I got it fixed after 5 days.

vibe code summary
Here’s what we changed and why.

web-app/index.html

• Injected an inline boot script.

• Rewrites any localhost:3001 or ws://localhost:3001 to your site origin.

• Patches fetch, XMLHttpRequest, sendBeacon, EventSource, WebSocket.

• Sets Wasp client apiUrl to same-origin.

• Adds basic error logs.

web-app/src/main.tsx

• Unregisters any service workers to avoid stale bundles.

• Imports preflight before React.

• Mounts App.

web-app/src/preflight.ts

• Sets Axios baseURL to same-origin.

• Rewrites any dev URL before requests go out.

• Forces all Wasp apiUrl globals to same-origin.

• Logs active base at startup.

web-app/src/lib/apiBase.ts

• Reads VITE_API_URL or VITE_API_BASE.

• Falls back to window.location.origin.

• Ignores localhost dev values.

web-app/src/lib/http.ts

• Single shared Axios client.

• baseURL from API_BASE, with credentials.

• Optional response error logging.

web-app/src/pages/Login.tsx

• Login button sends users to ${API_BASE}/auth/google.

web-app/src/App.tsx

• Keeps Axios defaults and a defensive rewrite interceptor.

• Adds basic Router with “/” and “/login”.

web-app/vite.config.ts

• Adds @rollup/plugin-replace to remove hardcoded localhost strings.

• Adds a custom “strip-localhost-3001” transform to catch any form, including ws and bare strings.

scripts/patch-web.js

• Post-build fixer that scans built assets and deletes any leftover localhost:3001 or ws variants.

• Forces same-origin at runtime even if a dependency baked a dev URL.

Dockerfile

• Runs the web build, then executes scripts/patch-web.js on the built client before copying it into the final image.

Result

• No localhost:3001 remains in the shipped bundle.

• Any runtime attempt to use it gets rewritten to your production origin.

• Wasp client and Axios both target same-origin in production.