samagotchi 0.138.0 → 0.139.0

data/lib/samagotchi/task_watch.rb

@@ -19,12 +19,14 @@ module Samagotchi
   # and anytime commands run on threads of their own.
   class TaskWatch
     # A watched task: +limit_sec+, the limit an execute handed it over at
-    # (nil for task_create's); +note_only+, the user stopped the turn that
+    # (nil for task_create's); +early_sec+, the seconds an execute had run
+    # when a message from the user handed it over early (nil otherwise);
+    # +note_only+, the user stopped the turn that
     # started or waited on it (M5): its finish is a plain note, no wake;
     # +failures+, how often its note couldn't be written (#put_back) or the
     # look for it failed (#look_failed).
-    Entry = Data.define(:id, :limit_sec, :note_only, :failures) do
-      def initialize(id:, limit_sec: nil, note_only: false, failures: 0) = super
+    Entry = Data.define(:id, :limit_sec, :early_sec, :note_only, :failures) do
+      def initialize(id:, limit_sec: nil, early_sec: nil, note_only: false, failures: 0) = super
     end
 
     # A task whose note or look failed this often still gets tried at each
@@ -41,6 +43,7 @@ module Samagotchi
     TASK_LINE = /\A#{Tools::TaskRuntime::RAN_AS_LINE}(?:\[task_(?:wait|get|stop)\]\n)?task_id: (\S+)/
     LOOK_TOOLS = %w[task_wait task_get task_stop].freeze
     HANDED_OVER_LIMIT = /#{Regexp.escape(Tools::Execute::HANDED_OVER)} (\d+)s limit/
+    HANDED_OVER_EARLY = /#{Regexp.escape(Tools::Execute::HANDED_OVER)} (\d+)s mark/
 
     MODE_KEY = "session.task_wakes"
     MODES = %w[wake queue off].freeze
@@ -75,16 +78,18 @@ module Samagotchi
       output = event[:output].to_s
       output = output.scrub unless output.valid_encoding?
       if (id = Tools::TaskRuntime.created_id(tool, output))
-        add(id, limit_sec: tool == Tools::Execute::NAME ? output[HANDED_OVER_LIMIT, 1]&.to_i : nil)
+        executed = tool == Tools::Execute::NAME
+        add(id, limit_sec: executed ? output[HANDED_OVER_LIMIT, 1]&.to_i : nil,
+                early_sec: executed ? output[HANDED_OVER_EARLY, 1]&.to_i : nil)
       elsif LOOK_TOOLS.include?(tool) && (id = output[TASK_LINE, 1])
         touched(id)
         remove(id) if seen?(tool, output)
       end
     end
 
-    def add(id, limit_sec: nil)
+    def add(id, limit_sec: nil, early_sec: nil)
       @mutex.synchronize do
-        @entries[id] = Entry.new(id: id, limit_sec: limit_sec)
+        @entries[id] = Entry.new(id: id, limit_sec: limit_sec, early_sec: early_sec)
         @turn_ids << id
       end
     end

data/lib/samagotchi/tool_activity.rb

@@ -264,8 +264,8 @@ module Samagotchi
       "ok"
     end
 
-    # An execute still running at its limit, handed over as a task
-    # (Tools::Execute::HANDED_OVER).
+    # An execute still running at its limit (or when a message from the user
+    # waited), handed over as a task (Tools::Execute::HANDED_OVER).
     def handed_over?(tool_name, text)
       return false unless tool_name == Tools::Execute::NAME && text.to_s.start_with?(Tools::Execute::HANDED_OVER)
 
@@ -273,7 +273,7 @@ module Samagotchi
       text.to_s.each_line.first.to_s.scrub.match?(HANDED_OVER_START)
     end
 
