Create the CLI in the `openagents` monorepo at

`packages/openagents-cli/` with:

- Package name `@openagentsinc/openagents-cli`.

- Package name `@openagentsinc/cli`.

- Binary name `openagents`.

- Node 24, pnpm, and Vite Plus, matching the monorepo contract.

- Effect and Effect Schema for services, configuration, response decoding,

Date: 2026-08-20

Status: Implementation complete; local end-to-end and staging verification

remain

Status: Implementation complete; the cross-repository loopback suite passes.

Exact `localhost:4000` and staging receipts remain gated

## Outcome

| 7. CLI device authorization | Complete | One-time device-code context, API, browser approval, and polling tests |

| 8. Repository browser interface | Complete | List, create, import, empty, failed, private, and code-route LiveView tests |

| 9. CLI package scaffold | Complete | `@openagentsinc/cli`, Effect 4 command graph, build, and package inspection |

| 10. CLI configuration and authentication | Complete | Profiles, custom origins, OS credential store, and Git helper tests |

| 11. CLI repository commands | Complete | Create, import, list, view, clone, source remote, inference, and refusal tests |

| 12. Local cross-repository verification | In progress | Contract digests and focused suites pass; disposable CLI-to-server create, push, clone, and import proof remains |

| 10. CLI configuration and authentication | Complete | Profiles, persisted configuration precedence, custom origins, OS credential store, headless refusal, stable errors, and origin-isolated Git helper tests |

| 11. CLI repository commands | Complete | Create, matching-namespace import, cursor list, view, clone, source remote, inference, and refusal tests |

| 12. Local cross-repository verification | In progress | The default-`4000` disposable suite passes on an alternate loopback port for create, push, clone, anonymous read, private concealment, viewer push refusal, cache reconstruction, exact import refs, and no later sync. Record the exact `localhost:4000` receipt when that port is available. |

| 13. Staging and release | Not started | — |

## Completion audit

    )

  end

  def list_visible_repositories_page(%User{id: user_id}, per_page, after_cursor)

  def list_visible_repositories_page(

        %User{id: user_id},

        per_page,

        after_cursor,

        namespace_key \\ nil

      )

      when per_page in 1..100 do

    query =

      from repository in Repository,

        order_by: [asc: namespace.slug_key, asc: repository.name_key, asc: repository.id],

        preload: [namespace: namespace]

    query = apply_repository_cursor(query, after_cursor)

    query =

      query

      |> apply_namespace_filter(namespace_key)

      |> apply_repository_cursor(after_cursor)

    rows = Repo.all(from row in query, limit: ^(per_page + 1))

    {Enum.take(rows, per_page), length(rows) > per_page}

  end

  defp apply_namespace_filter(query, nil), do: query

  defp apply_namespace_filter(query, namespace_key) when is_binary(namespace_key) do

    from [repository, namespace, membership] in query,

      where: namespace.slug_key == ^namespace_key

  end

  def get_import_for_user!(id, %User{id: user_id}) do

    Repo.one!(

      from repository_import in RepositoryImport,

defmodule OpenAgentsWeb.ForgeUserController do

  @moduledoc "Reports the authenticated GitHub identity and eligible repository namespaces."

  use OpenAgentsWeb, :controller

  alias OpenAgents.Repositories.GitHubProjection

  def show(conn, _params) do

    user = conn.assigns.current_user

    case GitHubProjection.available_namespaces(user) do

      {:ok, namespaces} ->

        json(conn, %{

          "id" => user.github_id,

          "login" => user.github_login,

          "token_expires_at" => DateTime.to_iso8601(conn.assigns.api_token.expires_at),

          "namespaces" =>

            Enum.map(namespaces, fn namespace ->

              %{

                "id" => namespace.provider_account_id,

                "login" => namespace.slug,

                "type" => namespace.kind

              }

            end)

        })

