@fishawack/lab-env 5.7.0-beta.5 → 5.7.0-beta.7

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 ## Changelog
 
+### 5.7.0-beta.7 (2026-07-03)
+
+#### Bug Fixes
+
+* added more places where rekey can bypass without project ([44e8ca4](https://bitbucket.org/fishawackdigital/lab-env/commits/44e8ca4ec2a1199d96e857338516628d51cb7e1d))
+* remove boilerplate-vue as option now its deprecated ([e8c097a](https://bitbucket.org/fishawackdigital/lab-env/commits/e8c097af21260c127defb90bb85c0eed224f35c2))
+* rotate email creds before operator iam permissions ([a4f510e](https://bitbucket.org/fishawackdigital/lab-env/commits/a4f510e916912dd199d03e4fde984c4abbb8d931))
+
+### 5.7.0-beta.6 (2026-07-03)
+
+#### Features
+
+* **devops:** misc.json setup, SES rotation recovery, runner ordering ([3c6ec70](https://bitbucket.org/fishawackdigital/lab-env/commits/3c6ec70df5e54ad4683a9a5b4e8e3accb681121d))
+
+#### Bug Fixes
+
+* add timeout for aws key calls themselves ([389444c](https://bitbucket.org/fishawackdigital/lab-env/commits/389444cf7c0c61273b8dc7edf2d0d6695a1047a7))
+* concurrency set back to 5 for more stable key commands ([a5e7382](https://bitbucket.org/fishawackdigital/lab-env/commits/a5e7382b9731ad2a5a60110a54e27ebe4af45391))
+
 ### 5.7.0-beta.5 (2026-07-03)
 
 #### Bug Fixes

package/commands/create/cmds/dekey.js

@@ -75,7 +75,7 @@ module.exports = [
         }));
 
         await parallelRunner(batches, {
-            concurrency: 10,
+            concurrency: 5,
             verb: "Remove credentials",
         });
     },

package/commands/create/cmds/diagnose.js

@@ -142,6 +142,16 @@ module.exports = [
                 }
             }
 
+            if (preset === "devops") {
+                while (!(await test.targets())) {
+                    await guide.targets(argv);
+                }
+
+                while (!(await test.misc())) {
+                    await guide.misc(argv);
+                }
+            }
+
             // Update diagnosis version in ~/.lab-env config file
             let spinner = new Spinner(
                 `Writing options to ${path.join(os.homedir(), "", ".lab-env")}`,

package/commands/create/cmds/key.js

@@ -95,18 +95,32 @@ module.exports = [
 
             if (answer.check) {
                 try {
-                    const creds = await aws.ses.ensureOperatorSESCredentials(
+                    let creds = await aws.ses.ensureOperatorSESCredentials(
                         operator.username,
                     );
 
+                    if (!creds) {
+                        answer = await inquirer.prompt([
+                            {
+                                type: "confirm",
+                                name: "check",
+                                message:
+                                    "SES IAM user exists but secret is not stored locally. Rotate credentials to recapture?",
+                                default: "Y",
+                            },
+                        ]);
+
+                        if (answer.check) {
+                            creds = await aws.ses.rotateOperatorSESCredentials(
+                                operator.username,
+                            );
+                        }
+                    }
+
                     if (creds) {
                         aws.ses.updateMiscNodemailer(creds);
                         console.log(
-                            "\n  ✓ SES email credentials created and saved to misc.json\n",
-                        );
-                    } else {
-                        console.log(
-                            "\n  ⚠ SES IAM user exists but keys were already created. Rotate with `fw rekey` to generate new credentials.\n",
+                            "\n  ✓ SES email credentials saved to misc.json\n",
                         );
                     }
                 } catch (err) {
@@ -133,7 +147,7 @@ module.exports = [
         }));
 
         const resultsMap = await parallelRunner(batches, {
-            concurrency: 10,
+            concurrency: 5,
             verb: "Create credentials",
         });
 

package/commands/create/cmds/rekey.js

@@ -95,18 +95,32 @@ module.exports = [
 
             if (answer.check) {
                 try {
-                    const creds = await aws.ses.ensureOperatorSESCredentials(
+                    let creds = await aws.ses.ensureOperatorSESCredentials(
                         operator.username,
                     );
 
