@andrian.yablonskyy/thub-coordinator 1.1.0 → 1.1.2

package/README.md

@@ -14,7 +14,7 @@ This gives you two global commands: `thub-coordinator` (the server itself) and `
 
 - `~/.config/thub/coordinator.json` with every default option (see Configuration below), if it doesn't exist yet.
 - `~/var/lib/thub` (the `dataDir`: SQLite DB, uploaded artifacts, avatars) with its `artifacts/`, `avatars/` and `work/` subdirectories.
-- On Linux as root: `/etc/systemd/system/thub-coordinator.service`, enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
+- On Linux as root: `/etc/systemd/system/thub-coordinator.service` (`ProtectSystem=strict` with a private writable `/tmp`, which SQLite needs), enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
 
 Under `sudo`, `~` means the home of the user who ran `sudo` (`SUDO_USER`), not `/root`. That user owns the config and data and the service runs as them. Without root the config and directories are still created; the systemd step is skipped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {
@@ -19,7 +19,7 @@
     "lint:fix": "eslint . --fix"
   },
   "dependencies": {
-    "@andrian.yablonskyy/thub-common": "^1.1.0",
+    "@andrian.yablonskyy/thub-common": "^1.1.1",
     "better-sqlite3": "^12.4.1",
     "express": "^5.1.0",
     "express-session": "^1.18.2",

package/public/css/thub.css

@@ -86,17 +86,33 @@
   padding: 0.45rem 0.65rem;
 }
 
-/* Bootstrap hides inactive tab panes only as direct children of
-   .tab-content (`.tab-content > .tab-pane`). The client details modal's
-   capability tabs sit inside their shared <form>/<fieldset> (one Save for
-   all of them), so without this the inactive ones merely fade out and still
-   take up space, pushing the active tab's fields down. */
-.tab-content .tab-pane[data-config-pane] {
-  display: none;
+/* The client details modal keeps one size whichever tab is open — the
+   tallest tab's — instead of growing and shrinking (and, centered, jumping)
+   on every switch. Every pane sits in the same grid cell, so the tab area is
+   as tall as the tallest; inactive ones are hidden with `visibility`, which
+   keeps their height (and still takes them out of the tab order and of what
+   screen readers read). The device tabs sit inside their shared
+   <form>/<fieldset> (one Save for all of them), so that fieldset stacks its
+   panes the same way. The USB tab's output scrolls in its own box (360 px),
+   so a long lsusb doesn't make every tab that tall. */
+.thub-resource-card .tab-content,
+.thub-resource-card .tab-content > form > fieldset {
+  display: grid;
+}
+
+.thub-resource-card .tab-content > *,
+.thub-resource-card .tab-content > form > fieldset > * {
+  grid-area: 1 / 1;
+  min-width: 0;
 }
 
-.tab-content .tab-pane[data-config-pane].active {
+.thub-resource-card .tab-content .tab-pane {
   display: block;
+  visibility: hidden;
+}
+
+.thub-resource-card .tab-content .tab-pane.active {
+  visibility: visible;
 }
 
 /* Help page (views/help/): sticky table of contents, code blocks with a
@@ -233,9 +249,6 @@
    itself on short screens, and is laid out for thumbs: pages as a two-column
    grid, the tools in one row, the account in the next. public/js/actions.js
    closes it on a tap outside, Esc, or choosing a page. */
-.thub-nav-break {
-  display: none;
-}
 
 @media (max-width: 991.98px) {
   .navbar .thub-nav {
@@ -295,15 +308,19 @@
     min-height: 2.5rem;
   }
 
-  /* The account row: the profile link takes the line, sign-out at its end. */
-  .thub-nav-break {
-    display: block;
-    flex-basis: 100%;
-    height: 0;
+  /* The account row, first in the menu: you, your role, your profile, and
+     sign-out at its end. */
+  .thub-nav-me {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding-bottom: 0.75rem;
+    margin-bottom: 0.75rem;
+    border-bottom: 1px solid var(--bs-border-color);
   }
 
-  .thub-nav-account {
-    flex: 1 1 auto;
+  .thub-nav-me .btn {
+    min-width: 2.5rem;
     min-height: 2.5rem;
   }
 }

package/public/js/client-config.js

@@ -34,7 +34,6 @@
       return compact({
         ...extra,
         ...device(text(tr, 'device')),
-        serial: text(tr, 'serial'),
         baudRate: num(tr, 'baudRate'),
         devpath: text(tr, 'devpath')
       });

package/src/services/registry.js

@@ -655,6 +655,17 @@ function createRegistryService(db, { bus, events }){
     return get(resourceId);
   }
 
