@andrian.yablonskyy/thub-coordinator 1.0.0

package/README.md

@@ -0,0 +1,157 @@
+# @andrian.yablonskyy/thub-coordinator
+
+The Coordinator component of [TestHub](https://github.com/andrianyablonskyy/thub) — a self-hosted job network that lets CI/CD pipelines and individual developers run firmware tests on real hardware or emulators in a private lab. The Coordinator owns the job queue, the resource registry, the scheduler, log/artifact storage and the web dashboard. It's the one component you self-host on a reachable server; the [Agent](https://github.com/andrianyablonskyy/thub-agent) and [Client](https://github.com/andrianyablonskyy/thub-client) both talk to it over HTTPS and don't need to be anywhere near it.
+
+See the [main TestHub repo](https://github.com/andrianyablonskyy/thub) for the full system architecture, deployment diagrams, and how this fits together with the Agent and Client.
+
+## Install
+
+```bash
+npm install @andrian.yablonskyy/thub-coordinator
+```
+
+Or clone this repo directly and run it from source (see below).
+
+## Configuration
+
+The Coordinator loads a **JSON** config file (no YAML support here, unlike the Client). Resolution order, first match wins: `THUB_COORDINATOR_CONFIG` env var path → the bundled `config.json` default. There is no other automatic fallback path — a real deployment always sets `THUB_COORDINATOR_CONFIG` explicitly.
+
+```json
+{
+  "listen": "127.0.0.1:8080",
+  "publicUrl": "https://thub.example.com",
+  "dataDir": "/var/lib/thub",
+  "sessionSecret": "change-me-to-a-long-random-string",
+  "clientJoinKey": "change-me-to-a-long-random-string",
+  "heartbeat": { "intervalSec": 10, "missedLimit": 3, "sweepIntervalSec": 5 },
+  "scheduler": { "assignAckTimeoutSec": 15, "requeueOnLost": true, "maxQueuedPerAgent": 20, "tickIntervalSec": 10 },
+  "jobs": { "defaultTimeoutSec": 1800, "maxTimeoutSec": 14400 },
+  "retention": { "logRetentionDays": 14, "artifactRetentionDays": 30 },
+  "artifacts": { "maxUploadMb": 512, "linkTtlHours": 168 }
+}
+```
+
+`sessionSecret` signs the dashboard's session cookie and the HMAC on artifact download links; `clientJoinKey` is the shared secret Clients self-register with — omit or leave `null` to disable auto-registration entirely. Individual `THUB_LISTEN` / `THUB_PUBLIC_URL` / `THUB_DATA_DIR` / `THUB_SESSION_SECRET` / `THUB_CLIENT_JOIN_KEY` env vars override whatever the file set.
+
+## Running it
+
+```bash
+# First run: no admin_users row exists yet, so either set a bootstrap
+# password (creates user "admin") or use thub-admin afterwards.
+THUB_COORDINATOR_CONFIG=/etc/thub/coordinator.json \
+THUB_BOOTSTRAP_ADMIN_PASSWORD=correct-horse-battery-staple \
+node src/server.js
+# -> Reset password for admin user "admin" from THUB_BOOTSTRAP_ADMIN_PASSWORD
+# -> TestHub Coordinator listening on http://127.0.0.1:8080
+```
+
+`THUB_BOOTSTRAP_ADMIN_PASSWORD` is more than a first-run convenience — it's an **exceptional password reset**, checked on every startup, not only when `admin_users` is empty. Whenever it's set, the named account (`THUB_BOOTSTRAP_ADMIN_USER`, default `admin`) has its password forced to it — creating that user as `admin` if it doesn't exist yet, or just resetting the password (never the role) if it does. With it unset, login uses whatever's already in the DB, as normal — unset it again once you're back in, or every subsequent restart re-applies it.
+
+Or just `npm start` / `npm run dev` (auto-restart on change) against the bundled `config.json` default for local development.
+
+## `thub-admin` — the local operator CLI
+
+Talks to the Coordinator's SQLite database directly — no running server required, and no HTTP auth of its own, so it's meant to be run on the Coordinator host itself:
+
+```bash
+# Create additional dashboard users (first one can also come from
+# THUB_BOOTSTRAP_ADMIN_PASSWORD above).
+node bin/thub-admin.js create-admin alice s3cret --role admin
+
+# Register a CI or developer identity — the only credential still issued
+# by an admin; the token is shown once.
+node bin/thub-admin.js agent add ci-firmware --kind ci
+# -> Agent agt_... created. Token (shown once): agt_...
+
+# Mint the shared secret Clients use to self-register, and put it in both
+# the Coordinator's clientJoinKey and every Client's joinKey.
+node bin/thub-admin.js join-key generate
+
+# Take a resource out of rotation without an active job (or bring it back).
+node bin/thub-admin.js resource maintenance res_abc123 --on
+
+# Cancel every queued/assigned/preparing/running job.
+node bin/thub-admin.js jobs reset --yes
+
+# Permanently delete every finished job, plus its logs and artifacts on disk.
+node bin/thub-admin.js jobs clean --yes
+