+                    if (!creds) {
+                        answer = await inquirer.prompt([
+                            {
+                                type: "confirm",
+                                name: "check",
+                                message:
+                                    "SES IAM user exists but secret is not stored locally. Rotate credentials to recapture?",
+                                default: "Y",
+                            },
+                        ]);
+
+                        if (answer.check) {
+                            creds = await aws.ses.rotateOperatorSESCredentials(
+                                operator.username,
+                            );
+                        }
+                    }
+
                     if (creds) {
                         aws.ses.updateMiscNodemailer(creds);
                         console.log(
-                            "\n  \u2713 SES email credentials created and saved to misc.json\n",
-                        );
-                    } else {
-                        console.log(
-                            "\n  \u26a0 SES IAM user exists but keys were already created. Rotate with `fw rekey` to generate new credentials.\n",
+                            "\n  \u2713 SES email credentials saved to misc.json\n",
                         );
                     }
                 } catch (err) {
@@ -117,10 +131,19 @@ module.exports = [
             }
         }
 
-        // Separate non-operator users and operator
-        // Operator MUST be processed last per account — rotating the
-        // operator's key invalidates the credentials used for all API calls
-        let nonOperatorUsers = users.filter((u) => u !== operator.username);
+        // Separate users into: regular, runners, operator
+        // Processing order: regular users → runners → operator (last)
+        let runners = users.filter((u) => {
+            let config = _.config.users.find((d) => d.username === u);
+            return (
+                u !== operator.username &&
+                config &&
+                (config.runner || u === "aws-runner")
+            );
+        });
+        let nonOperatorUsers = users.filter(
+            (u) => u !== operator.username && !runners.includes(u),
+        );
         let includeOperator = users.includes(operator.username);
 
         let credentials = {};
@@ -144,7 +167,7 @@ module.exports = [
             }));
 
             const resultsMap = await parallelRunner(batches, {
-                concurrency: 10,
+                concurrency: 5,
                 verb: "Rotate credentials",
             });
 
@@ -164,39 +187,49 @@ module.exports = [
             }
         }
 
-        // Process operator sequentially — must be last per account
-        if (includeOperator) {
-            const operatorBatches = clients.map((client) => ({
-                users: [operator.username],
+        // Process runner users as a group (after regular, before operator)
+        if (runners.length) {
+            const runnerBatches = clients.map((client) => ({
+                users: runners,
                 client,
                 fn: async (user) => {
                     setAWSClientDefaults(client);
 
-                    return aws.iam.rotateFWIAMUser(
+                    await aws.iam.removeIAMUser(`fw-automation-${user}`);
+
+                    return aws.iam.createFWIAMUser(
                         `fw-automation-${user}`,
-                        operator.permissions,
+                        _.config.users.find((d) => d.username === user)
+                            .permissions,
                     );
                 },
             }));
 
-            const operatorResults = await parallelRunner(operatorBatches, {
-                concurrency: 1,
-                verb: "Rotate operator credentials",
+            const runnerResults = await parallelRunner(runnerBatches, {
+                concurrency: 5,
+                verb: "Rotate runner credentials",
             });
 
-            for (const [user, entries] of operatorResults) {
+            for (const [user, entries] of runnerResults) {
                 credentials[user] = {};
 
                 for (const { client, res } of entries) {
                     credentials[user][client] = {
-                        key: res.AccessKey.AccessKeyId,
-                        secret: res.AccessKey.SecretAccessKey,
+                        key:
+                            (res.AccessKey && res.AccessKey.AccessKeyId) ||
+                            res.AccessKeyMetadata[0].AccessKeyId,
+                        secret:
+                            (res.AccessKey && res.AccessKey.SecretAccessKey) ||
+                            "** secret **",
                     };
                 }
             }
         }
 
-        // Rotate SES email credentials (after operator keys so fishawack creds are still valid)
+        // Rotate SES email credentials BEFORE rotating the operator's AWS key.
+        // The SES client uses fromIni({ profile: 'fishawack' }) which reads the
+        // operator's key from ~/.aws/credentials — once that key is rotated below
+        // the profile becomes stale and the SES call would fail.
         if (misc.nodemailer?.AWSSES?.username) {
             try {
                 const creds = await aws.ses.rotateOperatorSESCredentials(
@@ -213,6 +246,38 @@ module.exports = [
             }
         }
 
