@andrian.yablonskyy/thub-coordinator 1.0.10 → 1.0.12

package/README.md

@@ -102,7 +102,7 @@ thub-admin group add ci-nightly --comment "shared CI pool"
 thub-admin group list
 thub-admin group remove <groupId>
 
-# The Coordinator is only ever updated by hand (never from the dashboard).
+# Update the Coordinator by hand (the dashboard's "Update app" button does the same through a root helper).
 thub-admin check-update                  # installed vs latest published version
 thub-admin self-update [--to <x.y.z>]    # sudo npm i -g; the postinstall restarts the service
 ```
@@ -157,14 +157,14 @@ Server-rendered Pug templates styled with Bootstrap 5.3, with a little vanilla J
 | `/admin/agents` | Register/revoke CI and developer agents; token shown once. Shows each agent's last reported version. |
 | `/profile` | Every logged-in user's own account settings: display name, avatar, timezone (renders every dashboard timestamp), theme, idle session timeout, password change. |
 
-**Resource card.** Clicking a resource on `/` or `/resources` opens a card with its name, type, status, Client version, IP addresses, labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts.
+**Resource card.** Clicking a resource on `/` or `/resources` opens a card with its name, type, status, Client version, IP addresses, capabilities (reported at registration: HW udev devices with a **missing** flag for any whose device node doesn't exist, relay channels and power control; SW image, source and limits), labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts.
 
 The Coordinator's own version (`ver. X.Y.Z`) is shown under the TestHub logo, top left of every page.
 
-**Versions and self-update.** The Coordinator checks the npm registry for the latest Coordinator, Agent and Client every `updates.checkIntervalHours` (default 6, `0` disables; `updates.registry` for a private mirror) and on **Check for updates**. A newer Coordinator shows as a badge under the logo; Agents and Resources show each one's version with an **update available** or pending **→ vX.Y.Z** badge. Admins request self-updates per agent/resource (**Update**, which becomes **Cancel update**) or with **Update all agents** / **Update all clients**, always to the latest version:
+**Versions and self-update.** The Coordinator checks the npm registry for the latest Coordinator, Agent and Client every `updates.checkIntervalHours` (default 6, `0` disables; `updates.registry` for a private mirror) and on **Check for updates**. A newer Coordinator shows as an **Update app to X.Y.Z** button in the navbar for admins (a badge under the logo for viewers); Agents and Resources show each one's version with an **update available** or pending **→ vX.Y.Z** badge. Admins request self-updates per agent/resource (**Update**, which becomes **Cancel update**) or with **Update all agents** / **Update all clients**, always to the latest version:
 - Clients get a `self-update` command on their next heartbeat and install it through their root `thub-client-update` helper, once none of the host's instances is busy.
 - Agents install it at the start of their next run (`GET /api/v1/agents/me/update`), then re-run the command on the new version.
-- The Coordinator itself is updated by hand only: `thub-admin self-update`.
+- The Coordinator itself: the **Update app** button writes `<dataDir>/update-request.json`; the root `thub-coordinator-update.path` unit (installed by `sudo npm i -g`) runs `npm i -g` for it, and the postinstall restarts the service (the dashboard and API are briefly down). Logs: `journalctl -u thub-coordinator-update`. Without that unit, use `thub-admin self-update` on the host.
 
 A request is cleared when the Agent/Client reports the new version.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/scripts/install-systemd-unit.js

@@ -24,7 +24,12 @@ const fs = require('node:fs'),
   UNIT_SRC = path.join(__dirname, '..', 'systemd', UNIT_NAME),
   SERVER_PATH = path.join(__dirname, '..', 'src', 'server.js'),
   UNIT_DEST = `/etc/systemd/system/${UNIT_NAME}`,
-  MANUAL_HINT = 'sudo npm i -g @andrian.yablonskyy/thub-coordinator';
+  MANUAL_HINT = 'sudo npm i -g @andrian.yablonskyy/thub-coordinator',
+  // Root-side self-update (README §10.2): the path unit watches the update
+  // request the dashboard writes, the service installs it.
