@evident-ai/runner-cdk 3.5.2-dev.da3340e → 3.5.2-dev.e22029a

package/README.md

@@ -116,6 +116,17 @@ built from a `Dockerfile` you control. The generic runner image lives separately
 
 ## The MicroVM image
 
+### Prune image versions
+
+MicroVM image versions are quota-bound. `@evident-ai/lambda-microvm-cdk` ships the
+`prune-microvm-image-versions` CLI; enable it with one `package.json` script line:
+
+```json
+"microvm:prune": "prune-microvm-image-versions --image-arn arn:aws:lambda:eu-west-1:000000000000:microvm-image:your-image"
+```
+
+See the `@evident-ai/lambda-microvm-cdk` package README for the CLI flags and safety semantics.
+
 `EvidentMicrovmConstruct`'s `imageSource` is a **local directory** holding the image build
 context, which `cdk deploy` zips and uploads. The Lambda MicroVM service then builds the
 image in *your* account, from a base image ARN you discover there — so, unlike the Fargate

package/dist/controller-lambda/handler.js

@@ -49799,9 +49799,9 @@ var MICROVM_MAX_RUN_SECONDS = 28800;
 // src/microvm/controller/handle-doorbell.ts
 var import_node_crypto12 = require("node:crypto");
 
-// ../webhook-signature/src/verify-wake-signature.ts
+// ../../sdk/src/signature.ts
 var import_node_crypto11 = require("node:crypto");
-function verifyWakeSignature(rawBody, signatureHeader, secret) {
+function verifyEvidentSignature(rawBody, signatureHeader, secret) {
   if (!signatureHeader || !secret) {
     return false;
   }
@@ -50042,7 +50042,7 @@ async function handleDoorbell({
   sleep: sleep4,
   random
 }) {
-  if (!verifyWakeSignature(rawBody, signatureHeader, doorbellSecret)) {
+  if (!verifyEvidentSignature(rawBody, signatureHeader, doorbellSecret)) {
     return decide({
       statusCode: 401,
       action: "rejected",
@@ -50470,7 +50470,7 @@ function createRuntimeMicrovm(executionRoleArn) {
           // runner is outbound-only (it dials the Cloudflare relay), so AWS sees
           // an idle endpoint no matter how busy the agent is. Idle is instead
           // decided IN the VM by `evident run --idle-timeout`
-          // (packages/runner-cdk/microvm-image/hooks/common.sh's `IDLE_TIMEOUT_SECONDS`), whose
+          // (runner/docker-images/microvm/hooks/common.sh's `IDLE_TIMEOUT_SECONDS`), whose
           // clean exit is what drives the controller's own `suspend()` below via
           // the `runner.suspend_requested` doorbell. See `idle-policy.test.ts`
           // in this directory, which scans this file's source for the key and

package/dist/evident-scale-to-zero-construct.js

@@ -157,6 +157,13 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
         // Object Get/Put/Delete scoped to this agent's prefix. DeleteObject is
         // required: Litestream's retention/compaction prunes old LTX files.
         replicaBucket.grantReadWrite(taskRole, `${this.replicaPrefix}/*`);
+        // Vault credentials are read and conditionally written, so this shared prefix
+        // needs no delete or list permission; conditional writes use request headers.
+        taskRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            sid: 'ReadWriteCredentialVaultObjects',
+            actions: ['s3:GetObject', 's3:PutObject'],
+            resources: [replicaBucket.arnForObjects('credential-vaults/*')],
+        }));
         this.service = new ecs.FargateService(this, 'Service', {
             cluster,
             taskDefinition,

package/dist/microvm/construct.js

@@ -37,6 +37,7 @@ exports.EvidentMicrovmConstruct = void 0;
 const path = __importStar(require("path"));
 const cdk = __importStar(require("aws-cdk-lib"));
 const constructs_1 = require("constructs");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
 const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
@@ -189,13 +190,14 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 hooks: imageHooks,
             }));
         }
-        // Bucket-wide rather than per-prefix (as the ECS runner's task role is):
-        // the prefix arrives at /run, so it cannot be named at synth, and one
-        // execution role is shared by every VM of every shape (D3). So a VM can
-        // read another session's credential store — acceptable within a single
-        // customer account, and what Phase 4 (#263) has to tighten when this goes
-        // multi-tenant.
-        durableState.grantReadWrite(defaultImage.executionRole);
+        // The execution role serves every image shape, so per-session state is scoped
+        // to the `runners/` root; vault credentials need only GetObject and PutObject.
+        durableState.grantReadWrite(defaultImage.executionRole, 'runners/*');
+        defaultImage.executionRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            sid: 'ReadWriteCredentialVaultObjects',
+            actions: ['s3:GetObject', 's3:PutObject'],
+            resources: [durableState.arnForObjects('credential-vaults/*')],
+        }));
         // The image receives only an ARN; `/run` reads the secret value at runtime.
         props.runnerSecret?.grantRead(defaultImage.executionRole);
         // The shape catalogue the controller resolves a doorbell's `shape` field

