@meffecta/agent 1.0.8 → 1.0.10

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.8",
-  "builtFrom": "09dbb9d808cafb8b06c0282602f1ca20914e3e6d"
+  "engineTag": "1.0.10",
+  "builtFrom": "36d54c192cfa454f2e4485414ac854b3be86c8f7"
 }

package/lib/commands.js

@@ -186,8 +186,35 @@ async function status() {
   );
   const external = Boolean(env.AGENT_TASKS_QUEUE && env.AGENT_PUBLIC_URL);
 
+  // What is RUNNING, asked of the service rather than inferred from the image tag — which
+  // is a moving target: `latest` names a different engine every time main is pushed, so the
+  // tag on the revision says what was requested and not what answers. /health is
+  // unauthenticated, so this needs no credential; a service that cannot be reached simply
+  // does not get the line.
+  let engine = "";
+  if (svc.status?.url) {
+    try {
+      const res = await fetch(`${svc.status.url}/health`, { signal: AbortSignal.timeout(25_000) });
+      const health = await res.json();
+      if (health?.version) {
+        engine = health.build ? `${health.version} (build ${health.build})` : health.version;
+      } else {
+        engine = "up, but too old to report its version";
+      }
+    } catch {
+      // Short timeout on purpose: this is a status command, and asking wakes a
+      // scale-to-zero service, so it waits about as long as a cold start and then says
+      // nothing rather than hanging. Not a verdict on health — `doctor` is where that is
+      // decided.
+      engine = "no answer within 25s (a sleeping service can take longer to wake)";
+    }
+  }
+
   console.log(`▶ ${d.SERVICE}  (${d.PROJECT} / ${d.REGION})`);
   console.log(`   url        ${svc.status?.url ?? "?"}`);
+  if (engine) {
+    console.log(`   engine     ${engine}`);
+  }
   console.log(`   revision   ${svc.status?.latestReadyRevisionName ?? "?"}`);
   console.log(`   image      ${container.image}`);
   console.log(

package/lib/create-job.js

@@ -180,7 +180,7 @@ function buildPrompt(description, { timezone, existing }) {
     "",
     "Before writing anything, read what this deployment actually is:",
     "  - jobs/*.md in your working directory — the house style, and what already exists",
-    "  - systems/ (or ENVIRONMENT.md) — what this deployment can reach, and the variables for each",
+    "  - systems/ — what this deployment can reach, one file per system, and the variables for each",
     "  - worlds/ if present — the projects/products a job can be pointed at",
     "  - your own available skills — use only skills that exist; never invent a capability",
     "",

package/lib/verify-credentials.js

@@ -40,8 +40,8 @@ PART 2 — this deployment's own systems.
 
 Part 1 tests what the ENGINE knows how to test. It cannot test a system belonging to this
 deployment specifically. The register of those is \`systems/\` in your working directory —
-one file per system — or, in a deployment that has not moved to that yet, a single
-ENVIRONMENT.md table. Read whichever is present.
+one file per system. If it is not there, say so and stop: a deployment with no register has
+no systems of its own that anything can check.
 
 Each file's frontmatter says what to do:
   system:     what it is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/deploy.sh

@@ -160,6 +160,51 @@ gcloud run deploy "${SERVICE}" \
   --execution-environment gen2 \
   "${SCALE_FLAGS[@]}"
 
+# What actually landed. `--tag latest` is a request, not an answer: it names whatever GHCR
+# was serving a moment ago, and after this it names whatever it serves next. The digest is
+# the immutable identity — and the one thing that makes a rollback to *this* engine possible
+# in a month, when the tag has moved on.
+read -r URL REVISION < <(gcloud run services describe "${SERVICE}" \
+  --project "${PROJECT}" --region "${REGION}" \
+  --format 'value[separator=" "](status.url, status.latestReadyRevisionName)' 2>/dev/null || echo " ")
+DIGEST=""
+if [ -n "${REVISION}" ]; then
+  DIGEST=$(gcloud run revisions describe "${REVISION}" \
+    --project "${PROJECT}" --region "${REGION}" \
+    --format 'value(status.imageDigest)' 2>/dev/null || true)
+fi
+
+# And which engine is answering. The digest says the image is different; only the service
+# says what it is. This is also the first real request to the new revision, so a rollout
+# that produced an image which cannot boot says so here rather than at the next cron —
+# generously timed, because a scale-to-zero service is cold and this image is a large pull.
+HEALTH=""
+if [ -n "${URL}" ]; then
+  HEALTH=$(curl -fsS --max-time 180 "${URL}/health" 2>/dev/null || true)
+fi
+VERSION=$(printf '%s' "${HEALTH}" | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+BUILD=$(printf '%s' "${HEALTH}" | sed -n 's/.*"build":"\([^"]*\)".*/\1/p')
+
+echo ""
+if [ -n "${VERSION}" ]; then
+  echo "✅ Running engine ${VERSION}${BUILD:+ (build ${BUILD})}"
+elif [ -n "${HEALTH}" ]; then
+  # It answered, but without a version: an engine from before /health reported one.
+  echo "✅ Service is up — this engine predates version reporting, so it cannot say which it is"
+else
+  echo "⚠️  Deployed, but ${SERVICE} did not answer /health within 3 minutes"
+  echo "   Check it before assuming the rollout is good:"
+  if has_cli; then
+    echo "     $(cmd logs)"
+  else
+    echo "     gcloud run services logs read ${SERVICE} --project ${PROJECT} --region ${REGION} --limit 50"
+  fi
+fi
+[ -n "${REVISION}" ] && echo "   revision  ${REVISION}"
+[ -n "${DIGEST}" ] && echo "   image     ${DIGEST##*@}"
+[ -n "${DIGEST}" ] && echo "   roll back to this exact engine later with:"
+[ -n "${DIGEST}" ] && echo "     $(cmd deploy) --image ${DIGEST}"
+
 # Only for a deployment that has opted into external triggers — AGENT_TASKS_QUEUE on the
 # service is what says so. Creating Scheduler jobs for an always-on one would mean every
 # cron fires twice, once from outside and once from the in-process timer.
@@ -170,10 +215,8 @@ if [ "${SYNC_SCHEDULER}" = true ] &&
   "$(dirname "${BASH_SOURCE[0]}")/sync-triggers.sh" ${CONFIG_FILE:+--config "${CONFIG_FILE}"}
 fi
 