+  // The Client's hw/sw section as it stands: what it reported at its last
+  // start, unless a saved revision hasn't reached it yet — then that one.
+  // The base for a revision that only changes something else (groups, an
+  // Import without a section) and for Export: the saved one alone could be
+  // older than the Client's file, and sending it would undo what changed
+  // there since.
+  function currentSection(r){
+    const pending = r.config_desired && r.config_applied_revision < r.config_revision;
+    return pending ? r.config_desired : (r.client_config || r.config_desired);
+  }
+
   // { revision, type, config[, file] } while the Client hasn't applied the
   // saved one; `file`: an import's other fields, until it's applied.
   function pendingConfig(resourceId){
@@ -684,7 +695,7 @@ function createRegistryService(db, { bus, events }){
     if (!valid){
       throw Object.assign(new Error(`Can't import this config into ${r.name}: ${errors.join('; ')}`), { status: 400 });
     }
-    const desired = section || r.config_desired || r.client_config;
+    const desired = section || currentSection(r);
     if (!desired){
       throw Object.assign(new Error(`Can't import this config into ${r.name}: it has no "${HW_DEVICES_SECTION}" section, and the Client hasn't reported one`),
         { status: 400 });
@@ -714,7 +725,7 @@ function createRegistryService(db, { bus, events }){
     }
     // Writing top-level fields needs a Client that reports its config file
     // (the same that Import needs); an older one would drop them.
-    const desired = r.config_desired || r.client_config;
+    const desired = currentSection(r);
     if (!desired || !r.client_config_file){
       throw Object.assign(new Error(`${r.name} is too old to take its groups from the dashboard — update its Client first`), { status: 409 });
     }
@@ -740,7 +751,7 @@ function createRegistryService(db, { bus, events }){
     }
     // Re-shared: a file stored from an older Client may still say hw / sw.
     const base = shareableClientConfigFile(r.client_config_file || { name: r.reported_name || r.name, type: r.type, labels: r.labels }),
-      section = r.type === 'hw' ? r.config_desired || r.client_config : null;
+      section = r.type === 'hw' ? currentSection(r) : null;
     return { ...base, ...(pendingImport(r) || {}), type: r.type, ...(section ? { [HW_DEVICES_SECTION]: section } : {}) };
   }
 

package/src/web/routes.js

@@ -1189,10 +1189,12 @@ function createWebRouter({ services, config }){
   // the page the action returns — never stored anywhere.
   // Searched (?q=), filtered by role (?role=user|maintainer|admin|blocked),
   // sorted and paged like the other lists (§10.1).
-  const USER_ROLE_FILTERS = ['user', 'maintainer', 'admin', 'blocked'],
+  const USER_ROLE_FILTERS = ['admin', 'maintainer', 'user', 'blocked'],
     ROLE_ORDER = { user: 0, maintainer: 1, admin: 2 },
+    // What the User column shows: first and last name, else the username.
+    userDisplayName = (u) => `${u.firstName || ''} ${u.lastName || ''}`.trim() || u.username,
     USER_SORT_VALUE = {
-      username: (u) => u.username.toLowerCase(),
+      username: (u) => userDisplayName(u).toLowerCase(),
       role: (u) => ROLE_ORDER[u.role],
       status: (u) => (u.blocked ? 1 : 0),
       used: (u) => u.key?.lastUsedAt || null
@@ -1230,6 +1232,7 @@ function createWebRouter({ services, config }){
       total: searched.length,
       roleFilter: role,
       roleFilters: USER_ROLE_FILTERS,
+      userDisplayName,
       roleCounts,
       list: { ...view, pagination, pageUrl, q },
       q,

package/systemd/thub-coordinator.service

@@ -16,6 +16,10 @@ Restart=always
 RestartSec=2
 NoNewPrivileges=yes
 ProtectSystem=strict
+# A private, writable /tmp: ProtectSystem=strict makes the shared one
+# read-only, and SQLite needs temp files for big sorts (a migration that
+# rebuilds a table and its index) — without them: SQLITE_IOERR_GETTEMPPATH.
+PrivateTmp=yes
 ReadWritePaths=/var/lib/thub/var/lib/thub
 
