@evident-ai/runner-cdk 3.6.1-dev.8d3e144 → 3.6.1-dev.d5a3d9d

package/dist/controller-lambda/handler.js

@@ -49795,6 +49795,7 @@ var RUN_HOOK_PAYLOAD_MAX_BYTES = 16384;
 var SUSPENDING_POLL_ATTEMPTS = 4;
 var SUSPENDING_POLL_INTERVAL_MS = 500;
 var MICROVM_MAX_RUN_SECONDS = 28800;
+var MICROVM_EXPIRY_REFRESH_WINDOW_MS = 2 * 60 * 6e4;
 
 // src/microvm/controller/handle-doorbell.ts
 var import_node_crypto12 = require("node:crypto");
@@ -49924,6 +49925,7 @@ var REASON = {
   alreadyStarting: "already_starting",
   terminated: "terminated_or_terminating",
   imageVersionOutdated: "image_version_outdated",
+  expiringSoon: "microvm_expiring_soon",
   resumeFailedFallingBackToRun: "resume_failed_falling_back_to_run",
   suspendingPollExhausted: "suspending_poll_exhausted",
   suspendWithoutMicrovmId: "suspend_without_microvm_id",
@@ -50001,6 +50003,15 @@ function compareImageVersions(a7, b7) {
   }
   return 0;
 }
+function isWithinExpiryRefreshWindow(doorbellRequest, startedAt, nowMs) {
+  if (startedAt === void 0 || !Number.isFinite(startedAt.getTime())) {
+    console.warn(
+      `[doorbell] GetMicrovm reported no finite startedAt for runner ${doorbellRequest.runnerId}; resuming`
+    );
+    return false;
+  }
+  return startedAt.getTime() + MICROVM_MAX_RUN_SECONDS * 1e3 - nowMs < MICROVM_EXPIRY_REFRESH_WINDOW_MS;
+}
 async function shouldRecreateForNewerImage(doorbellRequest, shape, runningVersion, microvm) {
   if (runningVersion === void 0) {
     console.warn(
@@ -50039,6 +50050,7 @@ async function handleDoorbell({
   controllerSigningSecret,
   shapes,
   microvm,
+  nowMs,
   sleep: sleep4,
   random
 }) {
@@ -50078,11 +50090,11 @@ async function handleDoorbell({
         microvmId: doorbellRequest.microvmId
       });
     }
-    return handleWakeDoorbell(doorbellRequest, resolvedShape, microvm, timing);
+    return handleWakeDoorbell(doorbellRequest, resolvedShape, microvm, timing, nowMs);
   }
   return suspendMicrovm(doorbellRequest, microvm, timing);
 }
-async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
+async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing, nowMs) {
   if (doorbellRequest.microvmId === void 0) {
     return runMicrovm(doorbellRequest, shape, microvm, timing, false, REASON.noMicrovmId);
   }
@@ -50132,7 +50144,19 @@ async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
         startedAt: described.startedAt,
         imageVersion: described.imageVersion
       });
-    case "SUSPENDED":
+    case "SUSPENDED": {
+      const resumeStartedAt = described.startedAt === void 0 || Number.isFinite(described.startedAt.getTime()) ? described.startedAt : void 0;
+      if (isWithinExpiryRefreshWindow(doorbellRequest, described.startedAt, nowMs)) {
+        return runMicrovm(
+          doorbellRequest,
+          shape,
+          microvm,
+          timing,
+          polled,
+          REASON.expiringSoon,
+          state3
+        );
+      }
       if (doorbellRequest.recreateOnOutdatedImage === true && await shouldRecreateForNewerImage(doorbellRequest, shape, described.imageVersion, microvm)) {
         return runMicrovm(
           doorbellRequest,
@@ -50151,9 +50175,10 @@ async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
         microvm,
         timing,
         polled,
-        described.startedAt,
+        resumeStartedAt,
         described.imageVersion
       );
+    }
     default:
       return runMicrovm(
         doorbellRequest,
@@ -50514,6 +50539,7 @@ var handler = async (event) => {
     controllerSigningSecret,
     shapes,
     microvm: createRuntimeMicrovm(executionRoleArn),
+    nowMs: Date.now(),
     sleep: sleep3,
     random: Math.random
   });

package/dist/microvm/constants.d.ts

@@ -5,5 +5,6 @@ export declare const RUN_HOOK_PAYLOAD_MAX_BYTES = 16384;
 export declare const SUSPENDING_POLL_ATTEMPTS = 4;
 export declare const SUSPENDING_POLL_INTERVAL_MS = 500;
 export declare const MICROVM_MAX_RUN_SECONDS = 28800;
+export declare const MICROVM_EXPIRY_REFRESH_WINDOW_MS: number;
 export declare const SESSION_CLEANUP_MAX_AGE = "24h";
 export declare const CONTROLLER_SIGNING_SECRET_KEY = "CONTROLLER_SIGNING_SECRET";

package/dist/microvm/constants.js

@@ -4,7 +4,7 @@
 // across them. The image template pins matching copies, guarded by
 // `microvm/image/dockerfile.test.ts`.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONTROLLER_SIGNING_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
+exports.CONTROLLER_SIGNING_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_EXPIRY_REFRESH_WINDOW_MS = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
 // The port the image's hook server binds, baked into the published Dockerfile
 // (`ENV HOOKS_PORT`) and passed to the construct as `hooksPort`. Exported from
 // the package index because a consumer building the published image context
@@ -32,6 +32,9 @@ exports.SUSPENDING_POLL_INTERVAL_MS = 500;
 // longer than any VM can possibly still be running, no VM started before the
 // deactivation can outlive it. The two MUST move together.
 exports.MICROVM_MAX_RUN_SECONDS = 28800;
+// A SUSPENDED VM with less than this left against `MICROVM_MAX_RUN_SECONDS`
+// is started fresh so AWS cannot terminate it during a task.
+exports.MICROVM_EXPIRY_REFRESH_WINDOW_MS = 2 * 60 * 60_000;
 // Auto-cleanup (issue #190): `evident run` reads this directly from the Fargate
 // task and MicroVM image. Setting a retention rule makes it sweep OpenCode
 // sessions idle longer than 24h; protected/active sessions are never touched.

package/dist/microvm/controller/handle-doorbell.d.ts

@@ -17,11 +17,12 @@ export type DoorbellResult = {
         kind: ActionKind;
     };
 };
-export declare function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }: {
+export declare function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, nowMs, sleep, random, }: {
     rawBody: string;
     signatureHeader: string | undefined;
     controllerSigningSecret: string;
     shapes: ShapeCatalogue;
     microvm: MicrovmClient;
+    nowMs: number;
 } & Timing): Promise<DoorbellResult>;
 export {};

package/dist/microvm/controller/handle-doorbell.js

@@ -14,6 +14,7 @@ const REASON = {
     alreadyStarting: 'already_starting',
     terminated: 'terminated_or_terminating',
     imageVersionOutdated: 'image_version_outdated',
+    expiringSoon: 'microvm_expiring_soon',
     resumeFailedFallingBackToRun: 'resume_failed_falling_back_to_run',
     suspendingPollExhausted: 'suspending_poll_exhausted',
     suspendWithoutMicrovmId: 'suspend_without_microvm_id',
@@ -128,6 +129,14 @@ function compareImageVersions(a, b) {
     }
     return 0;
 }
+function isWithinExpiryRefreshWindow(doorbellRequest, startedAt, nowMs) {
+    if (startedAt === undefined || !Number.isFinite(startedAt.getTime())) {
+        console.warn(`[doorbell] GetMicrovm reported no finite startedAt for runner ${doorbellRequest.runnerId}; ` +
+            'resuming');
+        return false;
+    }
+    return (startedAt.getTime() + constants_1.MICROVM_MAX_RUN_SECONDS * 1000 - nowMs < constants_1.MICROVM_EXPIRY_REFRESH_WINDOW_MS);
+}
 /**
  * Whether an opted-in doorbell should throw away and recreate the SUSPENDED VM
  * because a newer image has been published since it booted.
@@ -174,7 +183,7 @@ async function shouldRecreateForNewerImage(doorbellRequest, shape, runningVersio
     // been deactivated, and recreating would not roll it forward. Resume.
     return compareImageVersions(running, latest) < 0;
 }
-async function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }) {
+async function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, nowMs, sleep, random, }) {
     if (!(0, sdk_1.verifyEvidentSignature)(rawBody, signatureHeader, controllerSigningSecret)) {
         return decide({
             statusCode: 401,
@@ -223,11 +232,11 @@ async function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecre
                 microvmId: doorbellRequest.microvmId,
             });
         }
-        return handleWakeDoorbell(doorbellRequest, resolvedShape, microvm, timing);
+        return handleWakeDoorbell(doorbellRequest, resolvedShape, microvm, timing, nowMs);
     }
     return suspendMicrovm(doorbellRequest, microvm, timing);
 }
-async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
+async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing, nowMs) {
     if (doorbellRequest.microvmId === undefined) {
         return runMicrovm(doorbellRequest, shape, microvm, timing, false, REASON.noMicrovmId);
     }
@@ -285,16 +294,23 @@ async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
                 startedAt: described.startedAt,
                 imageVersion: described.imageVersion,
             });
-        case 'SUSPENDED':
+        case 'SUSPENDED': {
             // False/absent disables silent automatic roll-forward; an explicit restart
             // request (#1906) can still set the same wire flag. Recreate loses VM-local
             // filesystem state; durable provider credentials survive in object storage,
             // but a manual paste/upload not yet synced there may be lost (#2071).
+            const resumeStartedAt = described.startedAt === undefined || Number.isFinite(described.startedAt.getTime())
+                ? described.startedAt
+                : undefined;
+            if (isWithinExpiryRefreshWindow(doorbellRequest, described.startedAt, nowMs)) {
+                return runMicrovm(doorbellRequest, shape, microvm, timing, polled, REASON.expiringSoon, state);
+            }
             if (doorbellRequest.recreateOnOutdatedImage === true &&
                 (await shouldRecreateForNewerImage(doorbellRequest, shape, described.imageVersion, microvm))) {
                 return runMicrovm(doorbellRequest, shape, microvm, timing, polled, REASON.imageVersionOutdated, state);
             }
-            return resumeMicrovm(doorbellRequest, doorbellRequest.microvmId, shape, microvm, timing, polled, described.startedAt, described.imageVersion);
+            return resumeMicrovm(doorbellRequest, doorbellRequest.microvmId, shape, microvm, timing, polled, resumeStartedAt, described.imageVersion);
+        }
         default:
             // TERMINATED, TERMINATING, not_found — gone or going, so a fresh VM either
             // way. This is what self-heals a stale `microvm_id`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.6.1-dev.8d3e144",
+  "version": "3.6.1-dev.d5a3d9d",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -18,7 +18,7 @@
     "//build-bundled-deps": "Builds the workspace dependencies whose dist/ output the direct runner-cdk build chain consumes: lambda-microvm-cdk for the public construct types, lambda-microvm-runtime for runner-microvm-image's hook-server bundle, and runner-microvm-image for that bundle itself. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
     "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build && pnpm --filter runner-microvm-image build",
     "typecheck": "tsc --noEmit",
-    "test": "node --test --require ts-node/register 'src/**/*.test.ts'",
+    "test": "node --test --require tsx/cjs 'src/**/*.test.ts'",
     "format": "prettier --write 'src/**/*.ts'",
     "lint": "eslint 'src/**/*.ts' --max-warnings=0"
   },