@andrian.yablonskyy/thub-coordinator 1.0.38 → 1.0.39

package/test/logs.test.js

@@ -0,0 +1,150 @@
+/**
+ * @file        packages/coordinator/test/logs.test.js
+ * @description Tests: job log paging for the dashboard viewer, the full SSE replay, and the raw log (RAW button)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+// A Coordinator on a random port, an admin session, and one job with `n`
+// log lines ("line 1".."line n").
+async function setup(t, n){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-logs-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const login = await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    }),
+    cookie = login.headers.get('set-cookie').split(';')[0],
+    { agent } = services.agents.create({ name: 'ci', kind: 'ci' });
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './t.sh' } });
+  for (let i = 0; i < n; i += 500){
+    services.logs.appendBatch(job.id, Array.from({ length: Math.min(500, n - i) }, (_, k) => ({ stream: 'runner', line: `line ${i + k + 1}` })));
+  }
+  const finish = () => services.db.prepare('UPDATE jobs SET state = ?, finished_at = ? WHERE id = ?').run('PASSED', new Date().toISOString(), job.id);
+  return { base, cookie, services, job, finish, get: (p) => fetch(`${base}${p}`, { headers: { cookie } }) };
+}
+
+test('log pages: the end first, then earlier pages until the start', async (t) => {
+  const { get, job } = await setup(t, 2500),
+    last = await (await get(`/jobs/${job.id}/logs?limit=1000`)).json();
+  assert.equal(last.total, 2500);
+  assert.equal(last.hasMore, true);
+  assert.equal(last.lines.length, 1000);
+  assert.equal(last.lines[0].line, 'line 1501');
+  assert.equal(last.lines.at(-1).line, 'line 2500');
+
+  const earlier = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${last.lines[0].seq}`)).json();
+  assert.deepEqual([earlier.lines[0].line, earlier.lines.at(-1).line, earlier.hasMore], ['line 501', 'line 1500', true]);
+
+  const first = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${earlier.lines[0].seq}`)).json();
+  assert.deepEqual([first.lines.length, first.lines[0].line, first.hasMore], [500, 'line 1', false]);
+
+  // Limits are clamped: never more than 5000 a request.
+  assert.equal((await (await get(`/jobs/${job.id}/logs?limit=999999`)).json()).lines.length, 2500);
+});
+
+test('log stream replays every line, not just the first 500', async (t) => {
+  const { get, job, finish } = await setup(t, 1234);
+  finish();
+  const text = await (await get(`/jobs/${job.id}/stream`)).text(),
+    lines = [...text.matchAll(/^event: log$/gm)].length;
+  assert.equal(lines, 1234);
+  assert.match(text, /"line":"line 1234"/);
+  assert.match(text, /event: end/);
+
+  // Resuming after a seq replays only what follows it.
+  const resumed = await (await get(`/jobs/${job.id}/stream?after=1200`)).text();
+  assert.equal([...resumed.matchAll(/^event: log$/gm)].length, 34);
+});
+
+test('RAW: the whole log as plain text, for as long as the job exists', async (t) => {
+  const { get, job, finish, services } = await setup(t, 6001),
+    res = await get(`/jobs/${job.id}/log.txt`),
+    text = await res.text();
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get('content-type'), /^text\/plain; charset=utf-8/);
+  assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+  assert.match(res.headers.get('content-disposition'), new RegExp(`inline; filename="${job.id}.log"`));
+  const rows = text.trimEnd().split('\n');
+  assert.equal(rows.length, 6001); // more than one 5000-line page
+  assert.match(rows[0], /^\[\d{4}-\d\d-\d\dT[^\]]+\] \[runner\] line 1$/);
+  assert.match(rows.at(-1), /\] \[runner\] line 6001$/);
+
+  // Still complete once the job has finished — no retention of its own
+  // (log lines go with the job), and no artifact to fall back to.
+  finish();
+  assert.equal((await (await get(`/jobs/${job.id}/log.txt`)).text()).trimEnd().split('\n').length, 6001);
+  services.db.prepare('DELETE FROM job_logs WHERE job_id = ?').run(job.id);
+  assert.equal(await (await get(`/jobs/${job.id}/log.txt`)).text(), '');
+
+  assert.equal((await get('/jobs/M-99999/log.txt')).status, 404);
+});
+
+test('artifacts are gone: old Clients\' uploads are discarded, old Agents get none, the store is removed', async (t) => {
+  const { base, services, job } = await setup(t, 3),
+    { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c9', name: 'lab-hw-09', type: 'hw', labels: [] }),
+    { token: agentToken } = services.agents.create({ name: 'old-agent', kind: 'cli' });
+  services.db.prepare('UPDATE jobs SET resource_id = ? WHERE id = ?').run(resourceId, job.id);
+
+  // An old Client still uploads its results after the job: accepted (so the
+  // job doesn't end in ERROR), stored nowhere.
+  const form = new FormData();
+  form.append('files', new Blob(['<testsuite tests="1"/>']), 'results.xml');
+  const upload = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, {
+    method: 'POST', headers: { authorization: `Bearer ${resourceToken}` }, body: form
+  });
+  assert.equal(upload.status, 201);
+  assert.deepEqual(await upload.json(), { artifacts: [] });
+  assert.equal(fs.existsSync(path.join(path.dirname(services.db.name), 'artifacts')), false);
+
+  // An old Agent's `thub status` still asks: none.
+  const listed = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, { headers: { authorization: `Bearer ${agentToken}` } });
+  assert.deepEqual(await listed.json(), { artifacts: [] });
+
+  // No table, no download route.
+  assert.equal(services.db.prepare('SELECT COUNT(*) AS n FROM sqlite_master WHERE name = ?').get('artifacts').n, 0);
+  assert.equal((await fetch(`${base}/artifacts/download/x.y.z`, { redirect: 'manual' })).status, 302); // just the login redirect
+});
+
+test('upgrade: a leftover <dataDir>/artifacts is deleted on startup', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-legacy-')),
+    file = path.join(dir, 'coordinator.json'),
+    legacy = path.join(dir, 'data', 'artifacts', 'M-00001');
+  fs.mkdirSync(legacy, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'console.log'), 'old');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 } }));
+  const log = t.mock.method(console, 'log', () => {});
+  buildServices(loadConfig(file));
+  assert.equal(fs.existsSync(path.join(dir, 'data', 'artifacts')), false);
+  assert.match(log.mock.calls[0].arguments[0], /no longer stores job artifacts/);
+});

package/test/scheduler.test.js

@@ -25,8 +25,8 @@ const test = require('node:test'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
   { createGroupsService } = require('../src/services/groups'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
+  { createLogsService } = require('../src/services/logs'),
   { createScheduler } = require('../src/services/scheduler'),
   { createHeartbeatMonitor } = require('../src/services/heartbeat'),
   { JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -42,22 +42,19 @@ function buildTestServices(overrides = {}){
     registry = createRegistryService(db, { bus, events }),
     agents = createAgentsService(db, { events }),
     groups = createGroupsService(db, { events, registry }),
-    artifactsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-test-artifacts-')),
     config = {
       scheduler: { assignAckTimeoutSec: 15, requeueOnLost: true, maxQueuedPerAgent: 20, tickIntervalSec: 3600 },
       jobs: { defaultTimeoutSec: 1800, maxTimeoutSec: 14400 },
       heartbeat: { intervalSec: 10, missedLimit: 3, sweepIntervalSec: 3600 },
-      artifactsDir,
       sessionSecret: 'test-secret',
       publicUrl: 'http://localhost:8080',
-      artifacts: { linkTtlHours: 1 },
       ...overrides
     },
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    logs = createLogsService(db, { bus }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     scheduler = createScheduler(db, { bus, events, registry, config }),
     heartbeatMonitor = createHeartbeatMonitor(db, { bus, events, registry, jobs, config });
-  return { db, bus, registry, agents, groups, artifacts, jobs, scheduler, heartbeatMonitor, artifactsDir };
+  return { db, bus, registry, agents, groups, logs, jobs, scheduler, heartbeatMonitor };
 }
 