+  UPDATE_PATH_UNIT = 'thub-coordinator-update.path',
+  UPDATE_SERVICE_UNIT = 'thub-coordinator-update.service',
+  UPDATE_HELPER = path.join(__dirname, 'self-update-helper.js');
 
 // The checked-in unit only has placeholders — fill in the target user and
 // wherever *this* install's node and server.js actually are, so it works
@@ -38,6 +43,19 @@ function renderUnit(user, paths){
     .replace(/^ReadWritePaths=.*$/m, `ReadWritePaths=${paths.dataDir}`);
 }
 
+function renderUpdateUnits(user, paths){
+  const nodeDir = path.dirname(process.execPath),
+    unitPath = (name) => path.join(__dirname, '..', 'systemd', name);
+  return {
+    [UPDATE_PATH_UNIT]: fs.readFileSync(unitPath(UPDATE_PATH_UNIT), 'utf8')
+      .replace(/^PathModified=.*$/m, `PathModified=${paths.updateRequestFile}`),
+    // npm is a `#!/usr/bin/env node` script, so this node goes first on PATH.
+    [UPDATE_SERVICE_UNIT]: fs.readFileSync(unitPath(UPDATE_SERVICE_UNIT), 'utf8')
+      .replace(/^Environment=PATH=.*$/m, `Environment=PATH=${nodeDir}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`)
+      .replace(/^ExecStart=.*$/m, `ExecStart=${process.execPath} ${UPDATE_HELPER} ${paths.updateRequestFile} ${user.name}`)
+  };
+}
+
 // Best-effort, never fails the `npm install` itself. Runs after
 // install-default-config.js, so the config and data dirs the unit points
 // at already exist. `restart` (not `start`) so an upgrade picks up the
@@ -51,12 +69,18 @@ function main(){
     return;
   }
 
-  const user = resolveTargetUser();
+  const user = resolveTargetUser(),
+    paths = targetPaths(user);
   let step = 'write';
   try {
-    fs.writeFileSync(UNIT_DEST, renderUnit(user, targetPaths(user)));
+    fs.writeFileSync(UNIT_DEST, renderUnit(user, paths));
+    for (const [name, content]of Object.entries(renderUpdateUnits(user, paths))){
+      fs.writeFileSync(`/etc/systemd/system/${name}`, content);
+    }
     step = 'daemon-reload';
     execFileSync('systemctl', ['daemon-reload'], { stdio: 'ignore' });
+    step = `enable ${UPDATE_PATH_UNIT}`;
+    execFileSync('systemctl', ['enable', '--now', UPDATE_PATH_UNIT], { stdio: 'ignore' });
     step = 'enable';
     execFileSync('systemctl', ['enable', UNIT_NAME], { stdio: 'ignore' });
     step = 'restart';

package/scripts/install-target.js

@@ -66,6 +66,9 @@ function targetPaths(user){
     configPath,
     defaultDataDir,
     dataDir,
+    // Written by the dashboard's "Update app" button, watched by
+    // thub-coordinator-update.path (README §10.2).
+    updateRequestFile: path.join(dataDir, 'update-request.json'),
     dataSubdirs: ['artifacts', 'avatars', 'work'].map((d) => path.join(dataDir, d))
   };
 }

package/scripts/self-update-helper.js

@@ -0,0 +1,67 @@
+/**
+ * @file        scripts/self-update-helper.js
+ * @description Root side of the Coordinator's self-update (README §10.2): run by thub-coordinator-update.service
+ *              when the dashboard writes an update request, installs the requested version with npm i -g
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const fs = require('node:fs'),
+  { PACKAGES, isValidVersion, compareVersions, npmInstallGlobal } = require('@andrian.yablonskyy/thub-common'),
+  { version: installedVersion } = require('../package.json');
+
+// argv: <request file> <user the Coordinator runs as>. The request file
+// is written by the (unprivileged) Coordinator, so only its `version` is
+// used, and only if it's a plain semver — the package is fixed.
+function main(){
+  const [requestFile, user] = process.argv.slice(2);
+  if (!requestFile || !user){
+    console.error('usage: self-update-helper.js <request file> <user>');
+    return 2;
+  }
+
+  let request;
+  try {
+    request = JSON.parse(fs.readFileSync(requestFile, 'utf8'));
+  }
+  catch (err){
+    // Deleted by a previous run (PathModified= also fires on removal).
