@alfe.ai/claude-code-host 0.1.2 → 0.1.4

package/dist/host-config.cjs

@@ -463,6 +463,7 @@ var SessionDriver = class {
 			"--allowedTools",
 			allowed
 		];
+		if (params.model) args.push("--model", params.model);
 		if (params.claudeSessionId) args.push("--resume", params.claudeSessionId);
 		if (params.mcpConfigPath) args.push("--mcp-config", params.mcpConfigPath);
 		if (params.appendSystemPrompt) args.push("--append-system-prompt", params.appendSystemPrompt);
@@ -792,8 +793,20 @@ const VOICE_REPLY_SYSTEM_PROMPT = [
 ].join("\n");
 /** Cross-agent tool steering (every turn). Mirrors CROSS_AGENT_TOOLS_SYSTEM_PROMPT. */
 const CROSS_AGENT_TOOLS_SYSTEM_PROMPT = ["Cross-agent messaging: to contact another Alfe agent (IDs like agt_…), use list_agents to discover and message_agent to send.", "The runtime's built-in session tools do NOT know Alfe agent IDs and will fail — never use them to reach another agent."].join("\n");
-/** Persona files read from the workspace, in precedence order (first wins as lead). */
-const PERSONA_FILES = ["SOUL.md", "IDENTITY.md"];
+/**
+* Short, AUTHORITATIVE persona pointer for `--append-system-prompt`. The full
+* persona (SOUL/IDENTITY/AGENTS/…) is delivered as the workspace `CLAUDE.md`,
+* which Claude Code auto-loads every turn — so we do NOT re-dump it into the
+* system prompt (doing both double-injected the persona, wasting tokens and
+* risking drift). This system-level pointer just establishes the framing that
+* CLAUDE.md-as-project-memory can't guarantee on its own: this is an Alfe chat
+* agent, not a coding session.
+*/
+const PERSONA_POINTER_SYSTEM_PROMPT = [
+	"You are an Alfe agent replying to a user over a chat bridge — NOT an interactive coding session.",
+	"Your identity, persona, voice, and operating instructions live in CLAUDE.md and the other files in your workspace.",
+	"Fully embody that persona in how you speak and act; respond AS that agent, not as a generic coding assistant."
+].join("\n");
 /**
 * One FIFO backlog PER claude-session key. Unlike openclaw-chat's single
 * per-daemon queue, the Claude Code host spawns a distinct `claude -p` per
@@ -982,7 +995,7 @@ var ClaudeCodeHost = class {
 		} catch (err) {
 			this.log.warn(`[claude-host] memoryLoadContext failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
 		}
-		const appendSystemPrompt = await this.buildSystemPrompt(memoryContext, isVoice);
+		const appendSystemPrompt = this.buildSystemPrompt(memoryContext, isVoice);
 		const claudeSessionId = this.claudeSessionIds.get(bareSessionId) ?? null;
 		const driver = this.makeDriver();
 		this.runningTurns.set(sessionKey, req.id);
@@ -995,6 +1008,7 @@ var ClaudeCodeHost = class {
 				cwd: this.cfg.workspace,
 				...this.cfg.mcpConfigPath ? { mcpConfigPath: this.cfg.mcpConfigPath } : {},
 				...appendSystemPrompt ? { appendSystemPrompt } : {},
+				...this.cfg.model ? { model: this.cfg.model } : {},
 				onEmission: (emission) => {
 					this.forwardEmission(runId, sessionKey, emission);
 				}
@@ -1105,7 +1119,11 @@ var ClaudeCodeHost = class {
 	}
 	async handleSessionsList(req) {
 		const params = req.params;
-		const sessions = await listSessions(params);
+		const sessions = await listSessions({
+			channel: params.channel,
+			tenantId: params.tenantId,
+			userId: params.userId
+		});
 		this.chat.sendResponse(req.id, true, { sessions });
 	}
 	async handleSessionsGet(req) {
@@ -1139,23 +1157,13 @@ var ClaudeCodeHost = class {
 			activity: session.activity ?? []
 		});
 	}
-	async buildSystemPrompt(memoryContext, isVoice) {
-		const parts = [];
-		const persona = await this.readPersona();
-		if (persona) parts.push(persona);