 [Install]

package/test/groups-tab.test.js

@@ -95,3 +95,48 @@ test('Groups tab: keeps other pending changes; refuses unknown groups and Client
   const old = register(services, 'lab-old', { configFile: null });
   assert.throws(() => services.registry.setClientGroups(old, [g.id], { knownGroupIds: [g.id] }), /too old to take its groups/);
 });
+
+test('device tabs show what the Client runs — not an old saved revision; groups/import/export build on it', async (t) => {
+  const { base, services, admin } = await start(t),
+    reg = services.registry,
+    register = (devpath) => reg.registerAuto({
+      clientId: 'hw1', name: 'lab-hw-01', type: 'hw', labels: [],
+      config: { stlinks: [{ index: 1, devpath }] }, configFile: { name: 'lab-hw-01', type: 'hw' }
+    }).resourceId,
+    id = register('1.1'),
+    devpaths = async () => {
+      const html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text(),
+        table = html.slice(html.indexOf(`id="cfg-${id}-stlinks"`), html.indexOf(`id="cfg-${id}-uarts"`));
+      return [...table.matchAll(/data-f="devpath" value="([^"]*)"/g)].map((m) => m[1]).filter(Boolean); // not the blank add-row template
+    };
+  assert.deepEqual(await devpaths(), ['1.1']); // as the Client reported it
+
+  // Saved on the dashboard, not applied yet: the tab shows the saved one.
+  reg.setClientConfig(id, { stlinks: [{ index: 1, devpath: '2.2' }] }, { by: 'admin' });
+  assert.deepEqual(await devpaths(), ['2.2']);
+
+  // Applied — and later the file was edited on the host; the Client restarts
+  // and reports 3.3. That's what the tab shows now, not the old 2.2.
+  services.db.prepare('UPDATE resources SET config_applied_revision = config_revision WHERE id = ?').run(id);
+  register('3.3');
+  assert.deepEqual(await devpaths(), ['3.3']);
+
+  // …and what a groups save, an export and an Import without a section send.
+  const g = services.groups.create({ name: 'g' });
+  reg.setClientGroups(id, [g.id], { by: 'admin', knownGroupIds: [g.id] });
+  assert.deepEqual(reg.pendingConfig(id).config, { stlinks: [{ index: 1, devpath: '3.3' }] }); // not 2.2 again
+  assert.deepEqual(reg.exportClientConfig(id)['hw-devices'], { stlinks: [{ index: 1, devpath: '3.3' }] });
+});
+
+test('ST-Link tab has no Serial field; a serial set in the config file is kept on Save', async (t) => {
+  const { base, services, admin } = await start(t),
+    id = services.registry.registerAuto({
+      clientId: 'hw2', name: 'lab-hw-02', type: 'hw', labels: [],
+      config: { stlinks: [{ index: 1, serial: '066DFF48', devpath: '1.2' }] }, configFile: { name: 'lab-hw-02', type: 'hw' }
+    }).resourceId,
+    html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text(),
+    table = html.slice(html.indexOf(`id="cfg-${id}-stlinks"`), html.indexOf(`id="cfg-${id}-uarts"`));
+  assert.doesNotMatch(table, /data-f="serial"|>Serial</);
+  // Rides along in data-extra, which public/js/client-config.js spreads back into the row.
+  assert.match(table, /data-extra="\{&quot;serial&quot;:&quot;066DFF48&quot;\}"/);
+});

package/test/systemd-unit.test.js

@@ -0,0 +1,25 @@
+/**
+ * @file        packages/coordinator/test/systemd-unit.test.js
+ * @description Tests: the shipped systemd unit lets SQLite write its temp files
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  path = require('node:path');
+
+test('systemd unit: ProtectSystem=strict comes with a private writable /tmp (SQLITE_IOERR_GETTEMPPATH)', () => {
+  const unit = fs.readFileSync(path.join(__dirname, '../systemd/thub-coordinator.service'), 'utf8');
+  assert.match(unit, /^ProtectSystem=strict$/m);
+  assert.match(unit, /^PrivateTmp=yes$/m);
+});

package/test/users.test.js

@@ -245,7 +245,7 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
       method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
     })).headers.get('set-cookie').split(';')[0],
     page = (q) => fetch(`${base}/admin/users${q}`, { headers: { cookie } }).then((r) => r.text()),
-    names = (html) => [...html.matchAll(/<div class="fw-medium">([^<]+)/g)].map((m) => m[1]),
+    names = (html) => [...html.matchAll(/<a class="fw-medium" href="#editUser-[^"]+"[^>]*>([^<]+)/g)].map((m) => m[1]),
 
