@andrian.yablonskyy/thub-coordinator 1.0.37 → 1.0.39

package/src/web/routes.js

@@ -16,6 +16,7 @@
 const fs = require('node:fs'),
   os = require('node:os'),
   path = require('node:path'),
+  { once } = require('node:events'),
   express = require('express'),
   multer = require('multer'),
   { requireAdminSession, requireAdminRole } = require('../auth'),
@@ -25,11 +26,16 @@ const fs = require('node:fs'),
     nextCronRun
   } = require('@andrian.yablonskyy/thub-common'),
   { retentionCutoff, JOB_RETENTION } = require('../services/cleanup'),
-  listPrefs = require('../services/list-prefs');
+  listPrefs = require('../services/list-prefs'),
+  search = require('../services/search');
 
-// Resources page sort keys (list-prefs.js) -> comparators. Empty values
-// (never heartbeated, no version reported) sort last in both directions.
-const RESOURCE_SORT_VALUE = {
+// Job log viewer: lines per page it loads (and the most one request may ask for).
+const LOG_PAGE = 1000,
+  LOG_PAGE_MAX = 5000,
+
+  // Resources page sort keys (list-prefs.js) -> comparators. Empty values
+  // (never heartbeated, no version reported) sort last in both directions.
+  RESOURCE_SORT_VALUE = {
     name: (r) => r.name,
     type: (r) => r.type,
     version: (r) => r.client_version,
@@ -38,6 +44,15 @@ const RESOURCE_SORT_VALUE = {
   },
   compareResourceValues = (sort, a, b) =>
     sort === 'version' ? compareVersions(a, b) : String(a).localeCompare(String(b), undefined, { numeric: true }),
+  // Agents page (list-prefs `agents`): never-used / never-reported last.
+  AGENT_SORT_VALUE = {
+    name: (a) => a.name,
+    kind: (a) => a.kind,
+    version: (a) => a.version,
+    created: (a) => a.created_at,
+    used: (a) => a.last_used_at,
+    status: (a) => (a.revoked_at ? 'revoked' : 'active')
+  },
 
   // §10.1: avatar uploads are small, single images — a hard size cap and an
   // allow-list of image mimetypes, same spirit as the join-key/token checks
@@ -144,7 +159,7 @@ function createWebRouter({ services, config }){
     // error toast (never auto-closes) — on a page view, not the polling
     // endpoint or a POST whose redirect would drop it.
     const updateError = res.locals.updates.coordinatorUpdateError;
-    if (updateError && user?.role === 'admin' && req.method === 'GET' && req.path !== '/updates/status' &&
+    if (updateError && user?.role === 'admin' && req.method === 'GET' && req.path !== '/updates/status' && !req.thubPassive &&
       req.session.seenUpdateError !== updateError.at){
       req.session.seenUpdateError = updateError.at;
       res.locals.messages = [
@@ -156,7 +171,9 @@ function createWebRouter({ services, config }){
     res.locals.nextCronRun = nextCronRun;
     res.locals.formatDateTime = formatDateTime;
     res.locals.currentPath = req.originalUrl;
-    if (req.session){
+    // A live-update re-fetch (server.js, req.thubPassive) renders the page
+    // only for its data: flash messages stay for the next real page view.
+    if (req.session && !req.thubPassive){
       req.session.flash = [];
     }
 
@@ -181,21 +198,45 @@ function createWebRouter({ services, config }){
     // so a mid-session profile change takes effect immediately, and so
     // `rolling: true` (server.js) actually extends by *this* user's chosen
     // duration each time, not whatever the session happened to start with.
-    if (req.session && user){
+    if (req.session && user && !req.thubPassive){
       req.session.cookie.maxAge = user.sessionTimeoutMin * 60 * 1000;
     }
+    if (req.thubPassive){
+      res.set('Cache-Control', 'no-store');
+    }
 
     next();
   });
 
+  // A Secure-only session cookie (server.js cookieSecure, §12) is never
+  // sent back over plain HTTP, so signing in would just loop back here.
+  // Say why instead — usually a proxy not passing X-Forwarded-Proto.
+  function httpsProblem(req){
+    if (req.session.cookie.secure !== true || req.secure){
+      return null;
+    }
+    return {
+      type: 'danger',
+      sticky: true,
+      text: `Signing in needs HTTPS: this Coordinator's session cookie is sent only over HTTPS (publicUrl is ${config.publicUrl}), ` +
+        'but this request reached it as plain HTTP. Open the dashboard through that https:// address; behind a reverse proxy, ' +
+        'make it send "X-Forwarded-Proto: https" and check trustProxy. To allow plain HTTP, set session.secureCookie to false.'
+    };
+  }
+
   router.get('/login', (req, res) => {
     if (req.session.user){
       return res.redirect('/');
     }
-    res.render('login', { title: 'Sign in' });
+    const problem = httpsProblem(req);
+    res.render('login', { title: 'Sign in', ...(problem ? { messages: [problem] } : {}) });
   });
 
   router.post('/login', (req, res) => {
+    const problem = httpsProblem(req);
+    if (problem){
+      return res.status(400).render('login', { title: 'Sign in', messages: [problem] });
+    }
     const { username, password } = req.body,
       user = services.adminUsers.verify(username, password);
     if (!user){
@@ -308,6 +349,54 @@ function createWebRouter({ services, config }){
     res.redirect('/profile');
   });
 
+  // Live updates (services/live.js, public/js/live.js): which topics
+  // changed — `resources`, `agents`, `jobs` — never the data itself; the
+  // page re-fetches itself for that, with the same session and templates.
+  // A passive request (server.js): it doesn't extend the idle timeout, and
+  // it ends with `session-ended` once the session expires or logs out.
+  const LIVE_PING_MS = 25_000,
+    LIVE_SESSION_CHECK_MS = 15_000;
+  router.get('/live', (req, res) => {
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no'
+    });
+    res.flushHeaders?.();
+    const write = (event, data) => res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    // retry: how soon EventSource reconnects after the connection drops.
+    res.write('retry: 5000\n\n');
+    write('hello', { topics: services.live.TOPICS });
+
+    const unsubscribe = services.live.subscribe((topics) => write('changed', { topics })),
+      // Comment lines keep proxies from timing the idle stream out.
+      ping = setInterval(() => res.write(': ping\n\n'), LIVE_PING_MS),
+      sessionCheck = setInterval(() => {
+        req.sessionStore.get(req.sessionID, (err, sess) => {
+          if (!err && !sess?.user){
+            write('session-ended', {});
+            res.end();
+          }
+        });
+      }, LIVE_SESSION_CHECK_MS);
+    req.on('close', () => {
+      unsubscribe();
+      clearInterval(ping);
+      clearInterval(sessionCheck);
+    });
+  });
+
+  // Help (views/help/): product guide and setup reference for every
+  // signed-in user. Examples use this Coordinator's URL — the configured
+  // publicUrl, unless that's still the localhost default and the page was
+  // opened from elsewhere.
+  router.get('/help', (req, res) => {
+    const origin = `${req.protocol}://${req.get('host')}`,
+      coordinatorUrl = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(config.publicUrl || '') ? origin : config.publicUrl;
+    res.render('help/index', { title: 'Help', active: 'help', coordinatorUrl: String(coordinatorUrl).replace(/\/+$/, '') });
+  });
+
   router.get('/', (req, res) => {
     const resources = withActiveJobs(services.registry.list()),
       queueLength = services.jobs.list({ state: JOB_STATES.QUEUED, limit: 1000 }).length,
@@ -317,15 +406,21 @@ function createWebRouter({ services, config }){
         .filter((j) => j.created_at >= dayAgo).length,
       onlineCount = resources.filter((r) => r.status !== RESOURCE_STATES.OUT_OF_SERVICE && r.status !== RESOURCE_STATES.REGISTERED).length,
       groupsById = Object.fromEntries(services.groups.list().map((g) => [g.id, g]));
-    res.render('index', { title: 'Overview', active: 'overview', resources, queueLength, jobsLast24h, onlineCount, groupsById });
+    res.render('index', { title: 'Overview', active: 'overview', liveTopics: 'resources jobs', resources, queueLength, jobsLast24h, onlineCount, groupsById });
   });
 
