@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.39

package/src/server.js

@@ -15,7 +15,8 @@
 
 'use strict';
 
-const path = require('node:path'),
+const fs = require('node:fs'),
+  path = require('node:path'),
   express = require('express'),
   session = require('express-session'),
 
@@ -31,20 +32,31 @@ const path = require('node:path'),
   { createScheduler } = require('./services/scheduler'),
   { createHeartbeatMonitor } = require('./services/heartbeat'),
   { createLogsService } = require('./services/logs'),
-  { createArtifactsService } = require('./services/artifacts'),
   { createCommandsService } = require('./services/commands'),
   { createRetentionService } = require('./services/retention'),
   { createCleanupService } = require('./services/cleanup'),
   { startDevMode } = require('./dev/virtual'),
   { createUpdatesService } = require('./services/updates'),
   { createLiveService } = require('./services/live'),
+  { SqliteSessionStore } = require('./services/session-store'),
 
   { createAgentRouter } = require('./api/agent'),
   { createResourceRouter } = require('./api/resource'),
   { createAdminRouter } = require('./api/admin'),
   { createWebRouter } = require('./web/routes');
 
+// Artifacts are no longer stored on the Coordinator (README §9): an
+// upgraded one frees the space the old <dataDir>/artifacts took, once.
+function removeLegacyArtifacts(config){
+  const dir = path.join(config.dataDir, 'artifacts');
+  if (fs.existsSync(dir)){
+    fs.rmSync(dir, { recursive: true, force: true });
+    console.log(`Removed ${dir}: the Coordinator no longer stores job artifacts`);
+  }
+}
+
 function buildServices(config){
+  removeLegacyArtifacts(config);
   const db = openDb(config.dbPath),
     events = createEventsService(db),
     registry = createRegistryService(db, { bus, events }),
@@ -53,14 +65,14 @@ function buildServices(config){
     adminUsers = createAdminUsersService(db),
     commands = createCommandsService({ bus }),
     logs = createLogsService(db, { bus }),
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     scheduler = createScheduler(db, { bus, events, registry, config }),
     heartbeatMonitor = createHeartbeatMonitor(db, { bus, events, registry, jobs, config }),
-    retention = createRetentionService(db, { bus, logs, artifacts, config }),
+    retention = createRetentionService(db, { config }),
     cleanup = createCleanupService(db, { jobs, config }),
     updates = createUpdatesService({ config }),
-    live = createLiveService(db, { bus, updates });
+    live = createLiveService(db, { bus, updates }),
+    sessionStore = new SqliteSessionStore(db);
 
   jobs.reconcileOnStartup();
   updates.start();
@@ -83,13 +95,13 @@ function buildServices(config){
     commands,
     jobs,
     logs,
-    artifacts,
     scheduler,
     heartbeatMonitor,
     retention,
     cleanup,
     updates,
-    live
+    live,
+    sessionStore
   };
 }
 
@@ -101,6 +113,18 @@ function commonVersion(){
   return require('@andrian.yablonskyy/thub-common/package.json').version;
 }
 
+// The session cookie's Secure flag (config session.secureCookie, §12).
+// "auto": always Secure for an https:// publicUrl — the cookie must never
+// travel over plain HTTP there — else express-session's per-request 'auto'
+// (Secure on HTTPS connections), so plain-HTTP development still works.
+function cookieSecure(config){
+  const setting = config.session?.secureCookie ?? 'auto';
+  if (setting === true || setting === false){
+    return setting;
+  }
+  return /^https:\/\//i.test(config.publicUrl || '') ? true : 'auto';
+}
+
 function createApp(config, services){
   const app = express();
   app.set('view engine', 'pug');
@@ -119,6 +143,9 @@ function createApp(config, services){
   app.use(
     session({
       secret: config.sessionSecret,
+      // In the SQLite database (services/session-store.js), not in memory:
+      // survives restarts, and expired sessions are pruned.
+      store: services.sessionStore,
       resave: false,
       saveUninitialized: false,
       // Idle timeout, not a fixed one (§10.1): `rolling` re-sends a fresh
@@ -127,7 +154,7 @@ function createApp(config, services){
       // (routes.js) after their *last* request. Each user's own preference
       // is applied per-request in web/routes.js, since it isn't known here.
       rolling: true,
-      cookie: { httpOnly: true, sameSite: 'lax' }
+      cookie: { httpOnly: true, sameSite: 'lax', secure: cookieSecure(config) }
     })
   );
   // Background requests of the dashboard's live updates (public/js/live.js):
@@ -152,17 +179,6 @@ function createApp(config, services){
   app.use('/api/v1', createResourceRouter({ services, config }));
   app.use('/api/v1/admin', createAdminRouter({ services }));
 
