samagotchi 0.18.1 → 0.19.0

data/lib/samagotchi/terminal_ui/version_lines.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "../installed_versions"
+require_relative "../version"
+
+module Samagotchi
+  class TerminalUI
+    # The line an attaching terminal shows when chi versions differ: the
+    # session's worker (its snapshot's chi_version), this terminal (VERSION)
+    # and the newest installed. Neither process can reload itself: the worker
+    # moves with `chi sessions restart`, the terminal by attaching again.
+    module VersionLines
+      module_function
+
+      # @param worker [String, nil] the worker's chi_version (nil: a worker
+      #   from before it said so; nothing is said then)
+      # @param installed [String, nil] InstalledVersions#newest
+      # @return [String, nil] one "chi> ..." line, or nil when all is current
+      def at_attach(worker:, installed:, session_id:, terminal: VERSION)
+        return nil if worker.to_s.empty?
+
+        newest = [installed, terminal].select { |v| Gem::Version.correct?(v.to_s) && !v.to_s.empty? }
+                                      .max_by { |v| Gem::Version.new(v) }
+        worker_old = InstalledVersions.newer?(newest, worker)
+        terminal_old = InstalledVersions.newer?(newest, terminal)
+        return nil unless worker_old || terminal_old
+
+        id = session_id.to_s[0, 8]
+        restart = "chi sessions restart #{id}"
+        attach = "/detach, then chi --attach #{id}"
+        if worker_old && terminal_old
+          "chi> chi #{newest} is installed; this session's worker runs #{worker} and this terminal #{terminal}. " \
+            "#{restart} moves the worker; #{attach} for the terminal."
+        elsif worker_old
+          "chi> chi #{newest} is installed; this session's worker runs #{worker}. #{restart} moves it there " \
+            "(this terminal follows)."
+        else
+          "chi> chi #{newest} is installed; this terminal runs #{terminal}. #{attach} to use it."
+        end
+      end
+
+      # After the stream moved to a new worker (a restart).
+      def restarted(worker)
+        worker.to_s.empty? ? "chi> the session's worker restarted" : "chi> the session's worker restarted on chi #{worker}"
+      end
+    end
+  end
+end

data/lib/samagotchi/tools/builtins.rb

@@ -22,6 +22,7 @@ require_relative "delegate"
 require_relative "delegate_result"
 require_relative "ask_user_question"
 require_relative "../guardrails/parent_approvals"
+require_relative "../model_profile"
 
 module Samagotchi
   module Tools
@@ -73,7 +74,8 @@ module Samagotchi
         TaskCreate::NAME => lambda do |call, kctx|
           next Execute::NOT_RUN_ON_STOP if cancelled_proc(kctx).call
 
-          TaskCreate.call(call[:content], cwd: call[:cwd], env: call[:env], marker_env: parent_env(kctx))
+          TaskCreate.call(call[:content], cwd: call[:cwd], env: call[:env],
+                          marker_env: task_marker_env(kctx, call[:env]))
         end,
         TaskWait::NAME => lambda do |call, kctx|
           TaskWait.call(call[:content], timeout: call[:timeout], tail_lines: call[:tail_lines],
@@ -108,17 +110,31 @@ module Samagotchi
       # wrapper. The session's id, "chi" without one. And the model the
       # session runs on (SAMAGOTCHI_SESSION_MODEL, read live, so right after
       # /model), which chi self reports; unset when unknown, so a value
-      # inherited from an outer session never passes for this one.
-      def parent_env(kctx)
+      # inherited from an outer session never passes for this one. A
+      # worker's `chi --model X` default (ModelProfile::MODEL_FROM_CLI_ENV)
+      # is unset: it was that run's, not the default of a chi run here.
+      def parent_env(kctx, env: ENV)
         peers = kctx.peers
         id = peers.respond_to?(:session_id) ? peers.session_id.to_s : ""
         model = peers.respond_to?(:model_ref) ? peers.model_ref.to_s : ""
-        { Guardrails::ParentApprovals::PARENT_SESSION_ENV => id.empty? ? "chi" : id,
-          SESSION_MODEL_ENV => model.empty? ? nil : model }
+        vars = { Guardrails::ParentApprovals::PARENT_SESSION_ENV => id.empty? ? "chi" : id,
+                 SESSION_MODEL_ENV => model.empty? ? nil : model }
+        if env[ModelProfile::MODEL_FROM_CLI_ENV]
+          vars[ModelProfile::MODEL_ENV] = nil
+          vars[ModelProfile::MODEL_FROM_CLI_ENV] = nil
+        end
+        vars
       end
 
