samagotchi 0.146.0 → 0.148.0

data/lib/samagotchi/guardrail_wiring.rb

@@ -323,7 +323,7 @@ module Samagotchi
       # one that passes every gate is allowed once without reaching them
       # (docs/guardrails.md, "System 1").
       judgment = begin
-        system_one_judge(payload, targets: verdict.targets)
+        system_one_judge(payload, targets: verdict.targets, ask_user: verdict.fresh_ask? || verdict.second_rule_ask?)
       rescue LLM::RequestCancelled
         return turn_stopped(verdict)
       end
@@ -366,8 +366,9 @@ module Samagotchi
     # auto-allowed: its asks go to the owner. No client (mode off, no
     # host) means no line at all. A judgment that fails is logged with p nil,
     # so the failures are in the log too.
+    # With +ask_user+ (a fresh ask, a second rule's) it is judged and logged, never answered.
     # @return [Hash, nil] {id:, p:, auto:}, nil when nothing was written
-    def system_one_judge(payload, targets: nil)
+    def system_one_judge(payload, targets: nil, ask_user: false)
       return nil if Steer.participant_author?(turn_author)
 
       client = @system_one.call
@@ -397,13 +398,13 @@ module Samagotchi
       end
       latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
       p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
-      auto = system_one_auto_allow?(client, approval, p, entries, targets: targets)
+      auto = !ask_user && system_one_auto_allow?(client, approval, p, entries, targets: targets)
       decision = system_one_decision(client, auto)
 
       id = log.judgment(id: run_id, session_id: @session_lookup.call&.id,
                         rule: approval.rule, source: approval.source, tool: approval.tool,
                         **SystemOne::ApprovalQuestion.call_fields(approval),
-                        repo_name: approval.repo_name,
+                        repo_name: approval.repo_name, repo: targets&.repo,
                         p: p, threshold: Config.get("guardrails.system_one.threshold"), model: client.model,
                         latency_ms: latency_ms, decision: decision, origin: "live")
       # A judgment the log cannot hold is no judgment: the user is asked.
@@ -443,7 +444,8 @@ module Samagotchi
 
     # Every gate an auto-allow must pass, in order: the mode, the rule the
     # user opted in, the never-list and chi's own files, the probability, and
-    # the rule's record. Any one that fails leaves the ask to the user. The
+    # the rule's record (this repo's for a rule that goes by repo; with no repo
+    # that is none). Any one that fails leaves the ask to the user. The
     # entries are the judgment log read once for this ask.
     # @param approval [Guardrails::ApprovalFacts] the ask's facts
     # @param entries [Array<Hash>] SystemOne::Log#entries
@@ -460,7 +462,10 @@ module Samagotchi
       return false if p.nil? || p.to_f < threshold
 
       min_record = Config.get("guardrails.system_one.min_record").to_i
-      SystemOne::Record.new(entries, rule: rule).qualifies?(threshold: threshold, min_record: min_record)
+      per_repo = SystemOne::Record.per_repo?(rule)
+      return false if per_repo && targets&.repo.nil?
+
+      SystemOne::Record.new(entries, rule: rule, repo: (targets.repo if per_repo)).qualifies?(threshold: threshold, min_record: min_record)
     rescue StandardError => e
       Samagotchi::Log.warn(:guardrails, "system_one_gate_failed", error: "#{e.class}: #{e.message}")
       false

data/lib/samagotchi/guardrails/approvals.rb

@@ -80,7 +80,9 @@ module Samagotchi
           case e["scope"]
           when "session" then session_id && e["session_id"] == session_id && e["key"] == key
           when "repo" then here.call(e) && e["key"] == key
-          when "rule" then verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source && here.call(e)
+          when "rule"
+            # One rule's grant can't answer for a second rule's ask on the call.
+            !verdict.second_rule_ask? && verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source && here.call(e)
           end
         end
       end

data/lib/samagotchi/guardrails/rules.rb

@@ -310,10 +310,13 @@ module Samagotchi
         @disable.reject { |entry| @rules.any? { |rule| disables?(entry, rule) } }
       end
 
