I got it fixed after 5 days.

vibe code summary

Here’s what we changed and why.

web-app/index.html

• Injected an inline boot script.
• Rewrites any localhost:3001 or ws://localhost:3001 to your site origin.
• Patches fetch, XMLHttpRequest, sendBeacon, EventSource, WebSocket.
• Sets Wasp client apiUrl to same-origin.
• Adds basic error logs.

web-app/src/main.tsx

• Unregisters any service workers to avoid stale bundles.
• Imports preflight before React.
• Mounts App.

web-app/src/preflight.ts

• Sets Axios baseURL to same-origin.
• Rewrites any dev URL before requests go out.
• Forces all Wasp apiUrl globals to same-origin.
• Logs active base at startup.

web-app/src/lib/apiBase.ts

• Reads VITE_API_URL or VITE_API_BASE.
• Falls back to window.location.origin.
• Ignores localhost dev values.

web-app/src/lib/http.ts

• Single shared Axios client.
• baseURL from API_BASE, with credentials.
• Optional response error logging.

web-app/src/pages/Login.tsx

• Login button sends users to ${API_BASE}/auth/google.

web-app/src/App.tsx

• Keeps Axios defaults and a defensive rewrite interceptor.
• Adds basic Router with “/” and “/login”.

web-app/vite.config.ts

• Adds @rollup/plugin-replace to remove hardcoded localhost strings.
• Adds a custom “strip-localhost-3001” transform to catch any form, including ws and bare strings.

scripts/patch-web.js

• Post-build fixer that scans built assets and deletes any leftover localhost:3001 or ws variants.
• Forces same-origin at runtime even if a dependency baked a dev URL.

Dockerfile

• Runs the web build, then executes scripts/patch-web.js on the built client before copying it into the final image.

Result

• No localhost:3001 remains in the shipped bundle.
• Any runtime attempt to use it gets rewritten to your production origin.
• Wasp client and Axios both target same-origin in production.