@andrian.yablonskyy/thub-coordinator 1.0.31 → 1.0.33

package/README.md

@@ -159,7 +159,7 @@ Server-rendered Pug templates styled with Bootstrap 5.3, with a little vanilla J
 
 Notifications (results of dashboard actions, errors) appear as toasts in the top-right corner and close themselves by severity: **errors stay until closed**, warnings close after **30 s**, info and success after **10 s**. A one-time secret such as a rotated resource token never closes on its own.
 
-**Resource card.** Clicking a resource on `/` or `/resources` opens a card with its name, type, status, host uptime and current task/status with its duration (both from the Client's heartbeats, anchored to the Coordinator's clock; as of the last heartbeat for an OUT_OF_SERVICE resource), Client version, IP addresses, capabilities (reported at registration: HW udev devices with a **missing** flag for any whose device node doesn't exist, relay channels and power control; SW image, source and limits), labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts. Admins get a **Cancel** button on it, enabled only while the Client is doing something: it cancels its current job, releases a manual local lock, or aborts a self-update hold on its host (the last two delivered as `unlock` / `cancel-update` heartbeat commands).
+**Resource card.** Clicking a resource on `/` or `/resources` opens a card with its name, type, status, host uptime and current task/status with its duration (both from the Client's heartbeats, anchored to the Coordinator's clock; as of the last heartbeat for an OUT_OF_SERVICE resource), Client version, IP addresses, capabilities (reported at registration: HW udev devices with a **missing** flag for any whose device node doesn't exist; SW image, source and limits), labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts. Admins get a **Cancel** button on it, enabled only while the Client is doing something: it cancels its current job, releases a manual local lock, or aborts a self-update hold on its host (the last two delivered as `unlock` / `cancel-update` heartbeat commands).
 
 The Coordinator's own version (`ver. X.Y.Z`) is shown under the TestHub logo, top left of every page.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {
@@ -19,7 +19,7 @@
     "lint:fix": "eslint . --fix"
   },
   "dependencies": {
-    "@andrian.yablonskyy/thub-common": "^1.0.26",
+    "@andrian.yablonskyy/thub-common": "^1.0.28",
     "better-sqlite3": "^12.4.1",
     "express": "^5.1.0",
     "express-session": "^1.18.2",

package/public/js/client-config.js

@@ -1,7 +1,7 @@
 /**
  * @file        packages/coordinator/public/js/client-config.js
  * @description Dashboard: the resource card's Capabilities form — add/remove device rows, and turn the form into
- *              the Client's hw/sw config section (JSON) on Save
+ *              an HW Client's hw-devices config section (JSON) on Save
  *
  * @author      Andrian Yablonskyy
  * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
@@ -24,9 +24,6 @@
 
   function rows(form, kind){
     return [...form.querySelectorAll(`[data-table="${kind}"] tbody [data-row]`)].map((tr) => {
-      if (kind === 'relays'){
-        return compact({ channel: num(tr, 'channel'), baseUrl: text(tr, 'baseUrl') });
-      }
       let extra = {};
       try {
         extra = JSON.parse(tr.dataset.extra || '{}');
@@ -44,26 +41,12 @@
     });
   }
 
+  // An HW Client's hw-devices section (the only Clients with a form).
   function sectionFrom(form){
-    if (form.dataset.clientConfig === 'sw'){
-      return compact({
-        image: text(form, 'image'),
-        registry: text(form, 'registry'),
-        cpus: num(form, 'cpus'),
-        memory: text(form, 'memory'),
-        cmd: text(form, 'cmd') ? text(form, 'cmd').split(/\s+/) : undefined,
-        allowDockerHub: val(form, 'allowDockerHub').checked,
-        allowJobImages: val(form, 'allowJobImages').checked
-      });
-    }
-    const power = form.querySelector('[data-power]'),
-      method = text(power, 'method');
     return {
       stlinks: rows(form, 'stlinks'),
       uarts: rows(form, 'uarts'),
-      usbs: rows(form, 'usbs'),
-      relays: rows(form, 'relays'),
-      power: method ? compact({ method, hub: text(power, 'hub'), port: num(power, 'port'), baseUrl: text(power, 'baseUrl') }) : null
+      usbs: rows(form, 'usbs')
     };
   }
 

package/public/js/config-import.js

@@ -0,0 +1,59 @@
+/**
+ * @file        packages/coordinator/public/js/config-import.js
+ * @description Dashboard: the resource card's config Import button — picks a JSON file, puts it in the import form
+ *              and submits it, confirmed first (confirm.js) with what will and won't be applied
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+(function (){
+  const IGNORED = ['joinKey', 'coordinatorUrl', 'name'],
+    MAX_BYTES = 64 * 1024;
+
+  document.querySelectorAll('form[data-config-import]').forEach((form) => {
+    const picker = form.querySelector('[data-config-import-file]');
+    form.querySelector('[data-config-import-pick]').addEventListener('click', () => {
+      picker.value = ''; // the same file again still fires `change`
+      picker.click();
+    });
+
+    picker.addEventListener('change', async () => {
+      const file = picker.files[0];
+      if (!file){
+        return;
+      }
+      const text = file.size > MAX_BYTES ? '' : await file.text();
+      form.querySelector('input[name="file"]').value = text;
+      form.querySelector('input[name="fileName"]').value = file.name;
+
+      let parsed = null;
+      try {
+        parsed = JSON.parse(text);
+      }
+      catch {
+        parsed = null;
+      }
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)){
+        // Nothing to confirm: the Coordinator says what's wrong with it.
+        delete form.dataset.confirm;
+      }
+      else {
+        const present = IGNORED.filter((k) => k in parsed);
+        form.dataset.confirm = `Import ${file.name} into ${form.dataset.resourceName}? ` +
+          'It replaces the Client\'s config (capabilities, labels, groups, heartbeat settings, …); the Client writes it on its next heartbeat ' +
+          'and restarts once it has no job running.\n\n' +
+          `Ignored: joinKey, coordinatorUrl and name${present.length ? ` (in this file: ${present.join(', ')})` : ''}, ` +
+          'and the Client\'s id, file paths and secrets — each Client keeps its own.';
+      }
+      form.requestSubmit();
+    });
+  });
+})();

package/src/api/agent.js

@@ -47,7 +47,7 @@ function createAgentRouter({ services, config }){
     }
     const resource = job.resource_id ? services.registry.get(job.resource_id) : null;
     res.json({
-      ...job,
+      ...services.jobs.publicJob(job),
       resource: resource ? { id: resource.id, name: resource.name } : job.resource_name ? { id: null, name: job.resource_name } : null
     });
   });
@@ -60,13 +60,13 @@ function createAgentRouter({ services, config }){
       mine: req.query.mine === 'true' || req.query.mine === '1',
       limit: req.query.limit ? Number(req.query.limit) : undefined
     });
-    res.json({ jobs });
+    res.json({ jobs: jobs.map(services.jobs.publicJob) });
   });
 
   router.post('/jobs/:id/cancel', auth, (req, res, next) => {
     try {
       const job = services.jobs.cancel(req.params.id, { agentId: req.agent.id, isAdmin: false });
-      res.json(job);
+      res.json(services.jobs.publicJob(job));
     }
     catch (err){
       next(err);

package/src/api/resource.js

@@ -51,7 +51,7 @@ function createResourceRouter({ services, config }){
   // the resource by name (see registry.registerAuto).
   router.post('/resources/register', requireJoinKey(config), (req, res, next) => {
     try {
-      const { clientId, name, type, labels, groups, hostInfo, capabilities, config: clientConfig } = req.body;
+      const { clientId, name, type, labels, groups, hostInfo, capabilities, config: clientConfig, configFile } = req.body;
       if (!clientId){
         return res.status(400).json({ error: 'clientId is required (persisted in the Client\'s .client-id file)' });
       }
@@ -67,6 +67,7 @@ function createResourceRouter({ services, config }){
         hostInfo,
         capabilities,
         config: clientConfig,
+        configFile,
         remoteAddr: req.ip,
         clientVersion: appVersion(req, 'client')
       });

package/src/api/sse.js

@@ -13,7 +13,9 @@
 
 'use strict';
 