-      # A core check: every matching rule votes (strictest wins).
+      # A core check: every matching rule votes (strictest wins). A second
+      # rule id that asks takes rule grants out (Verdict#second_rule_asks!);
+      # asks from before the rules (the child boundary's) stay as they are.
       def check(verdict)
         return verdict unless @enabled
 
+        asking = nil
         @rules.each do |rule|
           next if disabled?(rule)
           next unless rule.for_mode?(@mode)
@@ -323,6 +326,8 @@ module Samagotchi
             verdict.deny!(rule.reason, rule: rule.id, source: rule.source, decided_by: "rule")
           else
             verdict.ask!(rule.reason, scopes: rule.scopes, rule: rule.id, source: rule.source, decided_by: "rule")
+            verdict.second_rule_asks!(rule.scopes) if asking && asking != rule.id
+            asking ||= rule.id
           end
         end
         verdict

data/lib/samagotchi/guardrails/verdict.rb

@@ -8,7 +8,8 @@ module Samagotchi
     # first one stays, except that a protected rule's ask (PROTECTED_RULES)
     # takes over an unprotected ask: its rule id is what a parent's answer
     # and a stored approval are checked against, and the offered scopes
-    # narrow to both asks' common ones.
+    # narrow to both asks' common ones. A second rule's ask takes rule grants
+    # out (#second_rule_asks!): the one id it keeps can't answer for both.
     class Verdict
       STRICTNESS = { allow: 0, ask: 1, deny: 2 }.freeze
       # Rules that ask about chi's own config and hooks: the core
@@ -47,6 +48,9 @@ module Samagotchi
 
       def fresh_ask? = @fresh_ask == true
 
+      # Whether a second distinct rule asks about this call (#second_rule_asks!).
+      def second_rule_ask? = @second_rule_ask == true
+
       def initialize(call:)
         @call = call
         @decision = :allow
@@ -84,6 +88,22 @@ module Samagotchi
         self
       end
 
+      # A second distinct rule asks about this call (Rules#check). The ask
+      # names one rule, and a rule grant or System 1's record is about that
+      # rule alone, so neither answers for the other's: no rule-scope entry
+      # matches it (Approvals.find_in), System 1 doesn't auto-allow it, and it
+      # offers what both rules allow, minus the rule. An exact-call entry
+      # (session, repo) still answers: it is keyed on the whole command.
+      # @param scopes [Array<String>, nil] the second rule's scopes (default all)
+      def second_rule_asks!(scopes = nil)
+        @second_rule_ask = true
+        allowed = Array(scopes).map(&:to_s) & SCOPES
+        allowed = SCOPES if allowed.empty?
+        left = (@scopes & allowed) - %w[rule]
+        @scopes = left.empty? ? %w[once] : left
+        self
+      end
+
       def self.protected_rule?(rule) = PROTECTED_RULES.include?(rule.to_s)
 
       # A before_tool_call hook set the old event[:blocked] flag. Its model

data/lib/samagotchi/guardrails_command.rb

@@ -8,6 +8,7 @@ require_relative "cli/flags"
 require_relative "config"
 require_relative "bridge/card_store"
 require_relative "guardrails/approval"
+require_relative "guardrail_wiring"
 require_relative "guardrails/approvals"
 require_relative "guardrails/parent_policy"
 require_relative "host_registry"
@@ -20,7 +21,10 @@ module Samagotchi
   # seed: System 1 judges every approval this machine's sessions already
   # answered, and the judgment and the user's answer go to the log as they
   # would live. A rule's record then starts with the asks the user really
-  # decided on, instead of waiting for a few days of live ones.
+  # decided on, instead of waiting for a few days of live ones. `rule` says
+  # whether one rule votes `ask` on this machine now, read from the config and
+  # the installed bundles as a worker reads them (GuardrailWiring#rules), by
+  # its id: the text of a command never comes near it.
   class GuardrailsCommand
     include CLI::Command
 
