samagotchi 0.122.0 → 0.124.0

data/lib/samagotchi/web/app.rb

@@ -4,6 +4,9 @@ require "cgi/escape" # CGI.escapeHTML; Ruby 4.0 ships only cgi/escape
 require "digest"
 require "fileutils"
 require "json"
+require "open3"
+require "rbconfig"
+require "rubygems/version"
 require "time"
 require "uri"
 require "rack"
@@ -67,10 +70,14 @@ require_relative "session_show"
 require_relative "session_create"
 require_relative "session_control"
 require_relative "push_routes"
+require_relative "update_check"
 require_relative "proxy_gate"
 require_relative "../log"
 require_relative "../paths"
 require_relative "../redacted_inspect"
+require_relative "../child_env"
+require_relative "../installed_gem"
+require_relative "../live_versions"
 
 module Samagotchi
   module Web
@@ -113,6 +120,7 @@ module Samagotchi
       # A callable the event loops ask whether the server still runs;
       # Server.start points it at WEBrick's status once it has the server.
       attr_writer :server_running
+      attr_writer :restart_web
 
       # @param bridge_wait_timeout [Float] bounded seconds to wait for a
       #   freshly-spawned worker's bridge before answering POST /api/sessions.
@@ -156,7 +164,8 @@ module Samagotchi
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
                      working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
-                     grants: nil, public_url: nil, public_token: nil, push: nil, start_dir: nil)
+                     grants: nil, public_url: nil, public_token: nil, push: nil, start_dir: nil, update_runner: nil,
+                     update_blocked: nil)
         @start_dir = start_dir
         @manager = manager || SessionManager
         @registry = registry
@@ -182,6 +191,10 @@ module Samagotchi
         @refused_logged = {}
         @wait_poll_interval = wait_poll_interval
         @push = push
+        @update_mutex = Mutex.new
+        @update_running = false
+        @update_runner = update_runner || method(:run_update_command)
+        @update_blocked = update_blocked || -> { UpdateCheck.blocked_reason }
         init_participant_access(grants, state_dir)
         init_proxy_gate(public_url, public_token)
       end
@@ -233,6 +246,9 @@ module Samagotchi
         ["GET", %r{\A/api/models\z}, :handle_models, :owner],
         ["GET", %r{\A/api/history\z}, :handle_history, :owner],
         ["GET", %r{\A/api/events\z}, :handle_events, :owner],
+        ["POST", %r{\A/api/update\z}, :handle_update, :owner],
+        ["POST", %r{\A/api/update/restart_workers\z}, :handle_restart_workers, :owner],
+        ["POST", %r{\A/api/update/restart_web\z}, :handle_restart_web, :owner],
         ["POST", %r{\A/api/render\z}, :handle_render, :owner],
         ["GET", %r{\A/api/sessions/([^/]+)/stream\z}, :handle_stream, :participant],
         ["GET", %r{\A/api/sessions/([^/]+)/review\z}, :handle_review, :participant, :session],
@@ -649,6 +665,183 @@ module Samagotchi
       # no token is asked of this request): nothing to do.
       def handle_token(_req) = [204, { "Cache-Control" => "no-store" }, []]
 