     users = await page('?role=user&size=10');
   assert.match(users, /Showing 1–10 of 12 users/); // before the two below are added
@@ -259,6 +259,9 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /href="\/admin\/users\?role=user&amp;size=10&amp;sort=username&amp;dir=asc&amp;page=2"/); // pages keep the filter
   assert.deepEqual(names(await page('?role=blocked')), ['mo']);
   assert.match(users, />Maintainer<span class="badge/); // filter buttons
+  const filterNav = users.slice(users.indexOf('aria-label="Filter by role"'), users.indexOf('</nav>', users.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'Admin', 'Maintainer', 'User', 'Blocked']);
+  assert.doesNotMatch(users, /d1@example\.com<\/div>|>Edit<\/button>/); // the name only; it opens Edit
   assert.match(users, /href="[^"]*role=maintainer/); // …while values stay lowercase
   assert.deepEqual(names(await page('?role=admin&size=all')), ['root']);
   assert.deepEqual(names(await page('?role=&sort=role&dir=desc&size=all')).slice(0, 2), ['root', 'mo']); // admin, maintainer, users…
@@ -267,3 +270,19 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /<option value="user" selected="selected" data-help="Agent only[^"]*">User<\/option>/);
   assert.match(users, /<div class="form-text" id="new-role-help" aria-live="polite">Agent only/);
 });
+
+test('Users page: the User column shows first and last name, sorts by it, and opens Edit', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' });
+  const zed = u.create({ username: 'aaa', email: 'a@example.com', role: 'user', firstName: 'Zed', lastName: 'Young' });
+  u.create({ username: 'zzz', email: 'z@example.com', role: 'user', firstName: 'Ann' });
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    html = await (await fetch(`${base}/admin/users?sort=username&dir=asc&size=all`, { headers: { cookie } })).text(),
+    cells = [...html.matchAll(/<a class="fw-medium" href="#editUser-([^"]+)"[^>]*>([^<]+)/g)];
+  assert.deepEqual(cells.map((m) => m[2]), ['Ann', 'root', 'Zed Young']); // no name → the username
+  assert.equal(cells[2][1], zed.id);
+  assert.match(html, new RegExp(`id="editUser-${zed.id}"`)); // the modal it opens
+});

package/views/admin/users.pug

@@ -68,17 +68,10 @@ block content
     tbody
       each u in users
         tr(class=u.blocked ? 'opacity-50' : '')
+          //- Just the name (the username until one is set); it opens Edit,
+          //- where the username, email and the rest are.
           td
-            .fw-medium
-              = u.username
-              if u.id === me.id
-                span.badge.text-bg-light.border.ms-1 you
-            if u.firstName || u.lastName
-              .small= `${u.firstName || ''} ${u.lastName || ''}`.trim()
-            if u.email
-              .small.text-body-secondary= u.email
-            else
-              span.badge.text-bg-warning(data-bs-toggle="tooltip" data-bs-title="Every user needs an email — add it with Edit") no email
+            a.fw-medium(href=`#editUser-${u.id}` data-bs-toggle="modal" role="button")= userDisplayName(u)
           td
             span.badge(class=`text-bg-${roleTone[u.role]}` data-bs-toggle="tooltip" data-bs-title=roleHelp[u.role])= roleLabel(u.role)
           td
@@ -98,8 +91,7 @@ block content
             else
               span.text-body-secondary none
           td.text-end.text-nowrap
-            button.btn.btn-sm.btn-outline-secondary(type="button" data-bs-toggle="modal" data-bs-target=`#editUser-${u.id}` aria-label=`Edit ${u.username}`) Edit
-            form.d-inline.ms-1(
+            form.d-inline(
               method="post"
               action=`/admin/users/${u.id}/key`
               data-confirm=u.key ? `Issue a new access key for ${u.username}? Their current key stops working at once.` : `Create an access key for ${u.username}?`

package/views/help/_client-setup.pug

@@ -103,7 +103,10 @@
   p.small.
     SW Clients have no settings of their own: they run whatever DUT image a job brings (#[code --docker-image]).
     Admins can also edit an HW Client's devices from its resource card (#[strong ST-Link | UART | DUT USB]
-    tabs). #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    tabs). The tabs show the config the Client runs, as it reported it at its last start, or a saved
+    change it hasn't applied yet. #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    There's no ST-Link serial field: the job's #[code --command] picks the probe
+    (#[code $THUB_DUT_STLINK_<n>]), and the Client reads each serial from its udev symlink.
 
