@andrian.yablonskyy/thub-coordinator 1.1.8 → 1.1.10

package/README.md

@@ -149,8 +149,8 @@ Server-rendered Pug templates styled with Bootstrap 5.3, with a little vanilla J
 
 | Page | Content |
 |---|---|
-| `/` | Resource cards by status, queue length, jobs in the last 24 h. Click a card for its resource card (below). |
-| `/resources` | Type, Client version, labels, groups, status, busy source/reason, last heartbeat age; admin maintenance/rotate-token actions. Click a row for its resource card (below). |
+| `/` | Runner cards by status, queue length, jobs in the last 24 h. Click a card for its runner card (below). |
+| `/runners` | **Runners** (formerly Resources; `/resources` redirects): Type, Client version, labels, groups, status, busy source/reason, last heartbeat age; admin maintenance/rotate-token actions. Click a row for its resource card (below). |
 | `/groups` | Resource groups — id/name/comment, member count; admin create/rename/delete. Membership itself is set per-resource in the Client's own config. |
 | `/jobs` | Filterable job list (state, source, resource), with the job's `user` label if set; admin **Reset queue** / **Clean history**. |
 | `/jobs/:id` | Spec, timeline, live log viewer with stream filter, artifact downloads, cancel button. |
@@ -159,7 +159,7 @@ Server-rendered Pug templates styled with Bootstrap 5.3, with a little vanilla J
 
 Notifications (results of dashboard actions, errors) appear as toasts in the top-right corner and close themselves by severity: **errors stay until closed**, warnings close after **30 s**, info and success after **10 s**. A one-time secret such as a rotated resource token never closes on its own.
 
-**Resource card.** Clicking a resource on `/` or `/resources` opens a card with its name, type, status, host uptime and current task/status with its duration (both from the Client's heartbeats, anchored to the Coordinator's clock; as of the last heartbeat for an OUT_OF_SERVICE resource), Client version, IP addresses, capabilities (reported at registration: HW udev devices with a **missing** flag for any whose device node doesn't exist; SW image, source and limits), labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts. Admins get a **Cancel** button on it, enabled only while the Client is doing something: it cancels its current job, releases a manual local lock, or aborts a self-update hold on its host (the last two delivered as `unlock` / `cancel-update` heartbeat commands).
+**Runner card.** Clicking a runner on `/` or `/runners` opens a card with its name, type, status, host uptime and current task/status with its duration (both from the Client's heartbeats, anchored to the Coordinator's clock; as of the last heartbeat for an OUT_OF_SERVICE resource), Client version, IP addresses, capabilities (reported at registration: HW udev devices with a **missing** flag for any whose device node doesn't exist; SW image, source and limits), labels, groups, busy source/reason, last heartbeat and (admins only) the maintenance/rotate-token actions. IP addresses are the Client host's interface addresses except loopback (reported at registration and on every heartbeat) plus the external address — the one the Coordinator last saw the Client connect from, taken from `X-Forwarded-For` when the request came through a proxy `trustProxy` trusts. Admins get a **Cancel** button on it, enabled only while the Client is doing something: it cancels its current job, releases a manual local lock, or aborts a self-update hold on its host (the last two delivered as `unlock` / `cancel-update` heartbeat commands).
 
 The Coordinator's own version (`ver. X.Y.Z`) is shown under the TestHub logo, top left of every page.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.8",
+  "version": "1.1.10",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/public/js/remove-resource.js

@@ -29,8 +29,8 @@
       field('job').textContent = job;
       field('job').href = `/jobs/${encodeURIComponent(job)}`;
       field('job-text').textContent = job;
-      field('form').action = `/resources/${encodeURIComponent(id)}/remove`;
-      field('return').value = returnTo || '/resources';
+      field('form').action = `/runners/${encodeURIComponent(id)}/remove`;
+      field('return').value = returnTo || '/runners';
 
       // Clicked from inside a resource card: close that first — Bootstrap
       // doesn't stack modals.

