samagotchi 0.122.0 → 0.124.0

data/lib/samagotchi/web/public/update_notice.js

@@ -6,6 +6,17 @@
 // changes).
 
 const known = (v) => typeof v === "string" && v !== "";
+const has = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+
+// Merge partial chi frames without treating an omitted field as a cleared value.
+export function mergeVersionState(current = {}, frame = {}) {
+  const next = { ...current };
+  if (known(frame.version)) next.served = frame.version;
+  if (has(frame, "installed")) next.installed = known(frame.installed) ? frame.installed : null;
+  if (has(frame, "available")) next.available = known(frame.available) ? frame.available : null;
+  if (has(frame, "update_blocked")) next.updateBlocked = known(frame.update_blocked) ? frame.update_blocked : null;
+  return next;
+}
 
 // Gem::Version's order, near enough: segments of digits or letters, a
 // missing one counts as 0, and letters (a prerelease: 0.19.0.pre1) sort
@@ -34,19 +45,37 @@ export function newerVersion(a, b) {
 // The toast for the versions as the page knows them, or null:
 // - loaded ≠ served: chi web restarted on another version; reload the page;
 // - installed newer than served: chi web runs an older chi than installed;
-//   only its terminal can restart it.
+//   restart its workers or chi web;
+// - available newer than served: install it, unless the install is blocked.
 // Each has a key; one in +shown+ (a Set: what this tab already showed, as
 // every reconnect's snapshot says it again) is not shown twice.
 // @return {{key, text, reload: boolean} | null}
-export function versionNotice({ loaded, served, installed, shown = new Set() } = {}) {
+export function versionNotice({ loaded, served, installed, available, updateBlocked, shown = new Set() } = {}) {
   let notice = null;
   if (known(loaded) && known(served) && loaded !== served) {
     notice = { key: `reload:${served}`, text: `chi was updated to ${served}`, reload: true };
   } else if (newerVersion(installed, served)) {
     notice = {
       key: `installed:${installed}`,
-      text: `chi ${installed} is installed; this chi web runs ${served}. ` +
-        "Restart it: Ctrl-C in its terminal, then chi web",
+      text: `chi ${installed} is installed; this chi web runs ${served}.`,
+      actions: ["restartWorkers", "restartWeb"],
+      reload: false,
+    };
+  } else if (newerVersion(available, served)) {
+    const commands = {
+      checkout: ["this chi is running from a checkout", "git pull"],
+      bundler: ["chi update cannot run under Bundler", "bundle update samagotchi"],
+      gem_dir_not_writable: ["the RubyGems directory is not writable", `gem install samagotchi -v ${available}`],
+    };
+    const blocked = commands[updateBlocked];
+    const command = blocked?.[1] || "chi update";
+    notice = {
+      key: `available:${available}`,
+      text: blocked
+        ? `chi ${available} is available (you run ${served}); ${blocked[0]}. Run ${command}.`
+        : `chi ${available} is available (you run ${served}).`,
+      ...(blocked ? { command } : { updateVersion: available }),
+      releaseUrl: `https://rubygems.org/gems/samagotchi/versions/${encodeURIComponent(available)}`,
       reload: false,
     };
   }