+      def handle_update(req)
+        return error_response(503, "no_hub", "this chi web has no session hub") unless @hub
+
+        raw = request_body(req, 16_385)
+        return error_response(413, "body_too_large", "update request is too large") if raw.bytesize > 16_384
+
+        payload = parse_json(raw)
+        return error_response(400, "invalid_update", "expected a JSON object with a version") unless payload.is_a?(Hash)
+
+        version = payload["version"]
+        # Gem::Version.correct? lets surrounding whitespace through; argv gets none.
+        unless version.is_a?(String) && !version.match?(/\s/) && Gem::Version.correct?(version)
+          return error_response(400, "invalid_version", "version must be a gem version")
+        end
+
+        version = Gem::Version.new(version).to_s
+        if Gem::Version.new(version) <= Gem::Version.new(VERSION)
+          return error_response(409, "update_not_newer", "version #{version} is not newer than this chi")
+        end
+
+        # Found out here, not from the hub: UpdateCheck (off with update.notify: off) is what tells it.
+        blocked = @update_blocked.call
+        return json_response(409, { error: "update_blocked", reason: blocked }) if blocked
+
+        already_running = @update_mutex.synchronize do
+          if @update_running
+            true
+          else
+            @update_running = true
+            false
+          end
+        end
+        return error_response(409, "update_running", "an update is already running") if already_running
+
+        @hub.publish_update(state: "running", rows: [], operation: "install", version: version)
+        Thread.new { perform_update(version) }
+        json_response(202, { state: "running", version: version })
+      rescue ThreadError => e
+        @update_mutex.synchronize { @update_running = false }
+        Log.warn(:web, "update_start_failed", error: e.class.name, msg: e.message)
+        @hub&.publish_update(state: "failed", rows: [
+          { "component" => "chi update", "status" => "failed (couldn't start update)", "failed" => true, "kept" => [] }
+        ], operation: "install")
+        error_response(503, "update_start_failed", "couldn't start chi update")
+      end
+
+      def perform_update(version)
+        argv = [RbConfig.ruby, InstalledGem.wrapper, "update", "--to", version, "--no-desktop", "--json"]
+        said = nil
+        output, success = @update_runner.call(argv, env: ChildEnv.unbundled,
+                                              progress: lambda { |line|
+                                                said = line unless line.strip.empty?
+                                                @hub.publish_update(state: "running", rows: [], progress: line,
+                                                                    operation: "install", version: version)
+                                              })
+        rows = update_rows(output)
+        # No rows (a usage error, a refusal): what the child said is the reason.
+        raise UpdateFailed, said || output.lines.map(&:strip).find { |line| !line.empty? } || "chi update printed no rows" unless rows
+
+        # The installed version as of now (the hub's own look is up to a probe interval old), before "done".
+        @hub.refresh_installed if success
+        @hub.publish_update(state: success ? "done" : "failed", rows: rows, operation: "install", version: version)
+      rescue StandardError => e
+        Log.exception(:web, "update_failed", e)
+        @hub.publish_update(state: "failed", rows: [
+          { "component" => "chi update", "status" => "failed (#{e.message.lines.first.to_s.strip})",
+            "failed" => true, "kept" => [] }
+        ], operation: "install", version: version)
+      ensure
+        @update_mutex.synchronize { @update_running = false }
+      end
+
+      # chi update's own words when it printed no rows.
+      class UpdateFailed < StandardError; end
+
+      # chi update --json's rows, or nil when it printed none.
+      def update_rows(output)
+        rows = JSON.parse(output)
+        rows if rows.is_a?(Array) && rows.all?(Hash)
+      rescue JSON::ParserError
+        nil
+      end
+
+      def run_update_command(argv, env:, progress:)
+        Open3.popen3(env, *argv) do |stdin, stdout, stderr, wait_thread|
+          stdin.close
+          stderr_thread = Thread.new { stderr.each_line { |line| progress.call(line.chomp) } }
+          output = stdout.read
+          stderr_thread.value
+          [output, wait_thread.value.success?]
+        end
+      end