package/src/services/jobs.js

@@ -14,6 +14,7 @@
 'use strict';
 
 const { validateJobSpec, maskEnv, JOB_STATES, ACTIVE_JOB_STATES, TERMINAL_JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common'),
+  { LABEL_RE, LABEL_RULE } = require('./registry'),
   { paginate } = require('./list-prefs'),
   { parseTerms, likeClause } = require('./search'),
   { sanitizeArtifacts } = require('./job-artifacts'),
@@ -165,6 +166,12 @@ function createJobsService(db, { bus, events, registry, config }){
     if (!valid){
       throw Object.assign(new Error(`Invalid job spec (${VERSIONS}): ${errors.join('; ')}`), { status: 400 });
     }
+    // A label no runner could have (the Labels tab's rule): say so, rather
+    // than "no runner can ever satisfy" it.
+    const badLabels = (spec.target.labels || []).filter((l) => !LABEL_RE.test(l));
+    if (badLabels.length){
+      throw Object.assign(new Error(`Invalid label: ${badLabels.join(', ')} — ${LABEL_RULE}`), { status: 400 });
+    }
     spec.source = source;
     // The group is the agent's, set on the dashboard (§13.1) — whatever an
     // older Agent sent as `target.group` is replaced.

package/src/services/list-prefs.js

@@ -32,7 +32,7 @@ const PAGE_SIZES = [10, 25, 50, 100, 'all'],
       defaults: { size: DEFAULT_PAGE_SIZE, sort: 'name', dir: 'asc' }
     },
     agents: {
-      sorts: ['name', 'kind', 'group', 'version', 'created', 'used', 'status'],
+      sorts: ['name', 'group', 'version', 'created', 'used', 'status'],
       defaults: { size: DEFAULT_PAGE_SIZE, sort: 'created', dir: 'desc' }
     },
     users: {

package/src/services/registry.js

@@ -18,8 +18,14 @@ const { v4: uuid } = require('uuid'),
     shareableClientConfigFile, HW_DEVICES_SECTION } = require('@andrian.yablonskyy/thub-common'),
   { generateToken, hashToken } = require('./tokens');
 
-// Never kept from or put in a Client's config file: its credentials.
-const CONFIG_FILE_SECRETS = ['joinKey'],
+// A label (a runner's, on the Labels tab; a job's, --label): 1–64
+// characters, no whitespace, commas or semicolons — JOB_LABEL joins them
+// with commas, and a label is one line on the dashboard.
+const LABEL_RE = /^[^\s,;]{1,64}$/,
+  LABEL_RULE = '1–64 characters, no spaces, commas or semicolons',
+
+  // Never kept from or put in a Client's config file: its credentials.
+  CONFIG_FILE_SECRETS = ['joinKey'],
   // The first Client that applies a whole config file (an Import's other
   // fields, the Groups tab), not only its hw-devices section.
   CONFIG_FILE_CLIENT = '1.0.30';
@@ -796,6 +802,38 @@ function createRegistryService(db, { bus, events }){
     return get(resourceId);
   }
 
+  // Labels tab (runner card): the labels a job's --label / --label board:must
+  // find on this Client. Like the Groups tab: they belong to its config
+  // file (`labels`, which every registration reports), so they go out as
+  // its next config revision, and the Coordinator applies them at once.
+  // Each label: see LABEL_RE (top); at most 64 of them.
+  function setClientLabels(resourceId, labels, { by } = {}){
+    const r = get(resourceId);
+    if (!r){
+      throw Object.assign(new Error('Unknown resource'), { status: 404 });
+    }
+    const list = [...new Set(labels.map((l) => String(l).trim()).filter(Boolean))],
+      bad = list.filter((l) => !LABEL_RE.test(l));
+    if (bad.length){
+      throw Object.assign(new Error(`Invalid label: ${bad.join(', ')} — ${LABEL_RULE}`), { status: 400 });
+    }
+    if (list.length > 64){
+      throw Object.assign(new Error('At most 64 labels'), { status: 400 });
+    }
+    const desired = currentSection(r);
+    if (!desired || r.config_support !== 'file'){
+      throw Object.assign(new Error(`${r.name} is too old to take its labels from the dashboard — update its Client first`), { status: 409 });
+    }
+    const revision = r.config_revision + 1,
+      fields = { ...(pendingImport(r) || {}), labels: list };
+    db.transaction(() => {
+      db.prepare(`UPDATE resources SET config_desired = ?, config_revision = ?, config_error = NULL, config_import = ?, labels = ?
+                  WHERE id = ?`).run(JSON.stringify(desired), revision, JSON.stringify({ revision, fields }), JSON.stringify(list), resourceId);
+    })();
+    events.record('resource', resourceId, 'resource.labels_set', { by, revision, labels: list });
+    return get(resourceId);
+  }
+
   // Export (resource card): the Client's config file as it last reported it
   // (secrets excluded), with what's saved for it but not applied yet — so
   // exporting right after an edit or import gives what the Client will run.
@@ -878,6 +916,7 @@ function createRegistryService(db, { bus, events }){
   return {
     get,
     reportClientConfig,
+    setClientLabels,
     getByName,
     getByClientId,
     getByTokenHash,
@@ -912,4 +951,4 @@ function createRegistryService(db, { bus, events }){
   };
 }
 