      {:error, reason} ->

        render_error(conn, reason)

    end

  end

  defp render_error(conn, :github_connection_required),

    do: error(conn, :forbidden, "github_connection_required", "Connect GitHub to continue")

  defp render_error(conn, :github_scope_required),

    do: error(conn, :forbidden, "github_scope_required", "Reconnect GitHub with required access")

  defp render_error(conn, _reason),

    do: error(conn, :service_unavailable, "github_unavailable", "GitHub is unavailable")

  defp error(conn, status, code, message) do

    conn

    |> put_status(status)

    |> put_resp_header("cache-control", "no-store")

    |> json(%{

      "code" => code,

      "message" => message,

      "request_id" => List.first(get_resp_header(conn, "x-request-id"))

    })

  end

end

  def index(conn, params) do

    with {:ok, per_page} <- per_page(params),

         {:ok, after_cursor} <- decode_cursor(params["after"]) do

         {:ok, after_cursor} <- decode_cursor(params["after"]),

         {:ok, namespace_key} <- namespace_key(params["namespace"]) do

      {repositories, more?} =

        Repositories.list_visible_repositories_page(

          conn.assigns.current_user,

          per_page,

          after_cursor

          after_cursor,

          namespace_key

        )

      next_cursor = if more?, do: encode_cursor(List.last(repositories)), else: nil

  defp per_page(_params), do: {:ok, 30}

  defp namespace_key(nil), do: {:ok, nil}

  defp namespace_key(namespace) when is_binary(namespace) do

    if Regex.match?(~r/\A[A-Za-z0-9][A-Za-z0-9-]{0,38}\z/, namespace),

      do: {:ok, String.downcase(namespace)},

      else: {:error, :invalid_pagination}

  end

  defp namespace_key(_namespace), do: {:error, :invalid_pagination}

  defp decode_cursor(nil), do: {:ok, nil}

  defp decode_cursor(cursor) when is_binary(cursor) do

      )

  defp policy(%{path: path, verb: verb})

       when path in ["/api/v3/user/repos", "/api/v3/repository-imports/:id"] and

       when path in ["/api/v3/user", "/api/v3/user/repos", "/api/v3/repository-imports/:id"] and

              verb in [:get, :head],

       do: declaration(:authenticated_api, "first-party bearer token", "forge:read", false)

  scope "/api/v3", OpenAgentsWeb do

    pipe_through :forge_write_api

    get "/user", ForgeUserController, :show

    get "/user/repos", RepositoryController, :index

    post "/user/repos", RepositoryController, :create_user

    post "/orgs/:org/repos", RepositoryController, :create_organization

    ]

  },

  "endpoints": {

    "get_authenticated_user": "GET /api/v3/user",

    "create_user_repository": "POST /api/v3/user/repos",

    "create_organization_repository": "POST /api/v3/orgs/{org}/repos",

    "import_user_repository": "POST /api/v3/user/repos/imports",

    "create_device_authorization": "POST /api/v3/device/authorizations",

    "poll_device_authorization": "POST /api/v3/device/authorizations/token"

  },

  "authenticated_user": {

    "required": ["id", "login", "namespaces", "token_expires_at"],

    "namespace_required": ["id", "login", "type"]

  },

  "repository": {

    "required": [

      "id",

  },

  "pagination": {

    "request_cursor": "after",

    "namespace_filter": "namespace",

    "response_cursor": "next_cursor",

    "maximum_page_size": 100

  },

defmodule OpenAgents.Repositories.CliLocalE2ETest do

  use OpenAgents.DataCase, async: false

  import OpenAgents.AccountsFixtures

  alias OpenAgents.{Accounts, ApiTokens, Repositories}

  alias OpenAgents.Forge.{Repos, WAL}

  alias OpenAgents.Repositories.{Importer, Provisioner}

  @moduletag :cross_repo

  setup do

    cli_entry = System.fetch_env!("OPENAGENTS_CLI_ENTRY")

    node =

      System.find_executable("node") || raise "node is required for the CLI cross-repository test"

    true = Path.type(cli_entry) == :absolute

    true = File.regular?(cli_entry)

    root =

      Path.join(

        System.tmp_dir!(),

        "openagents-cli-local-e2e-#{Ecto.UUID.generate()}"