+# Resource groups: constrain which resources a job can schedule onto.
+node bin/thub-admin.js group add ci-nightly --comment "shared CI pool"
+node bin/thub-admin.js group list
+node bin/thub-admin.js group remove <groupId>
+```
+
+Both `jobs reset` and `jobs clean` refuse to run without `--yes` — there's no undo for either, especially `clean`.
+
+## API
+
+All endpoints are under `/api/v1`, JSON, and require `Authorization: Bearer <token>` (the dashboard is a separate session-based auth path).
+
+**Agent endpoints** (used by [thub-agent](https://github.com/andrianyablonskyy/thub-agent)):
+
+| Method | Path | Description |
+|---|---|---|
+| `POST` | `/jobs` | Submit a job spec. Returns `201 {jobId, state, webUrl}`. |
+| `GET` | `/jobs/:id` | Job details and current state. |
+| `GET` | `/jobs?state=&source=&limit=` | List jobs. |
+| `POST` | `/jobs/:id/cancel` | Cancel a job (owner or admin). |
+| `GET` | `/jobs/:id/logs?after=<seq>&limit=` | Paged log lines (polling fallback). |
+| `GET` | `/jobs/:id/logs/stream` | Server-Sent Events: `log`, `state`, `end`. Honors `Last-Event-ID` for resume. |
+| `GET` | `/jobs/:id/artifacts` | Artifact list with signed download URLs. |
+| `GET` | `/resources` | Resources with status (read-only). |
+
+**Resource (Client) endpoints** (used by [thub-client](https://github.com/andrianyablonskyy/thub-client)):
+
+| Method | Path | Description |
+|---|---|---|
+| `POST` | `/resources/register` | Self-register (every start/restart) using the shared `clientJoinKey`; upserts by `clientId`. |
+| `POST` | `/resources/:id/heartbeat` | Heartbeat and self-reported state; response may carry `commands[]`. |
+| `POST` | `/resources/:id/status` | Explicit status change, e.g. a local lock. |
+| `GET` | `/resources/:id/jobs/next?wait=30` | Long-poll for an assigned job; `204` when nothing arrived within `wait` seconds. |
+| `POST` | `/jobs/:id/accept` | Acknowledge assignment. |
+| `POST` | `/jobs/:id/state` | Progress: `PREPARING`, `RUNNING`, plus optional `message`. |
+| `POST` | `/jobs/:id/logs` | Batch of log lines. |
+| `POST` | `/jobs/:id/artifacts` | Multipart upload of result files. |
+| `POST` | `/jobs/:id/result` | Final verdict `{state, exitCode, summary}`. |
+
+**Admin endpoints** (dashboard-session-authenticated, not bearer tokens): `/admin/agents`, `/admin/resources/:id/maintenance`, `/admin/resources/:id/rotate-token`, `/admin/jobs/reset-queue`, `/admin/jobs/clean-history`, `/admin/groups`.
+
+## Web dashboard
+
+Server-rendered Pug templates styled with Bootstrap 5.3, with a little vanilla JavaScript for live updates via the same SSE endpoints the Agent uses.
+
+| Page | Content |
+|---|---|
+| `/` | Resource cards by status, queue length, jobs in the last 24 h. |
+| `/resources` | Type, labels, groups, status, busy source/reason, last heartbeat age; admin maintenance/rotate-token actions. |
+| `/groups` | Resource groups — id/name/comment, member count; admin create/rename/delete. Membership itself is set per-resource in the Client's own config. |
+| `/jobs` | Filterable job list (state, source, resource), with the job's `user` label if set; admin **Reset queue** / **Clean history**. |
+| `/jobs/:id` | Spec, timeline, live log viewer with stream filter, artifact downloads, cancel button. |
+| `/admin/agents` | Register/revoke CI and developer agents; token shown once. |
+| `/profile` | Every logged-in user's own account settings: display name, avatar, timezone (renders every dashboard timestamp), theme, idle session timeout, password change. |
+
+## Data storage
+
+SQLite via `better-sqlite3`, WAL mode. Schema migrations are plain numbered SQL files in `src/db/migrations/`, applied automatically at startup. `job_logs` rows are compacted into `artifacts/<jobId>/console.log` when a job finishes and deleted after `logRetentionDays`; artifacts are deleted after `artifactRetentionDays`. See the [main repo's ER diagram](https://github.com/andrianyablonskyy/thub#9-data-storage-sqlite) for the full schema.
+
+## Security notes
+
+- No inbound exposure needed for Clients — they connect outbound only.
+- Tokens (agent, resource) are 256-bit random, stored as SHA-256 hashes, shown once, revocable.
+- A resource token can only act on its own resource and jobs assigned to it; an agent can cancel only its own jobs unless admin.
+- Job specs contain no shell commands — only the fixed entry point of a downloaded test package is ever executed.
+- Artifact downloads are HMAC-signed URLs with expiry.
+- Every state change is written to the `events` table and visible on the dashboard.
+
+## Development
+
+```bash
+npm install
+npm test    # node --test test/*.test.js
+npm run lint
+```
+
+## License
+
+Proprietary — see the header comment in each source file.