-module.exports = { createRegistryService };
+module.exports = { LABEL_RE, LABEL_RULE, createRegistryService };

package/src/web/routes.js

@@ -52,7 +52,6 @@ const STARTED_AT = new Date().toISOString(),
   // Agents page (list-prefs `agents`): never-used / never-reported last.
   AGENT_SORT_VALUE = {
     name: (a) => a.name,
-    kind: (a) => a.kind,
     version: (a) => a.version,
     created: (a) => a.created_at,
     used: (a) => a.last_used_at,
@@ -292,6 +291,15 @@ function createWebRouter({ services, config }){
     req.session.destroy(() => res.redirect('/login'));
   });
 
+  // Resources were renamed Runners on the dashboard: old links and
+  // bookmarks (and a form from a page loaded before) still land.
+  router.use((req, res, next) => {
+    if (!/^\/resources(\/|$)/.test(req.path)){
+      return next();
+    }
+    res.redirect(req.method === 'GET' || req.method === 'HEAD' ? 301 : 308, req.originalUrl.replace(/^\/resources/, '/runners'));
+  });
+
   router.use(requireAdminSession);
   router.use((req, res, next) => {
     const u = req.session.user;
@@ -496,7 +504,7 @@ function createWebRouter({ services, config }){
     res.render('index', { title: 'Overview', active: 'overview', liveTopics: 'resources jobs', resources, queueLength, jobsLast24h, onlineCount, groupsById });
   });
 
-  router.get('/resources', (req, res) => {
+  router.get('/runners', (req, res) => {
     const groupsById = Object.fromEntries(services.groups.list().map((g) => [g.id, g])),
       q = search.normalizeQuery(req.query.q),
       terms = search.parseTerms(q),
@@ -518,7 +526,7 @@ function createWebRouter({ services, config }){
       pagination = listPrefs.paginate(sorted.length, size, req.query.page),
       pageUrl = (changes) => view.urlFor({ page: pagination.page, ...changes });
     res.render('resources/list', {
-      title: 'Resources',
+      title: 'Runners',
       active: 'resources',
       liveTopics: 'resources',
       resources: withActiveJobs(sorted.slice(pagination.offset, pagination.offset + pagination.limit)),
@@ -527,21 +535,21 @@ function createWebRouter({ services, config }){
     });
   });
 
-  router.post('/resources/:id/maintenance', (req, res) => {
+  router.post('/runners/:id/maintenance', (req, res) => {
     services.registry.setMaintenance(req.params.id, req.body.enabled === '1');
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Cancel whatever the Client is doing (resource card): its job, a manual
   // local lock, or a self-update hold (README §10). The Client applies the
   // lock/update ones via heartbeat commands; a job is canceled right here.
-  router.post('/resources/:id/cancel-activity', (req, res) => {
+  router.post('/runners/:id/cancel-activity', (req, res) => {
     const r = services.registry.get(req.params.id),
       job = r && services.jobs.activeForResource(r.id),
       activity = r?.activity?.state;
     try {
       if (!r){
-        throw Object.assign(new Error('Unknown resource'), { status: 404 });
+        throw Object.assign(new Error('Unknown runner'), { status: 404 });
       }
       if (job){
         services.jobs.cancel(job.id, { isAdmin: true });
@@ -572,10 +580,10 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
-  router.post('/resources/:id/remove', (req, res) => {
+  router.post('/runners/:id/remove', (req, res) => {
     try {
       const { resource: r, pending, stoppedJob, canceledJobs } = services.jobs.removeResource(req.params.id, {
         by: req.session.user.username,
@@ -592,12 +600,12 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Reboot now (resource card footer): cancels a running job, then the
   // Client reboots its host on its next heartbeat (jobs.requestReboot).
-  router.post('/resources/:id/reboot', (req, res) => {
+  router.post('/runners/:id/reboot', (req, res) => {
     try {
       const { resource: r, canceledJob } = services.jobs.requestReboot(req.params.id, { by: req.session.user.username });
       flash(req, 'warning', `Rebooting ${r.name}'s host on its next heartbeat.` + (canceledJob ? `\nCanceled its running job ${canceledJob}.` : ''));
@@ -605,7 +613,7 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // "Connected USB devices" tab (public/js/usb-scan.js): Refresh queues a
@@ -621,7 +629,7 @@ function createWebRouter({ services, config }){
     };
   }
 
