@meffecta/agent 1.0.14 → 1.0.15

package/deployment.env.example

@@ -52,5 +52,5 @@ REGION=europe-west1
 # SCALING=scale-to-zero
 # CPU=2
 # MEMORY=4Gi
-# MAX_INSTANCES=1        # >1 breaks the serial run queue — raise only with reason
+# MAX_INSTANCES=1        # the run pool is per process — >1 breaks it, so raise only with reason
 # REQUEST_TIMEOUT=3600   # seconds one held request may last; the ceiling on a single run

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.14",
-  "builtFrom": "788fc7fd22968bd3e14bf4c19e850b2c13c7eb8c"
+  "engineTag": "1.0.15",
+  "builtFrom": "6b2db5d04d06db2612112659dd526e6f23a3e8c3"
 }

package/lib/commands.js

@@ -730,7 +730,7 @@ export const GROUPS = [
         "Provision GCP: registry, buckets, service account, run queue, service shell",
         script("setup-infrastructure.sh"),
       ],
-      ["set-secret", "AGENT_API_SECRET --random, CLAUDE_CODE_OAUTH_TOKEN, GITHUB_TOKEN", script("set-secret.sh")],
+      ["set-secret", "AGENT_API_SECRET --random, ANTHROPIC_API_KEY, GITHUB_TOKEN", script("set-secret.sh")],
       ["set-env", "GIT_REPO_URL — the one setting the service will not boot without", script("set-env.sh")],
       ["deploy", "Roll out an engine image and assert the runtime shape", script("deploy.sh")],
       [

package/lib/doctor.js

@@ -216,7 +216,29 @@ export async function doctor() {
       "meffecta-agent set-secret AGENT_API_SECRET   (paste the same value, deploy, then delete the old one)",
     );
   }
-  for (const name of [apiSecretName, "CLAUDE_CODE_OAUTH_TOKEN", "GITHUB_TOKEN"]) {
+  // Either variable pays for runs, and the API key wins when both are set. Naming the one
+  // in effect matters more than naming a missing variable: a deployment that switched to a
+  // Console key and left the old token behind is still billing the key, not the subscription.
+  const claudeAuth = env.ANTHROPIC_API_KEY ? "ANTHROPIC_API_KEY" : "CLAUDE_CODE_OAUTH_TOKEN";
+  if (!env.ANTHROPIC_API_KEY && !env.CLAUDE_CODE_OAUTH_TOKEN) {
+    r.fail(
+      "No way to pay for runs",
+      "The engine needs ANTHROPIC_API_KEY (a Claude Console key — what a product or service should use) or CLAUDE_CODE_OAUTH_TOKEN (billed to a personal subscription).",
+      "meffecta-agent set-secret ANTHROPIC_API_KEY",
+    );
+  } else {
+    r.ok("Claude credential", `runs bill to ${claudeAuth}`);
+    if (env.ANTHROPIC_API_KEY && env.CLAUDE_CODE_OAUTH_TOKEN) {
+      r.warn(
+        "Both Claude credentials are set",
+        "ANTHROPIC_API_KEY outranks CLAUDE_CODE_OAUTH_TOKEN, so the subscription token is unused.",
+        // Both are secret-backed, so --remove-env-vars (what `set-env --unset` does) will not
+        // touch them. Removing one is --remove-secrets, which the CLI has no command for.
+        `Drop whichever you did not mean to bill: gcloud run services update ${d.SERVICE} --region=${d.REGION} --remove-secrets CLAUDE_CODE_OAUTH_TOKEN`,
+      );
+    }
+  }
+  for (const name of [apiSecretName, claudeAuth, "GITHUB_TOKEN"]) {
     const ref = env[name]?.valueFrom?.secretKeyRef?.name;
     if (!env[name]) {
       r.fail(`${name} not set`, "Required by the engine.", `meffecta-agent set-secret ${name}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/create-project.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Step 1 of IMPLEMENTATION.md: create the GCP project this deployment will live in.
+# Step 1 of the set-up (https://agent.meffecta.com/install): create the GCP project this
+# deployment will live in.
 #
 # Give the agent a project of its own, separate from any product project it will read:
 # its service account gets project-wide secret access, and the mail tokens stored here

package/scripts/deploy.sh

@@ -32,9 +32,9 @@ set -euo pipefail
 # and is left alone.
 #
 # Usage:
-#   scripts/deploy.sh                     # the newest published engine (--tag latest)
-#   scripts/deploy.sh --tag sha-556ca72   # a specific build, e.g. to roll back
-#   scripts/deploy.sh --image europe-west1-docker.pkg.dev/PROJECT/REPO/agent:sha-556ca72
+#   scripts/deploy.sh                     # the newest release (--tag latest)
+#   scripts/deploy.sh --tag 1.0.13        # a specific version, e.g. to roll back
+#   scripts/deploy.sh --image europe-west1-docker.pkg.dev/PROJECT/REPO/agent:1.0.13
 #   scripts/deploy.sh --dry-run           # print the target, image and shape; change nothing
 #   scripts/deploy.sh --no-scheduler      # roll out without re-syncing the triggers
 #

package/scripts/link-billing.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Step 2 of IMPLEMENTATION.md: link a billing account to the project.
+# Step 2 of the set-up (https://agent.meffecta.com/install): link a billing account.
 #
 # Nothing else works without this — provisioning starts by enabling APIs, which fails on
 # an unbilled project, and the failure does not mention billing.