package/bin/thub-admin.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+
+/**
+ * @file        packages/coordinator/bin/thub-admin.js
+ * @description Local operator CLI: admin/agent/resource/group/job management, talks to SQLite directly (README §13.1)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+// Local admin tool: operates directly on the Coordinator's SQLite database.
+// Used to bootstrap the first dashboard admin and manage agent tokens.
+// Resources no longer need an admin action to join — a Client registers
+// itself with the shared clientJoinKey (see `join-key generate` below and
+// api/resource.js) — this tool only manages a resource after the fact
+// (maintenance mode).
+
+const { loadConfig } = require('../src/config'),
+  { openDb } = require('../src/db'),
+  { bus } = require('../src/services/bus'),
+  { createEventsService } = require('../src/services/events'),
+  { createRegistryService } = require('../src/services/registry'),
+  { createAgentsService } = require('../src/services/agents'),
+  { createGroupsService } = require('../src/services/groups'),
+  { createAdminUsersService } = require('../src/services/admin-users'),
+  { createArtifactsService } = require('../src/services/artifacts'),
+  { createJobsService } = require('../src/services/jobs'),
+  { generateToken } = require('../src/services/tokens');
+
+function usage(){
+  console.log(`Usage:
+  thub-admin create-admin <username> <password> [--role admin|viewer]
+  thub-admin agent add <name> --kind ci|cli
+  thub-admin join-key generate
+  thub-admin resource maintenance <resourceId> --on|--off
+  thub-admin jobs reset --yes     Cancel every queued/assigned/preparing/running job
+  thub-admin jobs clean --yes     Permanently delete finished jobs, logs and artifacts
+  thub-admin group add <name> [--comment <text>]
+  thub-admin group list
+  thub-admin group remove <groupId>
+`);
+}
+
+function parseFlags(args){
+  const positional = [],
+    flags = {};
+  for (let i = 0; i < args.length; i++){
+    const a = args[i];
+    if (a.startsWith('--')){
+      const key = a.slice(2);
+      if (key === 'label'){
+        flags.label = flags.label || [];
+        flags.label.push(args[++i]);
+      }
+      else if (key === 'on'){
+        flags.on = true;
+      }
+      else if (key === 'off'){
+        flags.on = false;
+      }
+      else if (key === 'yes'){
+        flags.yes = true;
+      }
+      else {
+        flags[key] = args[++i];
+      }
+    }
+    else {
+      positional.push(a);
+    }
+  }
+  return { positional, flags };
+}
+
+function main(){
+  const [, , cmd, sub, ...rest] = process.argv,
+    config = loadConfig(),
+    db = openDb(config.dbPath),
+    events = createEventsService(db),
+    registry = createRegistryService(db, { bus, events }),
+    agents = createAgentsService(db, { events }),
+    adminUsers = createAdminUsersService(db),
+    artifacts = createArtifactsService(db, { config }),
+    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    groups = createGroupsService(db, { events, registry });
+
+  if (cmd === 'create-admin'){