   h3.h6 Several DUT slots on one machine
   +code('One instance per slot').

package/views/help/_coordinator.pug

@@ -13,6 +13,8 @@
     #[code ~/.config/thub/coordinator.json] (with a random #[code sessionSecret]) and
     #[code ~/var/lib/thub] (database, avatars). It installs, enables and starts
     #[code thub-coordinator.service], plus the root helper behind the navbar's #[strong Update app] button.
+    The unit uses #[code ProtectSystem=strict] with #[code PrivateTmp=yes], so the data directory and a
+    private #[code /tmp] (SQLite's temp files) are the only places the service can write.
 
   h3.h6 2. Configure
   p.small.
@@ -123,6 +125,9 @@
     thub-admin resource maintenance <resourceId> --on
     thub-admin jobs reset --yes                             # cancel every active job
     thub-admin jobs clean --yes --before "01/09/2026 00:00:00"
+  p.small.
+    On #[a(href="/admin/users") Users] (admins), click a name to edit that user. The quick filter is
+    #[strong All | Admin | Maintainer | User | Blocked]. The search box also matches usernames and emails.
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on

package/views/help/_troubleshooting.pug

@@ -21,6 +21,7 @@
       ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
       ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
       ['Agent says “Invalid or revoked access key” or “… is blocked”', 'The key was replaced (`thub key rotate`, an admin, your profile) or revoked, or your user is blocked. Ask an admin for a new key (Users), or create one on your profile if you can sign in. Then `thub config set key <key>`; `thub whoami` checks it.'],
+      ['The Coordinator won\'t start after an upgrade: `SqliteError: disk I/O error` (`SQLITE_IOERR_GETTEMPPATH`)', 'Its systemd unit is older than 1.1.1: it has `ProtectSystem=strict` without `PrivateTmp=yes`, so SQLite has no writable temp directory for a large migration. The migration rolls back, so no data is lost. Install the latest version with `sudo npm i -g @andrian.yablonskyy/thub-coordinator` (the dashboard can\'t update a Coordinator that\'s down), or run `sudo systemctl edit thub-coordinator`, add `[Service]` and `PrivateTmp=yes`, then `sudo systemctl restart thub-coordinator`.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text

package/views/layout.pug

@@ -1,3 +1,11 @@
+//- The signed-in user's avatar, or their initials in a circle.
+mixin navAvatar(px)
+  if user.avatarPath
+    img.rounded-circle.me-2(src=user.avatarPath width=px height=px style="object-fit: cover;")
+  else
+    span.rounded-circle.bg-secondary.text-white.d-inline-flex.align-items-center.justify-content-center.me-2.flex-shrink-0(style=`width: ${px}px; height: ${px}px; font-size: ${Math.round(px / 2)}px;`)
+      = ((user.firstName ? user.firstName[0] : user.username[0]) + (user.lastName ? user.lastName[0] : '')).toUpperCase()
+
 doctype html
 html(lang="en" data-bs-theme=(user && user.theme) || "auto")
   head
@@ -30,6 +38,18 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
         button.navbar-toggler(type="button" data-bs-toggle="collapse" data-bs-target="#nav")
           span.navbar-toggler-icon
         #nav.collapse.navbar-collapse.thub-nav
+          //- Phones/tablets: who you are comes first — name, role, profile,
+          //- sign-out (thub.css .thub-nav-me). Desktop keeps it on the right.
+          if user
+            .thub-nav-me.d-lg-none
+              a.d-flex.align-items-center.text-reset.text-decoration-none.flex-grow-1(href="/profile")
+                +navAvatar(36)
+                span.d-flex.flex-column.lh-sm
+                  span.fw-medium= user.firstName ? `${user.firstName} ${user.lastName || ''}`.trim() : user.username
+                  span.small.text-body-secondary= `${roleLabel(user.role)} · profile`
+              form(action="/logout" method="post")
+                button.btn.btn-outline-danger(type="submit" aria-label="Log out")
+                  i.bi.bi-box-arrow-right
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
@@ -112,22 +132,16 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
               )
                 i.bi.bi-circle-half
             if user
-              li.thub-nav-break(aria-hidden="true")
-              li.nav-item.d-flex.align-items-center.me-3.thub-nav-account
+              li.nav-item.d-none.d-lg-flex.align-items-center.me-3
                 a.nav-link.d-flex.align-items-center.p-0(
                   href="/profile"
                   data-bs-toggle="tooltip"
                   data-bs-placement="bottom"
                   data-bs-title=`Profile settings (${roleLabel(user.role)})`
                 )
-                  if user.avatarPath
-                    img.rounded-circle.me-2(src=user.avatarPath width="24" height="24" style="object-fit: cover;")
-                  else
-                    span.rounded-circle.bg-secondary.text-white.d-inline-flex.align-items-center.justify-content-center.me-2(style="width: 24px; height: 24px; font-size: 12px;")
-                      = ((user.firstName ? user.firstName[0] : user.username[0]) + (user.lastName ? user.lastName[0] : '')).toUpperCase()
+                  +navAvatar(24)
                   span= user.firstName ? `${user.firstName} ${user.lastName || ''}`.trim() : user.username
-                  span.small.text-body-secondary.ms-2.d-lg-none= `${roleLabel(user.role)} · profile`
-              li.nav-item.d-flex.align-items-center
+              li.nav-item.d-none.d-lg-flex.align-items-center
                 form(action="/logout" method="post")
                   button.btn.btn-sm.btn-outline-danger(
                     type="submit"