      )

    File.mkdir_p!(root)

    previous = save_environment([:forge_data_dir, :forge_wal_dir, :github_api])

    Application.put_env(:openagents, :forge_data_dir, Path.join(root, "forge"))

    Application.put_env(:openagents, :forge_wal_dir, Path.join(root, "wal"))

    user = repository_user_fixture("cli-e2e-owner")

    {:ok, user} = Accounts.store_github_token(user, "github-cli-e2e-token")

    {:ok, _api_token, plaintext} =

      ApiTokens.create(user, %{name: "CLI local E2E", scopes: ["forge:write"], lifetime_days: 1})

    source = fixture_repository!(root)

    refs = refs(source)

    github_port = free_port()

    endpoint_port = System.get_env("OPENAGENTS_E2E_PORT", "4000") |> String.to_integer()

    api_origin = "http://localhost:#{endpoint_port}"

    github_options = [

      source_full_name: "#{user.github_login}/source-project",

      repository_id: 9_001,

      owner_id: user.github_id,

      default_branch: "main",

      refs:

        Map.new(refs, fn {name, sha} ->

          {type, 0} = System.cmd("git", ["-C", source, "cat-file", "-t", sha])

          {name, %{sha: sha, type: String.trim(type)}}

        end)

    ]

    start_supervised!(

      Supervisor.child_spec(

        {Bandit,

         plug: {OpenAgents.Test.RepositoryCliGitHubFake, github_options},

         port: github_port,

         ip: {127, 0, 0, 1}},

        id: :repository_cli_github_fake

      )

    )

    Application.put_env(:openagents, :github_api,

      base_url: "http://127.0.0.1:#{github_port}",

      request_options: []

    )

    start_supervised!(

      Supervisor.child_spec(

        {Bandit, plug: OpenAgentsWeb.Endpoint, port: endpoint_port, ip: {127, 0, 0, 1}},

        id: :repository_cli_local_endpoint

      )

    )

    bin = Path.join(root, "bin")

    File.mkdir_p!(bin)

    wrapper = Path.join(bin, "openagents")

    File.write!(

      wrapper,

      "#!/bin/sh\nexec node \"$OPENAGENTS_CLI_ENTRY\" \"$@\"\n",

      [:exclusive]

    )

    File.chmod!(wrapper, 0o700)

    on_exit(fn ->

      restore_environment(previous)

      File.rm_rf!(root)

    end)

    %{

      cli_entry: cli_entry,

      node: node,

      environment: [

        {"OPENAGENTS_API_URL", api_origin},

        {"OPENAGENTS_TOKEN", plaintext},

        {"OPENAGENTS_CLI_ENTRY", cli_entry},

        {"PATH", bin <> ":" <> System.fetch_env!("PATH")},

        {"NO_COLOR", "1"}

      ],

      api_origin: api_origin,

      root: root,

      secret: plaintext,

      source: source,

      source_refs: refs,

      user: user

    }

  end

  test "CLI creates, pushes, clones, reconstructs, and imports once", context do

    checkout = local_checkout!(context.root, "created-source")

    create_task =

      cli_task(context, checkout, [

        "--json",

        "repo",

        "create",

        "created-project",

        "--public",

        "--source",

        checkout,

        "--wait-timeout",

        "20"

      ])

    assert :processed = await_outbox(&Provisioner.run_once/0)

    create_output = await_cli!(create_task, context.secret)

    assert create_output =~ "\"full_name\":\"#{context.user.github_login}/created-project\""

    setup_git_output =

      cli!(context, checkout, ["--json", "auth", "setup-git", "--local"])

    refute setup_git_output =~ context.secret

    git!(checkout, ["push", "-u", "origin", "HEAD:main"], context.environment)

    expected_sha = git!(checkout, ["rev-parse", "HEAD"], context.environment) |> String.trim()

    clone = Path.join(context.root, "cli-clone")

    clone_output =

      cli!(context, context.root, [

        "--json",

        "repo",

        "clone",

        "#{context.user.github_login}/created-project",

        clone

      ])

    refute clone_output =~ context.secret

    assert git!(clone, ["rev-parse", "HEAD"], context.environment) |> String.trim() ==

             expected_sha

    repository = Repositories.get_by_path!(context.user.github_login, "created-project")

