@meffecta/agent 1.0.13 → 1.0.15

package/deployment.env.example

@@ -52,5 +52,5 @@ REGION=europe-west1
 # SCALING=scale-to-zero
 # CPU=2
 # MEMORY=4Gi
-# MAX_INSTANCES=1        # >1 breaks the serial run queue — raise only with reason
+# MAX_INSTANCES=1        # the run pool is per process — >1 breaks it, so raise only with reason
 # REQUEST_TIMEOUT=3600   # seconds one held request may last; the ceiling on a single run

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.13",
-  "builtFrom": "2c7075fd557116ad9692c5bb1780d60a1559aa01"
+  "engineTag": "1.0.15",
+  "builtFrom": "6b2db5d04d06db2612112659dd526e6f23a3e8c3"
 }

package/lib/commands.js

@@ -730,7 +730,7 @@ export const GROUPS = [
         "Provision GCP: registry, buckets, service account, run queue, service shell",
         script("setup-infrastructure.sh"),
       ],
-      ["set-secret", "AGENT_API_SECRET --random, CLAUDE_CODE_OAUTH_TOKEN, GITHUB_TOKEN", script("set-secret.sh")],
+      ["set-secret", "AGENT_API_SECRET --random, ANTHROPIC_API_KEY, GITHUB_TOKEN", script("set-secret.sh")],
       ["set-env", "GIT_REPO_URL — the one setting the service will not boot without", script("set-env.sh")],
       ["deploy", "Roll out an engine image and assert the runtime shape", script("deploy.sh")],
       [

package/lib/doctor.js

@@ -216,7 +216,29 @@ export async function doctor() {
       "meffecta-agent set-secret AGENT_API_SECRET   (paste the same value, deploy, then delete the old one)",
     );
   }
-  for (const name of [apiSecretName, "CLAUDE_CODE_OAUTH_TOKEN", "GITHUB_TOKEN"]) {
+  // Either variable pays for runs, and the API key wins when both are set. Naming the one
+  // in effect matters more than naming a missing variable: a deployment that switched to a
+  // Console key and left the old token behind is still billing the key, not the subscription.
+  const claudeAuth = env.ANTHROPIC_API_KEY ? "ANTHROPIC_API_KEY" : "CLAUDE_CODE_OAUTH_TOKEN";
+  if (!env.ANTHROPIC_API_KEY && !env.CLAUDE_CODE_OAUTH_TOKEN) {
+    r.fail(
+      "No way to pay for runs",
+      "The engine needs ANTHROPIC_API_KEY (a Claude Console key — what a product or service should use) or CLAUDE_CODE_OAUTH_TOKEN (billed to a personal subscription).",
+      "meffecta-agent set-secret ANTHROPIC_API_KEY",
+    );
+  } else {
+    r.ok("Claude credential", `runs bill to ${claudeAuth}`);
+    if (env.ANTHROPIC_API_KEY && env.CLAUDE_CODE_OAUTH_TOKEN) {
+      r.warn(
+        "Both Claude credentials are set",
+        "ANTHROPIC_API_KEY outranks CLAUDE_CODE_OAUTH_TOKEN, so the subscription token is unused.",
+        // Both are secret-backed, so --remove-env-vars (what `set-env --unset` does) will not
+        // touch them. Removing one is --remove-secrets, which the CLI has no command for.
+        `Drop whichever you did not mean to bill: gcloud run services update ${d.SERVICE} --region=${d.REGION} --remove-secrets CLAUDE_CODE_OAUTH_TOKEN`,
+      );
+    }
+  }
+  for (const name of [apiSecretName, claudeAuth, "GITHUB_TOKEN"]) {
     const ref = env[name]?.valueFrom?.secretKeyRef?.name;
     if (!env[name]) {
       r.fail(`${name} not set`, "Required by the engine.", `meffecta-agent set-secret ${name}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/create-project.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Step 1 of IMPLEMENTATION.md: create the GCP project this deployment will live in.
+# Step 1 of the set-up (https://agent.meffecta.com/install): create the GCP project this
+# deployment will live in.
 #
 # Give the agent a project of its own, separate from any product project it will read:
 # its service account gets project-wide secret access, and the mail tokens stored here

package/scripts/deploy.sh

@@ -32,9 +32,9 @@ set -euo pipefail
 # and is left alone.
 #
 # Usage:
-#   scripts/deploy.sh                     # the newest published engine (--tag latest)
-#   scripts/deploy.sh --tag sha-556ca72   # a specific build, e.g. to roll back
-#   scripts/deploy.sh --image europe-west1-docker.pkg.dev/PROJECT/REPO/agent:sha-556ca72
+#   scripts/deploy.sh                     # the newest release (--tag latest)
+#   scripts/deploy.sh --tag 1.0.13        # a specific version, e.g. to roll back
+#   scripts/deploy.sh --image europe-west1-docker.pkg.dev/PROJECT/REPO/agent:1.0.13
 #   scripts/deploy.sh --dry-run           # print the target, image and shape; change nothing
 #   scripts/deploy.sh --no-scheduler      # roll out without re-syncing the triggers
 #

package/scripts/link-billing.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Step 2 of IMPLEMENTATION.md: link a billing account to the project.
+# Step 2 of the set-up (https://agent.meffecta.com/install): link a billing account.
 #
 # Nothing else works without this — provisioning starts by enabling APIs, which fails on
 # an unbilled project, and the failure does not mention billing.