-    HANDED_OVER_START = /\A#{Regexp.escape(Tools::Execute::HANDED_OVER)} \d+s limit:/
+    HANDED_OVER_START = /\A#{Regexp.escape(Tools::Execute::HANDED_OVER)} #{Tools::Execute::HANDED_OVER_AFTER}/
 
     def execute_failed?(text)
       code = execute_exit_code(text)

data/lib/samagotchi/tool_declarations.rb

@@ -20,7 +20,7 @@ module Samagotchi
     TOOL_SCHEMAS = [
       {
         name: "execute",
-        description: "Run any shell command in a working directory (defaults to the project root) and see stdout, stderr, and exit code. Large output may be truncated to a head+tail preview with metadata. A command still running at the time limit keeps running as a background task (by default): the result gives its task_id, and task_wait waits for it. Don't background with &; use task_create.",
+        description: "Run any shell command in a working directory (defaults to the project root) and see stdout, stderr, and exit code. Large output may be truncated to a head+tail preview with metadata. A command still running at the time limit, or after a few seconds when a message from the user is waiting, keeps running as a background task (by default): the result gives its task_id, and task_wait waits for it. Don't background with &; use task_create.",
         parameters: {
           type: "object",
           properties: {
@@ -395,7 +395,7 @@ module Samagotchi
       },
       {
         name: "delegate_result",
-        description: "Wait for a delegated child session's next reply, only when this turn can't go on without it: the child named, or this session's newest running child (name the child when a delegate report is about it). After delegate with wait false you don't need this: chi brings each child's reply by itself as a delegate report, also when you are idle, so end your turn or keep working instead of waiting here. A delegate report already carries the reply: don't call this for it. Returns early if the child waits for a question the user must answer. A tool call the child needs approved goes to your user while this waits; the result says how it was answered.",
+        description: "Wait for a delegated child session's next reply, only when this turn can't go on without it: the child named, or this session's newest running child (name the child when a delegate report is about it). After delegate with wait false you don't need this: chi brings each child's reply by itself as a delegate report, also when you are idle, so end your turn or keep working instead of waiting here. A delegate report already carries the reply: don't call this for it. Returns early if the child waits for a question the user must answer, or a message from the user arrives (the child keeps running). A tool call the child needs approved goes to your user while this waits; the result says how it was answered.",
         parameters: {
           type: "object",
           properties: {

data/lib/samagotchi/tools/builtins.rb

@@ -92,6 +92,7 @@ module Samagotchi
         end,
         Execute::NAME => lambda do |call, kctx|
           Execute.call(call[:content], cwd: call[:cwd], cancelled: cancelled_proc(kctx), stop_reason: stop_reason_proc(kctx),
+                                       message_waiting: input_waiting_proc(kctx),
                                        **participant_execute(kctx, project_env(kctx).merge(parent_env(kctx))))
         end,
         RegisterReminder::NAME => lambda do |call, kctx|
@@ -202,7 +203,7 @@ module Samagotchi
 
       # A person's message waits for the turn's next boundary
       # (Engine#input_waiting?, through its PeerView): a task_wait returns on
-      # it. A kernel whose peers can't tell: never.
+      # it, an execute hands its command over early. A kernel whose peers can't tell: never.
       def input_waiting_proc(kctx)
         peers = kctx.peers
         -> { peers.respond_to?(:input_waiting?) && !!peers.input_waiting? }

data/lib/samagotchi/tools/delegate_wait.rb

@@ -63,6 +63,7 @@ module Samagotchi
         sd = peers.state_dir || Session.default_state_dir
         key = [peers.session_id, child_id]
         cancelled = -> { peers.cancelled? }
+        message_waiting = -> { peers.respond_to?(:input_waiting?) && !!peers.input_waiting? }
         relay = peers.respond_to?(:relay) ? peers.relay : nil
         reports = reports_mode(peers)
         others = relay && others_for(peers.session_id, child_id, relay, sd)
@@ -80,7 +81,7 @@ module Samagotchi
           wait = ReplyWait.call(child_id, state_dir: sd, cursor: cursor.reply_file, timeout: [left, 0].max,
                                           poll_interval: poll_interval, cancelled: cancelled, baseline: baseline,
                                           owner_grace: owner_grace, interject: others && -> { others.poll },
-                                          turn: cursor.turn)
+                                          turn: cursor.turn, message_waiting: message_waiting)
           left -= monotonic - started
           unless wait.status == :waiting_for_answer &&
                  DelegateRelay.relayable?(relay, wait.question, strategy: Guardrails::ParentPolicy.for_session(wait.session),
@@ -91,7 +92,9 @@ module Samagotchi
               file = movement.cursor.report_claim&.file || wait.file
               return already_reported_result(child_id, file, state_dir: sd)
             end
-            return already_reported_result(child_id, report_claim.file, state_dir: sd) if report_claim && wait.status == :timeout
+            if report_claim && %i[timeout message_waiting].include?(wait.status)
+              return already_reported_result(child_id, report_claim.file, state_dir: sd)
+            end
 
             text = with_outcomes(finish(wait, child_id, timeout: timeout, reports: reports), outcomes)
             return RefText.wrap(text, reply_path(child_id, wait, state_dir: sd))
@@ -158,6 +161,22 @@ module Samagotchi
         result(child_id, "running", "wait canceled; the child keeps running; chi brings its reply as a delegate report")
       end
 