+    if (err.code === 'ENOENT'){
+      return 0;
+    }
+    console.error(`thub-coordinator-update: unreadable request ${requestFile}: ${err.message}`);
+    fs.rmSync(requestFile, { force: true });
+    return 1;
+  }
+  fs.rmSync(requestFile, { force: true });
+
+  const target = request?.version;
+  if (!isValidVersion(target)){
+    console.error('thub-coordinator-update: ignoring request with an invalid version');
+    return 1;
+  }
+  if (compareVersions(installedVersion, target) >= 0){
+    console.log(`thub-coordinator-update: already on v${installedVersion} (requested v${target})`);
+    return 0;
+  }
+
+  console.log(`thub-coordinator-update: v${installedVersion} -> v${target} (requested by ${request.requestedBy || 'the dashboard'})`);
+  // SUDO_USER makes the postinstall scripts target the Coordinator's user,
+  // as a `sudo npm i -g` by that user would (install-target.js); the
+  // postinstall then restarts thub-coordinator on the new version.
+  const status = npmInstallGlobal(PACKAGES.coordinator, target, { env: { ...process.env, SUDO_USER: user } });
+  if (status !== 0){
+    console.error(`thub-coordinator-update: npm i -g failed (exit ${status})`);
+  }
+  return status;
+}
+
+process.exit(main());

package/src/api/resource.js

@@ -65,6 +65,7 @@ function createResourceRouter({ services, config }){
         labels: labels || capabilities?.labels || [],
         groups: groups || [],
         hostInfo,
+        capabilities,
         remoteAddr: req.ip,
         clientVersion: appVersion(req, 'client')
       });

package/src/db/migrations/011_add_capabilities.sql

@@ -0,0 +1,5 @@
+-- What the Client reported it can drive at registration (README §5.1,
+-- §10): its udev devices (with whether each is present), relays and power
+-- control for HW, or emulator image and limits for SW. JSON, NULL for
+-- Clients too old to report it.
+ALTER TABLE resources ADD COLUMN capabilities TEXT;

package/src/services/registry.js

@@ -25,7 +25,8 @@ function rowToResource(row){
     ...row,
     labels: JSON.parse(row.labels || '[]'),
     group_ids: JSON.parse(row.group_ids || '[]'),
-    host_info: row.host_info ? JSON.parse(row.host_info) : null
+    host_info: row.host_info ? JSON.parse(row.host_info) : null,
+    capabilities: row.capabilities ? JSON.parse(row.capabilities) : null
   };
 }
 
@@ -51,6 +52,52 @@ function normalizeRemoteAddr(addr){
   return typeof addr === 'string' && addr ? addr.replace(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/, '$1') : null;
 }
 
+// `capabilities` comes straight from the Client and is rendered on the
+// dashboard, so keep only the known shape, as plain strings/numbers/bools.
+const MAX_DEVICES = 8,
+  str = (v, max = 256) => (typeof v === 'string' && v ? v.slice(0, max) : null),
+  num = (v) => (Number.isFinite(v) ? v : null),
+  capList = (v) => (Array.isArray(v) ? v.slice(0, MAX_DEVICES) : []),
+  device = (d) => ({
+    path: str(d?.path),
+    index: num(d?.index),
+    serial: str(d?.serial, 64),
+    baudRate: num(d?.baudRate),
+    present: typeof d?.present === 'boolean' ? d.present : null
+  });
+
+function sanitizeCapabilities(caps){
+  if (!caps || typeof caps !== 'object'){
+    return null;
+  }
+  if (caps.sw && typeof caps.sw === 'object'){
+    const sw = caps.sw;
+    return {
+      sw: {
+        image: str(sw.image),
+        registry: str(sw.registry),
+        allowDockerHub: sw.allowDockerHub === true,
+        cpus: num(sw.cpus),
+        memory: str(sw.memory, 16)
+      }
+    };
+  }
+  if (caps.hw && typeof caps.hw === 'object'){
+    const hw = caps.hw,
+      power = hw.power && typeof hw.power === 'object' ? hw.power : null;
+    return {
+      hw: {
+        stlinks: capList(hw.stlinks).map(device),
+        uarts: capList(hw.uarts).map(device),
+        usbs: capList(hw.usbs).map(device),
+        relays: capList(hw.relays).map((r) => ({ channel: num(r?.channel), baseUrl: str(r?.baseUrl) })),
+        power: power ? { method: str(power.method, 32), hub: str(power.hub, 64), port: num(power.port) } : null
+      }
+    };
+  }
+  return null;
+}
+
 function createRegistryService(db, { bus, events }){
   function get(id){
     return rowToResource(db.prepare('SELECT * FROM resources WHERE id = ?').get(id));
@@ -106,10 +153,12 @@ function createRegistryService(db, { bus, events }){
   // this registration is allowed to reclaim it. Anything else (IDLE, BUSY,
   // MAINTENANCE, REGISTERED-but-just-created) means a process might still
   // be actively using that identity, so it stays a hard conflict.