+	buildSystemPrompt(memoryContext, isVoice) {
+		const parts = [PERSONA_POINTER_SYSTEM_PROMPT];
 		if (memoryContext) parts.push(`# Relevant memory\n\n${memoryContext}`);
 		if (isVoice) parts.push(VOICE_REPLY_SYSTEM_PROMPT);
 		parts.push(CROSS_AGENT_TOOLS_SYSTEM_PROMPT);
 		return parts.join("\n\n");
 	}
-	async readPersona() {
-		const chunks = [];
-		for (const file of PERSONA_FILES) try {
-			const text = await (0, node_fs_promises.readFile)((0, node_path.join)(this.cfg.workspace, file), "utf-8");
-			if (text.trim()) chunks.push(text.trim());
-		} catch {}
-		return chunks.join("\n\n");
-	}
 	async buildHistoryPreamble(bareSessionId) {
 		const session = await getSession(bareSessionId);
 		if (!session || session.messages.length === 0) return "";
@@ -1165,7 +1173,7 @@ var ClaudeCodeHost = class {
 	}
 	async ensureSession(bareSessionId, params) {
 		if (await getSession(bareSessionId)) return;
-		await createSession(bareSessionId, params.agentId, params.clientType ?? "chat", params.tenantId, params.identityId ?? params.userId);
+		await createSession(bareSessionId, params.agentId, params.clientType ?? "chat", params.tenantId, params.userId);
 	}
 	async loadClaudeSessionIds() {
 		try {
@@ -1217,7 +1225,8 @@ function resolveHostConfig() {
 		apiUrl: resolved.apiUrl,
 		workspace: resolved.workspacePath,
 		mcpConfigPath: (0, node_path.join)((0, node_os.homedir)(), ".claude-code", "mcp-config.json"),
-		claudeSessionsPath: (0, node_path.join)((0, node_os.homedir)(), ".alfe", "claude-code", "sessions.json")
+		claudeSessionsPath: (0, node_path.join)((0, node_os.homedir)(), ".alfe", "claude-code", "sessions.json"),
+		...process.env.ALFE_DEFAULT_MODEL?.trim() ? { model: process.env.ALFE_DEFAULT_MODEL.trim() } : {}
 	};
 }
 //#endregion

package/dist/host-config.js

@@ -463,6 +463,7 @@ var SessionDriver = class {
 			"--allowedTools",
 			allowed
 		];
+		if (params.model) args.push("--model", params.model);
 		if (params.claudeSessionId) args.push("--resume", params.claudeSessionId);
 		if (params.mcpConfigPath) args.push("--mcp-config", params.mcpConfigPath);
 		if (params.appendSystemPrompt) args.push("--append-system-prompt", params.appendSystemPrompt);
@@ -792,8 +793,20 @@ const VOICE_REPLY_SYSTEM_PROMPT = [
 ].join("\n");
 /** Cross-agent tool steering (every turn). Mirrors CROSS_AGENT_TOOLS_SYSTEM_PROMPT. */
 const CROSS_AGENT_TOOLS_SYSTEM_PROMPT = ["Cross-agent messaging: to contact another Alfe agent (IDs like agt_…), use list_agents to discover and message_agent to send.", "The runtime's built-in session tools do NOT know Alfe agent IDs and will fail — never use them to reach another agent."].join("\n");
-/** Persona files read from the workspace, in precedence order (first wins as lead). */
-const PERSONA_FILES = ["SOUL.md", "IDENTITY.md"];
+/**
+* Short, AUTHORITATIVE persona pointer for `--append-system-prompt`. The full
+* persona (SOUL/IDENTITY/AGENTS/…) is delivered as the workspace `CLAUDE.md`,
+* which Claude Code auto-loads every turn — so we do NOT re-dump it into the
+* system prompt (doing both double-injected the persona, wasting tokens and
+* risking drift). This system-level pointer just establishes the framing that
+* CLAUDE.md-as-project-memory can't guarantee on its own: this is an Alfe chat
+* agent, not a coding session.
+*/
+const PERSONA_POINTER_SYSTEM_PROMPT = [
+	"You are an Alfe agent replying to a user over a chat bridge — NOT an interactive coding session.",
+	"Your identity, persona, voice, and operating instructions live in CLAUDE.md and the other files in your workspace.",
+	"Fully embody that persona in how you speak and act; respond AS that agent, not as a generic coding assistant."
+].join("\n");
 /**
 * One FIFO backlog PER claude-session key. Unlike openclaw-chat's single
 * per-daemon queue, the Claude Code host spawns a distinct `claude -p` per
@@ -982,7 +995,7 @@ var ClaudeCodeHost = class {
 		} catch (err) {
 			this.log.warn(`[claude-host] memoryLoadContext failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
 		}
-		const appendSystemPrompt = await this.buildSystemPrompt(memoryContext, isVoice);
+		const appendSystemPrompt = this.buildSystemPrompt(memoryContext, isVoice);
 		const claudeSessionId = this.claudeSessionIds.get(bareSessionId) ?? null;
 		const driver = this.makeDriver();
 		this.runningTurns.set(sessionKey, req.id);
@@ -995,6 +1008,7 @@ var ClaudeCodeHost = class {
 				cwd: this.cfg.workspace,
 				...this.cfg.mcpConfigPath ? { mcpConfigPath: this.cfg.mcpConfigPath } : {},
 				...appendSystemPrompt ? { appendSystemPrompt } : {},
+				...this.cfg.model ? { model: this.cfg.model } : {},
 				onEmission: (emission) => {
 					this.forwardEmission(runId, sessionKey, emission);
 				}
@@ -1105,7 +1119,11 @@ var ClaudeCodeHost = class {
 	}
 	async handleSessionsList(req) {
 		const params = req.params;
-		const sessions = await listSessions(params);
+		const sessions = await listSessions({
+			channel: params.channel,
+			tenantId: params.tenantId,
+			userId: params.userId
+		});
 		this.chat.sendResponse(req.id, true, { sessions });
 	}
 	async handleSessionsGet(req) {
@@ -1139,23 +1157,13 @@ var ClaudeCodeHost = class {
 			activity: session.activity ?? []
 		});
 	}
-	async buildSystemPrompt(memoryContext, isVoice) {
-		const parts = [];
-		const persona = await this.readPersona();
-		if (persona) parts.push(persona);
+	buildSystemPrompt(memoryContext, isVoice) {
+		const parts = [PERSONA_POINTER_SYSTEM_PROMPT];
 		if (memoryContext) parts.push(`# Relevant memory\n\n${memoryContext}`);
 		if (isVoice) parts.push(VOICE_REPLY_SYSTEM_PROMPT);
 		parts.push(CROSS_AGENT_TOOLS_SYSTEM_PROMPT);
 		return parts.join("\n\n");
 	}
-	async readPersona() {
-		const chunks = [];
-		for (const file of PERSONA_FILES) try {
-			const text = await readFile(join(this.cfg.workspace, file), "utf-8");
-			if (text.trim()) chunks.push(text.trim());
-		} catch {}
-		return chunks.join("\n\n");
-	}
 	async buildHistoryPreamble(bareSessionId) {
 		const session = await getSession(bareSessionId);
 		if (!session || session.messages.length === 0) return "";
@@ -1165,7 +1173,7 @@ var ClaudeCodeHost = class {
 	}
 	async ensureSession(bareSessionId, params) {
 		if (await getSession(bareSessionId)) return;
-		await createSession(bareSessionId, params.agentId, params.clientType ?? "chat", params.tenantId, params.identityId ?? params.userId);
+		await createSession(bareSessionId, params.agentId, params.clientType ?? "chat", params.tenantId, params.userId);
 	}
 	async loadClaudeSessionIds() {
 		try {
@@ -1217,7 +1225,8 @@ function resolveHostConfig() {
 		apiUrl: resolved.apiUrl,
 		workspace: resolved.workspacePath,
 		mcpConfigPath: join(homedir(), ".claude-code", "mcp-config.json"),
-		claudeSessionsPath: join(homedir(), ".alfe", "claude-code", "sessions.json")
+		claudeSessionsPath: join(homedir(), ".alfe", "claude-code", "sessions.json"),
+		...process.env.ALFE_DEFAULT_MODEL?.trim() ? { model: process.env.ALFE_DEFAULT_MODEL.trim() } : {}
 	};
 }
 //#endregion

package/dist/index.d.cts

@@ -521,6 +521,67 @@ declare class AgentApiClient {
       scopes: string;
     }[];
   }>;
+  /**
+   * Pattern A: provider-parameterized multi-account credential fetch for the
+   * social connectors (Bluesky, and the approval-gated backlog: X, Meta,
+   * Threads, LinkedIn, Pinterest, TikTok, Reddit, YouTube).
