chore(ci): remove the unreachable --ci legacy gateway fallback (#1247)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: brandonleung

scripts/smoke-test-ci.sh

@@ -5,8 +5,7 @@
 #
 # Prerequisites:
 #   - POSTHOG_PERSONAL_API_KEY env var (or in .env): a personal API key (phx_)
-#     or a wizard-app OAuth access token (pha_), which is what the CI bot uses.
-#     The env name stays the same for either so the secret rotates in place.
+#   - WIZARD_CI_GATEWAY_TOKEN_FILE: path to a file holding the AI gateway key
 #   - A wizard-workbench repo checked out (for the test app), pointed to by:
 #       - WIZARD_WORKBENCH_ROOT=/path/to/wizard-workbench
 #         or
@@ -17,9 +16,8 @@
 #   ./scripts/smoke-test-ci.sh basic-integration/next-js/15-pages-router-saas
 #
 # Examples:
-#   # With the key inline (a phx_ personal key or a pha_ wizard-app token):
+#   # With API key inline:
 #   POSTHOG_PERSONAL_API_KEY=phx_your_key_here ./scripts/smoke-test-ci.sh
-#   POSTHOG_PERSONAL_API_KEY=pha_wizard_app_token ./scripts/smoke-test-ci.sh
 #
 #   # With project ID override:
 #   POSTHOG_PERSONAL_API_KEY=phx_your_key_here POSTHOG_PROJECT_ID=12345 ./scripts/smoke-test-ci.sh

src/lib/__tests__/agent-interface.test.ts

@@ -607,7 +607,7 @@ describe('buildAgentEnv header shape', () => {
   const flags = { 'wizard-orchestrator': 'test' };
 
   it('sends one properties blob and no per-key or bedrock headers', () => {
-    const encoded = buildAgentEnv(metadata, flags, { teamId: 42 });
+    const encoded = buildAgentEnv(metadata, flags, 42);
     const [name, json] = encoded.split(': ', 2);
     expect(name).toBe('X-PostHog-Properties');
     // Fallback is native in the gateway's routing chain, and the run tags ride
@@ -622,14 +622,6 @@ describe('buildAgentEnv header shape', () => {
     expect(encoded).not.toContain('x-posthog-use-bedrock-fallback');
     expect(encoded).not.toContain('X-POSTHOG-PROPERTY-');
   });
-
-  it('sends per-key headers and the bedrock opt-in on the legacy gateway', () => {
-    const encoded = buildAgentEnv(metadata, flags, { legacy: true });
-    expect(encoded).toContain('x-posthog-use-bedrock-fallback: true');
-    expect(encoded).toContain('X-POSTHOG-PROPERTY-run_id: r1');
-    expect(encoded).toContain('X-POSTHOG-FLAG-WIZARD-ORCHESTRATOR: test');
-    expect(encoded).not.toContain('X-PostHog-Properties');
-  });
 });
 
 describe('subprocess gateway credentials', () => {

src/lib/__tests__/gateway-session.test.ts

@@ -12,7 +12,6 @@ import {
 } from '@lib/gateway-session';
 import type { HostResolution } from '@lib/host-resolution';
 import { ErrorCodes } from '@lib/errors';
-import { setLegacyGatewayFallback } from '@lib/legacy-gateway';
 import { WizardError } from '@utils/wizard-abort';
 import { analytics } from '@utils/analytics';
 import { logToFile } from '@utils/debug';
@@ -46,10 +45,7 @@ const renderArg = (a: unknown): string => {
 const loggedLines = () =>
   vi.mocked(logToFile).mock.calls.map((call) => call.map(renderArg).join(' '));
 
-const host = {
-  region: 'us',
-  apiHost: 'https://us.posthog.com',
-} as unknown as HostResolution;
+const host = { apiHost: 'https://us.posthog.com' } as unknown as HostResolution;
 
 describe('gatewayAuth', () => {
   const fetchMock = vi.fn();
@@ -574,91 +570,6 @@ describe('gatewayAuth', () => {
     ).rejects.toBeInstanceOf(GatewayMintRefused);
   });
 