package/dist/microvm-image-context/hooks/common.sh

@@ -445,6 +445,26 @@ stop_litestream() {
   log "litestream stopped ${outcome}"
 }
 
+SESSION_DB_LITESTREAM_QUIESCED=0
+
+quiesce_litestream_for_session_db() {
+  if [ "${SESSION_DB_LITESTREAM_QUIESCED}" -eq 1 ]; then
+    return 0
+  fi
+
+  if [ -z "${PERSISTENCE_BUCKET:-}" ] || [ -e "${SESSION_DB_NO_REPLICATE_MARKER}" ] || [ ! -s "${LITESTREAM_CONFIG_FILE}" ]; then
+    return 0
+  fi
+
+  if litestream_is_running; then
+    stop_litestream
+  else
+    warn "SESSION-DB-REPLICATOR-DIED: no live litestream at ${LITESTREAM_PID_FILE}; flushing one-shot anyway"
+  fi
+
+  SESSION_DB_LITESTREAM_QUIESCED=1
+}
+
 # The cheap stop: one SIGTERM, one rm, one log line, NO poll loop — `/run`'s
 # own cleanup calls this, never stop_litestream, because that path only runs
 # after /run has already FAILED: no session happened yet, so a graceful final
@@ -519,11 +539,7 @@ flush_session_db() {
     return 0
   fi
 
-  if litestream_is_running; then
-    stop_litestream
-  else
-    warn "SESSION-DB-REPLICATOR-DIED: no live litestream at ${LITESTREAM_PID_FILE}; flushing one-shot anyway"
-  fi
+  quiesce_litestream_for_session_db
 
   # Only reached with the daemon confirmed stopped, or never running — never
   # concurrently with it (see above).
@@ -539,6 +555,44 @@ flush_session_db() {
 }
 # --- flush_session_db (end) --------------------------------------------------
 
+SESSION_DB_MAINTENANCE_DEADLINE_SECONDS=4
+SESSION_DB_MAINTENANCE_KILL_GRACE_SECONDS=1
+SESSION_DB_MAINTENANCE_MAX_BYTES=268435456
+
+maintain_session_db() {
+  if [ -z "${PERSISTENCE_BUCKET:-}" ]; then
+    warn "SESSION-DB-MAINTENANCE-SKIP: persistence is disabled"
+    return 0
+  fi
+
+  if [ -e "${SESSION_DB_NO_REPLICATE_MARKER}" ]; then
+    warn "SESSION-DB-MAINTENANCE-SKIP: this boot's session DB was not proven safe to replicate"
+    return 0
+  fi
+
+  if [ ! -s "${LITESTREAM_CONFIG_FILE}" ]; then
+    error "SESSION-DB-MAINTENANCE-SKIP: no usable ${LITESTREAM_CONFIG_FILE}"
+    return 0
+  fi
+
+  if litestream_is_running; then
+    warn "SESSION-DB-MAINTENANCE-SKIP: litestream is still running"
+    return 0
+  fi
+
+  local maintenance_rc=0
+  timeout -k "${SESSION_DB_MAINTENANCE_KILL_GRACE_SECONDS}" "${SESSION_DB_MAINTENANCE_DEADLINE_SECONDS}" \
+    node "$(dirname "${BASH_SOURCE[0]}")/session-db-maintenance.mjs" \
+    "${HOME:-/home/runner}/.local/share/opencode/opencode.db" \
+    "${SESSION_DB_MAINTENANCE_MAX_BYTES}" || maintenance_rc=$?
+
+  if [ "${maintenance_rc}" -ne 0 ]; then
+    warn "SESSION-DB-MAINTENANCE: helper exited ${maintenance_rc}; continuing teardown"
+  fi
+
+  return 0
+}
+
 # How long the guest CLI runs with no activity before it exits itself
 # (`evident run --idle-timeout`), which is what
 # turns a truly-abandoned VM into the clean-offline POST that lets Evident

