samagotchi 0.18.1 → 0.19.0

data/lib/samagotchi/session_manager.rb

@@ -19,7 +19,9 @@ require_relative "bridge_client"
 require_relative "worker_sidecar"
 require_relative "log"
 require_relative "log_path"
+require_relative "model_profile"
 require_relative "installed_gem"
+require_relative "installed_versions"
 require_relative "recap_store"
 require_relative "archive_store"
 require_relative "image_store"
@@ -191,6 +193,7 @@ module Samagotchi
       # A worker gets no CLI args: --model, --thinking, --log-level and the
       # other flags this chi was started with.
       child_env.merge!(Config.cli_env)
+      child_env[ModelProfile::MODEL_FROM_CLI_ENV] = "1" if child_env.key?(ModelProfile::MODEL_ENV)
       # And the spawner's debug log, absolute: a relative log.file would
       # otherwise land in the worker's (the session's) directory.
       log_path = begin LogPath.resolve rescue nil end
@@ -204,10 +207,25 @@ module Samagotchi
       # key mapped to nil. config.yml no longer reads them; this keeps an
       # older or future env-exposed one out as well.
       ENV.each_key { |key| child_env[key] = nil if key.start_with?(GUARDRAILS_ENV_PREFIX) }
+      # A smoke's fake "newest installed" is for this process's notices only.
+      child_env[InstalledVersions::ENV_KEY] = nil
+      # A gem-mode worker activates the newest installed chi itself: under
+      # `bundle exec` (a Gemfile that has samagotchi) Bundler's RUBYOPT would
+      # hold it to the bundle's version, and its badge would never clear.
+      child_env.merge!(unbundled_env_changes) if InstalledGem.spec
       opts[:env] = child_env unless child_env.empty?
       opts
     end
 
+    # What Bundler changed in ENV (RUBYOPT, BUNDLE_*), mapped back to the
+    # values from before it (nil: unset); {} outside Bundler.
+    private_class_method def self.unbundled_env_changes(env = ENV.to_h)
+      return {} unless defined?(::Bundler) && ::Bundler.respond_to?(:unbundled_env)
+
+      clean = ::Bundler.unbundled_env
+      (env.keys | clean.keys).each_with_object({}) { |key, changes| changes[key] = clean[key] unless clean[key] == env[key] }
+    end
+
     GUARDRAILS_ENV_PREFIX = "SAMAGOTCHI_GUARDRAILS_"
 
     # List all sessions, reading status from persisted session.json files.
@@ -409,6 +427,10 @@ module Samagotchi
       # status is turn state, not liveness: a new worker runs no turn yet,
       # and must not find the session stopped (it would exit): neither the
       # marker nor a status field from before it.
+      # One this process just spawned may not hold the lock yet (a slow
+      # start, deliver_turn's second resume): it would only lose it.
+      return session if still_starting?(session.id, state_dir: sd)
+
       Session.clear_stopped(session.id, state_dir: sd)
       session.status = Session::STATUS_IDLE
       session.save(state_dir: sd)
@@ -416,6 +438,36 @@ module Samagotchi
       session
     end
 
+    # How long after a spawn a resume trusts that worker to take the
+    # session, while it runs (and the session wasn't stopped since).
+    WORKER_START_GRACE = 30.0
+
+    @spawns = {}
+    @spawns_mutex = Mutex.new
+
+    # A worker this process spawned for the session within
+    # WORKER_START_GRACE is still running, and no stop came since.
+    private_class_method def self.still_starting?(session_id, state_dir:)
+      return false if Session.stopped_marker?(session_id, state_dir: state_dir)
+
+      at, waiter = @spawns_mutex.synchronize { @spawns[[state_dir, session_id]] }
+      return false unless at && waiter.respond_to?(:alive?) && waiter.alive?
+
+      Process.clock_gettime(Process::CLOCK_MONOTONIC) - at < WORKER_START_GRACE
+    end
+
+    private_class_method def self.note_spawn(session_id, state_dir:, waiter:)
+      @spawns_mutex.synchronize do
+        @spawns.delete_if { |_, (_, w)| !(w.respond_to?(:alive?) && w.alive?) }
+        @spawns[[state_dir, session_id]] = [Process.clock_gettime(Process::CLOCK_MONOTONIC), waiter]
+      end
+    end
+
+    # Forget the spawns #still_starting? remembers (specs).
+    def self.forget_spawns
+      @spawns_mutex.synchronize { @spawns.clear }
+    end
+
     # Read any new output files from a session directory.
     # Optionally filters to only files newer than `since_time`.
     def self.read_responses(session_id, since_time: nil, state_dir: nil)
@@ -423,6 +475,85 @@ module Samagotchi
                                 since_time: since_time)
     end
 
