@alfe.ai/gateway 0.8.3 → 0.9.1

package/dist/bin/gateway.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as installService, c as uninstallService, f as SOCKET_PATH, i as checkExistingDaemon, n as queryDaemonHealth, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport } from "../health.js";
+import { a as installService, d as uninstallService, h as SOCKET_PATH, i as checkExistingDaemon, l as stopExistingDaemon, n as queryDaemonHealth, r as startDaemon, t as formatHealthReport } from "../health.js";
 import { t as LOG_FILE } from "../logger.js";
 import { spawn } from "node:child_process";
 //#region bin/gateway.ts

package/dist/health.js

@@ -76,6 +76,26 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 */
 const PINNED_OPENCLAW_VERSION = "2026.6.11";
 //#endregion
+//#region src/claude-code-host-version.ts
+/**
+* The `@alfe.ai/claude-code-host` version Alfe pins the claude-code runtime to —
+* the single source of truth for its install paths:
+*   - `@alfe.ai/cli` `installClaudeCodeHost` (fresh `alfe setup`)
+*   - the daemon `runtime.update` default (this package)
+*
+* Pinning (rather than floating `npm install -g @alfe.ai/claude-code-host` →
+* `latest`) is deliberate: the host is the claude-code runtime child on every
+* self-hosted claude-code agent, so a bad `latest` publish would auto-reach
+* every new `alfe setup` with no CLI gate. Bump deliberately after validating a
+* new host, then cut a CLI release so the pin travels with the CLI version. The
+* dashboard still surfaces npm-`latest` as an explicit opt-in upgrade.
+*
+* NOTE: claude-code is self-hosted-only (no managed Docker image), so — unlike
+* `PINNED_OPENCLAW_VERSION` — there is no `services/compute/Dockerfile` mirror to
+* keep in sync.
+*/
+const PINNED_CLAUDE_CODE_HOST_VERSION = "0.1.3";
+//#endregion
 //#region ../../packages-internal/ids/dist/prefixes.js
 const ID_PREFIXES = {
 	agent: "agt",
@@ -325,465 +345,72 @@ var AlfeApiClient = class {
 						error: "Session expired",
 						status: 401
 					}
-				};
-			}
-			const body = await res.json();
-			if (!res.ok) return {
-				ok: false,
-				result: {
-					ok: false,
-					error: body.message || `API error: ${String(res.status)}`,
-					status: res.status
-				}
-			};
-			return {
-				ok: true,
-				res,
-				body
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				result: {
-					ok: false,
-					error: err instanceof Error ? err.message : "Network error"
-				}
-			};
-		}
-	}
-	/**
-	* Make an authenticated request to an Alfe API endpoint.
-	* Unwraps the @auriclabs/api-core `{ data, timestamp, requestId }` envelope.
-	*/
-	async request(path, options) {
-		const result = await this._fetch(path, options);
-		if (!result.ok) return result.result;
-		return {
-			ok: true,
-			data: result.body.data
-		};
-	}
-	/**
-	* Make a request to a PUBLIC endpoint that does not require authentication.
-	* Skips both the Authorization header injection AND the onAuthFailure
-	* callback. Use for endpoints like /auth/device-code that the CLI hits
-	* before it has a token.
-	*/
-	async publicRequest(path, options) {
-		const result = await this._fetch(path, options, true);
-		if (!result.ok) return result.result;
-		return {
-			ok: true,
-			data: result.body.data
-		};
-	}
-	/**
-	* Make an authenticated request that returns the body directly (no envelope unwrap).
-	* Use for APIs that don't use the @auriclabs/api-core response format (e.g. gateway).
-	*/
-	async rawRequest(path, options) {
-		const result = await this._fetch(path, options);
-		if (!result.ok) return result.result;
-		return {
-			ok: true,
-			data: result.body
-		};
-	}
-	getApiBaseUrl() {
-		return this.apiBaseUrl;
-	}
-};
-//#endregion
-//#region ../../packages-internal/api-client/dist/services/auth.js
-var AuthService = class {
-	client;
-	constructor(client) {
-		this.client = client;
-	}
-	prefix = "/auth";
-	validate(token) {
-		return this.client.request(`${this.prefix}/validate`, {
-			method: "POST",
-			body: JSON.stringify({ token })
-		});
-	}
-	listTokens() {
-		return this.client.request(`${this.prefix}/tokens`);
-	}
-	createToken(data) {
-		return this.client.request(`${this.prefix}/tokens`, {
-			method: "POST",
-			body: JSON.stringify(data)
-		});
-	}
-	deleteToken(tokenId) {
-		return this.client.request(`${this.prefix}/tokens/${tokenId}`, { method: "DELETE" });
-	}
-	/**
-	* Start a device-code flow. Called by the CLI when the user runs
-	* `alfe login` and picks the browser path. The returned `device_code`
-	* is the CLI's bearer secret for polling /auth/device-token; the
-	* `user_code` is what the user types/sees on the dashboard.
-	*
-	* Uses `publicRequest` because the CLI has no token yet — the standard
-	* `request` path would short-circuit with a synthetic 401.
-	*/
-	startDeviceCode(input) {
-		return this.client.publicRequest(`${this.prefix}/device-code`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	/**
-	* Poll for the minted API key. Public endpoint. Returns:
-	*   200 → { api_key, tenantId, tokenExpiresAt } (success — write to config)
-	*   428 → still pending (caller should sleep `interval` and retry)
-	*   429 → polling too fast; caller should back off
-	*   410 → device-code expired; user must run `alfe login` again
-	*   400 → already redeemed (security: do not retry)
-	*
-	* Surface the HTTP-status code via the standard ApiResult error shape
-	* so callers can branch.
-	*/
-	pollDeviceToken(deviceCode) {
-		return this.client.publicRequest(`${this.prefix}/device-token`, {
-			method: "POST",
-			body: JSON.stringify({ device_code: deviceCode })
-		});
-	}
-	/** Dashboard-side. Fetch the device fingerprint for an approval card. */
-	lookupDeviceCode(userCode) {
-		return this.client.request(`${this.prefix}/device-code/lookup`, {
-			method: "POST",
-			body: JSON.stringify({ user_code: userCode })
-		});
-	}
-	/** Dashboard-side. Approve the pending device-code; CLI's next poll gets the key. */
-	approveDeviceCode(input) {
-		return this.client.request(`${this.prefix}/device-code/approve`, {
-			method: "POST",
-			body: JSON.stringify({
-				user_code: input.userCode,
-				expiresIn: input.expiresIn
-			})
-		});
-	}
-	getOnboardingStatus() {
-		return this.client.request(`${this.prefix}/onboarding/status`);
-	}
-	completeOnboarding(input) {
-		return this.client.request(`${this.prefix}/onboarding/complete`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	getAccessStatus() {
-		return this.client.request(`${this.prefix}/access/status`);
-	}
-	redeemAccessCode(code) {
-		return this.client.request(`${this.prefix}/access/redeem`, {
-			method: "POST",
-			body: JSON.stringify({ code })
-		});
-	}
-	/**
-	* Fetch the caller's current permission list as enforced by the gateway.