+    const { positional, flags } = parseFlags([sub, ...rest].filter(Boolean)),
+      [username, password] = positional;
+    if (!username || !password){
+      return usage(), process.exit(4);
+    }
+    adminUsers.create({ username, password, role: flags.role || 'admin' });
+    console.log(`Created ${flags.role || 'admin'} user "${username}"`);
+    return;
+  }
+
+  if (cmd === 'agent' && sub === 'add'){
+    const { positional, flags } = parseFlags(rest),
+      [name] = positional;
+    if (!name || !flags.kind){
+      return usage(), process.exit(4);
+    }
+    const { agent, token } = agents.create({ name, kind: flags.kind });
+    console.log(`Agent ${agent.id} created. Token (shown once): ${token}`);
+    return;
+  }
+
+  if (cmd === 'join-key' && sub === 'generate'){
+    const key = generateToken('jk');
+    console.log(`Join key: ${key}`);
+    console.log('Put it in the Coordinator config as "clientJoinKey" (or THUB_CLIENT_JOIN_KEY),');
+    console.log('and on every Client as "joinKey" (or THUB_CLIENT_JOIN_KEY) to let it self-register.');
+    return;
+  }
+
+  if (cmd === 'resource' && sub === 'maintenance'){
+    const { positional, flags } = parseFlags(rest),
+      [resourceId] = positional;
+    if (!resourceId || flags.on === undefined){
+      return usage(), process.exit(4);
+    }
+    registry.setMaintenance(resourceId, flags.on);
+    console.log(`Resource ${resourceId} maintenance ${flags.on ? 'enabled' : 'disabled'}`);
+    return;
+  }
+
+  if (cmd === 'jobs' && sub === 'reset'){
+    const { flags } = parseFlags(rest);
+    if (!flags.yes){
+      console.error('This cancels every queued/assigned/preparing/running job. Re-run with --yes to confirm.');
+      process.exit(4);
+    }
+    const canceled = jobs.resetQueue();
+    console.log(`Canceled ${canceled} active job(s).`);
+    return;
+  }
+
+  if (cmd === 'jobs' && sub === 'clean'){
+    const { flags } = parseFlags(rest);
+    if (!flags.yes){
+      console.error('This permanently deletes finished jobs and their logs/artifacts. Re-run with --yes to confirm.');
+      process.exit(4);
+    }
+    const deleted = jobs.cleanHistory();
+    console.log(`Deleted ${deleted} finished job(s) and their logs/artifacts.`);
+    return;
+  }
+
+  if (cmd === 'group' && sub === 'add'){
+    const { positional, flags } = parseFlags(rest),
+      [name] = positional;
+    if (!name){
+      return usage(), process.exit(4);
+    }
+    const group = groups.create({ name, comment: flags.comment });
+    console.log(`Group ${group.id} created ("${group.name}"). Use it with: thub run --group ${group.id}`);
+    return;
+  }
+
+  if (cmd === 'group' && sub === 'list'){
+    for (const g of groups.list()){
+      console.log(`${g.id}  ${g.name}${g.comment ? '  — ' + g.comment : ''}`);
+    }
+    return;
+  }
+
+  if (cmd === 'group' && sub === 'remove'){
+    const { positional } = parseFlags(rest),
+      [groupId] = positional;
+    if (!groupId){
+      return usage(), process.exit(4);
+    }
+    groups.remove(groupId);
+    console.log(`Group ${groupId} removed.`);
+    return;
+  }
+
+  usage();
+  process.exit(4);
+}
+
+main();