-  // HMAC-signed artifact downloads (§3.1, §12) — no session or bearer token.
-  app.get('/artifacts/download/:token', (req, res, next) => {
-    try {
-      const artifact = services.artifacts.verify(req.params.token);
-      res.download(artifact.path, artifact.name);
-    }
-    catch (err){
-      next(err);
-    }
-  });
-
   app.use('/', createWebRouter({ services, config }));
 
   app.use((err, req, res, next) => {
@@ -225,4 +241,4 @@ if (require.main === module){
   start();
 }
 
-module.exports = { start, buildServices, createApp };
+module.exports = { start, buildServices, createApp, cookieSecure };

package/src/services/cleanup.js

@@ -1,6 +1,6 @@
 /**
  * @file        packages/coordinator/src/services/cleanup.js
- * @description Database cleanup: wipe finished jobs (logs, artifacts, events) and old events before a cutoff, then
+ * @description Database cleanup: wipe finished jobs (logs, events) and old events before a cutoff, then
  *              VACUUM to shrink the file — on demand from the dashboard, and hourly per retention.jobRetention (README §9)
  *
  * @author      Andrian Yablonskyy
@@ -81,7 +81,7 @@ function createCleanupService(db, { jobs, config, now = () => new Date() }){
   }
 
   // Wipe everything older than `before` (a Date; default now): finished
-  // jobs that ended before it, with their logs, artifacts and events, and
+  // jobs that ended before it, with their logs and events, and
   // the other audit events (resource/agent/group) logged before it. Events
   // of jobs that stay (still active, or newer) are kept. `vacuum`: true,
   // false, or 'auto' (only if something was deleted and the last VACUUM is

package/src/services/jobs.js

@@ -56,7 +56,7 @@ function nextJobId(db, source){
   return `${prefix}-${String(n).padStart(5, '0')}`;
 }
 
-function createJobsService(db, { bus, events, registry, artifacts, config }){
+function createJobsService(db, { bus, events, registry, config }){
   function get(id){
     return rowToJob(db.prepare('SELECT * FROM jobs WHERE id = ?').get(id));
   }
@@ -483,7 +483,7 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
   }
 
   // Admin: "clean the queue" — permanently delete finished jobs (and their
-  // logs/artifacts, on disk and in the DB), for when the history itself,
+  // logs, in the DB), for when the history itself,
   // not just active work, needs clearing out. Unlike the nightly retention
   // sweep (§9), this runs on demand and isn't limited to old jobs.
   function cleanHistory(){
@@ -491,7 +491,7 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
   }
 
   // Finished jobs that ended before `beforeIso` (null: all of them), with
-  // their logs, artifacts (files too) and events — manual cleanup and the
+  // their logs and events — manual cleanup and the
   // job retention task (services/cleanup.js). Active jobs are never touched.
   function purgeFinishedBefore(beforeIso){
     const placeholders = [...TERMINAL_JOB_STATES].map(() => '?').join(','),
@@ -504,14 +504,11 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
       return 0;
     }
 