+      # A person's message waits for this turn's next step (ReplyWait's
+      # :message_waiting, Engine#input_waiting?): the wait ends with no reply
+      # yet and the child untouched, as a cancel does. The cursor didn't
+      # move, so the reply still comes (a delegate report, or the next
+      # delegate_result).
+      def message_waiting_result(child_id, reports: "off")
+        head = "no reply yet: a message from the user is waiting; the child keeps running. Read the message first."
+        if reports == "off"
+          return result(child_id, "running", "#{head} delegate_result #{child_id} waits again; chi --attach #{child_id} shows it.")
+        end
+
+        result(child_id, "running",
+               "#{head} chi brings its reply as a delegate report; delegate_result #{child_id} waits again only if " \
+               "this turn needs it.")
+      end
+
       def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
       REPORT_NEXT_REPLY = "chi brings the child's next reply here by itself; don't wait for it with delegate_result."
@@ -230,6 +249,8 @@ module Samagotchi
           result(child_id, status, waiting_text(child_id, wait.question, report: report, reports: reports, strategy: strategy))
         when :canceled
           canceled_result(child_id, reports: reports)
+        when :message_waiting
+          message_waiting_result(child_id, reports: reports)
         when :no_reply
           result(child_id, status, "#{no_reply_text(wait, child_id, strategy: strategy)}; its session shows what happened")
         when :worker_gone

data/lib/samagotchi/tools/execute.rb

@@ -68,10 +68,20 @@ module Samagotchi
       # record is gone or is older than RETENTION_DAYS.
       ORPHAN_AGE_SEC = 24 * 3600
       RETENTION_DAYS = 14
-      # The first words of a command still running at the limit and handed
-      # over as a task (handed_over_line). TaskRuntime.handed_over_id, the
-      # web's task_stop.js and the slow-commands bundle match on them.
+      # The first words of a command still running and handed over as a
+      # task (handed_over_line at the limit, early_handed_over_line for a
+      # message). TaskRuntime.handed_over_id, the web's task_stop.js and the
+      # slow-commands bundle match on them; the bundle reads only the limit's
+      # form, "at the 120s limit".
       HANDED_OVER = "Still running at the"
+      # What follows HANDED_OVER on the first line, as regexp source: "120s
+      # limit:" (the limit) or "4s mark:" (a message from the user ended the
+      # wait early). Every matcher of the line builds on it.
+      HANDED_OVER_AFTER = "(?:\\d+s limit|\\d+s mark):"
+      # A message from the user waiting for the turn hands a command over
+      # early, but never before it has run this long: a short command ends
+      # on its own first, and its result is the better answer.
+      EARLY_HAND_OVER_FLOOR_SEC = 3
 
       def self.name        = NAME
 
@@ -80,6 +90,14 @@ module Samagotchi
         "#{HANDED_OVER} #{Integer(limit_sec)}s limit: moved to a background task, not killed."
       end
 
+      # A hand-over result's first line when a message from the user is
+      # waiting (the command ran +elapsed_sec+ seconds); its "task_id: …"
+      # line follows it.
+      def self.early_handed_over_line(elapsed_sec)
+        "#{HANDED_OVER} #{Integer(elapsed_sec)}s mark: a message from the user is waiting, " \
+          "so the command moved to a background task, not killed."
+      end
+
       # @param cancelled [#call] true once the user stopped the turn: the
       #   command is killed (or not started) and its output so far returned
       # @param stop_reason [#call] the stop's reason (:signal: a signal to
@@ -91,7 +109,13 @@ module Samagotchi
       #   may set those keys (task_create refuses them from the model)
       # @param on_timeout [Symbol, String, nil] :task or :kill (ON_TIMEOUT);
       #   nil reads execute.on_timeout
-      def self.call(command, cwd: nil, cancelled: -> { false }, stop_reason: -> {}, env: nil, on_timeout: nil)
+      # @param message_waiting [#call] true once a person's message waits for
+      #   the turn's next step (Engine#input_waiting?): in :task mode, after
+      #   EARLY_HAND_OVER_FLOOR_SEC, the command is handed over as a task at
+      #   once, not at the limit. Never read in :kill mode, which never
+      #   hands a command over.
+      def self.call(command, cwd: nil, cancelled: -> { false }, stop_reason: -> {}, env: nil, on_timeout: nil,
+                    message_waiting: -> { false })
         return not_run(stop_reason) if cancelled.call
 