-const { TERMINAL_JOB_STATES } = require('@andrian.yablonskyy/thub-common');
+const { TERMINAL_JOB_STATES, JOB_STATES } = require('@andrian.yablonskyy/thub-common');
+
+const WAITING_CHECK_MS = 15_000;
 
 // §6.4: log / state / end events, resumable via Last-Event-ID (§7: "the
 // Agent reconnects with exponential backoff and resumes from the last seq").
@@ -62,7 +64,26 @@ function attachJobStream(req, res, { jobId, services, config }){
   const resourceName = (id) => (id ? registry.get(id)?.name : undefined);
   writeEvent('state', { state: current.state, resource: resourceName(current.resource_id) });
 
-  const onLog = (entry) => {
+  // While QUEUED: why no Client has taken it yet (`waiting`), re-checked
+  // as Clients come and go; sent again only when the reason changes.
+  let lastReason = null;
+  function checkWaiting(){
+    const job = jobs.get(jobId);
+    if (job?.state !== JOB_STATES.QUEUED){
+      lastReason = null;
+      return;
+    }
+    const { type, labels = [], group, client } = job.spec.target,
+      reason = registry.waitingReason(type, labels, group, client);
+    if (reason && reason !== lastReason){
+      writeEvent('waiting', { reason });
+    }
+    lastReason = reason;
+  }
+  checkWaiting();
+  const waitingTimer = setInterval(checkWaiting, WAITING_CHECK_MS),
+
+    onLog = (entry) => {
       if (entry.jobId === jobId){
         writeEvent('log', { ts: entry.ts, stream: entry.stream, line: entry.line }, entry.seq);
       }
@@ -82,6 +103,7 @@ function attachJobStream(req, res, { jobId, services, config }){
     };
 
   function cleanup(){
+    clearInterval(waitingTimer);
     bus.off('job.log', onLog);
     bus.off('job.state', onState);
     bus.off('job.finished', onFinished);

package/src/db/migrations/021_add_client_config_file.sql

@@ -0,0 +1,8 @@
+-- Client config Export / Import (README §10, resource card Actions).
+-- `client_config_file` is the Client's whole config file as it last
+-- reported it at registration, its secrets (artifactory.token,
+-- sw.registryAuth) left out. `config_import` is an imported file's fields
+-- beyond the hw/sw section, as JSON { revision, fields }: sent with every
+-- set-config until the Client reports applying that revision.
+ALTER TABLE resources ADD COLUMN client_config_file TEXT;
+ALTER TABLE resources ADD COLUMN config_import TEXT;

package/src/dev/virtual.js

@@ -29,9 +29,7 @@ const DEV_AGENT_NAME = 'virtual-agent',
       name: 'virtual-sw-01',
       type: 'sw',
       labels: ['virtual', 'emulator'],
-      capabilities: {
-        sw: { image: 'dut-emulator:dev', registry: null, allowDockerHub: true, allowJobImages: true, cpus: 2, memory: '2g' }
-      },
+      capabilities: { sw: {} },
       address: '10.0.0.41'
     },
     {
@@ -43,9 +41,7 @@ const DEV_AGENT_NAME = 'virtual-agent',
         hw: {
           stlinks: [{ path: '/dev/thub/dut1-stlink', index: 1, serial: '066DFF485457725187092834', present: true }],
           uarts: [{ path: '/dev/thub/dut1-uart', index: 1, baudRate: 115200, present: true }],
-          usbs: [{ path: '/dev/thub/dut1-usb', index: 1, present: false }],
-          relays: [{ channel: 0, baseUrl: 'http://localhost:3000' }],
-          power: { method: 'relay' }
+          usbs: [{ path: '/dev/thub/dut1-usb', index: 1, present: false }]
         }
       },
       address: '10.0.0.42'
@@ -188,21 +184,14 @@ function startVirtualClients(services, config){
       labels: def.labels,
       hostInfo: { hostname: `${def.name}.virtual`, platform: 'linux', addresses: [{ iface: 'eth0', address: def.address, family: 'IPv4' }], timeZone: 'UTC' },
       capabilities: { ...def.capabilities, rebootSupported: false },
-      // Its "config file": the hw/sw section, as a real Client reports it.
+      // Its editable section as a real Client reports it: an HW Client's
+      // hw-devices; an SW Client has none ({}).
       config: def.type === 'sw'
-        ? {
-          image: def.capabilities.sw.image,
-          allowDockerHub: def.capabilities.sw.allowDockerHub,
-          allowJobImages: def.capabilities.sw.allowJobImages,
-          cpus: def.capabilities.sw.cpus,
-          memory: def.capabilities.sw.memory
-        }
+        ? {}
         : {
           stlinks: [{ index: 1, serial: '066DFF485457725187092834', devpath: '3.3.4.3.1' }],
           uarts: [{ index: 1, baudRate: 115200, devpath: '3.3.3.2' }],
-          usbs: [{ index: 1 }],
-          relays: [{ channel: 0, baseUrl: 'http://localhost:3000' }],
-          power: { method: 'relay' }
+          usbs: [{ index: 1 }]
         },
       remoteAddr: '127.0.0.1',
       clientVersion: version

package/src/services/jobs.js

@@ -13,7 +13,7 @@
 
 'use strict';
 
-const { validateJobSpec, JOB_STATES, ACTIVE_JOB_STATES, TERMINAL_JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common'),
+const { validateJobSpec, maskEnv, JOB_STATES, ACTIVE_JOB_STATES, TERMINAL_JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common'),
   { paginate } = require('./list-prefs'),
   // Named in spec errors: a field the Agent sends but this thub-common
   // doesn't know means the Coordinator needs an update.
@@ -149,20 +149,8 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
       spec.target.client = resource.id;
     }
 