-  router.post('/resources/:id/usb-scan', (req, res) => {
+  router.post('/runners/:id/usb-scan', (req, res) => {
     try {
       services.registry.requestUsbScan(req.params.id, { by: req.session.user.username });
       res.json(usbScanView(req, services.registry.get(req.params.id)));
@@ -631,16 +639,16 @@ function createWebRouter({ services, config }){
     }
   });
 
-  router.get('/resources/:id/usb-scan', (req, res) => {
+  router.get('/runners/:id/usb-scan', (req, res) => {
     const r = services.registry.get(req.params.id);
     if (!r){
-      return res.status(404).json({ error: 'Unknown resource' });
+      return res.status(404).json({ error: 'Unknown runner' });
     }
     res.set('Cache-Control', 'no-store').json(usbScanView(req, r));
   });
 
   // Rename (resource card, Name row); empty = back to the Client's own name.
-  router.post('/resources/:id/rename', (req, res) => {
+  router.post('/runners/:id/rename', (req, res) => {
     try {
       const before = services.registry.get(req.params.id)?.name,
         r = services.registry.rename(req.params.id, req.body.name, { by: req.session.user.username });
@@ -651,13 +659,13 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Capabilities (resource card, Config tab): public/js/client-config.js
   // sends the edited hw/sw section as JSON in `config`. Applied by the Client
   // on its next heartbeat, then it restarts once idle.
-  router.post('/resources/:id/config', (req, res) => {
+  router.post('/runners/:id/config', (req, res) => {
     try {
       let config;
       try {
@@ -673,12 +681,27 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Groups tab (resource card): the Client's group membership, as a config
   // revision the Client writes to its file (registry.setClientGroups).
-  router.post('/resources/:id/groups', (req, res) => {
+  // Labels tab (runner card): one label per line.
+  router.post('/runners/:id/labels', (req, res) => {
+    try {
+      // One per line: a comma or semicolon is in a label (and refused), not a separator.
+      const labels = String(req.body.labels || '').split(/\r?\n/),
+        r = services.registry.setClientLabels(req.params.id, labels, { by: req.session.user.username });
+      flash(req, 'success', `Labels of ${r.name} saved: ${r.labels.length ? r.labels.join(', ') : 'none'} — in effect now.\n` +
+        'The Client writes them to its config file on its next heartbeat, then restarts once it has no job running.');
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/runners'));
+  });
+
+  router.post('/runners/:id/groups', (req, res) => {
     try {
       const ids = [].concat(req.body.groups || []).filter((g) => typeof g === 'string' && g),
         r = services.registry.setClientGroups(req.params.id, ids, {
@@ -691,12 +714,12 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Export (resource card, admins — the file holds the join key): the
   // Client's config file as JSON, secrets excluded.
-  router.get('/resources/:id/config/export', (req, res) => {
+  router.get('/runners/:id/config/export', (req, res) => {
     try {
       const r = services.registry.get(req.params.id),
         file = services.registry.exportClientConfig(req.params.id);
@@ -704,13 +727,13 @@ function createWebRouter({ services, config }){
     }
     catch (err){
       flash(req, 'danger', err.message);
-      res.redirect('/resources');
+      res.redirect('/runners');
     }
   });
 
   // Import (resource card, public/js/config-import.js): a config file, applied
   // by the Client on its next heartbeat like a Config tab Save.
-  router.post('/resources/:id/config/import', (req, res) => {
+  router.post('/runners/:id/config/import', (req, res) => {
     try {
       let file;
       try {
@@ -727,12 +750,12 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Scheduled host reboot (resource card): save a cron expression, or clear
   // it; the Client applies it on its next heartbeat.
-  router.post('/resources/:id/reboot-schedule', (req, res) => {
+  router.post('/runners/:id/reboot-schedule', (req, res) => {
     try {
       const cron = req.body.clear === '1' ? '' : req.body.cron,
         r = services.registry.setRebootSchedule(req.params.id, cron, { by: req.session.user.username });
@@ -743,17 +766,17 @@ function createWebRouter({ services, config }){
     catch (err){
       flash(req, 'danger', err.message);
     }
-    res.redirect(returnTo(req, '/resources'));
+    res.redirect(returnTo(req, '/runners'));
   });
 