       SESSION_MODEL_ENV = "SAMAGOTCHI_SESSION_MODEL"
 
+      # task_create's parent_env, less the unsets of a variable the model
+      # set in its env (a SAMAGOTCHI_DEFAULT_MODEL it asked for stays).
+      def task_marker_env(kctx, env)
+        given = env.is_a?(Hash) ? env.keys.map(&:to_s) : []
+        parent_env(kctx).reject { |key, value| value.nil? && given.include?(key) }
+      end
+
       # Stop flips the turn's controller, seen through the Engine's PeerView
       # (as DelegateWait does); a bare kernel has no peers: never cancelled.
       def cancelled_proc(kctx)

data/lib/samagotchi/turn_note.rb

@@ -37,7 +37,8 @@ module Samagotchi
     # @param reason [Symbol, String, nil] the cancel reason (:ctrl_c, :user…)
     # @param seconds [Numeric, nil] how long the turn had run
     # @param shown [Boolean] visible text had streamed (an `[interrupted]`
-    #   model message precedes this note)
+    #   model message precedes this note): an answer, or only narration
+    #   before a tool call, so the note says "reply"
     # @param running_tasks [Array<Hash>] {id:, command:} of this session's
     #   background tasks still running: a Stop doesn't end them
     # @param stopped_by [Hash, nil] {by:, reason:} of a hook that stopped
@@ -45,7 +46,7 @@ module Samagotchi
     def cancelled(reason, seconds: nil, shown: false, running_tasks: [], stopped_by: nil)
       why = reason.to_s.empty? ? "" : " (#{reason.to_s.tr("_", "-")}#{stopper(stopped_by)})"
       after = seconds ? " after #{seconds.round}s" : ""
-      what = shown ? "the answer above ends where it was cut off." : "no answer had been shown."
+      what = shown ? "the reply above ends where it was cut off." : "no answer had been shown."
       message("the previous turn was cancelled#{why}#{after}; #{what}#{still_running(running_tasks)}")
     end
 

data/lib/samagotchi/update_command.rb

@@ -34,8 +34,9 @@ module Samagotchi
         --no-gem       don't install a newer gem (config update.gem: false)
         --no-bundles   leave the shipped bundles alone (config update.bundles: false)
         --no-desktop   leave the desktop helper alone (config update.desktop: false)
-        Running sessions keep their chi until they idle out (30 min) or
-        chi sessions stop ID; a running chi web needs a restart.
+        Running sessions keep their chi until restarted (chi sessions
+        restart ID) or until they idle out with nothing attached; a running
+        chi web needs a restart (the sessions it starts run the new chi).
     TEXT
 
     # Help is a flag here: it doesn't stop the parse (an unknown option
@@ -238,22 +239,42 @@ module Samagotchi
     def live_rows
       rows = []
       stale = LiveVersions.stale_workers(VERSION, state_dir: @state_dir)
-      unless stale.empty?
-        versions = stale.map { |w| w.version || "an older chi" }.uniq.join(", ")
-        ids = stale.map { |w| w.session_id[0, 8] }.join(" ")
-        rows << Row.new(component: "workers",
-                        status: "#{stale.size} live on #{versions}: they move to #{VERSION} at idle exit (30 min) " \
-                                "or chi sessions stop #{ids}")
-      end
+      rows << Row.new(component: "workers", status: workers_status(stale)) unless stale.empty?
       host, port = @web
-      web = LiveVersions.web_version(host, port)
-      if web && web != VERSION
+      info = LiveVersions.web_info(host, port)
+      web = info && info["version"].to_s
+      if web && !web.empty? && web != VERSION
+        # Since newest_workers, the sessions it starts run the newest chi.
+        spreads = !Array(info["features"]).include?("newest_workers")
         rows << Row.new(component: "chi web :#{port}", from: web,
-                        status: "running old code: new sessions it starts run #{web} too; restart it")
+                        status: "running old code#{": new sessions it starts run #{web} too" if spreads}; restart it")
       end
       rows
     end
 