-    // A job-supplied Docker image needs an SW Client that opted in — say so,
-    // rather than the generic "no resource can satisfy".
-    const needs = { jobImage: Boolean(spec.image) },
-      { type, labels, group, client } = spec.target;
-    if (needs.jobImage && registry.everSatisfiable(type, labels, group, client) && !registry.everSatisfiable(type, labels, group, client, needs)){
-      throw Object.assign(
-        new Error(
-          `No matching SW Client runs job-supplied Docker images (${spec.image}) — enable it on a Client ` +
-            'with "sw": { "allowJobImages": true } in its config'
-        ),
-        { status: 422 }
-      );
-    }
-    if (!registry.everSatisfiable(type, labels, group, client, needs)){
+    const { type, labels, group, client } = spec.target;
+    if (!registry.everSatisfiable(type, labels, group, client)){
       throw Object.assign(
         new Error(
           `No registered resource can ever satisfy type=${spec.target.type} labels=${spec.target.labels.join(',')}` +
@@ -248,6 +236,10 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
       bus.emit('job.queued', { jobId: id });
     }
     if (TERMINAL_JOB_STATES.has(state)){
+      // A LOST job may be requeued (markLost), and needs its env for that.
+      if (state !== JOB_STATES.LOST){
+        forgetEnv(id);
+      }
       bus.emit('job.finished', { jobId: id, state });
       // LOST means the resource is presumed OUT_OF_SERVICE (that's why the
       // job went LOST) — it only comes back via a real heartbeat (§4.1),
@@ -378,14 +370,30 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
     if (job.state === JOB_STATES.LOST || TERMINAL_JOB_STATES.has(job.state)){
       return job;
     }
-    const spec = job.spec;
     setState(id, JOB_STATES.LOST);
     if (config.scheduler.requeueOnLost && job.attempt < 2){
       return setState(id, JOB_STATES.QUEUED);
     }
+    forgetEnv(id);
     return get(id);
   }
 
+  // A finished job's `--env` values (registry passwords etc.) aren't kept:
+  // only the names stay, masked.
+  function forgetEnv(id){
+    const row = db.prepare('SELECT spec FROM jobs WHERE id = ?').get(id),
+      spec = row && JSON.parse(row.spec);
+    if (spec?.env){
+      db.prepare('UPDATE jobs SET spec = ? WHERE id = ?').run(JSON.stringify({ ...spec, env: maskEnv(spec.env) }), id);
+    }
+  }
+
+  // A job as the Agent API shows it: `--env` values masked (any Agent token
+  // can read any job; only the Client running it gets them).
+  function publicJob(job){
+    return job?.spec?.env ? { ...job, spec: { ...job.spec, env: maskEnv(job.spec.env) } } : job;
+  }
+
   function checkTimeouts(){
     const now = Date.now(),
       active = db
@@ -513,6 +521,7 @@ function createJobsService(db, { bus, events, registry, artifacts, config }){
 
   return {
     get,
+    publicJob,
     list,
     page,
     create,

package/src/services/registry.js

@@ -14,7 +14,8 @@
 'use strict';
 
 const { v4: uuid } = require('uuid'),
-  { RESOURCE_STATES, BUSY_SOURCES, ACTIVE_JOB_STATES, compareVersions, parseCron, validateClientConfig } = require('@andrian.yablonskyy/thub-common'),
+  { RESOURCE_STATES, BUSY_SOURCES, ACTIVE_JOB_STATES, compareVersions, parseCron, validateClientConfig, importClientConfigFile,
+    shareableClientConfigFile, HW_DEVICES_SECTION } = require('@andrian.yablonskyy/thub-common'),
   { generateToken, hashToken } = require('./tokens');
 
 function rowToResource(row){
@@ -29,6 +30,8 @@ function rowToResource(row){
     capabilities: row.capabilities ? JSON.parse(row.capabilities) : null,
     client_config: row.client_config ? JSON.parse(row.client_config) : null,
     config_desired: row.config_desired ? JSON.parse(row.config_desired) : null,
+    client_config_file: row.client_config_file ? JSON.parse(row.client_config_file) : null,
+    config_import: row.config_import ? JSON.parse(row.config_import) : null,
     usb_scan: row.usb_scan ? JSON.parse(row.usb_scan) : null,
     activity: row.activity ? JSON.parse(row.activity) : null
   };
@@ -86,29 +89,17 @@ function sanitizeCapabilities(caps){
 }
 
 function sanitizeTypedCapabilities(caps){
+  // An SW Client has no settings to report (older ones still send some).
   if (caps.sw && typeof caps.sw === 'object'){
-    const sw = caps.sw;
-    return {
-      sw: {
-        image: str(sw.image),
-        registry: str(sw.registry),
-        allowDockerHub: sw.allowDockerHub === true,
-        allowJobImages: sw.allowJobImages === true,
-        cpus: num(sw.cpus),
-        memory: str(sw.memory, 16)
-      }
-    };
+    return { sw: {} };
   }
   if (caps.hw && typeof caps.hw === 'object'){
-    const hw = caps.hw,
-      power = hw.power && typeof hw.power === 'object' ? hw.power : null;
+    const hw = caps.hw;
     return {
       hw: {
         stlinks: capList(hw.stlinks).map(device),
         uarts: capList(hw.uarts).map(device),
-        usbs: capList(hw.usbs).map(device),
-        relays: capList(hw.relays).map((r) => ({ channel: num(r?.channel), baseUrl: str(r?.baseUrl) })),
-        power: power ? { method: str(power.method, 32), hub: str(power.hub, 64), port: num(power.port) } : null
+        usbs: capList(hw.usbs).map(device)
       }
     };
   }
@@ -195,7 +186,8 @@ function createRegistryService(db, { bus, events }){
   // Config tab. Stored as reported, if it's a plain object of sane size.
   // A dashboard rename (name_override) wins over the name the Client
   // presents; that one is kept as reported_name.
-  function registerAuto({ config, ...registration }){
+  // And `configFile`: the whole config file (secrets excluded), for Export.
+  function registerAuto({ config, configFile, ...registration }){
     const known = registration.clientId ? getByClientId(registration.clientId) : null,
       result = registerAutoInner({ ...registration, name: known?.name_override || registration.name });
     db.prepare('UPDATE resources SET reported_name = ? WHERE id = ?').run(registration.name, result.resourceId);
@@ -205,6 +197,12 @@ function createRegistryService(db, { bus, events }){
         db.prepare('UPDATE resources SET client_config = ? WHERE id = ?').run(json, result.resourceId);
       }
     }
+    if (configFile && typeof configFile === 'object' && !Array.isArray(configFile)){
+      const json = JSON.stringify(shareableClientConfigFile(configFile));
+      if (json.length <= 64 * 1024){
+        db.prepare('UPDATE resources SET client_config_file = ? WHERE id = ?').run(json, result.resourceId);
+      }
+    }
     return result;
   }
 
@@ -529,13 +527,10 @@ function createRegistryService(db, { bus, events }){
     );
   }
 
-  // `needs`: what a job brings that a Client must have opted in to run —
-  // jobImage (the job's own Docker image; sw.allowJobImages).
-  function matchesTarget(r, labels, groupId, resourceId, needs = {}){
+  function matchesTarget(r, labels, groupId, resourceId){
     return labels.every((l) => r.labels.includes(l)) &&
       (!groupId || r.group_ids.includes(groupId)) &&
-      (!resourceId || r.id === resourceId) &&
-      (!needs.jobImage || r.capabilities?.sw?.allowJobImages === true);
+      (!resourceId || r.id === resourceId);
   }
 
   // Admin: remove a resource from the registry (dashboard "Remove"). Refused
@@ -653,13 +648,60 @@ function createRegistryService(db, { bus, events }){
     return get(resourceId);
   }
 
-  // { revision, type, config } while the Client hasn't applied the saved one.
+  // { revision, type, config[, file] } while the Client hasn't applied the
+  // saved one; `file`: an import's other fields, until it's applied.
   function pendingConfig(resourceId){
     const r = get(resourceId);
     if (!r || !r.config_desired || r.config_applied_revision >= r.config_revision){
       return null;
     }
-    return { revision: r.config_revision, type: r.type, config: r.config_desired };
+    const file = pendingImport(r);
+    return { revision: r.config_revision, type: r.type, config: r.config_desired, ...(file ? { file } : {}) };
+  }
+
+  function pendingImport(r){
+    return r.config_import && r.config_import.revision > r.config_applied_revision ? r.config_import.fields : null;
+  }
+
+  // Import (resource card): a whole config file, as the Client's next config
+  // revision — its hw/sw section as if saved on the Config tabs (the one
+  // already there if the file has none), its other fields besides. Never
+  // taken from it: joinKey, coordinatorUrl, name, the Client's identity and
+  // host paths, secrets (importClientConfigFile). Returns { resource, ignored }.
+  function importClientConfig(resourceId, file, { by } = {}){
+    const r = get(resourceId);
+    if (!r){
+      throw Object.assign(new Error('Unknown resource'), { status: 404 });
+    }
+    const { valid, errors, section, fields, ignored } = importClientConfigFile(r.type, file);
+    if (!valid){
+      throw Object.assign(new Error(`Can't import this config into ${r.name}: ${errors.join('; ')}`), { status: 400 });
+    }
+    const desired = section || r.config_desired || r.client_config;
+    if (!desired){
+      throw Object.assign(new Error(`Can't import this config into ${r.name}: it has no "${HW_DEVICES_SECTION}" section, and the Client hasn't reported one`),
+        { status: 400 });
+    }
+    const revision = r.config_revision + 1;
+    db.prepare(`UPDATE resources SET config_desired = ?, config_revision = ?, config_error = NULL, config_import = ?
+                WHERE id = ?`).run(JSON.stringify(desired), revision, JSON.stringify({ revision, fields }), resourceId);
+    events.record('resource', resourceId, 'resource.config_imported', { by, revision, fields: Object.keys(fields), ignored });
+    return { resource: get(resourceId), ignored };
+  }
+
+  // Export (resource card): the Client's config file as it last reported it
+  // (secrets excluded), with what's saved for it but not applied yet — so
+  // exporting right after an edit or import gives what the Client will run.
+  // A Client too old to report its file gets what the Coordinator knows.
+  function exportClientConfig(resourceId){
+    const r = get(resourceId);
+    if (!r){
+      throw Object.assign(new Error('Unknown resource'), { status: 404 });
+    }
+    // Re-shared: a file stored from an older Client may still say hw / sw.
+    const base = shareableClientConfigFile(r.client_config_file || { name: r.reported_name || r.name, type: r.type, labels: r.labels }),
+      section = r.type === 'hw' ? r.config_desired || r.client_config : null;
+    return { ...base, ...(pendingImport(r) || {}), type: r.type, ...(section ? { [HW_DEVICES_SECTION]: section } : {}) };
   }
 
   // Scheduled host reboot (resource card): a cron expression, validated
@@ -693,17 +735,37 @@ function createRegistryService(db, { bus, events }){
     return { cron: r.reboot_schedule || null };
   }
 
-  function findIdleCandidates(type, labels, groupId, resourceId, needs){
+  function findIdleCandidates(type, labels, groupId, resourceId){
     const rows = db
       .prepare('SELECT * FROM resources WHERE status = ? AND type = ? AND remove_requested_at IS NULL')
       .all(RESOURCE_STATES.IDLE, type)
       .map(rowToResource);
-    return rows.filter((r) => matchesTarget(r, labels, groupId, resourceId, needs));
-  }
-
-  function everSatisfiable(type, labels, groupId, resourceId, needs){
+    return rows.filter((r) => matchesTarget(r, labels, groupId, resourceId));
+  }
+
+  // Why a queued job isn't assigned yet, in words — for the Agent and the
+  // dashboard (null when an idle Client fits: the next scheduler pass takes
+  // it, or higher-priority jobs are ahead). Names each matching Client that
+  // isn't free and what it's doing.
+  function waitingReason(type, labels, groupId, resourceId){
+    const matching = db.prepare('SELECT * FROM resources WHERE type = ?').all(type).map(rowToResource)
+        .filter((r) => matchesTarget(r, labels, groupId, resourceId)),
+      free = (r) => r.status === RESOURCE_STATES.IDLE && !r.remove_requested_at,
+      what = (r) => (r.remove_requested_at
+        ? 'being removed'
+        : { [RESOURCE_STATES.BUSY]: 'busy', [RESOURCE_STATES.OUT_OF_SERVICE]: 'offline', [RESOURCE_STATES.MAINTENANCE]: 'in maintenance',
+          [RESOURCE_STATES.REGISTERED]: 'not connected yet' }[r.status] || r.status.toLowerCase()),
+      names = (rs) => rs.map((r) => `${r.name} (${what(r)})`).join(', '),
+      kind = type.toUpperCase();
+    if (!matching.length){
+      return `no ${kind} Client matches this job's target`;
+    }
+    return matching.some(free) ? null : `every matching ${kind} Client is taken: ${names(matching)}`;
+  }
+
+  function everSatisfiable(type, labels, groupId, resourceId){
     const rows = db.prepare('SELECT * FROM resources WHERE type = ?').all(type).map(rowToResource);
-    return rows.some((r) => matchesTarget(r, labels, groupId, resourceId, needs));
+    return rows.some((r) => matchesTarget(r, labels, groupId, resourceId));
   }
 
   return {
@@ -728,13 +790,16 @@ function createRegistryService(db, { bus, events }){
     pendingRebootSchedule,
     setClientConfig,
     pendingConfig,
+    importClientConfig,
+    exportClientConfig,
     rename,
     requestUsbScan,
     storeUsbScan,
     requestRemoval,
     pendingRemovals,
     findIdleCandidates,
-    everSatisfiable
+    everSatisfiable,
+    waitingReason
   };
 }
 

package/src/services/scheduler.js

@@ -15,11 +15,6 @@
 
 const { JOB_STATES, BUSY_SOURCES } = require('@andrian.yablonskyy/thub-common');
 
-// What a job needs a Client to have opted in to (registry matchesTarget).
-function jobNeeds(spec){
-  return { jobImage: Boolean(spec.image) };
-}
-
 function rowToJob(row){
   return { ...row, spec: JSON.parse(row.spec) };
 }
@@ -48,7 +43,7 @@ function createScheduler(db, { bus, events, registry, config }){
         for (const job of queued){
           const { type, labels = [], group, client } = job.spec.target,
             candidates = registry
-              .findIdleCandidates(type, labels, group, client, jobNeeds(job.spec))
+              .findIdleCandidates(type, labels, group, client)
               .filter((r) => !claimedResourceIds.has(r.id));
           if (candidates.length === 0){
             continue;

package/src/web/routes.js

@@ -493,6 +493,42 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/resources'));
   });
 
+  // Export (resource card, admins — the file holds the join key): the
+  // Client's config file as JSON, secrets excluded.
+  router.get('/resources/:id/config/export', requireAdminRole, (req, res) => {
+    try {
+      const r = services.registry.get(req.params.id),
+        file = services.registry.exportClientConfig(req.params.id);
+      res.attachment(`${r.name.replace(/[^A-Za-z0-9._-]+/g, '_')}.json`).type('application/json').send(JSON.stringify(file, null, 2) + '\n');
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+      res.redirect('/resources');
+    }
+  });
+
+  // Import (resource card, public/js/config-import.js): a config file, applied
+  // by the Client on its next heartbeat like a Config tab Save.
+  router.post('/resources/:id/config/import', requireAdminRole, (req, res) => {
+    try {
+      let file;
+      try {
+        file = JSON.parse(req.body.file || '');
+      }
+      catch (err){
+        throw Object.assign(new Error(`${req.body.fileName || 'The file'} isn't valid JSON: ${err.message}`), { status: 400 });
+      }
+      const { resource: r, ignored } = services.registry.importClientConfig(req.params.id, file, { by: req.session.user.username });
+      flash(req, 'success', `Config imported into ${r.name} (revision ${r.config_revision}).\n` +
+        'The Client applies it on its next heartbeat, then restarts once it has no job running.' +
+        (ignored.length ? `\nIgnored: ${ignored.join(', ')}.` : ''));
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/resources'));
+  });
+
   // Scheduled host reboot (resource card): save a cron expression, or clear
   // it; the Client applies it on its next heartbeat.
   router.post('/resources/:id/reboot-schedule', requireAdminRole, (req, res) => {
@@ -714,6 +750,10 @@ function createWebRouter({ services, config }){
       active: 'jobs',
       job,
       pinnedClient: job.spec.target.client ? services.registry.get(job.spec.target.client) : null,
+      waitingReason: job.state === JOB_STATES.QUEUED
+        ? services.registry.waitingReason(job.spec.target.type, job.spec.target.labels || [], job.spec.target.group,
+          job.spec.target.client)
+        : null,
       artifacts,
       jobActive,
       canCancel: req.session.user.role === 'admin' && jobActive

package/test/scheduler.test.js

@@ -524,26 +524,52 @@ test('a removed Client re-registers as a fresh resource under the same name', ()
   assert.equal(again.name, 'lab-back');
 });
 
-test('a job-supplied Docker image only goes to SW Clients that allow it; otherwise 422', () => {
+test('a job-supplied Docker image runs on any matching SW Client (no opt-in any more)', () => {
   const { registry, agents, jobs, scheduler } = buildTestServices(),
     { agent } = agents.create({ name: 'dev', kind: 'cli' }),
-    imageJob = { target: { type: 'sw', labels: [] }, image: 'alpine', command: './run.sh' },
-    strict = registerResource(registry, { name: 'sw-strict', type: 'sw' });
-  registry.heartbeat(strict.id, { state: 'idle' });
-
-  assert.throws(() => jobs.create({ agentId: agent.id, source: 'cli', spec: imageJob }), /allowJobImages/);
-
+    r = registerResource(registry, { name: 'sw-any', type: 'sw' });
+  registry.heartbeat(r.id, { state: 'idle' });
+  const job = jobs.create({ agentId: agent.id, source: 'cli', spec: { target: { type: 'sw', labels: [] }, image: 'alpine', command: './run.sh' } });
+  scheduler.runPass();
+  assert.equal(jobs.get(job.id).resource_id, r.id);
+  // An older Client still reporting its sw settings: they're dropped.
   const { resourceId } = registry.registerAuto({
-    clientId: 'c-open', name: 'sw-open', type: 'sw', labels: [], capabilities: { sw: { image: 'emu', allowJobImages: true } }
+    clientId: 'c-old', name: 'sw-old', type: 'sw', labels: [], capabilities: { sw: { image: 'emu', allowJobImages: false } }
   });
-  registry.heartbeat(resourceId, { state: 'idle' });
-  const job = jobs.create({ agentId: agent.id, source: 'cli', spec: imageJob });
-  scheduler.runPass();
-  assert.equal(jobs.get(job.id).resource_id, resourceId); // not sw-strict, though it's idle too
+  assert.deepEqual(registry.get(resourceId).capabilities.sw, {});
+});
+
+test('waiting reason: says why a queued job has no Client — every match taken, or none matching', () => {
+  const { registry } = buildTestServices(),
+    reason = () => registry.waitingReason('sw', [], undefined, undefined),
+    a = registerResource(registry, { name: 'sw-a', type: 'sw' }),
+    b = registerResource(registry, { name: 'sw-b', type: 'sw' });
+  registry.heartbeat(a.id, { state: 'idle' });
+  assert.equal(reason(), null); // sw-a can take it
+
+  registry.assignToJob(a.id, 'cli');
+  assert.equal(reason(), 'every matching SW Client is taken: sw-a (busy), sw-b (not connected yet)');
+  assert.equal(registry.waitingReason('hw', [], undefined, undefined), 'no HW Client matches this job\'s target');
+});
+
+test('--env: the Client gets the values; the Agent API sees them masked; they\'re dropped when the job ends (not on a requeued LOST)', () => {
+  const { registry, agents, jobs, scheduler } = buildTestServices(),
+    { agent } = agents.create({ name: 'dev', kind: 'cli' }),
+    r = registerResource(registry, { name: 'sw-env', type: 'sw' }),
+    env = { DOCKER_REGISTRY: 'registry.lab:5000', DOCKER_USERNAME: 'ci', DOCKER_PASSWORD: 's3cret' };
+  registry.heartbeat(r.id, { state: 'idle' });
+
+  const job = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec({ env }) });
+  assert.deepEqual(jobs.get(job.id).spec.env, env); // what the Client is handed
+  assert.deepEqual(jobs.publicJob(jobs.get(job.id)).spec.env, { DOCKER_REGISTRY: '***', DOCKER_USERNAME: '***', DOCKER_PASSWORD: '***' });
 
-  const fileJob = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() });
   scheduler.runPass();
-  assert.equal(jobs.get(fileJob.id).resource_id, strict.id); // jobs without an image still go anywhere
+  jobs.markLost(job.id); // requeued: still needs them
+  assert.equal(jobs.get(job.id).state, JOB_STATES.QUEUED);
+  assert.deepEqual(jobs.get(job.id).spec.env, env);
+
+  jobs.cancel(job.id, { isAdmin: true });
+  assert.deepEqual(jobs.get(job.id).spec.env, { DOCKER_REGISTRY: '***', DOCKER_USERNAME: '***', DOCKER_PASSWORD: '***' });
 });
 
 test('every job carries its command and runs on any matching Client; an old-Agent spec is refused', () => {
@@ -618,29 +644,85 @@ test('reboot now: refused offline or without a helper; cancels a running job fir
   assert.equal(after.message, 'Canceled: user reboot request');
 });
 
-test('capabilities from the dashboard: reported config stored, saved at a new revision, resent until applied', () => {
+test('devices from the dashboard: reported hw-devices stored, saved at a new revision, resent until applied', () => {
   const { registry } = buildTestServices(),
     { resourceId } = registry.registerAuto({
-      clientId: 'c-cfg', name: 'lab-cfg', type: 'sw', labels: [], capabilities: { sw: { image: 'emu' } },
-      config: { image: 'emu:1', cpus: 2, memory: '2g' }
+      clientId: 'c-cfg', name: 'lab-cfg', type: 'hw', labels: [], capabilities: { hw: { stlinks: [], uarts: [], usbs: [] } },
+      config: { stlinks: [], uarts: [{ index: 1 }], usbs: [] }
     });
-  assert.deepEqual(registry.get(resourceId).client_config, { image: 'emu:1', cpus: 2, memory: '2g' });
+  assert.deepEqual(registry.get(resourceId).client_config, { stlinks: [], uarts: [{ index: 1 }], usbs: [] });
   assert.equal(registry.pendingConfig(resourceId), null);
 
