coding_jobs_dir: "/var/lib/openagents/coding-jobs",

  posthog_project_token: nil,

  posthog_api_host: "https://us.i.posthog.com",

  posthog_analytics: [

    personal_api_key: nil,

    project_id: nil,

    app_host: "https://us.posthog.com"

  ],

  work_workers_enabled: false,

  work: [enabled: false],

  scv_codex: [

    config :posthog, api_host: posthog_api_host

  end

  # The operator analytics surface reads computed results back from the

  # PostHog REST API. Absent credentials disable the read path only; capture

  # above is independent of it.

  config :openagents, :posthog_analytics,

    personal_api_key: optional_text.("OPENAGENTS_POSTHOG_PERSONAL_API_KEY"),

    project_id: optional_text.("OPENAGENTS_POSTHOG_PROJECT_ID"),

    app_host:

      optional_text.("OPENAGENTS_POSTHOG_APP_HOST") ||

        Application.get_env(:openagents, :posthog_analytics)[:app_host]

  github_oauth = Application.get_env(:openagents, :github_oauth, [])

  github_oauth =

9. Check the browser console for CSP violations against the ingest host; fix `connect-src` if any appear.

10. Confirm each taxonomy event registered as an event definition with `read-data-schema`, so typos surface as missing definitions rather than silent zero-volume charts.

## Operator analytics surface

`/admin/analytics` gives operators the trailing-24-hour picture without opening PostHog. It pulls computed results from the PostHog REST API at request time through `OpenAgents.PostHog` (a personal API key over HogQL), so it adds no second aggregation authority: the numbers match what the PostHog app answers for the same window.

Settings (all optional; absent credentials disable the read path only, independently of capture):

| Setting | Requirement |

| --- | --- |

| `OPENAGENTS_POSTHOG_PERSONAL_API_KEY` | A `phx_...` personal API key created for this integration |

| `OPENAGENTS_POSTHOG_PROJECT_ID` | The numeric PostHog project id |

| `OPENAGENTS_POSTHOG_APP_HOST` | Optional; defaults to `https://us.posthog.com`. This is the app/API host, not the ingest host |

The page renders four bounded projections — activation funnel, chat turn outcomes and durations, event volume, top pages — plus its non-happy states as first-class UI: unconfigured credentials, an unanswered query (with retry, never stale numbers), and loading. It shows aggregates only; no conversation content is reachable from it. The route is operator-gated like the rest of `/admin` and classified in the route authority inventory as `analytics:read`.

### Rollout order

1. Steps 1-6 are implemented and covered by the test suite; they activate the moment a project token is configured.

defmodule OpenAgents.PostHog do

  @moduledoc """

  Server-side read access to the project's own PostHog analytics.

  The operator analytics surface (`/admin/analytics`) pulls computed results

  from the PostHog REST API with a personal API key. This module is that

  boundary: it owns the HogQL for each bounded question, shapes the rows into

  plain maps, and never raises — a failed or unconfigured integration is an

  ordinary `{:error, reason}`, which the surface renders as a degraded state.

  Configuration (see `config/runtime.exs`):

  - `OPENAGENTS_POSTHOG_PERSONAL_API_KEY` — a `phx_...` personal API key.

    Absent means disabled: no request ever leaves, and the surface says so.

  - `OPENAGENTS_POSTHOG_PROJECT_ID` — the numeric PostHog project id.

  - `OPENAGENTS_POSTHOG_APP_HOST` — optional; defaults to

    `https://us.posthog.com`. This is the app/API host, not the event ingest

    host used by capture.

  The key is read-only analytics material. It grants whatever scopes the key

  was created with and must not be logged or echoed into errors.

  """

  require Logger

  @receive_timeout_ms 8_000

  @type shaped :: map()

  @doc """

  Whether the read path has both credentials configured. Capture being

  enabled does not imply this: the personal API key is a separate setting.

  """

  @spec enabled?() :: boolean()

  def enabled? do

    present?(settings()[:personal_api_key]) and integer_id?(settings()[:project_id])

  end

  @doc """

  Everything the operator analytics page shows, for the trailing 24 hours.