+    # A worker keeps its chi until restarted: `chi sessions restart` for
+    # one that can, a stop for an older one (the next prompt starts it on
+    # the newest). It idles out on its own only with nothing attached.
+    def workers_status(stale)
+      versions = stale.map { |w| w.version || "an older chi" }.uniq.join(", ")
+      restart, stop = stale.partition(&:restart).map { |ws| ws.map { |w| w.session_id[0, 8] }.join(" ") }
+      moves = []
+      moves << "chi sessions restart #{restart}" unless restart.empty?
+      moves << "chi sessions stop #{stop}" unless stop.empty?
+      "#{stale.size} live on #{versions}: they keep it until restarted (#{moves.join("; ")})#{idle_note}"
+    end
+
+    def idle_note
+      minutes = begin
+        Config.get("session.idle_exit_minutes").to_f
+      rescue StandardError
+        30.0
+      end
+      return "; they never idle out (session.idle_exit_minutes: 0)" unless minutes.positive?
+
+      "; or they idle out after #{minutes.round(1).to_s.delete_suffix(".0")} min with nothing attached"
+    end
+
     def footers(options)
       return [] if off(options, "bundles")
 

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.18.1"
+  VERSION = "0.19.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -82,7 +82,7 @@ module Samagotchi
       #   lists and GET /api/events streams from (Server always builds one);
       #   without one both routes answer 503
       # @param registry [HostRegistry, nil] the hosts GET /api/models lists
-      #   (built from the config on first use)
+      #   (nil: built from config.yml's hosts:, again when they change)
       # @param models_wait_timeout [Float] bounded seconds GET /api/models
       #   waits for the hosts' lists
       # @param lan [Hash, nil] LAN mode (web.host: lan): { ip:, token: },
@@ -96,6 +96,7 @@ module Samagotchi
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil)
         @manager = manager || SessionManager
         @registry = registry
+        @registry_given = !registry.nil?
         @models_wait_timeout = models_wait_timeout
         @models_mutex = Mutex.new
         @models_thread = nil
@@ -138,6 +139,7 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/([^/]+)/output\z}, :handle_output],
         ["POST", %r{\A/api/sessions/([^/]+)/cancel\z}, :handle_cancel],
         ["POST", %r{\A/api/sessions/([^/]+)/stop\z}, :handle_stop],
+        ["POST", %r{\A/api/sessions/([^/]+)/restart\z}, :handle_restart],
         ["POST", %r{\A/api/sessions/([^/]+)/archive\z}, :handle_archive],
         ["POST", %r{\A/api/sessions/([^/]+)/unarchive\z}, :handle_unarchive],
         ["POST", %r{\A/api/sessions/([^/]+)/turn\z}, :handle_turn],
@@ -375,10 +377,12 @@ module Samagotchi
       end
 
       # What a second `chi web` probes before starting its own server: this
-      # is chi web, and it knows ?dir (features).
+      # is chi web, and it knows ?dir (features). installed: the newest chi
+      # on this machine (nil until the hub has looked); newest_workers: the
+      # workers it starts run that one, not this chi web's version.
       def handle_info(_req)
-        json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, cwd: Dir.pwd,
-                             features: ["dir"], lan: @lan && @lan[:ip] })
+        json_response(200, { app: "chi-web", version: Samagotchi::VERSION, installed: @hub&.installed, pid: Process.pid,
+                             cwd: Dir.pwd, features: %w[dir newest_workers], lan: @lan && @lan[:ip] })
       end
 
       # The models a new session can start on, spelled as chi spells them
@@ -441,8 +445,21 @@ module Samagotchi
         json_response(200, payload)
       end
 