-  function registerAuto({ clientId, name, type, labels = [], groups = [], hostInfo, remoteAddr, clientVersion = null }){
+  function registerAuto({ clientId, name, type, labels = [], groups = [], hostInfo, capabilities, remoteAddr, clientVersion = null }){
     const resourceToken = generateToken('res'),
       remote = normalizeRemoteAddr(remoteAddr);
     hostInfo = { ...(hostInfo || {}), addresses: sanitizeAddresses(hostInfo?.addresses) || [] };
+    const caps = sanitizeCapabilities(capabilities),
+      capsJson = caps ? JSON.stringify(caps) : null;
     let existing = getByClientId(clientId);
 
     if (!existing){
@@ -157,7 +206,7 @@ function createRegistryService(db, { bus, events }){
       db.prepare(
         `UPDATE resources
          SET token_hash = ?, client_id = ?, name = ?, type = ?, labels = ?, group_ids = ?, host_info = ?,
-             remote_addr = ?, client_version = ?, status = ?, busy_source = NULL, busy_reason = NULL
+             remote_addr = ?, client_version = ?, capabilities = ?, status = ?, busy_source = NULL, busy_reason = NULL
          WHERE id = ?`
       ).run(
         hashToken(resourceToken),
@@ -169,6 +218,7 @@ function createRegistryService(db, { bus, events }){
         JSON.stringify(hostInfo),
         remote,
         clientVersion,
+        capsJson,
         nextStatus,
         existing.id
       );
@@ -187,8 +237,9 @@ function createRegistryService(db, { bus, events }){
 
     const id = `res_${uuid()}`;
     db.prepare(
-      `INSERT INTO resources (id, name, type, status, labels, group_ids, host_info, remote_addr, client_version, token_hash, client_id, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      `INSERT INTO resources (id, name, type, status, labels, group_ids, host_info, remote_addr, client_version, capabilities,
+                              token_hash, client_id, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
     ).run(
       id,
       name,
@@ -199,6 +250,7 @@ function createRegistryService(db, { bus, events }){
       JSON.stringify(hostInfo),
       remote,
       clientVersion,
+      capsJson,
       hashToken(resourceToken),
       clientId,
       new Date().toISOString()

package/src/services/updates.js

@@ -13,15 +13,21 @@
 
 'use strict';
 
-const { PACKAGES, fetchLatestVersion, defaultRegistry, isNewer } = require('@andrian.yablonskyy/thub-common'),
+const fs = require('node:fs'),
+  path = require('node:path'),
+  { PACKAGES, fetchLatestVersion, defaultRegistry, isNewer } = require('@andrian.yablonskyy/thub-common'),
   { version: coordinatorVersion } = require('../../package.json');
 
+// Installed by scripts/install-systemd-unit.js; runs the actual `npm i -g`
+// as root when the dashboard writes an update request (README §10.2).
+const UPDATE_PATH_UNIT = '/etc/systemd/system/thub-coordinator-update.path';
+
 // Latest published versions, refreshed every `updates.checkIntervalHours`
 // and on demand from the dashboard. Kept in memory only — a restart just
 // checks again.
 function createUpdatesService({ config }){
   const registry = config.updates.registry || defaultRegistry(),
-    state = { latest: {}, checkedAt: null, error: null };
+    state = { latest: {}, checkedAt: null, error: null, coordinatorPending: null };
   let inFlight = null;
 
   async function checkNow(){
@@ -55,6 +61,28 @@ function createUpdatesService({ config }){
     };
   }
 
+  // Navbar "Update app" button: hand the latest version to the root
+  // thub-coordinator-update helper, whose install restarts this process
+  // (so `coordinatorPending` only lasts until then).
+  function requestCoordinatorUpdate(requestedBy){
+    const target = status().coordinatorUpdate;
+    if (!target){
+      throw Object.assign(new Error(`Already on the latest version (v${coordinatorVersion}).`), { status: 409 });
+    }
+    if (!fs.existsSync(UPDATE_PATH_UNIT)){
+      throw Object.assign(
+        new Error(`Self-update isn't installed on this host (${UPDATE_PATH_UNIT}) — update by hand: thub-admin self-update`),
+        { status: 501 }
+      );
+    }
+    fs.writeFileSync(
+      path.join(config.dataDir, 'update-request.json'),
+      JSON.stringify({ version: target, requestedBy, requestedAt: new Date().toISOString() }) + '\n'
+    );
+    state.coordinatorPending = target;
+    return target;
+  }
+
   // The version a self-update request targets: the latest known one,
   // checking first if nothing has been fetched yet.
