@evident-ai/runner-cdk 3.5.1-dev.bbaa769 → 3.5.1

package/README.md

@@ -9,7 +9,7 @@ Reusable AWS CDK constructs for running an [Evident](https://evident.run) agent
   `desiredCount 0`, and an HMAC-authenticated waker Lambda scales it back up on the next
   message. You pay for the time the agent is actually working.
 - **`EvidentMicrovmConstruct`** — a per-session AWS Lambda MicroVM that boots on demand
-  and suspends between messages. Installing the `@dev` tag of this package is all you
+  and suspends between messages. Installing this package is all you
   need: the image build context ships inside it (see [The MicroVM image](#the-microvm-image)
   below), so there is no checkout of the source repository involved. See
   [the AWS runner doc](https://evident.run/docs/aws-runner) for the full picture of both
@@ -76,8 +76,8 @@ agent.selfStopRoleArn;
 agent.replicaPrefix;
 ```
 
-For a complete working example, see [`GETTING-STARTED.md`](./GETTING-STARTED.md) in this
-package — it is the construct's own dogfooding consumer.
+For a complete working example, see `GETTING-STARTED.md` (not published to npm); it is the
+construct's own dogfooding consumer.
 
 ## Props
 
@@ -97,7 +97,7 @@ package — it is the construct's own dogfooding consumer.
 | `cluster`, `securityGroup`, `taskRole`, `logGroup`, `replicaBucket` | interfaces | Shared infra you create and pass in. |
 | `image` | `ecs.ContainerImage` | Your runner image. |
 | `agentSecret`, `wakerSecret` | `secretsmanager.ISecret` | Any Secrets Manager secret. |
-| `availableSecretKeys` | `Set<string>` | Keys present in the agent secret. Every listed key is injected; `EVIDENT_AGENT_KEY` and `GH_TOKEN` are also injected for compatibility with adopters that do not enumerate their secret. |
+| `availableSecretKeys` | `Set<string>` | Keys present in the agent secret. Every listed key is injected; `EVIDENT_RUNNER_KEY` and `EVIDENT_AGENT_KEY` are injected from the `EVIDENT_AGENT_KEY` field, and `GH_TOKEN` is also injected for adopters that do not enumerate their secret. |
 
 ### Two deliberate "no default" choices
 
@@ -183,9 +183,9 @@ all of them, so never put a secret in this prop.
 
 ## Status / limitations
 
-- **Published to npm** as `@evident-ai/runner-cdk` (MIT). Install the `@dev` tag —
-  `npm install @evident-ai/runner-cdk@dev` (or `pnpm add`/`yarn add`); no checkout of
-  this repo is required. It builds to a self-contained `dist/` (`pnpm --filter
+- **Published to npm** as `@evident-ai/runner-cdk` (MIT). `npm install
+  @evident-ai/runner-cdk` (or `pnpm add`/`yarn add`); no checkout of this repo is
+  required. It builds to a self-contained `dist/` (`pnpm --filter
   @evident-ai/runner-cdk build`) with no `workspace:`/`@evident/*` runtime dependency.
   Evident's own consumer still consumes it as a `workspace:*` dependency for dogfooding.
 - **AWS/ECS-specific.** Non-AWS clouds are an open question on the epic, not a supported

package/dist/evident-scale-to-zero-construct.d.ts

@@ -61,10 +61,12 @@ export type EvidentScaleToZeroConstructProps = {
     replicaBucket: s3.IBucket;
     image: ecs.ContainerImage;
     /**
-     * Container secrets. `availableSecretKeys` are injected by name; EVIDENT_AGENT_KEY
-     * and GH_TOKEN remain available to external adopters that do not enumerate keys.
+     * Container secrets. `availableSecretKeys` are injected by name; both identity
+     * environment names and GH_TOKEN remain available to external adopters that do not
+     * enumerate keys.
      *
-     * `agentSecret` always supplies EVIDENT_AGENT_KEY. When `capabilitySecret` is
+     * `agentSecret` always supplies EVIDENT_RUNNER_KEY and EVIDENT_AGENT_KEY from its
+     * `EVIDENT_AGENT_KEY` field. When `capabilitySecret` is
      * ALSO given (#1868 WI-2), every capability key (GH_TOKEN included) is injected
      * from THAT secret instead, and `availableSecretKeys` is ignored — the two
      * deploy targets (this one and the MicroVM stack) then read the same

package/dist/evident-scale-to-zero-construct.js

@@ -98,7 +98,8 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
             OPENCODE_PORT: '4096',
             HOME: '/home/runner',
             // Selects the Evident environment (passed to `evident run` as
-            // --endpoint / --tunnel). The agent is resolved from EVIDENT_AGENT_KEY.
+            // --endpoint / --tunnel). The runner is resolved from EVIDENT_RUNNER_KEY,
+            // falling back to EVIDENT_AGENT_KEY.
             EVIDENT_API_URL: evidentApiUrl,
             EVIDENT_TUNNEL_URL: evidentTunnelUrl,
             // Litestream replica target (read by runner/synchroniser, which
@@ -126,12 +127,7 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
             // LAST so an adopter can override any key above if they ever need to.
             ...extraEnvironment,
         };
-        const secrets = {
-            // Identifies the runner to Evident. Always agentSecret — capabilitySecret
-            // never carries this key (#1868 WI-2: the two are a deliberate split, not
-            // a duplication of the same data).
-            EVIDENT_AGENT_KEY: ecs.Secret.fromSecretsManager(agentSecret, 'EVIDENT_AGENT_KEY'),
-        };
+        const secrets = {};
         if (capabilitySecret !== undefined) {
             for (const key of capabilityKeys ?? new Set()) {
                 secrets[key] = ecs.Secret.fromSecretsManager(capabilitySecret, key);
@@ -146,6 +142,10 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
                 secrets[key] = ecs.Secret.fromSecretsManager(agentSecret, key);
             }
         }
+        // Both environment names identify the runner and resolve from the identity
+        // field in agentSecret, never from capabilitySecret.
+        secrets.EVIDENT_AGENT_KEY = ecs.Secret.fromSecretsManager(agentSecret, 'EVIDENT_AGENT_KEY');
+        secrets.EVIDENT_RUNNER_KEY = ecs.Secret.fromSecretsManager(agentSecret, 'EVIDENT_AGENT_KEY');
         // Container name pinned to "Runner": operator `execute-command --container
         // Runner` examples rely on it.
         taskDefinition.addContainer('Runner', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.1-dev.bbaa769",
+  "version": "3.5.1",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",