Three AgentToolkit tools call paths that cannot succeed — live in published @wave-av/adk@1.0.14 (two gateway-denied 403, one 404s at the captions spoke)

[yakimoto]

Three of AgentToolkit's ten tools call gateway paths that cannot succeed, and all three are in the published @wave-av/adk@1.0.14 artifact:

$ grep -c -- "/v1/graphics/show"      package/dist/index.cjs   # 2
$ grep -c -- "/v1/moderation/action"  package/dist/index.cjs   # 1
$ grep -c -- "/v1/captions/start"     package/dist/index.cjs   # 2

Source: sdk-typescript/packages/adk/src/tools/AgentToolkit.ts lines 97, 107, 117.

1 & 2 — wave_show_graphic and wave_moderate_chat hit fail-closed prefixes

graphics and moderation are not in the gateway's V1_GROUPS catalog (139 groups mined from WSC). The catalog has graphics-engine, not graphics, and no moderation at all. requiredScope() then fails closed:

Under an enforced prefix but unmapped → FAIL-CLOSED (never silently allow an unbilled route).

Live against https://api.wave.online, with a deliberately-nonsense control:

/v1/streams                        402
/v1/switcher/abc/switch            402
/v1/graphics/show                  403   <-- denied
/v1/moderation/action              403   <-- denied
/v1/analytics/stream/abc/qoe       402
/v1/cameras/abc/control            402
/v1/definitely-not-real-xyz        403   <-- control

402 = the prefix is mapped and the billing gate fired first. 403 = the gateway refused to map it. Both tools land in the same bucket as the nonsense path.

3 — wave_start_captions was orphaned by the spoke migration

/v1/captions/* now routes to the captions spoke, which owns the namespace with an exact-match router:

if (url.pathname === '/v1/captions') { ... }
if (url.pathname === '/v1/live/caption') { ... }
// …
return json({ error: 'not found' }, 404);

So /v1/captions/start reaches the spoke and 404s. Probing cannot catch this one — the prefix is routed, so an unauthenticated request returns 402 exactly like a valid path. Only the spoke source reveals it. The real endpoint is POST /v1/captions.

Suggested fix

• wave_start_captions → repoint at POST /v1/captions.
• wave_show_graphic / wave_moderate_chat → find where these actually live (the graphics-engine group exists; the moderation surface needs locating) and repoint, or drop them from the advertised tool list. A tool that returns 403 is worse than an absent one.
• Add a CI check. Two tiers, neither needing a credential:
  1. static — assert each declared path's first /v1 segment is in V1_GROUPS. Pure file comparison, no network. Catches both 403 cases.
  2. spoke — for any prefix routed to a spoke, assert the path appears in that spoke's router at origin/main. The only tier that catches /v1/captions/start.

Note on scope — I checked rather than assumed

I originally filed this against wave-av/adk (#63) before establishing that repo is a stale fork (#42). Re-verifying against this copy and the published artifact:

Finding	Applies here?
Three dead paths	yes — live in 1.0.14
Adapters wrap only AgentToolkit (adk#61)	yes
call() ignores response.ok (adk#62)	no — already fixed here; this copy checks if (!response.ok) and the published artifact contains the check
Test suite never runs (adk#60)	no — vitest run works here (27 passed / 2 skipped)

So two of the four issues I filed against the fork are fork-only. Correcting that on adk#62 rather than leaving a false claim standing.

Related: #41 (langgraph fix), #42 (the fork problem).

[coderabbitai]

🔗 Related PRs

#5 - W-S2: carve adk/mcp-server/workflow-sdk folds + 3 missed real product modules + #59 origin fix [closed]
#35 - feat(adk): consume shared @wave-av/kernel client (Phase A consumer 1) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!