-	* UI permission providers should call this on mount and refetch on
-	* Clerk org switch to stay in sync with sub-tenant permission changes.
-	*/
-	getMyPermissions() {
-		return this.client.request(`${this.prefix}/me/permissions`);
-	}
-	/**
-	* Preview what deleting the caller's own account will do. Drives the Danger
-	* Zone copy so the user sees an honest, kind-appropriate warning before the
-	* irreversible action (a last-admin cascade wipes the whole workspace).
-	*/
-	getDeletionPreview() {
-		return this.client.request(`${this.prefix}/me/deletion-preview`);
-	}
-	/**
-	* Permanently delete the caller's own account. Returns `{ status: "deleting" }`
-	* and tears the account down asynchronously — the Clerk user is deleted shortly
-	* after, so the caller's session dies. On success, sign out and route the user
-	* to a terminal "account is being deleted" state; do NOT retry.
-	*
-	* Pass `confirmKind` (the accountKind the user actually confirmed, from the
-	* deletion preview): if membership changed between preview and execute, the
-	* server answers 409 `account_kind_changed` instead of cascading a scope the
-	* user never agreed to.
-	*/
-	deleteAccount(confirmKind) {
-		return this.client.request(`${this.prefix}/me`, {
-			method: "DELETE",
-			...confirmKind ? { body: JSON.stringify({ confirmKind }) } : {}
-		});
-	}
-	getSubscriptionStatus() {
-		return this.client.request(`${this.prefix}/subscription`);
-	}
-	/**
-	* Mint a short-lived, single-use Clerk sign-in token for the calling user so
-	* a native client can hand its logged-in session to the web dashboard
-	* (`${dashboard}/handoff?__clerk_ticket=<token>`). Server mints only for the
-	* authenticated user — never a caller-supplied id.
-	*/
-	createHandoffToken() {
-		return this.client.request(`${this.prefix}/handoff-token`, { method: "POST" });
-	}
-	applyForStartup(input) {
-		return this.client.request(`${this.prefix}/subscription/apply-startup`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	/**
-	* Accept an approved Startup Program invite. Call after the applicant has a
-	* card on file (confirmed or freshly added) — this mints the Professional
-	* grant subscription. Idempotent: a repeat call on an already-accepted
-	* application returns `{ status: "accepted" }` without re-charging.
-	*/
-	acceptStartup() {
-		return this.client.request(`${this.prefix}/subscription/accept-startup`, { method: "POST" });
-	}
-	createCheckoutSession(input) {
-		return this.client.request(`${this.prefix}/subscription/checkout`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	/**
-	* Change a personal (individual-tier) subscriber's platform plan in place on
-	* their existing Stripe subscription — no second Checkout, no duplicate sub,
-	* no double charge. Upgrades prorate immediately; downgrades apply with no
-	* immediate charge/refund. Returns the updated subscription.
-	*/
-	changePlatformPlan(input) {
-		return this.client.request(`${this.prefix}/subscription/change`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	/**
-	* Preview the proration cost for changing a personal (individual-tier)
-	* subscriber's platform plan — read-only companion to `changePlatformPlan`.
-	* Nothing is charged.
-	*/
-	previewPlatformPlanChange(input) {
-		return this.client.request(`${this.prefix}/subscription/change/preview`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	updateSeats(seats) {
-		return this.client.request(`${this.prefix}/subscription/seats`, {
-			method: "POST",
-			body: JSON.stringify({ seats })
-		});
-	}
-	previewSeatChange(seats) {
-		return this.client.request(`${this.prefix}/subscription/seats/preview`, {
-			method: "POST",
-			body: JSON.stringify({ seats })
-		});
-	}
-	listOrgMembers() {
-		return this.client.request(`${this.prefix}/org/members`);
-	}
-	patchOrgMember(userId, body) {
-		return this.client.request(`${this.prefix}/org/members/${encodeURIComponent(userId)}`, {
-			method: "PATCH",
-			body: JSON.stringify(body)
-		});
-	}
-	removeOrgMember(userId) {
-		return this.client.request(`${this.prefix}/org/members/${encodeURIComponent(userId)}`, { method: "DELETE" });
-	}
-	listOrgInvitations() {
-		return this.client.request(`${this.prefix}/org/invitations`);
-	}
-	createOrgInvitation(input) {
-		return this.client.request(`${this.prefix}/org/invitations`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	revokeOrgInvitation(invitationId) {
-		return this.client.request(`${this.prefix}/org/invitations/${encodeURIComponent(invitationId)}`, { method: "DELETE" });
-	}
-	listOrgDomains() {
-		return this.client.request(`${this.prefix}/org/domains`);
-	}
-	createOrgDomain(input) {
-		return this.client.request(`${this.prefix}/org/domains`, {
-			method: "POST",
-			body: JSON.stringify(input)
-		});
-	}
-	deleteOrgDomain(domainId) {
-		return this.client.request(`${this.prefix}/org/domains/${encodeURIComponent(domainId)}`, { method: "DELETE" });
-	}
-	updateOrgSettings(input) {
-		return this.client.request(`${this.prefix}/org/settings`, {
-			method: "PATCH",
-			body: JSON.stringify(input)
-		});
-	}
-};
-//#endregion
-//#region ../../packages-internal/api-client/dist/services/integrations.js
-var IntegrationsService = class {
-	client;
-	constructor(client) {
-		this.client = client;
-	}
-	listScopedInstalls(scope, scopeId) {
-		const params = new URLSearchParams({
-			scope,
-			scopeId
-		});
-		return this.client.request(`/integrations/scoped?${params}`);
-	}
-	installScoped(data) {
-		return this.client.request("/integrations/scoped", {
-			method: "POST",
-			body: JSON.stringify(data)
-		});
-	}
-	getScopedInstall(integrationId, scope, scopeId) {
-		const params = new URLSearchParams({
-			scope,
-			scopeId
-		});
-		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}?${params}`);
-	}
-	updateScopedInstall(integrationId, data) {
-		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}`, {
-			method: "PATCH",
-			body: JSON.stringify(data)
-		});
-	}
-	removeScopedInstall(integrationId, scope, scopeId) {
-		const params = new URLSearchParams({
-			scope,
-			scopeId
-		});
-		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}?${params}`, { method: "DELETE" });
-	}
-	/**
-	* Reinstall (re-apply latest) a scope-level install. Agent scope is rejected
-	* by the route — use {@link reinstallIntegration} for agent-scoped reinstall.