-  router.post('/resources/:id/rotate-token', requireAdminRole, (req, res) => {
+  router.post('/runners/:id/rotate-token', requireAdminRole, (req, res) => {
     const { generateToken, hashToken } = require('../services/tokens');
     const token = generateToken('res');
     services.db.prepare('UPDATE resources SET token_hash = ? WHERE id = ?').run(hashToken(token), req.params.id);
     services.events.record('resource', req.params.id, 'resource.token_rotated', {});
     // Sticky: shown only once, so it mustn't close before it's copied.
-    flash(req, 'warning', `New resource token (copy it now):\n${token}`, { sticky: true });
-    res.redirect(returnTo(req, '/resources'));
+    flash(req, 'warning', `New runner token (copy it now):\n${token}`, { sticky: true });
+    res.redirect(returnTo(req, '/runners'));
   });
 
   // Self-update (README §10.2). Clients get a `self-update` heartbeat
@@ -797,13 +820,13 @@ function createWebRouter({ services, config }){
       parts.push('Latest Client version unknown.');
     }
     else if (!connected.length){
-      parts.push('No connected resources.');
+      parts.push('No connected runners.');
     }
     else if (outdated.length){
-      parts.push(`${outdated.length} of ${connected.length} connected resource(s) can update to Client v${s.latest.client}: ${names(outdated)}.`);
+      parts.push(`${outdated.length} of ${connected.length} connected runner(s) can update to Client v${s.latest.client}: ${names(outdated)}.`);
     }
     else {
-      parts.push(`All ${connected.length} connected resource(s) run the latest Client (v${s.latest.client}).`);
+      parts.push(`All ${connected.length} connected runner(s) run the latest Client (v${s.latest.client}).`);
     }
     if (unknown.length){
       parts.push(`Version unknown (Client too old to report it): ${names(unknown)}.`);
@@ -833,20 +856,20 @@ function createWebRouter({ services, config }){
     });
   });
 
-  router.post('/resources/update-all', updateAction(async () => {
+  router.post('/runners/update-all', updateAction(async () => {
     const version = await services.updates.targetVersion('client'),
       n = services.registry.requestUpdateAll(version);
-    return `Requested update to client v${version} on ${n} resource(s).`;
+    return `Requested update to client v${version} on ${n} runner(s).`;
   }));
 
-  router.post('/resources/:id/update', updateAction(async (req) => {
+  router.post('/runners/:id/update', updateAction(async (req) => {
     // Cancel (next to the version): withdraw the request and, if the host is
     // already holding for the update, abort that too (the Client's next
     // heartbeat) — the one control for canceling a Client update.
     if (req.body.cancel === '1'){
       const r = services.registry.get(req.params.id);
       if (!r){
-        throw Object.assign(new Error('Unknown resource'), { status: 404 });
+        throw Object.assign(new Error('Unknown runner'), { status: 404 });
       }
       services.registry.setUpdateTo(r.id, null);
       if (r.activity?.state === 'update-hold'){
@@ -1069,7 +1092,7 @@ function createWebRouter({ services, config }){
 
   router.post('/groups/:id/delete', (req, res) => {
     services.groups.remove(req.params.id);
-    flash(req, 'warning', 'Group deleted; any resource that listed it just stopped matching on it.');
+    flash(req, 'warning', 'Group deleted; any runner that listed it just stopped matching on it.');
     res.redirect('/groups');
   });
 