 function registerResource(registry, { name, type, labels = [], groups = [], clientId } = {}){
@@ -206,15 +203,16 @@ test('admin resetQueue cancels every active job and leaves finished ones alone',
   assert.equal(jobs.get(finished.id).state, JOB_STATES.PASSED); // untouched
 });
 
-test('admin cleanHistory deletes finished jobs, their artifacts on disk, and leaves active jobs alone', () => {
-  const { registry, agents, artifacts, jobs, artifactsDir } = buildTestServices(),
+test('admin cleanHistory deletes finished jobs with their log lines, and leaves active jobs alone', () => {
+  const { db, registry, agents, logs, jobs } = buildTestServices(),
     { agent } = agents.create({ name: 'ci', kind: 'ci' });
   registerResource(registry, { name: 'lab-sw-01', type: 'sw', labels: [] });
 
   const finished = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() });
   jobs.setState(finished.id, JOB_STATES.PASSED);
-  artifacts.storeGenerated(finished.id, 'console.log', Buffer.from('hello'), 'text/plain');
-  assert.ok(fs.existsSync(path.join(artifactsDir, finished.id)));
+  logs.appendBatch(finished.id, [{ stream: 'runner', line: 'hello' }]);
+  const logLines = (id) => db.prepare('SELECT COUNT(*) AS n FROM job_logs WHERE job_id = ?').get(id).n;
+  assert.equal(logLines(finished.id), 1);
 
   const active = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() }),
 
@@ -222,7 +220,7 @@ test('admin cleanHistory deletes finished jobs, their artifacts on disk, and lea
 
   assert.equal(deleted, 1);
   assert.equal(jobs.get(finished.id), undefined);
-  assert.equal(fs.existsSync(path.join(artifactsDir, finished.id)), false);
+  assert.equal(logLines(finished.id), 0);
   assert.ok(jobs.get(active.id)); // active job untouched
 });
 