+    # A restart that can't happen now. reason: :not_running (no live worker:
+    # the next prompt starts one on the newest chi anyway), :unsupported (a
+    # worker from before restarts, running +version+: stop it instead), a
+    # WorkerIdleExit#hold_for_restart hold (:turn_running, :reminders, ...),
+    # or :failed (the worker answered something else).
+    class RestartRefused < StandardError
+      attr_reader :session_id, :reason, :version
+
+      def initialize(session_id, reason, version: nil)
+        @session_id = session_id
+        @reason = reason.to_sym
+        @version = version
+        super(RestartRefused.words(session_id, @reason, version))
+      end
+
+      HOLDS = {
+        starting: "its worker is still starting",
+        turn_running: "a turn is running",
+        input_queued: "a prompt is queued",
+        continue_offered: "the step-limit question waits for an answer",
+        question_pending: "a question or approval waits for an answer",
+        reminders: "it has reminders, which a restart would drop",
+        command_running: "a /btw (or another command) is still running",
+        relays_open: "a delegate's approval relayed here is open or just answered",
+        background_tasks: "background tasks it started are still running"
+      }.freeze
+
+      # What the CLI and the web say.
+      def self.words(session_id, reason, version = nil)
+        case reason
+        when :not_running
+          "session #{session_id} has no running worker; the next prompt starts one on the newest chi"
+        when :unsupported
+          "session #{session_id}'s worker runs chi #{version || "(older)"}, which can't restart: " \
+            "chi sessions stop #{session_id}, then any prompt starts it on the newest chi"
+        when :failed then "session #{session_id}'s worker didn't take the restart"
+        else "not now: #{HOLDS.fetch(reason, reason.to_s.tr("_", " "))}"
+        end
+      end
+    end
+
+    # What a restart did: the worker's version before and after (nil when
+    # the new worker hadn't published its Bridge within the wait).
+    Restarted = Struct.new(:session_id, :from_version, :version, keyword_init: true)
+
+    RESTART_WAIT = 10.0
+
+    # Hand a session to a new worker on the newest chi installed: ask its
+    # worker (POST /exit restart: true), which leaves only when nothing would
+    # be lost and starts its successor (Worker#exit_request), then wait up to
+    # +wait+ seconds for the successor's Bridge. Web tabs and attached
+    # terminals reconnect to it.
+    # @return [Restarted]
+    # @raise [OwnedByTUI] a chi REPL owns the session
+    # @raise [RestartRefused]
+    # @raise [ArgumentError] no such session
+    def self.restart_session(session_id, state_dir: nil, wait: RESTART_WAIT, client_id: "cli:restart")
+      sd = state_dir || Session.default_state_dir
+      Session.load(session_id, state_dir: sd) # ArgumentError for none
+      owner = refuse_tui!(session_id, state_dir: sd)
+      dir = Session.session_dir(session_id, state_dir: sd)
+      sidecar = owner&.worker? && WorkerSidecar.live(dir, unlink: false)
+      raise RestartRefused.new(session_id, :not_running) unless sidecar
+      unless sidecar.features.include?("restart")
+        raise RestartRefused.new(session_id, :unsupported, version: sidecar.version)
+      end
+
+      reply = BridgeClient.new(session_id: session_id, port: sidecar.port).request_exit(client_id: client_id, restart: true)
+      raise RestartRefused.new(session_id, reply.json&.fetch("reason", nil) || :failed) if reply.status == 409
+      raise RestartRefused.new(session_id, :failed) unless reply.status == 200
+
+      Log.info(:worker, "restart", sid: session_id, from: sidecar.version, by: client_id)
+      fresh = BridgeClient.poll(wait, interval: 0.1) do
+        found = WorkerSidecar.live(dir, unlink: false)
+        found if found && found.started_at != sidecar.started_at
+      end
+      Restarted.new(session_id: session_id, from_version: sidecar.version, version: fresh&.version)
+    end
+
     # Stop a session by sending TERM to its process.
     # With +wait+ (seconds), also wait for the owner to let go of the session,
     # so a resume right after spawns a fresh worker instead of finding the
@@ -638,7 +769,7 @@ module Samagotchi
     # @param poll_interval [Numeric, nil] seconds between the loop's fallback
     #   ticks (nil: Worker::FALLBACK_TICK_SECONDS); queued turns wake it at once
     # A stopped session's worker exits 0 and a crashed one 1, there.
-    # @return [Symbol] :idle_exit or :exit_requested
+    # @return [Symbol] :idle_exit, :exit_requested or :restart
     def self.run_session_loop(session_id, state_dir: nil, owner_wait: OwnerLock::DEFAULT_WAIT,
                               idle_exit_minutes: nil, poll_interval: nil)
       # A worker inherits chi's locale (LC_ALL=C too): read files as UTF-8.
@@ -652,7 +783,10 @@ module Samagotchi
       # Kept in a class ivar so the lock's File lives as long as the worker.
       @owner_lock = OwnerLock.acquire(session_dir, kind: "worker", wait: owner_wait)
       exit(0) unless @owner_lock
-      Log.info(:worker, "start", cwd: Dir.pwd)
+      # Set by the boot string when the newest installed chi didn't load.
+      fallback = ENV.delete(BOOT_FALLBACK_ENV)
+      Log.info(:worker, "start", cwd: Dir.pwd, version: VERSION)
+      Log.warn(:worker, "boot_fallback", version: VERSION, error: fallback) if fallback
       worker = Worker.new(session_id: session_id, state_dir: sd, session_dir: session_dir,
                           idle_exit_minutes: idle_exit_minutes, poll_interval: poll_interval)
       result = begin
@@ -672,7 +806,10 @@ module Samagotchi
       # Only after the release: a writer that still saw this worker as the
       # owner may have queued input since the last check. Either it finds no
       # owner after its write and wakes one, or this finds its input.
-      if %i[idle_exit exit_requested].include?(result) && !SessionInbox.find_new_input_files(session_dir).empty?
+      # A restart starts its successor here, on the newest chi installed
+      # (worker_command), once this one's lock is free.
+      if result == :restart ||
+         (%i[idle_exit exit_requested].include?(result) && !SessionInbox.find_new_input_files(session_dir).empty?)
         resume_session(session_id, state_dir: sd)
       elsif worker.discard?
         discard_left_session(session_id, state_dir: sd, default_model: worker.default_model)
@@ -707,16 +844,31 @@ module Samagotchi
       session.save(state_dir: state_dir)
     end
 
