@meffecta/agent 1.0.11 → 1.0.13

package/deployment.env.example

@@ -32,7 +32,7 @@ REGION=europe-west1
 # several Google accounts and want this deployment pinned to one.
 # ACCOUNT=you@example.com
 
-# Optional. The service's TIMEZONE env var, which is what cron schedules are read in.
+# Optional. The zone every job's `cron:` is read in. Defaults to UTC.
 # TIMEZONE=Europe/Stockholm
 
 # Optional. The runtime shape asserted on every rollout, so the deployed service

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.11",
-  "builtFrom": "c0f07973f25a4d8872a3e4dd28c44cd94f2e87a7"
+  "engineTag": "1.0.13",
+  "builtFrom": "2c7075fd557116ad9692c5bb1780d60a1559aa01"
 }

package/lib/commands.js

@@ -217,6 +217,11 @@ async function status() {
   }
   console.log(`   revision   ${svc.status?.latestReadyRevisionName ?? "?"}`);
   console.log(`   image      ${container.image}`);
+  // The address you paste into someone else's console. GA4, Search Console and Google Ads
+  // authenticate as this rather than with a token, so granting the agent a property means
+  // inviting this email — and it is read from the service rather than assembled from the
+  // project name, so it is what the agent actually runs as.
+  console.log(`   acts as    ${tpl.spec.serviceAccountName ?? "(the project's default compute account)"}`);
   console.log(
     `   shape      min ${ann["autoscaling.knative.dev/minScale"] ?? "0"}, max ${
       ann["autoscaling.knative.dev/maxScale"] ?? "?"

package/lib/create-job.js

@@ -230,7 +230,7 @@ export async function createJob(args) {
         .map((f) => f.replace(/\.md$/, ""))
     : [];
 
-  const timezone = d.TIMEZONE ?? "Europe/Stockholm";
+  const timezone = d.TIMEZONE ?? "UTC";
   console.error(`Asking ${d.SERVICE} to write it — it can see your jobs, worlds and skills. This takes a minute.`);
   const params = new URLSearchParams({ prompt: buildPrompt(description, { timezone, existing }) });
   if (flags.model) {

package/lib/integrations.js

@@ -63,8 +63,8 @@ const INTEGRATIONS = {
     gives: "query-google-marketing — traffic, the queries that bring it, campaign spend",
     needs: [
       "No token at all: these authenticate as the runtime service account, which means",
-      "inviting it rather than minting anything. `meffecta-agent status` prints its address,",
-      "or look for agent-runtime@<project>.iam.gserviceaccount.com.",
+      "inviting it rather than minting anything. `meffecta-agent status` prints the exact",
+      "address to invite, on its `acts as` line.",
       "",
       "Invite it as a Viewer on each property you want read: the GA4 property (Admin →",
       "Property access management), the Search Console property (Settings → Users and",
@@ -199,7 +199,8 @@ const INTEGRATIONS = {
     needs: [
       "A mailbox the agent can read. Either a Workspace mailbox via domain-wide delegation",
       "(keyless, Cloud Run only), or any Gmail account you have already connected — see",
-      "`meffecta-agent connect gmail` first if you have not.",
+      "`meffecta-agent connect gmail` first if you have not. An AgentMail inbox needs none",
+      "of that: set AGENTMAIL_API_KEY and skip to the frontmatter below.",
     ],
     steps: [
       [
@@ -213,11 +214,15 @@ const INTEGRATIONS = {
     more: [
       "Then, in the job's frontmatter:",
       "",
-      "    inbox: crm@yourdomain.com",
+      "    inbox: gmail:crm@yourdomain.com",
       "    allowFrom: you@yourdomain.com, @yourdomain.com",
       "",
       "and `deploy` to register it — both fields are read when the service boots.",
       "",
+      "The system is required: `gmail:<address>`, or `agentmail:<address>` for an inbox the",
+      "agent owns. A bare address is refused rather than guessed at, because an address",
+      "polled against the wrong system finds nothing for ever and looks healthy doing it.",
+      "",
       "allowFrom is required and enforced in code: mail from anyone not listed is dropped",
       "before the run starts, so it never reaches the model. Leave it out and the job",
       "refuses every message — an omission is not read as consent.",