package/views/mixins/client-config.pug

@@ -5,14 +5,13 @@
 //- what the Client reported at registration.
 
 //- One device row: "Device" is a udev index (1-8) or a /dev path; fields the
-//- form doesn't show (vendorId/productId/subsystem) ride along in data-extra.
+//- form doesn't show (vendorId/productId/subsystem, an ST-Link serial set in
+//- the config file) ride along in data-extra.
 mixin deviceRow(kind, d)
-  - const known = ['index', 'path', 'serial', 'baudRate', 'devpath']
+  - const known = ['index', 'path', 'baudRate', 'devpath']
   - const extra = Object.fromEntries(Object.entries(d || {}).filter(([k]) => !known.includes(k)))
   tr(data-row=kind data-extra=JSON.stringify(extra))
     td: input.form-control.form-control-sm.font-monospace(data-f="device" value=d ? (d.path || d.index || '') : '' placeholder="1 or /dev/…" required)
-    if kind === 'stlinks'
-      td: input.form-control.form-control-sm.font-monospace(data-f="serial" value=d && d.serial || '' placeholder="(from udev)")
     if kind === 'uarts'
       td: input.form-control.form-control-sm(data-f="baudRate" type="number" min="50" value=d && d.baudRate || '' placeholder="115200")
     td: input.form-control.form-control-sm.font-monospace(data-f="devpath" value=d && d.devpath || '' placeholder="3.3.4.1")
@@ -162,7 +161,13 @@ mixin groupsPane(r, returnTo, groupsById)
 
 mixin configPanes(r, returnTo, groupsById)
   - const p = `cfg-${r.id}`
-  - const current = r.config_desired || r.client_config
+  //- What the Client runs — its config as it reported it at its last start
+  //- — unless a saved revision is still on its way to it: then that one, so
+  //- it can be checked or changed before it's applied. (Always preferring the
+  //- saved revision showed an old one forever, after the file changed on the
+  //- host or an Import.)
+  - const pendingRevision = r.config_desired && r.config_applied_revision < r.config_revision
+  - const current = pendingRevision ? r.config_desired : (r.client_config || r.config_desired)
   - const canEdit = can.operate
   if r.type !== 'hw'
     //- no device tabs
@@ -185,8 +190,8 @@ mixin configPanes(r, returnTo, groupsById)
       fieldset(disabled=!canEdit)
         +configPane(p, 'stlinks')
           +capabilitiesStatus(r)
-          +deviceTable('stlinks', 'ST-Link probes', current.stlinks || [], ['Device', 'Serial', 'udev devpath'])
-          .form-text Device: a udev index 1–8 (→ /dev/thub/dut&lt;N&gt;-stlink) or a /dev path. The serial is looked up from the udev symlink when empty.
+          +deviceTable('stlinks', 'ST-Link probes', current.stlinks || [], ['Device', 'udev devpath'])
+          .form-text Device: a udev index 1–8 (→ /dev/thub/dut&lt;N&gt;-stlink) or a /dev path. Which probe a job uses is up to its #[code --command] (#[code $THUB_DUT_STLINK_&lt;n&gt;]).
           +saveCapabilities(canEdit)
         +configPane(p, 'uarts')
           +capabilitiesStatus(r)