@@ -1086,7 +1109,7 @@ function createWebRouter({ services, config }){
       // CI tokens only: a person's key belongs to their user (Users, §10.3).
       sorted = services.agents.list()
         .filter((a) => !a.user_id)
-        .filter((a) => search.matches([a.name, a.kind, a.version, groupName(a), a.revoked_at ? 'revoked' : 'active'], terms))
+        .filter((a) => search.matches([a.name, a.version, groupName(a), a.revoked_at ? 'revoked' : 'active'], terms))
         .sort((a, b) => {
           const va = value(a),
             vb = value(b);
@@ -1469,7 +1492,7 @@ function createWebRouter({ services, config }){
       if (req.body.groupId !== undefined && (req.body.groupId || null) !== (before.group_id || null)){
         const group = req.body.groupId ? services.groups.get(req.body.groupId) : null;
         services.agents.setGroup(req.params.id, req.body.groupId);
-        flash(req, 'success', group ? `"${agent.name}" now runs its jobs in group ${group.name}.` : `"${agent.name}" now runs its jobs on any resource.`);
+        flash(req, 'success', group ? `"${agent.name}" now runs its jobs in group ${group.name}.` : `"${agent.name}" now runs its jobs on any runner.`);
       }
     }
     catch (err){

package/test/groups-tab.test.js

@@ -52,10 +52,10 @@ test('Groups tab: in effect at once, sent to the Client as its next config revis
     nightly = services.groups.create({ name: 'nightly' }),
     pr = services.groups.create({ name: 'pr-pool', comment: 'pull requests' }),
     id = register(services, 'lab-sw-01'),
-    save = (cookie, groups) => fetch(`${base}/resources/${id}/groups`, {
-      method: 'POST', headers: { cookie }, body: new URLSearchParams([...groups.map((g) => ['groups', g]), ['returnTo', '/resources']]), redirect: 'manual'
+    save = (cookie, groups) => fetch(`${base}/runners/${id}/groups`, {
+      method: 'POST', headers: { cookie }, body: new URLSearchParams([...groups.map((g) => ['groups', g]), ['returnTo', '/runners']]), redirect: 'manual'
     }),
-    page = async () => (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text();
+    page = async () => (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
 
   assert.equal((await save(viewer, [nightly.id])).status, 302); // a maintainer may (§10.3)
   assert.equal((await save(admin, [nightly.id, pr.id])).status, 302);
@@ -105,7 +105,7 @@ test('device tabs show what the Client runs — not an old saved revision; group
     }).resourceId,
     id = register('1.1'),
     devpaths = async () => {
-      const html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text(),
+      const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text(),
         table = html.slice(html.indexOf(`id="cfg-${id}-stlinks"`), html.indexOf(`id="cfg-${id}-uarts"`));
       return [...table.matchAll(/data-f="devpath" value="([^"]*)"/g)].map((m) => m[1]).filter(Boolean); // not the blank add-row template
     };
@@ -134,7 +134,7 @@ test('ST-Link tab has no Serial field; a serial set in the config file is kept o
       clientId: 'hw2', name: 'lab-hw-02', type: 'hw', labels: [],
       config: { stlinks: [{ index: 1, serial: '066DFF48', devpath: '1.2' }] }, configFile: { name: 'lab-hw-02', type: 'hw' }
     }).resourceId,
-    html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text(),
+    html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text(),
     table = html.slice(html.indexOf(`id="cfg-${id}-stlinks"`), html.indexOf(`id="cfg-${id}-uarts"`));
   assert.doesNotMatch(table, /data-f="serial"|>Serial</);
   // Rides along in data-extra, which public/js/client-config.js spreads back into the row.
@@ -147,7 +147,7 @@ test('resource card: USB actions update live and every disabled button says why'
       clientId: 'hw3', name: 'lab-hw-03', type: 'hw', labels: [], config: { stlinks: [{ index: 1 }] }, configFile: { name: 'lab-hw-03', type: 'hw' }
     }),
     card = async () => {
-      const html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text();
+      const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
       return html.slice(html.indexOf(`id="resource-card-${reg.resourceId}"`));
     };
   let html = await card();
@@ -169,7 +169,7 @@ test('Import and Export work for a Client that doesn\'t re-register (no joinKey)
   const { base, services, admin } = await start(t),
     { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'hw4', name: 'lab-hw-04', type: 'hw', labels: [] }),
     card = async () => {
-      const html = await (await fetch(`${base}/resources`, { headers: { cookie: admin } })).text();
+      const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
       return html.slice(html.indexOf(`id="resource-card-${resourceId}"`));
     };
   assert.match(await card(), /Import unavailable: this Client is too old/); // nothing reported, no version known
@@ -188,7 +188,7 @@ test('Import and Export work for a Client that doesn\'t re-register (no joinKey)
   const html = await card();
   assert.match(html, /data-config-import-pick/); // Import enabled
   assert.doesNotMatch(html, /Import unavailable/);
-  const exported = await (await fetch(`${base}/resources/${resourceId}/config/export`, { headers: { cookie: admin } })).json();
+  const exported = await (await fetch(`${base}/runners/${resourceId}/config/export`, { headers: { cookie: admin } })).json();
   assert.equal(exported.joinKey, undefined);
   assert.deepEqual(exported['hw-devices'], { stlinks: [{ index: 1, devpath: '1.1' }] });
 