-    # The worker's command line: this chi's lib/ and ruby. Run from an
-    # installed gem, the worker activates that gem first, so its dependencies
-    # resolve as the gemspec pins them (reline ~> 0.6.3) rather than to the
-    # newest installed version. A source checkout (bin/chi, bundle exec)
-    # keeps the plain -I lib.
+    # The worker's command line. Run from an installed gem, the worker
+    # activates the newest installed samagotchi (`>= 0.a`, prereleases
+    # count), whoever spawns it: an old chi web, chi send or --attach then
+    # starts new workers on the newest chi rather than on its own. Activating
+    # the gem also makes its dependencies resolve as its gemspec pins them
+    # (reline ~> 0.6.3). Should that fail (a broken newest install), the
+    # worker falls back to the spawner's own version and logs why.
+    #
+    # A source checkout (bin/chi, bundle exec; InstalledGem.spec is nil
+    # there) keeps the plain -I lib: a worktree's bin/chi spawns its own code.
+    #
+    # CROSS-VERSION CONTRACT: this boot string, run_session_loop(id,
+    # state_dir:), the env keys spawn_options sets and the input/ file
+    # format are read by a NEWER chi than the one writing them. Change them
+    # only additively (spec/worker_contract_spec.rb).
+    BOOT_FALLBACK_ENV = "SAMAGOTCHI_BOOT_FALLBACK"
+
     def self.worker_command(session_id, state_dir:, gem_spec: InstalledGem.spec)
       boot = "require 'samagotchi/session_manager'; " \
              "Samagotchi::SessionManager.run_session_loop('#{session_id}', state_dir: #{state_dir.inspect})"
-      boot = "gem 'samagotchi', '= #{gem_spec.version}'; #{boot}" if gem_spec
-      [RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-e", boot]
+      return [RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-e", boot] unless gem_spec
+
+      activate = "begin; gem 'samagotchi', '>= 0.a'; rescue LoadError => e; " \
+                 "ENV['#{BOOT_FALLBACK_ENV}'] = e.message; gem 'samagotchi', '= #{gem_spec.version}'; end"
+      [RbConfig.ruby, "-e", "#{activate}; #{boot}"]
     end
 