  Returns `{:ok, shaped}` with four bounded projections, or

  `{:error, :not_configured | :unavailable}`. Each projection runs as its own

  HogQL query; a failure of any one fails the whole pull, because partial

  numbers presented next to each other read as complete.

  """

  @spec overview() :: {:ok, shaped()} | {:error, :not_configured | :unavailable}

  def overview do

    if enabled?() do

      with {:ok, events} <- run(event_counts_sql(), "event_counts"),

           {:ok, funnel} <- run(funnel_sql(), "funnel"),

           {:ok, chat} <- run(chat_turns_sql(), "chat_turns"),

           {:ok, pages} <- run(top_pages_sql(), "top_pages") do

        {:ok,

         %{

           generated_at: DateTime.utc_now(),

           event_counts: shape_rows(events),

           funnel: shape_rows(funnel) |> List.first(%{}),

           chat_turns: shape_chat_turns(shape_rows(chat) |> List.first(%{})),

           top_pages: shape_rows(pages)

         }}

      end

    else

      {:error, :not_configured}

    end

  end

  # ── questions ────────────────────────────────────────────────────────────

  defp event_counts_sql do

    """

    SELECT event, count() AS count, uniq(person_id) AS people

    FROM events

    WHERE timestamp >= now() - INTERVAL 1 DAY

    GROUP BY event

    ORDER BY count DESC

    LIMIT 25

    """

    |> squash()

  end

  defp funnel_sql do

    """

    SELECT

      countIf(event = 'auth_started') AS auth_started,

      countIf(event = 'user_signed_up') AS user_signed_up,

      countIf(event = 'user_signed_in') AS user_signed_in,

      uniqIf(person_id, event = 'user_signed_up') AS identified_signups,

      countIf(event = 'chat_message_sent') AS chat_message_sent

    FROM events

    WHERE timestamp >= now() - INTERVAL 1 DAY

    """

    |> squash()

  end

  defp chat_turns_sql do

    """

    SELECT

      count() AS turns,

      countIf(properties.outcome = 'completed') AS completed,

      countIf(properties.outcome = 'failed') AS failed,

      countIf(properties.outcome = 'cancelled') AS cancelled,

      round(avg(properties.duration_ms)) AS avg_duration_ms,

      max(properties.duration_ms) AS max_duration_ms

    FROM events

    WHERE timestamp >= now() - INTERVAL 1 DAY AND event = 'chat_turn_completed'

    """

    |> squash()

  end

  defp top_pages_sql do

    """

    SELECT properties.$current_url AS url, count() AS views

    FROM events

    WHERE timestamp >= now() - INTERVAL 1 DAY AND event = '$pageview'

    GROUP BY properties.$current_url

    ORDER BY views DESC

    LIMIT 8

    """

    |> squash()

  end

  # ── shaping ──────────────────────────────────────────────────────────────

  defp shape_rows(%{"results" => results, "columns" => columns}) when is_list(results) do

    keys = Enum.map(columns, &to_string/1)

    Enum.map(results, fn row ->

      keys |> Enum.zip(List.wrap(row)) |> Map.new(fn {k, v} -> {k, scalar(v)} end)

    end)

  end

  defp shape_rows(_unexpected), do: []

  defp shape_chat_turns(row) do

    %{

      "turns" => count_value(row["turns"]),

      "completed" => count_value(row["completed"]),

      "failed" => count_value(row["failed"]),

      "cancelled" => count_value(row["cancelled"]),

      "avg_duration_ms" => duration_value(row["avg_duration_ms"]),

      "max_duration_ms" => duration_value(row["max_duration_ms"])

    }

  end

  defp scalar(value) when is_integer(value) or is_float(value), do: value

  defp scalar(value) when is_binary(value), do: value

  defp scalar(nil), do: nil

  defp scalar(value), do: to_string(value)

