frontend: 5 API calls omit the /api prefix (331 failed retries observed) — nginx SPA fallback masks them as 405/200-HTML instead of 404 #12317

Summary

Five API calls in the shipped ChatInterface bundle omit the /api prefix. Each has a documented, correct /api/... counterpart in the generated OpenAPI types in the same repo. Because nginx falls back to the SPA for unmatched paths, these never produce a clean 404 — they return 405 on POST or, worse, 200 text/html on GET.

Observed 331 failed requests for the activity-batch call in a single real user session.

The mismatched calls

From dist/assets/ChatInterface-B6-PeAmP.js (current build, 2026-07-24):

The same bundle also contains correctly-prefixed /api/... calls, so this is inconsistency within one file, not a client-wide convention.

Source of the largest offender — src/composables/useSessionActivityLogger.ts:450:

await apiClient.post<unknown>(`/chat/sessions/${sessionId}/activities/batch`, {

while the generated contract in the same repo says otherwise:

src/types/generated/api.ts:1017:  "/api/chat/sessions/{session_id}/activities/batch": {

The SPA fallback masks it — this is the real problem

$ curl -sk -o /dev/null -w '%{http_code}\n' https://<host>/api/image-generation/models
404                                     # honest

$ curl -sk https://<host>/image-generation/models -D- -o /dev/null | grep -i content-type
content-type: text/html                 # SPA index.html
$ curl -sk -o /dev/null -w '%{http_code}\n' https://<host>/image-generation/models
200                                     # <-- "success"

So an un-prefixed GET returns HTTP 200 with <!DOCTYPE html>, and the frontend then tries to parse an HTML page as JSON. An un-prefixed POST returns nginx's 405 because it will not POST to a static file.

Neither failure mode names the actual problem, which is why five wrong paths shipped: there is no configuration in which a missing /api prefix produces a diagnosable error.

Impact

• Session activity telemetry is silently lost — the logger retries in a loop (331 attempts observed) and never succeeds.
• Chat summarization and image generation are wired to dead paths.
• Any future prefix mistake will be equally invisible.

Recommendation

1. Fix the five call sites to match the generated contract.
2. Stop the SPA fallback from swallowing API paths — add an nginx guard so anything under a known API namespace 404s as JSON instead of serving index.html:

   location ~ ^/(chat|image-generation|knowledge_base|llc|transcriber)/ {
       return 404;    # never SPA-fallback a bare API namespace
   }

   or, better, have the SPA fallback apply only to paths that do not look like API calls.
3. Generate the client from openapi.json (the types are already generated — the calls are not), or add a lint rule asserting every apiClient.<verb> path exists as a key in src/types/generated/api.ts. That check would have caught all five mechanically.
4. Have apiClient reject relative paths that do not start with /api, failing loudly in development.

Environment

nginx/1.18.0, install.sh deploy at /opt/autobot, bundle ChatInterface-B6-PeAmP.js built 2026-07-24 15:41. Deployed tree matches origin/Dev_new_gui.