     private_class_method def self.spawn_worker_for_session(session, state_dir:)
@@ -729,6 +881,8 @@ module Samagotchi
       env = opts.delete(:env)
       command = worker_command(session.id, state_dir: state_dir)
       pid = env ? Process.spawn(env, *command, **opts) : Process.spawn(*command, **opts)
+      # Reaped when it exits: a long-lived spawner (chi web) keeps no zombies.
+      note_spawn(session.id, state_dir: state_dir, waiter: Process.detach(pid))
       Log.info(:worker, "spawn", sid: session.id, child_pid: pid)
       pid
     end
@@ -831,7 +985,8 @@ module Samagotchi
         raise OwnedByTUI, session_id
       end
       # A worker that idle-exited since the resume never reads it either:
-      # wake a new one. (The exiting worker also looks for input it left.)
+      # wake a new one. (The exiting worker also looks for input it left;
+      # one the first resume spawned that is still starting is left be.)
       manager.resume_session(session_id, state_dir: state_dir) if owner.nil?
       { status: :accepted, ack: { status: "accepted", enqueued_id: enqueued_id, session_id: session_id } }
     end

data/lib/samagotchi/session_metrics.rb

@@ -296,7 +296,8 @@ module Samagotchi
         retries: totals[:retries] + (turn&.retries || 0),
         started_at: @started_at,
         last_activity_at: @last_activity_at,
-        session_duration_ms: elapsed_ms(@session_started_monotonic),
+        # From the session's first start (an earlier process's too), to now.
+        session_duration_ms: ms_since(@started_at),
         **records_view(records_mode),
         active_turn: active_turn_snapshot,
         active_tools: active_tool_snapshots
@@ -327,7 +328,6 @@ module Samagotchi
           load_persisted
         end
         @started_at ||= now.iso8601(3)
-        @session_started_monotonic ||= monotonic_time
         @turn = TurnState.new(
           session_id: @session_id,
           iteration_count: 0,
@@ -364,6 +364,10 @@ module Samagotchi
           # A turn that failed mid-stream never saw its generation end:
           # what it got to still counts.
           close_generation if @turn.gen_open
+          # A call still running when the turn ends (a cancel, a failure)
+          # never completes: its record says so, as the count already has it.
+          @turn.tool_calls_by_id.each_value { |active| finish_tool_record(active, "canceled") }
+          @turn.tool_calls_by_id.clear
           finished_at = now
           record = {
             id: @turn.id,
@@ -486,20 +490,24 @@ module Samagotchi
         active = @turn.tool_calls_by_id.delete(key)
         return unless active
 