  # PostHog aggregates arrive as integers or floats depending on the

  # expression; counts round down and durations keep one decimal of sense by

  # staying numeric.

  defp count_value(value) when is_integer(value), do: value

  defp count_value(value) when is_float(value), do: trunc(value)

  defp count_value(_other), do: 0

  defp duration_value(value) when is_integer(value), do: value

  defp duration_value(value) when is_float(value), do: round(value)

  defp duration_value(_other), do: nil

  # ── transport ────────────────────────────────────────────────────────────

  defp run(sql, label) do

    settings = settings()

    url = "#{settings[:app_host]}/api/projects/#{settings[:project_id]}/query/"

    request_options =

      [

        json: %{query: %{kind: "HogQLQuery", query: sql}},

        auth: {:bearer, settings[:personal_api_key]},

        headers: [{"user-agent", "openagents-admin-analytics"}],

        receive_timeout: @receive_timeout_ms,

        retry: false

      ]

      |> Keyword.merge(settings[:request_options] || [])

    case Req.post(url, request_options) do

      {:ok, %Req.Response{status: 200, body: %{"results" => _} = body}} ->

        {:ok, body}

      {:ok, %Req.Response{status: status}} when status in [401, 403] ->

        Logger.warning("posthog_query_failed label=#{label} code=posthog_key_rejected")

        {:error, :unavailable}

      {:ok, %Req.Response{status: status}} ->

        Logger.warning("posthog_query_failed label=#{label} code=posthog_status_#{status}")

        {:error, :unavailable}

      {:error, _transport_error} ->

        Logger.warning("posthog_query_failed label=#{label} code=posthog_unreachable")

        {:error, :unavailable}

    end

  rescue

    error ->

      Logger.warning(

        "posthog_query_failed label=#{label} code=#{OpenAgents.OperationalLog.code(error)}"

      )

      {:error, :unavailable}

  end

  defp settings, do: Application.get_env(:openagents, :posthog_analytics, [])

  defp present?(value) when is_binary(value), do: String.trim(value) != ""

  defp present?(_value), do: false

  defp integer_id?(value) when is_integer(value), do: value > 0

  defp integer_id?(value) when is_binary(value) do

    case Integer.parse(String.trim(value)) do

      {id, ""} -> id > 0

      _invalid -> false

    end

  end

  defp integer_id?(_value), do: false

  defp squash(sql), do: sql |> String.split("\n") |> Enum.map(&String.trim/1) |> Enum.join(" ")

end

defmodule OpenAgentsWeb.AdminAnalyticsLive do

  @moduledoc """

  Operator view of product analytics, pulled server-side from PostHog.

  Every number here is computed by PostHog at request time through

  `OpenAgents.PostHog`, so the surface adds no second aggregation authority:

  what an operator sees matches what the PostHog app would answer for the same

  window. Read-only, operator-gated, and honest about its three non-happy

  states — unconfigured credentials, a failed pull, and loading.

  It shows operational facts about accounts as aggregates. It never renders

  conversation content, memory claims, or anything a person wrote.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Accounts

  alias OpenAgents.PostHog

  @impl true

  def mount(_params, _session, socket) do

    if Accounts.admin?(socket.assigns.current_user) do

      socket =

        socket

        |> assign(:page_title, "Operator · Analytics")

        |> assign(:status, :loading)

        |> assign(:overview, nil)

      if connected?(socket) do

        send(self(), :load)

      end

      {:ok, socket}

    else

      {:ok, redirect(socket, to: ~p"/")}

    end

  end

  @impl true

  def handle_event("refresh", _params, socket) do

    # Re-checked per event, not only at mount: a long-lived socket outlives the

    # decision that opened it.

    if Accounts.admin?(socket.assigns.current_user) do

      {:noreply,

       socket

       |> assign(:status, :loading)

       |> load()}

    else

      {:noreply, redirect(socket, to: ~p"/")}

    end

  end

  @impl true

  def handle_info(:load, socket), do: {:noreply, load(socket)}

  defp load(%{assigns: %{status: :loading}} = socket) do

    case PostHog.overview() do

      {:ok, overview} ->

        assign(socket, status: :loaded, overview: overview)