+
+      def handle_restart_workers(_req)
+        return error_response(503, "no_hub", "this chi web has no session hub") unless @hub
+
+        already_running = @update_mutex.synchronize do
+          if @update_running
+            true
+          else
+            @update_running = true
+            false
+          end
+        end
+        return error_response(409, "update_running", "a chi update operation is already running") if already_running
+
+        @hub.publish_update(state: "running", rows: [], operation: "workers")
+        Thread.new { perform_worker_restarts }
+        json_response(202, { state: "running" })
+      rescue ThreadError => e
+        @update_mutex.synchronize { @update_running = false }
+        Log.warn(:web, "worker_restart_start_failed", error: e.class.name, msg: e.message)
+        @hub&.publish_update(state: "failed", rows: [
+          { "state" => "failed", "reason" => "couldn't start worker restarts" }
+        ], operation: "workers")
+        error_response(503, "restart_start_failed", "couldn't start worker restarts")
+      end
+
+      def perform_worker_restarts
+        # Installed now: the hub's own look is up to a full probe old (nil right after chi web started).
+        target = @hub.refresh_installed || VERSION
+        rows = []
+        LiveVersions.stale_workers(target, state_dir: default_state_dir).each do |worker|
+          row = begin
+            restarted = @manager.restart_session(worker.session_id, state_dir: @state_dir, client_id: ClientId::WEB_RESTART)
+            @hub.touch(worker.session_id)
+            { "session_id" => restarted.session_id, "state" => "restarted", "from_version" => restarted.from_version,
+              "version" => restarted.version }
+          rescue SessionManager::RestartRefused => e
+            # detail: the refusal's own words (RestartRefused.words), the reason code for clients.
+            { "session_id" => worker.session_id, "state" => "refused", "reason" => e.reason.to_s,
+              "detail" => e.message, "holds" => e.holds.map(&:to_s) }
+          rescue SessionManager::OwnedByTUI => e
+            { "session_id" => worker.session_id, "state" => "owned_by_tui", "detail" => e.message }
+          rescue StandardError => e
+            Log.exception(:web, "worker_restart_failed", e, sid: worker.session_id)
+            { "session_id" => worker.session_id, "state" => "failed", "reason" => e.class.name, "detail" => e.message }
+          end
+          rows << row
+          @hub.publish_update(state: "running", rows: rows.dup, operation: "workers")
+        end
+        state = rows.any? { |row| row["state"] == "failed" } ? "failed" : "done"
+        @hub.publish_update(state: state, rows: rows, operation: "workers")
+      rescue StandardError => e
+        Log.exception(:web, "worker_restart_failed", e)
+        @hub.publish_update(state: "failed", rows: [
+          { "state" => "failed", "reason" => e.class.name, "detail" => e.message }
+        ], operation: "workers")
+      ensure
+        @update_mutex.synchronize { @update_running = false }
+      end
+
+      # The exec replaces this process: an update's chi update child (its
+      # pipes read here) or a worker restart pass would die mid-way, so
+      # neither may run, and none starts once the restart is asked for.
+      def handle_restart_web(_req)
+        return error_response(503, "restart_unavailable", "chi web cannot restart itself in this process") unless @restart_web
+
+        busy = @update_mutex.synchronize do
+          next true if @update_running
+
+          @update_running = true # held for good once restarting: the exec ends this process
+          false
+        end
+        return error_response(409, "update_running", "a chi update operation is running; restart chi web when it ends") if busy
+
+        case @restart_web.call
+        when true then return json_response(202, { state: "restarting" })
+        when :no_wrapper
+          refusal = error_response(409, "restart_unavailable", "no chi wrapper to restart into (installed with --bindir?); " \
+                                                               "restart chi web in its terminal")
+        else refusal = error_response(409, "restart_requested", "chi web is already restarting")
+        end
+        @update_mutex.synchronize { @update_running = false }
+        refusal
+      end
+
       def unauthorized(req)
         reason = req.env[REFUSED_ENV]
         log_refused(refused_peer(req), req.path_info, reason)
@@ -865,8 +1058,8 @@ module Samagotchi
       end
 
