@stage5/lumine 0.2.58 → 0.2.59

package/lib/sponsor-duty.js

@@ -234,7 +234,7 @@ async function reconcileExistingStateBeforeStart({
   }
   const preservedWorkspaces = dutyWorkspacePaths(existingState);
   if (preservedWorkspaces.length > 0) {
-    const archivePath = await archiveSponsorState(options);
+    const archivePath = await archiveSponsorState(options, existingState);
     console.error(
       `lumine: preserved the expired duty record at ${archivePath}.`,
     );
@@ -408,7 +408,7 @@ async function changeDutyState(options, action) {
       const preservedWorkspaces = dutyWorkspacePaths(localState);
       const localArchive =
         preservedWorkspaces.length > 0
-          ? await archiveSponsorState(options)
+          ? await archiveSponsorState(options, localState)
           : null;
       if (!localArchive) await removeSponsorState(options);
       printJsonOrLines(
@@ -472,7 +472,7 @@ async function changeDutyState(options, action) {
     if (nextState === "stopped") {
       preservedWorkspaces = dutyWorkspacePaths(localState);
       if (preservedWorkspaces.length > 0) {
-        localArchive = await archiveSponsorState(options);
+        localArchive = await archiveSponsorState(options, localState);
       } else {
         await removeSponsorState(options);
       }
@@ -1412,7 +1412,17 @@ async function sponsorLockIsStale(lockPath) {
   }
 }
 
-async function archiveSponsorState(options) {
+async function archiveSponsorState(options, state) {
+  for (const jobState of Object.values(state.jobs || {})) {
+    await scrubJobCredentials(jobState);
+  }
+  for (const preserved of Array.isArray(state.preservedWorkspaces)
+    ? state.preservedWorkspaces
+    : []) {
+    await scrubPreservedWorkspaceCredential(preserved);
+  }
+  state.duty = { ...state.duty, leaseToken: null };
+  await writeSponsorState(options, state);
   const filePath = sponsorDutyStatePath(options);
   const archivePath = `${filePath}.stopped-${Date.now()}`;
   await fs.rename(filePath, archivePath);
@@ -1422,6 +1432,7 @@ async function archiveSponsorState(options) {
 
 async function removeCompletedJob({ options, state, jobId }) {
   const jobState = requireJobState(state, jobId);
+  await scrubJobCredentials(jobState);
   const nextJobs = { ...(state.jobs || {}) };
   delete nextJobs[String(jobId)];
   state.jobs = nextJobs;
@@ -1435,6 +1446,7 @@ async function removeCompletedJob({ options, state, jobId }) {
 
 async function preserveFailedJobWorkspace({ options, state, jobId, reason }) {
   const jobState = requireJobState(state, jobId);
+  await scrubJobCredentials(jobState);
   const nextJobs = { ...(state.jobs || {}) };
   delete nextJobs[String(jobId)];
   state.jobs = nextJobs;
@@ -1449,6 +1461,7 @@ async function preserveFailedJobWorkspace({ options, state, jobId, reason }) {
       workspaceDir: jobState.workspaceDir,
       reason: reason.slice(0, 1000),
       preservedAt: new Date().toISOString(),
+      credentialsRemovedAt: jobState.credentialsRemovedAt,
     },
   ];
   await writeSponsorState(options, state);
@@ -1473,6 +1486,50 @@ function dutyWorkspacePaths(state) {
 }
 
 async function cleanupJobFiles(jobState) {
+  const tempDir = resolveJobTempDir(jobState);
+  await fs.rm(tempDir, { recursive: true, force: true });
+}
+
+async function scrubJobCredentials(jobState) {
+  const tempDir = resolveJobTempDir(jobState);
+  const expectedAuthFile = path.join(tempDir, "job-auth.json");
+  const authFile = path.resolve(
+    String(jobState?.authFile || expectedAuthFile),
+  );
+  if (authFile !== expectedAuthFile) {
+    throw new Error(
+      "Refused to remove an unrecognized Workshop credential file.",
+    );
+  }
+  await fs.unlink(authFile).catch((error) => {
+    if (error.code !== "ENOENT") throw error;
+  });
+  jobState.authFile = null;
+  jobState.workspaceToken = null;
+  if (jobState.attempt) {
+    jobState.attempt = { ...jobState.attempt, token: null };
+  }
+  jobState.credentialsRemovedAt = new Date().toISOString();
+}
+
+async function scrubPreservedWorkspaceCredential(preserved) {
+  const workspaceDir = path.resolve(String(preserved?.workspaceDir || ""));
+  if (path.basename(workspaceDir) !== "workspace") return;
+  const tempDir = path.dirname(workspaceDir);
+  try {
+    resolveJobTempDir({ tempDir });
+  } catch {
+    return;
+  }
+  const credentialState = {
+    tempDir,
+    authFile: path.join(tempDir, "job-auth.json"),
+  };
+  await scrubJobCredentials(credentialState);
+  preserved.credentialsRemovedAt = credentialState.credentialsRemovedAt;
+}
+
+function resolveJobTempDir(jobState) {
   const tempRoot = path.resolve(os.tmpdir());
   const tempDir = path.resolve(String(jobState?.tempDir || ""));
   if (
@@ -1482,7 +1539,7 @@ async function cleanupJobFiles(jobState) {
   ) {
     throw new Error("Refused to remove an unrecognized Workshop directory.");
   }
-  await fs.rm(tempDir, { recursive: true, force: true });
+  return tempDir;
 }
 
 export function detectSponsorAgentSession({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.2.58",
+  "version": "0.2.59",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {