end

  defp provider do

    :sarah

    :openagents

    |> Application.get_env(:tool_discovery, [])

    |> Keyword.get(:provider)

  end

  end

  defp default_top_k do

    :sarah

    :openagents

    |> Application.get_env(:tool_discovery, [])

    |> Keyword.get(:top_k, 12)

  end

  # ── run + translate ─────────────────────────────────────────────────────

  defp run(conn, grant, request) do

    provider = Application.fetch_env!(:sarah, :provider)

    provider = Application.fetch_env!(:openagents, :provider)

    parent = self()

    # The provider pushes events synchronously; capture them to this process's

defmodule OpenAgentsWeb.LegacyMachinesController do

  @moduledoc false

  use OpenAgentsWeb, :controller

  def show(conn, _params) do

    redirect(conn, to: ~p"/computers")

  end

end

  end

  defp principal_for(token) when is_binary(token) and token != "" do

    operator_token = Application.get_env(:sarah, :forge_operator_token)

    operator_token = Application.get_env(:openagents, :forge_operator_token)

    if is_binary(operator_token) and operator_token != "" and

         Plug.Crypto.secure_compare(token, operator_token) do

defmodule OpenAgents.Repo.Migrations.ReconcileForgeBuildsReceiptShape do

  @moduledoc """

  Port fix: `forge_builds` was created (223c6f6, "Phase 3 target and receipt

  persistence") with a shape that no module in this repo declares — a bigint

  key plus `source_sha`/`module_changes`/`artifact_path`. The only schema

  bound to that table is `OpenAgents.Forge.BuildReceipt`, which declares the

  upstream receipt shape (`repo`, `sha`, `modules`, `warnings`, `tests`,

  `artifact`, binary id).

  The mismatch is not merely cosmetic: `OpenAgents.Changelog.receipt_index/1`

  selects `forge_builds.repo`, so every query raised `UndefinedColumnError`,

  and `Changelog.build/1`'s `safely/2` rescue swallowed it — dropping the

  push, build **and** deploy receipts for the whole timeline. That is why a

  receipted deploy never appeared as a `:receipt` row and no entry ever

  carried `receipt_ids`.

  Guarded and non-destructive: it acts only when the divergent shape is

  present, and preserves any existing rows by renaming the old table aside

  rather than dropping it.

  """

  use Ecto.Migration

  def up do

    if divergent_shape?() do

      rename(table(:forge_builds), to: table(:forge_builds_phase3_legacy))

      create table(:forge_builds, primary_key: false) do

        add :id, :binary_id, primary_key: true

        add :repo, :string, null: false

        add :sha, :string, null: false

        add :target_id, :binary_id, null: false

        add :modules, {:array, :string}, null: false, default: []

        add :warnings, :text

        add :tests, :text

        add :duration_ms, :integer

        add :artifact, :string

        timestamps(type: :utc_datetime_usec, updated_at: false)

      end

      create unique_index(:forge_builds, [:repo, :sha, :target_id])

      create index(:forge_builds, [:repo, :inserted_at])

    end

  end

  def down do

    if receipt_shape?() do

      drop table(:forge_builds)

      rename(table(:forge_builds_phase3_legacy), to: table(:forge_builds))

    end

  end

  defp divergent_shape?, do: not has_column?("forge_builds", "repo")

  defp receipt_shape?,

    do: has_column?("forge_builds", "repo") and table?("forge_builds_phase3_legacy")

  defp has_column?(table, column) do

    query?("""

    SELECT 1 FROM information_schema.columns

    WHERE table_name = '#{table}' AND column_name = '#{column}'

    """)

  end

  defp table?(table) do

    query?("SELECT 1 FROM information_schema.tables WHERE table_name = '#{table}'")

  end

  defp query?(sql) do

    case repo().query(sql) do

      {:ok, %{num_rows: n}} -> n > 0

      _ -> false

    end

  end

end

  Tagged `:cluster`; run with `mix test --include cluster` (needs epmd).