package/test/session.test.js

@@ -0,0 +1,132 @@
+/**
+ * @file        packages/coordinator/test/session.test.js
+ * @description Tests: dashboard sessions — the SQLite session store, sessions surviving a restart, and the Secure cookie flag
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { promisify } = require('node:util'),
+  { openDb } = require('../src/db'),
+  { SqliteSessionStore } = require('../src/services/session-store'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp, cookieSecure } = require('../src/server');
+
+test('session store: get/set/touch/destroy, expired sessions dropped and pruned', async () => {
+  let now = Date.parse('2026-09-30T12:00:00Z');
+  const store = new SqliteSessionStore(openDb(':memory:'), { pruneIntervalMs: 0, now: () => now }),
+    get = promisify(store.get.bind(store)),
+    set = promisify(store.set.bind(store)),
+    touch = promisify(store.touch.bind(store)),
+    destroy = promisify(store.destroy.bind(store)),
+    length = promisify(store.length.bind(store)),
+    sess = (minutes) => ({ cookie: { expires: new Date(now + minutes * 60_000).toISOString() }, user: { id: 'u1' } });
+
+  await set('a', sess(60));
+  await set('b', sess(5));
+  assert.deepEqual((await get('a')).user, { id: 'u1' });
+  assert.equal(await get('nope'), null);
+  assert.equal(await length(), 2);
+
+  now += 10 * 60_000; // b's 5 minutes are up
+  assert.equal(await get('b'), null); // expired: gone on read
+  await touch('a', sess(60)); // activity moves a's expiry out
+  now += 55 * 60_000;
+  assert.ok(await get('a'));
+
+  await set('c', sess(1));
+  now += 2 * 60_000;
+  assert.equal(store.prune(), 1); // c, never read again, swept
+  assert.equal(await length(), 1);
+
+  await destroy('a'); // logout
+  assert.equal(await get('a'), null);
+});
+
+test('cookieSecure: Secure for an https publicUrl, per-request otherwise, or as configured', () => {
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: 'auto' } }), true);
+  assert.equal(cookieSecure({ publicUrl: 'http://localhost:8080', session: { secureCookie: 'auto' } }), 'auto');
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: false } }), false);
+  assert.equal(cookieSecure({ publicUrl: 'http://lab', session: { secureCookie: true } }), true);
+});
+
+// --- over HTTP ------------------------------------------------------------
+
+function writeConfig(dir, extra = {}){
+  const file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, ...extra
+  }));
+  return file;
+}
+
+async function start(t, file){
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  await new Promise((r) => server.on('listening', r));
+  const stop = () => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  });
+  t.after(stop);
+  return { base: `http://127.0.0.1:${server.address().port}`, services, stop };
+}
+
+const login = (base, headers = {}) => fetch(`${base}/login`, {
+  method: 'POST', headers, body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+});
+
+test('a signed-in session survives a Coordinator restart', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'))),
+    first = await start(t, file);
+  first.services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const cookie = (await login(first.base)).headers.get('set-cookie').split(';')[0];
+  assert.equal((await fetch(`${first.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+  await first.stop();
+
+  const second = await start(t, file); // same database, new process state
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+
+  await fetch(`${second.base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 302);
+});
+
+test('https publicUrl: the session cookie is Secure; plain HTTP gets an explanation, not a login loop', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-')), { publicUrl: 'https://thub.example.com' }),
+    { base, services } = await start(t, file);
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+
+  // Behind the (loopback, trusted) reverse proxy terminating TLS.
+  const viaProxy = await login(base, { 'X-Forwarded-Proto': 'https' }),
+    setCookie = viaProxy.headers.get('set-cookie');
+  assert.equal(viaProxy.status, 302);
+  assert.match(setCookie, /; Secure/);
+  assert.match(setCookie, /; HttpOnly/);
+  assert.match(setCookie, /; SameSite=Lax/);
+
+  // The proxy forgot X-Forwarded-Proto: no cookie could come back — say so.
+  const plain = await login(base);
+  assert.equal(plain.status, 400);
+  assert.equal(plain.headers.get('set-cookie'), null);
+  assert.match(await plain.text(), /Signing in needs HTTPS/);
+  assert.match(await (await fetch(`${base}/login`)).text(), /X-Forwarded-Proto: https/);
+});
+
+test('config: session.secureCookie must be "auto", true or false', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'));
+  assert.equal(loadConfig(writeConfig(dir)).session.secureCookie, 'auto');
+  assert.throws(() => loadConfig(writeConfig(dir, { session: { secureCookie: 'yes' } })), /session\.secureCookie must be/);
+});

package/views/help/_agent-cli.pug

@@ -2,7 +2,7 @@
   h3.h6 Commands
   +code('thub --help').
     thub run      [options]                 Submit a job and follow its log
-    thub status   <jobId> [--json]          Status; follow the log if running, artifact links if done
+    thub status   <jobId> [--json]          Status; follow the log if running, verdict and test counts if done
     thub cancel   <jobId>                   Cancel a job
     thub resources [--json]                 Clients and their status
     thub jobs     [--mine] [--state <s>] [--json]   Recent jobs

package/views/help/_coordinator.pug

@@ -11,7 +11,7 @@
   p.small.
     #[code sudo npm i -g] does the whole setup for the user who ran #[code sudo]. It creates
     #[code ~/.config/thub/coordinator.json] (with a random #[code sessionSecret]) and
-    #[code ~/var/lib/thub] (database, artifacts, avatars). It installs, enables and starts
+    #[code ~/var/lib/thub] (database, avatars). It installs, enables and starts
     #[code thub-coordinator.service], plus the root helper behind the navbar's #[strong Update app] button.
 
