@andrian.yablonskyy/thub-coordinator 1.1.9 → 1.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.9",
+  "version": "1.1.11",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/public/css/thub.css

@@ -56,7 +56,7 @@
 }
 
 .resource-capabilities {
-  font-size: 0.75rem;
+  font-size: 0.875rem;
 }
 
 /* An overlay inside a modal (e.g. "Import to config"'s review note on the

package/src/services/jobs.js

@@ -14,6 +14,7 @@
 'use strict';
 
 const { validateJobSpec, maskEnv, JOB_STATES, ACTIVE_JOB_STATES, TERMINAL_JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common'),
+  { LABEL_RE, LABEL_RULE } = require('./registry'),
   { paginate } = require('./list-prefs'),
   { parseTerms, likeClause } = require('./search'),
   { sanitizeArtifacts } = require('./job-artifacts'),
@@ -165,6 +166,12 @@ function createJobsService(db, { bus, events, registry, config }){
     if (!valid){
       throw Object.assign(new Error(`Invalid job spec (${VERSIONS}): ${errors.join('; ')}`), { status: 400 });
     }
+    // A label no runner could have (the Labels tab's rule): say so, rather
+    // than "no runner can ever satisfy" it.
+    const badLabels = (spec.target.labels || []).filter((l) => !LABEL_RE.test(l));
+    if (badLabels.length){
+      throw Object.assign(new Error(`Invalid label: ${badLabels.join(', ')} — ${LABEL_RULE}`), { status: 400 });
+    }
     spec.source = source;
     // The group is the agent's, set on the dashboard (§13.1) — whatever an
     // older Agent sent as `target.group` is replaced.

package/src/services/list-prefs.js

@@ -32,7 +32,7 @@ const PAGE_SIZES = [10, 25, 50, 100, 'all'],
       defaults: { size: DEFAULT_PAGE_SIZE, sort: 'name', dir: 'asc' }
     },
     agents: {
-      sorts: ['name', 'kind', 'group', 'version', 'created', 'used', 'status'],
+      sorts: ['name', 'group', 'version', 'created', 'used', 'status'],
       defaults: { size: DEFAULT_PAGE_SIZE, sort: 'created', dir: 'desc' }
     },
     users: {

package/src/services/registry.js

@@ -18,8 +18,14 @@ const { v4: uuid } = require('uuid'),
     shareableClientConfigFile, HW_DEVICES_SECTION } = require('@andrian.yablonskyy/thub-common'),
   { generateToken, hashToken } = require('./tokens');
 
-// Never kept from or put in a Client's config file: its credentials.
-const CONFIG_FILE_SECRETS = ['joinKey'],
+// A label (a runner's, on the Labels tab; a job's, --label): 1–64
+// characters, no whitespace, commas or semicolons — JOB_LABEL joins them
+// with commas, and a label is one line on the dashboard.
+const LABEL_RE = /^[^\s,;]{1,64}$/,
+  LABEL_RULE = '1–64 characters, no spaces, commas or semicolons',
+
+  // Never kept from or put in a Client's config file: its credentials.
+  CONFIG_FILE_SECRETS = ['joinKey'],
   // The first Client that applies a whole config file (an Import's other
   // fields, the Groups tab), not only its hw-devices section.
   CONFIG_FILE_CLIENT = '1.0.30';
@@ -796,6 +802,38 @@ function createRegistryService(db, { bus, events }){
     return get(resourceId);
   }
 