         command = command.strip
@@ -101,7 +125,8 @@ module Samagotchi
         sweep_leftovers_once
         timeout_sec = timeout_seconds
         stdout, stderr, status, held_open = run_command(command, timeout_sec: timeout_sec, cwd: resolved_cwd, cancelled: cancelled,
-                                                                 env: env, on_timeout: on_timeout_mode(on_timeout))
+                                                                 env: env, on_timeout: on_timeout_mode(on_timeout),
+                                                                 message_waiting: message_waiting)
 
         stdout_block = output_block("stdout", stdout)
         stderr_block = output_block("stderr", stderr)
@@ -162,12 +187,14 @@ module Samagotchi
       # group reading the terminal would stop on SIGTTIN. The shell is
       # detached at once; the waiter it returns reaps it, also after a
       # hand-over, so it never stays a zombie.
-      def self.run_command(command, timeout_sec:, cwd:, cancelled: -> { false }, env: nil, on_timeout: :task)
+      def self.run_command(command, timeout_sec:, cwd:, cancelled: -> { false }, env: nil, on_timeout: :task,
+                           message_waiting: -> { false })
         status = nil
         timed_out = false
         was_cancelled = false
         aborted = false
         handed_over = false
+        early_tried = false
         held_open = false
         started_at = Time.now
         started = monotonic_time
@@ -201,6 +228,19 @@ module Samagotchi
             elsif monotonic_time > deadline
               timed_out = true
               break
+            elsif !early_tried && on_timeout == :task && monotonic_time - started >= EARLY_HAND_OVER_FLOOR_SEC &&
+                  message_waiting.call
+              # One try: a command that can't be adopted goes on to its limit.
+              early_tried = true
+              task = TaskRecord.running(id: id, command: command, cwd: cwd, pid: pid, started_at: started_at.utc.iso8601,
+                                        output_path: logs[0], stderr_path: logs[1], exit_code_path: exit_code_path)
+              text = hand_over(task, waiter: wait_thr, timeout_sec: timeout_sec, dir: dir,
+                                     early_sec: monotonic_time - started)
+              if text
+                handed_over = true
+                Log.info(:turn, "execute_handed_over", id: id, after_sec: (monotonic_time - started).round, early: true)
+                raise HandedOver, text
+              end
             end
           end
           # Ended right at the deadline: finished, not timed out.
@@ -345,8 +385,10 @@ module Samagotchi
       # (+dir+); a back-pointer in that dir names the record for the sweep. nil when it can't be adopted (the caller
       # then kills it as in :kill mode) or when it ended meanwhile (the
       # caller then reads it as finished).
+      # @param early_sec [Numeric, nil] set when a message from the user ended
+      #   the wait before the limit: the seconds the command had run
       # @return [String, nil] the HANDED_OVER result
-      def self.hand_over(task, waiter:, timeout_sec:, dir:)
+      def self.hand_over(task, waiter:, timeout_sec:, dir:, early_sec: nil)
         return nil unless waiter.alive?
 
         record, error = TaskRuntime.adopt(task)
@@ -356,8 +398,8 @@ module Samagotchi
         TaskRuntime.record_exit_status(waiter, record.exit_code_path, task_id: record.id)
         # Ended between the deadline and the adopt: the record says how.
         TaskRuntime.get_record(record.id) unless waiter.alive?
-        lines = [handed_over_line(timeout_sec), "task_id: #{record.id}",
-                 "Wait for it with task_wait (it may take minutes); task_stop stops it."]
+        lines = [early_sec ? early_handed_over_line(early_sec) : handed_over_line(timeout_sec), "task_id: #{record.id}",
+                 "#{"Read the message first. " if early_sec}Wait for it with task_wait (it may take minutes); task_stop stops it."]
         { "stdout" => record.output_path, "stderr" => record.stderr_path }.each do |label, path|
           tail = TaskRuntime.output_tail_lines(path, HAND_OVER_TAIL_LINES)
           lines << "#{label} (so far, tail):\n#{tail.chomp}" unless tail.empty?