-        finished_at = now
-        record = active.slice(
-          :id, :turn_id, :iteration, :call_index, :tool, :started_at
-        ).merge(
-          status: status.empty? ? "ok" : status,
-          completed_at: finished_at.iso8601(3),
-          # Less a guardrail approval wait (ToolRunner's waited_ms).
-          duration_ms: [elapsed_ms(active[:started_monotonic]) - event[:waited_ms].to_i, 0].max
-        )
-        @tool_records << record
-        count_tool(record)
+        finish_tool_record(active, status.empty? ? "ok" : status, waited_ms: event[:waited_ms].to_i)
       end
     end
 
+    # Caller holds the mutex.
+    def finish_tool_record(active, status, waited_ms: 0)
+      record = active.slice(
+        :id, :turn_id, :iteration, :call_index, :tool, :started_at
+      ).merge(
+        status: status,
+        completed_at: now.iso8601(3),
+        # Less a guardrail approval wait (ToolRunner's waited_ms).
+        duration_ms: [elapsed_ms(active[:started_monotonic]) - waited_ms, 0].max
+      )
+      @tool_records << record
+      count_tool(record)
+    end
+
     # Accumulate token counts from a streamed generation_chunk payload.
     # Server-first: prefer real timings/usage. Prompt and completion tokens
     # are tracked as a per-generation MAX (the server's counts are cumulative
@@ -558,6 +566,15 @@ module Samagotchi
       [((monotonic_time - started) * 1000.0).round, 0].max
     end
 
+    # Wall-clock ms from an ISO 8601 stamp to now (0 without one).
+    def ms_since(timestamp)
+      return 0 unless timestamp
+
+      [((now - Time.iso8601(timestamp.to_s)) * 1000.0).round, 0].max
+    rescue ArgumentError
+      0
+    end
+
     def tool_key(iteration, call_index)
       "#{iteration}:#{call_index}"
     end
@@ -609,6 +626,12 @@ module Samagotchi
       @tool_records.each { |record| count_tool(record) }
       @started_at = earliest_timestamp(prior["started_at"], @started_at)
       @last_activity_at ||= prior["last_activity_at"]
+      # The served model last reported, with the name asked for then (the
+      # Engine shows it only while that name is still the one asked for).
+      if @served_model.nil? && prior["served_model"]
+        @served_model = prior["served_model"]
+        @served_model_for = prior["served_model_for"]
+      end
       # The window last seen, until this process's first generation reports.
       window = prior["context"].is_a?(Hash) ? prior["context"] : {}
       if window["window_tokens"] && @context_window_tokens.nil?

data/lib/samagotchi/sessions_command.rb

@@ -13,7 +13,7 @@ require_relative "cli/command"
 require_relative "cli/flags"
 
 module Samagotchi
-  # `chi sessions`: list, stop, archive/unarchive, delete, prune and clean
+  # `chi sessions`: list, stop, restart, archive/unarchive, delete, prune and clean
   # sessions from the shell (bin/chi dispatches here before OptionParser;
   # the subcommands have their own flags). Not SessionCommands, the REPL's
   # slash commands for sessions (session_commands.rb).
@@ -21,7 +21,7 @@ module Samagotchi
     include CLI::Command
 