+  // Labels tab (runner card): the labels a job's --label / --label board:must
+  // find on this Client. Like the Groups tab: they belong to its config
+  // file (`labels`, which every registration reports), so they go out as
+  // its next config revision, and the Coordinator applies them at once.
+  // Each label: see LABEL_RE (top); at most 64 of them.
+  function setClientLabels(resourceId, labels, { by } = {}){
+    const r = get(resourceId);
+    if (!r){
+      throw Object.assign(new Error('Unknown resource'), { status: 404 });
+    }
+    const list = [...new Set(labels.map((l) => String(l).trim()).filter(Boolean))],
+      bad = list.filter((l) => !LABEL_RE.test(l));
+    if (bad.length){
+      throw Object.assign(new Error(`Invalid label: ${bad.join(', ')} — ${LABEL_RULE}`), { status: 400 });
+    }
+    if (list.length > 64){
+      throw Object.assign(new Error('At most 64 labels'), { status: 400 });
+    }
+    const desired = currentSection(r);
+    if (!desired || r.config_support !== 'file'){
+      throw Object.assign(new Error(`${r.name} is too old to take its labels from the dashboard — update its Client first`), { status: 409 });
+    }
+    const revision = r.config_revision + 1,
+      fields = { ...(pendingImport(r) || {}), labels: list };
+    db.transaction(() => {
+      db.prepare(`UPDATE resources SET config_desired = ?, config_revision = ?, config_error = NULL, config_import = ?, labels = ?
+                  WHERE id = ?`).run(JSON.stringify(desired), revision, JSON.stringify({ revision, fields }), JSON.stringify(list), resourceId);
+    })();
+    events.record('resource', resourceId, 'resource.labels_set', { by, revision, labels: list });
+    return get(resourceId);
+  }
+
   // Export (resource card): the Client's config file as it last reported it
   // (secrets excluded), with what's saved for it but not applied yet — so
   // exporting right after an edit or import gives what the Client will run.
@@ -878,6 +916,7 @@ function createRegistryService(db, { bus, events }){
   return {
     get,
     reportClientConfig,
+    setClientLabels,
     getByName,
     getByClientId,
     getByTokenHash,
@@ -912,4 +951,4 @@ function createRegistryService(db, { bus, events }){
   };
 }
 
-module.exports = { createRegistryService };
+module.exports = { LABEL_RE, LABEL_RULE, createRegistryService };

package/src/web/routes.js

@@ -52,7 +52,6 @@ const STARTED_AT = new Date().toISOString(),
   // Agents page (list-prefs `agents`): never-used / never-reported last.
   AGENT_SORT_VALUE = {
     name: (a) => a.name,
-    kind: (a) => a.kind,
     version: (a) => a.version,
     created: (a) => a.created_at,
     used: (a) => a.last_used_at,
@@ -687,6 +686,21 @@ function createWebRouter({ services, config }){
 
   // Groups tab (resource card): the Client's group membership, as a config
   // revision the Client writes to its file (registry.setClientGroups).
+  // Labels tab (runner card): one label per line.
+  router.post('/runners/:id/labels', (req, res) => {
+    try {
+      // One per line: a comma or semicolon is in a label (and refused), not a separator.
+      const labels = String(req.body.labels || '').split(/\r?\n/),
+        r = services.registry.setClientLabels(req.params.id, labels, { by: req.session.user.username });
+      flash(req, 'success', `Labels of ${r.name} saved: ${r.labels.length ? r.labels.join(', ') : 'none'} — in effect now.\n` +
+        'The Client writes them to its config file on its next heartbeat, then restarts once it has no job running.');
+    }
+    catch (err){
+      flash(req, 'danger', err.message);
+    }
+    res.redirect(returnTo(req, '/runners'));
+  });
+
   router.post('/runners/:id/groups', (req, res) => {
     try {
       const ids = [].concat(req.body.groups || []).filter((g) => typeof g === 'string' && g),
@@ -1095,7 +1109,7 @@ function createWebRouter({ services, config }){
       // CI tokens only: a person's key belongs to their user (Users, §10.3).
       sorted = services.agents.list()
         .filter((a) => !a.user_id)
-        .filter((a) => search.matches([a.name, a.kind, a.version, groupName(a), a.revoked_at ? 'revoked' : 'active'], terms))
+        .filter((a) => search.matches([a.name, a.version, groupName(a), a.revoked_at ? 'revoked' : 'active'], terms))
         .sort((a, b) => {
           const va = value(a),
             vb = value(b);