+      # Built again when config.yml's hosts: changed (compared as read: the
+      # YAML read is mtime-cached), so the model picker lists a host added
+      # while chi web runs. An injected registry (specs) stays.
       def host_registry
-        @models_mutex.synchronize { @registry ||= HostRegistry.new }
+        @models_mutex.synchronize do
+          next @registry if @registry_given
+
+          hosts = ConfigFile.hosts_config
+          if @registry.nil? || hosts != @registry_hosts
+            @registry = HostRegistry.new(hosts_config: hosts)
+            @registry_hosts = hosts
+            @models_thread = nil # a listing of the old hosts
+          end
+          @registry
+        end
       end
 
       # The hosts' model lists (cached ones as they are), or the last complete
@@ -785,8 +802,10 @@ module Samagotchi
       # worker_timeout (+what+ didn't happen), a 404 for a route the worker
       # doesn't have → 501 not_supported (it runs an older chi that +cant+;
       # 501, not 503: it is live, and the page reads 503 as "not running"),
-      # and no live bridge, a refused connection or anything else → 503
-      # not_live.
+      # another unmapped status → 502 bridge_error with the worker's detail
+      # (a live worker that failed the request; never 503, which the page
+      # reads as "session not running"), and only no live bridge, a refused
+      # connection or one that says it isn't this session's → 503 not_live.
       # @param request [#call] sends with the client, answers its Response
       def relay(id, client, request, what:, cant:)
         return not_live(id) unless client
@@ -801,7 +820,7 @@ module Samagotchi
           return not_live(id) if reply.json&.dig("error") == "unknown_session"
 
           error_response(501, "not_supported", BridgeClient.stale_worker_message(id, cant: cant))
-        else not_live(id)
+        else bridge_error(reply, what)
         end
       rescue Errno::ETIMEDOUT
         worker_timeout(what)
@@ -813,6 +832,15 @@ module Samagotchi
         error_response(503, "not_live", "no live bridge for session #{id}")
       end
 
+      # A live worker refused or failed the request (a 500 in its handler, a
+      # status this route doesn't know): 502, with its detail when it sent
+      # one. 503 would have the page say the session isn't running, which is
+      # untrue and sends the user to restart a healthy worker.
+      def bridge_error(reply, what)
+        detail = reply_detail(reply, "#{what}: the session's worker answered #{reply.status}")
+        error_response(502, "bridge_error", detail)
+      end
+
       # The Bridge's detail for a refusal, or +fallback+.
       def reply_detail(reply, fallback)
         reply.json&.dig("detail") || fallback
@@ -976,6 +1004,26 @@ module Samagotchi
         error_response(404, "not_found", e.message)
       end
 
+      # POST /api/sessions/:id/restart: hand the session to a new worker on
+      # the newest chi installed (SessionManager.restart_session). 200
+      # {status: "restarted", session_id, from_version, version} (version nil:
+      # the new worker is still starting; its bridge_up follows); 409
+      # {error: "held" | "not_running" | "unsupported" | "failed", reason, detail} in words; 409
+      # owned_by_tui; 404.
+      def handle_restart(_req, id)
+        result = @manager.restart_session(id, state_dir: @state_dir, client_id: "web:restart")
+        @hub&.touch(id)
+        json_response(200, { status: "restarted", session_id: id, from_version: result.from_version,
+                             version: result.version })
+      rescue SessionManager::RestartRefused => e
+        error = %i[not_running unsupported failed].include?(e.reason) ? e.reason.to_s : "held"
+        json_response(409, { error: error, reason: e.reason.to_s, detail: e.message, session_id: id })
+      rescue SessionManager::OwnedByTUI => e
+        error_response(409, "owned_by_tui", e.message)
+      rescue ArgumentError => e
+        error_response(404, "not_found", e.message)
+      end
+
       # POST /api/sessions/:id/archive: hide it (and its delegates) from the
       # lists, keep it for good. A live idle worker is stopped first; a turn
       # running in it or a delegate, a chi REPL's session and a scratch one
@@ -1062,7 +1110,8 @@ module Samagotchi
       # GET /api/events: the session list as one SSE stream per tab. The
       # first frame is the hub's snapshot (scoped by ?dir= as the list is,
       # with chi's version),
-      # then `session` for an upsert and `session_gone` for a removal, with
+      # then `session` for an upsert, `session_gone` for a removal and `chi`
+      # when the newest installed chi changed, with
       # a `: ping` while idle. Frame ids are the hub's seq, for the log's
       # sake: there is no replay, a reconnect starts with a fresh snapshot.
       def handle_events(req)
@@ -1598,11 +1647,15 @@ module Samagotchi
           @server_running = server_running
           @queue = Bridge::BoundedQueue.new(capacity: capacity)
           @handle, @snapshot = @hub.subscribe(->(event) { @queue.push(event) }, snapshot: true, project_root: project_root)
+          # Read after subscribing: a change in between is also a queued event.
+          @installed = @hub.installed
         end
 