-    const deleteArtifacts = db.prepare('DELETE FROM artifacts WHERE job_id = ?'),
-      deleteLogs = db.prepare('DELETE FROM job_logs WHERE job_id = ?'),
+    const deleteLogs = db.prepare('DELETE FROM job_logs WHERE job_id = ?'),
       deleteEvents = db.prepare('DELETE FROM events WHERE entity = \'job\' AND entity_id = ?'),
       deleteJob = db.prepare('DELETE FROM jobs WHERE id = ?'),
       tx = db.transaction(() => {
         for (const id of ids){
-          artifacts.deleteJobArtifacts(id);
-          deleteArtifacts.run(id);
           deleteLogs.run(id);
           deleteEvents.run(id);
           deleteJob.run(id);

package/src/services/logs.js

@@ -15,7 +15,7 @@
 
 // §3.1 Log service: accepts batched log lines, assigns a monotonically
 // increasing seq per job, stores them, and fans them out over the bus for
-// SSE subscribers (§6.4). Retention is handled separately (§9).
+// SSE subscribers (§6.4). Lines are deleted with their job (§9).
 function createLogsService(db, { bus }){
   const insert = db.prepare(
       'INSERT INTO job_logs (job_id, seq, ts, stream, line) VALUES (?, ?, ?, ?, ?)'
@@ -47,24 +47,22 @@ function createLogsService(db, { bus }){
       .all(jobId, afterSeq, limit);
   }
 
-  // Used when a job finishes: fold job_logs into a flat console.log artifact.
-  function renderConsoleLog(jobId){
+  // The dashboard log viewer's pages (views/mixins/log-viewer.pug): the
+  // `limit` lines just before `beforeSeq` (the end of the log when omitted),
+  // oldest first, and whether there are earlier ones to scroll up to.
+  function pageBefore(jobId, beforeSeq, limit){
     const rows = db
-      .prepare('SELECT * FROM job_logs WHERE job_id = ? ORDER BY seq ASC')
-      .all(jobId);
-    return rows.map((r) => `[${r.ts}] [${r.stream}] ${r.line}`).join('\n') + (rows.length ? '\n' : '');
+        .prepare('SELECT seq, ts, stream, line FROM job_logs WHERE job_id = ? AND seq < ? ORDER BY seq DESC LIMIT ?')
+        .all(jobId, beforeSeq ?? Number.MAX_SAFE_INTEGER, limit + 1),
+      hasMore = rows.length > limit;
+    return { lines: rows.slice(0, limit).reverse(), hasMore };
   }
 
-  function purgeOlderThan(days){
-    const cutoff = new Date(Date.now() - days * 86400 * 1000).toISOString();
-    db.prepare(
-      `DELETE FROM job_logs WHERE job_id IN (
-         SELECT id FROM jobs WHERE finished_at IS NOT NULL AND finished_at <= ?
-       )`
-    ).run(cutoff);
+  function count(jobId){
+    return db.prepare('SELECT COUNT(*) AS n FROM job_logs WHERE job_id = ?').get(jobId).n;
   }
 
-  return { appendBatch, listSince, renderConsoleLog, purgeOlderThan };
+  return { appendBatch, listSince, pageBefore, count };
 }
 
 module.exports = { createLogsService };

package/src/services/retention.js

@@ -1,6 +1,6 @@
 /**
  * @file        packages/coordinator/src/services/retention.js
- * @description Deletes finished jobs' logs/artifacts past their retention window (README §9)
+ * @description Nightly consistent database backup (VACUUM INTO, README §9)
  *
  * @author      Andrian Yablonskyy
  * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
@@ -17,20 +17,11 @@ const path = require('node:path');
 
 const DAY_MS = 86400 * 1000;
 
-// §9: fold job_logs into a console.log artifact when a job finishes, purge
-// old logs/artifacts on the configured retention windows, and take a nightly
-// consistent backup via VACUUM INTO.
-function createRetentionService(db, { bus, logs, artifacts, config }){
-  bus.on('job.finished', ({ jobId }) => {
-    const text = logs.renderConsoleLog(jobId);
-    if (text){
-      artifacts.storeGenerated(jobId, 'console.log', Buffer.from(text, 'utf8'), 'text/plain');
-    }
-  });
-
+// §9: a nightly consistent backup via VACUUM INTO. (A job's log lines live
+// as long as the job itself — retention.jobRetention / Clean up database,
+// services/cleanup.js — and there are no artifacts to purge any more.)
+function createRetentionService(db, { config }){
   function runDaily(){
-    logs.purgeOlderThan(config.retention.logRetentionDays);
-    artifacts.purgeOlderThan(config.retention.artifactRetentionDays);
     const backupPath = path.join(config.dataDir, `backup-${new Date().toISOString().slice(0, 10)}.db`);
     db.exec(`VACUUM INTO '${backupPath.replace(/'/g, '\'\'')}'`);
   }