package/test/groups-tab.test.js

@@ -289,3 +289,72 @@ test('Resources renamed Runners: the page is /runners; old /resources links and
   assert.match(html, /href="\/runners"[^>]*>(<i [^>]*><\/i>)?Runners</);
   assert.doesNotMatch(html.replace(/<[^>]*>/g, ' '), /\bResources?\b/); // no visible "Resource(s)" left on the page
 });
+
+test('Labels tab: in effect at once, sent to the Client as its next config revision; validated', async (t) => {
+  const { base, services, admin } = await start(t),
+    id = register(services, 'lab-sw-30'),
+    save = (labels) => fetch(`${base}/runners/${id}/labels`, {
+      method: 'POST', headers: { cookie: admin }, body: new URLSearchParams({ labels, returnTo: '/runners' }), redirect: 'manual'
+    }),
+    card = async () => {
+      const html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text();
+      return html.slice(html.indexOf(`id="resource-card-${id}"`));
+    };
+  assert.match(await card(), new RegExp(`id="cfg-${id}-labels-tab"`)); // the tab
+
+  await save('board:nucleo-f401re\nuart\n\nuart\n');
+  const r = services.registry.get(id);
+  assert.deepEqual(r.labels, ['board:nucleo-f401re', 'uart']); // trimmed, deduplicated, at once
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:nucleo-f401re', 'uart'] });
+  assert.match(await card(), /not written to the Client yet/);
+  assert.match(await card(), />board:nucleo-f401re\nuart<\/textarea>/);
+
+  // Scheduling follows at once: a job asking for them can run here.
+  services.registry.heartbeat(id, { state: 'IDLE' });
+  const { agent } = services.agents.create({ name: 'ci', kind: 'ci' }),
+    spec = { target: { type: 'sw', labels: ['uart', 'board:nucleo-f401re'] }, command: './t' };
+  assert.ok(services.jobs.create({ agentId: agent.id, source: 'ci', spec }));
+
+  // A groups save meanwhile keeps the labels in the same revision.
+  services.registry.setClientGroups(id, [], { by: 'admin' });
+  assert.deepEqual(services.registry.pendingConfig(id).file, { labels: ['board:nucleo-f401re', 'uart'], groups: [] });
+
+  await save('has space');
+  assert.deepEqual(services.registry.get(id).labels, ['board:nucleo-f401re', 'uart']); // refused
+  for (const bad of ['a,b', 'a;b', 'a\tb', 'x'.repeat(65)]){
+    assert.throws(() => services.registry.setClientLabels(id, [bad], { by: 'x' }), /1–64 characters, no spaces, commas or semicolons/, bad);
+  }
+  assert.deepEqual(services.registry.setClientLabels(id, ['x'.repeat(64), 'board:b'], { by: 'x' }).labels, ['x'.repeat(64), 'board:b']);
+  await save('uart, stlink'); // a comma is part of the label (refused), not a separator
+  assert.deepEqual(services.registry.get(id).labels, ['x'.repeat(64), 'board:b']);
+  // One per line in the card's Labels row and the Runners table.
+  const html = await card(),
+    labelsRow = html.slice(html.indexOf('<dt class="col-sm-4">Labels</dt>'));
+  assert.match(labelsRow, /^<dt[^>]*>Labels<\/dt><dd[^>]*><div class="d-flex flex-column[^"]*">/);
+  assert.match(labelsRow, /^[^]*?<span class="badge[^"]*">x{64}<\/span><span class="badge[^"]*">board:b<\/span><\/div>/);
+
+  // A job asking for a label no runner could have: refused, saying why.
+  assert.throws(() => services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw', labels: ['has space'] }, command: './t' } }),
+    /Invalid label: has space — 1–64 characters/);
+
+  const old = register(services, 'lab-old-30', { configFile: null });
+  assert.throws(() => services.registry.setClientLabels(old, ['x'], { by: 'x' }), /too old/);
+});
+
+test('runner card: capabilities have their own tab, next to Details', async (t) => {
+  const { base, services, admin } = await start(t),
+    { resourceId } = services.registry.registerAuto({
+      clientId: 'hw8', name: 'lab-hw-08', type: 'hw', labels: [],
+      capabilities: { hw: { stlinks: [{ index: 1, path: '/dev/thub/dut1-stlink', present: false }], uarts: [], usbs: [] } }
+    }),
+    html = await (await fetch(`${base}/runners`, { headers: { cookie: admin } })).text(),
+    card = html.slice(html.indexOf(`id="resource-card-${resourceId}"`)),
+    details = card.slice(card.indexOf(`id="rc-${resourceId}-details"`), card.indexOf(`id="rc-${resourceId}-caps"`)),
+    caps = card.slice(card.indexOf(`id="rc-${resourceId}-caps"`)),
+    // The tab right after Details.
+    tabs = [...card.slice(0, card.indexOf('</ul>')).matchAll(/<button class="nav-link[^"]*" id="rc-[^"]*-(\w+)-tab"/g)].map((m) => m[1]);
+  assert.deepEqual(tabs.slice(0, 2), ['details', 'caps']);
+  assert.doesNotMatch(details, />Capabilities</); // no longer a Details row
+  assert.match(caps, new RegExp(`^id="rc-${resourceId}-caps"[^>]*data-live="rc-caps-${resourceId}"`)); // updates live
+  assert.match(caps, /\/dev\/thub\/dut1-stlink<\/code><span class="badge text-bg-danger[^"]*"[^>]*>missing/);
+});