    File.rm_rf!(Repos.bare_path(repository.storage_key))

    reconstructed = Path.join(context.root, "reconstructed-clone")

    _output =

      cli!(context, context.root, [

        "--json",

        "repo",

        "clone",

        "#{context.user.github_login}/created-project",

        reconstructed

      ])

    assert git!(reconstructed, ["rev-parse", "HEAD"], context.environment) |> String.trim() ==

             expected_sha

    anonymous = Path.join(context.root, "anonymous-clone")

    git!(

      context.root,

      [

        "-c",

        "credential.helper=",

        "clone",

        "#{context.api_origin}/git/#{context.user.github_login}/created-project.git",

        anonymous

      ],

      [{"GIT_TERMINAL_PROMPT", "0"}]

    )

    assert git!(anonymous, ["rev-parse", "HEAD"], []) |> String.trim() == expected_sha

    private_task =

      cli_task(context, context.root, [

        "--json",

        "repo",

        "create",

        "private-project",

        "--wait-timeout",

        "20"

      ])

    assert :processed = await_outbox(&Provisioner.run_once/0)

    _private_output = await_cli!(private_task, context.secret)

    private_repository = Repositories.get_by_path!(context.user.github_login, "private-project")

    private_url =

      "#{context.api_origin}/git/#{context.user.github_login}/private-project.git"

    {anonymous_private_output, anonymous_private_status} =

      git_raw(

        context.root,

        ["-c", "credential.helper=", "clone", private_url, Path.join(context.root, "concealed")],

        [{"GIT_TERMINAL_PROMPT", "0"}]

      )

    assert anonymous_private_status != 0

    refute anonymous_private_output =~ context.secret

    viewer = repository_user_fixture("cli-e2e-viewer")

    {:ok, _membership} = Repositories.add_member(private_repository, viewer, "viewer")

    {:ok, _viewer_token, viewer_plaintext} =

      ApiTokens.create(viewer, %{

        name: "CLI E2E viewer",

        scopes: ["forge:write"],

        lifetime_days: 1

      })

    viewer_context = %{

      context

      | secret: viewer_plaintext,

        environment:

          replace_environment(context.environment, "OPENAGENTS_TOKEN", viewer_plaintext)

    }

    viewer_clone = Path.join(context.root, "viewer-clone")

    _viewer_output =

      cli!(viewer_context, context.root, [

        "--json",

        "repo",

        "clone",

        "#{context.user.github_login}/private-project",

        viewer_clone

      ])

    cli!(viewer_context, viewer_clone, ["--json", "auth", "setup-git", "--local"])

    git!(viewer_clone, ["config", "user.email", "viewer@example.com"], [])

    git!(viewer_clone, ["config", "user.name", "Read-only viewer"], [])

    File.write!(Path.join(viewer_clone, "refused.txt"), "must not land\n")

    git!(viewer_clone, ["add", "refused.txt"], [])

    git!(viewer_clone, ["commit", "-m", "Refused viewer push"], [])

    {viewer_push_output, viewer_push_status} =

      git_raw(viewer_clone, ["push", "origin", "HEAD:main"], viewer_context.environment)

    assert viewer_push_status != 0

    refute viewer_push_output =~ viewer_plaintext

    assert Repos.refs(private_repository.storage_key) == %{}

    import_task =

      cli_task(context, context.root, [

        "--json",

        "repo",

        "import",

        "#{context.user.github_login}/source-project",

        "--name",

        "imported-project",

        "--wait-timeout",

        "20"