package/src/services/session-store.js

@@ -0,0 +1,127 @@
+/**
+ * @file        packages/coordinator/src/services/session-store.js
+ * @description Dashboard session store in the Coordinator's SQLite database: survives restarts, prunes expired sessions
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const session = require('express-session');
+
+// express-session's default MemoryStore loses every session on a restart,
+// never drops expired ones (memory only grows) and warns against itself in
+// production. This one keeps them in the `sessions` table (migration 022),
+// so signing in survives a Coordinator restart or self-update, and an
+// expired session is deleted when read and by a periodic sweep.
+const PRUNE_INTERVAL_MS = 15 * 60 * 1000,
+  // A session without a cookie expiry (never the case here: routes.js sets
+  // each user's idle timeout) is kept this long.
+  FALLBACK_TTL_MS = 24 * 60 * 60 * 1000;
+
+class SqliteSessionStore extends session.Store{
+  constructor(db, { pruneIntervalMs = PRUNE_INTERVAL_MS, now = Date.now } = {}){
+    super();
+    this.now = now;
+    this.stmts = {
+      get: db.prepare('SELECT sess, expires FROM sessions WHERE sid = ?'),
+      set: db.prepare(
+        `INSERT INTO sessions (sid, sess, expires) VALUES (?, ?, ?)
+         ON CONFLICT(sid) DO UPDATE SET sess = excluded.sess, expires = excluded.expires`
+      ),
+      touch: db.prepare('UPDATE sessions SET sess = ?, expires = ? WHERE sid = ?'),
+      destroy: db.prepare('DELETE FROM sessions WHERE sid = ?'),
+      prune: db.prepare('DELETE FROM sessions WHERE expires <= ?'),
+      length: db.prepare('SELECT COUNT(*) AS n FROM sessions WHERE expires > ?'),
+      clear: db.prepare('DELETE FROM sessions')
+    };
+    if (pruneIntervalMs > 0){
+      this.pruneTimer = setInterval(() => this.prune(), pruneIntervalMs);
+      this.pruneTimer.unref?.();
+    }
+  }
+
+  expiresOf(sess){
+    const at = sess?.cookie?.expires ? new Date(sess.cookie.expires).getTime() : NaN;
+    return Number.isFinite(at) ? at : this.now() + FALLBACK_TTL_MS;
+  }
+
+  // Each method answers through `cb`, as express-session expects; errors
+  // (a locked or broken database) go there too instead of throwing.
+  run(cb, fn){
+    let result;
+    try {
+      result = fn();
+    }
+    catch (err){
+      return cb?.(err);
+    }
+    cb?.(null, result);
+  }
+
+  get(sid, cb){
+    this.run(cb, () => {
+      const row = this.stmts.get.get(sid);
+      if (!row){
+        return null;
+      }
+      if (row.expires <= this.now()){
+        this.stmts.destroy.run(sid);
+        return null;
+      }
+      return JSON.parse(row.sess);
+    });
+  }
+
+  set(sid, sess, cb){
+    this.run(cb, () => {
+      this.stmts.set.run(sid, JSON.stringify(sess), this.expiresOf(sess));
+    });
+  }
+
+  // Called for a request that didn't change the session: moves its expiry
+  // (rolling idle timeout, §10.1). A passive live-update request leaves the
+  // cookie's expiry as it was (server.js), so this writes the same value.
+  touch(sid, sess, cb){
+    this.run(cb, () => {
+      this.stmts.touch.run(JSON.stringify(sess), this.expiresOf(sess), sid);
+    });
+  }
+
+  destroy(sid, cb){
+    this.run(cb, () => {
+      this.stmts.destroy.run(sid);
+    });
+  }
+
+  length(cb){
+    this.run(cb, () => this.stmts.length.get(this.now()).n);
+  }
+
+  clear(cb){
+    this.run(cb, () => {
+      this.stmts.clear.run();
+    });
+  }
+
+  prune(){
+    try {
+      return this.stmts.prune.run(this.now()).changes;
+    }
+    catch {
+      return 0; // the next sweep tries again
+    }
+  }
+
+  close(){
+    clearInterval(this.pruneTimer);
+  }
+}
+
+module.exports = { SqliteSessionStore };