   h3.h6 2. Configure
@@ -25,12 +25,12 @@
       "trustProxy": "loopback",
       "dataDir": "/home/thub/var/lib/thub",
       "sessionSecret": "<long random string>",
+      "session": { "secureCookie": "auto" },
       "clientJoinKey": "<output of: thub-admin join-key generate>",
       "heartbeat": { "intervalSec": 10, "missedLimit": 3, "sweepIntervalSec": 5 },
       "scheduler": { "assignAckTimeoutSec": 15, "requeueOnLost": true, "maxQueuedPerAgent": 20, "tickIntervalSec": 10 },
       "jobs": { "defaultTimeoutSec": 1800, "maxTimeoutSec": 14400 },
-      "retention": { "logRetentionDays": 14, "artifactRetentionDays": 30, "jobRetention": "forever" },
-      "artifacts": { "maxUploadMb": 512, "linkTtlHours": 168 },
+      "retention": { "jobRetention": "forever" },
       "updates": { "checkIntervalMin": 15, "registry": null }
     }
   .table-responsive
@@ -51,7 +51,10 @@
           td Which proxies' #[code X-Forwarded-For] to trust for a Client's external address: #[code loopback] (default), a CIDR such as #[code "10.0.0.0/8"], a hop count, or #[code false].
         tr
           td: code sessionSecret
-          td Signs dashboard sessions and artifact download links. Keep it secret and never use the #[code change-me-…] placeholder.
+          td Signs dashboard session cookies. Keep it secret and never use the #[code change-me-…] placeholder.
+        tr
+          td: code session.secureCookie
+          td #[code "auto"] (default): the session cookie is Secure (HTTPS-only) whenever #[code publicUrl] is https://. #[code true]/#[code false] force it. Sessions are stored in the database and survive restarts.
         tr
           td: code clientJoinKey
           td The shared secret Clients self-register with. Unset or #[code null] turns registration off (#[code 503]).
@@ -66,7 +69,7 @@
           td Default and maximum job timeout, in seconds.
         tr
           td: code retention.*
-          td #[code jobRetention]: #[code 1w], #[code 2w], #[code 1m], #[code 3m], #[code 6m] or #[code forever]. Older finished jobs, their logs and artifacts are deleted hourly.
+          td #[code jobRetention]: #[code 1w], #[code 2w], #[code 1m], #[code 3m], #[code 6m] or #[code forever]. Older finished jobs and their logs are deleted hourly.
         tr
           td: code updates.*
           td How often to check npm for new versions (#[code 0] turns the periodic check off), and an optional private registry.
@@ -96,7 +99,7 @@
           proxy_http_version 1.1;
           proxy_buffering off;          # SSE log streams
           proxy_read_timeout 1h;
-          client_max_body_size 512m;    # artifacts.maxUploadMb
+          client_max_body_size 10m;     # log batches, avatars
         }
 
   h3.h6 4. Users, agents and the join key

package/views/help/_docker.pug

@@ -106,7 +106,7 @@
         td Removes the container when the tests end.
       tr
         td: code -v "$THUB_WORK_DIR:/work" -w /work
-        td The checkout and downloads, and the #[code results/] and #[code artifacts/] folders, which the Client uploads.
+        td The checkout and downloads, and the #[code results/] and #[code artifacts/] folders, where the Client reads JUnit XML for the test counts.
       tr
         td: code -e NAME
         td Passes a job variable (#[code --env], #[code THUB_*], #[code JOB_*]) into the container.