  """

  use ExUnit.Case, async: false

  @moduletag :skip

  @moduletag :cluster

  @moduletag timeout: 180_000

  defp start_peer(name, cookie) do

    {:ok, peer, node} =

      :peer.start_link(%{

        name: name,

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

      Node.self() != :nonode@nohost ->

        :ok

      match?({:ok, _}, :net_kernel.start([:"sarah_test@127.0.0.1", :longnames])) ->

        :erlang.set_cookie(Node.self(), :sarah_cluster_test_cookie)

      # A fixed node name wedges this whole stage on any machine where an

      # earlier run left that name registered with epmd: net_kernel then

      # refuses to start and every distribution test flunks "unavailable".

      # Unique per run, and OpenAgents-named now that this is not Sarah's BEAM.

      match?({:ok, _}, :net_kernel.start([unique_test_node(), :longnames])) ->

        :erlang.set_cookie(Node.self(), :openagents_cluster_test_cookie)

        :ok

      true ->

      true -> Process.sleep(100) && eventually(fun, attempts - 1)

    end

  end

  defp unique_test_node do

    :erlang.list_to_atom(~c"openagents_test_#{:erlang.unique_integer([:positive])}@127.0.0.1")

  end

  # Peer node names register with epmd too. A fixed name that a killed peer

  # left behind makes the next run's :peer.start_link fail, so the gate is

  # green once and wedged thereafter. Suffix every peer uniquely.

  defp unique_peer_name(base) do

    :erlang.list_to_atom(~c"#{base}_#{:erlang.unique_integer([:positive])}")

  end

end

  Tagged `:cluster`; run with `mix test --include cluster` (needs epmd).

  """

  use ExUnit.Case, async: false

  @moduletag :skip

  @moduletag :cluster

  alias OpenAgents.Cluster.{Drain, Ra}

  defp start_peer(name, cookie) do

    {:ok, peer, node} =

      :peer.start_link(%{

        name: name,

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

      Node.self() != :nonode@nohost ->

        :ok

      match?({:ok, _}, :net_kernel.start([:"sarah_test@127.0.0.1", :longnames])) ->

        :erlang.set_cookie(Node.self(), :sarah_cluster_test_cookie)

      # A fixed node name wedges this whole stage on any machine where an

      # earlier run left that name registered with epmd: net_kernel then

      # refuses to start and every distribution test flunks "unavailable".

      # Unique per run, and OpenAgents-named now that this is not Sarah's BEAM.

      match?({:ok, _}, :net_kernel.start([unique_test_node(), :longnames])) ->

        :erlang.set_cookie(Node.self(), :openagents_cluster_test_cookie)

        :ok

      true ->

      true -> Process.sleep(100) && eventually(fun, attempts - 1)

    end

  end

  defp unique_test_node do

    :erlang.list_to_atom(~c"openagents_test_#{:erlang.unique_integer([:positive])}@127.0.0.1")

  end

  # Peer node names register with epmd too. A fixed name that a killed peer

  # left behind makes the next run's :peer.start_link fail, so the gate is

  # green once and wedged thereafter. Suffix every peer uniquely.

  defp unique_peer_name(base) do

    :erlang.list_to_atom(~c"#{base}_#{:erlang.unique_integer([:positive])}")

  end

end

  (needs epmd).

  """

  use ExUnit.Case, async: false

  @moduletag :skip

  @moduletag :cluster

  alias OpenAgents.Cluster.Ra

    # Stop peer2's local Raft server, leaving it in the cluster config but not

    # running here — the phantom-member state an ungraceful restart produces.

    :ok = :erpc.call(node2, :ra, :stop_server, [:default, {:sarah_sessions, node2}])

    # The Ra cluster atom was renamed `:sarah_sessions` -> `:openagents_sessions`

    # in `OpenAgents.Cluster.Ra`, but this line kept the old name. `:ra.stop_server`

    # answers `:ok` for a server id it does not know, so the stop silently did

    # nothing and peer2's real server stayed up. Ask the module for the id so the

    # test can never drift from the cluster name again.

    :ok = :erpc.call(node2, :ra, :stop_server, [:default, Ra.server_id(node2)])

    assert eventually(fn -> :erpc.call(node2, Ra, :members, [node2]) == [] end),

           "peer2 local server did not stop"

  defp start_peer(name, cookie, opts \\ []) do

    base = %{

      name: name,

      name: unique_peer_name(name),

      host: ~c"127.0.0.1",

      args: [~c"-setcookie", Atom.to_charlist(cookie)]