package/test/scheduler.test.js

@@ -845,3 +845,15 @@ test('migration 027 drops joinKey copies from stored config files', () => {
   assert.deepEqual(JSON.parse(db.prepare('SELECT client_config_file FROM resources WHERE id = ?').get('a').client_config_file), { name: 'a', labels: [] });
   assert.equal(db.prepare('SELECT client_config_file FROM resources WHERE id = ?').get('b').client_config_file, null);
 });
+
+test('a job runs only on a runner that has every label it asks for', () => {
+  const { registry, agents, jobs, scheduler } = buildTestServices(),
+    { agent } = agents.create({ name: 'ci', kind: 'ci' }),
+    some = registerResource(registry, { name: 'lab-some', type: 'hw', labels: ['board:nucleo', 'uart'] }),
+    all = registerResource(registry, { name: 'lab-all', type: 'hw', labels: ['board:nucleo', 'uart', 'stlink', 'extra'] });
+  registry.heartbeat(some.id, { state: 'idle' });
+  registry.heartbeat(all.id, { state: 'idle' });
+  const job = jobs.create({ agentId: agent.id, source: 'ci', spec: makeSpec({ target: { type: 'hw', labels: ['board:nucleo', 'uart', 'stlink'] } }) });
+  scheduler.runPass();
+  assert.equal(jobs.get(job.id).resource_id, all.id); // lab-some lacks stlink, though it's idle too
+});

package/views/admin/agents.pug

@@ -10,7 +10,7 @@ block content
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
     +updatesToolbar('agent', 'agents', list.pageUrl())
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
-    +searchForm(q, 'Search agents: name, kind, group, version, status', list.urlFor({ q: '' }))
+    +searchForm(q, 'Search CI tokens: name, group, version, status', list.urlFor({ q: '' }))
     .ms-auto
       +pageSizePicker(list)
 
@@ -30,7 +30,6 @@ block content
     thead
       tr
         +sortHeader(list, 'name', 'Name')
-        +sortHeader(list, 'kind', 'Kind')
         +sortHeader(list, 'group', 'Group')
         +sortHeader(list, 'version', 'Version', 'desc')
         +sortHeader(list, 'created', 'Created', 'desc')
@@ -43,7 +42,6 @@ block content
           //- The name opens Edit (name and group).
           td
             a.fw-medium(href=`#editAgentModal-${a.id}` data-bs-toggle="modal" role="button")= a.name
-          td.text-uppercase= a.kind
           td
             if a.group_id && groupsById[a.group_id]
               span.badge.text-bg-info= groupsById[a.group_id].name
@@ -108,7 +106,7 @@ block content
                       button.btn.btn-primary(type="submit") Save
       else
         tr
-          td.text-body-secondary(colspan="8")
+          td.text-body-secondary(colspan="7")
             if q
               | No agent matches “#{q}”. 
               a(href=list.urlFor({ q: '' })) Show all agents

package/views/help/_agent-cli.pug

@@ -19,8 +19,7 @@
     const groups = [
       { title: 'Where to run', rows: [
         ['--type hw|sw', 'Required. Runner type.', '--type hw'],
-        ['--board <name>', 'Shorthand for --label board:<name>.', '--board nucleo-f401re'],
-        ['--label <l>', 'Required label (repeatable). The Client must have all of them.', '--label uart --label stlink'],
+        ['--label <l>', 'Required label (repeatable). The runner must have all of them. 1–64 characters, no spaces, commas or semicolons.', '--label uart --label stlink'],
         ['--client <name|id>', 'Only this Client; waits for it even if others are idle.', '--client lab-hw-01']
       ] },
       { title: 'What to run', rows: [
@@ -73,13 +72,13 @@
 
   h3.h6 Examples
   +code('Flash and test a board, fail CI on failure').
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo https://github.com/yourorg/firmware-tests.git v1.4.0 \
       --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/test.sh "$@"' \
       --arg --junit --timeout 45m --wait
   +code('Reproduce a failure on the exact bench, labeled with your name').
-    thub run --type hw --board nucleo-f401re --client lab-hw-01 --user "$USER" \
+    thub run --type hw --label board:nucleo-f401re --client lab-hw-01 --user "$USER" \
       --download-file "$IMAGE_URL" --git-repo "$TESTS_REPO" --command ./ci/test.sh
     # Ctrl-C detaches; the job keeps running. Re-attach:
     thub status M-00126