      ])

    executor = fn work -> Importer.import(work.repository, source_url: context.source) end

    assert :processed = await_outbox(fn -> Provisioner.run_once(executor) end)

    import_output = await_cli!(import_task, context.secret)

    assert import_output =~ "This is a one-time import" or

             import_output =~ "\"state\":\"completed\""

    imported = Repositories.get_by_path!(context.user.github_login, "imported-project")

    assert {:ok, _generation, imported_index} = WAL.read_index(imported.storage_key)

    assert WAL.refs(imported_index) == context.source_refs

    File.write!(Path.join(context.source, "later.txt"), "later GitHub change\n")

    git!(context.source, ["add", "later.txt"], [])

    git!(context.source, ["commit", "-m", "Later source change"], [])

    assert WAL.refs(imported_index) == context.source_refs

    assert Repos.refs(imported.storage_key) == context.source_refs

    remote_config = git!(checkout, ["config", "--get", "remote.origin.url"], [])

    refute remote_config =~ context.secret

    refute remote_config =~ "@localhost"

    write_receipt(context, expected_sha, imported)

  end

  defp cli_task(context, directory, arguments) do

    Task.async(fn -> cli_raw(context, directory, arguments) end)

  end

  defp cli!(context, directory, arguments) do

    context

    |> cli_raw(directory, arguments)

    |> assert_cli_success!(context.secret)

  end

  defp cli_raw(context, directory, arguments) do

    System.cmd(context.node, [context.cli_entry | arguments],

      cd: directory,

      env: context.environment,

      stderr_to_stdout: true

    )

  end

  defp await_cli!(task, secret) do

    task

    |> Task.await(30_000)

    |> assert_cli_success!(secret)

  end

  defp assert_cli_success!({output, 0}, secret) do

    refute output =~ secret

    output

  end

  defp assert_cli_success!({output, status}, _secret) do

    flunk("CLI exited with #{status}:\n#{output}")

  end

  defp await_outbox(run, remaining \\ 500)

  defp await_outbox(_run, 0), do: flunk("repository outbox work was not accepted")

  defp await_outbox(run, remaining) do

    case run.() do

      :processed ->

        :processed

      :idle ->

        receive do

        after

          10 -> await_outbox(run, remaining - 1)

        end

    end

  end

  defp local_checkout!(root, name) do

    path = Path.join(root, name)

    File.mkdir_p!(path)

    git!(path, ["init", "--initial-branch=main"], [])

    git!(path, ["config", "user.email", "cli-e2e@example.com"], [])

    git!(path, ["config", "user.name", "CLI E2E"], [])

    File.write!(Path.join(path, "README.md"), "CLI local E2E\n")

    git!(path, ["add", "README.md"], [])

    git!(path, ["commit", "-m", "Initial commit"], [])

    path

  end

  defp fixture_repository!(root) do

    path = local_checkout!(root, "github-source")

    git!(path, ["branch", "release"], [])

    git!(path, ["tag", "v1"], [])

    path

  end

  defp refs(path) do

    path

    |> git!(["for-each-ref", "--format=%(objectname) %(refname)"], [])

    |> String.split("\n", trim: true)

    |> Map.new(fn line ->

      [sha, name] = String.split(line, " ", parts: 2)

      {name, sha}

    end)

  end

  defp git!(directory, arguments, environment) do

    case git_raw(directory, arguments, environment) do

      {output, 0} -> output

      {output, status} -> flunk("git exited with #{status}:\n#{output}")

    end

  end

  defp git_raw(directory, arguments, environment) do

    System.cmd("git", arguments,

      cd: directory,

      env: environment,

      stderr_to_stdout: true

    )

  end

  defp replace_environment(environment, key, value) do

    Enum.map(environment, fn

      {^key, _old_value} -> {key, value}

      pair -> pair

    end)

  end

  defp write_receipt(context, pushed_sha, imported) do

    case System.get_env("OPENAGENTS_E2E_RECEIPT_PATH") do

      nil ->

        :ok

      path ->

        repository_import =

          imported

          |> OpenAgents.Repo.preload(:repository_import)

          |> Map.fetch!(:repository_import)

        contract_path =

          Application.app_dir(:openagents, "priv/api-contracts/repositories-v1.json")

        contract_digest =

          contract_path

          |> File.read!()

          |> then(&:crypto.hash(:sha256, &1))

          |> Base.encode16(case: :lower)

        body = %{

          "api_origin" => context.api_origin,

          "cli_revision" => System.get_env("OPENAGENTS_CLI_REVISION", "working-tree"),

          "contract_sha256" => contract_digest,

          "created_commit_sha" => pushed_sha,

          "import_ref_digest" => repository_import.source_ref_digest,

          "server_revision" => System.get_env("OPENAGENTS_SERVER_REVISION", "working-tree"),