         def each
-          # version: the page compares it with the one it was served by.
-          yield frame(nil, "snapshot", sessions: @snapshot, version: Samagotchi::VERSION)
+          # version: the page compares it with the one it was served by;
+          # installed: the newest chi on this machine (a later change is a
+          # `chi` event).
+          yield frame(nil, "snapshot", sessions: @snapshot, version: Samagotchi::VERSION, installed: @installed)
           last_write = monotonic
           loop do
             event = @queue.pop([@heartbeat, EVENTS_POLL].min)

data/lib/samagotchi/web/public/app.js

@@ -4,6 +4,7 @@ import {
   sendTurn,
   cancelTurn,
   stopSession,
+  restartSession,
   deleteSession,
   archiveSession,
   unarchiveSession,
@@ -39,12 +40,12 @@ import { shouldFollowScroll, keepFollowing } from "./scroll.js";
 import { SHORT_WINDOW_QUERY, stripAutoHidden, stripColumns, stripShowParts } from "./strip.js";
 import { applySessionEvent, heldOrder, listedSessions, sortedByUpdated, waitingBadge, waitingFirst, waitingSearchText, withChildrenAfterParents } from "./sessions_list.js";
 import { createNotifications } from "./notifications.js";
-import { updateNotice } from "./update_notice.js";
+import { restartConfirmText, versionNotice, workerBadge } from "./update_notice.js";
 import {
   appendAboveLiveTiming, cancelLineText, elapsedSince, formatDuration, mergeTiming, normalizeTiming, turnTimingText,
 } from "./timing.js";
 import { DONE_MS, applyInitEvent, dropDone, initRowHtml, newInitTasks, seedInitTasks } from "./init_row.js";
-import { clientLabel, commandView, emptyAnswerLine, emptyRetryLine, hookNoticeLabel, initWaitLine, isOwn, sessionCommandLine, keepEarlyRestore, newClientId, noticeLine, promptOps, reminderText, restoreAction, restoreOnAck, retryStatusLine, snapshotEvents, startPageReply, turnOutput, unknownCommandHint, webLocalReply, workerGoneText } from "./turn_events.js";
+import { clientLabel, commandView, displayWait, dropEarlyRestores, emptyAnswerLine, emptyRetryLine, hookNoticeLabel, initWaitLine, isOwn, sessionCommandLine, keepEarlyRestore, newClientId, noticeLine, promptOps, reminderText, restoreAction, composerAfterAck, restoreOnAck, retryStatusLine, snapshotEvents, startPageReplyOrHint, turnOutput, unknownCommandHint, webLocalReply, workerGoneText } from "./turn_events.js";
 
 const $ = (s) => document.querySelector(s);
 const topStripEl = $("#topStrip");
@@ -179,7 +180,7 @@ async function refresh() {
 function openSessionEvents() {
   eventsControl = openEvents({
     snapshot: (data) => {
-      noticeUpdate(data.version);
+      noticeVersions(data);
       notifications.noticeSessions("snapshot", data);
       allSessions = applySessionEvent(allSessions, "snapshot", data);
       render();
@@ -201,6 +202,7 @@ function openSessionEvents() {
       }
       leaveGoneSession(data.id, "deleted");
     },
+    chi: (data) => noticeVersions(data),
   }, {
     dir: scope.dir,
     onError: () => {
@@ -210,15 +212,24 @@ function openSessionEvents() {
   });
 }
 
