@meffecta/agent 1.0.11 → 1.0.12

package/deployment.env.example

@@ -32,7 +32,7 @@ REGION=europe-west1
 # several Google accounts and want this deployment pinned to one.
 # ACCOUNT=you@example.com
 
-# Optional. The service's TIMEZONE env var, which is what cron schedules are read in.
+# Optional. The zone every job's `cron:` is read in. Defaults to UTC.
 # TIMEZONE=Europe/Stockholm
 
 # Optional. The runtime shape asserted on every rollout, so the deployed service

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.11",
-  "builtFrom": "c0f07973f25a4d8872a3e4dd28c44cd94f2e87a7"
+  "engineTag": "1.0.12",
+  "builtFrom": "222c28d7ab3961fc2512e630a6b41b60430c9558"
 }

package/lib/commands.js

@@ -217,6 +217,11 @@ async function status() {
   }
   console.log(`   revision   ${svc.status?.latestReadyRevisionName ?? "?"}`);
   console.log(`   image      ${container.image}`);
+  // The address you paste into someone else's console. GA4, Search Console and Google Ads
+  // authenticate as this rather than with a token, so granting the agent a property means
+  // inviting this email — and it is read from the service rather than assembled from the
+  // project name, so it is what the agent actually runs as.
+  console.log(`   acts as    ${tpl.spec.serviceAccountName ?? "(the project's default compute account)"}`);
   console.log(
     `   shape      min ${ann["autoscaling.knative.dev/minScale"] ?? "0"}, max ${
       ann["autoscaling.knative.dev/maxScale"] ?? "?"

package/lib/create-job.js

@@ -230,7 +230,7 @@ export async function createJob(args) {
         .map((f) => f.replace(/\.md$/, ""))
     : [];
 
-  const timezone = d.TIMEZONE ?? "Europe/Stockholm";
+  const timezone = d.TIMEZONE ?? "UTC";
   console.error(`Asking ${d.SERVICE} to write it — it can see your jobs, worlds and skills. This takes a minute.`);
   const params = new URLSearchParams({ prompt: buildPrompt(description, { timezone, existing }) });
   if (flags.model) {

package/lib/integrations.js

@@ -63,8 +63,8 @@ const INTEGRATIONS = {
     gives: "query-google-marketing — traffic, the queries that bring it, campaign spend",
     needs: [
       "No token at all: these authenticate as the runtime service account, which means",
-      "inviting it rather than minting anything. `meffecta-agent status` prints its address,",
-      "or look for agent-runtime@<project>.iam.gserviceaccount.com.",
+      "inviting it rather than minting anything. `meffecta-agent status` prints the exact",
+      "address to invite, on its `acts as` line.",
       "",
       "Invite it as a Viewer on each property you want read: the GA4 property (Admin →",
       "Property access management), the Search Console property (Settings → Users and",

package/lib/resources.js

@@ -210,6 +210,9 @@ export async function resources() {
     const note = explain[name] ?? `${display || "no description"} — not part of the agent set-up`;
     row(email === runtimeSa ? "✔" : explain[name] ? "✔" : "·", name, note, saWidth);
   }
+  console.log(`      ${runtimeSa}`);
+  console.log("      is the address to invite on a GA4 property, Search Console or Google Ads —");
+  console.log("      those grant access to a login rather than to a token.");
   const held = (roles ?? "").split("\n").filter(Boolean);
   if (held.length) {
     console.log(`      agent-runtime may, across the whole project: ${held.map((r) => leaf(r)).join(", ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/lib/deployment.sh

@@ -70,7 +70,7 @@ resolve_deployment() {
   # configure by editing a committed file.
   GHCR_IMAGE="${GHCR_IMAGE:-ghcr.io/meffecta/agent}"
   GHCR_PATH="${GHCR_IMAGE#*/}"   # ghcr.io/meffecta/agent → meffecta/agent
-  TIMEZONE="${TIMEZONE:-Europe/Stockholm}"
+  TIMEZONE="${TIMEZONE:-UTC}"
 
   # The runtime shape, asserted by deploy.sh on every rollout so the deployed service
   # matches this file rather than whatever was last done by hand in the console. Defaults

package/scripts/setup-infrastructure.sh

@@ -314,6 +314,13 @@ echo "   the agent acts as, a bucket for its memory, a write-once bucket for the
 echo "   trail, the queue that carries work back to the service, and the service itself —"
 echo "   empty, waiting for an engine."
 echo ""
+# The one address an operator has to type into someone else's console. Google Analytics,
+# Search Console and Google Ads grant access to a login rather than to a token, so this is
+# what gets invited. Printed on every run, not only the one that created it.
+echo "   The agent acts as:"
+echo "     ${RUNTIME_SA}"
+echo "   Invite that on a GA4 property, Search Console or Google Ads to let it read them."
+echo ""
 echo "   Next, from this directory:"
 echo ""
 echo "     $(cmd set-env) GIT_REPO_URL=https://github.com/<owner>/<content-repo>.git"