@evident-ai/runner-cdk 3.4.1-dev.fb92ede → 3.5.1-dev.8bb8794

package/README.md

@@ -9,7 +9,7 @@ Reusable AWS CDK constructs for running an [Evident](https://evident.run) agent
   `desiredCount 0`, and an HMAC-authenticated waker Lambda scales it back up on the next
   message. You pay for the time the agent is actually working.
 - **`EvidentMicrovmConstruct`** — a per-session AWS Lambda MicroVM that boots on demand
-  and suspends between messages. Installing the `@dev` tag of this package is all you
+  and suspends between messages. Installing this package is all you
   need: the image build context ships inside it (see [The MicroVM image](#the-microvm-image)
   below), so there is no checkout of the source repository involved. See
   [the AWS runner doc](https://evident.run/docs/aws-runner) for the full picture of both
@@ -76,8 +76,8 @@ agent.selfStopRoleArn;
 agent.replicaPrefix;
 ```
 
-For a complete working example, see [`GETTING-STARTED.md`](./GETTING-STARTED.md) in this
-package — it is the construct's own dogfooding consumer.
+For a complete working example, see `GETTING-STARTED.md` (not published to npm); it is the
+construct's own dogfooding consumer.
 
 ## Props
 
@@ -161,12 +161,12 @@ new EvidentMicrovmConstruct(this, 'Runner', {
 
 Pass `overlayDir` to add deployment-specific build steps to the staged image. The
 directory provides `setup-root` for root-owned installs and `setup-workspace` for
-workspace build warm-up after dependency installation. See the [MicroVM image
+dependency installation and workspace build warm-up. See the [MicroVM image
 README](../../runner/docker-images/microvm/README.md) for the full overlay contract.
 
-Your repo does not have to be a pnpm workspace. If it commits a `pnpm-lock.yaml` the image
-pre-installs dependencies at build time (a faster first boot); if not, that step is skipped
-and the agent installs on first use.
+The image bakes your repository checked out but not installed and makes no assumptions about
+its package manager. To speed up first boot, install dependencies from your overlay's
+`setup-workspace`; otherwise, the agent installs them on first use.
 
 | MicroVM prop | Omitted behavior |
 | --- | --- |
@@ -183,9 +183,9 @@ all of them, so never put a secret in this prop.
 
 ## Status / limitations
 
-- **Published to npm** as `@evident-ai/runner-cdk` (MIT). Install the `@dev` tag —
-  `npm install @evident-ai/runner-cdk@dev` (or `pnpm add`/`yarn add`); no checkout of
-  this repo is required. It builds to a self-contained `dist/` (`pnpm --filter
+- **Published to npm** as `@evident-ai/runner-cdk` (MIT). `npm install
+  @evident-ai/runner-cdk` (or `pnpm add`/`yarn add`); no checkout of this repo is
+  required. It builds to a self-contained `dist/` (`pnpm --filter
   @evident-ai/runner-cdk build`) with no `workspace:`/`@evident/*` runtime dependency.
   Evident's own consumer still consumes it as a `workspace:*` dependency for dogfooding.
 - **AWS/ECS-specific.** Non-AWS clouds are an open question on the epic, not a supported

package/dist/microvm/image/stage-context.js

@@ -66,8 +66,8 @@ function isShallowRepository(repositoryPath) {
     }
 }
 /**
- * Clones the caller's repository into the build context, so the Dockerfile can
- * ship the workspace already installed.
+ * Clones the caller's repository into the build context for the Dockerfile to
+ * bake as a checked-out but uninstalled workspace.
  *
  * `file://` rather than a plain path: a path triggers git's local-clone
  * optimisation, which copies the whole object store — every branch and worktree
@@ -102,9 +102,6 @@ function stageRepository(repositoryPath, destination, originUrl) {
     (0, node_fs_1.rmSync)(path.join(destination, '.git', 'index'), { force: true });
     (0, node_fs_1.rmSync)(path.join(destination, '.git', 'logs'), { recursive: true, force: true });
     console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], destination)}`);
-    if (!(0, node_fs_1.existsSync)(path.join(destination, 'pnpm-lock.yaml'))) {
-        console.log(`[stage] ${repositoryPath} has no pnpm-lock.yaml — the image build will skip dependency installation`);
-    }
 }
 function stageScriptDirectory(source, destination) {
     (0, node_fs_1.mkdirSync)(destination);

package/dist/microvm-image-context/Dockerfile

@@ -1,9 +1,9 @@
 # Generic MicroVM runner image
 #
 # Built for linux/arm64 (Lambda MicroVMs run on Graviton only) and with ONE
-# process: the hook server. `overlay/setup-root` and
-# `overlay/setup-workspace` are the extension point for deployment-specific
-# packages and build warm-up.