      {:error, reason} when reason in [:not_configured, :unavailable] ->

        assign(socket, status: reason, overview: nil)

    end

  end

  # A refresh while a load is already resolving must not clobber the newer

  # state with an older response.

  defp load(socket), do: socket

  @impl true

  def render(assigns) do

    ~H"""

    <Layouts.app

      flash={@flash}

      sidebar_sections={assigns[:sidebar_sections]}

      current_scope={@current_scope}

      title="PostHog analytics"

    >

      <main id="admin-analytics-page" class="app-shell admin-shell">

        <section class="admin space-y-8" aria-labelledby="analytics-heading">

          <header class="admin-heading">

            <h1 id="analytics-heading">Product analytics</h1>

            <p>

              Computed live from PostHog over the trailing twenty-four hours. These are

              aggregate operational facts about usage; no conversation or memory content

              is readable from this page.

            </p>

            <div class="admin-totals">

              <.badge variant={:info}>TRAILING 24 HOURS</.badge>

              <.badge

                :if={@status == :loaded && @overview}

                variant={:dim}

                id="analytics-generated-at"

              >

                GENERATED {Calendar.strftime(@overview.generated_at, "%Y-%m-%d %H:%M UTC")}

              </.badge>

              <.text_button id="analytics-refresh" phx-click="refresh" disabled={@status == :loading}>

                {if(@status == :loading, do: "REFRESHING…", else: "REFRESH")}

              </.text_button>

            </div>

          </header>

          <.alert

            :if={@status == :not_configured}

            id="analytics-not-configured"

            appearance={:notice}

            variant={:warning}

          >

            This deployment has no PostHog read credentials configured. Set

            <.kbd>OPENAGENTS_POSTHOG_PERSONAL_API_KEY</.kbd>

            and

            <.kbd>OPENAGENTS_POSTHOG_PROJECT_ID</.kbd>

            to enable this surface.

          </.alert>

          <.alert

            :if={@status == :unavailable}

            id="analytics-unavailable"

            appearance={:notice}

            variant={:danger}

          >

            <div class="space-y-3">

              <p>PostHog did not answer the last query. Nothing on this page is stale data.</p>

              <.button id="analytics-retry" variant={:secondary} phx-click="refresh">

                TRY AGAIN

              </.button>

            </div>

          </.alert>

          <.alert :if={@status == :loading} id="analytics-loading" appearance={:row}>

            Querying PostHog for the trailing twenty-four hours…

          </.alert>

          <div :if={@status == :loaded && @overview} class="space-y-8">

            <section aria-labelledby="funnel-heading">

              <.card id="analytics-funnel">

                <h2 id="funnel-heading" class="card-title">Activation funnel</h2>

                <ul class="divide-y divide-border">

                  <li class="flex items-center justify-between gap-4 py-3">

                    <span>GitHub authorization started</span>

                    <span class="font-semibold">{@overview.funnel["auth_started"]}</span>

                  </li>

                  <li class="flex items-center justify-between gap-4 py-3">

                    <span>Accounts created</span>

                    <span class="font-semibold">{@overview.funnel["user_signed_up"]}</span>

                  </li>

                  <li class="flex items-center justify-between gap-4 py-3">

                    <span>Returning sign-ins</span>

                    <span class="font-semibold">{@overview.funnel["user_signed_in"]}</span>

                  </li>

                  <li class="flex items-center justify-between gap-4 py-3">

                    <span>First chat messages sent</span>

                    <span class="font-semibold">{@overview.funnel["chat_message_sent"]}</span>

                  </li>

                </ul>

              </.card>

            </section>

            <section aria-labelledby="turns-heading">

              <.card id="analytics-chat-turns">

                <h2 id="turns-heading" class="card-title">Chat turns</h2>

                <% turns = @overview.chat_turns %>

                <div class="flex flex-wrap items-center gap-3 pb-3">

                  <.badge>{turns["turns"]} TURNS</.badge>

                  <.badge :if={turns["completed"] > 0} variant={:success}>

                    {turns["completed"]} COMPLETED

                  </.badge>

                  <.badge :if={turns["failed"] > 0} variant={:danger}>

                    {turns["failed"]} FAILED

                  </.badge>

                  <.badge :if={turns["cancelled"] > 0} variant={:warning}>

                    {turns["cancelled"]} CANCELLED

                  </.badge>

                </div>

                <p class="text-muted-foreground">

                  Average turn {format_duration(turns["avg_duration_ms"])}; longest {format_duration(

                    turns["max_duration_ms"]

                  )}.

