@andrian.yablonskyy/thub-coordinator 1.1.8 → 1.1.10

package/test/users.test.js

@@ -185,7 +185,7 @@ test('dashboard: only maintainers and admins sign in; security pages are admins\
   assert.match(dev.text, /no dashboard access/);
 
   const mo = await signIn('mo', 'pw');
-  assert.equal((await get(mo.cookie, '/resources')).status, 200);
+  assert.equal((await get(mo.cookie, '/runners')).status, 200);
   assert.equal((await get(mo.cookie, '/admin/settings')).status, 403); // admins' only
   for (const url of ['/admin/users', '/admin/agents']){
     assert.equal((await get(mo.cookie, url)).status, 200, url); // within limits — see below
@@ -195,7 +195,7 @@ test('dashboard: only maintainers and admins sign in; security pages are admins\
 
   // Blocked while signed in: the next click goes to the sign-in page.
   u.setBlocked(maint.id, true, { actorId: admin.id });
-  const after = await get(mo.cookie, '/resources');
+  const after = await get(mo.cookie, '/runners');
   assert.equal(after.status, 302);
   assert.equal(after.headers.get('location'), '/login');
   assert.match((await signIn('mo', 'pw')).text, /blocked/);

package/views/admin/agents.pug

@@ -10,7 +10,7 @@ block content
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
     +updatesToolbar('agent', 'agents', list.pageUrl())
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
-    +searchForm(q, 'Search agents: name, kind, group, version, status', list.urlFor({ q: '' }))
+    +searchForm(q, 'Search CI tokens: name, group, version, status', list.urlFor({ q: '' }))
     .ms-auto
       +pageSizePicker(list)
 
@@ -30,7 +30,6 @@ block content
     thead
       tr
         +sortHeader(list, 'name', 'Name')
-        +sortHeader(list, 'kind', 'Kind')
         +sortHeader(list, 'group', 'Group')
         +sortHeader(list, 'version', 'Version', 'desc')
         +sortHeader(list, 'created', 'Created', 'desc')
@@ -43,7 +42,6 @@ block content
           //- The name opens Edit (name and group).
           td
             a.fw-medium(href=`#editAgentModal-${a.id}` data-bs-toggle="modal" role="button")= a.name
-          td.text-uppercase= a.kind
           td
             if a.group_id && groupsById[a.group_id]
               span.badge.text-bg-info= groupsById[a.group_id].name
@@ -108,7 +106,7 @@ block content
                       button.btn.btn-primary(type="submit") Save
       else
         tr
-          td.text-body-secondary(colspan="8")
+          td.text-body-secondary(colspan="7")
             if q
               | No agent matches “#{q}”. 
               a(href=list.urlFor({ q: '' })) Show all agents

package/views/groups/list.pug

@@ -9,7 +9,7 @@ block content
 
   p.text-body-secondary.small: i.
     Give an agent a group — a user on #[a(href="/admin/users") Users], a CI token on #[a(href="/admin/agents") CI tokens] —
-    and its jobs run only on resources in that group (§13.1). Which groups a Client is in is set on its resource card (Groups tab).
+    and its jobs run only on runners in that group (§13.1). Which groups a Client is in is set on its runner card (Groups tab).
 
   if totalCount
     .d-flex.flex-wrap.align-items-center.gap-2.mb-2
@@ -25,7 +25,7 @@ block content
         tr
           th Name
           th Comment
-          th Resources
+          th Runners
           th Agents
           th Created
           if canManage
@@ -44,7 +44,7 @@ block content
                 form.d-inline.ms-1(
                   method="post"
                   action=`/groups/${g.id}/delete`
-                  data-confirm=`Delete group "${g.name}"? Resources listing it just stop matching on it, and its agents go back to running their jobs on any resource.`
+                  data-confirm=`Delete group "${g.name}"? Runners listing it just stop matching on it, and its agents go back to running their jobs on any runner.`
                   data-confirm-title="Delete group?"
                   data-confirm-ok="Delete group"
                 )