data/lib/samagotchi/tools/task_runtime.rb

@@ -269,7 +269,7 @@ module Samagotchi
       end
 
       def handed_over_pattern
-        @handed_over_pattern ||= /\A#{RAN_AS_LINE}(?:\[#{Execute::NAME}\]\n)?#{Regexp.escape(Execute::HANDED_OVER)} \d+s limit:[^\n]*\ntask_id: (\S+)/
+        @handed_over_pattern ||= /\A#{RAN_AS_LINE}(?:\[#{Execute::NAME}\]\n)?#{Regexp.escape(Execute::HANDED_OVER)} #{Execute::HANDED_OVER_AFTER}[^\n]*\ntask_id: (\S+)/
       end
 
       # A task id as task_create makes them: no path parts.

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.138.0"
+  VERSION = "0.139.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -4,8 +4,6 @@ require "cgi/escape" # CGI.escapeHTML; Ruby 4.0 ships only cgi/escape
 require "digest"
 require "fileutils"
 require "json"
-require "open3"
-require "rbconfig"
 require "rubygems/version"
 require "time"
 require "uri"
@@ -76,6 +74,7 @@ require_relative "session_control"
 require_relative "verify_fresh_routes"
 require_relative "push_routes"
 require_relative "update_check"
+require_relative "update_ops"
 require_relative "proxy_gate"
 require_relative "../log"
 require_relative "../paths"
@@ -130,7 +129,13 @@ module Samagotchi
       # A callable the event loops ask whether the server still runs;
       # Server.start points it at WEBrick's status once it has the server.
       attr_writer :server_running
-      attr_writer :restart_web
+      # The update operations the routes ask for (Server.start hands the same to AutoUpdate).
+      attr_reader :update_ops
+
+      # Set by Server.start: how chi web restarts itself (UpdateOps#restart_web=).
+      def restart_web=(restarter)
+        @update_ops.restart_web = restarter
+      end
 
       # @param bridge_wait_timeout [Float] bounded seconds to wait for a
       #   freshly-spawned worker's bridge before answering POST /api/sessions.
@@ -165,6 +170,8 @@ module Samagotchi
       #   nil: off (no https public_url, or web.push.enabled false)
       # @param start_dir [String] the folder chi web starts in (StartDir):
       #   where a new session without a dir starts (nil: the cwd)
+      # @param update_ops [UpdateOps, nil] the update operations (nil: built
+      #   from +update_runner+ and +update_blocked+, the specs' seams)
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
                      bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
@@ -173,7 +180,7 @@ module Samagotchi
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
                      working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
                      grants: nil, public_url: nil, public_token: nil, push: nil, start_dir: nil, update_runner: nil,
-                     update_blocked: nil)
+                     update_blocked: nil, update_ops: nil)
         @start_dir = start_dir
         @manager = manager || SessionManager
         @registry = registry
@@ -198,10 +205,8 @@ module Samagotchi
         @refused_logged = {}
         @wait_poll_interval = wait_poll_interval
         @push = push
-        @update_mutex = Mutex.new
-        @update_running = false
-        @update_runner = update_runner || method(:run_update_command)
-        @update_blocked = update_blocked || -> { UpdateCheck.blocked_reason }
+        @update_ops = update_ops || UpdateOps.new(hub: hub, manager: @manager, state_dir: state_dir,
+                                                  runner: update_runner, blocked: update_blocked)
         init_participant_access(grants, state_dir)
         init_proxy_gate(public_url, public_token)
       end
@@ -734,169 +739,36 @@ module Samagotchi
         end
 
         # Found out here, not from the hub: UpdateCheck (off with update.notify: off) is what tells it.
-        blocked = @update_blocked.call
+        blocked = @update_ops.blocked_reason
         return json_response(409, { error: "update_blocked", reason: blocked }) if blocked
 