package/views/help/_env.pug

@@ -9,7 +9,7 @@
   -
     const thubVars = [
       ['THUB_JOB_ID', 'The job id, e.g. M-00125'],
-      ['THUB_WORK_DIR', 'The directory the command runs in: the --git-repo checkout, else empty. results/ and artifacts/ in it are uploaded'],
+      ['THUB_WORK_DIR', 'The directory the command runs in: the --git-repo checkout, else empty. JUnit XML in results/ or artifacts/ gives the test counts; deleted when the job ends'],
       ['THUB_SUITE', '--suite (default: default)'],
       ['THUB_GIT_COMMIT', 'The exact commit checked out for --git-repo'],
       ['THUB_DOWNLOADS_DIR', 'Where the --download-file files are'],

package/views/help/_git.pug

@@ -20,8 +20,9 @@
     git remote add origin git@github.com:yourorg/firmware-tests.git
     git push -u origin main
   p.small.
-    The exit code of #[code --command] is the verdict. JUnit files under #[code results/] or #[code artifacts/] are uploaded
-    as artifacts and summed into the job's test counts. Any other file there is uploaded too.
+    The exit code of #[code --command] is the verdict. JUnit files under #[code results/] or #[code artifacts/] are summed into
+    the job's test counts. Nothing is uploaded: the workspace is deleted when the job ends, so publish anything you need to keep
+    from the command itself (e.g. #[code curl -T report.html "$ARTIFACTORY/…"] with a token passed as #[code --env]).
 
   h3.h6 2. Give Clients read access: SSH deploy key (recommended)
   p.small.

package/views/help/_overview.pug

@@ -13,7 +13,7 @@
             | Coordinator
           p.card-text.small.mb-0.
             This service. It holds the job queue and the resource registry, and runs the scheduler and
-            the heartbeat monitor. It stores logs and artifacts in SQLite plus a local directory,
+            the heartbeat monitor. It stores job state and logs in SQLite,
             and serves this dashboard. It's the only thing that needs a public HTTPS port.
     .col-md-4
       .card.h-100
@@ -41,7 +41,7 @@
     li The Coordinator queues it (#[code QUEUED]) and the scheduler assigns it to an idle Client whose type, labels and group match.
     li The Client accepts it, clones #[code --git-repo], downloads #[code --download-file] files and prepares the DUT (#[code PREPARING]).
     li It runs #[code --command] with #[code sh -c], and output streams live to the Agent and the dashboard (#[code RUNNING]).
-    li The exit code is the verdict: #[code 0] = #[code PASSED], anything else = #[code FAILED]. JUnit files and artifacts are uploaded.
+    li The exit code is the verdict: #[code 0] = #[code PASSED], anything else = #[code FAILED]. The Client reports the JUnit test counts; the job's files stay on the Client and are deleted with its workspace.
     li The Agent exits with the verdict code, so a CI step passes or fails with it.
 
   h3.h6 Key design rules

package/views/help/_troubleshooting.pug

@@ -16,6 +16,8 @@
       ['Live logs don\'t stream through the proxy', 'Turn off response buffering for the Coordinator (nginx: `proxy_buffering off;`, Caddy: `flush_interval -1`).'],
       ['Finding a job, resource, group or agent', 'Use the search box on its list page (press `/` to jump to it). Every word must match, e.g. `lab-hw-01 FAILED` or a git ref. Job search covers ids, users, resources, agents, commands, repos and `--meta`, but not `--env` values (secrets). On a job page, search the log above the log viewer: `Enter`/`Shift+Enter` step through matches.'],
       ['Lists don\'t update by themselves (navbar shows Offline or Paused)', '`Paused`: you\'re editing something on the page (a field, the inline rename, a dialog); it resumes when you\'re done. `Offline`: the browser can\'t hold the `/live` stream open, often a proxy buffering it (nginx: `proxy_buffering off;`); reloading the page always shows current data. `Session ended`: sign in again. Background updates never extend the session\'s idle timeout.'],
+      ['Sign-in says it needs HTTPS', 'The session cookie is HTTPS-only because `publicUrl` is `https://`, but the request arrived as plain HTTP. Open the dashboard through its https:// address; behind a reverse proxy, make it send `X-Forwarded-Proto: https` (nginx: `proxy_set_header X-Forwarded-Proto $scheme;`) and check `trustProxy`. To allow plain HTTP, set `session.secureCookie` to `false`.'],
+      ['Where are a job\'s test reports and output files?', 'The Coordinator keeps only the log and the result (verdict, exit code, JUnit test counts). Files the job creates stay in its workspace on the Client and are deleted when the job ends. To keep them, publish them from `--command`, e.g. `curl -fsS -H "Authorization: Bearer $ART_TOKEN" -T results/report.xml "https://artifactory.example.com/qa/$THUB_JOB_ID/report.xml"` with `--env ART_TOKEN`. The full log is always available from the job page\'s Raw button.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text