package/views/help/_ci.pug

@@ -31,7 +31,7 @@
         steps:
           - run: |
               npx -y @andrian.yablonskyy/thub-agent run \
-                --type hw --board nucleo-f401re \
+                --type hw --label board:nucleo-f401re \
                 --download-file "${{ needs.build.outputs.image_url }}" \
                 --git-repo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" "$GITHUB_SHA" \
                 --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/hw-tests.sh' \

package/views/help/_client-machines.pug

@@ -47,10 +47,10 @@
       +code('HW machine').
         sudo systemctl restart thub-client@client
         ls -l /dev/thub/
-    li Check the runner card's #[strong Capabilities]: each configured device must be present (a missing one is flagged).
+    li Check the runner card's #[strong Capabilities] tab: each configured device must be present (a missing one is flagged).
     li Your job's #[code --command] flashes the board. The Client never flashes by itself; it passes the ST-Link serials and the downloaded files in the environment (#[a(href="#env") Environment variables]).
   +code('A typical HW job').
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo https://github.com/yourorg/firmware-tests.git v1.4.0 \
       --command 'st-flash --serial "$THUB_DUT_STLINK" --reset write "$THUB_DOWNLOAD_1" 0x08000000 && ./ci/test.sh' \

package/views/help/_client-setup.pug

@@ -78,7 +78,7 @@
         tr
           td: code labels
           td No
-          td Matched against a job's #[code --board]/#[code --label]. Use #[code board:<name>] for the board.
+          td Matched against a job's #[code --label]s. Use #[code board:<name>] for the board (#[code --label board:<name>]). Also set on its runner card (Labels tab), which writes them here.
         tr
           td: code groups
           td No

package/views/help/_docker.pug

@@ -121,4 +121,4 @@
         td Files written to #[code /work] stay owned by the Client user, so the workspace can be cleaned up.
   +note('info').
     Docker access is effectively root access on that host. The Client host must have Docker and the service user must be in the
-    #[code docker] group. The runner card's #[strong Capabilities] show whether a Client can use Docker, and why not.
+    #[code docker] group. The runner card's #[strong Capabilities] tab shows whether a Client can use Docker, and why not.

package/views/help/_env.pug

@@ -35,8 +35,7 @@
   -
     const jobVars = [
       ['JOB_TYPE', '--type', 'hw or sw'],
-      ['JOB_BOARD', '--board', 'the board name'],
-      ['JOB_LABEL / JOB_LABEL_<n>', '--board, --label', 'all labels, comma-separated / each'],
+      ['JOB_LABEL / JOB_LABEL_<n>', '--label', 'all labels, comma-separated / each'],
       ['JOB_GROUP', '(dashboard)', 'the submitting agent\'s group, if it has one'],
       ['JOB_CLIENT', '--client', 'this Client\'s name'],
       ['JOB_USER', '--user', 'as given'],
@@ -118,7 +117,7 @@
       python:3.14 ./run-tests.sh
   +code('Submitting the job that feeds these').
     export API_TOKEN=…
-    thub run --type hw --board nucleo-f401re \
+    thub run --type hw --label board:nucleo-f401re \
       --download-file https://artifactory.example.com/fw-local/app/1.4.0-42/app.bin \
       --git-repo git@github.com:yourorg/firmware-tests.git main \
       --env TARGET=production --env API_TOKEN \