-	*/
-	reinstallScoped(integrationId, scope, scopeId) {
-		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}/reinstall`, {
-			method: "POST",
-			body: JSON.stringify({
-				scope,
-				scopeId
-			})
-		});
-	}
-	listIntegrations(agentId, options) {
-		const params = new URLSearchParams();
-		if (options?.includeInherited) params.set("includeInherited", "true");
-		if (options?.effective) params.set("effective", "true");
-		const qs = params.toString();
-		return this.client.request(`/integrations/agents/${agentId}${qs ? `?${qs}` : ""}`);
-	}
-	installIntegration(agentId, data) {
-		return this.client.request(`/integrations/agents/${agentId}`, {
-			method: "POST",
-			body: JSON.stringify(data)
-		});
-	}
-	getIntegrationConfig(agentId, integrationId) {
-		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/config`);
-	}
-	updateIntegration(agentId, integrationId, data) {
-		return this.client.request(`/integrations/agents/${agentId}/${integrationId}`, {
-			method: "PATCH",
-			body: JSON.stringify(data)
-		});
-	}
-	removeIntegration(agentId, integrationId) {
-		return this.client.request(`/integrations/agents/${agentId}/${integrationId}`, { method: "DELETE" });
-	}
-	reinstallIntegration(agentId, integrationId) {
-		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/reinstall`, { method: "POST" });
-	}
-	/**
-	* Upgrade an integration to the registry's latest version via the fast,
-	* diff-based daemon path (bumps `version` without `reinstallRequestedAt`).
-	* The agent stays online — no destructive teardown. Distinct from
-	* {@link reinstallIntegration}, which is the destructive repair path.
-	*/
-	upgradeIntegration(agentId, integrationId) {
-		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/upgrade`, { method: "POST" });
-	}
-	getRegistry() {
-		return this.client.request("/integrations/registry");
-	}
-	triggerSync(agentId) {
-		return this.client.request("/integrations/sync/trigger", {
-			method: "POST",
-			body: JSON.stringify({ agentId })
-		});
-	}
-	getDiscordGuildChannels(guildId) {
-		return this.client.request(`/discord/guilds/${encodeURIComponent(guildId)}/channels`);
-	}
-	listMobileNumbers() {
-		return this.client.request("/mobile/numbers");
-	}
-	searchMobileNumbers(country, query) {
-		const params = new URLSearchParams();
-		if (country) params.set("country", country);
-		if (query) params.set("query", query);
-		return this.client.request(`/mobile/numbers/search?${params}`);
-	}
-	assignMobileNumber(agentId, phoneNumber, countryCode) {
-		return this.client.request("/mobile/numbers/assign", {
-			method: "POST",
-			body: JSON.stringify({
-				agentId,
-				phoneNumber,
-				countryCode
-			})
-		});
-	}
-	releaseMobileNumber(agentId) {
-		return this.client.request("/mobile/numbers/release", {
-			method: "POST",
-			body: JSON.stringify({ agentId })
-		});
-	}
-	getMobileNumber(agentId) {
-		return this.client.request(`/mobile/numbers?agentId=${encodeURIComponent(agentId)}`);
-	}
-	disconnectGoogle(agentId, email) {
-		const query = email ? `?email=${encodeURIComponent(email)}` : "";
-		return this.client.request(`/google/agents/${encodeURIComponent(agentId)}/account${query}`, { method: "DELETE" });
+				};
+			}
+			const body = await res.json();
+			if (!res.ok) return {
+				ok: false,
+				result: {
+					ok: false,
+					error: body.message || `API error: ${String(res.status)}`,
+					status: res.status
+				}
+			};
+			return {
+				ok: true,
+				res,
+				body
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				result: {
+					ok: false,
+					error: err instanceof Error ? err.message : "Network error"
+				}
+			};
+		}
 	}
-	getAtlassianSites(agentId) {
-		return this.client.request(`/atlassian/agents/${encodeURIComponent(agentId)}/sites`);
+	/**
+	* Make an authenticated request to an Alfe API endpoint.
+	* Unwraps the @auriclabs/api-core `{ data, timestamp, requestId }` envelope.
+	*/
+	async request(path, options) {
+		const result = await this._fetch(path, options);
+		if (!result.ok) return result.result;
+		return {
+			ok: true,
+			data: result.body.data
+		};
 	}
-	selectAtlassianSite(agentId, cloudId) {
-		return this.client.request(`/atlassian/agents/${encodeURIComponent(agentId)}/sites`, {
-			method: "PUT",
-			body: JSON.stringify({ cloudId })
-		});
+	/**
+	* Make a request to a PUBLIC endpoint that does not require authentication.
+	* Skips both the Authorization header injection AND the onAuthFailure
+	* callback. Use for endpoints like /auth/device-code that the CLI hits
+	* before it has a token.
+	*/
+	async publicRequest(path, options) {
+		const result = await this._fetch(path, options, true);
+		if (!result.ok) return result.result;
+		return {
+			ok: true,
+			data: result.body.data
+		};
 	}
-	listSlackChannels(agentId) {
-		return this.client.request(`/slack/agents/${encodeURIComponent(agentId)}/channels`);
+	/**
+	* Make an authenticated request that returns the body directly (no envelope unwrap).
+	* Use for APIs that don't use the @auriclabs/api-core response format (e.g. gateway).
