feat(studio): add opt-in dev-server proxy for platform /apis

[aray12]

What

Adds an opt-in Vite dev-server proxy so Studio can make same-origin /apis requests to the platform during local development.

Introduces a new VITE_PLATFORM_PROXY_DOMAIN env var. When VITE_PLATFORM_BASE_URL is set to an empty string and VITE_PLATFORM_PROXY_DOMAIN is set, server.proxy forwards /apis to that domain. Otherwise the dev server config is unchanged.

Why

The Studio dev server runs over HTTPS (via vite-plugin-mkcert), but the local platform runs over plain HTTP (http://localhost:8080). An HTTPS page issuing HTTP fetches is active mixed content, which Safari/WebKit blocks hard (Chrome is more lenient). With this proxy, the browser only ever talks to the HTTPS dev origin and Vite forwards to the HTTP platform server-side — no mixed content, and HTTPS/mkcert stays intact.

The entire platform request surface (SDK fetchers plus the non-SDK callers: data-designer preview, coding-agents, and deployment-log SSE) goes through /apis, so a single proxy rule covers it. SSE works over the plain HTTP proxy; there are no native WebSockets to handle.

How to use

In env/.env.dev.local:

VITE_PLATFORM_BASE_URL=''
VITE_PLATFORM_PROXY_DOMAIN='http://localhost:8080'

Then restart the dev server. Leaving VITE_PLATFORM_PROXY_DOMAIN unset preserves today's behavior.

Notes / out of scope

• /telemetry (OTel) is intentionally not proxied; it's off by default locally (VITE_TELEMETRY_ENABLED=false).
• Absolute download_urls returned by the backend (e.g. evaluation results) are not affected by a path proxy — out of scope here.

Test plan

• pnpm --filter nemo-studio-ui typecheck
• With the two env vars set, start the HTTPS dev server and confirm /apis calls succeed in Safari without mixed-content errors
• With VITE_PLATFORM_PROXY_DOMAIN unset, confirm dev server behavior is unchanged

Summary by CodeRabbit

• Developer Experience
  • Added optional local development proxy support for /apis requests.
  • Helps avoid mixed-content issues by routing requests through the Vite development server.
  • Documented the new proxy configuration and environment variables in the development settings sample.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Platform API proxy

Layer / File(s)	Summary
Proxy environment configuration web/packages/studio/env/.env.dev.local.sample, web/packages/studio/vite.config.ts	Documents VITE_PLATFORM_PROXY_DOMAIN, loads platform proxy variables, and enables proxying when VITE_PLATFORM_BASE_URL is empty.
Vite proxy routing web/packages/studio/vite.config.ts	Conditionally proxies /apis requests to the configured platform domain with changeOrigin enabled and TLS verification disabled.

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant ViteDevServer
  participant PlatformAPI
  Browser->>ViteDevServer: Request /apis
  ViteDevServer->>PlatformAPI: Proxy /apis
  PlatformAPI-->>ViteDevServer: API response
  ViteDevServer-->>Browser: API response

Loading

Suggested reviewers: parkanzky

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: an opt-in dev-server proxy for Studio /apis requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch local-proxy

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/packages/studio/vite.config.ts`:
- Around line 207-217: Update the proxy configuration under shouldProxyPlatform
to remove secure: false, keeping TLS certificate verification enabled by default
for HTTPS targets while preserving the existing /apis proxy behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 144aa6cb-fa78-4cf4-a6a3-3419285abf8b

📥 Commits

Reviewing files that changed from the base of the PR and between 82bcdae and 48bcf20.

📒 Files selected for processing (2)

• web/packages/studio/env/.env.dev.local.sample
• web/packages/studio/vite.config.ts

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27113/34832	77.8%	62.1%
Integration Tests	15892/33443	47.5%	19.9%