package/scripts/setup-infrastructure.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # One-time GCP provisioning for a deployment of the agent. Idempotent — safe to re-run.
-# See IMPLEMENTATION.md for the whole set-up, of which this is step 6.
+# See https://agent.meffecta.com/install for the whole set-up, of which this is step 5.
 #
 # Give the agent a GCP project of its OWN, separate from any product project it reads:
 # this project's service account holds project-wide secret access, and the mail refresh
@@ -325,7 +325,8 @@ echo "   Next, from this directory:"
 echo ""
 echo "     $(cmd set-env) GIT_REPO_URL=https://github.com/<owner>/<content-repo>.git"
 echo "     $(cmd set-secret) AGENT_API_SECRET --random"
-echo "     $(cmd set-secret) CLAUDE_CODE_OAUTH_TOKEN     # from: claude setup-token"
+echo "     $(cmd set-secret) ANTHROPIC_API_KEY           # a Claude Console key — for a service"
+echo "         ...or CLAUDE_CODE_OAUTH_TOKEN            # from: claude setup-token — individual use"
 echo "     $(cmd set-secret) GITHUB_TOKEN                # must be able to clone the repo above"
 echo "     $(cmd deploy)                              # rolls out the engine, then creates its triggers"
 if has_cli; then

package/scripts/update-tooling.sh

@@ -23,7 +23,7 @@ set -euo pipefail
 # That is this script's job, done by hand once. Afterwards:
 #
 #   scripts/update-tooling.sh                  # match the newest published engine
-#   scripts/update-tooling.sh --tag sha-558a144  # match a specific one, e.g. what you run
+#   scripts/update-tooling.sh --tag 1.0.13     # match a specific one, e.g. what you run
 #   scripts/update-tooling.sh --dry-run        # show what would change, touch nothing
 #
 # Needs docker, and is the only thing here that does: the files are lifted out of the

package/scripts/verify-credentials.mjs

@@ -163,6 +163,24 @@ async function checkAhrefs() {
     : fail("AHREFS_API_KEY", `domain-rating-free → ${status}`);
 }
 
+async function checkMevisio() {
+  if (!env.MEVISIO_HOST || !env.MEVISIO_EMAIL || !env.MEVISIO_PASSWORD) {
+    return skip("MEVISIO", "unset");
+  }
+  // A real login, because that is the only thing that proves these three agree — the platform
+  // hands an ANONYMOUS session to anyone who asks, and /gateway/api/context answers 200 with
+  // the account filled in and no user at all. Checking the host alone would report a pass.
+  const { status, json } = await http(`https://${env.MEVISIO_HOST}/identity/api/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ email: env.MEVISIO_EMAIL, password: env.MEVISIO_PASSWORD }),
+  });
+  if (status !== 200 || !json?.ok) {
+    return fail("MEVISIO", `login → ${status}${json?.error ? ` ${json.error}` : ""}`);
+  }
+  ok("MEVISIO", `${env.MEVISIO_EMAIL} @ ${env.MEVISIO_HOST}`);
+}
+
 async function checkAgentmail() {
   if (!env.AGENTMAIL_API_KEY) {
     return skip("AGENTMAIL_API_KEY", "unset");
@@ -601,7 +619,13 @@ async function checkDeploymentsContext() {
  * These are also the ones a shipped script CAN test properly, because they are the
  * engine's own and mean the same thing in every deployment.
  */
-const ESSENTIAL = new Set(["AGENT_API_SECRET", "CLAUDE_CODE_OAUTH_TOKEN", "GITHUB_TOKEN", "GIT_REPO_URL"]);
+const ESSENTIAL = new Set([
+  "AGENT_API_SECRET",
+  "ANTHROPIC_API_KEY",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "GITHUB_TOKEN",
+  "GIT_REPO_URL",
+]);
 
 /**
  * Inside a run, three of the four are proven by the fact that this output exists at all —
@@ -627,12 +651,20 @@ function checkPresence() {
   // started it, which is exactly right, and means "unset" here would be a lie: the run
   // doing the reporting is itself the proof it is set. AGENT_SPAWN_TOKEN is how we know we
   // are inside a run; the engine sets that one, so `claude` has no reason to strip it.
-  if (env.CLAUDE_CODE_OAUTH_TOKEN) {
-    ok("CLAUDE_CODE_OAUTH_TOKEN", "present (not remotely testable)");
+  //
+  // Either variable pays for runs, and the API key wins when both are set — so report which
+  // one is actually in play rather than just that something is.
+  if (env.ANTHROPIC_API_KEY) {
+    ok("ANTHROPIC_API_KEY", "present — runs bill to this Console key (not remotely testable)");
+    if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+      ok("CLAUDE_CODE_OAUTH_TOKEN", "present but unused — the API key outranks it");
+    }
+  } else if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+    ok("CLAUDE_CODE_OAUTH_TOKEN", "present — runs bill to this subscription (not remotely testable)");
   } else if (env.AGENT_SPAWN_TOKEN) {
-    ok("CLAUDE_CODE_OAUTH_TOKEN", "in use by this very run — a run cannot read it, by design");
+    ok("Claude credential", "in use by this very run — a run cannot read it, by design");
   } else {
-    skip("CLAUDE_CODE_OAUTH_TOKEN", "unset");
+    skip("Claude credential", "neither ANTHROPIC_API_KEY nor CLAUDE_CODE_OAUTH_TOKEN is set");
   }
   // Either name satisfies the engine; say which one is actually in play.
   if (env.AGENT_API_SECRET) {
@@ -666,6 +698,7 @@ const CHECKS = [
   ["AHREFS_API_KEY", checkAhrefs],
   ["SERPER_API_KEY", checkSerper],
   ["AGENTMAIL_API_KEY", checkAgentmail],
+  ["MEVISIO", checkMevisio],
   ["HUBSPOT_TOKEN", checkHubspot],
   ["KLEER_API_TOKEN", checkKleer],
   ["CLOUDFLARE", checkCloudflare],