+	*/
+	async rawRequest(path, options) {
+		const result = await this._fetch(path, options);
+		if (!result.ok) return result.result;
+		return {
+			ok: true,
+			data: result.body
+		};
 	}
-	sendSlackMessage(agentId, channel, text) {
-		return this.client.request(`/slack/agents/${encodeURIComponent(agentId)}/send`, {
-			method: "POST",
-			body: JSON.stringify({
-				channel,
-				text
-			})
-		});
+	getApiBaseUrl() {
+		return this.apiBaseUrl;
 	}
 };
 //#endregion
@@ -4515,6 +4142,7 @@ enumValues({
 	Other: "other"
 });
 enumValues({
+	IndividualPayg: "individual_payg",
 	IndividualLite: "individual_lite",
 	IndividualNormal: "individual_normal",
 	IndividualPro: "individual_pro",
@@ -4878,6 +4506,7 @@ const NotificationType = {
 	SubscriptionCreated: "subscription.created",
 	SubscriptionCancelled: "subscription.cancelled",
 	StartupGrantEnded: "startup.grant_ended",
+	GrantEnded: "subscription.grant_ended",
 	SubscriptionPastDue: "subscription.past_due",
 	BalanceThresholdWarning: "balance.threshold.warning",
 	PlatformTierPriceIncrease: "platform.tier_price_increase",
@@ -4898,11 +4527,404 @@ const NotificationChannel = {
 	Push: "push",
 	Sms: "sms"
 };
-const RecipientStrategy = {
-	TenantAdmins: "tenant_admins",
-	SpecificUser: "specific_user"
+const RecipientStrategy = {
+	TenantAdmins: "tenant_admins",
+	SpecificUser: "specific_user"
+};
+NotificationType.PaymentSucceeded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PaymentFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.TopUpCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AutoRechargeCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AutoRechargeFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.SubscriptionCreated, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.SubscriptionCancelled, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.StartupGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.GrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.SubscriptionPastDue, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.BalanceThresholdWarning, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PlatformTierPriceIncrease, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AgentCreated, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentProvisionFailed, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentBillingSuspended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentDisconnectedExtended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.BrowserTakeoverRequested, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.InviteCreated, NotificationCategory.System, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationType.OrgClaimed, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.TeamMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ProjectMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.IntegrationInstalled, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.IntegrationRemoved, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push;
+//#endregion
+//#region ../../packages-internal/api-client/dist/services/auth.js
+var AuthService = class {
+	client;
+	constructor(client) {
+		this.client = client;
+	}
+	prefix = "/auth";
+	validate(token) {
+		return this.client.request(`${this.prefix}/validate`, {
+			method: "POST",
+			body: JSON.stringify({ token })
+		});
+	}
+	listTokens() {
+		return this.client.request(`${this.prefix}/tokens`);
+	}
+	createToken(data) {
+		return this.client.request(`${this.prefix}/tokens`, {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	deleteToken(tokenId) {
+		return this.client.request(`${this.prefix}/tokens/${tokenId}`, { method: "DELETE" });
+	}
+	/**
+	* Start a device-code flow. Called by the CLI when the user runs
+	* `alfe login` and picks the browser path. The returned `device_code`
+	* is the CLI's bearer secret for polling /auth/device-token; the
+	* `user_code` is what the user types/sees on the dashboard.
+	*
+	* Uses `publicRequest` because the CLI has no token yet — the standard
+	* `request` path would short-circuit with a synthetic 401.
+	*/
+	startDeviceCode(input) {
+		return this.client.publicRequest(`${this.prefix}/device-code`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	/**
+	* Poll for the minted API key. Public endpoint. Returns:
+	*   200 → { api_key, tenantId, tokenExpiresAt } (success — write to config)
+	*   428 → still pending (caller should sleep `interval` and retry)
+	*   429 → polling too fast; caller should back off
+	*   410 → device-code expired; user must run `alfe login` again
+	*   400 → already redeemed (security: do not retry)
+	*
+	* Surface the HTTP-status code via the standard ApiResult error shape
+	* so callers can branch.
+	*/
+	pollDeviceToken(deviceCode) {
+		return this.client.publicRequest(`${this.prefix}/device-token`, {
+			method: "POST",
+			body: JSON.stringify({ device_code: deviceCode })
+		});
+	}
+	/** Dashboard-side. Fetch the device fingerprint for an approval card. */
+	lookupDeviceCode(userCode) {
+		return this.client.request(`${this.prefix}/device-code/lookup`, {
+			method: "POST",
+			body: JSON.stringify({ user_code: userCode })
+		});
+	}
+	/** Dashboard-side. Approve the pending device-code; CLI's next poll gets the key. */
+	approveDeviceCode(input) {
+		return this.client.request(`${this.prefix}/device-code/approve`, {
+			method: "POST",
+			body: JSON.stringify({
+				user_code: input.userCode,
+				expiresIn: input.expiresIn
+			})
+		});
+	}
+	getOnboardingStatus() {
+		return this.client.request(`${this.prefix}/onboarding/status`);
+	}
+	completeOnboarding(input) {
+		return this.client.request(`${this.prefix}/onboarding/complete`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	getAccessStatus() {
+		return this.client.request(`${this.prefix}/access/status`);
+	}
+	redeemAccessCode(code) {
+		return this.client.request(`${this.prefix}/access/redeem`, {
+			method: "POST",
+			body: JSON.stringify({ code })
+		});
+	}
+	/**
+	* Fetch the caller's current permission list as enforced by the gateway.
+	* UI permission providers should call this on mount and refetch on
+	* Clerk org switch to stay in sync with sub-tenant permission changes.
+	*/
+	getMyPermissions() {
+		return this.client.request(`${this.prefix}/me/permissions`);
+	}
+	/**
+	* Preview what deleting the caller's own account will do. Drives the Danger
+	* Zone copy so the user sees an honest, kind-appropriate warning before the
+	* irreversible action (a last-admin cascade wipes the whole workspace).
+	*/
+	getDeletionPreview() {
+		return this.client.request(`${this.prefix}/me/deletion-preview`);
+	}
+	/**
+	* Permanently delete the caller's own account. Returns `{ status: "deleting" }`
+	* and tears the account down asynchronously — the Clerk user is deleted shortly
+	* after, so the caller's session dies. On success, sign out and route the user
+	* to a terminal "account is being deleted" state; do NOT retry.
+	*
+	* Pass `confirmKind` (the accountKind the user actually confirmed, from the
+	* deletion preview): if membership changed between preview and execute, the
+	* server answers 409 `account_kind_changed` instead of cascading a scope the
+	* user never agreed to.
+	*/
+	deleteAccount(confirmKind) {
+		return this.client.request(`${this.prefix}/me`, {
+			method: "DELETE",
+			...confirmKind ? { body: JSON.stringify({ confirmKind }) } : {}
+		});
+	}
+	getSubscriptionStatus() {
+		return this.client.request(`${this.prefix}/subscription`);
+	}
+	/**
+	* Mint a short-lived, single-use Clerk sign-in token for the calling user so
+	* a native client can hand its logged-in session to the web dashboard
+	* (`${dashboard}/handoff?__clerk_ticket=<token>`). Server mints only for the
+	* authenticated user — never a caller-supplied id.