       # What a second `chi web` probes before starting its own server: this
-      # is chi web, and it knows ?dir (features). installed: the newest chi
-      # on this machine (nil until the hub has looked); newest_workers: the
+      # is chi web, and it knows ?dir (features). Its chi version state is
+      # {version, installed, available, update_blocked}; newest_workers: the
       # workers it starts run that one, not this chi web's version;
       # session_commands: the routes chi --remote needs
       # (SessionAccessRoutes::FEATURE); remote_attach: the ones a remote
@@ -880,7 +1073,8 @@ module Samagotchi
       def handle_info(req)
         return participant_info unless principal(req).owner?
 
-        json_response(200, { app: "chi-web", version: Samagotchi::VERSION, installed: @hub&.installed, pid: Process.pid,
+        chi_state = @hub&.chi_state || { version: Samagotchi::VERSION, installed: nil, available: nil, update_blocked: nil }
+        json_response(200, { app: "chi-web", **chi_state, pid: Process.pid,
                              cwd: Dir.pwd, start_dir: start_dir, features: INFO_FEATURES, lan: @lan && @lan[:ip],
                              proxy: @public_url && { identity_header: @public_url.identity_header } })
       end
@@ -1799,14 +1993,15 @@ module Samagotchi
           @queue = Bridge::BoundedQueue.new(capacity: capacity)
           @handle, @snapshot = @hub.subscribe(->(event) { @queue.push(event) }, snapshot: true, project_root: project_root)
           # Read after subscribing: a change in between is also a queued event.
-          @installed = @hub.installed
+          @chi_state = @hub.chi_state
         end
 
         def each
-          # version: the page compares it with the one it was served by;
-          # installed: the newest chi on this machine (a later change is a
-          # `chi` event).
-          yield frame(nil, "snapshot", sessions: @snapshot, version: Samagotchi::VERSION, installed: @installed)
+          # The page compares this full chi state with the one it was served by.
+          snapshot = { sessions: @snapshot }.merge(@chi_state)
+          update_state = @hub.update_state
+          snapshot[:chi_update] = update_state if update_state
+          yield frame(nil, "snapshot", snapshot)
           last_write = monotonic
           loop do
             event = @queue.pop([@heartbeat, EVENTS_POLL].min)

data/lib/samagotchi/web/grants.rb

@@ -4,6 +4,7 @@ require "digest"
 require "fileutils"
 require "json"
 require_relative "../steer"
+require_relative "../participant_mode"
 require "securerandom"
 require "time"
 require "rack/utils"
@@ -54,6 +55,11 @@ module Samagotchi
       KINDS = %w[human agent].freeze
       # The only role in v1: a reviewer reads and (P3) comments.
       ROLES = %w[reviewer].freeze
+      # The participant mode a grant was issued for (ParticipantMode): "pair"
+      # only when the owner was shown that a participant's turns act
+      # (ReviewStart::PAIR_WARNING); none for every other grant, and every
+      # grant from before it, whose turns stay review turns.
+      PAIR_MODE = ParticipantMode::PAIR.to_s
       NAME_MAX = ParticipantName::MAX
       ID_RE = /\Ap_[0-9a-f]{8}\z/
       # D7: what a participant's turns (and the side calls they cause) may
@@ -137,12 +143,15 @@ module Samagotchi
       # +extra+: the stored keys this chi doesn't know (a newer chi's,
       # such as a field added to a grant without a version bump), written
       # back as they were, so a rewrite here never drops them.
+      # +mode+: PAIR_MODE when the owner invited them to act (Grants#issue's
+      # mode:), nil otherwise. Stored only when set; a chi that doesn't know
+      # it keeps it in +extra+ and runs their turns as review turns.
       Grant = Data.define(:id, :session_id, :digest, :kind, :name, :role, :created_at, :expires_at, :revoked_at,
-                          :revoked_by, :last_used_at, :cap, :queue, :identity, :exposure, :extra) do
+                          :revoked_by, :last_used_at, :cap, :queue, :identity, :exposure, :mode, :extra) do
         # identity: the proxy identity (an email, lower case) the grant is
         # bound to, nil for any (ProxyGate; issued from shared-sessions P6).
-        def initialize(cap: nil, queue: nil, identity: nil, exposure: nil, extra: {}, **)
-          super(cap: cap, queue: queue, identity: identity, extra: extra,
+        def initialize(cap: nil, queue: nil, identity: nil, exposure: nil, mode: nil, extra: {}, **)
+          super(cap: cap, queue: queue, identity: identity, extra: extra, mode: mode,
                 exposure: exposure.nil? ? ParticipantExposure::DEFAULT : exposure, **)
         end
 