   router.get('/resources', (req, res) => {
     const groupsById = Object.fromEntries(services.groups.list().map((g) => [g.id, g])),
-      view = listView(req, res, 'resources'),
+      q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      view = listView(req, res, 'resources', { q }),
       { sort, dir, size } = view.prefs,
       value = RESOURCE_SORT_VALUE[sort],
-      sorted = services.registry.list().sort((a, b) => {
+      sorted = services.registry.list().filter((r) => search.matches([
+        r.id, r.name, r.reported_name, r.type, r.status, r.busy_source, r.busy_reason, r.client_version, r.remote_addr,
+        r.labels, r.group_ids, r.group_ids.map((id) => groupsById[id]?.name),
+        r.host_info?.hostname, (r.host_info?.addresses || []).map((a) => a.address)
+      ], terms)).sort((a, b) => {
         const va = value(a),
           vb = value(b);
         if (va == null || vb == null){
@@ -338,9 +433,10 @@ function createWebRouter({ services, config }){
     res.render('resources/list', {
       title: 'Resources',
       active: 'resources',
+      liveTopics: 'resources',
       resources: withActiveJobs(sorted.slice(pagination.offset, pagination.offset + pagination.limit)),
       groupsById,
-      list: { ...view, pagination, pageUrl }
+      list: { ...view, pagination, pageUrl, q }
     });
   });
 
@@ -677,7 +773,11 @@ function createWebRouter({ services, config }){
   }));
 
   router.get('/jobs', (req, res) => {
-    const filters = { state: req.query.state || undefined, source: req.query.source || undefined },
+    const filters = {
+        state: req.query.state || undefined,
+        source: req.query.source || undefined,
+        q: search.normalizeQuery(req.query.q) || undefined
+      },
       view = listView(req, res, 'jobs', filters),
       { rows, pagination } = services.jobs.page({ ...filters, ...view.prefs, page: req.query.page }),
       jobs = rows.map((j) => ({
@@ -689,9 +789,10 @@ function createWebRouter({ services, config }){
     res.render('jobs/list', {
       title: 'Jobs',
       active: 'jobs',
+      liveTopics: 'jobs',
       jobs,
       filters,
-      list: { ...view, pagination, pageUrl },
+      list: { ...view, pagination, pageUrl, q: filters.q },
       // A row's Cancel comes back to this exact view (filters, sort, page).
       returnTo: pageUrl(),
       canManage: req.session.user.role === 'admin',
@@ -711,7 +812,7 @@ function createWebRouter({ services, config }){
   });
 
   // "Clean up database" (§9): everything before the given time — finished
-  // jobs with their logs/artifacts, and older history — then VACUUM. The
+  // jobs with their logs, and older history — then VACUUM. The
   // time is dd/mm/yyyy HH:MM:SS in the user's own time zone.
   router.post('/jobs/clean-history', requireAdminRole, (req, res) => {
     const tz = req.session.user.timezone || 'UTC',
@@ -743,8 +844,7 @@ function createWebRouter({ services, config }){
       return res.status(404).send('Not found');
     }
     job.resource = job.resource_id ? services.registry.get(job.resource_id) : null;
-    const artifacts = services.artifacts.listForJob(job.id).map((a) => ({ ...a, url: services.artifacts.signedUrl(a) })),
-      jobActive = ACTIVE_JOB_STATES.has(job.state);
+    const jobActive = ACTIVE_JOB_STATES.has(job.state);
     res.render('jobs/show', {
       title: job.id,
       active: 'jobs',
@@ -754,7 +854,6 @@ function createWebRouter({ services, config }){
         ? services.registry.waitingReason(job.spec.target.type, job.spec.target.labels || [], job.spec.target.group,
           job.spec.target.client)
         : null,
-      artifacts,
       jobActive,
       canCancel: req.session.user.role === 'admin' && jobActive
     });
@@ -772,15 +871,53 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, `/jobs/${req.params.id}`));
   });
 