package/views/help/_agent-cli.pug

@@ -18,9 +18,8 @@
   -
     const groups = [
       { title: 'Where to run', rows: [
-        ['--type hw|sw', 'Required. Resource type.', '--type hw'],
-        ['--board <name>', 'Shorthand for --label board:<name>.', '--board nucleo-f401re'],
-        ['--label <l>', 'Required label (repeatable). The Client must have all of them.', '--label uart --label stlink'],
+        ['--type hw|sw', 'Required. Runner type.', '--type hw'],
+        ['--label <l>', 'Required label (repeatable). The runner must have all of them. 1–64 characters, no spaces, commas or semicolons.', '--label uart --label stlink'],
         ['--client <name|id>', 'Only this Client; waits for it even if others are idle.', '--client lab-hw-01']
       ] },
       { title: 'What to run', rows: [
@@ -73,13 +72,13 @@
 
   h3.h6 Examples
   +code('Flash and test a board, fail CI on failure').
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo https://github.com/yourorg/firmware-tests.git v1.4.0 \
       --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/test.sh "$@"' \
       --arg --junit --timeout 45m --wait
   +code('Reproduce a failure on the exact bench, labeled with your name').
-    thub run --type hw --board nucleo-f401re --client lab-hw-01 --user "$USER" \
+    thub run --type hw --label board:nucleo-f401re --client lab-hw-01 --user "$USER" \
       --download-file "$IMAGE_URL" --git-repo "$TESTS_REPO" --command ./ci/test.sh
     # Ctrl-C detaches; the job keeps running. Re-attach:
     thub status M-00126

package/views/help/_agent-setup.pug

@@ -44,7 +44,7 @@
     thub config set key   thk_…
     thub config set user  "Your Name"      # optional: job owner label
   p.small.
-    These are saved in #[code ~/.config/thub/agent.json]. Which resource group your jobs run in isn't an Agent
+    These are saved in #[code ~/.config/thub/agent.json]. Which runner group your jobs run in isn't an Agent
     setting: an admin or maintainer sets it for your user on the dashboard (#[code thub whoami] shows it). Order of precedence: flags (#[code --url], #[code --key]) →
     environment → config file.
   table.table.table-sm.small

package/views/help/_ci.pug

@@ -31,7 +31,7 @@
         steps:
           - run: |
               npx -y @andrian.yablonskyy/thub-agent run \
-                --type hw --board nucleo-f401re \
+                --type hw --label board:nucleo-f401re \
                 --download-file "${{ needs.build.outputs.image_url }}" \
                 --git-repo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" "$GITHUB_SHA" \
                 --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/hw-tests.sh' \