package/views/help/_troubleshooting.pug

@@ -6,7 +6,7 @@
       ['A Client doesn\'t appear on Runners', 'Check `journalctl -u thub-client@<instance> -f`. A `503` at registration means the Coordinator has no `clientJoinKey`; a `401` means the `joinKey` differs. Also check that `coordinatorUrl` is reachable from the lab (`curl -sI <url>/login`).'],
       ['A Client flaps or two machines show as one runner', 'Both use the same `.client-id` (a cloned VM or a shared config file). Delete `<varDir>/<instance>/.client-id` on one of them and restart it, or set a distinct `clientId`.'],
       ['Name already in use (`409`)', 'Another live Client holds that name. Rename one of them in its config or from the runner card. A name held by an `OUT_OF_SERVICE` runner is reclaimed automatically.'],
-      ['The job is rejected with `422`', 'No registered Client can ever match its type, labels, group or client. Compare `thub resources` with your `--type` and `--board`/`--label`; your group (set on the dashboard, see `thub whoami`) must have a Client of that kind.'],
+      ['The job is rejected with `422`', 'No registered Client can ever match its type, labels, group or client. Compare `thub resources` with your `--type` and `--label`s; your group (set on the dashboard, see `thub whoami`) must have a Client of that kind.'],
       ['The job stays `QUEUED`', 'Matching Clients are all `BUSY`, locked (`local`), in `MAINTENANCE` or offline, or the job is pinned with `--client`. It times out after `--timeout`.'],
       ['`ERROR` during prepare', 'The clone, download or DUT image pull failed; the job log names the reason. For git, check the Client user\'s keys and `known_hosts` (`ssh -T git@<host>` as that user). For images, check the Client user\'s `docker login`.'],
       ['Permission denied on `/dev/ttyUSB*` or `docker.sock`', 'Docker or the device groups were added after the Client was installed. Re-run `sudo npm i -g @andrian.yablonskyy/thub-client` so the unit gets the `dialout`/`plugdev`/`docker` groups, then restart.'],

package/views/mixins/client-config.pug

@@ -96,9 +96,56 @@ mixin configTabItems(r)
   if r.type === 'hw'
     each t in [['stlinks', 'ST-Link'], ['uarts', 'UART'], ['usbs', 'DUT USB']]
       +configTab(p, t[0], t[1])
+  +configTab(p, 'labels', 'Labels')
   +configTab(p, 'groups', 'Groups')
   +configTab(p, 'reboot', 'Reboot')
 
+//- Labels tab: what a job's --label / --label board:must find on this Client,
+//- one per line. Saved like the Groups tab (registry.setClientLabels): in
+//- effect on the Coordinator at once, written to the config file's
+//- `labels` by the Client.
+mixin labelsPane(r, returnTo)
+  - const p = `cfg-${r.id}`
+  - const canEdit = can.operate && r.config_support === 'file'
+  - const pending = r.config_import && r.config_import.revision > r.config_applied_revision && r.config_import.fields && r.config_import.fields.labels
+  +configPane(p, 'labels')
+    if pending || r.config_error
+      .d-flex.justify-content-end.gap-1.mb-2
+        if pending
+          span.badge.text-bg-warning(
+            data-bs-toggle="tooltip"
+            data-bs-title="In effect on the Coordinator; the Client writes them to its config file on its next heartbeat, then restarts once idle"
+          ) not written to the Client yet
+        if r.config_error
+          span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=r.config_error) refused by the Client
+    if r.config_support !== 'file'
+      p.small.text-body-secondary Labels can't be set here: #{noConfigReport} Or set #[code labels] in its config file.
+    form(
+      method="post"
+      action=`/runners/${r.id}/labels`
+      data-confirm=`Save the labels of ${r.name}? They apply at once; the Client also writes them to its config file and restarts once it has no job running.`
+      data-confirm-title="Save runner labels?"
+      data-confirm-ok="Save"
+      data-confirm-tone="primary"
+    )
+      input(type="hidden" name="returnTo" value=returnTo)
+      fieldset(disabled=!canEdit)
+        label.form-label.small(for=`${p}-labels-input`) One label per line
+        textarea.form-control.font-monospace(
+          id=`${p}-labels-input`
+          name="labels"
+          rows="6"
+          spellcheck="false"
+          autocapitalize="off"
+          placeholder="board:nucleo-f401re\nuart\nstlink"
+        )= r.labels.join('\n')
+        .form-text
+          | A job runs here only if this runner has every label it asks for (#[code thub run --label uart --label board:nucleo-f401re]).
+          | Each up to 64 characters, no spaces, commas or semicolons; up to 64 labels.
+        if canEdit
+          .d-flex.justify-content-end.mt-3
+            button.btn.btn-sm.btn-primary(type="submit" data-bs-toggle="tooltip" data-bs-title="Save the labels — in effect at once; the Client writes them to its config file") Save labels
+
 //- Groups tab: which resource groups this Client belongs to (thub run
 //- --group). Saved as a config revision the Client writes to its config
 //- file's `groups` (registry.setClientGroups); in effect on the Coordinator
@@ -198,6 +245,7 @@ mixin configPanes(r, returnTo, groupsById)
           +deviceTable('usbs', 'DUT USB devices', current.usbs || [], ['Device', 'udev devpath'])
           .form-text Device: a udev index 1–8 (→ /dev/thub/dut<N>-usb) or a /dev path. udev devpath: the USB port it's plugged into.
           +saveCapabilities(canEdit)
+  +labelsPane(r, returnTo)
   +groupsPane(r, returnTo, groupsById || {})
   +configPane(p, 'reboot')
     dl.row.mb-0