package/config.json

@@ -0,0 +1,30 @@
+{
+  "listen": "127.0.0.1:8000",
+  "publicUrl": "http://localhost",
+  "dataDir": "./tmp/srv/thub",
+  "sessionSecret": "change-me-to-a-long-random-string",
+  "clientJoinKey": "change-me-to-a-long-random-string",
+  "heartbeat": {
+    "intervalSec": 10,
+    "missedLimit": 3,
+    "sweepIntervalSec": 5
+  },
+  "scheduler": {
+    "assignAckTimeoutSec": 15,
+    "requeueOnLost": true,
+    "maxQueuedPerAgent": 20,
+    "tickIntervalSec": 10
+  },
+  "jobs": {
+    "defaultTimeoutSec": 1800,
+    "maxTimeoutSec": 14400
+  },
+  "retention": {
+    "logRetentionDays": 14,
+    "artifactRetentionDays": 30
+  },
+  "artifacts": {
+    "maxUploadMb": 512,
+    "linkTtlHours": 168
+  }
+}

package/eslint.config.js

@@ -0,0 +1,115 @@
+/**
+ * @file        eslint.config.js
+ * @description ESLint flat config for @andrian.yablonskyy/thub-coordinator: stylistic/promise rules plus Node globals
+ *              for server code and browser globals for the dashboard's public/js scripts.
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const stylistic = require('@stylistic/eslint-plugin'),
+  promise = require('eslint-plugin-promise'),
+  globals = require('globals');
+
+const rules = {
+  // Core JS
+  'prefer-const': 'error',
+  strict: ['error', 'global'],
+  camelcase: [
+    'error',
+    {
+      properties: 'never',
+      ignoreGlobals: true,
+      ignoreDestructuring: true,
+      allow: ['[a-z]+([a-z0-9_])?']
+    }
+  ],
+  'one-var': ['error', { var: 'never', let: 'consecutive', const: 'consecutive' }],
+  'no-var': 'error',
+  // No logging abstraction exists in this codebase — console.log/warn/error
+  // *is* the daemon/server's actual output mechanism, not leftover
+  // debugging. Disallowing it would just mean eslint-disable comments on
+  // every real call site.
+  'no-console': 'off',
+
+  'no-restricted-syntax': [
+    'error',
+    {
+      selector: 'CallExpression[callee.object.name="console"][callee.property.name!=/^(log|warn|error|info|trace)$/]',
+      message: 'Unexpected property on console object was called'
+    }
+  ],
+
+  curly: 'error',
+
+  // Stylistic
+  '@stylistic/indent': ['error', 2],
+  '@stylistic/key-spacing': ['error', { beforeColon: false, afterColon: true, mode: 'strict' }],
+  '@stylistic/keyword-spacing': ['error', { before: false, after: true }],
+  '@stylistic/linebreak-style': ['error', 'unix'],
+  '@stylistic/space-before-function-paren': ['error', { anonymous: 'always', named: 'never', asyncArrow: 'always' }],
+  '@stylistic/space-infix-ops': 'error',
+  '@stylistic/space-before-blocks': ['error', 'never'],
+  '@stylistic/comma-dangle': ['error', 'never'],
+  '@stylistic/max-len': ['error', 160],
+  '@stylistic/no-trailing-spaces': ['error', { skipBlankLines: false }],
+  '@stylistic/no-multiple-empty-lines': ['error', { max: 1 }],