+   *
+   * Unlike the bespoke `getGithubAccounts()` / `getXeroAccounts()` shapes,
+   * this returns a UNIFORM normalized account shape so `@alfe.ai/social-mcp`'s
+   * shared driver can require a single `account` selector on every
+   * credential-touching tool regardless of platform. The backend
+   * `api-agents/{provider}/accounts` route is already provider-generic; this
+   * is the client-side normalization the plan (`do-we-need-any-moonlit-toucan`
+   * Phase 0, step 5) calls for.
+   *
+   * `accountIdentifier` is the stable per-account selector the LLM should
+   * pass back (for Bluesky: the account DID). `accessToken` carries whatever
+   * the provider's `buildCredentialsResponse` bundles (for Bluesky: the JSON
+   * session bundle — the driver parses the `accessJwt` out of it, or reads the
+   * top-level `accessJwt` from `providerMetadata`-adjacent fields). Everything
+   * else the driver needs for routing (handle, pdsHost, did, …) is on
+   * `providerMetadata`.
+   *
+   * Token refresh is delegated to connect (never done in-plugin) via the
+   * per-account route `POST /agent/connect/{provider}/accounts/{accountIdentifier}/refresh`
+   * — call `refreshSocialAccount(provider, accountIdentifier)`. (The non-account
+   * `POST /agent/connect/{provider}/refresh` route refreshes the provider's
+   * PRIMARY connection, which is wrong under multi-account Pattern A.)
+   */
+  getSocialAccounts(provider: string): Promise<{
+    provider: string;
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      accessToken: string;
+      providerMetadata: Record<string, unknown>;
+      connectedAt: string;
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific social Connection by its stable
+   * `accountIdentifier` (for Bluesky: the account DID) via the
+   * provider-generic per-account refresh route. The counterpart to
+   * `getSocialAccounts(provider)`; `@alfe.ai/social-mcp` calls this on a
+   * 401/ExpiredToken from the platform PDS/API, then re-fetches accounts to
+   * pick up the rotated bundle.
+   *
+   * Refresh itself is ALWAYS delegated to connect — the plugin never calls
+   * the platform's own refresh XRPC (e.g. `com.atproto.server.refreshSession`)
+   * because connect owns the encrypted refresh token + rotation persistence
+   * (Bluesky rotates the refreshJwt; a missed rotation kills the connection
+   * after one refresh). The returned `accessToken` is whatever the provider's
+   * `refreshToken` hook re-bundled (for Bluesky: the JSON session bundle with
+   * the fresh `accessJwt`) — callers typically ignore it and re-fetch via
+   * `getSocialAccounts` for a consistent shape.
+   */
+  refreshSocialAccount(provider: string, accountIdentifier: string): Promise<{
+    accountIdentifier: string;
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob (legacy "pick-the-
    * default-connection" shape). Use `getXeroAccounts()` for the multi-
@@ -756,6 +817,45 @@ declare class AgentApiClient {
     accessTokenExpiresAt: string;
     expiresAt: string;
   }>;
+  /**
+   * @deprecated Returns a single primary credential blob. Use
+   * `getShopifyAccounts()` for the multi-account shape required by Pattern A
+   * (`@alfe.ai/shopify-mcp` keys per-shop on the myshopify domain).
+   */
+  getShopifyCredentials(): Promise<{
+    accessToken: string;
+    shopDomain: string;
+    shopGid: string;
+    shopName: string;
+    apiVersion: string;
+  }>;
+  /**
+   * Pattern A: multi-account credential fetch for Shopify. Returns every
+   * agent-scoped Shopify Connection. One OAuth grant maps to one store, so the
+   * stable per-call selector is the store's myshopify domain (`shopDomain`),
+   * NOT `accountIdentifier` — the connect provider keys `accountIdentifier` on
+   * the immutable shop GID (falling back to the domain), so `shopDomain` is the
+   * value the LLM passes and the plugin routes on.
+   *
+   * Each entry is shaped by the connect provider's `buildCredentialsResponse`:
+   * `{ accessToken, shopDomain, shopGid, shopName, apiVersion }` — offline
+   * Shopify tokens never expire, so there is NO token / expiry field and no
+   * refresh method (unlike Salesforce). The GraphQL Admin API authenticates
+   * purely on `X-Shopify-Access-Token`; no client credentials are on the wire.