-  describe('CI legacy fallback', () => {
-    const refused = (status: number) => ({
-      ok: false,
-      status,
-      json: () => Promise.resolve({}),
-    });
-
-    beforeEach(() => setLegacyGatewayFallback(true));
-    afterEach(() => setLegacyGatewayFallback(false));
-
-    it('stays on the legacy gateway when the mint does not take the credential', async () => {
-      // A personal API key 401s at the mint; the legacy gateway authenticates it itself.
-      fetchMock.mockResolvedValue(refused(401));
-      const auth = await gatewayAuth(host, 'phx_personal', 'integration');
-      expect(auth).toMatchObject({
-        gatewayUrl: 'https://gateway.us.posthog.com/wizard',
-        token: 'phx_personal',
-        legacy: true,
-      });
-      expect(isPastRefresh(auth)).toBe(false);
-    });
-
-    it('picks the legacy gateway for the region, or the local one for a dev host', async () => {
-      fetchMock.mockResolvedValue(refused(401));
-      const urlFor = async (region: string, apiHost: string) => {
-        resetGatewaySession();
-        const h = { region, apiHost } as unknown as HostResolution;
-        return (await gatewayAuth(h, 'phx_personal', 'integration')).gatewayUrl;
-      };
-      expect(await urlFor('eu', 'https://eu.i.posthog.com')).toBe(
-        'https://gateway.eu.posthog.com/wizard',
-      );
-      expect(await urlFor('us', 'http://localhost:8010')).toBe(
-        'http://localhost:3308/wizard',
-      );
-      expect(await urlFor('us', 'http://host.docker.internal:8010')).toBe(
-        'http://host.docker.internal:3308/wizard',
-      );
-    });
-
-    it('stays on the legacy gateway when the instance has no mint', async () => {
-      fetchMock.mockResolvedValue(refused(404));
-      const auth = await gatewayAuth(host, 'phx_personal', 'integration');
-      expect(auth.legacy).toBe(true);
-    });
-
-    it('caches the fallback instead of re-asking the mint per caller', async () => {
-      fetchMock.mockResolvedValue(refused(401));
-      await gatewayAuth(host, 'phx_personal', 'integration');
-      await gatewayAuth(host, 'phx_personal', 'integration');
-      expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-
-    it('still fails a policy refusal', async () => {
-      // 403/429/400 are decisions about the run, which the legacy gateway would not enforce.
-      fetchMock.mockResolvedValue(refused(403));
-      await expect(
-        gatewayAuth(host, 'phx_personal', 'integration'),
-      ).rejects.toBeInstanceOf(GatewayMintRefused);
-    });
-
-    it('still mints when the mint accepts the credential', async () => {
-      fetchMock.mockResolvedValue({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            token: 'phe_minted',
-            expires_at: new Date(Date.now() + 3600_000).toISOString(),
-            gateway_url: 'https://gateway.us.posthog.com',
-          }),
-      });
-      const auth = await gatewayAuth(host, 'pha_app', 'integration');
-      expect(auth.token).toBe('phe_minted');
-      expect(auth.legacy).toBeUndefined();
-    });
-
-    it('does not fall back outside CI', async () => {
-      setLegacyGatewayFallback(false);
-      fetchMock.mockResolvedValue(refused(401));
-      await expect(
-        gatewayAuth(host, 'phx_personal', 'integration'),
-      ).rejects.toBeInstanceOf(GatewayMintRefused);
-    });
-  });
-
   it("names the run's program in the mint request", async () => {
     fetchMock.mockResolvedValue({
       ok: true,

src/lib/agent/__tests__/tutorial-run-tags.test.ts

@@ -48,15 +48,14 @@ describe('buildTutorialRunTags', () => {
     const encoded = buildAgentEnv(
       buildTutorialRunTags({ programId: 'mcp-tutorial' }),
       {},
-      {},
     );
 
     expect(encoded).toContain('X-PostHog-Properties: ');
     expect(encoded).toContain('"program_id":"mcp-tutorial"');
   });
 
   it('sends only product attribution when there is no program', () => {
-    const encoded = buildAgentEnv(buildTutorialRunTags({}), {}, {});
+    const encoded = buildAgentEnv(buildTutorialRunTags({}), {});
 
     expect(encoded).toBe('X-PostHog-Properties: {"ai_product":"wizard"}');
   });