-        already_running = @update_mutex.synchronize do
-          if @update_running
-            true
-          else
-            @update_running = true
-            false
-          end
-        end
-        return error_response(409, "update_running", UPDATE_RUNNING) if already_running
-
-        @hub.publish_update(state: "running", rows: [], operation: "install", version: version)
-        Thread.new { perform_update(version) }
-        json_response(202, { state: "running", version: version })
-      rescue ThreadError => e
-        @update_mutex.synchronize { @update_running = false }
-        Log.warn(:web, "update_start_failed", error: e.class.name, msg: e.message)
-        @hub&.publish_update(state: "failed", rows: [
-          { "component" => "chi update", "status" => "failed (couldn't start update)", "failed" => true, "kept" => [] }
-        ], operation: "install")
-        error_response(503, "update_start_failed", "couldn't start chi update")
-      end
-
-      # The chi update child: with a chi home, the home's chi (its gem dirs
-      # are what new workers activate); else this Ruby and the wrapper.
-      def update_argv(version, home: ChiHome.current)
-        args = ["update", "--to", version, "--no-desktop", "--json"]
-        return home.boot_argv(run: ChiHome::CHI_BOOT) + ["--", *args] if home
-
-        [RbConfig.ruby, InstalledGem.wrapper, *args]
-      end
-
-      def perform_update(version)
-        argv = update_argv(version)
-        said = nil
-        output, success = @update_runner.call(argv, env: ChildEnv.unbundled,
-                                              progress: lambda { |line|
-                                                said = line unless line.strip.empty?
-                                                @hub.publish_update(state: "running", rows: [], progress: line,
-                                                                    operation: "install", version: version)
-                                              })
-        rows = update_rows(output)
-        # No rows (a usage error, a refusal): what the child said is the reason.
-        raise UpdateFailed, said || output.lines.map(&:strip).find { |line| !line.empty? } || "chi update printed no rows" unless rows
-
-        # The installed version as of now (the hub's own look is up to a probe interval old), before "done".
-        @hub.refresh_installed if success
-        @hub.publish_update(state: success ? "done" : "failed", rows: rows, operation: "install", version: version)
-      rescue StandardError => e
-        Log.exception(:web, "update_failed", e)
-        @hub.publish_update(state: "failed", rows: [
-          { "component" => "chi update", "status" => "failed (#{e.message.lines.first.to_s.strip})",
-            "failed" => true, "kept" => [] }
-        ], operation: "install", version: version)
-      ensure
-        @update_mutex.synchronize { @update_running = false }
-      end
-
-      # chi update's own words when it printed no rows.
-      class UpdateFailed < StandardError; end
-
-      # chi update --json's rows, or nil when it printed none.
-      def update_rows(output)
-        rows = JSON.parse(output)
-        rows if rows.is_a?(Array) && rows.all?(Hash)
-      rescue JSON::ParserError
-        nil
-      end
-
-      def run_update_command(argv, env:, progress:)
-        Open3.popen3(env, *argv) do |stdin, stdout, stderr, wait_thread|
-          stdin.close
-          stderr_thread = Thread.new { stderr.each_line { |line| progress.call(line.chomp) } }
-          output = stdout.read
-          stderr_thread.value
-          [output, wait_thread.value.success?]
+        case @update_ops.install(version)
+        when :busy then error_response(409, "update_running", UPDATE_RUNNING)
+        when :start_failed then error_response(503, "update_start_failed", "couldn't start chi update")
+        else json_response(202, { state: "running", version: version })
         end
       end
 
       def handle_restart_workers(_req)
         return error_response(503, "no_hub", "this chi web has no session hub") unless @hub
 