                </p>

              </.card>

            </section>

            <section aria-labelledby="events-heading">

              <.card id="analytics-event-volume">

                <h2 id="events-heading" class="card-title">Event volume</h2>

                <.table id="analytics-events-table" rows={@overview.event_counts}>

                  <:col :let={row} label="Event">{row["event"]}</:col>

                  <:col :let={row} label="Count">{row["count"]}</:col>

                  <:col :let={row} label="People">{row["people"]}</:col>

                </.table>

              </.card>

            </section>

            <section aria-labelledby="pages-heading">

              <.card id="analytics-top-pages">

                <h2 id="pages-heading" class="card-title">Top pages</h2>

                <.table id="analytics-pages-table" rows={@overview.top_pages}>

                  <:col :let={row} label="URL">{row["url"]}</:col>

                  <:col :let={row} label="Views">{row["views"]}</:col>

                </.table>

              </.card>

            </section>

          </div>

        </section>

      </main>

    </Layouts.app>

    """

  end

  defp format_duration(nil), do: "n/a"

  defp format_duration(ms) when is_number(ms) and ms >= 1_000 do

    "#{:erlang.float_to_binary(ms / 1_000, decimals: 1)}s"

  end

  defp format_duration(ms) when is_integer(ms), do: "#{ms}ms"

end

  defp policy(%{path: "/logout"}),

    do: declaration(:authenticated_browser, "encrypted browser session", "session:delete", true)

  defp policy(%{path: "/admin/analytics"}),

    do: declaration(:operator, "configured operator GitHub ID", "analytics:read", false)

  defp policy(%{path: "/admin/forge"}),

    do: declaration(:operator, "configured operator GitHub ID", "forge:promote", true)

        {OpenAgentsWeb.UserAuth, :ensure_admin}

      ] do

      live "/", AdminLive, :index

      live "/analytics", AdminAnalyticsLive, :index

      live "/forge", AdminForgeLive, :index

      live "/recordings", AdminRecordingsLive, :index

      live "/scv/accounts", AdminScvAccountsLive, :index

defmodule OpenAgents.PostHogTest do

  use ExUnit.Case, async: false

  alias OpenAgents.PostHog

  setup do

    original = Application.get_env(:openagents, :posthog_analytics)

    on_exit(fn ->

      if original == nil,

        do: Application.delete_env(:openagents, :posthog_analytics),

        else: Application.put_env(:openagents, :posthog_analytics, original)

    end)

    :ok

  end

  defp configure(overrides \\ []) do

    Application.put_env(

      :openagents,

      :posthog_analytics,

      Keyword.merge(

        [

          personal_api_key: "phx_test_key",

          project_id: 303_178,

          app_host: "https://posthog-api.internal",

          request_options: [plug: {Req.Test, __MODULE__}]

        ],

        overrides

      )

    )

  end

  describe "enabled?/0" do

    test "requires both a key and a positive numeric project id" do

      refute PostHog.enabled?()

      configure(personal_api_key: nil)

      refute PostHog.enabled?()

      configure(project_id: "0")

      refute PostHog.enabled?()

      configure(project_id: 303_178)

      assert PostHog.enabled?()

      configure(personal_api_key: "   ")

      refute PostHog.enabled?()

    end

  end

  describe "overview/0" do

    test "is not configured without credentials and sends nothing" do

      assert {:error, :not_configured} = PostHog.overview()

    end

    test "shapes the four projections from one pull" do

      configure()

