@evident-ai/runner-cdk 3.4.1-dev.1856549 → 3.4.1-dev.31006db

package/README.md

@@ -97,7 +97,7 @@ the construct's own dogfooding consumer.
 | `cluster`, `securityGroup`, `taskRole`, `logGroup`, `replicaBucket` | interfaces | Shared infra you create and pass in. |
 | `image` | `ecs.ContainerImage` | Your runner image. |
 | `agentSecret`, `wakerSecret` | `secretsmanager.ISecret` | Any Secrets Manager secret. |
-| `availableSecretKeys` | `Set<string>` | Keys present in the agent secret. Requires `EVIDENT_AGENT_KEY` + `GH_TOKEN`; MCP credentials (`BRAVE_API_KEY`, `CLOUDFLARE_API_TOKEN`, `NEON_API_KEY`) are injected only when listed. |
+| `availableSecretKeys` | `Set<string>` | Keys present in the agent secret. Every listed key is injected; `EVIDENT_AGENT_KEY` and `GH_TOKEN` are also injected for compatibility with adopters that do not enumerate their secret. |
 
 ### Two deliberate "no default" choices
 
@@ -162,7 +162,7 @@ and the agent installs on first use.
 
 | MicroVM prop | Omitted behavior |
 | --- | --- |
-| `runnerSecret` | No GitHub or MCP credentials are exported at `/run`. |
+| `runnerSecret` | No GitHub or MCP credentials are exported at `/run`. When supplied, `/run` reads the JSON secret and exports every non-empty value whose key is a valid environment-variable name. |
 | `runnerOpencodeConfigPath` | OpenCode uses the baked project configuration. Relative paths resolve from the workspace; absolute paths resolve in the image. |
 | `gitUserName` / `gitUserEmail` | The hook uses the Evident bot defaults for git identity. |
 

package/dist/controller-lambda/handler.js

@@ -42866,7 +42866,7 @@ Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.ht
 // ../../node_modules/.pnpm/@aws-sdk+signature-v4-multi-region@3.996.42/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js
 var require_dist_cjs23 = __commonJS({
   "../../node_modules/.pnpm/@aws-sdk+signature-v4-multi-region@3.996.42/node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js"(exports2) {
-    var { SignatureV4: SignatureV43, signatureV4aContainer } = require_dist_cjs17();
+    var { SignatureV4: SignatureV43, signatureV4aContainer } = require_dist_cjs2();
     var signatureV4CrtContainer = {
       CrtSignerV4: null
     };

package/dist/evident-scale-to-zero-construct.d.ts

@@ -61,13 +61,25 @@ export type EvidentScaleToZeroConstructProps = {
     replicaBucket: s3.IBucket;
     image: ecs.ContainerImage;
     /**
-     * Container secrets. Requires EVIDENT_AGENT_KEY + GH_TOKEN; the MCP
-     * credentials BRAVE_API_KEY / CLOUDFLARE_API_TOKEN / NEON_API_KEY are injected
-     * only if present (see availableSecretKeys).
+     * Container secrets. `availableSecretKeys` are injected by name; EVIDENT_AGENT_KEY
+     * and GH_TOKEN remain available to external adopters that do not enumerate keys.
+     *
+     * `agentSecret` always supplies EVIDENT_AGENT_KEY. When `capabilitySecret` is
+     * ALSO given (#1868 WI-2), every capability key (GH_TOKEN included) is injected
+     * from THAT secret instead, and `availableSecretKeys` is ignored — the two
+     * deploy targets (this one and the MicroVM stack) then read the same
+     * capability keys from the same shared secret rather than each carrying its
+     * own copy. When `capabilitySecret` is absent, behavior is unchanged: GH_TOKEN
+     * plus every `availableSecretKeys` entry, all from `agentSecret` — an external
+     * adopter passing only `agentSecret`/`availableSecretKeys` is unaffected.
      */
     agentSecret: secretsmanager.ISecret;
-    /** Key names present in the agent secret; gates the optional MCP creds. */
+    /** Key names present in the agent secret. Every listed key is injected into the container. */
     availableSecretKeys: Set<string>;
+    /** The shared capability secret (#1868 WI-2). See `agentSecret`'s doc above. */
+    capabilitySecret?: secretsmanager.ISecret;
+    /** Key names present in `capabilitySecret`. Ignored when `capabilitySecret` is absent. */
+    capabilityKeys?: Set<string>;
     /** Waker secret (EVIDENT_WAKE_SECRET), consumed by the waker at runtime. */
     wakerSecret: secretsmanager.ISecret;
 };