+	*/
+	createHandoffToken() {
+		return this.client.request(`${this.prefix}/handoff-token`, { method: "POST" });
+	}
+	applyForStartup(input) {
+		return this.client.request(`${this.prefix}/subscription/apply-startup`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	/**
+	* Accept an approved Startup Program invite. Call after the applicant has a
+	* card on file (confirmed or freshly added) — this mints the Professional
+	* grant subscription. Idempotent: a repeat call on an already-accepted
+	* application returns `{ status: "accepted" }` without re-charging.
+	*/
+	acceptStartup() {
+		return this.client.request(`${this.prefix}/subscription/accept-startup`, { method: "POST" });
+	}
+	createCheckoutSession(input) {
+		return this.client.request(`${this.prefix}/subscription/checkout`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	/**
+	* Change a personal (individual-tier) subscriber's platform plan in place on
+	* their existing Stripe subscription — no second Checkout, no duplicate sub,
+	* no double charge. Upgrades prorate immediately; downgrades apply with no
+	* immediate charge/refund. Returns the updated subscription.
+	*/
+	changePlatformPlan(input) {
+		return this.client.request(`${this.prefix}/subscription/change`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	/**
+	* Preview the proration cost for changing a personal (individual-tier)
+	* subscriber's platform plan — read-only companion to `changePlatformPlan`.
+	* Nothing is charged.
+	*/
+	previewPlatformPlanChange(input) {
+		return this.client.request(`${this.prefix}/subscription/change/preview`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	updateSeats(seats) {
+		return this.client.request(`${this.prefix}/subscription/seats`, {
+			method: "POST",
+			body: JSON.stringify({ seats })
+		});
+	}
+	previewSeatChange(seats) {
+		return this.client.request(`${this.prefix}/subscription/seats/preview`, {
+			method: "POST",
+			body: JSON.stringify({ seats })
+		});
+	}
+	listOrgMembers() {
+		return this.client.request(`${this.prefix}/org/members`);
+	}
+	patchOrgMember(userId, body) {
+		return this.client.request(`${this.prefix}/org/members/${encodeURIComponent(userId)}`, {
+			method: "PATCH",
+			body: JSON.stringify(body)
+		});
+	}
+	removeOrgMember(userId) {
+		return this.client.request(`${this.prefix}/org/members/${encodeURIComponent(userId)}`, { method: "DELETE" });
+	}
+	listOrgInvitations() {
+		return this.client.request(`${this.prefix}/org/invitations`);
+	}
+	createOrgInvitation(input) {
+		return this.client.request(`${this.prefix}/org/invitations`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	revokeOrgInvitation(invitationId) {
+		return this.client.request(`${this.prefix}/org/invitations/${encodeURIComponent(invitationId)}`, { method: "DELETE" });
+	}
+	listOrgDomains() {
+		return this.client.request(`${this.prefix}/org/domains`);
+	}
+	createOrgDomain(input) {
+		return this.client.request(`${this.prefix}/org/domains`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	deleteOrgDomain(domainId) {
+		return this.client.request(`${this.prefix}/org/domains/${encodeURIComponent(domainId)}`, { method: "DELETE" });
+	}
+	updateOrgSettings(input) {
+		return this.client.request(`${this.prefix}/org/settings`, {
+			method: "PATCH",
+			body: JSON.stringify(input)
+		});
+	}
+};
+//#endregion
+//#region ../../packages-internal/api-client/dist/services/integrations.js
+var IntegrationsService = class {
+	client;
+	constructor(client) {
+		this.client = client;
+	}
+	listScopedInstalls(scope, scopeId) {
+		const params = new URLSearchParams({
+			scope,
+			scopeId
+		});
+		return this.client.request(`/integrations/scoped?${params}`);
+	}
+	installScoped(data) {
+		return this.client.request("/integrations/scoped", {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	getScopedInstall(integrationId, scope, scopeId) {
+		const params = new URLSearchParams({
+			scope,
+			scopeId
+		});
+		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}?${params}`);
+	}
+	updateScopedInstall(integrationId, data) {
+		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}`, {
+			method: "PATCH",
+			body: JSON.stringify(data)
+		});
+	}
+	removeScopedInstall(integrationId, scope, scopeId) {
+		const params = new URLSearchParams({
+			scope,
+			scopeId
+		});
+		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}?${params}`, { method: "DELETE" });
+	}
+	/**
+	* Reinstall (re-apply latest) a scope-level install. Agent scope is rejected
+	* by the route — use {@link reinstallIntegration} for agent-scoped reinstall.
+	*/
+	reinstallScoped(integrationId, scope, scopeId) {
+		return this.client.request(`/integrations/scoped/${encodeURIComponent(integrationId)}/reinstall`, {
+			method: "POST",
+			body: JSON.stringify({
+				scope,
+				scopeId
+			})
+		});
+	}
+	listIntegrations(agentId, options) {
+		const params = new URLSearchParams();
+		if (options?.includeInherited) params.set("includeInherited", "true");
+		if (options?.effective) params.set("effective", "true");
+		const qs = params.toString();
+		return this.client.request(`/integrations/agents/${agentId}${qs ? `?${qs}` : ""}`);
+	}
+	installIntegration(agentId, data) {
+		return this.client.request(`/integrations/agents/${agentId}`, {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	getIntegrationConfig(agentId, integrationId) {
+		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/config`);
+	}
+	updateIntegration(agentId, integrationId, data) {
+		return this.client.request(`/integrations/agents/${agentId}/${integrationId}`, {
+			method: "PATCH",
+			body: JSON.stringify(data)
+		});
+	}
+	removeIntegration(agentId, integrationId) {
+		return this.client.request(`/integrations/agents/${agentId}/${integrationId}`, { method: "DELETE" });
+	}
+	reinstallIntegration(agentId, integrationId) {
+		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/reinstall`, { method: "POST" });
+	}
+	/**
+	* Upgrade an integration to the registry's latest version via the fast,
+	* diff-based daemon path (bumps `version` without `reinstallRequestedAt`).
+	* The agent stays online — no destructive teardown. Distinct from
+	* {@link reinstallIntegration}, which is the destructive repair path.