@@ -198,6 +207,7 @@ module Samagotchi
         def to_store
           hash = to_h.except(:extra).transform_keys(&:to_s)
           hash.delete("identity") if identity.nil?
+          hash.delete("mode") if mode.nil?
           hash.delete("exposure") if exposure == ParticipantExposure::DEFAULT
           hash.merge(extra.reject { |key, _| hash.key?(key) })
         end
@@ -315,7 +325,8 @@ module Samagotchi
       # @param on_write [#call, nil] see #update
       # @return [Issued]
       # @raise [Invalid]
-      def issue(session_id:, name:, kind: "human", role: "reviewer", ttl: nil, cap: nil, identity: nil, on_write: nil)
+      def issue(session_id:, name:, kind: "human", role: "reviewer", ttl: nil, cap: nil, identity: nil, mode: nil,
+                on_write: nil)
         Session.check_id!(session_id)
         ttl ||= Grants.default_ttl
         cap = Grants.default_cap if cap.nil?
@@ -323,6 +334,7 @@ module Samagotchi
         raise Invalid, "role is reviewer, not #{role}" unless ROLES.include?(role)
         raise Invalid, "a grant lasts 1 hour to 30 days" unless ttl.is_a?(Integer) && ttl.between?(3600, MAX_TTL)
         raise Invalid, CAP_RANGE unless Grants.cap?(cap)
+        raise Invalid, "mode is #{PAIR_MODE} or none, not #{mode}" unless mode.nil? || mode == PAIR_MODE
 
         clean = Grants.clean_name(name)
         identity = Grants.clean_identity(identity) unless identity.nil?
@@ -333,7 +345,7 @@ module Samagotchi
           grant = Grant.new(id: id, session_id: session_id, digest: Grants.digest(token), kind: kind, name: clean,
                             role: role, created_at: stamp(issued), expires_at: stamp(issued + ttl), revoked_at: nil,
                             revoked_by: nil, last_used_at: nil, cap: cap.to_f, queue: Grants.default_queue,
-                            identity: identity)
+                            identity: identity, mode: mode)
           [grants + [grant], Issued.new(grant: grant, token: token)]
         end
       end

data/lib/samagotchi/web/message_display.rb

@@ -136,7 +136,12 @@ module Samagotchi
           turn_id = m[:turn_id] || m["turn_id"]
           message[:turn_id] = turn_id.to_s if norm_role == "user" && turn_id
           # A participant's message names them (the page's author badge).
-          message.merge!(Samagotchi::Steer.author_fields(m[:author] || m["author"], m[:author_name] || m["author_name"])) if norm_role == "user"
+          if norm_role == "user"
+            message.merge!(Samagotchi::Steer.author_fields(m[:author] || m["author"], m[:author_name] || m["author_name"]))
+            # Its turn's mode (review or pair: the badge, Apply under a review turn only).
+            mode = m[:participant_mode] || m["participant_mode"]
+            message[:participant_mode] = mode.to_s if mode && message[:author]
+          end
           images = m[:images] || m["images"]
           message[:images] = Array(images).map { |ref| ImageStore.symbolize(ref).slice(:file, :name, :width, :height) } if norm_role == "user" && images.is_a?(Array) && !images.empty?
           if norm_role == "assistant"

data/lib/samagotchi/web/participant_review.rb

@@ -50,7 +50,7 @@ module Samagotchi
       #   current_turn, waiting_for_owner, queued: {mine, others}, last_event_id}
       def handle_review(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
-        mode = ParticipantMode.of(session).to_s
+        mode = ParticipantMode.live(session, state_dir: default_state_dir).to_s
         viewer = participant_viewer(req, session)
         live = bridge_get_json(id, "snapshot")
         turn_snapshot = live && live["snapshot"]
@@ -156,6 +156,8 @@ module Samagotchi
 
         grant = principal(req).grant
         capped = !participant_cap_refusal(grant).nil?
+        # Theirs: pair only when their grant was issued to act (ParticipantMode.live_for).
+        mode = ParticipantMode.live_for(session, grant, state_dir: default_state_dir).to_s
         { kind: "participant", id: grant.id, name: grant.name, participant_kind: grant.kind, mode: mode, can_comment: !capped,
           cap_reached: capped, session_id: id,
           usage: review_usage(grant, session: session, state: state, queued: queued, viewer: viewer) }

data/lib/samagotchi/web/participant_view.rb

@@ -3,6 +3,7 @@
 require_relative "../output_formatter"
 require_relative "../steer"
 require_relative "../turn_origin"
+require_relative "../participant_mode"
 
 module Samagotchi
   module Web
@@ -36,6 +37,9 @@ module Samagotchi
         def own?(author) = !self.author.nil? && author.to_s == self.author
       end
 
