@meffecta/agent 1.0.9 → 1.0.10

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.9",
-  "builtFrom": "4769315eb49ce1036f888ffafb03881ec4e91131"
+  "engineTag": "1.0.10",
+  "builtFrom": "36d54c192cfa454f2e4485414ac854b3be86c8f7"
 }

package/lib/commands.js

@@ -186,8 +186,35 @@ async function status() {
   );
   const external = Boolean(env.AGENT_TASKS_QUEUE && env.AGENT_PUBLIC_URL);
 
+  // What is RUNNING, asked of the service rather than inferred from the image tag — which
+  // is a moving target: `latest` names a different engine every time main is pushed, so the
+  // tag on the revision says what was requested and not what answers. /health is
+  // unauthenticated, so this needs no credential; a service that cannot be reached simply
+  // does not get the line.
+  let engine = "";
+  if (svc.status?.url) {
+    try {
+      const res = await fetch(`${svc.status.url}/health`, { signal: AbortSignal.timeout(25_000) });
+      const health = await res.json();
+      if (health?.version) {
+        engine = health.build ? `${health.version} (build ${health.build})` : health.version;
+      } else {
+        engine = "up, but too old to report its version";
+      }
+    } catch {
+      // Short timeout on purpose: this is a status command, and asking wakes a
+      // scale-to-zero service, so it waits about as long as a cold start and then says
+      // nothing rather than hanging. Not a verdict on health — `doctor` is where that is
+      // decided.
+      engine = "no answer within 25s (a sleeping service can take longer to wake)";
+    }
+  }
+
   console.log(`▶ ${d.SERVICE}  (${d.PROJECT} / ${d.REGION})`);
   console.log(`   url        ${svc.status?.url ?? "?"}`);
+  if (engine) {
+    console.log(`   engine     ${engine}`);
+  }
   console.log(`   revision   ${svc.status?.latestReadyRevisionName ?? "?"}`);
   console.log(`   image      ${container.image}`);
   console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/deploy.sh

@@ -160,6 +160,51 @@ gcloud run deploy "${SERVICE}" \
   --execution-environment gen2 \
   "${SCALE_FLAGS[@]}"
 
+# What actually landed. `--tag latest` is a request, not an answer: it names whatever GHCR
+# was serving a moment ago, and after this it names whatever it serves next. The digest is
+# the immutable identity — and the one thing that makes a rollback to *this* engine possible
+# in a month, when the tag has moved on.
+read -r URL REVISION < <(gcloud run services describe "${SERVICE}" \
+  --project "${PROJECT}" --region "${REGION}" \
+  --format 'value[separator=" "](status.url, status.latestReadyRevisionName)' 2>/dev/null || echo " ")
+DIGEST=""
+if [ -n "${REVISION}" ]; then
+  DIGEST=$(gcloud run revisions describe "${REVISION}" \
+    --project "${PROJECT}" --region "${REGION}" \
+    --format 'value(status.imageDigest)' 2>/dev/null || true)
+fi
+
+# And which engine is answering. The digest says the image is different; only the service
+# says what it is. This is also the first real request to the new revision, so a rollout
+# that produced an image which cannot boot says so here rather than at the next cron —
+# generously timed, because a scale-to-zero service is cold and this image is a large pull.
+HEALTH=""
+if [ -n "${URL}" ]; then
+  HEALTH=$(curl -fsS --max-time 180 "${URL}/health" 2>/dev/null || true)
+fi
+VERSION=$(printf '%s' "${HEALTH}" | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+BUILD=$(printf '%s' "${HEALTH}" | sed -n 's/.*"build":"\([^"]*\)".*/\1/p')
+
+echo ""
+if [ -n "${VERSION}" ]; then
+  echo "✅ Running engine ${VERSION}${BUILD:+ (build ${BUILD})}"
+elif [ -n "${HEALTH}" ]; then
+  # It answered, but without a version: an engine from before /health reported one.
+  echo "✅ Service is up — this engine predates version reporting, so it cannot say which it is"
+else
+  echo "⚠️  Deployed, but ${SERVICE} did not answer /health within 3 minutes"
+  echo "   Check it before assuming the rollout is good:"
+  if has_cli; then
+    echo "     $(cmd logs)"
+  else
+    echo "     gcloud run services logs read ${SERVICE} --project ${PROJECT} --region ${REGION} --limit 50"
+  fi
+fi
+[ -n "${REVISION}" ] && echo "   revision  ${REVISION}"
+[ -n "${DIGEST}" ] && echo "   image     ${DIGEST##*@}"
+[ -n "${DIGEST}" ] && echo "   roll back to this exact engine later with:"
+[ -n "${DIGEST}" ] && echo "     $(cmd deploy) --image ${DIGEST}"
+
 # Only for a deployment that has opted into external triggers — AGENT_TASKS_QUEUE on the
 # service is what says so. Creating Scheduler jobs for an always-on one would mean every
 # cron fires twice, once from outside and once from the in-process timer.
@@ -170,10 +215,8 @@ if [ "${SYNC_SCHEDULER}" = true ] &&
   "$(dirname "${BASH_SOURCE[0]}")/sync-triggers.sh" ${CONFIG_FILE:+--config "${CONFIG_FILE}"}
 fi
 
-URL=$(gcloud run services describe "${SERVICE}" \
-  --project "${PROJECT}" --region "${REGION}" \
-  --format 'value(status.url)' 2>/dev/null || true)
 if [ -n "${URL}" ]; then
+  echo ""
   echo "🌍 ${SERVICE} → ${URL}"
   echo "   Liveness: curl -fsS ${URL}/health"
   echo "   Ask it:   ${URL}/ask   (any username, AGENT_API_SECRET as the password)"

package/scripts/verify-credentials.mjs

@@ -742,9 +742,8 @@ if (unknownCredentials.length) {
   // knowing anything about the systems themselves: the register travels into every run, so
   // it is right here in the working directory. A credential named in it is deliberate, and
   // proving it works is Part 2's job; one named nowhere is a key no skill will ever reach
-  // for, however valid it is. Printing the whole list as a to-do told the operator to
-  // register things that were already registered, which is how a real gap gets skimmed
-  // past.
+  // for, however valid it is. Splitting them matters because a real gap listed among
+  // things that are already fine is a gap that gets skimmed past.
   const registered = new Set();
   const registerDir = join(process.cwd(), "systems");
   if (existsSync(registerDir)) {