package/views/help/_client-machines.pug

@@ -40,17 +40,17 @@
         lsusb -t                                      # USB tree
         udevadm info -a -n /dev/ttyUSB0 | grep -m1 'ATTRS{devpath}'
         st-info --probe                               # ST-Link serials
-      | Or open the resource card → #[strong Connected USB devices] → #[strong Refresh], then #[strong Import to config].
+      | Or open the runner card → #[strong Connected USB devices] → #[strong Refresh], then #[strong Import to config].
     li
       | Put the devpaths into #[code hw-devices] and restart. On every start the Client writes
       | #[code /etc/udev/rules.d/99-thub-<instance>.rules], so the devices appear as #[code /dev/thub/dut<N>-stlink|uart|usb]:
       +code('HW machine').
         sudo systemctl restart thub-client@client
         ls -l /dev/thub/
-    li Check the resource card's #[strong Capabilities]: each configured device must be present (a missing one is flagged).
+    li Check the runner card's #[strong Capabilities]: each configured device must be present (a missing one is flagged).
     li Your job's #[code --command] flashes the board. The Client never flashes by itself; it passes the ST-Link serials and the downloaded files in the environment (#[a(href="#env") Environment variables]).
   +code('A typical HW job').
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo https://github.com/yourorg/firmware-tests.git v1.4.0 \
       --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/test.sh' \
@@ -71,7 +71,7 @@
   p.small.
     To scale out, clone the VM template. In the clone, #[strong before its first start], run
     #[code rm -f ~/var/lib/thub/client/*/.client-id ~/var/lib/thub/client/*.token] and give it its own #[code name].
-    Otherwise both VMs register as the same resource.
+    Otherwise both VMs register as the same runner.
   +code('A typical SW job').
     thub run --type sw \
       --docker-image registry.lab.local:5000/dut-emulator:2026.08 \
@@ -84,4 +84,4 @@
     li Outbound HTTPS to the Coordinator; test it with #[code curl -sI #{coordinatorUrl}/login].
     li The Client's service user has SSH keys and git credentials for private repos (#[a(href="#git") Git repositories]) and Docker logins for private registries (#[a(href="#docker") Docker registry]).
     li Under systemd, the service can only write to its state directory. Jobs write to #[code $THUB_WORK_DIR], not to #[code ~].
-    li Optional: a nightly reboot from the resource card's #[strong Reboot] tab (cron, host-local time). It waits for running jobs.
+    li Optional: a nightly reboot from the runner card's #[strong Reboot] tab (cron, host-local time). It waits for running jobs.

package/views/help/_client-setup.pug

@@ -74,15 +74,15 @@
         tr
           td: code name
           td No
-          td Resource name. Under systemd, the instance name (#[code thub-client@dut1] → #[code dut1]) is used unless an admin renames it on the dashboard.
+          td Runner name. Under systemd, the instance name (#[code thub-client@dut1] → #[code dut1]) is used unless an admin renames it on the dashboard.
         tr
           td: code labels
           td No
-          td Matched against a job's #[code --board]/#[code --label]. Use #[code board:<name>] for the board.
+          td Matched against a job's #[code --label]s. Use #[code board:<name>] for the board (#[code --label board:<name>]). Also set on its runner card (Labels tab), which writes them here.
         tr
           td: code groups
           td No
-          td The resource groups this Client belongs to. Set them on its resource card (Groups tab), which writes them here.
+          td The runner groups this Client belongs to. Set them on its runner card (Groups tab), which writes them here.
         tr
           td: code varDir
           td No
@@ -101,7 +101,7 @@
           td An explicit identity UUID (or #[code THUB_CLIENT_ID]). Normally generated once and kept in #[code .client-id].
   p.small.
     SW Clients have no settings of their own: they run whatever DUT image a job brings (#[code --docker-image]).
-    Admins can also edit an HW Client's devices from its resource card (#[strong ST-Link | UART | DUT USB]
+    Admins can also edit an HW Client's devices from its runner card (#[strong ST-Link | UART | DUT USB]
     tabs). The tabs show the config the Client runs, as it reported it at its last start, or a saved
     change it hasn't applied yet. #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
     The card's #[strong Export] and #[strong Import] icons download a Client's config file (never its

package/views/help/_coordinator.pug

@@ -63,13 +63,13 @@
           td The shared secret Clients self-register with. Unset or #[code null] turns registration off (#[code 503]).
         tr
           td: code heartbeat.*
-          td Clients heartbeat every #[code intervalSec] — the Coordinator tells them, so it's set here only (and on Settings). After #[code missedLimit] misses a resource goes #[code OUT_OF_SERVICE] and its job becomes #[code LOST]; #[code sweepIntervalSec] is how often that's checked.
+          td Clients heartbeat every #[code intervalSec] — the Coordinator tells them, so it's set here only (and on Settings). After #[code missedLimit] misses a runner goes #[code OUT_OF_SERVICE] and its job becomes #[code LOST]; #[code sweepIntervalSec] is how often that's checked.
         tr
           td: code scheduler.*
           td #[code assignAckTimeoutSec]: how long an assignment waits for the Client to accept. #[code requeueOnLost]: retry a #[code LOST] job once. #[code maxQueuedPerAgent]: queue limit per agent.
         tr
           td: code rateLimit.*
-          td Requests per minute per caller (agent/resource token, dashboard user, else IP; default 500), and sign-in attempts per IP (default 10). Past it: #[code 429] with #[code Retry-After]. #[code 0] turns a limit off.
+          td Requests per minute per caller (agent/runner token, dashboard user, else IP; default 500), and sign-in attempts per IP (default 10). Past it: #[code 429] with #[code Retry-After]. #[code 0] turns a limit off.
         tr
           td: code jobs.*
           td Default and maximum job timeout, in seconds.
@@ -152,5 +152,5 @@
   p.small.mb-0.
     The Coordinator checks npm for new Coordinator, Agent and Client versions. Admins update the Coordinator
     with #[strong Update app] in the navbar, and Agents and Clients from the #[a(href="/admin/agents") Agents]
-    and #[a(href="/resources") Resources] pages. Clients install an update only between jobs.
+    and #[a(href="/runners") Runners] pages. Clients install an update only between jobs.
     Manual alternatives: #[code thub-admin self-update], #[code thub self-update] and #[code thub-client self-update].

package/views/help/_docker.pug

@@ -121,4 +121,4 @@
         td Files written to #[code /work] stay owned by the Client user, so the workspace can be cleaned up.
   +note('info').
     Docker access is effectively root access on that host. The Client host must have Docker and the service user must be in the
-    #[code docker] group. The resource card's #[strong Capabilities] show whether a Client can use Docker, and why not.
+    #[code docker] group. The runner card's #[strong Capabilities] show whether a Client can use Docker, and why not.

package/views/help/_env.pug

@@ -35,8 +35,7 @@
   -
     const jobVars = [
       ['JOB_TYPE', '--type', 'hw or sw'],
-      ['JOB_BOARD', '--board', 'the board name'],
-      ['JOB_LABEL / JOB_LABEL_<n>', '--board, --label', 'all labels, comma-separated / each'],
+      ['JOB_LABEL / JOB_LABEL_<n>', '--label', 'all labels, comma-separated / each'],
       ['JOB_GROUP', '(dashboard)', 'the submitting agent\'s group, if it has one'],
       ['JOB_CLIENT', '--client', 'this Client\'s name'],
       ['JOB_USER', '--user', 'as given'],
@@ -118,7 +117,7 @@
       python:3.14 ./run-tests.sh
   +code('Submitting the job that feeds these').
     export API_TOKEN=…
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo git@github.com:yourorg/firmware-tests.git main \
       --env TARGET=production --env API_TOKEN \

package/views/help/_overview.pug

@@ -12,7 +12,7 @@
             i.bi.bi-hdd-network.me-1
             | Coordinator
           p.card-text.small.mb-0.
-            This service. It holds the job queue and the resource registry, and runs the scheduler and
+            This service. It holds the job queue and the runner registry, and runs the scheduler and
             the heartbeat monitor. It stores job state and logs in SQLite,
             and serves this dashboard. It's the only thing that needs a public HTTPS port.
     .col-md-4
@@ -51,13 +51,13 @@
     li #[strong The Coordinator is the single source of truth.] It assigns a job inside a single SQLite transaction, so a job can never be assigned twice.
     li #[strong A job is a command, not a script upload.] The Client runs your #[code --command] as its service user, never as root. Issue agent tokens only to trusted pipelines and people.
 
-  h3.h6 Resource and job states
+  h3.h6 Runner and job states
   .row.g-3.small
     .col-md-6
       table.table.table-sm.mb-0
         thead
           tr
-            th Resource
+            th Runner
             th Meaning
         tbody
           tr

package/views/help/_quick-start.pug

@@ -18,7 +18,7 @@
         sudo npm i -g @andrian.yablonskyy/thub-client
         nano ~/.config/thub/client.json               # coordinatorUrl, type, joinKey
         sudo systemctl enable --now thub-client@client
-      | It shows up on #[a(href="/resources") Resources] by itself, usually within 10 s.
+      | It shows up on #[a(href="/runners") Runners] by itself, usually within 10 s.
     li
       strong Create users and their access keys
       |  on #[a(href="/admin/users") Users] (admins and maintainers), or on the Coordinator host with

package/views/help/_troubleshooting.pug

@@ -3,10 +3,10 @@
   //- <code>, with everything else HTML-escaped first (so `<instance>` shows as text).
   -
     const faq = [
-      ['A Client doesn\'t appear on Resources', 'Check `journalctl -u thub-client@<instance> -f`. A `503` at registration means the Coordinator has no `clientJoinKey`; a `401` means the `joinKey` differs. Also check that `coordinatorUrl` is reachable from the lab (`curl -sI <url>/login`).'],
-      ['A Client flaps or two machines show as one resource', 'Both use the same `.client-id` (a cloned VM or a shared config file). Delete `<varDir>/<instance>/.client-id` on one of them and restart it, or set a distinct `clientId`.'],
-      ['Name already in use (`409`)', 'Another live Client holds that name. Rename one of them in its config or from the resource card. A name held by an `OUT_OF_SERVICE` resource is reclaimed automatically.'],
-      ['The job is rejected with `422`', 'No registered Client can ever match its type, labels, group or client. Compare `thub resources` with your `--type` and `--board`/`--label`; your group (set on the dashboard, see `thub whoami`) must have a Client of that kind.'],
+      ['A Client doesn\'t appear on Runners', 'Check `journalctl -u thub-client@<instance> -f`. A `503` at registration means the Coordinator has no `clientJoinKey`; a `401` means the `joinKey` differs. Also check that `coordinatorUrl` is reachable from the lab (`curl -sI <url>/login`).'],
+      ['A Client flaps or two machines show as one runner', 'Both use the same `.client-id` (a cloned VM or a shared config file). Delete `<varDir>/<instance>/.client-id` on one of them and restart it, or set a distinct `clientId`.'],
+      ['Name already in use (`409`)', 'Another live Client holds that name. Rename one of them in its config or from the runner card. A name held by an `OUT_OF_SERVICE` runner is reclaimed automatically.'],
+      ['The job is rejected with `422`', 'No registered Client can ever match its type, labels, group or client. Compare `thub resources` with your `--type` and `--label`s; your group (set on the dashboard, see `thub whoami`) must have a Client of that kind.'],
       ['The job stays `QUEUED`', 'Matching Clients are all `BUSY`, locked (`local`), in `MAINTENANCE` or offline, or the job is pinned with `--client`. It times out after `--timeout`.'],
       ['`ERROR` during prepare', 'The clone, download or DUT image pull failed; the job log names the reason. For git, check the Client user\'s keys and `known_hosts` (`ssh -T git@<host>` as that user). For images, check the Client user\'s `docker login`.'],
       ['Permission denied on `/dev/ttyUSB*` or `docker.sock`', 'Docker or the device groups were added after the Client was installed. Re-run `sudo npm i -g @andrian.yablonskyy/thub-client` so the unit gets the `dialout`/`plugdev`/`docker` groups, then restart.'],
@@ -14,11 +14,11 @@
       ['Job `LOST`', 'The Client missed 3 heartbeats (network, reboot, crash). With `requeueOnLost` the job is retried once on another Client.'],
       ['A job can\'t write to `~` (read-only file system)', 'Under systemd the Client can only write to its state directory. Write to `$THUB_WORK_DIR`, and set `DOCKER_CONFIG` there for `docker login`.'],
