Package Updates

Endpoints for checking and installing newer versions of @0xmaxma/claude-gateway and @anthropic-ai/claude-code. All package endpoints require an admin API key (admin: true in config).

---

GET /api/v1/packages

Returns the current and latest version for both packages. Result is cached for 5 minutes to avoid hammering the npm registry.

target is the version an update would install, read from the npm registry's dist-tags. channel names the dist-tag it came from. claude-gateway follows stable and falls back to latest when no version has been promoted; claude-code follows latest. Both are null when the registry answer is unusable. latest carries the same value as target and is kept for clients written before release channels; it is not necessarily the npm latest dist-tag. current is resolved per package: claude-gateway (an npm global) via npm list -g, and claude-code (native installer) from the installed binary (claude --version). If Claude Code is not installed, its current is null and the UI renders —. hasUpdate is true only when target is strictly newer than current by semver ordering, so a binary that is ahead of target does not report a spurious update.

curl -H "X-Api-Key: admin-secret" \
  http://localhost:10850/api/v1/packages | jq

{
  "packages": [
    {
      "package": "@0xmaxma/claude-gateway",
      "current": "1.2.0",
      "target": "1.3.1",
      "latest": "1.3.1",
      "channel": "stable",
      "hasUpdate": true
    },
    {
      "package": "@anthropic-ai/claude-code",
      "current": "1.0.5",
      "target": "1.1.0",
      "latest": "1.1.0",
      "channel": "latest",
      "hasUpdate": true
    }
  ]
}

Error responses:

Status	When
401	No API key provided
403	Non-admin API key
503	npm registry unreachable

---

POST /api/v1/packages/:name/update

Installs the version GET /api/v1/packages reports as target for the specified package (for claude-gateway, the stable dist-tag). :name accepts claude-gateway or claude-code.

• claude-gateway: runs npm install -g @0xmaxma/claude-gateway@<version> then sends itself SIGTERM, requesting a non-zero (EX_TEMPFAIL) exit code so a Restart=on-failure unit restarts it too — a graceful exit(0) reads as success to on-failure and never restarts (issue #450). Restart=always units and pm2's autorestart restart on any exit code regardless.
• claude-code: runs the native updater (claude update) so the actual binary on PATH is updated. No restart needed. (npm install is not used — Claude Code ships via the native installer, so an npm-global copy would not be the running binary.)

If the package is already on that version, or ahead of it, the call is a no-op (updated: false).

curl -X POST \
  -H "X-Api-Key: admin-secret" \
  http://localhost:10850/api/v1/packages/claude-gateway/update | jq

{
  "package": "@0xmaxma/claude-gateway",
  "from": "1.2.0",
  "to": "1.3.1",
  "updated": true,
  "warning": "service will restart"
}

warning values:

Value	Meaning
"service will restart"	Running under systemd or pm2 — process manager will auto-restart
"process will stop — restart manually"	Plain process (dev) — will exit after update
null	No restart needed (claude-code)

Error responses:

Status	When
401	No API key provided
403	Non-admin API key
404	Unknown package name
500	npm install failed — body contains stderr
503	npm registry unreachable