package/views/mixins/resource.pug

@@ -298,8 +298,9 @@ mixin resourceCard(r, groupsById, returnTo)
         //- data-config-root: where public/js/client-config.js tracks unsaved
         //- changes (⚠ on the config tabs).
         .modal-body.pt-2(data-config-root)
-          //- Details: what the Client is and reports. Then its config tabs
-          //- (client-config.pug; read-only for viewers), then its USB devices.
+          //- Details: what the Client is and reports; Capabilities: what it can
+          //- drive. Then its config tabs (client-config.pug; read-only for
+          //- viewers), then its USB devices.
           ul.nav.nav-tabs.mb-3(role="tablist")
             li.nav-item(role="presentation")
               button.nav-link.active(
@@ -311,6 +312,16 @@ mixin resourceCard(r, groupsById, returnTo)
                 aria-controls=`rc-${r.id}-details`
                 aria-selected="true"
               ) Details
+            li.nav-item(role="presentation")
+              button.nav-link(
+                id=`rc-${r.id}-caps-tab`
+                type="button"
+                role="tab"
+                data-bs-toggle="tab"
+                data-bs-target=`#rc-${r.id}-caps`
+                aria-controls=`rc-${r.id}-caps`
+                aria-selected="false"
+              ) Capabilities
             +configTabItems(r)
             li.nav-item(role="presentation")
               button.nav-link(
@@ -326,6 +337,11 @@ mixin resourceCard(r, groupsById, returnTo)
           .tab-content
             .tab-pane.fade.show.active(id=`rc-${r.id}-details` role="tabpanel" aria-labelledby=`rc-${r.id}-details-tab` tabindex="0" data-live=`rc-details-${r.id}`)
               +resourceDetails(r, groupsById, returnTo, local, external)
+            //- Live too: a Client that restarts reports them again.
+            .tab-pane.fade(id=`rc-${r.id}-caps` role="tabpanel" aria-labelledby=`rc-${r.id}-caps-tab` tabindex="0" data-live=`rc-caps-${r.id}`)
+              p.small.text-body-secondary.mb-2 What the Client reported it can drive at its last start, checked against its host.
+              .resource-capabilities
+                +capabilitiesList(r.capabilities)
             +configPanes(r, returnTo, groupsById)
             .tab-pane.fade.thub-usb-pane(id=`rc-${r.id}-usb` role="tabpanel" aria-labelledby=`rc-${r.id}-usb-tab` tabindex="0")
               +usbScanPane(r)
@@ -496,14 +512,13 @@ mixin resourceDetails(r, groupsById, returnTo, local, external)
               data-bs-toggle="tooltip"
               data-bs-title="The address the Coordinator last saw this Client connect from"
             ) external
-    dt.col-sm-4 Capabilities
-    dd.col-sm-8.resource-capabilities
-      +capabilitiesList(r.capabilities)
     dt.col-sm-4 Labels
     dd.col-sm-8
       if r.labels.length
-        each l in r.labels
-          span.badge.text-bg-light.border.me-1= l
+        //- One label per line, as on the Labels tab.
+        .d-flex.flex-column.align-items-start.gap-1
+          each l in r.labels
+            span.badge.text-bg-light.border.font-monospace= l
       else
         span.text-body-secondary —
     dt.col-sm-4 Busy source / reason

package/views/resources/list.pug

@@ -39,9 +39,12 @@ block content
           td.text-uppercase= r.type
           td: +versionWithUpdate(r.client_version, updates.latest.client, r.update_to, `/runners/${r.id}/update`, list.pageUrl(), true, r.activity && r.activity.state === 'update-hold')
           td: +resourceBadge(r.status, r.remove_requested_at)
+          //- One label per line.
           td
-            each l in r.labels
-              span.badge.text-bg-light.border.me-1= l
+            if r.labels.length
+              .d-flex.flex-column.align-items-start.gap-1
+                each l in r.labels
+                  span.badge.text-bg-light.border.font-monospace= l
           td
             if r.group_ids.length
               each gid in r.group_ids