data/lib/samagotchi/web/public/update_sheet.js

@@ -0,0 +1,158 @@
+import { html, nothing, render } from "./vendor/lit-html.js";
+
+function installRow(row) {
+  const kept = Array.isArray(row.kept) ? row.kept.map(String) : [];
+  const versions = [row.from, row.to].filter(Boolean).join(" → ");
+  return html`<li class="us-row">
+    <div class="us-row-head"><strong>${row.component || "chi update"}</strong><span>${row.status || "working"}</span></div>
+    ${versions ? html`<div class="us-detail">${versions}</div>` : nothing}
+    ${kept.length ? html`<div class="us-kept"><strong>Kept edited files:</strong><ul>${kept.map((file) => html`<li>${file}</li>`)}</ul></div>` : nothing}
+  </li>`;
+}
+
+function workerRow(row) {
+  const sessionId = String(row.session_id || "unknown");
+  const detail = row.detail || row.reason;
+  const holds = Array.isArray(row.holds) ? row.holds.map((hold) => String(hold).replaceAll("_", " ")).join(", ") : "";
+  const version = row.version ? `chi ${row.version}` : "";
+  return html`<li class="us-row">
+    <div class="us-row-head"><strong title=${sessionId}>${sessionId.slice(0, 8)}</strong>
+      <span>${String(row.state || "working").replaceAll("_", " ")}</span></div>
+    ${version ? html`<div class="us-detail">${version}</div>` : nothing}
+    ${detail ? html`<div class="us-detail">${detail}</div>` : nothing}
+    ${holds ? html`<div class="us-detail">Holds: ${holds}</div>` : nothing}
+  </li>`;
+}
+
+function operationTitle(model) {
+  if (model.operation === "install") return `Update chi${model.version ? ` to ${model.version}` : ""}`;
+  if (model.operation === "workers") return "Restart workers";
+  return "Restart chi web";
+}
+
+// A running operation's last progress line; the end's own words after it
+// (a done frame carries no progress, and the last line would stay).
+function statusText(model) {
+  if (model.error) return model.error;
+  if (model.operation === "web" && model.state === "restarting") return "Waiting for chi web to reconnect…";
+  if (model.operation === "web" && model.state === "done") return `Reconnected${model.version ? ` on chi ${model.version}` : ""}.`;
+  if (model.state === "starting") return "Starting…";
+  if (model.state === "running") return model.progress || (model.operation === "install" ? "Installing…" : "Restarting…");
+  if (model.state === "done") return model.operation === "install" ? "Update complete." : "Worker restart results.";
+  return "Operation failed.";
+}
+
+// Both restarts, once a newer chi is installed (an install done here, or the
+// installed notice's toast) and nothing runs: either result keeps the other in reach.
+function restartActions(model) {
+  const busy = ["starting", "running", "restarting"].includes(model.state);
+  if (!model.restartable || busy) return nothing;
+  return html`<button type="button" class="ghost" data-act="restart-workers">Restart workers</button>
+    <button type="button" class="ghost" data-act="restart-web">Restart chi web</button>`;
+}
+
+export function updateSheetTemplate(model) {
+  const rows = Array.isArray(model.rows) ? model.rows : [];
+  const rowTemplate = model.operation === "workers" ? workerRow : installRow;
+  return html`<header class="us-head">
+    <h2 id="updateSheetTitle">${operationTitle(model)}</h2>
+    <button type="button" class="us-close" data-act="close" aria-label="Close">×</button>
+  </header>
+  <p class="us-status" aria-live="polite">${statusText(model)}</p>
+  ${rows.length ? html`<ol class="us-rows">${rows.map(rowTemplate)}</ol>` : nothing}
+  <footer class="us-foot">${restartActions(model)}<button type="button" class="ghost" data-act="close">Close</button></footer>`;
+}
+
+// The update progress/result sheet; operations continue if it is dismissed.
+export function createUpdateSheet({ dialog, update, restartWorkers, restartWeb }) {
+  let model = null;
+  let requestId = 0;
+  let restartable = false;
+
+  function draw() {
+    if (model) render(updateSheetTemplate({ ...model, restartable }), dialog);
+  }
+
+  function show(next) {
+    model = { ...next, requestId: ++requestId };
+    draw();
+    if (!dialog.open) dialog.showModal();
+  }
+
+  function fail(error, expectedId) {
+    if (!model || model.requestId !== expectedId) return;
+    model = { ...model, state: "failed", error: error?.message || String(error) };
+    draw();
+  }
+
+  function request(action) {
+    const expectedId = model.requestId;
+    Promise.resolve().then(action).catch((error) => fail(error, expectedId));
+  }
+
+  dialog.addEventListener("click", (event) => {
+    const act = event.target.closest?.("[data-act]")?.dataset.act;
+    if (act === "close") dialog.close();
+    else if (act === "restart-workers") openWorkers();
+    else if (act === "restart-web") openWeb();
+  });
+
+  function openInstall(version) {
+    show({ operation: "install", version, state: "starting", rows: [] });
+    request(() => update(version));
+  }
+
+  function openWorkers() {
+    restartable = true;
+    show({ operation: "workers", state: "starting", rows: [] });
+    request(restartWorkers);
+  }
+
+  function openWeb() {
+    restartable = true;
+    show({ operation: "web", state: "restarting", rows: [] });
+    request(restartWeb);
+  }
+
+  function receive(data) {
+    if (!["install", "workers"].includes(data?.operation)) return false;
+    if (model?.operation === "web" && model.state === "restarting") return false;
+    if (!model || (model.operation !== data.operation && ["done", "failed"].includes(model.state))) {
+      model = { operation: data.operation, state: data.state, rows: [], version: data.version };
+    }
+    if (model.operation !== data.operation) return false;
+    model = {
+      ...model,
+      ...data,
+      rows: Array.isArray(data.rows) ? data.rows : [],
+    };
+    if (data.operation === "install" && data.state === "done") restartable = true;
+    draw();
+    return true;
+  }
+
+  function reconnected(version) {
+    if (model?.operation !== "web" || model.state !== "restarting") return false;
+    model = { ...model, state: "done", version };
+    draw();
+    return true;
+  }
+
+  function view() {
+    if (!model) return false;
+    draw();
+    if (!dialog.open) dialog.showModal();
+    return true;
+  }
+
+  return {
+    install: openInstall,
+    restartWorkers: openWorkers,
+    restartWeb: openWeb,
+    receive,
+    reconnected,
+    view,
+    close: () => dialog.close(),
+    isOpen: () => dialog.open,
+  };
+}

