select {
-            padding: 10px 15px;
-            border: 2px solid #e0e0e0;
-            border-radius: 6px;
-            font-size: 16px;
-            background-color: white;
-            cursor: pointer;
-            transition: border-color 0.2s ease;
-        }
-        .select-container select:focus {
-            outline: none;
-            border-color: #0066cc;
-        }
-        .method-info {
-            font-size: 13px;
-            color: #666;
-            margin-left: 10px;
-            font-style: italic;
-        }
-        #submit-button {
-            display: block;
-            width: 100%;
-            padding: 15px 30px;
-            background-color: #0066cc;
-            color: white;
-            border: none;
-            border-radius: 8px;
-            font-size: 18px;
-            font-weight: 600;
-            cursor: pointer;
-            transition: all 0.2s ease;
-        }
-        #submit-button:hover {
-            background-color: #0052a3;
-            transform: translateY(-1px);
-            box-shadow: 0 4px 8px rgba(0,0,0,0.1);
-        }
-        #submit-button:active {
-            transform: translateY(0);
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-        }
-        .userid-container {
-            text-align: center;
-            margin-top: 25px;
-            font-family: monospace;
-            font-size: 16px;
-            color: #666;
-        }
-        .userid-container span {
-            font-weight: bold;
-        }
-        .char-count-label {
-            margin-top: 5px;
-            text-align: right;
-            font-size: 12px;
-            color: #666;
-            font-family: monospace;
-        }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>Demo Run</h1>
-        <a href="/admin" style="display: inline-block; margin-bottom: 20px; color: #0066cc; text-decoration: none;">← Back to Admin</a>
-        <div class="input-container">
-            <div class="example-prompt-buttons">
-                <!-- Buttons will be dynamically generated here -->
-            </div>
-            <textarea id="prompt"></textarea>
-            <div class="char-count-label" id="char-count">Characters: 0 | Bytes: 0</div>
-            <div class="select-container">
-                <label for="speed-vs-detail-select">Speed vs detail:</label>
-                <select id="speed-vs-detail-select">
-                    <option value="fast_but_skip_details">Fast, but fewer details</option>
-                    <option value="all_details_but_slow">All details, but slow</option>
-                    <option value="ping_llm" selected>Ping LLM (single request)</option>
-                </select>
-            </div>
-            <div class="select-container">
-                <label for="model-profile-select">Model profile:</label>
-                <select id="model-profile-select">
-                    {% for profile_option in model_profile_options %}
-                    <option value="{{ profile_option.value }}" {% if profile_option.value == "baseline" %}selected{% endif %}>{{ profile_option.title }} - {{ profile_option.subtitle }}</option>
-                    {% endfor %}
-                </select>
-            </div>
-            <div class="checkbox-container">
-                <input type="checkbox" id="developer-checkbox" checked>
-                <label for="developer-checkbox">Developer mode when checked. When unchecked it's production mode.</label>
-            </div>
-            <div class="select-container">
-                <label for="method-select">Submit method:</label>
-                <select id="method-select">
-                    <option value="POST" selected>POST</option>
-                    <option value="GET">GET</option>
-                </select>
-                <span class="method-info" id="method-info">Recommended: payload not captured in logs</span>
-            </div>
-            <div class="select-container">
-                <label for="user-id-override">User ID override:</label>
-                <input type="text" id="user-id-override" placeholder="{{ user_id }}" style="font-family:monospace; font-size:14px; padding:4px 8px; border:1px solid #ccc; border-radius:4px; width:320px;">
-                <span style="font-size:12px; color:#999;">Leave empty to use current user</span>
-            </div>
-            <button id="submit-button">Submit</button>
-        </div>
-        <div class="iframe-container">
-            <iframe name="run-iframe" title="Run Page"></iframe>
-        </div>
-    </div>
-
-    <!-- Hidden form used to POST to /run into the iframe -->
-    <form id="run-form" action="/run" method="POST" target="run-iframe" style="display: none">
-        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
-        <input type="hidden" name="prompt" id="form-prompt" value="">
-        <input type="hidden" name="user_id" id="form-user-id" value="{{ user_id }}">
-        <input type="hidden" name="nonce" value="{{ nonce }}">
-        <!-- Values are submitted only when enabled (not disabled) -->
-        <input type="hidden" name="speed_vs_detail" id="form-speed-vs-detail" value="ping_llm">
-        <input type="hidden" name="model_profile" id="form-model-profile" value="baseline">
-        <input type="hidden" name="developer" id="form-developer" value="true">
-    </form>
-
-    <script>
-        const prompts = {{ prompts|tojson|safe }};
-
-        // Function to update character and byte count
-        function updateCharCount() {
-            const textarea = document.getElementById('prompt');
-            const charCountLabel = document.getElementById('char-count');
-            const text = textarea.value;
-            
-            // Count characters (UTF-8 code points)