@@ -41,16 +45,24 @@ module Samagotchi
           --dry-run judges and prints the table without writing a line. Needs
           guardrails.system_one.mode audit or on and a system_one.host
           (exit 2 without one).
+        rule <id>
+          Print exactly "asks" when the rule is loaded, not disabled and votes
+          ask in this guardrails.mode for every model; another line says why not
+          when it isn't (exit 0 either way). Reads config.yml and the installed
+          bundles, as a worker does: no session, no model, nothing written.
     TEXT
 
-    SUBCOMMANDS = %w[replay].freeze
+    SUBCOMMANDS = %w[replay rule].freeze
     FLAGS = {
       "replay" => CLI::Flags.new(help: HELP_WORDS, args: false) do |f|
         f.switch "--dry-run"
         f.value "--threshold"
         f.value "--model"
-      end
+      end,
+      "rule" => CLI::Flags.new(help: HELP_WORDS)
     }.freeze
+    # What `rule` prints when a rule asks. An agent compares the line to it.
+    ASKS = "asks"
     # The labels that mean the user let the call through.
     ALLOW_LABELS = %w[allow_once allow_wide].freeze
     # replay's table, in column order: the rule, how many asks it had, how
@@ -135,6 +147,8 @@ module Samagotchi
       parsed = parse_flags(FLAGS.fetch(@sub), @argv[1..])
       return parsed if parsed.is_a?(Integer)
 
+      return rule(parsed.args) if @sub == "rule"
+
       replay(parsed.options)
     end
 
@@ -142,6 +156,36 @@ module Samagotchi
 
     def command_name = @sub ? "chi guardrails #{@sub}" : "chi guardrails"
 
+    def rule(args)
+      return usage_error("give one rule id") unless args.size == 1
+
+      @stdout.puts(rule_status(args.first))
+      CLI::Exit::OK
+    end
+
+    # The rule set as a worker would load it now, the rule's id looked up in
+    # it. Every other answer than ASKS names what stands in the way.
+    def rule_status(id)
+      wiring = GuardrailWiring.new(scratch: false, hooks: -> {}, tools: -> {}, session: -> {}, model_key: -> {},
+                                   cancelled: -> { false }, ask: ->(_fields) {})
+      rules = wiring.rules
+      failed = wiring.failures.required
+      return "rules failed to load: #{failed.map(&:what).join(", ")}" unless failed.empty?
+      return "guardrails are off (guardrails.enabled: false)" unless rules.enabled?
+
+      named = rules.rules.select { |r| r.id == id }
+      return "no rule #{id} is loaded" if named.empty?
+
+      enabled = named.reject { |r| rules.disabled?(r) }
+      return "rule #{id} is disabled (guardrails.disable)" if enabled.empty?
+
+      voting = enabled.select { |r| r.for_mode?(rules.mode) }
+      return "rule #{id} doesn't vote in guardrails.mode #{rules.mode}" if voting.empty?
+      return "rule #{id} denies" if voting.any? { |r| r.verdict == :deny }
+
+      voting.any? { |r| r.models.nil? } ? ASKS : "rule #{id} asks for some models only"
+    end
+
     def replay(options)
       threshold = threshold(options[:threshold])
       return usage_error(threshold) if threshold.is_a?(String)

data/lib/samagotchi/run_options.rb

@@ -207,6 +207,7 @@ module Samagotchi
                  chi memory <ls|rm> [--scope project|system]   the memories; rm moves one to the bundle trash
                  chi bundle <install|upgrade|uninstall|status|diff|list|build|trash|new|test|check|try>
                  chi guardrails replay [--dry-run] [--threshold T] [--model M]   seed System 1's record from answered approvals
+                 chi guardrails rule <id>         print "asks" if that rule votes ask on this machine now
                  chi judgments ls | report NAME  System 1's saved asks on this machine
                  chi toolkit report [--days N]   grade toolkit suggestions against the tools sessions used
                  chi desktop <install|upgrade|uninstall|status>   macOS "Send to chi" helper