       ['Live logs don\'t stream through the proxy', 'Turn off response buffering for the Coordinator (nginx: `proxy_buffering off;`, Caddy: `flush_interval -1`).'],
-      ['Finding a job, resource, group or agent', 'Use the search box on its list page (press `/` to jump to it). Every word must match, e.g. `lab-hw-01 FAILED` or a git ref. Job search covers ids, users, resources, agents, commands, repos and `--meta`, but not `--env` values (secrets). On a job page, search the log above the log viewer: `Enter`/`Shift+Enter` step through matches.'],
+      ['Finding a job, runner, group or agent', 'Use the search box on its list page (press `/` to jump to it). Every word must match, e.g. `lab-hw-01 FAILED` or a git ref. Job search covers ids, users, runners, agents, commands, repos and `--meta`, but not `--env` values (secrets). On a job page, search the log above the log viewer: `Enter`/`Shift+Enter` step through matches.'],
       ['Lists don\'t update by themselves (navbar shows Offline or Paused)', '`Paused`: you\'re editing something on the page (a field, the inline rename, a dialog); it resumes when you\'re done. `Offline`: the browser can\'t hold the `/live` stream open, often a proxy buffering it (nginx: `proxy_buffering off;`); reloading the page always shows current data. `Session ended`: sign in again. Background updates never extend the session\'s idle timeout.'],
       ['Sign-in says it needs HTTPS', 'The session cookie is HTTPS-only because `publicUrl` is `https://`, but the request arrived as plain HTTP. Open the dashboard through its https:// address; behind a reverse proxy, make it send `X-Forwarded-Proto: https` (nginx: `proxy_set_header X-Forwarded-Proto $scheme;`) and check `trustProxy`. To allow plain HTTP, set `session.secureCookie` to `false`.'],
       ['Where are a job\'s test reports and output files?', 'The Coordinator keeps only the log and the result (verdict, exit code, JUnit test counts). Files the job creates stay in its workspace on the Client and are deleted when the job ends. To keep them, publish them from `--command`, e.g. `curl -fsS -H "Authorization: Bearer $ART_TOKEN" -T results/report.xml "https://artifactory.example.com/qa/$THUB_JOB_ID/report.xml"` with `--env ART_TOKEN`. To show them on the job page and in `thub status`, list them in `$THUB_ARTIFACTS_FILE` as `[{"name", "size", "link", "timestamp"}]` — only that metadata is kept. The full log is always available from the job page\'s Raw button.'],
-      ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
+      ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or runner token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
       ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
       ['Agent says “Invalid or revoked access key” or “… is blocked”', 'The key was replaced (`thub key rotate`, an admin, your profile) or revoked, or your user is blocked. Ask an admin for a new key (Users), or create one on your profile if you can sign in. Then `thub config set key <key>`; `thub whoami` checks it.'],
       ['The Coordinator won\'t start after an upgrade: `SqliteError: disk I/O error` (`SQLITE_IOERR_GETTEMPPATH`)', 'Its systemd unit is older than 1.1.1: it has `ProtectSystem=strict` without `PrivateTmp=yes`, so SQLite has no writable temp directory for a large migration. The migration rolls back, so no data is lost. Install the latest version with `sudo npm i -g @andrian.yablonskyy/thub-coordinator` (the dashboard can\'t update a Coordinator that\'s down), or run `sudo systemctl edit thub-coordinator`, add `[Service]` and `PrivateTmp=yes`, then `sudo systemctl restart thub-coordinator`.'],

package/views/index.pug

@@ -21,7 +21,7 @@ block content
     .col-md-4
       .card
         .card-body
-          h6.card-subtitle.mb-2.text-body-secondary Resources online
+          h6.card-subtitle.mb-2.text-body-secondary Runners online
           p.display-6= `${onlineCount} / ${resources.length}`
 