-URL=$(gcloud run services describe "${SERVICE}" \
-  --project "${PROJECT}" --region "${REGION}" \
-  --format 'value(status.url)' 2>/dev/null || true)
 if [ -n "${URL}" ]; then
+  echo ""
   echo "🌍 ${SERVICE} → ${URL}"
   echo "   Liveness: curl -fsS ${URL}/health"
   echo "   Ask it:   ${URL}/ask   (any username, AGENT_API_SECRET as the password)"

package/scripts/verify-credentials.mjs

@@ -8,7 +8,8 @@
 // Never prints a credential value. Exits 1 if anything configured actually fails.
 
 import { execFile } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const env = process.env;
@@ -674,8 +675,8 @@ results.sort((a, b) => a.name.localeCompare(b.name));
 // because this script ships to EVERY deployment and knows every integration the engine
 // supports — which is always more than any one deployment uses. Listing them individually
 // asks the operator "why is Kleer in my report?", and the honest answer is that it is not
-// theirs and never was. The deployment's own register of what it can reach is
-// ENVIRONMENT.md in its content repo; the catalogue of what it could add is `connect`.
+// theirs and never was. The deployment's own register of what it can reach is `systems/`
+// in its content repo; the catalogue of what it could add is `connect`.
 // Credentials this script has never heard of.
 //
 // A deployment adds its own systems, and their keys are just secrets bound to the service:
@@ -685,8 +686,8 @@ results.sort((a, b) => a.name.localeCompare(b.name));
 // "everything works" while a set-but-never-exercised key sits beside it.
 //
 // So: name them, say plainly that nothing here can test them, and let the run that called
-// this reconcile them against ENVIRONMENT.md — the deployment's own register does know
-// what they are and which skill reaches them.
+// this reconcile them against `systems/` — the deployment's own register does know what
+// they are and which skill reaches them.
 //
 // Known-ness is decided from this file's own source, so the list maintains itself: if the
 // script mentions the variable, or the family it belongs to, it knows about it.
@@ -736,9 +737,38 @@ console.log(`\n${configured.length - failures.length} working, ${failures.length
 if (unknownCredentials.length) {
   // Names only. This script never prints a value, and that holds hardest for the ones it
   // does not understand.
+  //
+  // Which of them are a PROBLEM, though, is a question this script can answer without
+  // knowing anything about the systems themselves: the register travels into every run, so
+  // it is right here in the working directory. A credential named in it is deliberate, and
+  // proving it works is Part 2's job; one named nowhere is a key no skill will ever reach
+  // for, however valid it is. Splitting them matters because a real gap listed among
+  // things that are already fine is a gap that gets skimmed past.
+  const registered = new Set();
+  const registerDir = join(process.cwd(), "systems");
+  if (existsSync(registerDir)) {
+    for (const entry of readdirSync(registerDir)) {
+      if (!entry.endsWith(".md")) continue;
+      const text = readFileSync(join(registerDir, entry), "utf8");
+      for (const name of unknownCredentials) {
+        if (text.includes(name)) registered.add(name);
+      }
+    }
+  }
+  const unregistered = unknownCredentials.filter((name) => !registered.has(name));
   console.log(`\nSet, but nothing here knows how to test them (${unknownCredentials.length}):`);
   console.log(`  ${unknownCredentials.join(", ")}`);
-  console.log("  Each should have a row in ENVIRONMENT.md saying which skill reaches it.");
+  if (!existsSync(registerDir)) {
+    // No register to read — say the general thing rather than accuse every one of them.
+    console.log("  Each needs a file in systems/ saying which skill reaches it.");
+  } else {
+    if (registered.size) {
+      console.log(`  In systems/, so a job can reach them: ${[...registered].sort().join(", ")}`);
+    }
+    if (unregistered.length) {
+      console.log(`  Not in systems/, so no skill will find them: ${unregistered.join(", ")}`);
+    }
+  }
 }
 if (unconfigured.length) {
   console.log(`\nNot set up here (${unconfigured.length}): ${unconfigured.map((r) => r.name).join(", ")}.`);