data/lib/samagotchi/send_command.rb

@@ -76,7 +76,8 @@ module Samagotchi
                     in its folder, on its model (or --model's; one whose
                     host is gone falls back to the default, with a
                     warning), LLM context, thinking level, toolkit and
-                    bundle settings, with a note carrying its recap; it
+                    bundle settings, with a note carrying its recap and
+                    last answer; it
                     is archived.
                     last:ID names the chain's latest link.
                     Without -m the new session waits idle. Refused for a

data/lib/samagotchi/session_chain.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "answer_tail"
+require_relative "config"
+require_relative "log"
+require_relative "output_formatter"
 require_relative "session"
+require_relative "session_inbox"
+require_relative "steer"
 require_relative "recap_store"
 
 module Samagotchi
@@ -16,9 +22,16 @@ module Samagotchi
     LAST_PREFIX = "last:"
     # Who the carry note is from (ContextNote's label: "note from session chain").
     NOTE_SOURCE = "session chain"
-    # The most of the previous link's recap the carry note takes; a recap is
-    # a few sentences, this only keeps a runaway one under the note's 16 KiB.
+    # The most of the previous link's recap a note takes; a recap is a few
+    # sentences. Characters, not bytes: #note_text holds the carry note to
+    # SessionInbox::NOTE_MAX_BYTES itself.
     RECAP_CHARS = 8000
+    # The most of the previous link's last answer the carry note takes. A
+    # wrap-up closes on what comes next, so a longer one keeps its end.
+    LAST_ANSWER_CHARS = 4000
+    LAST_ANSWER_HEAD = "\n\nIts last answer:\n"
+    # The "…" that marks a cut, in bytes.
+    CUT_MARK_BYTES = 3
 
     module_function
 
@@ -63,14 +76,79 @@ module Samagotchi
     end
 
     # The context note a new link starts with: which session it continues,
-    # from when, and that session's recap with its time, when it has one.
-    # Never more than the recap: no transcript.
-    # @param previous [Session]
+    # from when, that session's recap with its time, when it has one, and
+    # its last answer (#last_answer; session.carry_last_answer). No other transcript. Never over
+    # SessionInbox::NOTE_MAX_BYTES, whatever the session holds: the inbox
+    # rejects a longer note, and a continue writes it after the archive. The
+    # answer gets what the rest leaves.
+    # @param previous [Session] the answer is read fresh from its file
     # @param recap [Hash, nil] RecapStore.read's
     # @return [String]
-    def note_text(previous, recap:)
+    def note_text(previous, recap:, state_dir:)
       head = "This session continues #{previous.id[0, 8]} (#{clock(previous.created_at) || previous.created_at}), the previous link of its chain."
-      "#{head}#{recap_text(recap)}"
+      text = keep_start("#{head}#{recap_text(recap)}", SessionInbox::NOTE_MAX_BYTES)
+      room = SessionInbox::NOTE_MAX_BYTES - text.bytesize - LAST_ANSWER_HEAD.bytesize
+      answer = carried_answer(previous, room: room, state_dir: state_dir)
+      answer ? "#{text}#{LAST_ANSWER_HEAD}#{answer}" : text
+    end
+
+    # The last answer as the carry note takes it, in at most +room+ bytes;
+    # nil with session.carry_last_answer off, when there is none, when a
+    # review link has it (a continue copies review: but not the grants, so
+    # the next link's participants could differ) or when the session can't
+    # be read: this runs inside a continue's rollback, and a note without it
+    # is still a good note.
+    # @return [String, nil]
+    def carried_answer(previous, room:, state_dir:)
+      return nil if previous.review? || !Config.get("session.carry_last_answer")
+
+      text = last_answer(Session.load(previous.id, state_dir: state_dir).messages)
+      text && keep_end(text, room)
+    rescue StandardError => e
+      Log.warn(:worker, "continue_last_answer_failed", sid: previous.id, error: e.class.name, msg: e.message)
+      nil
+    end
+
+    # The session's last word: the text of AnswerTail's newest bubble, with
+    # the wire-format markup stripped, unless that bubble is a step of a
+    # turn (it asked for tools) or old text a later turn never replaced
+    # (one that failed or was cut before it answered). A cut reply keeps
+    # its "[interrupted]": that is what happened.
+    # @param messages [Array<Hash>]
+    # @return [String, nil]
+    def last_answer(messages)
+      found = AnswerTail.find(messages)
+      return nil unless found && found[:content].is_a?(String) && Array(found[:tool_calls]).empty?
+
+      at = messages.rindex { |m| m.equal?(found) }
+      return nil if messages[(at + 1)..].any? { |m| m[:role].to_s == "tool_response" || later_turn?(m) }
+
+      OutputFormatter.strip_markup(found[:content].scrub)
+    end
+
+    # A turn's opening, not a `!shell` line: a command the user ran after
+    # the answer leaves it the last word.
+    def later_turn?(message)
+      Steer.turn_prompt?(message) && !shell_line?(message)
+    end
+
+    # At most +max+ bytes of +text+'s start, cut on a character.
+    def keep_start(text, max)
+      return text if text.bytesize <= max
+
+      "#{text.byteslice(0, max - CUT_MARK_BYTES).scrub("")}…"
+    end
+
+    # +text+'s end: at most LAST_ANSWER_CHARS characters and +max+ bytes,
+    # with the "…" of a cut; nil when no character fits.
+    def keep_end(text, max)
+      return nil if max <= CUT_MARK_BYTES
+
+      text = "…#{text[(1 - LAST_ANSWER_CHARS)..]}" if text.length > LAST_ANSWER_CHARS
+      return text if text.bytesize <= max
+
+      kept = text.byteslice(-(max - CUT_MARK_BYTES), max - CUT_MARK_BYTES).scrub("")
+      kept.empty? ? nil : "…#{kept}"
     end
 