package/dist/microvm-image-context/hooks/session-db-maintenance.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+import { statSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { performance } from 'node:perf_hooks';
+
+const [dbPath, maxBytesText] = process.argv.slice(2);
+const maxBytes = Number(maxBytesText);
+const startedAt = performance.now();
+
+function fileBytes(path) {
+  try {
+    return statSync(path).size;
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return 0;
+    throw error;
+  }
+}
+
+function walFrames(path, pageSize) {
+  const bytes = fileBytes(path);
+  return bytes < 32 ? 0 : Math.floor((bytes - 32) / (pageSize + 24));
+}
+
+function elapsedMs() {
+  return (performance.now() - startedAt).toFixed(3);
+}
+
+let database;
+
+try {
+  if (!dbPath || !Number.isInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error('expected a database path and a positive byte limit');
+  }
+
+  const dbBytes = statSync(dbPath).size;
+  database = new DatabaseSync(dbPath);
+  const pageSize = Number(database.prepare('PRAGMA page_size').get().page_size);
+  const walPath = `${dbPath}-wal`;
+  const walBytes = fileBytes(walPath);
+  const totalBytes = dbBytes + walBytes;
+  const walFramesBefore = walFrames(walPath, pageSize);
+
+  if (totalBytes > maxBytes) {
+    console.log(
+      `SESSION-DB-MAINTENANCE-SKIP: reason=size-gate db_bytes=${dbBytes} ` +
+        `wal_bytes=${walBytes} total_bytes=${totalBytes} max_bytes=${maxBytes} ` +
+        `wal_frames_before=${walFramesBefore} wal_frames_after=${walFramesBefore} ` +
+        `elapsed_ms=${elapsedMs()}`,
+    );
+  } else {
+    const checkpoint = database.prepare('PRAGMA wal_checkpoint(TRUNCATE)').get();
+    const walFramesAfter = walFrames(walPath, pageSize);
+    console.log(
+      `SESSION-DB-MAINTENANCE: operation=wal_checkpoint_truncate ` +
+        `db_bytes=${dbBytes} wal_bytes=${walBytes} wal_frames_before=${walFramesBefore} ` +
+        `wal_frames_after=${walFramesAfter} busy=${checkpoint.busy} log=${checkpoint.log} ` +
+        `checkpointed=${checkpoint.checkpointed} elapsed_ms=${elapsedMs()}`,
+    );
+  }
+} catch (error) {
+  console.error(
+    `SESSION-DB-MAINTENANCE-ERROR: ${error instanceof Error ? error.message : String(error)} ` +
+      `elapsed_ms=${elapsedMs()}`,
+  );
+  process.exitCode = 1;
+} finally {
+  if (database) database.close();
+}

package/dist/microvm-image-context/hooks/terminate

@@ -20,6 +20,8 @@ stop_runner_and_flush_credentials
 # stop_opencode — /terminate can afford the real drain, the VM is being torn
 # down either way.
 stop_opencode_and_wait
+quiesce_litestream_for_session_db
+maintain_session_db
 flush_session_db
 
 # The key must not outlive the VM's last useful moment. The no-replicate

package/dist/waker-lambda/handler.js

@@ -27,9 +27,9 @@ module.exports = __toCommonJS(handler_exports);
 var import_client_ecs = require("@aws-sdk/client-ecs");
 var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 
-// ../webhook-signature/src/verify-wake-signature.ts
+// ../../sdk/src/signature.ts
 var import_node_crypto = require("node:crypto");
-function verifyWakeSignature(rawBody, signatureHeader, secret) {
+function verifyEvidentSignature(rawBody, signatureHeader, secret) {
   if (!signatureHeader || !secret) {
     return false;
   }
@@ -64,7 +64,7 @@ async function handleWake({
   service,
   ecs
 }) {
-  if (!verifyWakeSignature(rawBody, signatureHeader, wakeSecret)) {
+  if (!verifyEvidentSignature(rawBody, signatureHeader, wakeSecret)) {
     const { statusCode: statusCode2, body: body2 } = jsonResponse(401, "invalid signature");
     return { statusCode: statusCode2, body: body2, calledUpdateService: false };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.2-dev.da3340e",
+  "version": "3.5.2-dev.e22029a",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",