          "secret_scan" => "passed",

          "test_count" => 1

        }

        File.write!(path, Jason.encode_to_iodata!(body, pretty: true))

    end

  end

  defp free_port do

    {:ok, socket} = :gen_tcp.listen(0, [])

    {:ok, port} = :inet.port(socket)

    :ok = :gen_tcp.close(socket)

    port

  end

  defp save_environment(keys), do: Map.new(keys, &{&1, Application.get_env(:openagents, &1)})

  defp restore_environment(environment) do

    Enum.each(environment, fn

      {key, nil} -> Application.delete_env(:openagents, key)

      {key, value} -> Application.put_env(:openagents, key, value)

    end)

  end

end

defmodule OpenAgentsWeb.ForgeUserControllerTest do

  use OpenAgentsWeb.ConnCase, async: false

  alias OpenAgents.{Accounts, ApiTokens, GitHubOAuth}

  setup {Req.Test, :verify_on_exit!}

  setup do

    original = Application.get_env(:openagents, :github_api)

    Application.put_env(:openagents, :github_api,

      base_url: "https://github-api.internal",

      request_options: [plug: {Req.Test, __MODULE__}]

    )

    on_exit(fn -> Application.put_env(:openagents, :github_api, original) end)

    :ok

  end

  test "GET /api/v3/user returns the GitHub identity and eligible namespaces", %{conn: conn} do

    user = github_user("forge-user", "octavia")

    {:ok, user} =

      Accounts.store_github_token(user, "github-token", GitHubOAuth.required_scopes())

    {:ok, _token, plaintext} =

      ApiTokens.create(user, %{name: "CLI status", scopes: ["forge:write"]})

    Req.Test.expect(__MODULE__, fn github_conn ->

      case github_conn.request_path do

        "/user/memberships/orgs" ->

          Req.Test.json(github_conn, [])

        path ->

          raise "unexpected GitHub path: #{path}"

      end

    end)

    response =

      conn

      |> put_req_header("authorization", "Bearer " <> plaintext)

      |> get(~p"/api/v3/user")

    assert %{

             "id" => github_id,

             "login" => "octavia",

             "namespaces" => [

               %{"id" => namespace_id, "login" => "octavia", "type" => "user"}

             ],

             "token_expires_at" => token_expires_at

           } = json_response(response, 200)

    assert github_id == user.github_id

    assert namespace_id == user.github_id

    assert {:ok, _date_time, 0} = DateTime.from_iso8601(token_expires_at)

    assert get_resp_header(response, "cache-control") == ["no-store"]

  end

  test "GET /api/v3/user requires a bearer token", %{conn: conn} do

    assert %{"error" => "invalid_api_token"} =

             conn

             |> get(~p"/api/v3/user")

             |> json_response(401)

  end

end

           )

  end

  test "GET /api/v3/user/repos filters by GitHub namespace", %{conn: conn} do

    user = github_user("repository-api-list-namespace", "repo-list-filter")

    assert {:ok, _repository, :created} =

             Repositories.create_user_repository(

               user,

               %{name: "matching-project"},

               "list-namespace-key"

             )

    response =

      conn

      |> authorize(user)

      |> get(~p"/api/v3/user/repos?namespace=repo-list-filter&per_page=10")

      |> json_response(200)

    assert Enum.map(response["repositories"], & &1["full_name"]) == [

             "repo-list-filter/matching-project"