package/views/jobs/list.pug

@@ -87,7 +87,7 @@ block content
           |
           code CANCELED
           | .
-        p.small.text-body-secondary.mb-0 Finished jobs, logs and artifacts are not touched.
+        p.small.text-body-secondary.mb-0 Finished jobs and their logs are not touched.
       else
         p.mb-0 There are no active jobs — nothing to cancel.
 
@@ -132,7 +132,7 @@ block content
             onclick="document.getElementById('cleanup-before').value = this.dataset.value"
           )= preset.label
       p
-        | Deletes finished jobs that ended before then, with their logs and artifacts (files too), and the resource, agent and group history logged before then — then compacts the database file.
+        | Deletes finished jobs that ended before then, with their logs, and the resource, agent and group history logged before then — then compacts the database file.
         |
         strong This cannot be undone.
         |  Active jobs are never touched.

package/views/jobs/show.pug

@@ -49,15 +49,5 @@ block content
       dt.col-sm-2 Message
       dd.col-sm-10= job.message
 
-  h2.h6.mt-4#artifacts Artifacts
-  if artifacts.length
-    ul.list-group
-      each a in artifacts
-        li.list-group-item.d-flex.justify-content-between
-          span= a.name
-          a(href=a.url) download
-  else
-    p.text-body-secondary No artifacts yet.
-
   h2.h6.mt-4 Log
   +logViewer(job.id, jobActive)

package/views/mixins/log-viewer.pug

@@ -1,6 +1,7 @@
 mixin logViewer(jobId, jobActive)
   //- Stream filter + search (public/js/log-viewer.js): matches are
   //- highlighted; Enter / Shift+Enter or the arrows step through them.
+  //- The log loads from its end; earlier lines load as you scroll up.
   .d-flex.flex-wrap.align-items-center.gap-2.mb-2
     select#stream-filter.form-select.form-select-sm.w-auto(aria-label="Log stream")
       option(value="") all streams
@@ -28,6 +29,19 @@ mixin logViewer(jobId, jobActive)
     .form-check.form-check-inline.small.mb-0
       input#log-search-only.form-check-input(type="checkbox")
       label.form-check-label(for="log-search-only") Display only matching lines
+    a.btn.btn-sm.btn-outline-secondary.ms-auto(
+      href=`/jobs/${jobId}/log.txt`
+      target="_blank"
+      rel="noopener"
+      data-bs-toggle="tooltip"
+      data-bs-title="Open the full log as plain text in a new tab"
+    )
+      i.bi.bi-file-earmark-text.me-1
+      | Raw
+  //- "Showing the last 1,000 of 5,321 lines · Load all" (log-viewer.js).
+  .d-flex.flex-wrap.align-items-center.gap-2.small.text-body-secondary.mb-1(aria-live="polite")
+    span#log-info Loading log…
+    button#log-load-all.btn.btn-link.btn-sm.p-0.align-baseline(type="button" hidden) Load all
   pre#log-viewer.bg-body-tertiary.p-3.rounded.position-relative(
     style="height: 420px; overflow-y: auto;"
     data-job-id=jobId