   async function targetVersion(app){
@@ -77,7 +105,7 @@ function createUpdatesService({ config }){
     timer.unref?.();
   }
 
-  return { checkNow, status, targetVersion, start };
+  return { checkNow, status, targetVersion, requestCoordinatorUpdate, start };
 }
 
 module.exports = { createUpdatesService };

package/src/web/routes.js

@@ -60,6 +60,7 @@ function createWebRouter({ services, config }){
     // Latest published versions (README §10.2) — navbar, Agents, Resources.
     res.locals.updates = services.updates.status();
     res.locals.isNewer = isNewer;
+    res.locals.currentPath = req.originalUrl;
     if (req.session){
       req.session.flash = [];
     }
@@ -259,6 +260,12 @@ function createWebRouter({ services, config }){
     return s.error ? `Version check: ${found || 'nothing found'} (errors: ${s.error})` : `Latest versions: ${found}.`;
   }));
 
+  router.post('/updates/coordinator', requireAdminRole, updateAction(async (req) => {
+    const version = services.updates.requestCoordinatorUpdate(req.session.user.username);
+    console.log(`Coordinator self-update to v${version} requested by ${req.session.user.username}`);
+    return `Updating the Coordinator to v${version} — the dashboard restarts in a minute or two; reload the page then.`;
+  }));
+
   router.post('/resources/update-all', requireAdminRole, updateAction(async () => {
     const version = await services.updates.targetVersion('client'),
       n = services.registry.requestUpdateAll(version);

package/systemd/thub-coordinator-update.path

@@ -0,0 +1,13 @@
+[Unit]
+Description=TestHub Coordinator self-update request watcher
+
+# PathModified= is rewritten by scripts/install-systemd-unit.js to the
+# update-request.json in the Coordinator's dataDir. The dashboard's
+# "Update app" button writes it; this starts thub-coordinator-update.service
+# (as root) to install the requested version.
+[Path]
+PathModified=/var/lib/thub/.thub/update-request.json
+Unit=thub-coordinator-update.service
+
+[Install]
+WantedBy=multi-user.target

package/systemd/thub-coordinator-update.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=TestHub Coordinator self-update
+After=network-online.target
+Wants=network-online.target
+
+# ExecStart and Environment= are rewritten by scripts/install-systemd-unit.js
+# to this install's real node and helper paths, the request file, and the
+# user the Coordinator runs as. Runs as root: `npm i -g` writes the global
+# node_modules, and its postinstall re-renders these units and restarts
+# thub-coordinator. The helper only ever installs
+# @andrian.yablonskyy/thub-coordinator, at a strictly validated version.
+[Service]
+Type=oneshot
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/usr/bin/node /usr/lib/node_modules/@andrian.yablonskyy/thub-coordinator/scripts/self-update-helper.js /var/lib/thub/.thub/update-request.json thub
+TimeoutStartSec=15min

package/views/layout.pug

@@ -14,11 +14,11 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           span TestHub
           small.text-body-secondary.fw-normal.mt-1(style="font-size: .7rem;")
             | ver. #{coordinatorVersion}
-            if user && updates.coordinatorUpdate
+            if user && user.role !== 'admin' && updates.coordinatorUpdate
               span.badge.text-bg-warning.ms-1(
                 data-bs-toggle="tooltip"
                 data-bs-placement="bottom"
-                data-bs-title="Update the Coordinator by hand on its host: thub-admin self-update"
+                data-bs-title="An admin can update the Coordinator from the navbar"
               )= `v${updates.coordinatorUpdate} available`
         button.navbar-toggler(type="button" data-bs-toggle="collapse" data-bs-target="#nav")
           span.navbar-toggler-icon
@@ -37,6 +37,27 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                 li.nav-item
                   a.nav-link(href="/admin/agents" class=active === 'agents' ? 'active' : '') Agents
           ul.navbar-nav
+            if user && user.role === 'admin' && updates.coordinatorUpdate
+              li.nav-item.d-flex.align-items-center.me-3
+                if updates.coordinatorPending
+                  button.btn.btn-sm.btn-warning(type="button" disabled)
+                    span.spinner-border.spinner-border-sm.me-1(aria-hidden="true")
+                    = `Updating app to ${updates.coordinatorPending}…`
+                else
+                  form(
+                    method="post"
+                    action="/updates/coordinator"
+                    onsubmit=`return confirm('Update the Coordinator to v${updates.coordinatorUpdate}? It restarts, and the dashboard and API are briefly unavailable.')`
+                  )
+                    input(type="hidden" name="returnTo" value=currentPath)
+                    button.btn.btn-sm.btn-warning(
+                      type="submit"
+                      data-bs-toggle="tooltip"
+                      data-bs-placement="bottom"
+                      data-bs-title=`Installed v${coordinatorVersion} — installs v${updates.coordinatorUpdate} and restarts the Coordinator`
+                    )
+                      i.bi.bi-cloud-download.me-1
+                      = `Update app to ${updates.coordinatorUpdate}`
             li.nav-item.d-flex.align-items-center.me-3
               button#theme-toggle.btn.btn-sm.btn-outline-secondary(
                 type="button"

package/views/mixins/resource.pug

@@ -33,6 +33,62 @@ mixin resourceActions(r, returnTo)
       i.bi.bi-arrow-repeat
   +updateButton(`/resources/${r.id}/update`, r.update_to, returnTo)
 
+//- One udev device line: path (or udev index / ST-Link serial), extra
+//- detail, and whether the node was present when the Client registered.