     USAGE = <<~TEXT
-      Usage: chi sessions <list|stop|archive|unarchive|delete|prune|clean> [options]
+      Usage: chi sessions <list|stop|restart|archive|unarchive|delete|prune|clean> [options]
         list [--sort updated_at|created_at] [--order desc|asc] [--limit N]
              [--live] [--cwd PATH] [--format text|json|tsv] [--archived]
              --live: sessions a worker runs now (the ones chi note reaches), 10 unless --limit
@@ -29,6 +29,7 @@ module Samagotchi
              [--scope=all]: every project's sessions; by default only this git project's (all outside a repo)
              --archived: archived sessions too (marked [archived]; json: archived: true)
         stop ID...   # stop each session's worker (IDs or unique prefixes); chi --resume ID then starts a fresh one
+        restart ID...   # hand each session to a new worker on the newest chi installed; refused while a turn, question or reminder would be lost
         archive ID...   # hide sessions (and their delegates) from every list and keep them for good; unarchive ID... brings them back
         delete [--force] ID...   # delete sessions for good (IDs or unique prefixes); --force stops a live worker first
         prune [--dry-run] [--days N] [--keep N] [--keep-status running,...] [--test-only]
@@ -37,7 +38,8 @@ module Samagotchi
     TEXT
 
     STOP_USAGE = "Usage: chi sessions stop ID...\n"
-    SUBCOMMANDS = %w[list stop archive unarchive delete prune clean].freeze
+    RESTART_USAGE = "Usage: chi sessions restart ID...\n"
+    SUBCOMMANDS = %w[list stop restart archive unarchive delete prune clean].freeze
 
     # Each subcommand's flags ("--flag V" or "--flag=V" for a value): an
     # unknown flag, a value flag with nothing after it or an argument where
@@ -50,6 +52,7 @@ module Samagotchi
         f.switch "--archived", key: :include_archived
       end,
       "stop" => CLI::Flags.new,
+      "restart" => CLI::Flags.new,
       "prune" => CLI::Flags.new(args: false) do |f|
         %w[--days --keep --keep-status].each { |name| f.value name }
         f.switch "--dry-run"
@@ -94,6 +97,7 @@ module Samagotchi
       case @sub
       when "list" then list
       when "stop" then stop(parsed.args)
+      when "restart" then restart(parsed.args)
       else prune(@sub)
       end
     end
@@ -101,7 +105,7 @@ module Samagotchi
     private
 
     def command_name = @sub && SUBCOMMANDS.include?(@sub) ? "chi sessions #{@sub}" : "chi sessions"
-    def usage_text = @sub == "stop" ? STOP_USAGE : USAGE
+    def usage_text = { "stop" => STOP_USAGE, "restart" => RESTART_USAGE }.fetch(@sub, USAGE)
 
     # quirk: a number that isn't one is 0 (--days=abc turns the age limit off)
     def integers(options)
@@ -257,6 +261,41 @@ module Samagotchi
       ok.all? ? 0 : 1
     end
 
+    # Each session in turn: its worker hands over to a new one on the newest
+    # chi (SessionManager.restart_session), or says why not.
+    def restart(ids)
+      return usage_error("give session ids") if ids.empty?
+
+      ok = ids.uniq.map do |given|
+        begin
+          id = Samagotchi::Session.resolve_id(given)
+          result = Samagotchi::SessionManager.restart_session(id)
+        rescue Samagotchi::SessionManager::OwnedByTUI
+          @stdout.flush
+          @stderr.puts "session #{id} is open in a chi REPL; close it there first"
+          next false
+        rescue Samagotchi::SessionManager::RestartRefused => e
+          @stdout.flush
+          @stderr.puts e.reason == :not_running || e.reason == :unsupported ? e.message : "session #{id}: #{e.message}"
+          next false
+        rescue ArgumentError => e
+          @stdout.flush
+          @stderr.puts e.message
+          next false
+        end
+        @stdout.puts restarted_line(result)
+        true
+      end
+      ok.all? ? 0 : 1
+    end
+
+    def restarted_line(result)
+      return "Restarting session #{result.session_id}; its new worker is still starting." unless result.version
+
+      from = result.from_version && result.from_version != result.version ? " (was #{result.from_version})" : ""
+      "Restarted session #{result.session_id} on chi #{result.version}#{from}."
+    end
+
     def prune(sub)
       days, keep, keep_status, dry_run, test_only = @opts.values_at(:days, :keep, :keep_status, :dry_run, :test_only)
       test_only = true if sub == "clean" && !@opts[:all]