data/lib/samagotchi/web/push/notifier.rb

@@ -45,6 +45,8 @@ module Samagotchi
         SHOW_TTL = 12 * 3600
         # A failed or done turn: stale soon, no need to wake the phone.
         EVENT_TTL = 600
+        # A newly available chi is useful for a day while the phone is away.
+        UPDATE_TTL = 24 * 3600
         # A show carries +open+ only while its JSON stays this small: one
         # aes128gcm record leaves 3993 bytes of plaintext under Web Push's
         # 4096 (86 header, 1 delimiter, 16 tag). Longer, it goes without
@@ -96,6 +98,7 @@ module Samagotchi
           # The sink's side (under @mutex): the last summary per session.
           @mutex = Mutex.new
           @by_id = {}
+          @updates_seen = {}
           @seeded = false
           @early = []
           # The sender's side (its thread only, or #pump in a spec).
@@ -185,9 +188,28 @@ module Samagotchi
             prev = @by_id.delete(event.data[:id])
             keys = Attention.closed_keys(prev, nil)
             @queue << Close.new(keys: keys) unless keys.empty?
+          when "chi"
+            notice_update(event)
           end
         end
 
+        def notice_update(event)
+          return unless event.data[:update_notice]
+
+          version = event.data[:available]
+          return unless version.is_a?(String) && !version.empty? && !@updates_seen[version]
+
+          @updates_seen[version] = true
+          attention = Attention::Event.new(reason: "update", session_id: nil, key: "chi:update:#{version}", hold: nil)
+          @queue << Show.new(attention: attention, title: "chi #{version} is available",
+                             body: update_body(event.data[:update_blocked]), at: @now.call, url: "/")
+        end
+
+        # A blocked install (a checkout, Bundler, an unwritable gem dir) names its own command on the page.
+        def update_body(blocked)
+          blocked ? "Open chi web for how to update this install." : "Run chi update to install it."
+        end
+
         # Cards carry no time: they seed as they are.
         def catch_up(summaries)
           sent = nil
@@ -328,8 +350,13 @@ module Samagotchi
         def deliver(subs, payload, show, final: false)
           reason = show.attention.reason
           waiting = Attention.waiting?(reason)
+          ttl = if reason == "update"
+                  UPDATE_TTL
+                else
+                  waiting ? SHOW_TTL : EVENT_TTL
+                end
           subs.map do |sub|
-            result = @client.deliver(sub, payload, ttl: waiting ? SHOW_TTL : EVENT_TTL, urgency: waiting ? "high" : "normal")
+            result = @client.deliver(sub, payload, ttl: ttl, urgency: waiting ? "high" : "normal")
             if result.retry_after && !final
               retry_later(show, sub, result)
               next false

data/lib/samagotchi/web/server.rb

@@ -3,6 +3,7 @@
 require "json"
 require "rack"
 require "rackup/handler/webrick"
+require "rbconfig"
 require "uri"
 require "webrick"
 
@@ -17,12 +18,16 @@ require_relative "qr"
 require_relative "running"
 require_relative "start_dir"
 require_relative "session_hub"
+require_relative "update_check"
 require_relative "token"
 require_relative "tunnel"
 require_relative "../config"
+require_relative "../child_env"
+require_relative "../installed_gem"
 require_relative "../paths"
 require_relative "../project_scope"
 require_relative "../log"
+require_relative "../session_manager"
 require_relative "../version"
 require_relative "../cli/exit"
 
@@ -64,6 +69,8 @@ module Samagotchi
       DEFAULT_HOST = "127.0.0.1"
       # How long `chi web` waits for a server already on its port to answer.
       PROBE_TIMEOUT = 0.3
+      RESTARTED_ENV = "SAMAGOTCHI_WEB_RESTARTED"
+      ADOPT_PIDS_ENV = "SAMAGOTCHI_WEB_ADOPT_PIDS"
 
       # The raw header names next to Rack's env (ProxyGate's identity check):
       # chi web is the only WEBrick server chi runs.
@@ -86,7 +93,9 @@ module Samagotchi
       def self.launch(port: nil, host: nil, scope: "project", start_dir: nil, open_browser: false, markdown: false,
                       view: Config::BY_KEY["web.view"].default, annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
                       editor: Config::BY_KEY["web.editor"].default, new_token: false,
-                      working_set: Config::BY_KEY["web.working_set"].default, tunnel: nil, start_dir_from: :flag)
+                      working_set: Config::BY_KEY["web.working_set"].default, tunnel: nil, start_dir_from: :flag,
+                      restarted: false, restart_argv: ["web"], exec: nil)
+        handed_on = false # a :restart leaves Serve to the next process, a run turns it off itself
         start_given = !start_dir.to_s.strip.empty?
         start_dir = StartDir.resolve(start_dir, from: start_dir_from)
         rotate_token if new_token
@@ -119,6 +128,8 @@ module Samagotchi
           warn in_use_message(port)
           1
         else
+          provider = nil
+          plan = nil
           if tunnel
             provider = Tunnel.for(tunnel)
             plan = provider.prepare(port: port, config_owner: Samagotchi::Config.get("web.proxy.owner"),
@@ -141,11 +152,14 @@ module Samagotchi
                       public_url: public_url, start_dir: start_dir }
           started = if plan
                       with_tunnel(provider, plan) do |up|
-                        start(**options, public_notes: provider.start_lines(plan), on_bound: up)
+                        start(**options, public_notes: provider.start_lines(plan, restarted: restarted), on_bound: up)
                       end
                     else
                       start(**options)
                     end
+          handed_on = !!started
+          return reexec(restart_argv, provider: provider, plan: plan, exec: exec) if started == :restart
+
           started ? 0 : 1
         end
       rescue StartDir::Invalid, Lan::Error, Grants::Insecure, PublicUrl::Invalid, Tunnel::Refused, Push::Refused, Push::Store::Insecure => e
@@ -156,6 +170,11 @@ module Samagotchi
         # status a shell gives a command it interrupted.
         puts "#{"\n" if $stdout.tty?}Chi Web stopped."
         CLI::Exit::INTERRUPTED
+      ensure
+        # A restarted chi web that didn't get to serve (a refusal, the port
+        # race, a bad start folder): the old process's Serve handler it was
+        # to adopt goes off, never left forwarding to nothing.
+        stop_restarted_tunnel(tunnel, resolve_port(port)) if restarted && tunnel && !handed_on
       end
 