-  // Plain, one-shot fetch — used by the log viewer for a job that's
-  // already finished, so it doesn't open a live connection (§SSE) for
-  // output that will never change again.
+  // The log viewer's pages (public/js/log-viewer.js): the last `limit`
+  // lines first, then earlier ones (`before` = the oldest seq it has) as the
+  // reader scrolls up. `total` is how many lines the job has in all.
   router.get('/jobs/:id/logs', (req, res) => {
-    res.json({ lines: services.logs.listSince(req.params.id, 0) });
+    const before = Number.parseInt(req.query.before, 10),
+      limit = Math.min(Math.max(Number.parseInt(req.query.limit, 10) || LOG_PAGE, 1), LOG_PAGE_MAX),
+      page = services.logs.pageBefore(req.params.id, before > 0 ? before : undefined, limit);
+    res.json({ ...page, total: services.logs.count(req.params.id) });
+  });
+
+  // RAW (log viewer): the whole log as plain text, for a new tab, a
+  // download or grep. Streamed in pages, waiting for the socket to drain,
+  // so a huge log never sits in memory. Log lines live as long as their job
+  // (§9), so this is always the complete log.
+  router.get('/jobs/:id/log.txt', async (req, res, next) => {
+    try {
+      const job = services.jobs.get(req.params.id);
+      if (!job){
+        return res.status(404).type('text/plain').send('Unknown job');
+      }
+      res.set({
+        'Content-Type': 'text/plain; charset=utf-8',
+        // The log is whatever the job printed: never let a browser sniff it
+        // into HTML.
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Disposition': `inline; filename="${job.id}.log"`,
+        'Cache-Control': 'no-store'
+      });
+      for (let seq = 0, page; (page = services.logs.listSince(job.id, seq, LOG_PAGE_MAX)).length;){
+        const chunk = page.map((l) => `[${l.ts}] [${l.stream}] ${l.line}\n`).join('');
+        seq = page.at(-1).seq;
+        if (!res.write(chunk)){
+          await once(res, 'drain');
+        }
+        if (res.destroyed){
+          return;
+        }
+      }
+      res.end();
+    }
+    catch (err){
+      next(err);
+    }
   });
 
   router.get('/jobs/:id/stream', (req, res) => {
-    attachJobStream(req, res, { jobId: req.params.id, services, config });
+    attachJobStream(req, res, { jobId: req.params.id, services });
   });
 
   // Resource groups (§13.1) — their own page since they're a distinct
@@ -788,14 +925,19 @@ function createWebRouter({ services, config }){
   // Client config) and Agents. Viewable by anyone logged in; only admins
   // can create/rename/delete.
   router.get('/groups', (req, res) => {
-    const groups = services.groups.list().map((g) => ({
-      ...g,
-      resourceCount: services.registry.list().filter((r) => r.group_ids.includes(g.id)).length
-    }));
+    const q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      resources = services.registry.list(),
+      all = services.groups.list(),
+      groups = all
+        .filter((g) => search.matches([g.id, g.name, g.comment], terms))
+        .map((g) => ({ ...g, resourceCount: resources.filter((r) => r.group_ids.includes(g.id)).length }));
     res.render('groups/list', {
       title: 'Groups',
       active: 'groups',
       groups,
+      q,
+      totalCount: all.length,
       canManage: req.session.user.role === 'admin'
     });
   });
@@ -816,13 +958,42 @@ function createWebRouter({ services, config }){
     res.redirect('/groups');
   });
 
-  router.get('/admin/agents', requireAdminRole, (req, res) => {
-    res.render('admin/agents', { title: 'Agents', active: 'agents', agents: services.agents.list() });
-  });
+  // Agents page: searched (?q=), sorted and paged like Resources (§10.1).
+  // Also what registering one renders, with its token shown once.
+  function renderAgents(req, res, extra = {}){
+    const q = search.normalizeQuery(req.query.q),
+      terms = search.parseTerms(q),
+      view = listView(req, res, 'agents', { q }),
+      { sort, dir, size } = view.prefs,
+      value = AGENT_SORT_VALUE[sort],
+      sorted = services.agents.list()
+        .filter((a) => search.matches([a.id, a.name, a.kind, a.version, a.revoked_at ? 'revoked' : 'active'], terms))
+        .sort((a, b) => {
+          const va = value(a),
+            vb = value(b);
+          if (va == null || vb == null){
+            return (va == null) - (vb == null);
+          }
+          return (dir === 'asc' ? 1 : -1) * compareResourceValues(sort, va, vb) || b.created_at.localeCompare(a.created_at);
+        }),
+      pagination = listPrefs.paginate(sorted.length, size, req.query.page),
+      pageUrl = (changes) => view.urlFor({ page: pagination.page, ...changes });
+    res.render('admin/agents', {
+      title: 'Agents',
+      active: 'agents',
+      liveTopics: 'agents',
+      agents: sorted.slice(pagination.offset, pagination.offset + pagination.limit),
+      q,
+      list: { ...view, pagination, pageUrl, q },
+      ...extra
+    });
+  }
+
+  router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
 