@@ -238,7 +238,7 @@ test('agent groups are set on the dashboard (Users, CI tokens) and shown by name
   assert.match(agents, /<span class="badge text-bg-info">nightly-pool<\/span>/);
   assert.match(groups, /data-bs-title="dev, ci-night"[^>]*>2</); // Agents column: users, then CI tokens
   // The id is never shown as text on a page (it's only in values and URLs).
-  for (const html of [users, agents, groups, await page(admin, '/resources'), await page(admin, `/jobs/${job.id}`)]){
+  for (const html of [users, agents, groups, await page(admin, '/runners'), await page(admin, `/jobs/${job.id}`)]){
     const text = html.replace(/<[^>]*>/g, ' ');
     assert.ok(!text.includes(g.id), 'a group id shows as text');
   }
@@ -275,3 +275,68 @@ test('CI tokens: the name opens Edit; a new token replaces the old one; delete k
   assert.match(await (await form(`/admin/agents/${agent.id}/token`)).headers.get('location'), /agents/); // can't come back
   assert.equal(services.agents.get(agent.id).revoked_at !== null, true);
 });
+
+test('Resources renamed Runners: the page is /runners; old /resources links and forms still land', async (t) => {
+  const { base, admin } = await start(t),
+    old = await fetch(`${base}/resources?q=lab`, { headers: { cookie: admin }, redirect: 'manual' });
+  assert.equal(old.status, 301);
+  assert.equal(old.headers.get('location'), '/runners?q=lab');
+  const post = await fetch(`${base}/resources/abc/rename`, { method: 'POST', headers: { cookie: admin }, redirect: 'manual' });
+  assert.equal(post.status, 308); // keeps the method and body
+  assert.equal(post.headers.get('location'), '/runners/abc/rename');
+  const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
+  assert.match(html, /<title>Runners · TestHub<\/title>/);
+  assert.match(html, /href="\/runners"[^>]*>(<i [^>]*><\/i>)?Runners</);
+  assert.doesNotMatch(html.replace(/<[^>]*>/g, ' '), /\bResources?\b/); // no visible "Resource(s)" left on the page
+});
+
+test('Labels tab: in effect at once, sent to the Client as its next config revision; validated', async (t) => {
+  const { base, services, admin } = await start(t),
+    id = register(services, 'lab-sw-30'),
+    save = (labels) => fetch(`${base}/runners/${id}/labels`, {
+      method: 'POST', headers: { cookie: admin }, body: new URLSearchParams({ labels, returnTo: '/runners' }), redirect: 'manual'
+    }),
+    card = async () => {
+      const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
+      return html.slice(html.indexOf(`id="resource-card-${id}"`));
+    };
+  assert.match(await card(), new RegExp(`id="cfg-${id}-labels-tab"`)); // the tab
+
+  await save('board:nucleo-f401re\nuart\n\nuart\n');
+  const r = services.registry.get(id);
+  assert.deepEqual(r.labels, ['board:nucleo-f401re', 'uart']); // trimmed, deduplicated, at once
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:nucleo-f401re', 'uart'] });
+  assert.match(await card(), /not written to the Client yet/);
+  assert.match(await card(), />board:nucleo-f401re\nuart<\/textarea>/);
+
+  // Scheduling follows at once: a job asking for them can run here.
+  services.registry.heartbeat(id, { state: 'IDLE' });
+  const { agent } = services.agents.create({ name: 'ci', kind: 'ci' }),
+    spec = { target: { type: 'sw', labels: ['uart', 'board:nucleo-f401re'] }, command: './t' };
+  assert.ok(services.jobs.create({ agentId: agent.id, source: 'ci', spec }));
+
+  // A groups save meanwhile keeps the labels in the same revision.
+  services.registry.setClientGroups(id, [], { by: 'admin' });
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:nucleo-f401re', 'uart'], groups: [] });
+
+  await save('has space');
+  assert.deepEqual(services.registry.get(id).labels, ['board:nucleo-f401re', 'uart']); // refused
+  for (const bad of ['a,b', 'a;b', 'a\tb', 'x'.repeat(65)]){
+    assert.throws(() => services.registry.setClientLabels(id, [bad], { by: 'x' }), /1–64 characters, no spaces, commas or semicolons/, bad);
+  }
+  assert.deepEqual(services.registry.setClientLabels(id, ['x'.repeat(64), 'board:b'], { by: 'x' }).labels, ['x'.repeat(64), 'board:b']);
+  await save('uart, stlink'); // a comma is part of the label (refused), not a separator
+  assert.deepEqual(services.registry.get(id).labels, ['x'.repeat(64), 'board:b']);
+  // One per line in the card's Labels row and the Runners table.
+  const html = await card(),
+    labelsRow = html.slice(html.indexOf('<dt class="col-sm-4">Labels</dt>'));
+  assert.match(labelsRow, /^<dt[^>]*>Labels<\/dt><dd[^>]*><div class="d-flex flex-column[^"]*">/);
+  assert.match(labelsRow, /^[^]*?<span class="badge[^"]*">x{64}<\/span><span class="badge[^"]*">board:b<\/span><\/div>/);
+
+  // A job asking for a label no runner could have: refused, saying why.
+  assert.throws(() => services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw', labels: ['has space'] }, command: './t' } }),
+    /Invalid label: has space — 1–64 characters/);
+
+  const old = register(services, 'lab-old-30', { configFile: null });
+  assert.throws(() => services.registry.setClientLabels(old, ['x'], { by: 'x' }), /too old/);
+});