-        already_running = @update_mutex.synchronize do
-          if @update_running
-            true
-          else
-            @update_running = true
-            false
-          end
+        case @update_ops.restart_workers
+        when :busy then error_response(409, "update_running", UPDATE_RUNNING)
+        when :start_failed then error_response(503, "restart_start_failed", "couldn't start worker restarts")
+        else json_response(202, { state: "running" })
         end
-        return error_response(409, "update_running", UPDATE_RUNNING) if already_running
-
-        @hub.publish_update(state: "running", rows: [], operation: "workers")
-        Thread.new { perform_worker_restarts }
-        json_response(202, { state: "running" })
-      rescue ThreadError => e
-        @update_mutex.synchronize { @update_running = false }
-        Log.warn(:web, "worker_restart_start_failed", error: e.class.name, msg: e.message)
-        @hub&.publish_update(state: "failed", rows: [
-          { "state" => "failed", "reason" => "couldn't start worker restarts" }
-        ], operation: "workers")
-        error_response(503, "restart_start_failed", "couldn't start worker restarts")
-      end
-
-      def perform_worker_restarts
-        # Installed now: the hub's own look is up to a full probe old (nil right after chi web started).
-        target = @hub.refresh_installed || VERSION
-        rows = []
-        LiveVersions.stale_workers(target, state_dir: default_state_dir).each do |worker|
-          row = begin
-            restarted = @manager.restart_session(worker.session_id, state_dir: @state_dir, client_id: ClientId::WEB_RESTART)
-            @hub.touch(worker.session_id)
-            { "session_id" => restarted.session_id, "state" => "restarted", "from_version" => restarted.from_version,
-              "version" => restarted.version }
-          rescue SessionManager::RestartRefused => e
-            # detail: the refusal's own words (RestartRefused.words), the reason code for clients.
-            { "session_id" => worker.session_id, "state" => "refused", "reason" => e.reason.to_s,
-              "detail" => e.message, "holds" => e.holds.map(&:to_s) }
-          rescue SessionManager::OwnedByTUI => e
-            { "session_id" => worker.session_id, "state" => "owned_by_tui", "detail" => e.message }
-          rescue StandardError => e
-            Log.exception(:web, "worker_restart_failed", e, sid: worker.session_id)
-            { "session_id" => worker.session_id, "state" => "failed", "reason" => e.class.name, "detail" => e.message }
-          end
-          rows << row
-          @hub.publish_update(state: "running", rows: rows.dup, operation: "workers")
-        end
-        state = rows.any? { |row| row["state"] == "failed" } ? "failed" : "done"
-        @hub.publish_update(state: state, rows: rows, operation: "workers")
-      rescue StandardError => e
-        Log.exception(:web, "worker_restart_failed", e)
-        @hub.publish_update(state: "failed", rows: [
-          { "state" => "failed", "reason" => e.class.name, "detail" => e.message }
-        ], operation: "workers")
-      ensure
-        @update_mutex.synchronize { @update_running = false }
       end
 
-      # The exec replaces this process: an update's chi update child (its
-      # pipes read here) or a worker restart pass would die mid-way, so
-      # neither may run, and none starts once the restart is asked for.
       def handle_restart_web(_req)
-        return error_response(503, "restart_unavailable", "chi web cannot restart itself in this process") unless @restart_web
-
-        busy = @update_mutex.synchronize do
-          next true if @update_running
-
-          @update_running = true # held for good once restarting: the exec ends this process
-          false
-        end
-        return error_response(409, "update_running", UPDATE_RUNNING) if busy
-
-        case @restart_web.call
-        when true then return json_response(202, { state: "restarting" })
+        case @update_ops.restart_web
+        when :unavailable then error_response(503, "restart_unavailable", "chi web cannot restart itself in this process")
+        when :busy then error_response(409, "update_running", UPDATE_RUNNING)
+        when :started then json_response(202, { state: "restarting" })
         when :no_wrapper
-          refusal = error_response(409, "restart_unavailable", "no chi wrapper to restart into (installed with --bindir?); " \
-                                                               "restart chi web in its terminal")
-        else refusal = error_response(409, "restart_requested", "chi web is already restarting")
+          error_response(409, "restart_unavailable", "no chi wrapper to restart into (installed with --bindir?); " \
+                                                     "restart chi web in its terminal")
+        else error_response(409, "restart_requested", "chi web is already restarting")
         end
-        @update_mutex.synchronize { @update_running = false }
-        refusal
       end
 
       def unauthorized(req)
@@ -1144,7 +1016,7 @@ module Samagotchi
       def handle_info(req)
         return participant_info unless principal(req).owner?
 
-        chi_state = @hub&.chi_state || { version: Samagotchi::VERSION, installed: nil, available: nil, update_blocked: nil }
+        chi_state = @hub&.chi_state || { version: Samagotchi::VERSION, installed: nil, available: nil, update_blocked: nil, auto: "off" }
         json_response(200, { app: "chi-web", **chi_state, pid: Process.pid,
                              cwd: Dir.pwd, start_dir: start_dir, features: INFO_FEATURES, lan: @lan && @lan[:ip],
                              proxy: @public_url && { identity_header: @public_url.identity_header } })