   router.post('/admin/agents', requireAdminRole, (req, res) => {
-    const { agent, token } = services.agents.create({ name: req.body.name, kind: req.body.kind });
-    res.render('admin/agents', { title: 'Agents', active: 'agents', agents: services.agents.list(), newToken: token });
+    const { token } = services.agents.create({ name: req.body.name, kind: req.body.kind });
+    renderAgents(req, res, { newToken: token });
   });
 
   router.post('/admin/agents/:id/rename', requireAdminRole, (req, res) => {
@@ -836,12 +1007,12 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect('/admin/agents');
+    res.redirect(returnTo(req, '/admin/agents'));
   });
 
   router.post('/admin/agents/:id/revoke', requireAdminRole, (req, res) => {
     services.agents.revoke(req.params.id);
-    res.redirect('/admin/agents');
+    res.redirect(returnTo(req, '/admin/agents'));
   });
 
   return router;

package/test/cleanup.test.js

@@ -23,7 +23,6 @@ const test = require('node:test'),
   { createEventsService } = require('../src/services/events'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
   { createCleanupService, retentionCutoff } = require('../src/services/cleanup'),
   { JOB_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -35,8 +34,6 @@ function setup(jobRetention = 'forever'){
     config = {
       dataDir,
       dbPath: path.join(dataDir, 'thub.db'),
-      artifactsDir: path.join(dataDir, 'artifacts'),
-      artifacts: { linkTtlHours: 1 },
       sessionSecret: 's',
       publicUrl: 'http://x',
       scheduler: { maxQueuedPerAgent: 1000 },
@@ -48,8 +45,7 @@ function setup(jobRetention = 'forever'){
     events = createEventsService(db),
     registry = createRegistryService(db, { bus, events }),
     { agent } = createAgentsService(db, { events }).create({ name: 'ci', kind: 'ci' }),
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     cleanup = createCleanupService(db, { jobs, config, now: () => NOW });
   registry.registerAuto({ clientId: 'c', name: 'lab', type: 'sw', labels: [] });
 

package/test/list-prefs.test.js

@@ -87,3 +87,9 @@ test('jobs.page sorts and pages in SQL, with empty values last', () => {
   assert.equal(second.pagination.pages, 2);
   assert.equal(jobs.page({ state: 'PASSED' }).pagination.total, 0);
 });
+
+test('agents list: sortable columns, newest first by default', () => {
+  assert.deepEqual(normalize('agents'), { size: 25, sort: 'created', dir: 'desc' });
+  assert.deepEqual(normalize('agents', { size: 10, sort: 'used', dir: 'asc' }), { size: 10, sort: 'used', dir: 'asc' });
+  assert.equal(normalize('agents', { sort: 'token' }).sort, 'created'); // not a column: default
+});