       # A second chi web given a start folder (--start-dir, web.start_dir)
@@ -176,16 +195,87 @@ module Samagotchi
       # (its command runs in its own process group, and Serve keeps what it
       # set even if chi stopped waiting), so it can't land between the serve
       # going on and the teardown being due; #up is bounded by its timeout.
+      # A :restart result leaves Serve up for the exec'd chi web to adopt.
       def self.with_tunnel(provider, plan)
         attempted = false
-        yield(lambda do
+        result = yield(lambda do
           Thread.handle_interrupt(SignalException => :never) do
             attempted = true
             provider.up(plan)
           end
         end)
+        result
       ensure
-        tunnel_down(provider, plan) if attempted
+        tunnel_down(provider, plan) if attempted && result != :restart
+      end
+
+      # Replace this process only after its listener and hub have stopped.
+      # Starter PIDs are children of this process; workers are detached and
+      # must not be adopted or signaled.
+      # No line before the exec: one on a hung-up terminal raises EIO, and
+      # the restart would end in a dead chi web; the log says it.
+      def self.reexec(argv, provider: nil, plan: nil, exec: nil)
+        program = reexec_program
+        raise ArgumentError, "RubyGems chi wrapper not found" if program.to_s.empty?
+
+        env = ChildEnv.unbundled.merge(
+          RESTARTED_ENV => "1",
+          ADOPT_PIDS_ENV => SessionManager.live_spawn_pids.join(",")
+        )
+        Samagotchi::Log.info(:web, "restart", program: program)
+        runner = exec || ->(environment, *args) { Kernel.exec(environment, *args) }
+        runner.call(env, RbConfig.ruby, program, *argv)
+      rescue SystemCallError, ArgumentError => e
+        tunnel_down(provider, plan) if provider && plan
+        warn "Error: couldn't restart chi web: #{e.message}"
+        1
+      end
+
+      # What a restart execs: the installed gem's wrapper (it activates the
+      # newest installed chi), this bin/chi in a checkout; nil for a gem
+      # installed without one (--bindir).
+      def self.reexec_program
+        gem_spec = InstalledGem.spec
+        gem_spec ? InstalledGem.wrapper(gem_spec) : $PROGRAM_NAME
+      end
+
+      # bin/chi's first step: the restart marker and the starters to adopt
+      # out of +env+, before anything (a worker, chi update) is spawned with
+      # it; the starters are adopted only under the marker.
+      # @return [Boolean] whether this chi web is a restarted one
+      def self.take_restart_env!(env = ENV, detach: Process.method(:detach))
+        restarted = env.delete(RESTARTED_ENV) == "1"
+        adopt_reexec_children!(env: env, detach: detach) if restarted
+        env.delete(ADOPT_PIDS_ENV)
+        restarted
+      end
+
+      # Adopt only the recorded child starters. They may have exited in the
+      # interval between collecting their PIDs and the new process starting.
+      def self.adopt_reexec_children!(env: ENV, detach: Process.method(:detach))
+        pids = env.delete(ADOPT_PIDS_ENV).to_s
+        pids.split(",").reject(&:empty?).each do |pid|
+          child_pid = Integer(pid, 10)
+          begin
+            detach.call(child_pid)
+          rescue Errno::ECHILD
+            nil
+          end
+        end
+      end
+
+      # Turns off the Serve handler a restarted chi web was to adopt, only
+      # when it is still exactly this port's (prepare says adopted); a
+      # foreign one, or none, stays as it is. Never raises: the start's own
+      # error is the one to say.
+      def self.stop_restarted_tunnel(tunnel, port)
+        provider = Tunnel.for(tunnel)
+        plan = provider.prepare(port: port, config_owner: Samagotchi::Config.get("web.proxy.owner"),
+                                config_public_url: Samagotchi::Config.get("web.public_url"),
+                                config_identity_header: Samagotchi::Config.get("web.proxy.identity_header"))
+        tunnel_down(provider, plan) if plan.adopted
+      rescue StandardError => e
+        Samagotchi::Log.warn(:web, "restart_tunnel_left", error: e.class.name, msg: e.message)
       end
 