data/lib/samagotchi/system_prompt.rb

@@ -310,6 +310,15 @@ module Samagotchi
       end
     end
 
+    # Once per name for this prompt (the Engine's, one per process): a
+    # rebuild (another level, a /model switch) doesn't repeat it.
+    def warn_preload_failed(name, echo)
+      @warned_preloads ||= Set.new
+      return unless @warned_preloads.add?(name)
+
+      Log.warn(:memory, "preload_failed", echo: echo, memory: name)
+    end
+
     def explicit_memory_section
       return nil if @requested_memories.empty?
 
@@ -322,7 +331,7 @@ module Samagotchi
           body = Tools::MemoryRead.call(actual_name, scope: scope, **overlay_keys)
           if body.start_with?("Error:")
             source = Array(@config_memories).include?(raw) ? "memory '#{name}' (from config memories:)" : "--memory '#{name}'"
-            Log.warn(:memory, "preload_failed", echo: "Warning: #{source} could not be loaded (#{body})", memory: name)
+            warn_preload_failed(name, "Warning: #{source} could not be loaded (#{body})")
             next
           end
           # Record activated names so the UI can echo them in the sticky

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -11,6 +11,7 @@ require_relative "image_input"
 require_relative "line_reader"
 require_relative "question_prompt"
 require_relative "reline_seam"
+require_relative "version_lines"
 require_relative "../bridge/turn_accumulator"
 require_relative "../bridge_client"
 require_relative "../log"
@@ -92,8 +93,10 @@ module Samagotchi
                      default_input: false, wait_at_eof: false, parent_answers: false,
                      clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) },
                      delete_session: ->(id) { SessionManager.delete_session(id, stop: true, wait: DELETE_WAIT) },
-                     archive_session: ->(id) { SessionManager.archive_session(id, wait: DELETE_WAIT) })
+                     archive_session: ->(id) { SessionManager.archive_session(id, wait: DELETE_WAIT) },
+                     installed_version: -> { InstalledVersions.new.newest })
         @client = client
+        @installed_version = installed_version
         @delete_session = delete_session
         @archive_session = archive_session
         @screen = screen
@@ -108,6 +111,8 @@ module Samagotchi
         @running = false
         @joined_mid_turn = false
         @attached = false
+        # The stream moved to a new worker; its snapshot resyncs (#switch_worker).
+        @worker_changed = false
         @early_lines = []
         @question = nil
         @answered_ids = Set.new
@@ -158,7 +163,12 @@ module Samagotchi
         RelineSeam.interrupt_handler = method(:note_interrupted_line)
         # Tagged, so the worker doesn't count this stream as another UI
         # when this UI asks it to exit.
-        stream = @client.follow(client_id: @client_id) { |event| queue << [:event, event] }
+        # A new worker (a restart) is followed, not lost: its sidecar is
+        # looked for whenever the stream drops.
+        stream = @client.follow(client_id: @client_id, rediscover: method(:live_worker),
+                                reconnect_delays: BridgeClient::EventStream::REDISCOVER_DELAYS) do |event|
+          queue << [:event, event]
+        end
         @reader = LineReader.new(queue, prompt: method(:prompt_text), read: input || method(:read_input_line),
                                         prefill: default_input_text).start
         loop do
@@ -280,6 +290,7 @@ module Samagotchi
         when :generation_completed
           @status.take_event(event)
           @renderer.call(event)
+        when :worker_changed then switch_worker(event)
         when :stream_closed
           @view.finish_thinking_spinner
           @screen.commit("Lost the session's worker (#{event[:reason]}). " \
@@ -292,6 +303,32 @@ module Samagotchi
 