src/lib/agent/agent-interface.ts

@@ -30,7 +30,6 @@ import {
 import { wizardAbort, WizardError } from '@utils/wizard-abort';
 import { createCustomHeaders } from '@utils/custom-headers';
 import type { HostResolution } from '@lib/host-resolution';
-import { legacyGatewayHeaders } from '@lib/legacy-gateway';
 import {
   buildWizardPropertiesBlob,
   gatewayAuth,
@@ -397,25 +396,18 @@ export function isWarlockDisabled(): boolean {
 /**
  * Build ANTHROPIC_CUSTOM_HEADERS for the SDK subprocess: the run's metadata and
  * flags as one `X-PostHog-Properties` JSON blob. Bedrock fallback is native to
- * the gateway, so there is no opt-in header. The CI fallback sends the legacy
- * gateway's shape instead.
+ * the gateway, so there is no opt-in header.
  */
 export function buildAgentEnv(
   wizardMetadata: Record<string, string>,
   wizardFlags: Record<string, string>,
-  auth: Pick<GatewayAuth, 'teamId' | 'legacy'>,
+  teamId?: number,
 ): string {
   const headers = createCustomHeaders();
-  const shaped = auth.legacy
-    ? legacyGatewayHeaders(wizardMetadata, wizardFlags)
-    : {
-        'X-PostHog-Properties': buildWizardPropertiesBlob(
-          wizardMetadata,
-          wizardFlags,
-          auth.teamId,
-        ),
-      };
-  for (const [key, value] of Object.entries(shaped)) headers.add(key, value);
+  headers.add(
+    'X-PostHog-Properties',
+    buildWizardPropertiesBlob(wizardMetadata, wizardFlags, teamId),
+  );
   const encoded = headers.encode();
   logToFile('ANTHROPIC_CUSTOM_HEADERS', encoded);
   return encoded;
@@ -570,7 +562,6 @@ export async function initializeAgent(
         baseURL: current.gatewayUrl,
         authToken: current.token,
         teamId: current.teamId,
-        legacy: current.legacy,
         wizardMetadata: triageMetadata,
         wizardFlags: config.wizardFlags ?? {},
       };
@@ -1064,7 +1055,7 @@ export async function runAgent(
             ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(
               agentConfig.wizardMetadata ?? {},
               agentConfig.wizardFlags ?? {},
-              agentConfig.gatewayAuth,
+              agentConfig.gatewayAuth.teamId,
             ),
           },
           canUseTool: (toolName: string, input: unknown) => {

src/lib/agent/mcp-prompt-streaming.ts

@@ -385,7 +385,7 @@ export async function* runMcpPromptViaSdk(args: {
           ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(
             wizardMetadata ?? {},
             {},
-            auth,
+            auth.teamId,
           ),
         },
       },

src/lib/agent/runner/harness/pi/__tests__/gateway.test.ts

@@ -58,17 +58,6 @@ describe('buildGatewayProvider transport', () => {
     expect(baseUrl).toBe('https://ai-gateway.us.posthog.com/v1');
   });
 
-  it('routes openai models over chat completions on the legacy gateway', () => {
-    const { api, baseUrl } = buildGatewayProvider({
-      ...base,
-      gatewayUrl: 'https://gateway.us.posthog.com/wizard',
-      legacy: true,
-      modelId: 'openai/gpt-5.6-terra',
-    });
-    expect(api).toBe('openai-completions');
-    expect(baseUrl).toBe('https://gateway.us.posthog.com/wizard/v1');
-  });
-
   it('routes anthropic models over anthropic-messages without /v1', () => {
     const { api, baseUrl } = buildGatewayProvider({
       ...base,
@@ -95,20 +84,6 @@ describe('buildGatewayHeaders', () => {
     expect(headers['x-posthog-use-bedrock-fallback']).toBeUndefined();
     expect(headers['X-POSTHOG-PROPERTY-run_id']).toBeUndefined();
   });
-
-  it('carries per-key headers and the bedrock opt-in on the legacy gateway', () => {
-    const headers = buildGatewayHeaders(
-      { run_id: 'r1' },
-      { 'wizard-orchestrator': 'test', unrelated: 'x' },
-      42,
-      true,
-    );
-    expect(headers['X-POSTHOG-PROPERTY-run_id']).toBe('r1');
-    expect(headers['X-POSTHOG-FLAG-WIZARD-ORCHESTRATOR']).toBe('test');
-    expect(headers['X-POSTHOG-FLAG-UNRELATED']).toBeUndefined();
-    expect(headers['x-posthog-use-bedrock-fallback']).toBe('true');
-    expect(headers['X-PostHog-Properties']).toBeUndefined();
-  });
 });
 