-            const charCount = text.length;
-            
-            // Count bytes (UTF-8 encoded)
-            const byteCount = new TextEncoder().encode(text).length;
-            
-            charCountLabel.textContent = `Characters: ${charCount} | Bytes: ${byteCount}`;
-        }
-
-        // Function to update method info text
-        function updateMethodInfo() {
-            const methodSelect = document.getElementById('method-select');
-            const methodInfo = document.getElementById('method-info');
-            
-            if (methodSelect.value === 'POST') {
-                methodInfo.textContent = 'Recommended: payload not captured in logs';
-            } else {
-                methodInfo.textContent = 'Caution: prompt visible in URL and logs';
-            }
-        }
-
-        // Set default prompt on page load
-        window.onload = function() {
-            document.getElementById('prompt').value = prompts[0];
-            
-            // Update count on page load
-            updateCharCount();
-            
-            // Add event listener for real-time updates
-            document.getElementById('prompt').addEventListener('input', updateCharCount);
-            
-            // Add event listener for method select change
-            document.getElementById('method-select').addEventListener('change', updateMethodInfo);
-            
-            // Dynamically create example buttons
-            const buttonContainer = document.querySelector('.example-prompt-buttons');
-            prompts.forEach((prompt, index) => {
-                const button = document.createElement('button');
-                button.id = `example-${index + 1}-button`;
-                button.textContent = `Example ${index + 1}`;
-                button.addEventListener('click', function() {
-                    document.getElementById('prompt').value = prompts[index];
-                    updateCharCount(); // Update count when example is clicked
-                });
-                buttonContainer.appendChild(button);
-            });
-        };
-
-        document.getElementById('submit-button').addEventListener('click', function() {
-            const promptValue = document.getElementById('prompt').value;
-            const speedVsDetailValue = document.getElementById('speed-vs-detail-select').value;
-            const modelProfileValue = document.getElementById('model-profile-select').value;
-            const developerChecked = document.getElementById('developer-checkbox').checked;
-            const methodSelect = document.getElementById('method-select');
-            const iframeContainer = document.querySelector('.iframe-container');
-            const inputContainer = document.querySelector('.input-container');
-            const iframe = iframeContainer.querySelector('iframe');
-            const userIdOverride = document.getElementById('user-id-override').value.trim();
-            const effectiveUserId = userIdOverride || '{{ user_id }}';
-
-            if (methodSelect.value === 'GET') {
-                // GET method: build URL with query parameters
-                let url = `/run?prompt=${encodeURIComponent(promptValue)}&user_id=${encodeURIComponent(effectiveUserId)}&nonce={{ nonce }}&speed_vs_detail=${encodeURIComponent(speedVsDetailValue)}&model_profile=${encodeURIComponent(modelProfileValue)}`;
-                if (developerChecked) {
-                    url += '&developer';
-                }
-
-                // Update iframe src with the prompt
-                iframe.src = url;
-            } else {
-                // POST method: use hidden form
-                const form = document.getElementById('run-form');
-                document.getElementById('form-prompt').value = promptValue;
-                document.getElementById('form-model-profile').value = modelProfileValue;
-                document.getElementById('form-user-id').value = effectiveUserId;
-
-                // Submit flags only when checked (disable when unchecked so they are not submitted)
-                const developerInput = document.getElementById('form-developer');
-                developerInput.disabled = !developerChecked;
-                document.getElementById('form-speed-vs-detail').value = speedVsDetailValue;
-
-                // Submit the form to the iframe
-                form.submit();
-            }
-
-            // Show the iframe container and hide the input container
-            iframeContainer.style.display = 'block';
-            inputContainer.style.display = 'none';
-        });
-    </script>
-</body>
-</html>

From 7b93af3329e16a8754182d04a0ed31d75d58aee8 Mon Sep 17 00:00:00 2001
From: Simon Strandgaard <neoneye@gmail.com>
Date: Fri, 10 Apr 2026 15:20:45 +0200
Subject: [PATCH 4/4] fix: respect user_id override from admin in /run endpoint

When admin provides an explicit user_id (e.g. from demo_run page),
use it instead of overriding with the admin's own ID.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend_multi_user/src/plan_routes.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/frontend_multi_user/src/plan_routes.py b/frontend_multi_user/src/plan_routes.py
index b741962b6..6744bb958 100644
--- a/frontend_multi_user/src/plan_routes.py
+++ b/frontend_multi_user/src/plan_routes.py
@@ -626,8 +626,9 @@ def run():
     )
 
     if current_user.is_admin:
-        admin_account = _get_current_user_account()
-        user_id_param = str(admin_account.id) if admin_account else current_app.config["ADMIN_USERNAME"]
+        if not user_id_param:
+            admin_account = _get_current_user_account()
+            user_id_param = str(admin_account.id) if admin_account else current_app.config["ADMIN_USERNAME"]
     else:
         user_id_param = str(current_user.id)