       private
 
+      # The newest chi installed, looked at once, at the join.
+      def installed_version
+        @installed_version.call
+      rescue StandardError
+        nil
+      end
+
+      # The session's live worker for the stream to follow (EventStream's
+      # rediscover): nil while there is none yet, :gone once the session was
+      # stopped (no worker is coming).
+      def live_worker
+        id = @client.session_id
+        return :gone if Session.stopped_marker?(id)
+
+        BridgeClient.discover(id, session_dir: Session.session_dir(id), host: @client.host)
+      end
+
+      # The stream moved to a new worker (a restart): requests go there too.
+      def switch_worker(event)
+        @client = BridgeClient.new(session_id: @client.session_id, port: event[:port], host: @client.host)
+        @worker_changed = true
+        @view.finish_thinking_spinner
+        Log.info(:attached, "worker_changed", port: event[:port])
+        nil
+      end
+
       def next_item(queue)
         queue.pop
       rescue Interrupt
@@ -884,8 +921,13 @@ module Samagotchi
 
       def render_snapshot(snapshot, reset:)
         @view.finish_thinking_spinner
+        # A new worker's first snapshot is the session as it now stands.
+        moved = @worker_changed
+        reset ||= moved
+        @worker_changed = false
         if @attached
-          @screen.commit("(resynced with the session)") if reset
+          @screen.commit("(resynced with the session)") if reset && !moved
+          @screen.commit(paint(VersionLines.restarted(snapshot[:chi_version]), 2)) if moved
         else
           @attached = true
           # The recap first: what the session was about, then where it stopped.
@@ -894,6 +936,9 @@ module Samagotchi
           render_join_header(Array(snapshot[:messages]))
           @screen.commit("guardrails> #{snapshot[:guardrail_warning]}") if snapshot[:guardrail_warning]
           @screen.commit("plugins> #{snapshot[:plugin_warning]}") if snapshot[:plugin_warning]
+          version_line = VersionLines.at_attach(worker: snapshot[:chi_version], installed: installed_version,
+                                                session_id: @client.session_id)
+          @screen.commit(paint(version_line, 2)) if version_line
         end
         if snapshot[:commands]
           @command_registry = Commands::Registry.from_listing(snapshot[:commands], base: SessionCommands.builtin_registry)

data/lib/samagotchi/terminal_ui/image_input.rb

@@ -9,20 +9,27 @@ module Samagotchi
     # stays as typed; a token that isn't an image (a source file, a missing
     # path, an email address) is just text.
     #
-    #   @shot.png  @~/Desktop/a.jpg  @"my shot.png"  @'my shot.png'
+    #   @shot.png  @~/Desktop/a.jpg  @"my shot.png"  @'my shot.png'  @my\ shot.png
+    #
+    # A bare path takes backslash escapes the way a shell does (what a
+    # Finder drag into the terminal types): `\ ` is a space, `\(` a `(`.
     module ImageInput
-      # An @ at the start or after whitespace, then a quoted or bare path.
-      TOKEN_RE = /(?:\A|(?<=\s))@(?:"([^"]+)"|'([^']+)'|(\S+))/
+      # An @ at the start or after whitespace, then a quoted or bare path
+      # (a bare one runs on through backslash-escaped whitespace).
+      TOKEN_RE = /(?:\A|(?<=\s))@(?:"([^"]+)"|'([^']+)'|((?:\\\s|\S)+))/
 
       # @return [Array<Hash>] {path:} per image, in order, each path once
       def self.extract(text, cwd: Dir.pwd)
         text.to_s.scan(TOKEN_RE).filter_map do |quoted_double, quoted_single, bare|
-          raw = quoted_double || quoted_single || bare.sub(/[,.;:!?)\]]+\z/, "")
+          raw = quoted_double || quoted_single || unescape(bare.sub(/(?<!\\)[,.;:!?)\]]+\z/, ""))
           path = expand(raw, cwd)
           path if path && ImageStore.image_file?(path)
         end.uniq.map { |path| { path: path } }
       end
 
+      def self.unescape(bare) = bare.gsub(/\\(.)/m, '\\1')
+      private_class_method :unescape
+
       def self.expand(raw, cwd)
         return nil if raw.empty?