+# process: the hook server. `overlay/setup-root` and `overlay/setup-workspace`
+# are the extension point for deployment-specific packages, dependency
+# installation and build warm-up.
 #
 # THE BOOT SPLIT — the rule that governs everything below. AWS snapshots this
 # image ONCE at build and every MicroVM resumes from that same snapshot, so
@@ -130,8 +130,8 @@ COPY hook-server.js /usr/local/lib/evident/hook-server.js
 COPY hooks /etc/evident/hooks
 
 # Workspace: the repository the agent works on, baked in. A resumed VM must be
-# useful in milliseconds, and a clone + install costs minutes — so both happen
-# here, and the image is deliberately large in exchange.
+# useful in milliseconds, while a clone costs minutes — so the checkout happens
+# here; dependency installation and build warm-up belong to the deployment overlay.
 #
 # This does not weaken the boot split: source, git history and node_modules are
 # neither secret nor per-VM-unique, so sharing them across every VM from this
@@ -171,30 +171,11 @@ USER runner
 # `runner` (not root) so the rebuilt index is runner-owned and writable later.
 RUN git reset --quiet
 
-# Dependencies for the baked workspace. Install as the runner user so
-# node_modules is writable by the agent's own later installs.
+# Deployment-specific dependency installation and build work belongs here. This runs
+# as `runner` in `${WORKSPACE}`, so everything it writes is agent-writable.
 #
-# ONE layer on purpose: pnpm hard-links node_modules into its content-addressed
-# store (which it puts at ${WORKSPACE}/.pnpm-store, gitignored), and hard links
-# only survive within a single layer — split in two and the image carries both
-# copies. `--frozen-lockfile` because the committed lockfile is the whole reason
-# this is bakeable at all: installing against anything else would bake a
-# dependency set nobody committed.
-#
-# Guarded on a committed `pnpm-lock.yaml` so `microvm:repositoryPath` can point
-# at a repository that is not a pnpm workspace at all: it is baked uninstalled
-# instead of failing the build, and the agent installs on first use.
-#
-# Anything beyond dependency installation is deployment-specific and belongs in
-# `overlay/setup-workspace`.
-RUN if [ -f pnpm-lock.yaml ]; then \
-      pnpm install --frozen-lockfile; \
-    else \
-      echo "[workspace-prep] no pnpm-lock.yaml in the baked repository — skipping the dependency install; the agent installs on first use."; \
-    fi
-
-# Runs as `runner` in `${WORKSPACE}`, after the install, so a project's build
-# output is writable by the agent.
+# Keep the overlay's install and build in one layer: pnpm hard-links `node_modules`
+# into its content-addressed store, and hard links only survive within a single layer.
 RUN /etc/evident/overlay/setup-workspace
 
 # Port AWS calls the MicroVM hooks on.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.4.1-dev.fb92ede",
+  "version": "3.5.1-dev.8bb8794",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -14,7 +14,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "pnpm run build-bundled-deps && ts-node scripts/build.ts",
+    "build": "pnpm run build-bundled-deps && ts-node scripts/build.ts && node -e 'const m=require(\"./package.json\").main; if (!require(\"node:fs\").existsSync(m)) { console.error(`build produced no ${m}`); process.exit(1); }'",
     "//build-bundled-deps": "scripts/build.ts esbuild-bundles runner/docker-images/microvm/hook-server.ts, which imports @evident-ai/lambda-microvm-runtime by its built `main`. @evident-ai/lambda-microvm-cdk is a workspace:* devDependency whose types resolve through its own dist/, so tsc --project tsconfig.build.json cannot compile src/microvm/{shapes,construct}.ts without it. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
     "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build",
     "typecheck": "tsc --noEmit",