+   */
+  getShopifyAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      shopDomain: string;
+      shopGid: string;
+      shopName: string;
+      apiVersion: string;
+    }[];
+  }>;
   /**
    * Disconnects one connected Microsoft 365 account for the agent, by its
    * `accountIdentifier`. Hits the generic per-account disconnect route
@@ -1770,6 +1870,8 @@ interface RunTurnParams {
   mcpConfigPath?: string;
   /** Persona + reply-style text appended to the system prompt. Omitted → none. */
   appendSystemPrompt?: string;
+  /** Bare Claude model id for `--model` (subscription models only). Omitted → CLI default. */
+  model?: string;
   /** Tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS). */
   allowedTools?: readonly string[];
   /** Permission mode (defaults to DEFAULT_PERMISSION_MODE — never bypass). */
@@ -1838,6 +1940,13 @@ interface ClaudeCodeHostConfig {
   mcpConfigPath?: string;
   /** Path to persist Alfe sessionId → claude session id. */
   claudeSessionsPath?: string;
+  /**
+   * Bare Claude model id for `claude -p --model` (e.g. `claude-opus-4-8` or the
+   * `opus`/`sonnet`/`haiku` aliases). Sourced from the agent's `defaultModel`
+   * via `ALFE_DEFAULT_MODEL`. Omitted → the operator's `claude` CLI default.
+   * NEVER provider-qualified (`anthropic/…`) — that's an OpenClaw-only shape.
+   */
+  model?: string;
   logger?: Logger;
 }
 declare class ClaudeCodeHost {
@@ -1889,7 +1998,6 @@ declare class ClaudeCodeHost {
   private handleSessionsList;
   private handleSessionsGet;
   private buildSystemPrompt;
-  private readPersona;
   private buildHistoryPreamble;
   private ensureSession;
   private loadClaudeSessionIds;

package/dist/index.d.ts

@@ -521,6 +521,67 @@ declare class AgentApiClient {
       scopes: string;
     }[];
   }>;
+  /**
+   * Pattern A: provider-parameterized multi-account credential fetch for the
+   * social connectors (Bluesky, and the approval-gated backlog: X, Meta,
+   * Threads, LinkedIn, Pinterest, TikTok, Reddit, YouTube).
+   *
+   * Unlike the bespoke `getGithubAccounts()` / `getXeroAccounts()` shapes,
+   * this returns a UNIFORM normalized account shape so `@alfe.ai/social-mcp`'s
+   * shared driver can require a single `account` selector on every
+   * credential-touching tool regardless of platform. The backend
+   * `api-agents/{provider}/accounts` route is already provider-generic; this
+   * is the client-side normalization the plan (`do-we-need-any-moonlit-toucan`
+   * Phase 0, step 5) calls for.
+   *
+   * `accountIdentifier` is the stable per-account selector the LLM should
+   * pass back (for Bluesky: the account DID). `accessToken` carries whatever
+   * the provider's `buildCredentialsResponse` bundles (for Bluesky: the JSON
+   * session bundle — the driver parses the `accessJwt` out of it, or reads the
+   * top-level `accessJwt` from `providerMetadata`-adjacent fields). Everything
+   * else the driver needs for routing (handle, pdsHost, did, …) is on
+   * `providerMetadata`.
+   *
+   * Token refresh is delegated to connect (never done in-plugin) via the
+   * per-account route `POST /agent/connect/{provider}/accounts/{accountIdentifier}/refresh`
+   * — call `refreshSocialAccount(provider, accountIdentifier)`. (The non-account
+   * `POST /agent/connect/{provider}/refresh` route refreshes the provider's
+   * PRIMARY connection, which is wrong under multi-account Pattern A.)
+   */
+  getSocialAccounts(provider: string): Promise<{
+    provider: string;
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      accessToken: string;
+      providerMetadata: Record<string, unknown>;
+      connectedAt: string;
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific social Connection by its stable
+   * `accountIdentifier` (for Bluesky: the account DID) via the
+   * provider-generic per-account refresh route. The counterpart to
+   * `getSocialAccounts(provider)`; `@alfe.ai/social-mcp` calls this on a
+   * 401/ExpiredToken from the platform PDS/API, then re-fetches accounts to
+   * pick up the rotated bundle.