   .row.g-3(data-live="overview-cards")

package/views/jobs/list.pug

@@ -13,7 +13,7 @@ block content
 
   form.row.g-2.mb-3(method="get" role="search")
     .col-12.col-md-5.col-lg-4
-      +searchBox(filters.q, 'Search jobs: id, user, resource, command, repo…', list.urlFor({ q: '' }))
+      +searchBox(filters.q, 'Search jobs: id, user, runner, command, repo…', list.urlFor({ q: '' }))
     .col-auto
       select.form-select.form-select-sm(name="state" data-autosubmit)
         option(value="") any state
@@ -37,7 +37,7 @@ block content
         +sortHeader(list, 'source', 'Source')
         +sortHeader(list, 'user', 'User')
         +sortHeader(list, 'state', 'State')
-        +sortHeader(list, 'resource', 'Resource')
+        +sortHeader(list, 'resource', 'Runner')
         +sortHeader(list, 'created', 'Created', 'desc')
         +sortHeader(list, 'duration', 'Duration', 'desc')
         if canManage
@@ -132,7 +132,7 @@ block content
             data-value=preset.value
           )= preset.label
       p
-        | Deletes finished jobs that ended before then, with their logs, and the resource, agent and group history logged before then — then compacts the database file.
+        | Deletes finished jobs that ended before then, with their logs, and the runner, agent and group history logged before then — then compacts the database file.
         |
         strong This cannot be undone.
         |  Active jobs are never touched.

package/views/jobs/show.pug

@@ -29,7 +29,7 @@ block content
     if job.spec.user
       dt.col-sm-2 User
       dd.col-sm-10= job.spec.user
-    dt.col-sm-2 Resource
+    dt.col-sm-2 Runner
     dd.col-sm-10= job.resource ? job.resource.name : job.resource_name ? `${job.resource_name} (removed)` : '—'
     dt.col-sm-2 Target
     dd.col-sm-10= `${job.spec.target.type} — ${(job.spec.target.labels || []).join(', ')}`

package/views/layout.pug

@@ -53,7 +53,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
-          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task'], ['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key']].concat(user.role === 'admin' ? [['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
+          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/runners', 'resources', 'Runners', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task'], ['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key']].concat(user.role === 'admin' ? [['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
           ul.navbar-nav.me-auto.thub-nav-pages
             each pg in pages
               li.nav-item
@@ -88,7 +88,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                     aria-label="Check for updates"
                     data-bs-toggle="tooltip"
                     data-bs-placement="bottom"
-                    data-bs-title=updates.checkedAt ? `Check for updates now — the Coordinator and connected resources (last checked ${fmtDate(updates.checkedAt)})` : 'Check for updates now — the Coordinator and connected resources'
+                    data-bs-title=updates.checkedAt ? `Check for updates now — the Coordinator and connected runners (last checked ${fmtDate(updates.checkedAt)})` : 'Check for updates now — the Coordinator and connected runners'
                   )
                     i.bi.bi-arrow-repeat
             if user && can.admin && updates.coordinatorUpdate

package/views/mixins/client-config.pug

@@ -96,9 +96,56 @@ mixin configTabItems(r)
   if r.type === 'hw'
     each t in [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB']]
       +configTab(p, t[0], t[1])
+  +configTab(p, 'labels', 'Labels')
   +configTab(p, 'groups', 'Groups')
   +configTab(p, 'reboot', 'Reboot')
 