     # +recap+ as a note's tail: " Its recap, as of <time>:\n<text>" (cut
@@ -103,13 +181,18 @@ module Samagotchi
 
         text = msg[:content]
         next unless text.is_a?(String) && !text.strip.empty?
-        next if msg[:turn_id].nil? && text.start_with?("!(")
+        next if shell_line?(msg)
 
         return text.strip
       end
       nil
     end
 
+    # A stored `!shell` line: "!(cmd)\n<output>", no turn_id.
+    def shell_line?(message)
+      message[:turn_id].nil? && message[:content].is_a?(String) && message[:content].start_with?("!(")
+    end
+
     def clock(iso)
       iso && Time.iso8601(iso.to_s).localtime.strftime("%Y-%m-%d %H:%M")
     rescue ArgumentError

data/lib/samagotchi/session_commands.rb

@@ -534,7 +534,7 @@ module Samagotchi
         rules.each do |rule|
           summary = SystemOne::Record.new(entries, rule: rule).summary
           counts = summary.reject { |key, _| key == :rule }.map { |key, value| "#{key}=#{value}" }.join(", ")
-          lines << "    #{rule}: #{counts}"
+          lines << "    #{rule}#{" (per repo)" if SystemOne::Record.per_repo?(rule)}: #{counts}"
         end
       end
     end

data/lib/samagotchi/session_continue.rb

@@ -69,7 +69,8 @@ module Samagotchi
     # +id_or_ref+ (Session#continues) in its folder, on its model (the name
     # it was typed as, so an alias holds) and with its own setup (SessionSetup),
     # starting with a context note from chi: the link and the previous
-    # link's recap (SessionChain.note_text). +model+, when given, is the
+    # link's recap and last answer (SessionChain.note_text), read after the
+    # recap wait, so a turn that finished in it counts. +model+, when given, is the
     # new link's model instead; an inherited one whose host can't run it any
     # more (gone, disabled, an alias naming another host) falls back to the
     # default with a warning (#model_for). The previous link is archived
@@ -212,7 +213,7 @@ module Samagotchi
       link = SessionManager.spawn_session(
         prompt: start, preview: preview, title: previous.title, working_directory: previous.working_directory,
         model_name: choice.model, setup: SessionSetup.of(previous), review: previous.review,
-        continues: previous.id, note: SessionChain.note_text(previous, recap: recap),
+        continues: previous.id, note: SessionChain.note_text(previous, recap: recap, state_dir: state_dir),
         note_source: SessionChain::NOTE_SOURCE, state_dir: state_dir, before_spawn: before_spawn
       )
       link.moved_children = move