+	*/
+	upgradeIntegration(agentId, integrationId) {
+		return this.client.request(`/integrations/agents/${agentId}/${integrationId}/upgrade`, { method: "POST" });
+	}
+	getRegistry() {
+		return this.client.request("/integrations/registry");
+	}
+	triggerSync(agentId) {
+		return this.client.request("/integrations/sync/trigger", {
+			method: "POST",
+			body: JSON.stringify({ agentId })
+		});
+	}
+	getDiscordGuildChannels(guildId) {
+		return this.client.request(`/discord/guilds/${encodeURIComponent(guildId)}/channels`);
+	}
+	listMobileNumbers() {
+		return this.client.request("/mobile/numbers");
+	}
+	searchMobileNumbers(country, query) {
+		const params = new URLSearchParams();
+		if (country) params.set("country", country);
+		if (query) params.set("query", query);
+		return this.client.request(`/mobile/numbers/search?${params}`);
+	}
+	assignMobileNumber(agentId, phoneNumber, countryCode) {
+		return this.client.request("/mobile/numbers/assign", {
+			method: "POST",
+			body: JSON.stringify({
+				agentId,
+				phoneNumber,
+				countryCode
+			})
+		});
+	}
+	releaseMobileNumber(agentId) {
+		return this.client.request("/mobile/numbers/release", {
+			method: "POST",
+			body: JSON.stringify({ agentId })
+		});
+	}
+	getMobileNumber(agentId) {
+		return this.client.request(`/mobile/numbers?agentId=${encodeURIComponent(agentId)}`);
+	}
+	disconnectGoogle(agentId, email) {
+		const query = email ? `?email=${encodeURIComponent(email)}` : "";
+		return this.client.request(`/google/agents/${encodeURIComponent(agentId)}/account${query}`, { method: "DELETE" });
+	}
+	getAtlassianSites(agentId) {
+		return this.client.request(`/atlassian/agents/${encodeURIComponent(agentId)}/sites`);
+	}
+	selectAtlassianSite(agentId, cloudId) {
+		return this.client.request(`/atlassian/agents/${encodeURIComponent(agentId)}/sites`, {
+			method: "PUT",
+			body: JSON.stringify({ cloudId })
+		});
+	}
+	listSlackChannels(agentId) {
+		return this.client.request(`/slack/agents/${encodeURIComponent(agentId)}/channels`);
+	}
+	sendSlackMessage(agentId, channel, text) {
+		return this.client.request(`/slack/agents/${encodeURIComponent(agentId)}/send`, {
+			method: "POST",
+			body: JSON.stringify({
+				channel,
+				text
+			})
+		});
+	}
 };
-NotificationType.PaymentSucceeded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PaymentFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.TopUpCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AutoRechargeCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AutoRechargeFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.SubscriptionCreated, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.SubscriptionCancelled, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.StartupGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.SubscriptionPastDue, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.BalanceThresholdWarning, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PlatformTierPriceIncrease, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AgentCreated, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentProvisionFailed, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentBillingSuspended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentDisconnectedExtended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.BrowserTakeoverRequested, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.InviteCreated, NotificationCategory.System, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationType.OrgClaimed, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.TeamMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ProjectMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.IntegrationInstalled, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.IntegrationRemoved, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push;
 //#endregion
 //#region src/config.ts
 /**
@@ -5126,6 +5148,17 @@ async function loadDaemonConfig() {
 	const gatewayWsUrl = alfeConfig.gateway_url ?? deriveGatewayWsUrl(apiEndpoint);
 	const runtimes = await loadRuntimeConfigs();
 	const runtime = alfeConfig.runtime ?? identity.runtime;
+	let defaultModel;
+	if (runtime === "claude-code") {
+		let timer;
+		const ws = await Promise.race([fetchAgentConfig(alfeConfig.api_key, apiEndpoint), new Promise((resolve) => {
+			timer = setTimeout(() => {
+				resolve(null);
+			}, 5e3);
+		})]);
+		if (timer) clearTimeout(timer);
+		defaultModel = ws?.defaultModel;
+	}
 	return {
 		apiKey: alfeConfig.api_key,
 		apiEndpoint,
@@ -5136,7 +5169,8 @@ async function loadDaemonConfig() {
 		orgId: identity.orgId,
 		runtime,
 		runtimes,
-		autoStartRuntime: alfeConfig.auto_start_runtime ?? true
+		autoStartRuntime: alfeConfig.auto_start_runtime ?? true,
+		...defaultModel ? { defaultModel } : {}
 	};
 }
 /**
@@ -7073,12 +7107,25 @@ async function uninstallSystemd() {
 	return `Uninstalled: ${unitPath}`;
 }
 /**
-* Start the installed service via systemctl/launchctl.
+* Bootstrap (load) the launchd service from its plist if it isn't already
+* loaded. Already-loaded is an error we ignore. Needed so `start`/`restart`
+* work after `stopService()` boots the service OUT.
+*/
+function ensureLaunchdLoaded(uid) {
+	try {
+		execSync(`launchctl bootstrap gui/${uid} ${getLaunchdPlistPath()}`, { stdio: "pipe" });
+	} catch {}
+}
+/**
+* Start the installed service via systemctl/launchctl. Bootstraps the launchd
+* service first so this also works after `stopService()` booted it out.
 */
 function startService() {
 	const platform = process.platform;
 	if (platform === "darwin") {
-		execSync(`launchctl kickstart -k gui/${getLaunchdUid()}/${LAUNCHD_LABEL}`, { stdio: "pipe" });
+		const uid = getLaunchdUid();
+		ensureLaunchdLoaded(uid);
+		execSync(`launchctl kickstart -k gui/${uid}/${LAUNCHD_LABEL}`, { stdio: "pipe" });
 		logger$1.info("Started launchd service");
 		return;
 	}
@@ -7090,6 +7137,59 @@ function startService() {
 	throw new Error(`Unsupported platform: ${platform}`);
 }
 /**
+* Restart the installed service via systemctl/launchctl. This is the
+* service-manager-native restart (`kickstart -k` / `systemctl restart`) — the
+* CLI uses it instead of killing the process inline, which would fight launchd
+* `KeepAlive` / systemd `Restart=always`.
+*/
+function restartService() {
+	const platform = process.platform;
+	if (platform === "darwin") {
+		const uid = getLaunchdUid();
+		ensureLaunchdLoaded(uid);
+		execSync(`launchctl kickstart -k gui/${uid}/${LAUNCHD_LABEL}`, { stdio: "pipe" });
+		logger$1.info("Restarted launchd service");
+		return;
+	}
+	if (platform === "linux") {
+		execSync(`${isRootUser() ? "systemctl" : "systemctl --user"} restart ${SYSTEMD_SERVICE}`, { stdio: "pipe" });
+		logger$1.info("Restarted systemd service");
+		return;
+	}
+	throw new Error(`Unsupported platform: ${platform}`);
+}
+/**
+* Stop the installed service via systemctl/launchctl. On macOS this boots the
+* service OUT (unloads it) so launchd's `KeepAlive` does NOT respawn it;
+* `startService()` bootstraps it again. On Linux the unit stays enabled (starts
+* on next boot); `systemctl stop` just halts the current run.