           ]

    assert %{"repositories" => []} =

             conn

             |> authorize(user)

             |> get(~p"/api/v3/user/repos?namespace=another-owner&per_page=10")

             |> json_response(200)

  end

  defp authorize(conn, user) do

    {:ok, _credential, plaintext} =

      ApiTokens.create(user, %{name: "repository API test", scopes: ["forge:write"]})

           ).pipe_through == [:forge_write_api]

  end

  test "repository list and import status reads require bearer authentication" do

  test "repository identity, list, and import status reads require bearer authentication" do

    forge_user = route!(:get, "/api/v3/user")

    repository_list = route!(:get, "/api/v3/user/repos")

    import_status = route!(:get, "/api/v3/repository-imports/:id")

    repository_view = route!(:get, "/api/v3/repos/:owner/:repo")

    assert forge_user.class == :authenticated_api

    assert forge_user.scope == "forge:read"

    assert repository_list.class == :authenticated_api

    assert repository_list.scope == "forge:read"

    assert import_status.class == :authenticated_api

    assert repository_view.class == :public_read

    assert repository_view.principal == "anonymous or first-party bearer token"

    assert Phoenix.Router.route_info(

             OpenAgentsWeb.Router,

             "GET",

             "/api/v3/user",

             "stage.openagents.com"

           ).pipe_through == [:forge_write_api]

    assert Phoenix.Router.route_info(

             OpenAgentsWeb.Router,

             "GET",

defmodule OpenAgents.Test.RepositoryCliGitHubFake do

  @moduledoc false

  import Plug.Conn

  def init(options), do: Map.new(options)

  def call(conn, options) do

    case {conn.method, conn.request_path} do

      {"GET", "/user/memberships/orgs"} ->

        json(conn, [])

      {"GET", "/repos/" <> full_name} when full_name == options.source_full_name ->

        json(conn, %{

          "id" => options.repository_id,

          "node_id" => "R_#{options.repository_id}",

          "name" => full_name |> String.split("/") |> List.last(),

          "full_name" => full_name,

          "private" => true,

          "description" => "Disposable CLI import fixture",

          "default_branch" => options.default_branch,

          "owner" => %{

            "id" => options.owner_id,

            "node_id" => "U_#{options.owner_id}",

            "login" => full_name |> String.split("/") |> List.first(),

            "avatar_url" => "https://avatars.githubusercontent.com/u/#{options.owner_id}?v=4",

            "type" => "User"

          },

          "permissions" => %{"pull" => true, "push" => true, "admin" => true}

        })

      {"GET", "/repos/" <> rest} ->

        reference_response(conn, rest, options)

      _unmatched ->

        send_resp(conn, 404, "not found")

    end

  end

  defp reference_response(conn, rest, options) do

    prefix = options.source_full_name <> "/git/matching-refs/"

    cond do

      rest == options.source_full_name <> "/git/trees/" <> options.default_branch ->

        json(conn, %{"truncated" => false, "tree" => []})

      String.starts_with?(rest, prefix) ->

        kind = rest |> String.replace_prefix(prefix, "") |> String.trim_trailing("/")

        expected_prefix = "refs/#{kind}/"

        refs =

          options.refs

          |> Enum.filter(fn {name, _value} -> String.starts_with?(name, expected_prefix) end)

          |> Enum.map(fn {name, value} ->

            %{"ref" => name, "object" => %{"type" => value.type, "sha" => value.sha}}

          end)

        json(conn, refs)

      true ->

        send_resp(conn, 404, "not found")

    end

  end

  defp json(conn, body) do

    conn

    |> put_resp_content_type("application/json")

    |> send_resp(200, Jason.encode!(body))

  end

end

# (`mix test --only cluster`); this excludes them here for the same reason.

# The :skip tag is gone entirely: every lifted test now runs by default, so the

# suite is green because it passes, not because it is filtered.

ExUnit.start(exclude: [:cluster])

ExUnit.start(exclude: [:cluster, :cross_repo])

# The cluster stage needs the Erlang port mapper up before its first peer node.

# Leaving that to whichever module happened to run first made the stage