    }

      Node.self() != :nonode@nohost ->

        :ok

      match?({:ok, _}, :net_kernel.start([:"sarah_test@127.0.0.1", :longnames])) ->

        :erlang.set_cookie(Node.self(), :sarah_cluster_test_cookie)

      # A fixed node name wedges this whole stage on any machine where an

      # earlier run left that name registered with epmd: net_kernel then

      # refuses to start and every distribution test flunks "unavailable".

      # Unique per run, and OpenAgents-named now that this is not Sarah's BEAM.

      match?({:ok, _}, :net_kernel.start([unique_test_node(), :longnames])) ->

        :erlang.set_cookie(Node.self(), :openagents_cluster_test_cookie)

        :ok

      true ->

      true -> Process.sleep(100) && eventually(fun, attempts - 1)

    end

  end

  defp unique_test_node do

    :erlang.list_to_atom(~c"openagents_test_#{:erlang.unique_integer([:positive])}@127.0.0.1")

  end

  # Peer node names register with epmd too. A fixed name that a killed peer

  # left behind makes the next run's :peer.start_link fail, so the gate is

  # green once and wedged thereafter. Suffix every peer uniquely.

  defp unique_peer_name(base) do

    :erlang.list_to_atom(~c"#{base}_#{:erlang.unique_integer([:positive])}")

  end

end

defmodule OpenAgents.ClusterTest do

  use ExUnit.Case

  @moduletag :skip

  # Not async: the last test manipulates node-global distribution state.

  use ExUnit.Case, async: false

  alias OpenAgents.Cluster

  setup do

    on_exit(fn -> _ = Node.stop() end)

    :ok

  end

  test "single-node health report is well-formed" do

    report = Cluster.local_report()

    assert snapshot["size"] == 1

  end

  # Real peer nodes: gated to the `mix test --only cluster` stage, like every

  # other distribution test here. Left in the default suite it both needs epmd

  # and inherits whatever node-global state a previous cluster module left

  # behind — which is exactly how it came to fail on `net_kernel already started`.

  @tag :cluster

  test "three local nodes form a cluster, report a consistent revision, and detect a missing node" do

    start_epmd()

    start_distribution!()

    peers = start_peers(3)

      assert report2["missing"] == []

      refute to_string(down_node) in Enum.map(Cluster.members(), &to_string/1)

    after

      # Stop this test's peers, but leave net_kernel up. Stopping it stranded

      # every cluster module scheduled after this one: their

      # `ensure_distributed/0` then saw an undistributed node whose net_kernel

      # would no longer restart, and flunked "distribution unavailable".

      for {pid, _node} <- peers, do: safe_stop_peer(pid)

      _ = Node.stop()

      assert wait_for(fn -> Node.list() == [] end)

    end

  end

  # Idempotent: an already-distributed node is a legitimate state in the cluster

  # stage (another module got here first), not a reason to fail.

  defp start_distribution! do

    suffix = :erlang.unique_integer([:positive])

    name = :erlang.list_to_atom(~c"openagents_test_#{suffix}@127.0.0.1")

      :ok -> :ok

      true -> :ok

      {:ok, _pid} -> :ok

      {:error, {:already_started, _pid}} -> :ok

      other -> raise "Failed to start net_kernel: #{inspect(other)}"

    end

    :ok

  end

  defp start_epmd do

    # Start the Erlang port mapper if it is not already running.

    _ = System.cmd("epmd", ["-daemon"], stderr_to_stdout: true)

    :ok

  end

  defp start_peers(n) do

    ebins = [

      Application.app_dir(:openagents, "ebin"),

defmodule OpenAgents.SarahClusterTest do

  # Not async: it manipulates node-global distribution state.

  use ExUnit.Case, async: false

  @moduletag :skip

  alias OpenAgents.Cluster

  describe "single-node (undistributed or one member)" do

      {:ok, peer, node} =

        :peer.start_link(%{

          name: :sarah_cluster_peer,

          name: unique_peer_name("openagents_cluster_peer"),

          host: ~c"127.0.0.1",

          args: [~c"-setcookie", Atom.to_charlist(cookie)]