+//- Labels tab: what a job's --label / --label board:must find on this Client,
+//- one per line. Saved like the Groups tab (registry.setClientLabels): in
+//- effect on the Coordinator at once, written to the config file's
+//- `labels` by the Client.
+mixin labelsPane(r, returnTo)
+  - const p = `cfg-${r.id}`
+  - const canEdit = can.operate && r.config_support === 'file'
+  - const pending = r.config_import && r.config_import.revision > r.config_applied_revision && r.config_import.fields && r.config_import.fields.labels
+  +configPane(p, 'labels')
+    if pending || r.config_error
+      .d-flex.justify-content-end.gap-1.mb-2
+        if pending
+          span.badge.text-bg-warning(
+            data-bs-toggle="tooltip"
+            data-bs-title="In effect on the Coordinator; the Client writes them to its config file on its next heartbeat, then restarts once idle"
+          ) not written to the Client yet
+        if r.config_error
+          span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=r.config_error) refused by the Client
+    if r.config_support !== 'file'
+      p.small.text-body-secondary Labels can't be set here: #{noConfigReport} Or set #[code labels] in its config file.
+    form(
+      method="post"
+      action=`/runners/${r.id}/labels`
+      data-confirm=`Save the labels of ${r.name}? They apply at once; the Client also writes them to its config file and restarts once it has no job running.`
+      data-confirm-title="Save runner labels?"
+      data-confirm-ok="Save"
+      data-confirm-tone="primary"
+    )
+      input(type="hidden" name="returnTo" value=returnTo)
+      fieldset(disabled=!canEdit)
+        label.form-label.small(for=`${p}-labels-input`) One label per line
+        textarea.form-control.font-monospace(
+          id=`${p}-labels-input`
+          name="labels"
+          rows="6"
+          spellcheck="false"
+          autocapitalize="off"
+          placeholder="board:nucleo-f401re\nuart\nstlink"
+        )= r.labels.join('\n')
+        .form-text
+          | A job runs here only if this runner has every label it asks for (#[code thub run --label uart --label board:nucleo-f401re]).
+          | Each up to 64 characters, no spaces, commas or semicolons; up to 64 labels.
+        if canEdit
+          .d-flex.justify-content-end.mt-3
+            button.btn.btn-sm.btn-primary(type="submit" data-bs-toggle="tooltip" data-bs-title="Save the labels — in effect at once; the Client writes them to its config file") Save labels
+
 //- Groups tab: which resource groups this Client belongs to (thub run
 //- --group). Saved as a config revision the Client writes to its config
 //- file's `groups` (registry.setClientGroups); in effect on the Coordinator
@@ -129,7 +176,7 @@ mixin groupsPane(r, returnTo, groupsById)
     else
       form(
         method="post"
-        action=`/resources/${r.id}/groups`
+        action=`/runners/${r.id}/groups`
         data-confirm=`Save the groups of ${r.name}? They apply at once; the Client also writes them to its config file and restarts once it has no job running.`
         data-confirm-title="Save Client groups?"
         data-confirm-ok="Save"
@@ -173,7 +220,7 @@ mixin configPanes(r, returnTo, groupsById)
   else
     form(
       method="post"
-      action=`/resources/${r.id}/config`
+      action=`/runners/${r.id}/config`
       data-client-config="hw"
       data-confirm=`Apply these devices to ${r.name}? The Client writes them to its config file on its next heartbeat and restarts once it has no job running.`
       data-confirm-title="Save Client devices?"
@@ -198,6 +245,7 @@ mixin configPanes(r, returnTo, groupsById)
           +deviceTable('usbs', 'DUT USB devices', current.usbs || [], ['Device', 'udev devpath'])
           .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-usb) or a /dev path. udev devpath: the USB port it's plugged into.
           +saveCapabilities(canEdit)
+  +labelsPane(r, returnTo)
   +groupsPane(r, returnTo, groupsById || {})
   +configPane(p, 'reboot')
     dl.row.mb-0

package/views/mixins/group-select.pug

@@ -3,7 +3,7 @@
 //- --group. Groups by name; none = any resource.
 mixin groupSelect(id, selected, groups)
   select.form-select(id=id name="groupId")
-    option(value="" selected=!selected) Any resource (no group)
+    option(value="" selected=!selected) Any runner (no group)
     each g in groups
       option(value=g.id selected=g.id === selected)= g.name
-  .form-text Its jobs run only on resources in this group. Manage groups on #[a(href="/groups") Groups].
+  .form-text Its jobs run only on runners in this group. Manage groups on #[a(href="/groups") Groups].