+        // Process operator sequentially — must be last per account
+        if (includeOperator) {
+            const operatorBatches = clients.map((client) => ({
+                users: [operator.username],
+                client,
+                fn: async (user) => {
+                    setAWSClientDefaults(client);
+
+                    return aws.iam.rotateFWIAMUser(
+                        `fw-automation-${user}`,
+                        operator.permissions,
+                    );
+                },
+            }));
+
+            const operatorResults = await parallelRunner(operatorBatches, {
+                concurrency: 1,
+                verb: "Rotate operator credentials",
+            });
+
+            for (const [user, entries] of operatorResults) {
+                credentials[user] = {};
+
+                for (const { client, res } of entries) {
+                    credentials[user][client] = {
+                        key: res.AccessKey.AccessKeyId,
+                        secret: res.AccessKey.SecretAccessKey,
+                    };
+                }
+            }
+        }
+
         await outputCredentials(credentials, sendEmail);
     },
 ];

package/commands/create/libs/parallel-runner.js

@@ -6,6 +6,7 @@ const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧",
 const MAX_RETRIES = 15;
 const INITIAL_DELAY = 2000;
 const MAX_DELAY = 60000;
+const TASK_TIMEOUT = 120000; // 2 min hard timeout per attempt — prevents hung TCP connections
 
 const RETRYABLE_ERRORS = [
     "Throttling",
@@ -180,7 +181,24 @@ module.exports = async function parallelRunner(
                         state.taskStart = Date.now();
 
                         try {
-                            const res = await batch.fn(user);
+                            let timeoutHandle;
+                            const res = await Promise.race([
+                                batch.fn(user),
+                                new Promise((_, reject) => {
+                                    timeoutHandle = setTimeout(
+                                        () =>
+                                            reject(
+                                                Object.assign(
+                                                    new Error(
+                                                        "Request timed out after 2 minutes — will retry",
+                                                    ),
+                                                    { name: "RequestTimeout" },
+                                                ),
+                                            ),
+                                        TASK_TIMEOUT,
+                                    );
+                                }),
+                            ]).finally(() => clearTimeout(timeoutHandle));
                             results
                                 .get(user)
                                 .push({ client: batch.client, res });

package/commands/create/libs/vars.js

@@ -114,10 +114,6 @@ module.exports.templates = [
         name: "boilerplate",
         type: "boilerplate",
     },
-    {
-        name: "boilerplate-vue",
-        type: "boilerplate",
-    },
     {
         name: "boilerplate-wordpress",
         type: "boilerplate",

package/commands/create/services/aws/ses.js

@@ -176,7 +176,15 @@ const MISC_PATH = `${os.homedir()}/targets/misc.json`;
 module.exports.updateMiscNodemailer = (creds) => {
     const { misc } = require("../../libs/vars");
 
-    const file = JSON.parse(readFileSync(MISC_PATH, { encoding: "utf8" }));
+    let file = {};
+
+    try {
+        file = JSON.parse(readFileSync(MISC_PATH, { encoding: "utf8" }));
+    } catch {
+        const { mkdirSync } = require("fs");
+        mkdirSync(require("path").dirname(MISC_PATH), { recursive: true });
+        file = { bitbucket: {}, gitlab: {} };
+    }
 
     file.nodemailer = {
         driver: "AWSSES",

package/globals.js

@@ -233,6 +233,7 @@ if (composer && composer.require && composer.require["laravel/framework"]) {
             args[0] !== "new" &&
             args[0] !== "key" &&
             args[0] !== "dekey" &&
+            args[0] !== "rekey" &&
             args[0] !== "lint" &&
             args[0] !== "workspace" &&
             args[0] !== "prune"
@@ -355,6 +356,7 @@ if (process.env.FW_NEXT || forced) {
         args[0] !== "new" &&
         args[0] !== "key" &&
         args[0] !== "dekey" &&
+        args[0] !== "rekey" &&
         args[0] !== "lint" &&
         args[0] !== "workspace" &&
         args[0] !== "prune"
@@ -715,6 +717,7 @@ if (
     args[0] !== "--help" &&
     args[0] !== "key" &&
     args[0] !== "dekey" &&
+    args[0] !== "rekey" &&
     args[0] !== "lint" &&
     args[0] !== "workspace" &&
     args[0] !== "prune"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.7.0-beta.5",
+    "version": "5.7.0-beta.7",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {