@andrian.yablonskyy/thub-coordinator 1.0.37 → 1.0.38

package/src/services/live.js

@@ -0,0 +1,124 @@
+/**
+ * @file        packages/coordinator/src/services/live.js
+ * @description Dashboard live updates: detects when what a list page shows (resources, agents, jobs) has changed and notifies subscribers
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const crypto = require('node:crypto'),
+  { ACTIVE_JOB_STATES } = require('@andrian.yablonskyy/thub-common');
+
+// How the dashboard stays current (README §10): the page holds one
+// GET /live stream that only says *which* topics changed; it then re-fetches
+// itself and swaps the parts that differ (public/js/live.js). Rather than
+// every place that changes a resource or agent having to announce it, a
+// fingerprint of each topic is recomputed and compared — right away on bus
+// events (a job starting or finishing shows up at once) and every
+// `intervalMs` as the catch-all for everything else (heartbeats, the
+// sweeper, maintenance, renames, update requests, …).
+const TOPICS = ['resources', 'agents', 'jobs'],
+  BUS_EVENTS = ['job.queued', 'job.assigned', 'job.state', 'job.finished', 'resource.idle', 'resource.reregistered'];
+
+function createLiveService(db, { bus, updates, intervalMs = 5000, debounceMs = 250 } = {}){
+  const subscribers = new Set(),
+    activeStates = [...ACTIVE_JOB_STATES],
+    hash = (value) => crypto.createHash('sha1').update(JSON.stringify(value)).digest('base64'),
+    // One cheap query per topic covering everything its pages display.
+    // Resources: every column (tens of rows) — last_heartbeat_at included,
+    // since the pages show it. Jobs: counts and latest times of the whole
+    // table (new, finished and deleted jobs) plus every active job's state.
+    queries = {
+      resources: () => [db.prepare('SELECT * FROM resources ORDER BY id').all(), updates?.status().latest],
+      agents: () => [
+        db.prepare('SELECT id, name, kind, version, update_to, last_used_at, revoked_at FROM agents ORDER BY id').all(),
+        updates?.status().latest
+      ],
+      jobs: () => [
+        db.prepare('SELECT COUNT(*) AS n, MAX(created_at) AS created, MAX(finished_at) AS finished FROM jobs').get(),
+        db.prepare(
+          `SELECT id, state, resource_id, message FROM jobs WHERE state IN (${activeStates.map(() => '?').join(',')}) ORDER BY id`
+        ).all(...activeStates)
+      ]
+    };
+  let fingerprints = null,
+    timer = null,
+    pending = null;
+
+  function compute(){
+    return Object.fromEntries(TOPICS.map((t) => [t, hash(queries[t]())]));
+  }
+
+  // Compare with the last fingerprints; tell every subscriber what changed.
+  function check(){
+    pending = null;
+    if (!subscribers.size){
+      return [];
+    }
+    const next = compute(),
+      changed = fingerprints ? TOPICS.filter((t) => next[t] !== fingerprints[t]) : [];
+    fingerprints = next;
+    if (changed.length){
+      for (const fn of subscribers){
+        try {
+          fn(changed);
+        }
+        catch {
+          // one broken subscriber (a closed stream) mustn't stop the others
+        }
+      }
+    }
+    return changed;
+  }
+
+  // Bus events arrive in bursts (state + log + finished): check once.
+  function soon(){
+    if (subscribers.size && !pending){
+      pending = setTimeout(check, debounceMs);
+      pending.unref?.();
+    }
+  }
+
+  function start(){
+    fingerprints = compute();
+    timer = setInterval(check, intervalMs);
+    timer.unref?.();
+    for (const e of BUS_EVENTS){
+      bus.on(e, soon);
+    }
+  }
+
+  function stop(){
+    clearInterval(timer);
+    clearTimeout(pending);
+    timer = pending = null;
+    fingerprints = null;
+    for (const e of BUS_EVENTS){
+      bus.off(e, soon);
+    }
+  }
+
+  // Nothing runs while no dashboard is open.
+  function subscribe(fn){
+    subscribers.add(fn);
+    if (subscribers.size === 1){
+      start();
+    }
+    return () => {
+      if (subscribers.delete(fn) && !subscribers.size){
+        stop();
+      }
+    };
+  }
+
+  return { subscribe, check, subscriberCount: () => subscribers.size, TOPICS };
+}
+
+module.exports = { createLiveService, TOPICS };

package/src/services/search.js

@@ -0,0 +1,59 @@
+/**
+ * @file        packages/coordinator/src/services/search.js
+ * @description Dashboard search (?q=): splits the query into words; a record matches when every word occurs in one of its fields
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const MAX_QUERY = 200,
+  MAX_TERMS = 10;
+
+// "  Lab-HW  nucleo " -> ['lab-hw', 'nucleo']. Case-insensitive, words in
+// any order; capped so a pasted wall of text can't build a huge query.
+function parseTerms(q){
+  if (typeof q !== 'string'){
+    return [];
+  }
+  return [...new Set(q.slice(0, MAX_QUERY).toLowerCase().split(/\s+/).filter(Boolean))].slice(0, MAX_TERMS);
+}
+
+// The query as shown back in the search box (trimmed, capped).
+function normalizeQuery(q){
+  return typeof q === 'string' ? q.slice(0, MAX_QUERY).trim() : '';
+}
+
+// In-memory lists (resources, groups, agents): `fields` are the record's
+// searchable values — strings, numbers, arrays of them, or null.
+function matches(fields, terms){
+  if (!terms.length){
+    return true;
+  }
+  const text = fields.flat(Infinity).filter((v) => v !== null && v !== undefined && v !== '').join('\n').toLowerCase();
+  return terms.every((t) => text.includes(t));
+}
+
+// SQL lists (jobs): every term must match at least one of `expressions`
+// (SQL expressions yielding text). LIKE is case-insensitive for ASCII in
+// SQLite; % and _ in the query are matched literally.
+function likeClause(expressions, terms){
+  if (!terms.length){
+    return { sql: '', params: [] };
+  }
+  const one = `(${expressions.map((e) => `COALESCE(${e}, '') LIKE ? ESCAPE '\\'`).join(' OR ')})`,
+    params = [];
+  for (const t of terms){
+    const pattern = `%${t.replace(/[\\%_]/g, (c) => `\\${c}`)}%`;
+    params.push(...expressions.map(() => pattern));
+  }
+  return { sql: terms.map(() => one).join(' AND '), params };
+}
+
+module.exports = { parseTerms, normalizeQuery, matches, likeClause, MAX_QUERY };

package/src/web/routes.js

@@ -25,7 +25,8 @@ const fs = require('node:fs'),
     nextCronRun
   } = require('@andrian.yablonskyy/thub-common'),
   { retentionCutoff, JOB_RETENTION } = require('../services/cleanup'),
-  listPrefs = require('../services/list-prefs');
+  listPrefs = require('../services/list-prefs'),
+  search = require('../services/search');
 
 // Resources page sort keys (list-prefs.js) -> comparators. Empty values
 // (never heartbeated, no version reported) sort last in both directions.
@@ -38,6 +39,15 @@ const RESOURCE_SORT_VALUE = {
   },
   compareResourceValues = (sort, a, b) =>
     sort === 'version' ? compareVersions(a, b) : String(a).localeCompare(String(b), undefined, { numeric: true }),
+  // Agents page (list-prefs `agents`): never-used / never-reported last.
+  AGENT_SORT_VALUE = {
+    name: (a) => a.name,
+    kind: (a) => a.kind,
+    version: (a) => a.version,
+    created: (a) => a.created_at,
+    used: (a) => a.last_used_at,
+    status: (a) => (a.revoked_at ? 'revoked' : 'active')
+  },
 
   // §10.1: avatar uploads are small, single images — a hard size cap and an
   // allow-list of image mimetypes, same spirit as the join-key/token checks
@@ -144,7 +154,7 @@ function createWebRouter({ services, config }){
     // error toast (never auto-closes) — on a page view, not the polling
     // endpoint or a POST whose redirect would drop it.
     const updateError = res.locals.updates.coordinatorUpdateError;
-    if (updateError && user?.role === 'admin' && req.method === 'GET' && req.path !== '/updates/status' &&
+    if (updateError && user?.role === 'admin' && req.method === 'GET' && req.path !== '/updates/status' && !req.thubPassive &&
       req.session.seenUpdateError !== updateError.at){
       req.session.seenUpdateError = updateError.at;
       res.locals.messages = [
@@ -156,7 +166,9 @@ function createWebRouter({ services, config }){
     res.locals.nextCronRun = nextCronRun;
     res.locals.formatDateTime = formatDateTime;
     res.locals.currentPath = req.originalUrl;
-    if (req.session){
+    // A live-update re-fetch (server.js, req.thubPassive) renders the page
+    // only for its data: flash messages stay for the next real page view.
+    if (req.session && !req.thubPassive){
       req.session.flash = [];
     }
 
@@ -181,9 +193,12 @@ function createWebRouter({ services, config }){
     // so a mid-session profile change takes effect immediately, and so
     // `rolling: true` (server.js) actually extends by *this* user's chosen
     // duration each time, not whatever the session happened to start with.
-    if (req.session && user){
+    if (req.session && user && !req.thubPassive){
       req.session.cookie.maxAge = user.sessionTimeoutMin * 60 * 1000;
     }
+    if (req.thubPassive){
+      res.set('Cache-Control', 'no-store');
+    }
 
     next();
   });
@@ -308,6 +323,54 @@ function createWebRouter({ services, config }){
     res.redirect('/profile');
   });
 
+  // Live updates (services/live.js, public/js/live.js): which topics
+  // changed — `resources`, `agents`, `jobs` — never the data itself; the
+  // page re-fetches itself for that, with the same session and templates.
+  // A passive request (server.js): it doesn't extend the idle timeout, and
+  // it ends with `session-ended` once the session expires or logs out.
+  const LIVE_PING_MS = 25_000,
+    LIVE_SESSION_CHECK_MS = 15_000;
+  router.get('/live', (req, res) => {
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no'
+    });
+    res.flushHeaders?.();
+    const write = (event, data) => res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    // retry: how soon EventSource reconnects after the connection drops.
+    res.write('retry: 5000\n\n');
+    write('hello', { topics: services.live.TOPICS });
+
+    const unsubscribe = services.live.subscribe((topics) => write('changed', { topics })),
+      // Comment lines keep proxies from timing the idle stream out.
+      ping = setInterval(() => res.write(': ping\n\n'), LIVE_PING_MS),
+      sessionCheck = setInterval(() => {
+        req.sessionStore.get(req.sessionID, (err, sess) => {
+          if (!err && !sess?.user){
+            write('session-ended', {});
+            res.end();
+          }
+        });
+      }, LIVE_SESSION_CHECK_MS);
+    req.on('close', () => {
+      unsubscribe();
+      clearInterval(ping);
+      clearInterval(sessionCheck);
+    });
+  });
+
+  // Help (views/help/): product guide and setup reference for every
+  // signed-in user. Examples use this Coordinator's URL — the configured
+  // publicUrl, unless that's still the localhost default and the page was
+  // opened from elsewhere.
+  router.get('/help', (req, res) => {
+    const origin = `${req.protocol}://${req.get('host')}`,
+      coordinatorUrl = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(config.publicUrl || '') ? origin : config.publicUrl;
+    res.render('help/index', { title: 'Help', active: 'help', coordinatorUrl: String(coordinatorUrl).replace(/\/+$/, '') });
+  });
+
   router.get('/', (req, res) => {
     const resources = withActiveJobs(services.registry.list()),
       queueLength = services.jobs.list({ state: JOB_STATES.QUEUED, limit: 1000 }).length,
@@ -317,15 +380,21 @@ function createWebRouter({ services, config }){
         .filter((j) => j.created_at >= dayAgo).length,
       onlineCount = resources.filter((r) => r.status !== RESOURCE_STATES.OUT_OF_SERVICE && r.status !== RESOURCE_STATES.REGISTERED).length,
       groupsById = Object.fromEntries(services.groups.list().map((g) => [g.id, g]));
-    res.render('index', { title: 'Overview', active: 'overview', resources, queueLength, jobsLast24h, onlineCount, groupsById });
+    res.render('index', { title: 'Overview', active: 'overview', liveTopics: 'resources jobs', resources, queueLength, jobsLast24h, onlineCount, groupsById });
   });
 
   router.get('/resources', (req, res) => {
     const groupsById = Object.fromEntries(services.groups.list().map((g) => [g.id, g])),
-      view = listView(req, res, 'resources'),
+      q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      view = listView(req, res, 'resources', { q }),
       { sort, dir, size } = view.prefs,
       value = RESOURCE_SORT_VALUE[sort],
-      sorted = services.registry.list().sort((a, b) => {
+      sorted = services.registry.list().filter((r) => search.matches([
+        r.id, r.name, r.reported_name, r.type, r.status, r.busy_source, r.busy_reason, r.client_version, r.remote_addr,
+        r.labels, r.group_ids, r.group_ids.map((id) => groupsById[id]?.name),
+        r.host_info?.hostname, (r.host_info?.addresses || []).map((a) => a.address)
+      ], terms)).sort((a, b) => {
         const va = value(a),
           vb = value(b);
         if (va == null || vb == null){
@@ -338,9 +407,10 @@ function createWebRouter({ services, config }){
     res.render('resources/list', {
       title: 'Resources',
       active: 'resources',
+      liveTopics: 'resources',
       resources: withActiveJobs(sorted.slice(pagination.offset, pagination.offset + pagination.limit)),
       groupsById,
-      list: { ...view, pagination, pageUrl }
+      list: { ...view, pagination, pageUrl, q }
     });
   });
 
@@ -677,7 +747,11 @@ function createWebRouter({ services, config }){
   }));
 
   router.get('/jobs', (req, res) => {
-    const filters = { state: req.query.state || undefined, source: req.query.source || undefined },
+    const filters = {
+        state: req.query.state || undefined,
+        source: req.query.source || undefined,
+        q: search.normalizeQuery(req.query.q) || undefined
+      },
       view = listView(req, res, 'jobs', filters),
       { rows, pagination } = services.jobs.page({ ...filters, ...view.prefs, page: req.query.page }),
       jobs = rows.map((j) => ({
@@ -689,9 +763,10 @@ function createWebRouter({ services, config }){
     res.render('jobs/list', {
       title: 'Jobs',
       active: 'jobs',
+      liveTopics: 'jobs',
       jobs,
       filters,
-      list: { ...view, pagination, pageUrl },
+      list: { ...view, pagination, pageUrl, q: filters.q },
       // A row's Cancel comes back to this exact view (filters, sort, page).
       returnTo: pageUrl(),
       canManage: req.session.user.role === 'admin',
@@ -788,14 +863,19 @@ function createWebRouter({ services, config }){
   // Client config) and Agents. Viewable by anyone logged in; only admins
   // can create/rename/delete.
   router.get('/groups', (req, res) => {
-    const groups = services.groups.list().map((g) => ({
-      ...g,
-      resourceCount: services.registry.list().filter((r) => r.group_ids.includes(g.id)).length
-    }));
+    const q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      resources = services.registry.list(),
+      all = services.groups.list(),
+      groups = all
+        .filter((g) => search.matches([g.id, g.name, g.comment], terms))
+        .map((g) => ({ ...g, resourceCount: resources.filter((r) => r.group_ids.includes(g.id)).length }));
     res.render('groups/list', {
       title: 'Groups',
       active: 'groups',
       groups,
+      q,
+      totalCount: all.length,
       canManage: req.session.user.role === 'admin'
     });
   });
@@ -816,13 +896,42 @@ function createWebRouter({ services, config }){
     res.redirect('/groups');
   });
 
-  router.get('/admin/agents', requireAdminRole, (req, res) => {
-    res.render('admin/agents', { title: 'Agents', active: 'agents', agents: services.agents.list() });
-  });
+  // Agents page: searched (?q=), sorted and paged like Resources (§10.1).
+  // Also what registering one renders, with its token shown once.
+  function renderAgents(req, res, extra = {}){
+    const q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      view = listView(req, res, 'agents', { q }),
+      { sort, dir, size } = view.prefs,
+      value = AGENT_SORT_VALUE[sort],
+      sorted = services.agents.list()
+        .filter((a) => search.matches([a.id, a.name, a.kind, a.version, a.revoked_at ? 'revoked' : 'active'], terms))
+        .sort((a, b) => {
+          const va = value(a),
+            vb = value(b);
+          if (va == null || vb == null){
+            return (va == null) - (vb == null);
+          }
+          return (dir === 'asc' ? 1 : -1) * compareResourceValues(sort, va, vb) || b.created_at.localeCompare(a.created_at);
+        }),
+      pagination = listPrefs.paginate(sorted.length, size, req.query.page),
+      pageUrl = (changes) => view.urlFor({ page: pagination.page, ...changes });
+    res.render('admin/agents', {
+      title: 'Agents',
+      active: 'agents',
+      liveTopics: 'agents',
+      agents: sorted.slice(pagination.offset, pagination.offset + pagination.limit),
+      q,
+      list: { ...view, pagination, pageUrl, q },
+      ...extra
+    });
+  }
+
+  router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
 
   router.post('/admin/agents', requireAdminRole, (req, res) => {
-    const { agent, token } = services.agents.create({ name: req.body.name, kind: req.body.kind });
-    res.render('admin/agents', { title: 'Agents', active: 'agents', agents: services.agents.list(), newToken: token });
+    const { token } = services.agents.create({ name: req.body.name, kind: req.body.kind });
+    renderAgents(req, res, { newToken: token });
   });
 
   router.post('/admin/agents/:id/rename', requireAdminRole, (req, res) => {
@@ -836,12 +945,12 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect('/admin/agents');
+    res.redirect(returnTo(req, '/admin/agents'));
   });
 
   router.post('/admin/agents/:id/revoke', requireAdminRole, (req, res) => {
     services.agents.revoke(req.params.id);
-    res.redirect('/admin/agents');
+    res.redirect(returnTo(req, '/admin/agents'));
   });
 
   return router;

package/test/list-prefs.test.js

@@ -87,3 +87,9 @@ test('jobs.page sorts and pages in SQL, with empty values last', () => {
   assert.equal(second.pagination.pages, 2);
   assert.equal(jobs.page({ state: 'PASSED' }).pagination.total, 0);
 });
+
+test('agents list: sortable columns, newest first by default', () => {
+  assert.deepEqual(normalize('agents'), { size: 25, sort: 'created', dir: 'desc' });
+  assert.deepEqual(normalize('agents', { size: 10, sort: 'used', dir: 'asc' }), { size: 10, sort: 'used', dir: 'asc' });
+  assert.equal(normalize('agents', { sort: 'token' }).sort, 'created'); // not a column: default
+});

package/test/live.test.js

@@ -0,0 +1,153 @@
+/**
+ * @file        packages/coordinator/test/live.test.js
+ * @description Tests: dashboard live updates — change detection per topic, the GET /live stream, and passive re-fetches that leave the session alone
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { EventEmitter } = require('node:events'),
+  { openDb } = require('../src/db'),
+  { createEventsService } = require('../src/services/events'),
+  { createRegistryService } = require('../src/services/registry'),
+  { createAgentsService } = require('../src/services/agents'),
+  { createLiveService } = require('../src/services/live'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('live: reports exactly the topics whose data changed, only while subscribed', async () => {
+  const db = openDb(':memory:'),
+    bus = new EventEmitter(),
+    events = createEventsService(db),
+    registry = createRegistryService(db, { bus, events }),
+    agents = createAgentsService(db, { events }),
+    live = createLiveService(db, { bus, intervalMs: 60_000, debounceMs: 10 }),
+    seen = [];
+
+  assert.deepEqual(live.check(), []); // nobody listening: nothing computed
+  const unsubscribe = live.subscribe((topics) => seen.push(topics));
+  assert.equal(live.subscriberCount(), 1);
+  assert.deepEqual(live.check(), []); // nothing changed yet
+
+  registry.registerAuto({ clientId: 'c1', name: 'lab-hw-01', type: 'hw', labels: [] });
+  assert.deepEqual(live.check(), ['resources']);
+  agents.create({ name: 'ci', kind: 'ci' });
+  assert.deepEqual(live.check(), ['agents']);
+  assert.deepEqual(live.check(), []);
+
+  // A bus event triggers a check by itself (debounced), without the timer.
+  db.prepare('INSERT INTO jobs (id, agent_id, source, state, spec, priority, attempt, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+    .run('M-00001', agents.list()[0].id, 'cli', 'QUEUED', '{}', 60, 0, new Date().toISOString());
+  bus.emit('job.queued', { jobId: 'M-00001' });
+  await new Promise((r) => setTimeout(r, 50));
+  assert.deepEqual(seen.at(-1), ['jobs']);
+
+  unsubscribe();
+  assert.equal(live.subscriberCount(), 0);
+  assert.equal(bus.listenerCount('job.queued'), 0); // stopped listening
+});
+
+// --- over HTTP: /live and passive re-fetches ------------------------------
+
+function startApp(t){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-live-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  return new Promise((r) => server.on('listening', () => r({ base: `http://127.0.0.1:${server.address().port}`, services })));
+}
+
+const expiresOf = (res) => {
+  const m = /Expires=([^;]+)/.exec(res.headers.get('set-cookie') || '');
+  return m ? Date.parse(m[1]) : null;
+};
+
+async function login(base){
+  const res = await fetch(`${base}/login`, {
+    method: 'POST',
+    body: new URLSearchParams({ username: 'admin', password: 'pw' }),
+    redirect: 'manual'
+  });
+  return { cookie: res.headers.get('set-cookie').split(';')[0], expires: expiresOf(res) };
+}
+
+test('live: /live streams hello and changes; passive re-fetches keep the idle timeout and flash', async (t) => {
+  const { base, services } = await startApp(t),
+    { cookie, expires } = await login(base);
+  assert.ok(expires);
+
+  // The stream: hello, then `changed` when a resource appears.
+  const ctrl = new AbortController(),
+    stream = await fetch(`${base}/live`, { headers: { cookie }, signal: ctrl.signal }),
+    reader = stream.body.getReader(),
+    decoder = new TextDecoder();
+  assert.equal(stream.headers.get('content-type'), 'text/event-stream');
+  let text = '';
+  const until = async (re) => {
+    while (!re.test(text)){
+      const { value, done } = await reader.read();
+      if (done){
+        break;
+      }
+      text += decoder.decode(value);
+    }
+    return re.exec(text);
+  };
+  assert.ok(await until(/event: hello/));
+  assert.equal(services.live.subscriberCount(), 1);
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  services.live.check();
+  assert.match((await until(/event: changed\ndata: (.*)\n/))[1], /"resources"/);
+  ctrl.abort();
+
+  // A flash waiting for the next page view (a real request: it sets the
+  // expiry the passive one below must leave alone)…
+  const flashing = await fetch(`${base}/profile/password`, {
+      method: 'POST', headers: { cookie }, body: new URLSearchParams({ currentPassword: 'wrong', newPassword: 'a', confirmPassword: 'b' }),
+      redirect: 'manual'
+    }),
+    lastActive = expiresOf(flashing);
+  assert.ok(lastActive >= expires);
+  // Wait past a whole second, so a refreshed expiry would differ.
+  await new Promise((r) => setTimeout(r, 1100));
+
+  // …survives a passive re-fetch, which also doesn't push the expiry out.
+  const passive = await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' } });
+  assert.equal(passive.status, 200);
+  assert.match(passive.headers.get('cache-control'), /no-store/);
+  const passiveExpires = expiresOf(passive);
+  assert.ok(passiveExpires === null || passiveExpires === lastActive, 'passive request must not extend the session');
+  assert.match(await passive.text(), /data-live="rows"/);
+
+  // A real page view gets the flash, and extends the session as before.
+  const real = await fetch(`${base}/profile`, { headers: { cookie } });
+  assert.ok(expiresOf(real) > lastActive);
+  assert.match(await real.text(), /data-thub-toast="danger"/);
+
+  // Signed out: the stream is refused (EventSource then stops), and a
+  // passive re-fetch is redirected to the login page.
+  await fetch(`${base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
+  assert.equal((await fetch(`${base}/live`, { headers: { cookie, accept: 'text/event-stream' } })).status, 401);
+  assert.equal((await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' }, redirect: 'manual' })).status, 302);
+});