+      # A turn's participant_mode values the view passes on (ParticipantMode).
+      PARTICIPANT_MODES = [ParticipantMode::REVIEW.to_s, ParticipantMode::PAIR.to_s].freeze
+
       # The stream's event types a participant gets, each rebuilt by the
       # method named. Every other type is dropped.
       EVENTS = {
@@ -109,7 +113,7 @@ module Samagotchi
         origin = TurnOrigin.of(field(event, :origin))
         author = field(event, :author) || origin.author
         out = { "type" => "turn_started", **id_fields(event), **time_field(event) }
-        out.merge!(author_fields(author, field(event, :author_name), viewer))
+        out.merge!(author_fields(author, field(event, :author_name), viewer, field(event, :participant_mode)))
         prompt = field(event, :prompt)
         if field(event, :continue)
           out["continue"] = true
@@ -202,7 +206,8 @@ module Samagotchi
         out["content"] = field(message, :content).to_s
         out["turn_id"] = turn_id.to_s if turn_id
         out["merged"] = true if merged
-        out.merge!(author_fields(field(message, :author), field(message, :author_name), viewer))
+        out.merge!(author_fields(field(message, :author), field(message, :author_name), viewer,
+                                 field(message, :participant_mode)))
         images = field(message, :images)
         out["images"] = images.size if images.is_a?(Array) && !images.empty?
         out
@@ -277,12 +282,15 @@ module Samagotchi
       end
 
       # A turn's author as a participant sees it: the participant's id and
-      # name, or none for the owner's; +mine+ for the viewer's own.
-      def author_fields(author, name, viewer)
+      # name, or none for the owner's; +mine+ for the viewer's own; the
+      # turn's +mode+ (its participant_mode stamp: review or pair) when
+      # it has one.
+      def author_fields(author, name, viewer, mode = nil)
         return {} unless Steer.participant_author?(author)
 
         out = { "author" => author.to_s }
         out["author_name"] = name.to_s if name.is_a?(String) && !name.empty?
+        out["participant_mode"] = mode.to_s if PARTICIPANT_MODES.include?(mode.to_s)
         out["mine"] = true if viewer.own?(author)
         out
       end

data/lib/samagotchi/web/participants_admin.rb

@@ -24,14 +24,16 @@ module Samagotchi
       # for a session that isn't a review session (ReviewStart.share_warning,
       # null for one), which the panel shows before its Invite; and
       # +identity_header+: the header this chi web's auth proxy names the
-      # signed-in user in (null without one), for the Invite's email field.
+      # signed-in user in (null without one), for the Invite's email field;
+      # +mode+: what a participant invited now gets, "pair" or "review"
+      # (ReviewStart.share_terms), for the panel's words.
       def handle_participants_list(_req, id = nil)
         now = @grants.now
         grants = @grants.list(session_id: id).map { |grant| grant.public_h(now) }
         return json_response(200, { participants: grants }) unless id
 
-        warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
-        json_response(200, { participants: with_spend(id, grants), warning: warning,
+        terms = ReviewStart.share_terms(Session.load(id, state_dir: default_state_dir), state_dir: default_state_dir)
+        json_response(200, { participants: with_spend(id, grants), warning: terms.warning, mode: terms.mode.to_s,
                              identity_header: @public_url&.identity_header })
       rescue Grants::Unwritable => e
         grants_unwritable(e)
@@ -67,13 +69,15 @@ module Samagotchi
         cap = body["cap"]
         return error_response(400, "invalid_participant", Grants::CAP_RANGE) unless cap.nil? || Grants.cap?(cap)
 