+  '@stylistic/semi': ['error', 'always'],
+  '@stylistic/quotes': ['error', 'single'],
+  '@stylistic/one-var-declaration-per-line': ['error', 'always'],
+  '@stylistic/no-extra-semi': 'error',
+  '@stylistic/no-multi-spaces': 'error',
+  '@stylistic/no-mixed-spaces-and-tabs': 'error',
+  '@stylistic/arrow-parens': ['error', 'always'],
+  '@stylistic/arrow-spacing': ['error', { before: true, after: true }],
+  '@stylistic/block-spacing': 'error',
+  '@stylistic/brace-style': ['error', 'stroustrup'],
+  '@stylistic/comma-spacing': ['error', { before: false, after: true }],
+  '@stylistic/comma-style': ['error', 'last'],
+  '@stylistic/dot-location': ['error', 'property'],
+  '@stylistic/function-call-spacing': ['error', 'never'],
+
+  // Promises
+  'promise/always-return': ['error', { ignoreLastCallback: true }],
+  'promise/param-names': 'off',
+  'promise/catch-or-return': ['error', { allowFinally: true }],
+  'promise/no-native': 'off',
+  'promise/no-nesting': 'off',
+  'promise/no-callback-in-promise': 'off',
+  'promise/avoid-new': 'off',
+  'promise/no-new-statics': 'error',
+  'promise/no-return-in-finally': 'warn',
+  'promise/valid-params': 'warn'
+};
+
+module.exports = [
+  { ignores: ['**/node_modules/**', '.data/**', 'tmp/**'] },
+  {
+    files: ['**/*.{js,cjs,mjs}'],
+    ignores: ['public/js/**'],
+    plugins: { '@stylistic': stylistic, promise },
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'commonjs',
+      globals: { ...globals.node }
+    },
+    rules
+  },
+  {
+    files: ['public/js/**/*.js'],
+    plugins: { '@stylistic': stylistic, promise },
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'script',
+      globals: { ...globals.browser, bootstrap: 'readonly' }
+    },
+    rules
+  }
+];

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@andrian.yablonskyy/thub-coordinator",
+  "version": "1.0.0",
+  "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
+  "main": "src/server.js",
+  "bin": {
+    "thub-admin": "./bin/thub-admin.js"
+  },
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "node --watch src/server.js",
+    "test": "node --test test/*.test.js",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
+  },
+  "dependencies": {
+    "@andrian.yablonskyy/thub-common": "*",
+    "better-sqlite3": "^12.4.1",
+    "express": "^5.1.0",
+    "express-session": "^1.18.2",
+    "js-yaml": "^4.1.0",
+    "multer": "^2.0.2",
+    "pug": "^3.0.3",
+    "uuid": "^11.1.0"
+  },
+  "devDependencies": {
+    "@stylistic/eslint-plugin": "^5.10.0",
+    "eslint": "^10.11.0",
+    "eslint-plugin-promise": "^7.3.0",
+    "globals": "^17.12.0"
+  }
+}

package/public/css/thub.css

@@ -0,0 +1,6 @@
+#log-viewer {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.8125rem;
+  white-space: pre-wrap;
+  word-break: break-all;
+}