-  assert.throws(() => registry.setClientConfig(resourceId, { memory: 'lots' }), /Invalid SW config: sw\.memory/);
-  const saved = registry.setClientConfig(resourceId, { image: 'emu:2', cpus: 1, memory: '1g', allowJobImages: true });
+  assert.throws(() => registry.setClientConfig(resourceId, { uarts: [{ path: '/tmp/x' }] }), /Invalid HW config: hw-devices\.uarts\.0\.path/);
+  const saved = registry.setClientConfig(resourceId, { uarts: [{ index: 2, baudRate: 9600 }] });
   assert.equal(saved.config_revision, 1);
-  assert.deepEqual(registry.pendingConfig(resourceId), { revision: 1, type: 'sw', config: { image: 'emu:2', cpus: 1, memory: '1g', allowJobImages: true } });
+  assert.deepEqual(registry.pendingConfig(resourceId), { revision: 1, type: 'hw', config: { uarts: [{ index: 2, baudRate: 9600 }] } });
 
   registry.heartbeat(resourceId, { state: 'idle' }); // an older Client: reports nothing
   assert.equal(registry.pendingConfig(resourceId).revision, 1);
   registry.heartbeat(resourceId, { state: 'idle', configRevision: 1 });
   assert.equal(registry.pendingConfig(resourceId), null);
 
-  registry.setClientConfig(resourceId, { image: 'emu:3' });
+  registry.setClientConfig(resourceId, { usbs: [{ index: 1 }] });
   registry.heartbeat(resourceId, { state: 'idle', configRevision: 2, configError: 'Config revision 2 refused: bad' });
   assert.equal(registry.pendingConfig(resourceId), null); // refused ones aren't resent
   assert.match(registry.get(resourceId).config_error, /refused: bad/);
+
+  // An SW Client has no settings: only an empty section is accepted.
+  const sw = registerResource(registry, { name: 'sw1', type: 'sw' });
+  assert.throws(() => registry.setClientConfig(sw.id, { image: 'emu' }), /SW Client has no settings of its own/);
+});
+
+test('config export/import: exported from the reported file (+ what\'s pending); an import goes out with set-config until applied', () => {
+  const { registry } = buildTestServices(),
+    { resourceId } = registry.registerAuto({
+      clientId: 'c-io', name: 'dut1', type: 'hw', labels: [], capabilities: { hw: { stlinks: [], uarts: [], usbs: [] } },
+      config: { uarts: [{ index: 1 }] },
+      // An older Client: `hw`, plus legacy sections that never show up again.
+      configFile: { coordinatorUrl: 'https://c', name: 'dut1', joinKey: 'k', type: 'hw', labels: [], hw: { uarts: [{ index: 1 }] },
+        sw: { image: 'emu:1', registryAuth: { password: 'x' } }, artifactory: { token: 'secret', allowedArtifactPrefixes: [] } }
+    });
+  assert.deepEqual(registry.exportClientConfig(resourceId), {
+    coordinatorUrl: 'https://c', name: 'dut1', joinKey: 'k', type: 'hw', labels: [], 'hw-devices': { uarts: [{ index: 1 }] }
+  });
+
+  const { resource, ignored } = registry.importClientConfig(resourceId, {
+    coordinatorUrl: 'https://evil', name: 'other', joinKey: 'x', type: 'hw', labels: ['board:b'], sources: { allowedPrefixes: ['*'] },
+    'hw-devices': { usbs: [{ index: 2 }] }
+  }, { by: 'admin' });
+  assert.deepEqual(ignored, ['sources', 'coordinatorUrl', 'name', 'joinKey']);
+  assert.equal(resource.config_revision, 1);
+  assert.deepEqual(registry.pendingConfig(resourceId),
+    { revision: 1, type: 'hw', config: { usbs: [{ index: 2 }] }, file: { labels: ['board:b'] } });
+  const exported = registry.exportClientConfig(resourceId);
+  assert.deepEqual([exported.coordinatorUrl, exported.name, exported.labels, exported['hw-devices'], exported.hw],
+    ['https://c', 'dut1', ['board:b'], { usbs: [{ index: 2 }] }, undefined]);
+
+  registry.setClientConfig(resourceId, { usbs: [{ index: 3 }] }); // a Config tab Save meanwhile: the import still goes with it
+  assert.deepEqual(registry.pendingConfig(resourceId).file, { labels: ['board:b'] });
+  registry.heartbeat(resourceId, { state: 'idle', configRevision: 2 });
+  assert.equal(registry.pendingConfig(resourceId), null);
+
+  assert.throws(() => registry.importClientConfig(resourceId, { type: 'sw' }), /SW Client config, but this is a HW Client/);
+  assert.throws(() => registry.importClientConfig(resourceId, { 'hw-devices': { uarts: [{ path: '/tmp/x' }] } }), /hw-devices\.uarts/);
+
+  // An SW Client: nothing of its own to import or export, the rest applies.
+  const sw = registry.registerAuto({ clientId: 'c-sw', name: 'sw1', type: 'sw', labels: [], capabilities: { sw: {} }, config: {},
+    configFile: { name: 'sw1', type: 'sw', labels: [] } }).resourceId;
+  assert.deepEqual(registry.importClientConfig(sw, { type: 'sw', labels: ['x'], sw: { image: 'emu' } }).ignored, ['sw']);
+  assert.deepEqual(registry.pendingConfig(sw), { revision: 1, type: 'sw', config: {}, file: { labels: ['x'] } });
+  assert.deepEqual(registry.exportClientConfig(sw), { name: 'sw1', type: 'sw', labels: ['x'] });
+});
+
+test('HW capabilities: no power control — reported relays/power dropped, and refused on Save', () => {
+  const { registry } = buildTestServices(),
+    { resourceId } = registry.registerAuto({
+      clientId: 'c-hw', name: 'hw1', type: 'hw', labels: [],
+      capabilities: { hw: { stlinks: [], uarts: [], usbs: [], relays: [{ channel: 0 }], power: { method: 'uhubctl', hub: '1-1', port: 2 } } }
+    });
+  assert.deepEqual(registry.get(resourceId).capabilities.hw, { stlinks: [], uarts: [], usbs: [] });
+  assert.throws(() => registry.setClientConfig(resourceId, { relays: [{ channel: 0 }] }), /must NOT have additional properties/);
+  assert.throws(() => registry.setClientConfig(resourceId, { power: null }), /must NOT have additional properties/);
 });
 
 test('rename from the dashboard: kept across re-registration, unique, and resettable to the Client\'s own name', () => {

package/views/index.pug

@@ -51,3 +51,4 @@ block scripts
   script(src="/js/usb-scan.js")
   script(src="/js/usb-parse.js")
   script(src="/js/usb-import.js")
+  script(src="/js/config-import.js")

package/views/jobs/show.pug

@@ -19,6 +19,10 @@ block content
       )
         button.btn.btn-outline-danger.btn-sm(type="submit") Cancel
 
+  if waitingReason
+    .alert.alert-warning.py-2.small
+      i.bi.bi-hourglass-split.me-1
+      | Waiting: #{waitingReason}
   dl.row
     dt.col-sm-2 Source
     dd.col-sm-10.text-uppercase= job.source
@@ -32,6 +36,10 @@ block content
     if job.spec.target.client
       dt.col-sm-2 Client
       dd.col-sm-10= pinnedClient ? pinnedClient.name : job.spec.target.client
+    if job.spec.env && Object.keys(job.spec.env).length
+      dt.col-sm-2 Environment
+      dd.col-sm-10.font-monospace(data-bs-toggle="tooltip" data-bs-title="Set by --env; values are only given to the Client that runs the job")
+        = Object.keys(job.spec.env).join(', ')
     dt.col-sm-2 Created
     dd.col-sm-10= fmtDate(job.created_at)
     if job.duration_sec != null

package/views/mixins/client-config.pug

@@ -20,14 +20,6 @@ mixin deviceRow(kind, d)
       button.btn.btn-sm.btn-outline-secondary(type="button" data-remove-row aria-label="Remove row")
         i.bi.bi-x-lg
 
-mixin relayRow(rl)
-  tr(data-row="relays")
-    td: input.form-control.form-control-sm(data-f="channel" type="number" min="0" max="7" value=rl ? rl.channel : '' required)
-    td: input.form-control.form-control-sm(data-f="baseUrl" type="url" value=rl && rl.baseUrl || '' placeholder="http://localhost:3000")
-    td.text-end
-      button.btn.btn-sm.btn-outline-secondary(type="button" data-remove-row aria-label="Remove row")
-        i.bi.bi-x-lg
-
 mixin deviceTable(kind, title, rows, columns)
   .d-flex.justify-content-between.align-items-center.mb-1
     strong.small= title
@@ -42,15 +34,9 @@ mixin deviceTable(kind, title, rows, columns)
         th
     tbody
       each d in rows
-        if kind === 'relays'
-          +relayRow(d)
-        else
-          +deviceRow(kind, d)
+        +deviceRow(kind, d)
   template(data-template=kind)
-    if kind === 'relays'
-      +relayRow(null)
-    else
-      +deviceRow(kind, null)
+    +deviceRow(kind, null)
 
 //- The ⚠ shown on a config (sub-)tab while its data differs from what was
 //- loaded — public/js/client-config.js toggles it.
@@ -102,104 +88,55 @@ mixin capabilitiesStatus(r)
         span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=r.config_error) refused by the Client
 
 //- The Client's config, as tabs of the resource card next to Details:
-//- HW — ST-Link, UART, DUT USB, Power (relays + power control); SW —
-//- Emulator; both — Reboot (the schedule, its own Save). The capability tabs
-//- share one form and one "Save capabilities"; a tab with unsaved changes
-//- shows ⚠ (public/js/client-config.js).
+//- HW — ST-Link, UART, DUT USB (its hw-devices section); both — Reboot (the
+//- schedule, its own Save). An SW Client has no settings of its own. The
+//- device tabs share one form and one "Save capabilities"; a tab with
+//- unsaved changes shows ⚠ (public/js/client-config.js).
 mixin configTabItems(r)
   - const p = `cfg-${r.id}`
-  - const tabs = r.type === 'hw' ? [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB'], ['power', 'Power']] : [['emulator', 'Emulator']]
-  each t in tabs
-    +configTab(p, t[0], t[1])
+  if r.type === 'hw'
+    each t in [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB']]
+      +configTab(p, t[0], t[1])
   +configTab(p, 'reboot', 'Reboot')
 
 mixin configPanes(r, returnTo)
   - const p = `cfg-${r.id}`
   - const current = r.config_desired || r.client_config
   - const canEdit = user.role === 'admin'
-  if !current
-    each t in (r.type === 'hw' ? [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB'], ['power', 'Power']] : [['emulator', 'Emulator']])
+  if r.type !== 'hw'
+    //- no device tabs
+  else if !current
+    each t in [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB']]
       +configPane(p, t[0])
-        p.small.text-body-secondary.mb-0 This Client is too old to report its config — update it to edit its capabilities here.
+        p.small.text-body-secondary.mb-0 This Client is too old to report its config — update it to edit its devices here.
   else
     form(
       method="post"
       action=`/resources/${r.id}/config`
-      data-client-config=r.type
-      data-confirm=`Apply these capabilities to ${r.name}? The Client writes them to its config file on its next heartbeat and restarts once it has no job running.`
-      data-confirm-title="Save Client capabilities?"
+      data-client-config="hw"
+      data-confirm=`Apply these devices to ${r.name}? The Client writes them to its config file on its next heartbeat and restarts once it has no job running.`
+      data-confirm-title="Save Client devices?"
       data-confirm-ok="Save"
       data-confirm-tone="primary"
     )
       input(type="hidden" name="returnTo" value=returnTo)
       input(type="hidden" name="config")
       fieldset(disabled=!canEdit)
-        if r.type === 'sw'
-          +configPane(p, 'emulator')
-            +capabilitiesStatus(r)
-            .row.g-2
-              .col-sm-6
-                label.form-label.small.mb-0 Image
-                input.form-control.form-control-sm.font-monospace(data-f="image" value=current.image || '' placeholder="dut-emulator:2026.08")
-              .col-sm-6
-                label.form-label.small.mb-0 Registry
-                input.form-control.form-control-sm.font-monospace(data-f="registry" value=current.registry || '' placeholder="registry.lab:5000")
-              .col-sm-3
-                label.form-label.small.mb-0 CPUs
-                input.form-control.form-control-sm(data-f="cpus" type="number" step="0.1" min="0.1" value=current.cpus != null ? current.cpus : '' placeholder="2")
-              .col-sm-3
-                label.form-label.small.mb-0 Memory
-                input.form-control.form-control-sm(data-f="memory" value=current.memory || '' placeholder="2g")
-              .col-sm-6
-                label.form-label.small.mb-0 Container command
-                input.form-control.form-control-sm.font-monospace(
-                  data-f="cmd"
-                  value=(current.cmd || []).join(' ')
-                  placeholder="--firmware /downloads/app.bin"
-                  title="For the image above (not a job's own); space-separated"
-                )
-              .col-12.d-flex.gap-4.mt-2
-                .form-check
-                  input.form-check-input(type="checkbox" data-f="allowDockerHub" id=`cc-${r.id}-hub` checked=current.allowDockerHub === true)
-                  label.form-check-label.small(for=`cc-${r.id}-hub`) Pull from Docker Hub
-                .form-check
-                  input.form-check-input(type="checkbox" data-f="allowJobImages" id=`cc-${r.id}-jobimg` checked=current.allowJobImages === true)
-                  label.form-check-label.small(for=`cc-${r.id}-jobimg`) Run jobs' own images (--docker-image)
-            +saveCapabilities(canEdit)
-        else
-          - const power = current.power || {}
-          +configPane(p, 'stlinks')
-            +capabilitiesStatus(r)
-            +deviceTable('stlinks', 'ST-Link probes', current.stlinks || [], ['Device', 'Serial', 'udev devpath'])
-            .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-stlink) or a /dev path. The serial is looked up from the udev symlink when empty.
-            +saveCapabilities(canEdit)
-          +configPane(p, 'uarts')
-            +capabilitiesStatus(r)
-            +deviceTable('uarts', 'UARTs', current.uarts || [], ['Device', 'Baud rate', 'udev devpath'])
-            .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-uart) or a /dev path. Baud rate: 115200 when empty.
-            +saveCapabilities(canEdit)
-          +configPane(p, 'usbs')
-            +capabilitiesStatus(r)
-            +deviceTable('usbs', 'DUT USB devices', current.usbs || [], ['Device', 'udev devpath'])
-            .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-usb) or a /dev path. udev devpath: the USB port it's plugged into.
-            +saveCapabilities(canEdit)
-          +configPane(p, 'power')
-            +capabilitiesStatus(r)
-            +deviceTable('relays', 'Relay channels', current.relays || [], ['Channel (0-7)', 'Board URL'])
-            strong.small.d-block.mt-3.mb-1 Power control
-            .row.g-2(data-power)
-              .col-sm-3
-                select.form-select.form-select-sm(data-f="method" aria-label="Power method")
-                  option(value="" selected=!power.method) none
-                  option(value="uhubctl" selected=power.method === 'uhubctl') uhubctl
-                  option(value="relay" selected=power.method === 'relay') relay
-              .col-sm-3
-                input.form-control.form-control-sm(data-f="hub" value=power.hub || '' placeholder="hub (uhubctl)")
-              .col-sm-2
-                input.form-control.form-control-sm(data-f="port" type="number" min="1" value=power.port != null ? power.port : '' placeholder="port")
-              .col-sm-4
-                input.form-control.form-control-sm(data-f="baseUrl" type="url" value=power.baseUrl || '' placeholder="relay URL")
-            +saveCapabilities(canEdit)
+        +configPane(p, 'stlinks')
+          +capabilitiesStatus(r)
+          +deviceTable('stlinks', 'ST-Link probes', current.stlinks || [], ['Device', 'Serial', 'udev devpath'])
+          .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-stlink) or a /dev path. The serial is looked up from the udev symlink when empty.
+          +saveCapabilities(canEdit)
+        +configPane(p, 'uarts')
+          +capabilitiesStatus(r)
+          +deviceTable('uarts', 'UARTs', current.uarts || [], ['Device', 'Baud rate', 'udev devpath'])
+          .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-uart) or a /dev path. Baud rate: 115200 when empty.
+          +saveCapabilities(canEdit)
+        +configPane(p, 'usbs')
+          +capabilitiesStatus(r)
+          +deviceTable('usbs', 'DUT USB devices', current.usbs || [], ['Device', 'udev devpath'])
+          .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-usb) or a /dev path. udev devpath: the USB port it's plugged into.
+          +saveCapabilities(canEdit)
   +configPane(p, 'reboot')
     dl.row.mb-0
       +rebootScheduleRow(r, returnTo)