+        # The grant is stamped pair only when the warning that comes back says
+        # their turns act (one read: ReviewStart.share_terms).
+        terms = ReviewStart.share_terms(Session.load(id, state_dir: default_state_dir), state_dir: default_state_dir)
         issued = Participants.invite(@grants, session_id: id, name: body["name"], kind: (body["kind"] || "human").to_s,
                                               ttl: ttl, cap: cap, identity: body["identity"], public_url: @public_url,
-                                              state_dir: default_state_dir)
+                                              mode: terms.grant_mode, state_dir: default_state_dir)
         link = participant_link(req, id, issued.token, expires_at: issued.grant.expires_at)
-        warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
         json_response(201, { participant: issued.grant.public_h(@grants.now), token: issued.token,
-                             link: link, lan: !@lan.nil? || !@public_url.nil?, qr_svg: QR.svg(link), warning: warning })
+                             link: link, lan: !@lan.nil? || !@public_url.nil?, qr_svg: QR.svg(link), warning: terms.warning })
       rescue Grants::Invalid => e
         error_response(400, "invalid_participant", e.message)
       rescue Grants::Unwritable => e

data/lib/samagotchi/web/public/app.js

@@ -26,6 +26,9 @@ import {
   addContext,
   renderText,
   getWorkingSet,
+  updateChi,
+  restartWorkers,
+  restartWeb,
   onAuthLost,
 } from "./data.js";
 import { authProbe, createAuthLost } from "./auth_lost.js";
@@ -68,7 +71,7 @@ import { readStored, writeStored } from "./storage.js";
 import { createCommandList } from "./command_list.js";
 import { ALL_SESSIONS_HASH, sessionHash, sessionIdFromHash } from "./route.js";
 import { scopeDir, scopeTemplate } from "./scope.js";
-import { render } from "./vendor/lit-html.js";
+import { html, render } from "./vendor/lit-html.js";
 import { shouldFollowScroll } from "./scroll.js";
 import { SHORT_WINDOW_QUERY, stripAutoHidden } from "./strip.js";
 import { createStripGrip } from "./strip_grip.js";
@@ -76,7 +79,7 @@ import { waitingOn } from "./notify.js";
 import { applySessionEvent, sortedByUpdated } from "./sessions_list.js";
 import { createNotifications } from "./notifications.js";
 import { renameShown, tabTitle, topBarTitle } from "./session_title.js";
-import { restartConfirmText, versionNotice } from "./update_notice.js";
+import { mergeVersionState, restartConfirmText, versionNotice } from "./update_notice.js";
 import {
   appendAboveLiveTiming, mergeTiming, normalizeTiming,
 } from "./timing.js";
@@ -100,6 +103,7 @@ import { createUnqueue } from "./unqueue.js";
 import { createStartPage } from "./start_page.js";
 import { createSessionActions } from "./session_actions.js";
 import { createStopSheet } from "./stop_sheet.js";
+import { createUpdateSheet } from "./update_sheet.js";
 import { createRename } from "./session_rename.js";
 import { createSendTurn } from "./send_turn.js";
 import { createMarkdownTip } from "./markdown_tip.js";
@@ -442,6 +446,8 @@ function openSessionEvents() {
   eventsControl = openEvents({
     snapshot: (data) => {
       noticeVersions(data);
+      if (updateSheet.reconnected(data.version)) showToast(`chi web reconnected on chi ${data.version}`);
+      if (data.chi_update) updateFrame(data.chi_update, { snapshot: true });
       notifications.noticeSessions("snapshot", data);
       allSessions = applySessionEvent(allSessions, "snapshot", data);
       lists.render();
@@ -469,6 +475,7 @@ function openSessionEvents() {
       leaveGoneSession(data.id, "deleted");
     },
     chi: (data) => noticeVersions(data),
+    chi_update: (data) => updateFrame(data),
   }, {
     dir: scope.dir,
     onError: () => {
@@ -489,25 +496,75 @@ function openSessionEvents() {
 
 const EVENTS_REOPEN_MS = 3000;
 