+*/
+function stopService() {
+	const platform = process.platform;
+	if (platform === "darwin") {
+		execSync(`launchctl bootout gui/${getLaunchdUid()}/${LAUNCHD_LABEL}`, { stdio: "pipe" });
+		logger$1.info("Stopped launchd service");
+		return;
+	}
+	if (platform === "linux") {
+		execSync(`${isRootUser() ? "systemctl" : "systemctl --user"} stop ${SYSTEMD_SERVICE}`, { stdio: "pipe" });
+		logger$1.info("Stopped systemd service");
+		return;
+	}
+	throw new Error(`Unsupported platform: ${platform}`);
+}
+/**
+* True when the gateway is installed as a system service (launchd plist /
+* systemd unit present). Lets the CLI restart/stop/start THROUGH the service
+* manager instead of driving the daemon inline via the PID file.
+*/
+function isServiceInstalled() {
+	const platform = process.platform;
+	if (platform === "darwin") return existsSync(getLaunchdPlistPath());
+	if (platform === "linux") return existsSync(isRootUser() ? getSystemdSystemServicePath() : getSystemdServicePath());
+	return false;
+}
+/**
 * Write the current process PID to the PID file.
 */
 async function writePidFile() {
@@ -23913,7 +24013,7 @@ async function startDaemon() {
 			runtimeProcess = new RuntimeProcess({
 				runtime: config.runtime,
 				workspace: runtimeCfg.workspace,
-				env: {}
+				env: config.runtime === "claude-code" && config.defaultModel ? { ALFE_DEFAULT_MODEL: config.defaultModel } : {}
 			});
 			runtimeProcess.setTurnActivityProbe(turnActivityProbe);
 			runtimeProcess.start();
@@ -24105,7 +24205,7 @@ async function executeCloudCommand(command) {
 		};
 		const payload = command.payload;
 		const runtime = config.runtime;
-		const version = payload?.version ?? (runtime === "openclaw" ? "2026.6.11" : void 0);
+		const version = payload?.version ?? (runtime === "openclaw" ? "2026.6.11" : runtime === "claude-code" ? "0.1.3" : void 0);
 		upgradingRuntime = true;
 		setTimeout(() => {
 			(async () => {
@@ -24805,4 +24905,4 @@ function formatDuration(ms) {
 	return `${String(Math.round(seconds / 3600))}h`;
 }
 //#endregion
-export { installService as a, uninstallService as c, PID_PATH as d, SOCKET_PATH as f, PINNED_OPENCLAW_VERSION as g, resolveAgentIdentity as h, checkExistingDaemon as i, PROTOCOL_VERSION as l, loadDaemonConfig as m, queryDaemonHealth as n, startService as o, fetchAgentConfig as p, startDaemon as r, stopExistingDaemon as s, formatHealthReport as t, ALFE_DIR as u };
+export { loadDaemonConfig as _, installService as a, PINNED_OPENCLAW_VERSION as b, startService as c, uninstallService as d, PROTOCOL_VERSION as f, fetchAgentConfig as g, SOCKET_PATH as h, checkExistingDaemon as i, stopExistingDaemon as l, PID_PATH as m, queryDaemonHealth as n, isServiceInstalled as o, ALFE_DIR as p, startDaemon as r, restartService as s, formatHealthReport as t, stopService as u, resolveAgentIdentity as v, PINNED_CLAUDE_CODE_HOST_VERSION as y };

package/dist/runtime-upgrade.js

@@ -19,13 +19,19 @@ const execFileAsync = promisify(execFile);
 /**
 * Resolve the per-runtime upgrade command.
 *
-* - `openclaw`: `npm install -g openclaw@<version>` — version-pinned (unchanged).
-* - `hermes`:   `hermes update --yes` — Hermes self-updates from its own channel.
-*               A pinned version does not map to a Hermes CLI flag, so the
-*               `version` arg is intentionally ignored on this branch.
+* - `openclaw`:    `npm install -g openclaw@<version>` — version-pinned.
+* - `claude-code`: `npm install -g @alfe.ai/claude-code-host@<version>` — the
+*                  runtime child is the host binary; mirrors openclaw. The
+*                  caller defaults a missing version to the pin.
+* - `hermes`:      `hermes update --yes` — Hermes self-updates from its own
+*                  channel. A pinned version does not map to a Hermes CLI flag,
+*                  so the `version` arg is intentionally ignored on this branch.
 *
-* Returns `undefined` for an unknown runtime (or openclaw with no version),
-* which the caller treats as a failed upgrade (restart on the old version).
+* Returns `undefined` for an unknown runtime (or openclaw/claude-code with no
+* version), which the caller treats as a failed upgrade (restart on the old
+* version). `upgradeRuntime` restarts the RuntimeProcess child regardless of
+* runtime, so a new branch here is all that's needed to cycle onto the new
+* version.
 */
 function resolveUpgradeCommand(runtime, version) {
 	switch (runtime) {
@@ -39,6 +45,16 @@ function resolveUpgradeCommand(runtime, version) {
 					`openclaw@${version}`
 				]
 			};
+		case "claude-code":
+			if (!version) return void 0;
+			return {
+				command: "npm",
+				args: [
+					"install",
+					"-g",
+					`@alfe.ai/claude-code-host@${version}`
+				]
+			};
 		case "hermes": return {
 			command: "hermes",
 			args: ["update", "--yes"]

package/dist/src/index.d.ts

@@ -59,6 +59,26 @@ declare function startDaemon(): Promise<void>;
  */
 declare const PINNED_OPENCLAW_VERSION = "2026.6.11";
 //#endregion
+//#region src/claude-code-host-version.d.ts
+/**
+ * The `@alfe.ai/claude-code-host` version Alfe pins the claude-code runtime to —
+ * the single source of truth for its install paths:
+ *   - `@alfe.ai/cli` `installClaudeCodeHost` (fresh `alfe setup`)
+ *   - the daemon `runtime.update` default (this package)
+ *
+ * Pinning (rather than floating `npm install -g @alfe.ai/claude-code-host` →
+ * `latest`) is deliberate: the host is the claude-code runtime child on every
+ * self-hosted claude-code agent, so a bad `latest` publish would auto-reach
+ * every new `alfe setup` with no CLI gate. Bump deliberately after validating a
+ * new host, then cut a CLI release so the pin travels with the CLI version. The
+ * dashboard still surfaces npm-`latest` as an explicit opt-in upgrade.
+ *
+ * NOTE: claude-code is self-hosted-only (no managed Docker image), so — unlike
+ * `PINNED_OPENCLAW_VERSION` — there is no `services/compute/Dockerfile` mirror to
+ * keep in sync.