 describe('isGatewayAuthRejection', () => {

src/lib/agent/runner/harness/pi/gateway.ts

@@ -11,7 +11,6 @@ import {
   isPastRefresh,
   type GatewayAuth,
 } from '@lib/gateway-session';
-import { legacyGatewayHeaders } from '@lib/legacy-gateway';
 import {
   modelCapabilities,
   type ThinkingLevel,
@@ -36,10 +35,10 @@ export type GatewayApi =
  * OpenAI models take the Responses API because OpenAI rejects function tools
  * combined with `reasoning_effort` on chat completions and every task sends both.
  */
-export function gatewayApiFor(modelId: string, legacy?: boolean): GatewayApi {
-  if (!modelId.startsWith('openai/')) return 'anthropic-messages';
-  // The legacy gateway routes openai models through chat completions itself.
-  return legacy ? 'openai-completions' : 'openai-responses';
+export function gatewayApiFor(modelId: string): GatewayApi {
+  return modelId.startsWith('openai/')
+    ? 'openai-responses'
+    : 'anthropic-messages';
 }
 
 /**
@@ -52,19 +51,14 @@ export function buildGatewayHeaders(
   wizardMetadata: Record<string, string>,
   wizardFlags: Record<string, string>,
   teamId?: number,
-  legacy?: boolean,
 ): Record<string, string> {
   return {
     'anthropic-beta': 'context-1m-2025-08-07',
-    ...(legacy
-      ? legacyGatewayHeaders(wizardMetadata, wizardFlags)
-      : {
-          'X-PostHog-Properties': buildWizardPropertiesBlob(
-            wizardMetadata,
-            wizardFlags,
-            teamId,
-          ),
-        }),
+    'X-PostHog-Properties': buildWizardPropertiesBlob(
+      wizardMetadata,
+      wizardFlags,
+      teamId,
+    ),
   };
 }
 
@@ -73,8 +67,6 @@ export interface GatewayProviderInputs {
   accessToken: string;
   /** Customer team for the properties blob (from the mint response). */
   teamId?: number;
-  /** Set only by the CI fallback in legacy-gateway.ts. */
-  legacy?: boolean;
   wizardMetadata: Record<string, string>;
   wizardFlags: Record<string, string>;
   modelId: string;
@@ -90,9 +82,8 @@ export interface GatewayProviderInputs {
  * callers (scan triage) hand it straight to `completeSimple`.
  */
 export function buildGatewayModel(inputs: GatewayProviderInputs) {
-  const { gatewayUrl, wizardMetadata, wizardFlags, modelId, teamId, legacy } =
-    inputs;
-  const api = gatewayApiFor(modelId, legacy);
+  const { gatewayUrl, wizardMetadata, wizardFlags, modelId, teamId } = inputs;
+  const api = gatewayApiFor(modelId);
   return {
     id: modelId,
     name: `${modelId} (PostHog Gateway)`,
@@ -108,7 +99,7 @@ export function buildGatewayModel(inputs: GatewayProviderInputs) {
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     contextWindow: 1_000_000,
     maxTokens: 64_000,
-    headers: buildGatewayHeaders(wizardMetadata, wizardFlags, teamId, legacy),
+    headers: buildGatewayHeaders(wizardMetadata, wizardFlags, teamId),
   };
 }
 
@@ -123,8 +114,8 @@ export function buildGatewayProvider(inputs: GatewayProviderInputs): {
   gatewayUrl: string;
   baseUrl: string;
 } {
-  const { gatewayUrl, accessToken, modelId, effort, legacy } = inputs;
-  const api = gatewayApiFor(modelId, legacy);
+  const { gatewayUrl, accessToken, modelId, effort } = inputs;
+  const api = gatewayApiFor(modelId);
   // One resolution point for the model's traits and the run's effort override.
   // pi clamps whatever comes out of here against the levels this spec declares,
   // so a level the spec doesn't carry is silently reduced by the session.

src/lib/agent/runner/harness/pi/index.ts

@@ -263,7 +263,6 @@ export const piBackend: AgentHarness = {
         gatewayUrl: current.gatewayUrl,
         accessToken: current.token,
         teamId: current.teamId,
-        legacy: current.legacy,
         wizardMetadata: boot.wizardMetadata,
         wizardFlags: boot.wizardFlags,
         modelId,

src/lib/agent/runner/harness/pi/task.ts

@@ -230,7 +230,6 @@ export async function runPiTask(inputs: TaskRunInputs): Promise<AgentResult> {
       gatewayUrl: current.gatewayUrl,
       accessToken: current.token,
       teamId: current.teamId,
-      legacy: current.legacy,
       wizardMetadata: boot.wizardMetadata,
       wizardFlags: boot.wizardFlags,
       modelId,