Merge remote-tracking branch 'origin/main' into feat/realtime-handler

# Conflicts:
#	package-lock.json
#	package.json

Author: ImriKochWix

.github/dependabot.yml

@@ -1,23 +1,26 @@
+#
+# Switches js-sdk from routine version updates to SECURITY UPDATES ONLY, with a 7-day
+# cooldown — matching the vite-plugin / apper templates policy. (The previous config chased
+# every version bump with no cooldown, which created 11 non-security PRs.)
+#
+# open-pull-requests-limit: 0 turns off scheduled version bumps (no "chase latest" churn, no
+# major upgrades). Dependabot *security* updates ignore this limit and still flow — they need
+# Dependabot alerts enabled in repo Settings > Security. cooldown + groups are inert while
+# version updates are off, kept forward-compatible for if limit: 0 is ever dropped
+# (cooldown = 7-day supply-chain buffer; groups batch minor/patch).
 version: 2
 updates:
-  # Keep package.json dependencies patched. Combined with GitHub's
-  # Dependabot security updates (enabled in repo Settings > Security),
-  # this opens PRs for both routine version bumps and CVE fixes.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 10
+      interval: "daily"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 0
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
     groups:
-      # Batch low-risk dev tooling updates into a single PR to cut noise.
-      dev-dependencies:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-          - "patch"
-
-  # Keep the GitHub Actions used by these workflows up to date.
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+      npm-minor-patch:
+        update-types: ["minor", "patch"]

.github/workflows/claude-code-review.yml

@@ -39,7 +39,7 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
           # Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4)
-          model: "claude-opus-4-20250514"
+          model: "claude-opus-4-8"
 
           # Direct prompt for automated review (no @claude mention needed)
           direct_prompt: |

.github/workflows/claude-docs-drafter.yml

@@ -37,7 +37,7 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           use_sticky_comment: true
           claude_args: |
-            --model claude-sonnet-4-20250514
+            --model claude-sonnet-4-6
             --json-schema '{"type":"object","properties":{"needs_docs":{"type":"boolean","description":"true if the PR has public APIs that need new or improved JSDoc"}},"required":["needs_docs"]}'
 
           prompt: |

.github/workflows/claude.yml

@@ -41,7 +41,7 @@ jobs:
             actions: read
 
           # Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4)
-          model: "claude-opus-4-20250514"
+          model: "claude-opus-4-8"
 
           # Optional: Customize the trigger phrase (default: @claude)
           # trigger_phrase: "/claude"

.github/workflows/manual-publish.yml

@@ -18,6 +18,11 @@ on:
         required: false
         default: false
         type: boolean
+      notify_skills_repo:
+        description: "Notify the skills repo about the release"
+        required: false
+        default: true
+        type: boolean
 
 jobs:
   publish:
@@ -30,6 +35,7 @@ jobs:
         with:
           app-id: ${{ vars.BASE44_GITHUB_ACTIONS_APP_ID }}
           private-key: ${{ secrets.BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY }}
+          owner: base44
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -131,6 +137,19 @@ jobs:
           draft: false
           prerelease: false
 
+      - name: Notify skills repo
+        if: github.event.inputs.dry_run == 'false' && github.event.inputs.notify_skills_repo == 'true'
+        uses: peter-evans/repository-dispatch@v4
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          repository: base44/skills
+          event-type: sdk-release
+          client-payload: |
+            {
+              "version": "v${{ env.NEW_VERSION }}",
+              "release_name": "Release v${{ env.NEW_VERSION }}"
+            }
+
 permissions:
   contents: write
   packages: write