package/views/mixins/resource.pug

@@ -133,47 +133,23 @@ mixin capDevice(d, detail)
       ) missing
 
 //- What the Client reported it can drive at registration (HW: udev
-//- devices, relays, power; SW: emulator image and limits).
+//- devices; SW: nothing of its own — it runs each job's DUT image).
 mixin capabilitiesList(caps)
   if !caps
     span.text-body-secondary —
   else if caps.sw
-    ul.list-unstyled.mb-0
-      li
-        span.text-body-secondary.small.me-2 Image
-        code= caps.sw.image || '—'
-      li
-        span.text-body-secondary.small.me-2 Source
-        = caps.sw.registry ? caps.sw.registry : 'no local registry'
-        = caps.sw.allowDockerHub ? ', then Docker Hub' : ' (Docker Hub off)'
-      li
-        span.text-body-secondary.small.me-2 Limits
-        = `${caps.sw.cpus || '—'} CPU, ${caps.sw.memory || '—'}`
+    span.text-body-secondary Runs each job's own DUT image (--docker-image), 2 CPUs / 2 GB
   else if caps.hw
     - const kinds = [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'USB']]
-    - const empty = kinds.every(([k]) => !caps.hw[k].length) && !caps.hw.relays.length && !caps.hw.power
+    - const empty = kinds.every(([k]) => !(caps.hw[k] || []).length)
     if empty
       span.text-body-secondary no devices configured
     each pair in kinds
-      if caps.hw[pair[0]].length
+      if (caps.hw[pair[0]] || []).length
         .small.text-body-secondary.mt-1= pair[1]
         ul.list-unstyled.mb-0.ms-2
           each d in caps.hw[pair[0]]
             +capDevice(d, pair[0] === 'uarts' && d.baudRate ? `${d.baudRate} baud` : null)
-    if caps.hw.relays.length
-      .small.text-body-secondary.mt-1 Relays
-      ul.list-unstyled.mb-0.ms-2
-        each rl in caps.hw.relays
-          li
-            = `channel ${rl.channel}`
-            if rl.baseUrl
-              code.ms-2= rl.baseUrl
-    if caps.hw.power
-      .small.text-body-secondary.mt-1 Power
-      .ms-2
-        = caps.hw.power.method
-        if caps.hw.power.method === 'uhubctl' && caps.hw.power.hub
-          span.text-body-secondary.small.ms-2= `hub ${caps.hw.power.hub} port ${caps.hw.power.port}`
 
 //- Host uptime and the Client's current task/status with its duration,
 //- both from the last heartbeat. Measured up to now — or, for a Client
@@ -417,6 +393,47 @@ mixin rebootButton(r, returnTo)
       )
         i.bi.bi-power
 
+//- Export / Import the Client's config file as JSON (card's Actions row,
+//- icons only). Import: public/js/config-import.js reads the chosen file
+//- into the form and submits it (confirmed first); the Client applies it on
+//- its next heartbeat. A Client that doesn't report its config file is too
+//- old to apply more than the hw/sw section — Import is off for it.
+mixin configTransferButtons(r, returnTo)
+  a.btn.btn-sm.btn-outline-secondary.ms-1(
+    href=`/resources/${r.id}/config/export`
+    download
+    aria-label=`Export ${r.name}'s config`
+    data-bs-toggle="tooltip"
+    data-bs-title="Export the Client's config file (JSON; its secrets left out)"
+  )
+    i.bi.bi-download
+  if !r.client_config_file
+    span.d-inline-block.ms-1(tabindex="0" data-bs-toggle="tooltip" data-bs-title="Import unavailable: this Client is too old to report its config file — update it")
+      button.btn.btn-sm.btn-outline-secondary(type="button" disabled style="pointer-events: none;" aria-label="Import config")
+        i.bi.bi-upload
+  else
+    form.d-inline.ms-1(
+      method="post"
+      action=`/resources/${r.id}/config/import`
+      data-config-import
+      data-resource-name=r.name
+      data-confirm-title=`Import config into ${r.name}?`
+      data-confirm-ok="Import"
+      data-confirm-tone="primary"
+    )
+      input(type="hidden" name="returnTo" value=returnTo)
+      input(type="hidden" name="file")
+      input(type="hidden" name="fileName")
+      input.d-none(type="file" accept=".json,application/json" data-config-import-file)
+      button.btn.btn-sm.btn-outline-secondary(
+        type="button"
+        aria-label=`Import a config into ${r.name}`
+        data-config-import-pick
+        data-bs-toggle="tooltip"
+        data-bs-title="Import a config file (JSON) — joinKey, coordinatorUrl and name in it are ignored"
+      )
+        i.bi.bi-upload
+
 //- The resource card's Details tab.
 mixin resourceDetails(r, groupsById, returnTo, local, external)
   dl.row.mb-0
@@ -500,3 +517,4 @@ mixin resourceDetails(r, groupsById, returnTo, local, external)
       dd.col-sm-8.mb-0
         +resourceActions(r, returnTo)
         +rebootButton(r, returnTo)
+        +configTransferButtons(r, returnTo)

package/views/resources/list.pug

@@ -64,3 +64,4 @@ block scripts
   script(src="/js/usb-scan.js")
   script(src="/js/usb-parse.js")
   script(src="/js/usb-import.js")
+  script(src="/js/config-import.js")