-// Which chi serves this page now and which is the newest installed (the
-// events snapshot, and `chi` frames when that changes). A toast says when
-// chi web was upgraded while this tab stayed open (offering the reload,
-// never forcing it) or when a newer chi is installed than chi web runs.
+// The chi versions carried by each event snapshot and `chi` frame. A toast
+// says when chi web was upgraded, a newer one is installed, or an aged one
+// is available to update to.
 // Once per notice per tab: every reconnect's snapshot says it again.
 const versions = { served: null, installed: null };
 // The sessions whose Restart is under way (their button says so): one
 // session's restart never blocks another's.
 const restartingIds = new Set();
+// An available release's notice is once per version per browser, not per
+// tab: chi web says it in every snapshot until the owner updates.
+const AVAILABLE_SHOWN_KEY = "chi_update_available_shown";
 const versionNoticesShown = new Set();
+const availableShown = readStored(AVAILABLE_SHOWN_KEY);
+if (availableShown) versionNoticesShown.add(`available:${availableShown}`);
+let versionToast = null;
+
 function noticeVersions(data) {
-  if (typeof data.version === "string") versions.served = data.version;
-  versions.installed = typeof data.installed === "string" ? data.installed : null;
+  Object.assign(versions, mergeVersionState(versions, data));
   const notice = versionNotice({ loaded: document.body.dataset.version, served: versions.served,
-                                 installed: versions.installed, shown: versionNoticesShown });
+                                 installed: versions.installed, available: versions.available,
+                                 updateBlocked: versions.updateBlocked, shown: versionNoticesShown });
   updateInfoBar(); // the worker badge compares with the newest installed
   if (!notice) return;
   versionNoticesShown.add(notice.key);
-  showToast(notice.text, notice.reload ? { label: "Reload", run: () => location.reload() } : null, { sticky: true });
+  if (notice.key.startsWith("available:")) writeStored(AVAILABLE_SHOWN_KEY, notice.key.slice("available:".length));
+  const text = notice.releaseUrl
+    ? html`${notice.text} <a href=${notice.releaseUrl} target="_blank" rel="noopener noreferrer">RubyGems</a>`
+    : notice.text;
+  const action = notice.reload
+    ? { label: "Reload", run: () => location.reload() }
+    : notice.updateVersion
+      ? { label: "Update", run: () => updateSheet.install(notice.updateVersion) }
+      : notice.actions
+        ? notice.actions.map((name) => ({
+          label: name === "restartWorkers" ? "Restart workers" : "Restart chi web",
+          run: () => (name === "restartWorkers" ? updateSheet.restartWorkers() : updateSheet.restartWeb()),
+        }))
+    : notice.command
+      ? { label: "Copy", run: () => copyUpdateCommand(notice.command) }
+      : null;
+  // One version toast at a time: a newer notice (Reload after a restart)
+  // supersedes the one before it.
+  toasts.dismiss(versionToast);
+  versionToast = toasts.show(text, action, { sticky: true });
+}
+
+function updateFrame(data, { snapshot = false } = {}) {
+  const wasOpen = updateSheet.isOpen();
+  if (!updateSheet.receive(data)) return;
+  if (data.operation === "install" && data.state === "done" && data.version) noticeVersions({ installed: data.version });
+  if (!wasOpen && data.state === "running") {
+    const label = data.operation === "install" ? "Chi update" : "Worker restart";
+    showToast(`${label} in progress`, { label: "View", run: () => updateSheet.view() }, { sticky: true });
+  } else if (!snapshot && !wasOpen && ["done", "failed"].includes(data.state)
+    && !(data.operation === "install" && data.state === "done")) {
+    const label = data.operation === "install" ? "Chi update" : "Worker restart";
+    showToast(`${label} ${data.state}`, { label: "View", run: () => updateSheet.view() }, { sticky: true });
+  }
+}
+
+function copyUpdateCommand(command) {
+  if (!navigator.clipboard?.writeText) {
+    showToast(`Clipboard unavailable; run ${command}`);
+    return;
+  }
+  navigator.clipboard.writeText(command).then(
+    () => showToast(`Copied ${command}`),
+    () => showToast(`Couldn't copy ${command}`),
+  );
 }
 
 // The selected session's card changed: its owner and, without a live
@@ -1754,6 +1811,12 @@ function restoreDraft(draft, opener) {
 }
 
 const toasts = createToasts({ el: $("#toast"), onChange: placeToast });
+const updateSheet = createUpdateSheet({
+  dialog: $("#updateSheet"),
+  update: updateChi,
+  restartWorkers,
+  restartWeb,
+});
 
 function showToast(text, action = null, options = {}) { toasts.show(text, action, options); }