All 18 tools broken against prod: /api/v1/* returns Next.js 404, not a gateway route

[yakimoto]

Found while building wave-gateway#835 (agent-plugins-integration epic's manifest export). The redteam route-gating proof there required probing every route @wave-av/mcp-server's 18 tools actually call.

Finding: the package builds /api/v1/* URLs against a default base of https://wave.online. All 18 tool-backing routes return a prerendered Next.js 404 (x-nextjs-cache: HIT) on both wave.online and api.wave.online — they never reach wave-gateway at all. Per wave-gateway's forward.ts:262, /api/v1/* is the WSC origin's internal path shape (ORIGIN_PATH_PREFIX bridges the public /v1/me to the origin's internal /api/v1/me), not a path any client should call directly.

This contradicts the working assumption (used across the agent-plugins-integration epic) that @wave-av/mcp-server is "already live, already metered" against prod. As published, it appears non-functional — not gated, just absent.

Not a security gap (nothing is reachable/exploitable) — this is a correctness/functionality bug: paying customers using the published package today would get 404s on every tool call.

Recommend: verify against the actual published package version, confirm the base-URL default and path shape, and fix either the package's URL construction or the gateway's route mapping, whichever is wrong.

Filed by an autonomous build session (wave-av/claude-workstation, agent-plugins-integration epic) — Jake, flagging for your triage.

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• Default WAVE_BASE_URL (wave.online) 404s on /api/v1/*; all 18 tools broken #89

🔗 Related PRs

#37 - fix(open-core): genericize gateway repo ref in capabilities.json [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[yakimoto]

Root-caused and fixed. PR: #92 (open, not merged)

This is a wrong-base-URL/wrong-path bug in this package, not a "never wired up" backend gap. Cross-referenced against wave-gateway PR #835 (filed this same session, the source of this issue's finding) before touching code, so as not to re-derive what it already proved:

wave-gateway#835 probed all 18 routes with zero credentials:

GET/POST https://api.wave.online/v1/*      -> 402 PAYMENT_REQUIRED   (18/18 — route exists AND is priced/gated)
GET/POST https://wave.online/api/v1/*      -> 404 HTML, x-nextjs-cache: HIT (18/18 — absent, not gated)
GET/POST https://api.wave.online/api/v1/*  -> 404 HTML, x-nextjs-cache: HIT (18/18 — absent, not gated)

So every backend route this package needs is live and correctly gated today at the gateway-public shape (https://api.wave.online + /v1/*). The published package was simply pointed at the wrong origin (https://wave.online, the marketing/docs Next.js site — src/auth.ts DEFAULT_BASE_URL) and the wrong path prefix (/api/v1/*, which per wave-gateway's forward.ts:262 ORIGIN_PATH_PREFIX is the gateway's internal forwarding shape to the WSC origin, never a path a client should call). This ruled out the "shipped ahead of backend" branch this task was scoped to check for — no product decision needed, no cross-repo fix needed.

Fix (PR #92)

• src/auth.ts: DEFAULT_BASE_URL → https://api.wave.online
• 18 call sites across src/tools/{streams,studio,analytics,billing,production}.ts and both src/resources/*.ts: /api/v1/* → /v1/*
• README.md env var doc corrected to match
• Added a test runner (this repo had none) — tsx + node:test — and a regression suite that mocks the HTTP layer and asserts all 18 tools + 2 resources call https://api.wave.online/v1/*, never /api/v1/*. Verified the tests actually catch the regression (ran them against a scratch copy with the old paths restored: 18/18 fail there, all pass on the fix).
• type-check, lint, and build all clean; grepped the built dist/ bundle directly and confirmed zero occurrences of api/v1.

Stopping at PR-open per scope — not merging. WAVE_BASE_URL env override is untouched, so anyone already working around this by setting it manually is unaffected.

[yakimoto]

Duplicate of #89, filed independently by a parallel session the same day — same file (src/auth.ts:9), same root cause, same fix. Closing this one as a duplicate; the actual fix already shipped as PR #92 (open, not merged), which addresses both. #89 is the one tracked under the console-perfection epic (governance/plans/console-perfection/E5-MCP-PARITY.md Phase 1) — that's the epic of record for this fix.