package/test/live.test.js

@@ -133,7 +133,7 @@ test('live: /live streams hello and changes; passive re-fetches keep the idle ti
   await new Promise((r) => setTimeout(r, 1100));
 
   // …survives a passive re-fetch, which also doesn't push the expiry out.
-  const passive = await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' } });
+  const passive = await fetch(`${base}/runners`, { headers: { cookie, 'X-Thub-Live': '1' } });
   assert.equal(passive.status, 200);
   assert.match(passive.headers.get('cache-control'), /no-store/);
   const passiveExpires = expiresOf(passive);
@@ -149,5 +149,5 @@ test('live: /live streams hello and changes; passive re-fetches keep the idle ti
   // passive re-fetch is redirected to the login page.
   await fetch(`${base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
   assert.equal((await fetch(`${base}/live`, { headers: { cookie, accept: 'text/event-stream' } })).status, 401);
-  assert.equal((await fetch(`${base}/resources`, { headers: { cookie, 'X-Thub-Live': '1' }, redirect: 'manual' })).status, 302);
+  assert.equal((await fetch(`${base}/runners`, { headers: { cookie, 'X-Thub-Live': '1' }, redirect: 'manual' })).status, 302);
 });

package/test/scheduler.test.js

@@ -845,3 +845,15 @@ test('migration 027 drops joinKey copies from stored config files', () => {
   assert.deepEqual(JSON.parse(db.prepare('SELECT client_config_file FROM resources WHERE id = ?').get('a').client_config_file), { name: 'a', labels: [] });
   assert.equal(db.prepare('SELECT client_config_file FROM resources WHERE id = ?').get('b').client_config_file, null);
 });
+
+test('a job runs only on a runner that has every label it asks for', () => {
+  const { registry, agents, jobs, scheduler } = buildTestServices(),
+    { agent } = agents.create({ name: 'ci', kind: 'ci' }),
+    some = registerResource(registry, { name: 'lab-some', type: 'hw', labels: ['board:nucleo', 'uart'] }),
+    all = registerResource(registry, { name: 'lab-all', type: 'hw', labels: ['board:nucleo', 'uart', 'stlink', 'extra'] });
+  registry.heartbeat(some.id, { state: 'idle' });
+  registry.heartbeat(all.id, { state: 'idle' });
+  const job = jobs.create({ agentId: agent.id, source: 'ci', spec: makeSpec({ target: { type: 'hw', labels: ['board:nucleo', 'uart', 'stlink'] } }) });
+  scheduler.runPass();
+  assert.equal(jobs.get(job.id).resource_id, all.id); // lab-some lacks stlink, though it's idle too
+});