package/lib/resources.js

@@ -210,6 +210,9 @@ export async function resources() {
     const note = explain[name] ?? `${display || "no description"} — not part of the agent set-up`;
     row(email === runtimeSa ? "✔" : explain[name] ? "✔" : "·", name, note, saWidth);
   }
+  console.log(`      ${runtimeSa}`);
+  console.log("      is the address to invite on a GA4 property, Search Console or Google Ads —");
+  console.log("      those grant access to a login rather than to a token.");
   const held = (roles ?? "").split("\n").filter(Boolean);
   if (held.length) {
     console.log(`      agent-runtime may, across the whole project: ${held.map((r) => leaf(r)).join(", ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/lib/deployment.sh

@@ -70,7 +70,7 @@ resolve_deployment() {
   # configure by editing a committed file.
   GHCR_IMAGE="${GHCR_IMAGE:-ghcr.io/meffecta/agent}"
   GHCR_PATH="${GHCR_IMAGE#*/}"   # ghcr.io/meffecta/agent → meffecta/agent
-  TIMEZONE="${TIMEZONE:-Europe/Stockholm}"
+  TIMEZONE="${TIMEZONE:-UTC}"
 
   # The runtime shape, asserted by deploy.sh on every rollout so the deployed service
   # matches this file rather than whatever was last done by hand in the console. Defaults

package/scripts/setup-infrastructure.sh

@@ -314,6 +314,13 @@ echo "   the agent acts as, a bucket for its memory, a write-once bucket for the
 echo "   trail, the queue that carries work back to the service, and the service itself —"
 echo "   empty, waiting for an engine."
 echo ""
+# The one address an operator has to type into someone else's console. Google Analytics,
+# Search Console and Google Ads grant access to a login rather than to a token, so this is
+# what gets invited. Printed on every run, not only the one that created it.
+echo "   The agent acts as:"
+echo "     ${RUNTIME_SA}"
+echo "   Invite that on a GA4 property, Search Console or Google Ads to let it read them."
+echo ""
 echo "   Next, from this directory:"
 echo ""
 echo "     $(cmd set-env) GIT_REPO_URL=https://github.com/<owner>/<content-repo>.git"

package/scripts/verify-credentials.mjs

@@ -163,6 +163,25 @@ async function checkAhrefs() {
     : fail("AHREFS_API_KEY", `domain-rating-free → ${status}`);
 }
 
+async function checkAgentmail() {
+  if (!env.AGENTMAIL_API_KEY) {
+    return skip("AGENTMAIL_API_KEY", "unset");
+  }
+  // The cheapest call there is, and the one that answers what actually matters about this
+  // key: a key scoped to a single inbox is indistinguishable from an account-wide one until
+  // something asks, and a job pointed at another inbox would fail with a puzzling 404.
+  const { status, json } = await http("https://api.agentmail.to/v0/auth/me", {
+    headers: { Authorization: `Bearer ${env.AGENTMAIL_API_KEY}` },
+  });
+  if (status !== 200) {
+    return fail("AGENTMAIL_API_KEY", `auth/me → ${status}`);
+  }
+  ok(
+    "AGENTMAIL_API_KEY",
+    json?.scope_type === "inbox" ? `scoped to ${json.inbox_id}` : `${json?.scope_type ?? "?"}-wide scope`,
+  );
+}
+
 async function checkSerper() {
   if (!env.SERPER_API_KEY) {
     return skip("SERPER_API_KEY", "unset");
@@ -646,6 +665,7 @@ const CHECKS = [
   ["POSTHOG", checkPosthog],
   ["AHREFS_API_KEY", checkAhrefs],
   ["SERPER_API_KEY", checkSerper],
+  ["AGENTMAIL_API_KEY", checkAgentmail],
   ["HUBSPOT_TOKEN", checkHubspot],
   ["KLEER_API_TOKEN", checkKleer],
   ["CLOUDFLARE", checkCloudflare],