feat(e2e): mint a gateway token locally with one browser login - #1355
Closed
johncwaters wants to merge 1 commit into
Closed
johncwaters wants to merge 1 commit into
johncwaters wants to merge 1 commit into
Conversation
Headless and e2e runs need an already-issued AI gateway token in WIZARD_CI_GATEWAY_TOKEN_FILE, and the only way to get one locally was to borrow CI's. `pnpm mint-gateway-token` runs the same OAuth login and mint the interactive wizard uses, then writes the token plus a sidecar (program, verified project, gateway URL, refresh time, token SHA-256) so a runner such as wizard-workbench can reuse it until it expires. The mint writes only after the token's team matches PROJECT_ID, and only through 0600 temp files renamed into a directory chain that no other account can redirect, because the file holds a live bearer. Constraint: the mint endpoint accepts only a wizard-app OAuth token, so one browser login per mint is unavoidable Rejected: phs_ project secret key as the gateway token | gateway answers 402 admission rejected Confidence: medium Scope-risk: narrow Not-tested: the last review round's fix (full ancestor-chain check) had no review after it; exercised by a live mint on the default path
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
johncwaters
marked this pull request as ready for review
September 24, 2026 18:09
johncwaters
marked this pull request as draft
September 24, 2026 18:35
Author
|
Closing: a public mint-to-file script makes pulling a raw gateway token trivial for anyone, so it won't ship. Local e2e will use an employee-held token instead (see PostHog/wizard-workbench#4191). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Feedback wanted: ready to merge. Approve or request changes.
scripts/as a.no-jestdev tool, or undere2e-harness/?PROJECT_IDthe right call, rather than recording whichever project was picked on the consent screen?Headless and e2e runs need an already-issued AI gateway token in
WIZARD_CI_GATEWAY_TOKEN_FILE, and there is no way to get one locally except borrowing CI's. The wizard-workbench team wants the workbench to be easier for agents to run, and a one-time browser login that is then cached is the closest we can get today: the mint endpoint only accepts a wizard-app OAuth token (phs_andphx_keys were tried and refused).Companion PR: PostHog/wizard-workbench#4191, which calls this script and caches the token.
Changes
scripts/mint-gateway-token.no-jest.ts(pnpm mint-gateway-token): readsPROGRAM,PROJECT_ID,TOKEN_FILE; runs the same OAuth login andgatewayAuthmint the interactive wizard uses; writes the token and a<file>.jsonsidecar (program, verified project, gateway URL, refresh time, token SHA-256).PROJECT_ID, through0600temp files (O_EXCL|O_NOFOLLOW) renamed into place, and only when every directory on the path is a real directory no other account can write or redirect.docs/local-dev.md: how to mint a token locally..no-jestscripts are stripped fromdist, so nothing ships.Test plan
posthog-integrationon project 483112: file and sidecar0600, verified project, sidecar hash matches the token.basic-integration/django/django3-saas,basic-integration/next-js/15-app-router-saas) against this branch: the agent run completes through the gateway with the minted token.npx tsc --noEmit -p .clean. The repo's tsconfig and ESLint skipscripts/, so the script was also type-checked with a temporary config.Unrelated, seen during testing: on main the e2e result JSON records a screen path ending at
outroandskillsComplete: false, although the captured frames reachkeep-skills, so the workbench's keep-skills checks fail on main.LLM context
Written with Claude Code; security review also by Codex (gpt-6-astra).