      Req.Test.expect(__MODULE__, fn conn ->

        {:ok, body, conn} = Plug.Conn.read_body(conn)

        assert body =~ "uniq(person_id)"

        assert ["Bearer phx_test_key"] = Plug.Conn.get_req_header(conn, "authorization")

        assert conn.request_path == "/api/projects/303178/query/"

        Req.Test.json(conn, %{

          "columns" => ["event", "count", "people"],

          "results" => [["$pageview", 118, 8], ["chat_opened", 17, 3]]

        })

      end)

      Req.Test.expect(__MODULE__, fn conn ->

        {:ok, body, conn} = Plug.Conn.read_body(conn)

        assert body =~ "'auth_started'"

        Req.Test.json(conn, %{

          "columns" => [

            "auth_started",

            "user_signed_up",

            "user_signed_in",

            "identified_signups",

            "chat_message_sent"

          ],

          "results" => [[3, 1, 2, 1, 6]]

        })

      end)

      Req.Test.expect(__MODULE__, fn conn ->

        {:ok, body, conn} = Plug.Conn.read_body(conn)

        assert body =~ "'chat_turn_completed'"

        Req.Test.json(conn, %{

          "columns" => [

            "turns",

            "completed",

            "failed",

            "cancelled",

            "avg_duration_ms",

            "max_duration_ms"

          ],

          "results" => [[6, 6, 0, 0, 4525.0, 7414]]

        })

      end)

      Req.Test.expect(__MODULE__, fn conn ->

        {:ok, body, conn} = Plug.Conn.read_body(conn)

        assert body =~ "'$pageview'"

        Req.Test.json(conn, %{

          "columns" => ["url", "views"],

          "results" => [["https://openagents.com/", 20], [nil, 4]]

        })

      end)

      assert {:ok, overview} = PostHog.overview()

      assert %DateTime{} = overview.generated_at

      assert [%{"event" => "$pageview", "count" => 118, "people" => 8}] =

               Enum.slice(overview.event_counts, 0, 1)

      assert overview.funnel["user_signed_up"] == 1

      assert overview.funnel["chat_message_sent"] == 6

      assert overview.chat_turns == %{

               "turns" => 6,

               "completed" => 6,

               "failed" => 0,

               "cancelled" => 0,

               "avg_duration_ms" => 4525,

               "max_duration_ms" => 7414

             }

      assert [%{"url" => "https://openagents.com/", "views" => 20} | _] = overview.top_pages

    end

    test "a rejected key is unavailable, never raised" do

      configure()

      Req.Test.expect(__MODULE__, fn conn ->

        Plug.Conn.send_resp(conn, 401, "unauthorized")

      end)

      assert {:error, :unavailable} = PostHog.overview()

    end

    test "an unreachable host is unavailable, never raised" do

      configure(request_options: [])

      assert {:error, :unavailable} = PostHog.overview()

    end

  end

end

defmodule OpenAgentsWeb.AdminAnalyticsLiveTest do

  @moduledoc """

  `/admin/analytics` gates like every operator surface, and its data path is

  honest about the states it can be in: unconfigured credentials, a PostHog

  that did not answer, and loaded aggregates.

  The assertions hold the same line as `/admin`: aggregate operational facts

  only. Nothing rendered here names conversation or memory content.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  setup do

    original = Application.get_env(:openagents, :posthog_analytics)

    on_exit(fn ->

      if original == nil,

        do: Application.delete_env(:openagents, :posthog_analytics),

        else: Application.put_env(:openagents, :posthog_analytics, original)

    end)

    :ok

  end

  describe "access" do

    test "the operator reaches the surface", %{conn: conn} do

      conn = log_in_admin_user(conn, "analytics-operator")