+ */
+declare const PINNED_CLAUDE_CODE_HOST_VERSION = "0.1.3";
+//#endregion
 //#region src/sentry.d.ts
 /**
  * Agent-side error reporting (Sentry) for the Alfe CLI + gateway daemon.
@@ -261,6 +281,13 @@ interface DaemonConfig {
   runtimes: Record<string, RuntimeConfig>;
   /** Whether to auto-start the agent runtime process (e.g. openclaw) */
   autoStartRuntime: boolean;
+  /**
+   * The agent's bare `defaultModel`, resolved for claude-code only (other
+   * runtimes receive their model via the desired-state reconcile, not here).
+   * The daemon injects it into the host env so `claude -p --model` uses the
+   * dashboard-selected model. Never provider-qualified.
+   */
+  defaultModel?: string;
 }
 interface AgentIdentity {
   agentId: string;
@@ -349,9 +376,30 @@ declare function installService(): Promise<string>;
  */
 declare function uninstallService(): Promise<string>;
 /**
- * Start the installed service via systemctl/launchctl.
+ * Start the installed service via systemctl/launchctl. Bootstraps the launchd
+ * service first so this also works after `stopService()` booted it out.
  */
 declare function startService(): void;
+/**
+ * Restart the installed service via systemctl/launchctl. This is the
+ * service-manager-native restart (`kickstart -k` / `systemctl restart`) — the
+ * CLI uses it instead of killing the process inline, which would fight launchd
+ * `KeepAlive` / systemd `Restart=always`.
+ */
+declare function restartService(): void;
+/**
+ * Stop the installed service via systemctl/launchctl. On macOS this boots the
+ * service OUT (unloads it) so launchd's `KeepAlive` does NOT respawn it;
+ * `startService()` bootstraps it again. On Linux the unit stays enabled (starts
+ * on next boot); `systemctl stop` just halts the current run.
+ */
+declare function stopService(): void;
+/**
+ * True when the gateway is installed as a system service (launchd plist /
+ * systemd unit present). Lets the CLI restart/stop/start THROUGH the service
+ * manager instead of driving the daemon inline via the PID file.
+ */
+declare function isServiceInstalled(): boolean;
 /**
  * Write the current process PID to the PID file.
  */
@@ -366,4 +414,4 @@ declare function checkExistingDaemon(): Promise<number | null>;
  */
 declare function stopExistingDaemon(): Promise<boolean>;
 //#endregion
-export { AGENT_DAEMON_SENTRY_DSN, AGENT_MCP_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, type AgentIdentity, type AgentWorkspaceConfig, type DaemonConfig, type DaemonHealth, type IPCEvent, type IPCRequest, type IPCResponse, type InitAgentSentryOptions, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, type RuntimeOutputLine, SOCKET_PATH, type SentrySurface, captureCliFailure, captureFatal, captureIntegrationFailure, captureMcpFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };
+export { AGENT_DAEMON_SENTRY_DSN, AGENT_MCP_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, type AgentIdentity, type AgentWorkspaceConfig, type DaemonConfig, type DaemonHealth, type IPCEvent, type IPCRequest, type IPCResponse, type InitAgentSentryOptions, PID_PATH, PINNED_CLAUDE_CODE_HOST_VERSION, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, type RuntimeOutputLine, SOCKET_PATH, type SentrySurface, captureCliFailure, captureFatal, captureIntegrationFailure, captureMcpFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, isServiceInstalled, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, restartService, setAgentContext, startDaemon, startService, stopExistingDaemon, stopService, uninstallService };

package/dist/src/index.js

@@ -1,4 +1,4 @@
-import { a as installService, c as uninstallService, d as PID_PATH, f as SOCKET_PATH, g as PINNED_OPENCLAW_VERSION, h as resolveAgentIdentity, i as checkExistingDaemon, l as PROTOCOL_VERSION, m as loadDaemonConfig, n as queryDaemonHealth, o as startService, p as fetchAgentConfig, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport, u as ALFE_DIR } from "../health.js";
+import { _ as loadDaemonConfig, a as installService, b as PINNED_OPENCLAW_VERSION, c as startService, d as uninstallService, f as PROTOCOL_VERSION, g as fetchAgentConfig, h as SOCKET_PATH, i as checkExistingDaemon, l as stopExistingDaemon, m as PID_PATH, n as queryDaemonHealth, o as isServiceInstalled, p as ALFE_DIR, r as startDaemon, s as restartService, t as formatHealthReport, u as stopService, v as resolveAgentIdentity, y as PINNED_CLAUDE_CODE_HOST_VERSION } from "../health.js";
 import { n as logger } from "../logger.js";
 import { a as captureFatal, c as captureRuntimeCrash, d as initAgentSentry, f as setAgentContext, i as captureCliFailure, l as captureRuntimeErrorOutput, n as AGENT_MCP_SENTRY_DSN, o as captureIntegrationFailure, r as AGENT_RUNTIME_SENTRY_DSN, s as captureMcpFailure, t as AGENT_DAEMON_SENTRY_DSN, u as flushSentry } from "../sentry.js";
-export { AGENT_DAEMON_SENTRY_DSN, AGENT_MCP_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, SOCKET_PATH, captureCliFailure, captureFatal, captureIntegrationFailure, captureMcpFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };
+export { AGENT_DAEMON_SENTRY_DSN, AGENT_MCP_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, PID_PATH, PINNED_CLAUDE_CODE_HOST_VERSION, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, SOCKET_PATH, captureCliFailure, captureFatal, captureIntegrationFailure, captureMcpFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, isServiceInstalled, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, restartService, setAgentContext, startDaemon, startService, stopExistingDaemon, stopService, uninstallService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.8.3",
+  "version": "0.9.1",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -23,11 +23,11 @@
     "pino-roll": "^1.2.0",
     "smol-toml": ">=1.6.1",
     "ws": "^8.18.0",
-    "@alfe.ai/agent-api-client": "^0.11.0",
+    "@alfe.ai/agent-api-client": "^0.11.1",
     "@alfe.ai/ai-proxy-local": "^0.0.13",
     "@alfe.ai/config": "^0.3.0",
-    "@alfe.ai/integration-manifest": "^0.3.2",
-    "@alfe.ai/integrations": "^0.5.2",
+    "@alfe.ai/integration-manifest": "^0.3.3",
+    "@alfe.ai/integrations": "^0.5.3",
     "@alfe.ai/mcp-bundler": "^0.3.2"
   },
   "license": "UNLICENSED",