       # The tunnel's teardown, before any line (a hung-up terminal can't
@@ -229,12 +319,13 @@ module Samagotchi
       # @param on_bound [#call, nil] run once the port is bound, before any
       #   line (the tunnel's #up); what it raises ends the run
       # @param start_dir [String] the folder chi web starts in (App's)
-      # @return [Boolean] false when the port was taken (said so on stderr)
+      # @return [Boolean, :restart] false when the port was taken (said so on stderr);
+      #   :restart when the owner requested an in-place process replacement
       def self.start(port: nil, host: nil, url: nil, open_browser: false, state_dir: nil, manager: nil, markdown: false,
                      view: Config::BY_KEY["web.view"].default, annotate_presets: Config::BY_KEY["web.annotate_presets"].default, hub: nil, lan: nil,
                      editor: Config::BY_KEY["web.editor"].default, token_path: Token.path,
                      working_set: Config::BY_KEY["web.working_set"].default, public_url: nil, public_notes: [],
-                     on_bound: nil, start_dir: Dir.pwd)
+                     on_bound: nil, start_dir: Dir.pwd, update_check: nil)
         config_restart_unsubscribe = ConfigFile.watch_restart_settings!(process: :web) do |message|
           Samagotchi::Log.warn(:config, "restart_required", echo: "Warning: config: #{message}")
         end
@@ -243,6 +334,7 @@ module Samagotchi
         url ||= "http://#{url_host(host)}:#{port}/"
 
         hub ||= SessionHub.new(state_dir: state_dir || Session.default_state_dir, manager: manager || SessionManager)
+        update_check ||= UpdateCheck.new(hub: hub)
         Token.load_or_create(token_path) if lan || public_url
         lan_option = { ip: lan.ip, token: Token::Source.new(token_path) } if lan
         public_token = Token::Source.new(token_path) if public_url
@@ -250,6 +342,25 @@ module Samagotchi
         app = App.new(manager: manager, state_dir: state_dir, markdown: markdown, view: view,
                       annotate_presets: annotate_presets, editor: editor, hub: hub, lan: lan_option, working_set: working_set,
                       public_url: public_url, public_token: public_token, push: push, start_dir: start_dir)
+        webrick = nil
+        restart_mutex = Mutex.new
+        restart_requested = false
+        restart_thread = nil
+        if app.respond_to?(:restart_web=)
+          app.restart_web = lambda do
+            restart_mutex.synchronize do
+              next false if restart_requested
+              next :no_wrapper if reexec_program.to_s.empty?
+
+              restart_requested = true
+              restart_thread = Thread.new do
+                sleep 0.2
+                webrick&.shutdown
+              end
+              true
+            end
+          end
+        end
         Samagotchi::Log.info(:web, "start", url: "http://#{host}:#{port}", version: Samagotchi::VERSION)
         Samagotchi::Log.info(:web, "lan", ip: lan.ip, interface: lan.interface) if lan
         if public_url
@@ -267,10 +378,10 @@ module Samagotchi
           Samagotchi::Log.info(:web, "push", devices: push.store.for_origin(push.origin).size)
         end
         hub.start
+        update_check.start
         # Said once the port is bound: a second chi web racing for it gets
         # the in-use line instead.
         running_path = Running.path(state_dir: state_dir)
-        webrick = nil
         callback_unfinished = false
         started = lambda do
           callback_unfinished = true
@@ -302,7 +413,7 @@ module Samagotchi
           app.server_running = -> { server.status == :Running }
           listen_lan(server, lan, port) if lan
         end
-        true
+        restart_requested ? :restart : true
       rescue Errno::EADDRINUSE
         warn in_use_message(port)
         false
@@ -316,8 +427,10 @@ module Samagotchi
         Running.clear(path: running_path) if running_path
         config_restart_unsubscribe&.call
         notifier&.stop
+        update_check&.stop
         hub&.stop
         Samagotchi::Log.info(:web, "stop") if app
+        restart_thread&.join
       end
 
       class LanListenError < StandardError; end

data/lib/samagotchi/web/session_access_routes.rb

@@ -13,6 +13,7 @@ require_relative "../model_profile"
 require_relative "../client_id"
 require_relative "../children_status"
 require_relative "../session_metrics"
+require_relative "../version"
 
 module Samagotchi
   module Web
@@ -273,7 +274,7 @@ module Samagotchi
                              model_name: session_access.show(id).model_name,
                              default_model: ModelProfile.default_model_name,
                              parent_strategy: strategy_json(session_access.parent_strategy(id)),
-                             installed: @hub&.installed })
+                             **(@hub&.chi_state || { version: VERSION, installed: nil, available: nil, update_blocked: nil }) })
       rescue SessionManager::OwnedByTUI => e
         owned_by_tui(e)
       rescue SessionAccess::Refused => e