package/dist/evident-scale-to-zero-construct.js

@@ -61,7 +61,7 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
     service;
     constructor(scope, id, props) {
         super(scope, id);
-        const { agentName, evidentAgentId, gitRepo, gitBranch, idleTimeoutSeconds, cpu, memoryLimitMiB, resourcePrefix = DEFAULT_RESOURCE_PREFIX, envName, evidentApiUrl, evidentTunnelUrl, extraEnvironment, cluster, securityGroup, taskRole, logGroup, replicaBucket, image, agentSecret, availableSecretKeys, wakerSecret, } = props;
+        const { agentName, evidentAgentId, gitRepo, gitBranch, idleTimeoutSeconds, cpu, memoryLimitMiB, resourcePrefix = DEFAULT_RESOURCE_PREFIX, envName, evidentApiUrl, evidentTunnelUrl, extraEnvironment, cluster, securityGroup, taskRole, logGroup, replicaBucket, image, agentSecret, availableSecretKeys, capabilitySecret, capabilityKeys, wakerSecret, } = props;
         this.replicaPrefix = `agents/${evidentAgentId}`;
         // A plain STRING (not service.serviceName) so the container env is static and
         // has no construct-ordering dependency on the service.
@@ -127,16 +127,22 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
             ...extraEnvironment,
         };
         const secrets = {
+            // Identifies the runner to Evident. Always agentSecret — capabilitySecret
+            // never carries this key (#1868 WI-2: the two are a deliberate split, not
+            // a duplication of the same data).
             EVIDENT_AGENT_KEY: ecs.Secret.fromSecretsManager(agentSecret, 'EVIDENT_AGENT_KEY'),
-            GH_TOKEN: ecs.Secret.fromSecretsManager(agentSecret, 'GH_TOKEN'),
         };
-        // Optional MCP creds (consumed by opencode.runner.jsonc): BRAVE_API_KEY →
-        // brave-search, CLOUDFLARE_API_TOKEN → the Cloudflare MCP, NEON_API_KEY →
-        // the Neon MCP (read-only). Injected only if present in the SOPS file — a
-        // referenced-but-absent key fails ECS task startup, so an operator can
-        // enable an MCP by just adding its key + redeploy.
-        for (const key of ['BRAVE_API_KEY', 'CLOUDFLARE_API_TOKEN', 'NEON_API_KEY']) {
-            if (availableSecretKeys.has(key)) {
+        if (capabilitySecret !== undefined) {
+            for (const key of capabilityKeys ?? new Set()) {
+                secrets[key] = ecs.Secret.fromSecretsManager(capabilitySecret, key);
+            }
+        }
+        else {
+            // Legacy shape, unchanged: GH_TOKEN (required to clone this construct's
+            // workspace at boot) plus every availableSecretKeys entry, all from
+            // agentSecret — what every external adopter still gets.
+            secrets.GH_TOKEN = ecs.Secret.fromSecretsManager(agentSecret, 'GH_TOKEN');
+            for (const key of availableSecretKeys) {
                 secrets[key] = ecs.Secret.fromSecretsManager(agentSecret, key);
             }
         }

package/dist/microvm/construct.js

@@ -124,7 +124,11 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
             ...(props.runnerOpencodeConfigPath
                 ? { RUNNER_OPENCODE_CONFIG: props.runnerOpencodeConfigPath }
                 : {}),
-            ...(props.runnerSecret ? { RUNNER_SECRET_ARN: props.runnerSecret.secretArn } : {}),
+            ...(props.runnerSecret
+                ? {
+                    RUNNER_SECRET_ARN: props.runnerSecret.secretArn,
+                }
+                : {}),
             ...(props.gitUserName ? { GIT_USER_NAME: props.gitUserName } : {}),
             ...(props.gitUserEmail ? { GIT_USER_EMAIL: props.gitUserEmail } : {}),
         };

package/dist/microvm/controller/shape-catalogue.d.ts

@@ -1,6 +1,6 @@
 /**
  * Parses the `MICROVM_SHAPES` environment variable (a JSON array, written by
- * CloudFormation from `infrastructure/evident-microvm/src/shapes.ts` at
+ * CloudFormation from `aws/runner-cdk/src/microvm/shapes.ts` at
  * deploy time — see D6/D7 in the plan) into a `ShapeCatalogue` the pure
  * decision core can query, without that core ever touching `process.env`
  * itself.

package/dist/microvm/controller/shape-catalogue.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Parses the `MICROVM_SHAPES` environment variable (a JSON array, written by
- * CloudFormation from `infrastructure/evident-microvm/src/shapes.ts` at
+ * CloudFormation from `aws/runner-cdk/src/microvm/shapes.ts` at
  * deploy time — see D6/D7 in the plan) into a `ShapeCatalogue` the pure
  * decision core can query, without that core ever touching `process.env`
  * itself.