data/lib/samagotchi/system_one/record.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "../config"
+require_relative "../model_match"
+
 module Samagotchi
   module SystemOne
     # One rule's record: what System 1 has judged for it and what the user
@@ -7,7 +10,9 @@ module Samagotchi
     # joined with their last label), filtered to one rule. The gate before
     # System 1 answers for the user: enough clean allows at the threshold,
     # and no false allow among the rule's last 20 labelled asks
-    # (docs/guardrails.md, "System 1").
+    # (docs/guardrails.md, "System 1"). A rule in
+    # guardrails.system_one.repo_rules goes by repository: what the user allowed
+    # in one says nothing about another, so its record is built per repo.
     #
     # An ask with no label, no probability, or a `none` label counts for
     # neither side: only a judgment the user actually answered teaches
@@ -21,13 +26,22 @@ module Samagotchi
       # How many of the rule's labelled asks the false-allow check looks at.
       WINDOW = 20
 
+      # Whether +rule+'s record goes by repository
+      # (guardrails.system_one.repo_rules, read like .rules).
+      def self.per_repo?(rule)
+        ModelMatch.parse(Config.get("guardrails.system_one.repo_rules")).include?(rule.to_s)
+      end
+
       attr_reader :rule, :entries
 
       # @param entries [Array<Hash>] SystemOne::Log#entries, oldest first
       # @param rule [String] the rule the record is for
-      def initialize(entries, rule:)
+      # @param repo [String, nil] only this repository's asks (a judgment's
+      #   repo: Guardrails::Targets#repo, its common git dir); nil: all of the
+      #   rule's. A line with no repo is in no repository's record.
+      def initialize(entries, rule:, repo: nil)
         @rule = rule.to_s
-        @entries = Array(entries).select { |entry| entry["rule"].to_s == @rule }
+        @entries = Array(entries).select { |entry| entry["rule"].to_s == @rule && (repo.nil? || entry["repo"] == repo) }
       end
 
       # @param threshold [Float] the probability an auto-allow needs

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.146.0"
+  VERSION = "0.148.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -1018,7 +1018,7 @@ module Samagotchi
       def handle_info(req)
         return participant_info unless principal(req).owner?
 
-        chi_state = @hub&.chi_state || { version: Samagotchi::VERSION, installed: nil, available: nil, update_blocked: nil, auto: "off", restart: "idle" }
+        chi_state = @hub&.chi_state || { version: Samagotchi::VERSION, installed: nil, available: nil, update_blocked: nil, auto: "off", restart: "idle", auto_offers: nil }
         json_response(200, { app: "chi-web", **chi_state, pid: Process.pid,
                              cwd: Dir.pwd, start_dir: start_dir, features: INFO_FEATURES, lan: @lan && @lan[:ip],
                              proxy: @public_url && { identity_header: @public_url.identity_header } })