+   *
+   * Refresh itself is ALWAYS delegated to connect — the plugin never calls
+   * the platform's own refresh XRPC (e.g. `com.atproto.server.refreshSession`)
+   * because connect owns the encrypted refresh token + rotation persistence
+   * (Bluesky rotates the refreshJwt; a missed rotation kills the connection
+   * after one refresh). The returned `accessToken` is whatever the provider's
+   * `refreshToken` hook re-bundled (for Bluesky: the JSON session bundle with
+   * the fresh `accessJwt`) — callers typically ignore it and re-fetch via
+   * `getSocialAccounts` for a consistent shape.
+   */
+  refreshSocialAccount(provider: string, accountIdentifier: string): Promise<{
+    accountIdentifier: string;
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob (legacy "pick-the-
    * default-connection" shape). Use `getXeroAccounts()` for the multi-
@@ -756,6 +817,45 @@ declare class AgentApiClient {
     accessTokenExpiresAt: string;
     expiresAt: string;
   }>;
+  /**
+   * @deprecated Returns a single primary credential blob. Use
+   * `getShopifyAccounts()` for the multi-account shape required by Pattern A
+   * (`@alfe.ai/shopify-mcp` keys per-shop on the myshopify domain).
+   */
+  getShopifyCredentials(): Promise<{
+    accessToken: string;
+    shopDomain: string;
+    shopGid: string;
+    shopName: string;
+    apiVersion: string;
+  }>;
+  /**
+   * Pattern A: multi-account credential fetch for Shopify. Returns every
+   * agent-scoped Shopify Connection. One OAuth grant maps to one store, so the
+   * stable per-call selector is the store's myshopify domain (`shopDomain`),
+   * NOT `accountIdentifier` — the connect provider keys `accountIdentifier` on
+   * the immutable shop GID (falling back to the domain), so `shopDomain` is the
+   * value the LLM passes and the plugin routes on.
+   *
+   * Each entry is shaped by the connect provider's `buildCredentialsResponse`:
+   * `{ accessToken, shopDomain, shopGid, shopName, apiVersion }` — offline
+   * Shopify tokens never expire, so there is NO token / expiry field and no
+   * refresh method (unlike Salesforce). The GraphQL Admin API authenticates
+   * purely on `X-Shopify-Access-Token`; no client credentials are on the wire.
+   */
+  getShopifyAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      shopDomain: string;
+      shopGid: string;
+      shopName: string;
+      apiVersion: string;
+    }[];
+  }>;
   /**
    * Disconnects one connected Microsoft 365 account for the agent, by its
    * `accountIdentifier`. Hits the generic per-account disconnect route
@@ -1770,6 +1870,8 @@ interface RunTurnParams {
   mcpConfigPath?: string;
   /** Persona + reply-style text appended to the system prompt. Omitted → none. */
   appendSystemPrompt?: string;
+  /** Bare Claude model id for `--model` (subscription models only). Omitted → CLI default. */
+  model?: string;
   /** Tool allow-list (defaults to DEFAULT_ALLOWED_TOOLS). */
   allowedTools?: readonly string[];
   /** Permission mode (defaults to DEFAULT_PERMISSION_MODE — never bypass). */
@@ -1838,6 +1940,13 @@ interface ClaudeCodeHostConfig {
   mcpConfigPath?: string;
   /** Path to persist Alfe sessionId → claude session id. */
   claudeSessionsPath?: string;
+  /**
+   * Bare Claude model id for `claude -p --model` (e.g. `claude-opus-4-8` or the
+   * `opus`/`sonnet`/`haiku` aliases). Sourced from the agent's `defaultModel`
+   * via `ALFE_DEFAULT_MODEL`. Omitted → the operator's `claude` CLI default.
+   * NEVER provider-qualified (`anthropic/…`) — that's an OpenClaw-only shape.
+   */
+  model?: string;
   logger?: Logger;
 }
 declare class ClaudeCodeHost {
@@ -1889,7 +1998,6 @@ declare class ClaudeCodeHost {
   private handleSessionsList;
   private handleSessionsGet;
   private buildSystemPrompt;
-  private readPersona;
   private buildHistoryPreamble;
   private ensureSession;
   private loadClaudeSessionIds;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/claude-code-host",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Chat bridge that makes a self-hosted Claude Code agent reachable from Alfe chat on the user's Claude subscription",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,7 @@
     "dist"
   ],
   "dependencies": {
-    "@alfe.ai/agent-api-client": "^0.11.0",
+    "@alfe.ai/agent-api-client": "^0.12.0",
     "@alfe.ai/chat": "^0.0.16",
     "@alfe.ai/config": "^0.3.0"
   },