package/test/live.test.js

@@ -0,0 +1,153 @@
+/**
+ * @file        packages/coordinator/test/live.test.js
+ * @description Tests: dashboard live updates — change detection per topic, the GET /live stream, and passive re-fetches that leave the session alone
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { EventEmitter } = require('node:events'),
+  { openDb } = require('../src/db'),
+  { createEventsService } = require('../src/services/events'),
+  { createRegistryService } = require('../src/services/registry'),
+  { createAgentsService } = require('../src/services/agents'),
+  { createLiveService } = require('../src/services/live'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+test('live: reports exactly the topics whose data changed, only while subscribed', async () => {
+  const db = openDb(':memory:'),
+    bus = new EventEmitter(),
+    events = createEventsService(db),
+    registry = createRegistryService(db, { bus, events }),
+    agents = createAgentsService(db, { events }),
+    live = createLiveService(db, { bus, intervalMs: 60_000, debounceMs: 10 }),
+    seen = [];
+
+  assert.deepEqual(live.check(), []); // nobody listening: nothing computed
+  const unsubscribe = live.subscribe((topics) => seen.push(topics));
+  assert.equal(live.subscriberCount(), 1);
+  assert.deepEqual(live.check(), []); // nothing changed yet
+
+  registry.registerAuto({ clientId: 'c1', name: 'lab-hw-01', type: 'hw', labels: [] });
+  assert.deepEqual(live.check(), ['resources']);
+  agents.create({ name: 'ci', kind: 'ci' });
+  assert.deepEqual(live.check(), ['agents']);
+  assert.deepEqual(live.check(), []);
+
+  // A bus event triggers a check by itself (debounced), without the timer.
+  db.prepare('INSERT INTO jobs (id, agent_id, source, state, spec, priority, attempt, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+    .run('M-00001', agents.list()[0].id, 'cli', 'QUEUED', '{}', 60, 0, new Date().toISOString());
+  bus.emit('job.queued', { jobId: 'M-00001' });
+  await new Promise((r) => setTimeout(r, 50));
+  assert.deepEqual(seen.at(-1), ['jobs']);
+
+  unsubscribe();
+  assert.equal(live.subscriberCount(), 0);
+  assert.equal(bus.listenerCount('job.queued'), 0); // stopped listening
+});
+
+// --- over HTTP: /live and passive re-fetches ------------------------------
+
+function startApp(t){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-live-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  return new Promise((r) => server.on('listening', () => r({ base: `http://127.0.0.1:${server.address().port}`, services })));
+}
+
+const expiresOf = (res) => {
+  const m = /Expires=([^;]+)/.exec(res.headers.get('set-cookie') || '');
+  return m ? Date.parse(m[1]) : null;
+};
+
+async function login(base){
+  const res = await fetch(`${base}/login`, {
+    method: 'POST',
+    body: new URLSearchParams({ username: 'admin', password: 'pw' }),
+    redirect: 'manual'
+  });
+  return { cookie: res.headers.get('set-cookie').split(';')[0], expires: expiresOf(res) };
+}
+
+test('live: /live streams hello and changes; passive re-fetches keep the idle timeout and flash', async (t) => {
+  const { base, services } = await startApp(t),
+    { cookie, expires } = await login(base);
+  assert.ok(expires);
+
+  // The stream: hello, then `changed` when a resource appears.
+  const ctrl = new AbortController(),
+    stream = await fetch(`${base}/live`, { headers: { cookie }, signal: ctrl.signal }),
+    reader = stream.body.getReader(),
+    decoder = new TextDecoder();
+  assert.equal(stream.headers.get('content-type'), 'text/event-stream');
+  let text = '';
+  const until = async (re) => {
+    while (!re.test(text)){
+      const { value, done } = await reader.read();
+      if (done){
+        break;
+      }
+      text += decoder.decode(value);
+    }
+    return re.exec(text);
+  };
+  assert.ok(await until(/event: hello/));
+  assert.equal(services.live.subscriberCount(), 1);
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  services.live.check();
+  assert.match((await until(/event: changed\ndata: (.*)\n/))[1], /"resources"/);
+  ctrl.abort();
+
+  // A flash waiting for the next page view (a real request: it sets the
+  // expiry the passive one below must leave alone)…
+  const flashing = await fetch(`${base}/profile/password`, {
+      method: 'POST', headers: { cookie }, body: new URLSearchParams({ currentPassword: 'wrong', newPassword: 'a', confirmPassword: 'b' }),
+      redirect: 'manual'
+    }),
+    lastActive = expiresOf(flashing);
+  assert.ok(lastActive >= expires);
+  // Wait past a whole second, so a refreshed expiry would differ.
+  await new Promise((r) => setTimeout(r, 1100));
+
+  // …survives a passive re-fetch, which also doesn't push the expiry out.
+  const passive = await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' } });
+  assert.equal(passive.status, 200);
+  assert.match(passive.headers.get('cache-control'), /no-store/);
+  const passiveExpires = expiresOf(passive);
+  assert.ok(passiveExpires === null || passiveExpires === lastActive, 'passive request must not extend the session');
+  assert.match(await passive.text(), /data-live="rows"/);
+
+  // A real page view gets the flash, and extends the session as before.
+  const real = await fetch(`${base}/profile`, { headers: { cookie } });
+  assert.ok(expiresOf(real) > lastActive);
+  assert.match(await real.text(), /data-thub-toast="danger"/);
+
+  // Signed out: the stream is refused (EventSource then stops), and a
+  // passive re-fetch is redirected to the login page.
+  await fetch(`${base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
+  assert.equal((await fetch(`${base}/live`, { headers: { cookie, accept: 'text/event-stream' } })).status, 401);
+  assert.equal((await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' }, redirect: 'manual' })).status, 302);
+});