@evident-ai/runner-cdk 3.4.1-dev.cb56b3f → 3.4.1-dev.d4a79de

package/dist/microvm-image-context/Dockerfile

@@ -95,13 +95,23 @@ ARG OPENCODE_VERSION=1.18.3
 ARG EVIDENT_CLI_VERSION=dev
 ARG CLAUDE_CODE_VERSION=latest
 ARG RUNNER_SYNCHRONISER_VERSION=dev
+#
+# @brave/brave-search-mcp-server is pinned (not a build arg — a single caller,
+# opencode.evident.jsonc, needs one version) and baked here for the same reason
+# as the ECS runner image: a cold `npx -y` install of it took ~38s in a fresh
+# MicroVM, over OpenCode's ~30s MCP connect timeout, so the server silently
+# failed to connect on every first turn after a boot. Baking it lets
+# opencode.evident.jsonc invoke the installed `brave-search-mcp-server` binary
+# directly instead of through `npx`.
 RUN npm install -g \
     "opencode-ai@${OPENCODE_VERSION}" \
     "@evident-ai/cli@${EVIDENT_CLI_VERSION}" \
     "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
     "@evident-ai/runner-synchroniser@${RUNNER_SYNCHRONISER_VERSION}" \
+    "@brave/brave-search-mcp-server@2.1.0" \
   && opencode --version \
   && evident --version \
+  && brave-search-mcp-server --help >/dev/null \
   && npm cache clean --force
 
 # Playwright chromium + OS deps for E2E, baked at build time to avoid a slow

package/dist/microvm-image-context/hooks/common.sh

@@ -21,6 +21,12 @@ OPENCODE_PORT="${OPENCODE_PORT:-4096}"
 # /proc/<pid>/environ, which runs as that same uid. /terminate removes it.
 # shellcheck disable=SC2034  # read by the scripts that source this file
 CONTEXT_FILE="/dev/shm/evident-run-context"
+
+# The runtime injects MICROVM_ID only into /run, never /resume. This tmpfs file
+# survives suspend/resume so /resume can restore the id for every fresh CLI
+# process to self-report and acknowledge a fulfilled recycle request (#1906).
+# shellcheck disable=SC2034  # read by the scripts that source this file
+MICROVM_ID_FILE="/dev/shm/evident-microvm-id"
 TUNNEL_PID_FILE="/dev/shm/evident-tunnel.pid"
 OPENCODE_PID_FILE="/dev/shm/evident-opencode.pid"
 LITESTREAM_PID_FILE="/dev/shm/evident-litestream.pid"

package/dist/microvm-image-context/hooks/resume

@@ -39,6 +39,13 @@ fi
   read -r runner_key
 } <"${CONTEXT_FILE}"
 
+# Restore the id so the resumed CLI can self-report and acknowledge any
+# outstanding recycle request (#1906). Older images may not have this file.
+if [ -s "${MICROVM_ID_FILE}" ]; then
+  MICROVM_ID="$(cat "${MICROVM_ID_FILE}")"
+  export MICROVM_ID
+fi
+
 # Tolerant, never fatal: a resume that fails costs the user their whole
 # session, so a broken durable-state config degrades to "no session-DB
 # replication" rather than a failed resume. The CLI's own guards handle the

package/dist/microvm-image-context/hooks/run

@@ -77,7 +77,14 @@ check_runner_key "${runner_key}" "${api_url}" || exit 1
 # is written. Bare: every guard inside start_credential_sync is its own `return 0`.
 start_credential_sync
 
-# 7 — the first per-VM identity on the wire. The subshell's umask makes the file
+# 7 — preserve the VM id across suspend/resume. The runtime always supplies it
+# for a /run hook, and the subshell keeps the persisted value protected.
+(
+  umask 077
+  printf '%s\n' "${MICROVM_ID}" >"${MICROVM_ID_FILE}"
+)
+
+# 8 — the first per-VM identity on the wire. The subshell's umask makes the file
 # unreadable to anyone else from the moment it exists, before the key is in it.
 (
   umask 077

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.4.1-dev.cb56b3f",
+  "version": "3.4.1-dev.d4a79de",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",