package/scripts/setup-infrastructure.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # One-time GCP provisioning for a deployment of the agent. Idempotent — safe to re-run.
-# See IMPLEMENTATION.md for the whole set-up, of which this is step 6.
+# See https://agent.meffecta.com/install for the whole set-up, of which this is step 5.
 #
 # Give the agent a GCP project of its OWN, separate from any product project it reads:
 # this project's service account holds project-wide secret access, and the mail refresh
@@ -325,7 +325,8 @@ echo "   Next, from this directory:"
 echo ""
 echo "     $(cmd set-env) GIT_REPO_URL=https://github.com/<owner>/<content-repo>.git"
 echo "     $(cmd set-secret) AGENT_API_SECRET --random"
-echo "     $(cmd set-secret) CLAUDE_CODE_OAUTH_TOKEN     # from: claude setup-token"
+echo "     $(cmd set-secret) ANTHROPIC_API_KEY           # a Claude Console key — for a service"
+echo "         ...or CLAUDE_CODE_OAUTH_TOKEN            # from: claude setup-token — individual use"
 echo "     $(cmd set-secret) GITHUB_TOKEN                # must be able to clone the repo above"
 echo "     $(cmd deploy)                              # rolls out the engine, then creates its triggers"
 if has_cli; then

package/scripts/update-tooling.sh

@@ -23,7 +23,7 @@ set -euo pipefail
 # That is this script's job, done by hand once. Afterwards:
 #
 #   scripts/update-tooling.sh                  # match the newest published engine
-#   scripts/update-tooling.sh --tag sha-558a144  # match a specific one, e.g. what you run
+#   scripts/update-tooling.sh --tag 1.0.13     # match a specific one, e.g. what you run
 #   scripts/update-tooling.sh --dry-run        # show what would change, touch nothing
 #
 # Needs docker, and is the only thing here that does: the files are lifted out of the

package/scripts/verify-credentials.mjs

@@ -619,7 +619,13 @@ async function checkDeploymentsContext() {
  * These are also the ones a shipped script CAN test properly, because they are the
  * engine's own and mean the same thing in every deployment.
  */
-const ESSENTIAL = new Set(["AGENT_API_SECRET", "CLAUDE_CODE_OAUTH_TOKEN", "GITHUB_TOKEN", "GIT_REPO_URL"]);
+const ESSENTIAL = new Set([
+  "AGENT_API_SECRET",
+  "ANTHROPIC_API_KEY",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "GITHUB_TOKEN",
+  "GIT_REPO_URL",
+]);
 
 /**
  * Inside a run, three of the four are proven by the fact that this output exists at all —
@@ -645,12 +651,20 @@ function checkPresence() {
   // started it, which is exactly right, and means "unset" here would be a lie: the run
   // doing the reporting is itself the proof it is set. AGENT_SPAWN_TOKEN is how we know we
   // are inside a run; the engine sets that one, so `claude` has no reason to strip it.
-  if (env.CLAUDE_CODE_OAUTH_TOKEN) {
-    ok("CLAUDE_CODE_OAUTH_TOKEN", "present (not remotely testable)");
+  //
+  // Either variable pays for runs, and the API key wins when both are set — so report which
+  // one is actually in play rather than just that something is.
+  if (env.ANTHROPIC_API_KEY) {
+    ok("ANTHROPIC_API_KEY", "present — runs bill to this Console key (not remotely testable)");
+    if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+      ok("CLAUDE_CODE_OAUTH_TOKEN", "present but unused — the API key outranks it");
+    }
+  } else if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+    ok("CLAUDE_CODE_OAUTH_TOKEN", "present — runs bill to this subscription (not remotely testable)");
   } else if (env.AGENT_SPAWN_TOKEN) {
-    ok("CLAUDE_CODE_OAUTH_TOKEN", "in use by this very run — a run cannot read it, by design");
+    ok("Claude credential", "in use by this very run — a run cannot read it, by design");
   } else {
-    skip("CLAUDE_CODE_OAUTH_TOKEN", "unset");
+    skip("Claude credential", "neither ANTHROPIC_API_KEY nor CLAUDE_CODE_OAUTH_TOKEN is set");
   }
   // Either name satisfies the engine; say which one is actually in play.
   if (env.AGENT_API_SECRET) {