Add webpack dev server proxy to Grails backend (#63)

Closes #62

Companion [PR in
hoist-react](xh/hoist-react#4313) for
`WebSocketService` compatibility (merged in
xh/hoist-react@708b904)

## Test plan

- [ ] Start toolbox with `yarn start` — verify startup log shows proxy
target, client apps load, API calls succeed through `/api/...`, no CORS
errors
- [ ] Check Network tab shows same-origin requests to
`localhost:3000/api/...`
- [ ] Verify deep client routes (e.g. `/app/grids`) still work via
`historyApiFallback`
- [ ] Test with explicit `baseUrl: '//localhost:8080/'` override to
confirm old behavior still works

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Anselm McClain <atm@xh.io>

Author: lbwexler

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v12.0.0 - 2026-03-31
+
+### 💥 Breaking Changes - requires hoist-react v83.0.2 or higher.
+
+* The webpack dev server now proxies API requests to the Grails backend, serving client resources
+  and API responses from the same port. The default `baseUrl` in dev mode changed from the
+  cross-origin `//devHost:devGrailsPort/` to `/api/` (matching production). Requests to `/api/...`
+  are proxied to Grails with the prefix stripped. This mirrors the production nginx setup, avoids
+  CORS issues, and simplifies local development. Apps with an explicit `baseUrl` are unaffected.
+  Requires `@xh/hoist` v84+ for WebSocket compatibility.
+
+
 ## v11.2.0 - 2026-03-27
 
 ### ⚙️ Technical

configureWebpack.js

@@ -61,7 +61,7 @@ try {
  * @param {Object} [env.resolveAliases] - object mapping for custom webpack module resolution.
  *      When inlineHoist=true, a mapping between @xh/hoist and the local path will be added.
  * @param {string} [env.baseUrl] - root path prepended to all relative URLs called via FetchService. Defaults to
- *      `/api/` in production mode to work with proxy-based deployments and to `$devHost:$devGrailsPort` in dev mode.
+ *      `/api/`, a root path that will cause the request to be proxied to the Grails backend at `devHost:devGrailsPort`.
  * @param {string[]} [env.babelIncludePaths] - additional paths to pass Babel for transpiling via settings shared with
  *      app-level and @xh/hoist code. Intended for custom packages.
  * @param {string[]} [env.babelExcludePaths] - paths to exclude from Babel transpiling. An example use would be a local
@@ -127,7 +127,7 @@ async function configureWebpack(env) {
         devGrailsPort = env.devGrailsPort || 8080,
         devWebpackPort = env.devWebpackPort || 3000,
         devServerOptions = env.devServerOptions || {},
-        baseUrl = env.baseUrl || (prodBuild ? '/api/' : `//${devHost}:${devGrailsPort}/`),
+        baseUrl = env.baseUrl || '/api/',
         babelIncludePaths = env.babelIncludePaths || [],
         babelExcludePaths = env.babelExcludePaths || [],
         contextRoot = env.contextRoot || '/',
@@ -738,6 +738,21 @@ async function configureWebpack(env) {
                           };
                       })
                   },
+                  // Proxy API requests to the Grails backend, mirroring the production nginx setup.
+                  // Only needed when baseUrl is a relative path (default '/api/') — if baseUrl is
+                  // an absolute URL, the app will call the remote server directly.
+                  proxy: baseUrl.startsWith('/')
+                      ? [
+                            {
+                                context: baseUrl.slice(0, -1),
+                                target: `http://${devHost}:${devGrailsPort}`,
+                                pathRewrite: {[`^${baseUrl.slice(0, -1)}`]: ''},
+                                changeOrigin: true,
+                                secure: false,
+                                ws: true
+                            }
+                        ]
+                      : [],
                 ...devServerOptions
               }
     };