data/lib/samagotchi/web/auto_update.rb

@@ -3,6 +3,7 @@
 require "rubygems/version"
 require "time"
 require_relative "../config"
+require_relative "../installed_versions"
 require_relative "../log"
 require_relative "../version"
 require_relative "auto_update_record"
@@ -37,6 +38,17 @@ module Samagotchi
     # A preflight that fails leaves chi web as it is and says so.
     # update.restart: never stops after the install.
     #
+    # A newer chi installed some other way (a terminal's `chi update`, inside
+    # update.min_age_hours or not) is adopted: once it has settled and the
+    # gate is open, it gets a run from step 1 on. One run per version here
+    # too, so a restart that didn't take isn't tried again.
+    #
+    # The page offers no restart buttons for a run that will do them itself.
+    # It offers them again when this says so (SessionHub#auto_offer_restart):
+    # a run on record for the version ended with chi web still older, or
+    # something held it for HELD_FOR, a forgotten question or a long turn.
+    # The trying goes on behind that offer.
+    #
     # The run's record (AutoUpdateRecord) lives in update_check.json
     # (UpdateCheck#save_auto), so a chi web restart finds it. See
     # docs/architecture.md.
@@ -56,6 +68,13 @@ module Samagotchi
       OPEN_PHASES = %w[installed workers web].freeze
       # The phase after "chi updated" while workers are left.
       RETRYING = "retrying"
+      # A newer chi seen installed is adopted only this long after: `chi update`
+      # installs the gem first and merges the bundles after, with no lock or
+      # marker to look at. In practice the next POLL.
+      SETTLE = 60
+      # How long a newer installed chi may wait for its restart before the page
+      # offers the buttons again.
+      HELD_FOR = 3600
       # How long stop waits for the thread: long enough for a preflight
       # (Server::PREFLIGHT_TIMEOUT, 20 s; a healthy one takes about a
       # second) to end on its own, so a stop never abandons one mid-way.
@@ -84,6 +103,7 @@ module Samagotchi
         @wakeup = Queue.new
         @thread = nil
         @stopped = false
+        @seen = nil
       end
 
       def start
@@ -108,17 +128,17 @@ module Samagotchi
       def step
         return unless @auto == "install"
 
+        note_installed
         record = @check.auto_state
         return carry_on(record) if record && OPEN_PHASES.include?(record.phase)
 
         retry_left(record) if record&.phase == RETRYING
+        return if @ops.blocked_reason || @ops.running? || busy_turn?
 
         version = @check.available
-        return unless version
-        return if @check.auto_failed?(version) || tried?(version)
-        return if @ops.blocked_reason || @ops.running? || busy_turn?
+        return install(version) if version && !@check.auto_failed?(version) && !tried?(version)
 
-        install(version)
+        adopt_installed
       end
 
       private
@@ -158,6 +178,37 @@ module Samagotchi
         end
       end
 
+      # What is installed, ahead of every gate: since when a newer chi is, and
+      # whether the page should offer the restarts for it. A chi web restart
+      # starts the clock over, and finds a closed run's offer again here.
+      def note_installed
+        installed = @hub.refresh_installed
+        return @seen = nil unless InstalledVersions.newer?(installed)
+
+        now = @clock.call
+        @seen = [installed, now] unless @seen&.first == installed
+        @hub.auto_offer_restart(installed) if closed_run?(installed) || now - @seen.last >= HELD_FOR
+      end
+
+      # A run on record for +version+ that is over, with chi web still older.
+      def closed_run?(version)
+        record = @check.auto_state
+        !record.nil? && record.version == version && !OPEN_PHASES.include?(record.phase)
+      end
+
+      # A newer chi this didn't install, settled: a run of its own from here.
+      # The terminal's table already told what `chi update` kept.
+      def adopt_installed
+        return unless @restart == "idle" && @seen
+
+        installed, seen_at = @seen
+        now = @clock.call
+        return if tried?(installed) || now - seen_at < SETTLE
+
+        Log.info(:web, "auto_update_adopted", version: installed, from: VERSION)
+        carry_on(save(AutoUpdateRecord.new(version: installed, from: VERSION, at: now.iso8601, phase: "installed")))
+      end
+
       def install(version)
         Log.info(:web, "auto_update_start", version: version, from: VERSION)
         result = @ops.install(version, wait: true, auto: true)
@@ -187,7 +238,9 @@ module Samagotchi
       # The next step of a run on record.
       def carry_on(record)
         case record.phase
-        when "installed", "workers" then workers_then_web(record)
+        when "installed", "workers"
+          # Restarted by hand on the way (the page's offer): nothing left to exec.
+          InstalledVersions.newer?(record.version) ? workers_then_web(record) : finish(record)
         when "web" then finish(record)
         end
       end
@@ -260,6 +313,7 @@ module Samagotchi
       def restart_failed(record, detail, event)
         Log.warn(:web, event, version: record.version, detail: detail)
         save(record.with(phase: "failed", detail: detail, pushed: true))
+        @hub.auto_offer_restart(record.version)
         @hub.publish_notice(kind: "restart_failed", version: record.version, detail: detail)
       end
 