+mixin capDevice(d, detail)
+  li
+    code= d.path || (d.serial ? `serial ${d.serial}` : `index ${d.index}`)
+    if detail
+      span.text-body-secondary.small.ms-2= detail
+    if d.present === false
+      span.badge.text-bg-danger.ms-2(
+        data-bs-toggle="tooltip"
+        data-bs-title="The device node didn't exist when the Client registered — check the adapter and udev rules"
+      ) missing
+
+//- What the Client reported it can drive at registration (HW: udev
+//- devices, relays, power; SW: emulator image and limits).
+mixin capabilitiesList(caps)
+  if !caps
+    span.text-body-secondary —
+  else if caps.sw
+    ul.list-unstyled.mb-0
+      li
+        span.text-body-secondary.small.me-2 Image
+        code= caps.sw.image || '—'
+      li
+        span.text-body-secondary.small.me-2 Source
+        = caps.sw.registry ? caps.sw.registry : 'no local registry'
+        = caps.sw.allowDockerHub ? ', then Docker Hub' : ' (Docker Hub off)'
+      li
+        span.text-body-secondary.small.me-2 Limits
+        = `${caps.sw.cpus || '—'} CPU, ${caps.sw.memory || '—'}`
+  else if caps.hw
+    - const kinds = [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'USB']]
+    - const empty = kinds.every(([k]) => !caps.hw[k].length) && !caps.hw.relays.length && !caps.hw.power
+    if empty
+      span.text-body-secondary no devices configured
+    each pair in kinds
+      if caps.hw[pair[0]].length
+        .small.text-body-secondary.mt-1= pair[1]
+        ul.list-unstyled.mb-0.ms-2
+          each d in caps.hw[pair[0]]
+            +capDevice(d, pair[0] === 'uarts' && d.baudRate ? `${d.baudRate} baud` : null)
+    if caps.hw.relays.length
+      .small.text-body-secondary.mt-1 Relays
+      ul.list-unstyled.mb-0.ms-2
+        each rl in caps.hw.relays
+          li
+            = `channel ${rl.channel}`
+            if rl.baseUrl
+              code.ms-2= rl.baseUrl
+    if caps.hw.power
+      .small.text-body-secondary.mt-1 Power
+      .ms-2
+        = caps.hw.power.method
+        if caps.hw.power.method === 'uhubctl' && caps.hw.power.hub
+          span.text-body-secondary.small.ms-2= `hub ${caps.hw.power.hub} port ${caps.hw.power.port}`
+
 mixin resourceCard(r, groupsById, returnTo)
   - const isLoopback = (a) => /^127\./.test(a) || a === '::1' || a === 'localhost'
   - const local = ((r.host_info && r.host_info.addresses) || []).filter((a) => !isLoopback(a.address))
@@ -69,6 +125,9 @@ mixin resourceCard(r, groupsById, returnTo)
                       data-bs-toggle="tooltip"
                       data-bs-title="The address the Coordinator last saw this Client connect from"
                     ) external
+            dt.col-sm-4 Capabilities
+            dd.col-sm-8
+              +capabilitiesList(r.capabilities)
             dt.col-sm-4 Labels
             dd.col-sm-8
               if r.labels.length