package/public/js/copy-to-clipboard.js

@@ -0,0 +1,36 @@
+/**
+ * @file        packages/coordinator/public/js/copy-to-clipboard.js
+ * @description Dashboard: copies an element's data-copy value to the clipboard on click
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+(function (){
+  document.querySelectorAll('[data-copy]').forEach((btn) => {
+    btn.addEventListener('click', async () => {
+      try {
+        await navigator.clipboard.writeText(btn.dataset.copy);
+      }
+      catch {
+        return; // clipboard unavailable (e.g. non-secure context) — fail quietly
+      }
+      const icon = btn.querySelector('i');
+      if (!icon){
+        return;
+      }
+      const original = icon.className;
+      icon.className = 'bi bi-check2';
+      setTimeout(() => {
+        icon.className = original;
+      }, 1200);
+    });
+  });
+})();

package/public/js/log-viewer.js

@@ -0,0 +1,76 @@
+/**
+ * @file        packages/coordinator/public/js/log-viewer.js
+ * @description Dashboard: streams or fetches a job's log output into the log viewer pane
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+(function (){
+  const pre = document.getElementById('log-viewer');
+  if (!pre){
+    return;
+  }
+  const jobId = pre.dataset.jobId,
+    jobActive = pre.dataset.jobActive === 'true',
+    filter = document.getElementById('stream-filter'),
+    lines = [];
+
+  function render(){
+    const wanted = filter.value;
+    pre.textContent = lines
+      .filter((l) => !wanted || l.stream === wanted)
+      .map((l) => `[${l.ts}] [${l.stream}] ${l.line}`)
+      .join('\n');
+    pre.scrollTop = pre.scrollHeight;
+  }
+
+  filter.addEventListener('change', render);
+
+  // Already finished when the page loaded: the output will never change
+  // again, so just fetch it once — no EventSource, no live connection, no
+  // reload. (Opening a stream here used to trigger an auto-reload once it
+  // immediately got the job's "end" event, which reloaded the page, which
+  // re-opened the stream, which reloaded again — an infinite loop for
+  // anyone viewing a finished job.)
+  if (!jobActive){
+    fetch(`/jobs/${jobId}/logs`)
+      .then((r) => r.json())
+      .then(({ lines: fetched }) => {
+        lines.push(...fetched);
+        render();
+      })
+      .catch(() => {});
+    return;
+  }
+
+  const source = new EventSource(`/jobs/${jobId}/stream`);
+  source.addEventListener('log', (e) => {
+    lines.push(JSON.parse(e.data));
+    render();
+  });
+  source.addEventListener('state', (e) => {
+    const { state, resource } = JSON.parse(e.data);
+    lines.push({ ts: new Date().toISOString(), stream: 'state', line: `-> ${state}${resource ? ' on ' + resource : ''}` });
+    render();
+  });
+  source.addEventListener('end', (e) => {
+    const { state } = JSON.parse(e.data);
+    lines.push({ ts: new Date().toISOString(), stream: 'state', line: `job finished: ${state}` });
+    render();
+    source.close();
+    // The job was active when we opened this page and just finished —
+    // reload once to pick up the now-final badge/artifacts list.
+    setTimeout(() => window.location.reload(), 1500);
+  });
+  source.onerror = () => {
+    // EventSource auto-reconnects; nothing to do here.
+  };
+})();

package/public/js/profile-theme.js

@@ -0,0 +1,28 @@
+/**
+ * @file        packages/coordinator/public/js/profile-theme.js
+ * @description Profile page: wires the auto/light/dark buttons to the shared theme setter (theme.js)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+(function (){
+  const buttons = document.querySelectorAll('[data-set-theme]');
+  buttons.forEach((btn) => {
+    btn.addEventListener('click', () => {
+      const theme = btn.dataset.setTheme;
+      window.thubSetTheme(theme);
+      buttons.forEach((b) => {
+        b.classList.toggle('btn-primary', b === btn);
+        b.classList.toggle('btn-outline-secondary', b !== btn);
+      });
+    });
+  });
+})();