package/src/web/routes.js

@@ -16,6 +16,7 @@
 const fs = require('node:fs'),
   os = require('node:os'),
   path = require('node:path'),
+  { once } = require('node:events'),
   express = require('express'),
   multer = require('multer'),
   { requireAdminSession, requireAdminRole } = require('../auth'),
@@ -28,9 +29,13 @@ const fs = require('node:fs'),
   listPrefs = require('../services/list-prefs'),
   search = require('../services/search');
 
-// Resources page sort keys (list-prefs.js) -> comparators. Empty values
-// (never heartbeated, no version reported) sort last in both directions.
-const RESOURCE_SORT_VALUE = {
+// Job log viewer: lines per page it loads (and the most one request may ask for).
+const LOG_PAGE = 1000,
+  LOG_PAGE_MAX = 5000,
+
+  // Resources page sort keys (list-prefs.js) -> comparators. Empty values
+  // (never heartbeated, no version reported) sort last in both directions.
+  RESOURCE_SORT_VALUE = {
     name: (r) => r.name,
     type: (r) => r.type,
     version: (r) => r.client_version,
@@ -203,14 +208,35 @@ function createWebRouter({ services, config }){
     next();
   });
 
+  // A Secure-only session cookie (server.js cookieSecure, §12) is never
+  // sent back over plain HTTP, so signing in would just loop back here.
+  // Say why instead — usually a proxy not passing X-Forwarded-Proto.
+  function httpsProblem(req){
+    if (req.session.cookie.secure !== true || req.secure){
+      return null;
+    }
+    return {
+      type: 'danger',
+      sticky: true,
+      text: `Signing in needs HTTPS: this Coordinator's session cookie is sent only over HTTPS (publicUrl is ${config.publicUrl}), ` +
+        'but this request reached it as plain HTTP. Open the dashboard through that https:// address; behind a reverse proxy, ' +
+        'make it send "X-Forwarded-Proto: https" and check trustProxy. To allow plain HTTP, set session.secureCookie to false.'
+    };
+  }
+
   router.get('/login', (req, res) => {
     if (req.session.user){
       return res.redirect('/');
     }
-    res.render('login', { title: 'Sign in' });
+    const problem = httpsProblem(req);
+    res.render('login', { title: 'Sign in', ...(problem ? { messages: [problem] } : {}) });
   });
 
   router.post('/login', (req, res) => {
+    const problem = httpsProblem(req);
+    if (problem){
+      return res.status(400).render('login', { title: 'Sign in', messages: [problem] });
+    }
     const { username, password } = req.body,
       user = services.adminUsers.verify(username, password);
     if (!user){
@@ -786,7 +812,7 @@ function createWebRouter({ services, config }){
   });
 
   // "Clean up database" (§9): everything before the given time — finished
-  // jobs with their logs/artifacts, and older history — then VACUUM. The
+  // jobs with their logs, and older history — then VACUUM. The
   // time is dd/mm/yyyy HH:MM:SS in the user's own time zone.
   router.post('/jobs/clean-history', requireAdminRole, (req, res) => {
     const tz = req.session.user.timezone || 'UTC',
@@ -818,8 +844,7 @@ function createWebRouter({ services, config }){
       return res.status(404).send('Not found');
     }
     job.resource = job.resource_id ? services.registry.get(job.resource_id) : null;
-    const artifacts = services.artifacts.listForJob(job.id).map((a) => ({ ...a, url: services.artifacts.signedUrl(a) })),
-      jobActive = ACTIVE_JOB_STATES.has(job.state);
+    const jobActive = ACTIVE_JOB_STATES.has(job.state);
     res.render('jobs/show', {
       title: job.id,
       active: 'jobs',
@@ -829,7 +854,6 @@ function createWebRouter({ services, config }){
         ? services.registry.waitingReason(job.spec.target.type, job.spec.target.labels || [], job.spec.target.group,
           job.spec.target.client)
         : null,
-      artifacts,
       jobActive,
       canCancel: req.session.user.role === 'admin' && jobActive
     });
@@ -847,15 +871,53 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, `/jobs/${req.params.id}`));
   });
 
-  // Plain, one-shot fetch — used by the log viewer for a job that's
-  // already finished, so it doesn't open a live connection (§SSE) for
-  // output that will never change again.
+  // The log viewer's pages (public/js/log-viewer.js): the last `limit`
+  // lines first, then earlier ones (`before` = the oldest seq it has) as the
+  // reader scrolls up. `total` is how many lines the job has in all.
   router.get('/jobs/:id/logs', (req, res) => {
-    res.json({ lines: services.logs.listSince(req.params.id, 0) });
+    const before = Number.parseInt(req.query.before, 10),
+      limit = Math.min(Math.max(Number.parseInt(req.query.limit, 10) || LOG_PAGE, 1), LOG_PAGE_MAX),
+      page = services.logs.pageBefore(req.params.id, before > 0 ? before : undefined, limit);
+    res.json({ ...page, total: services.logs.count(req.params.id) });
+  });
+
+  // RAW (log viewer): the whole log as plain text, for a new tab, a
+  // download or grep. Streamed in pages, waiting for the socket to drain,
+  // so a huge log never sits in memory. Log lines live as long as their job
+  // (§9), so this is always the complete log.
+  router.get('/jobs/:id/log.txt', async (req, res, next) => {
+    try {
+      const job = services.jobs.get(req.params.id);
+      if (!job){
+        return res.status(404).type('text/plain').send('Unknown job');
+      }
+      res.set({
+        'Content-Type': 'text/plain; charset=utf-8',
+        // The log is whatever the job printed: never let a browser sniff it
+        // into HTML.
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Disposition': `inline; filename="${job.id}.log"`,
+        'Cache-Control': 'no-store'
+      });
+      for (let seq = 0, page; (page = services.logs.listSince(job.id, seq, LOG_PAGE_MAX)).length;){
+        const chunk = page.map((l) => `[${l.ts}] [${l.stream}] ${l.line}\n`).join('');
+        seq = page.at(-1).seq;
+        if (!res.write(chunk)){
+          await once(res, 'drain');
+        }
+        if (res.destroyed){
+          return;
+        }
+      }
+      res.end();
+    }
+    catch (err){
+      next(err);
+    }
   });
 
   router.get('/jobs/:id/stream', (req, res) => {
-    attachJobStream(req, res, { jobId: req.params.id, services, config });
+    attachJobStream(req, res, { jobId: req.params.id, services });
   });
 
   // Resource groups (§13.1) — their own page since they're a distinct

package/test/cleanup.test.js

@@ -23,7 +23,6 @@ const test = require('node:test'),
   { createEventsService } = require('../src/services/events'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
   { createCleanupService, retentionCutoff } = require('../src/services/cleanup'),
   { JOB_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -35,8 +34,6 @@ function setup(jobRetention = 'forever'){
     config = {
       dataDir,
       dbPath: path.join(dataDir, 'thub.db'),
-      artifactsDir: path.join(dataDir, 'artifacts'),
-      artifacts: { linkTtlHours: 1 },
       sessionSecret: 's',
       publicUrl: 'http://x',
       scheduler: { maxQueuedPerAgent: 1000 },
@@ -48,8 +45,7 @@ function setup(jobRetention = 'forever'){
     events = createEventsService(db),
     registry = createRegistryService(db, { bus, events }),
     { agent } = createAgentsService(db, { events }).create({ name: 'ci', kind: 'ci' }),
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     cleanup = createCleanupService(db, { jobs, config, now: () => NOW });
   registry.registerAuto({ clientId: 'c', name: 'lab', type: 'sw', labels: [] });