      {:ok, _view, html} = live(conn, ~p"/admin/analytics")

      assert html =~ "Product analytics"

    end

    test "an ordinary authenticated account is redirected and told nothing", %{conn: conn} do

      conn = log_in_github_user(conn, "analytics-ordinary")

      assert {:error, {:redirect, %{to: "/"}}} = live(conn, ~p"/admin/analytics")

      response = get(conn, ~p"/admin/analytics")

      assert redirected_to(response) == ~p"/"

    end

    test "an unauthenticated visitor is redirected", %{conn: conn} do

      assert {:error, {:redirect, %{to: "/"}}} = live(conn, ~p"/admin/analytics")

    end

  end

  describe "states" do

    test "without credentials the page says so instead of showing stale numbers",

         %{conn: conn} do

      Application.put_env(:openagents, :posthog_analytics,

        personal_api_key: nil,

        project_id: nil

      )

      conn = log_in_admin_user(conn, "analytics-unconfigured")

      {:ok, view, _html} = live(conn, ~p"/admin/analytics")

      render_async(view)

      assert has_element?(view, "#analytics-not-configured")

      refute has_element?(view, "#analytics-event-volume")

    end

    test "a failed pull offers retry and renders no numbers", %{conn: conn} do

      configure_posthog(fn conn ->

        Plug.Conn.send_resp(conn, 500, "boom")

      end)

      conn = log_in_admin_user(conn, "analytics-failed")

      {:ok, view, _html} = live(conn, ~p"/admin/analytics")

      render_async(view)

      assert has_element?(view, "#analytics-unavailable")

      refute has_element?(view, "#analytics-event-volume")

    end

    test "a successful pull renders bounded aggregates and refreshes", %{conn: conn} do

      Application.put_env(:openagents, :posthog_analytics,

        personal_api_key: "phx_test_key",

        project_id: 303_178,

        app_host: "https://posthog-api.internal",

        request_options: [plug: {Req.Test, __MODULE__}]

      )

      # One pull is four questions.

      Req.Test.expect(__MODULE__, 4, fn conn -> respond_by_query(conn) end)

      conn = log_in_admin_user(conn, "analytics-loaded")

      {:ok, view, _html} = live(conn, ~p"/admin/analytics")

      render_async(view)

      assert has_element?(view, "#analytics-generated-at")

      assert has_element?(view, "#analytics-funnel")

      assert has_element?(view, "#analytics-chat-turns")

      assert html = render(view)

      assert html =~ "$pageview"

      assert html =~ "https://openagents.com/"

      # A second full pull backs the refresh click.

      Req.Test.expect(__MODULE__, 4, fn conn -> respond_by_query(conn) end)

      assert view |> element("#analytics-refresh") |> render_click() =~ "TRAILING 24 HOURS"

      render_async(view)

      assert has_element?(view, "#analytics-generated-at")

    end

  end

  defp configure_posthog(handler) when is_function(handler, 1) do

    Application.put_env(:openagents, :posthog_analytics,

      personal_api_key: "phx_test_key",

      project_id: 303_178,

      app_host: "https://posthog-api.internal",

      request_options: [plug: {Req.Test, __MODULE__}]

    )

    Req.Test.expect(__MODULE__, handler)

  end

  # The client asks four questions in a fixed order; each stub answers by

  # matching the HogQL in the request body rather than relying on call order.

  defp respond_by_query(conn) do

    {:ok, body, conn} = Plug.Conn.read_body(conn)

    cond do

      body =~ "uniq(person_id)" ->

        Req.Test.json(conn, %{

          "columns" => ["event", "count", "people"],

          "results" => [["$pageview", 118, 8], ["chat_opened", 17, 3]]

        })

      body =~ "'auth_started'" ->

        Req.Test.json(conn, %{

          "columns" => [

            "auth_started",

            "user_signed_up",

            "user_signed_in",

            "identified_signups",

            "chat_message_sent"

          ],

          "results" => [[3, 1, 2, 1, 6]]

        })

      body =~ "'chat_turn_completed'" ->

        Req.Test.json(conn, %{

          "columns" => [

            "turns",

            "completed",

            "failed",

            "cancelled",

            "avg_duration_ms",

            "max_duration_ms"

          ],

          "results" => [[6, 6, 0, 0, 4525.0, 7414]]

        })

      true ->

        Req.Test.json(conn, %{

          "columns" => ["url", "views"],

          "results" => [["https://openagents.com/", 20]]

        })

    end

  end

end