data/lib/samagotchi/web/session_hub.rb

@@ -40,8 +40,8 @@ module Samagotchi
 
       # What a subscriber gets: `session` with {session: summary} for an
       # upsert, `session_gone` with {id:} for a removal, `chi` with
-      # {version:, installed:} when the newest installed chi changed (checked
-      # with the full probe; #installed has it for a new tab). seq is monotonic per
+      #   {version:, installed:, available:, update_blocked:} when chi version
+      #   state changes. seq is monotonic per
       # hub, for the log's sake: there is no replay.
       Event = Struct.new(:type, :seq, :data, keyword_init: true)
 
@@ -78,6 +78,9 @@ module Samagotchi
         @state_dir = state_dir
         @installed_versions = installed_versions
         @installed = nil
+        @available = nil
+        @update_blocked = nil
+        @update_state = nil
         @manager = manager
         @now = now || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
         @scan_interval = scan_interval
@@ -140,6 +143,52 @@ module Samagotchi
         @monitor.synchronize { @installed }
       end
 
+      # Look at what is installed now, not at the next full probe (after an
+      # install): a change is the usual `chi` event.
+      # @return [String, nil] the newest installed chi
+      def refresh_installed
+        @monitor.synchronize do
+          check_installed
+          @installed
+        end
+      end
+
+      # The complete chi version state used by event snapshots and info routes.
+      def chi_state
+        @monitor.synchronize do
+          { version: VERSION, installed: @installed, available: @available, update_blocked: @update_blocked }
+        end
+      end
+
+      # Publish the update check's answer without holding the Monitor while it
+      # fetches releases. A newly selected release may carry a one-shot push hint.
+      def update_available(available:, blocked:, notify: false)
+        @monitor.synchronize do
+          changed = available != @available || blocked != @update_blocked
+          @available = available
+          @update_blocked = blocked
+          emit("chi", chi_state.merge(notify ? { update_notice: true } : {})) if changed || notify
+        end
+        nil
+      end
+
+      # Publish the owner-triggered update's progress or result for current
+      # tabs, and retain the latest state for a reconnect's snapshot.
+      def publish_update(state:, rows:, progress: nil, operation: nil, version: nil)
+        @monitor.synchronize do
+          @update_state = { state: state, rows: rows }
+          @update_state[:operation] = operation unless operation.nil?
+          @update_state[:version] = version unless version.nil?
+          @update_state[:progress] = progress unless progress.nil?
+          emit("chi_update", @update_state)
+        end
+        nil
+      end
+
+      def update_state
+        @monitor.synchronize { @update_state&.dup }
+      end
+
       # Rescan one session now (its file, its folder, its owner), for the
       # page's own actions: no waiting for the next tick.
       def touch(id)
@@ -232,7 +281,7 @@ module Samagotchi
         return if newest == @installed
 
         @installed = newest
-        emit("chi", version: VERSION, installed: newest)
+        emit("chi", chi_state)
       rescue StandardError => e
         Log.warn(:web, "installed_check_failed", error: e.class.name, msg: e.message)
       end

data/lib/samagotchi/web/tunnel/tailscale.rb

@@ -162,10 +162,16 @@ module Samagotchi
 
         # What the start lines add: how it is reached and whose login is the
         # owner, and the Tailnet Lock warning.
-        def start_lines(plan)
+        def start_lines(plan, restarted: false)
           source = plan.owner_source == :config ? "web.proxy.owner" : "this machine's Tailscale login"
           via = "         via Tailscale Serve (tailnet only), owner #{plan.public_url.owner} (#{source})"
-          via += "; Serve already forwarded port 443 here, chi web turns it off on exit" if plan.adopted
+          if plan.adopted
+            via += if restarted
+                     "; adopted by the restarted chi web; it turns Serve off on exit"
+                   else
+                     "; Serve already forwarded port 443 here, chi web turns it off on exit"
+                   end
+          end
           lines = [via]
           if plan.lock_off
             lines << "Tailnet Lock is off: a device Tailscale's servers add to your tailnet could reach this page; " \