        })

      Node.self() != :nonode@nohost ->

        :ok

      match?({:ok, _}, :net_kernel.start([:"sarah_test@127.0.0.1", :longnames])) ->

        :erlang.set_cookie(Node.self(), :sarah_cluster_test_cookie)

      # Unique per run: a fixed name that a crashed run left registered with

      # epmd makes net_kernel refuse to start ever after. OpenAgents-named now

      # that this is not Sarah's BEAM.

      match?({:ok, _}, :net_kernel.start([unique_test_node(), :longnames])) ->

        :erlang.set_cookie(Node.self(), :openagents_cluster_test_cookie)

        :ok

      true ->

      true -> Process.sleep(50) && eventually(fun, attempts - 1)

    end

  end

  defp unique_test_node do

    :erlang.list_to_atom(~c"openagents_test_#{:erlang.unique_integer([:positive])}@127.0.0.1")

  end

  defp unique_peer_name(base) do

    :erlang.list_to_atom(~c"#{base}_#{:erlang.unique_integer([:positive])}")

  end

end

  defp start_peer(name, cookie) do

    {:ok, peer, node} =

      :peer.start_link(%{

        name: name,

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

      Node.self() != :nonode@nohost ->

        :ok

      match?({:ok, _}, :net_kernel.start([:"sarah_test@127.0.0.1", :longnames])) ->

        :erlang.set_cookie(Node.self(), :sarah_cluster_test_cookie)

      # A fixed node name wedges this whole stage on any machine where an

      # earlier run left that name registered with epmd: net_kernel then

      # refuses to start and every distribution test flunks "unavailable".

      # Unique per run, and OpenAgents-named now that this is not Sarah's BEAM.

      match?({:ok, _}, :net_kernel.start([unique_test_node(), :longnames])) ->

        :erlang.set_cookie(Node.self(), :openagents_cluster_test_cookie)

        :ok

      true ->

      true -> Process.sleep(100) && eventually(fun, attempts - 1)

    end

  end

  defp unique_test_node do

    :erlang.list_to_atom(~c"openagents_test_#{:erlang.unique_integer([:positive])}@127.0.0.1")

  end

  # Peer node names register with epmd too. A fixed name that a killed peer

  # left behind makes the next run's :peer.start_link fail, so the gate is

  # green once and wedged thereafter. Suffix every peer uniquely.

  defp unique_peer_name(base) do

    :erlang.list_to_atom(~c"#{base}_#{:erlang.unique_integer([:positive])}")

  end

end

defmodule OpenAgentsWeb.ComputersNavigationTest do

  use OpenAgentsWeb.SarahConnCase

  @moduletag :skip

  import Phoenix.LiveViewTest

  test "the canonical Computers surface carries authenticated application chrome", %{conn: conn} do

ExUnit.start(exclude: [:skip])

# The :cluster tag spins up real distributed peer nodes (needs epmd) and leaves

# node-global distribution state behind, so those tests cannot share a BEAM with

# the rest of the suite — a module that expects an undistributed node sees

# net_kernel already running. Upstream runs them as their own gate stage

# (`mix test --only cluster`); this excludes them here for the same reason.

# Note the exclusion is unconditional: `--include skip` must not drag them back

# in, so a :cluster module carries the :cluster tag only, never :skip too.

ExUnit.start(exclude: [:skip, :cluster])

# The cluster stage needs the Erlang port mapper up before its first peer node.

# Leaving that to whichever module happened to run first made the stage

# order-dependent: modules scheduled ahead of it flunked "distribution

# unavailable". Idempotent, and only paid for when that stage is selected.

cluster_stage? =

  ExUnit.configuration()

  |> Keyword.get(:include, [])

  |> Enum.any?(&(&1 == :cluster or match?({:cluster, _}, &1)))

if cluster_stage? do

  try do

    System.cmd("epmd", ["-daemon"], stderr_to_stdout: true)

  rescue

    # No epmd on PATH: the cluster tests flunk with their own clear message.

    _ -> :ok

  end

end

Ecto.Adapters.SQL.Sandbox.mode(OpenAgents.Repo, :manual)