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44/sdk",
-  "version": "0.8.37",
+  "version": "0.8.40",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -26,7 +26,7 @@
     "create-docs:process": "node scripts/mintlify-post-processing/file-processing/file-processing.js"
   },
   "dependencies": {
-    "axios": "^1.17.0",
+    "axios": "^1.18.1",
     "partysocket": "^0.0.23",
     "socket.io-client": "^4.8.3",
     "uuid": "^13.0.2"

package.json

@@ -0,0 +1,26 @@
+import PartySocket from "partysocket";
+
+// Fake WebSocket that just records the URL PartySocket tries to open.
+class FakeWS {
+  constructor(url) { FakeWS.lastUrl = url; this.readyState = 0; }
+  addEventListener(){} removeEventListener(){} close(){} send(){}
+}
+
+function urlFor(host) {
+  FakeWS.lastUrl = null;
+  try {
+    new PartySocket({ host, room: "room123", party: "GameRoom", WebSocket: FakeWS, query: { token: "T" } });
+  } catch (e) { return "THREW: " + e.message; }
+  return FakeWS.lastUrl;
+}
+
+console.log("=== PartySocket host -> connect URL ===");
+for (const h of ["https://app.base44.app", "http://localhost:1999", "app.base44.app", "https://app.com/sub/path", "http://10.0.0.5:3000"]) {
+  console.log(`host=${JSON.stringify(h)}\n   -> ${urlFor(h)}`);
+}
+
+console.log("\n=== new URL(raw).origin behavior ===");
+for (const raw of ["https://app.com", "http://localhost:1999", "https://app.com/foo", "app.com", "myapp.base44.app"]) {
+  try { console.log(`${JSON.stringify(raw)} -> ${new URL(raw).origin}`); }
+  catch (e) { console.log(`${JSON.stringify(raw)} -> THREW: ${e.message}`); }
+}

pstest.mjs

@@ -212,7 +212,7 @@ export function createClient(config: CreateClientConfig): Base44Client {
       serverUrl,
       token,
     }),
-    aiGateway: createAiGatewayModule({ serverUrl, token }),
+    aiGateway: createAiGatewayModule({ serverUrl, token, appId }),
     appLogs: createAppLogsModule(axiosClient, appId),
     users: createUsersModule(axiosClient, appId),
     analytics: createAnalyticsModule({
@@ -265,7 +265,7 @@ export function createClient(config: CreateClientConfig): Base44Client {
       serverUrl,
       token,
     }),
-    aiGateway: createAiGatewayModule({ serverUrl, token: serviceToken }),
+    aiGateway: createAiGatewayModule({ serverUrl, token: serviceToken, appId }),
     appLogs: createAppLogsModule(serviceRoleAxiosClient, appId),
     cleanup: () => {
       if (socket) {
@@ -427,6 +427,7 @@ export function createClientFromRequest(request: Request): Base44Client {
   const serverUrlHeader = request.headers.get("Base44-Api-Url");
   const functionsVersion = request.headers.get("Base44-Functions-Version");
   const stateHeader = request.headers.get("Base44-State");
+  const dataEnvHeader = request.headers.get("X-Data-Env");
 
   if (!appId) {
     throw new Error(
@@ -469,6 +470,16 @@ export function createClientFromRequest(request: Request): Base44Client {
   if (stateHeader) {
     additionalHeaders["Base44-State"] = stateHeader;
   }
+  // Propagate the data environment so entity operations from the function stay
+  // in the same environment (e.g. test data) as the triggering request. This
+  // matters for the user-scoped client: unlike the service token, the user JWT
+  // carries no data-env, so without forwarding this header the callbacks fall
+  // back to production data even when the app runs in test-data mode.
+  // Forward only the known closed set (matches the backend contract) rather
+  // than relaying an arbitrary attacker-supplied header value onward.
+  if (dataEnvHeader === "dev" || dataEnvHeader === "prod") {
+    additionalHeaders["X-Data-Env"] = dataEnvHeader;
+  }
 
   return createClient({
     serverUrl: serverUrlHeader || "https://base44.app",

src/client.ts

@@ -8,9 +8,10 @@ import {
 export function createAiGatewayModule({
   serverUrl,
   token,
+  appId,
 }: AiGatewayModuleConfig): AiGatewayModule {
   const connection = (): AiGatewayConnection => ({
-    baseURL: `${serverUrl}/api/ai/openai/v1`,
+    baseURL: `${serverUrl}/api/apps/${appId}/ai/openai/v1`,
     token: token ?? getAccessToken() ?? "",
   });