@@ -307,6 +361,7 @@ module Samagotchi
         Log.warn(:web, "auto_update_failed_install", version: record.version, detail: detail)
         gem_installed = rows.any? { |candidate| candidate["component"] == "chi (gem)" && !candidate["failed"] }
         @check.save_auto(record.with(phase: "failed", detail: detail, pushed: true), failed: record.version)
+        @hub.auto_offer_restart(record.version)
         @hub.publish_notice(kind: "failed", version: record.version, detail: detail.empty? ? nil : detail,
                             installed: gem_installed)
       end

data/lib/samagotchi/web/public/app.js

@@ -95,7 +95,7 @@ import { waitingOn } from "./notify.js";
 import { applySessionEvent, sortedByUpdated } from "./sessions_list.js";
 import { createNotifications } from "./notifications.js";
 import { renameShown, tabTitle, topBarTitle } from "./session_title.js";
-import { mergeVersionState, restartConfirmText, versionNotice } from "./update_notice.js";
+import { mergeVersionState, restartConfirmText, updateFrameToast, versionNotice } from "./update_notice.js";
 import {
   appendAboveLiveTiming, mergeTiming, normalizeTiming,
 } from "./timing.js";
@@ -585,7 +585,7 @@ function noticeVersions(data) {
   const notice = versionNotice({ loaded: document.body.dataset.version, served: versions.served,
                                  installed: versions.installed, available: versions.available,
                                  updateBlocked: versions.updateBlocked, auto: versions.auto, restart: versions.restart,
-                                 autoInstall: versions.autoInstall, shown: versionNoticesShown });
+                                 autoOffers: versions.autoOffers, shown: versionNoticesShown });
   store.touch("infoBar"); // the worker badge compares with the newest installed
   if (!notice) return;
   versionNoticesShown.add(notice.key);
@@ -614,20 +614,9 @@ function noticeVersions(data) {
 function updateFrame(data, { snapshot = false } = {}) {
   const wasOpen = updateSheet.isOpen();
   if (!updateSheet.receive(data)) return;
-  // Every install frame, not only the done one: the hub's `chi` frame with
-  // the new installed version comes before it, and an automatic run's
-  // running frame is what keeps that from offering the Restart toast.
-  if (data.operation === "install") {
-    noticeVersions({ ...(data.state === "done" && data.version ? { installed: data.version } : {}), chi_update: data });
-  }
-  const label = `${data.auto ? "Automatic " : ""}${data.operation === "install" ? "chi update" : "worker restart"}`
-    .replace(/^./, (c) => c.toUpperCase());
-  if (!wasOpen && data.state === "running") {
-    showToast(`${label} in progress`, { label: "View", run: () => updateSheet.view() }, { sticky: true });
-  } else if (!snapshot && !wasOpen && ["done", "failed"].includes(data.state)
-    && !(data.operation === "install" && data.state === "done")) {
-    showToast(`${label} ${data.state}`, { label: "View", run: () => updateSheet.view() }, { sticky: true });
-  }
+  if (data.operation === "install" && data.state === "done" && data.version) noticeVersions({ installed: data.version });
+  const text = updateFrameToast(data, { wasOpen, snapshot });
+  if (text) showToast(text, { label: "View", run: () => updateSheet.view() }, { sticky: true });
 }
 
 function copyUpdateCommand(command) {