-// chi web was upgraded while this tab stayed open (a snapshot on the
-// reconnect names another version than the one that served the page):
-// a toast offers the reload, never forces it.
-let updateShownFor = null;
-function noticeUpdate(served) {
-  const text = updateNotice(document.body.dataset.version, served, updateShownFor);
-  if (!text) return;
-  updateShownFor = served;
-  showToast(text, { label: "Reload", run: () => location.reload() }, { sticky: true });
+// Which chi serves this page now and which is the newest installed (the
+// events snapshot, and `chi` frames when that changes). A toast says when
+// chi web was upgraded while this tab stayed open (offering the reload,
+// never forcing it) or when a newer chi is installed than chi web runs.
+// Once per notice per tab: every reconnect's snapshot says it again.
+const versions = { served: null, installed: null };
+// The session whose Restart is under way (its button says so).
+let restartingId = null;
+const versionNoticesShown = new Set();
+function noticeVersions(data) {
+  if (typeof data.version === "string") versions.served = data.version;
+  versions.installed = typeof data.installed === "string" ? data.installed : null;
+  const notice = versionNotice({ loaded: document.body.dataset.version, served: versions.served,
+                                 installed: versions.installed, shown: versionNoticesShown });
+  updateInfoBar(); // the worker badge compares with the newest installed
+  if (!notice) return;
+  versionNoticesShown.add(notice.key);
+  showToast(notice.text, notice.reload ? { label: "Reload", run: () => location.reload() } : null, { sticky: true });
 }
 
 // The selected session's card changed: its owner and, without a live
@@ -227,6 +238,8 @@ function noticeUpdate(served) {
 // gets the stream attached through one resync.
 function followSelectedSession(sess) {
   current.owner = sess.owner || null;
+  current.workerVersion = sess.worker_version || null;
+  current.workerFeatures = Array.isArray(sess.worker_features) ? sess.worker_features : [];
   const streaming = !!(streamControl && streamControl.live);
   if (!streaming) current.status = sess.status;
   updateInfoBar();
@@ -240,7 +253,7 @@ function followSelectedSession(sess) {
 // new chat starts on the start page.
 function renderScope() {
   const el = $("#scope");
-  const allLink = `<a class="scope-all" href="${escapeHtml(allScopeHref(location.hash, scope.dir))}" title="Sessions of every project">all</a>`;
+  const allLink = `<a class="scope-all" href="${escapeHtml(allScopeHref(location.hash, scope.dir, location.search))}" title="Sessions of every project">all</a>`;
   if (scopeError) {
     el.innerHTML = `<span class="scope-name error" title="${escapeHtml(scopeError)}">folder not found</span>${allLink}`;
   } else if (scope.projectName) {
@@ -248,7 +261,7 @@ function renderScope() {
   } else {
     const where = scope.dir || scope.serverDir;
     const backLink = scope.backName
-      ? `<a class="scope-all scope-back" href="${escapeHtml(projectScopeHref(scope.backDir, location.hash))}" title="Sessions of ${escapeHtml(scope.backName)} only">← ${escapeHtml(scope.backName)}</a>`
+      ? `<a class="scope-all scope-back" href="${escapeHtml(projectScopeHref(scope.backDir, location.hash, location.search))}" title="Sessions of ${escapeHtml(scope.backName)} only">← ${escapeHtml(scope.backName)}</a>`
       : "";
     el.innerHTML = `<span class="scope-name" title="Sessions of every project">all projects</span>${backLink}${where ? `<span class="scope-where" title="New chats start in ${escapeHtml(where)}">new chat in<span class="path"><bdi>${escapeHtml(where)}</bdi></span></span>` : ""}`;
   }
@@ -256,10 +269,10 @@ function renderScope() {
   notifications.setBaseTitle(scope.projectName ? `Chi · ${scope.projectName}` : "Chi");
   // The links follow the hash (an open session, the all-sessions view).
   el.querySelector(".scope-all:not(.scope-back)")?.addEventListener("click", (e) => {
-    e.currentTarget.href = allScopeHref(location.hash, scope.dir);
+    e.currentTarget.href = allScopeHref(location.hash, scope.dir, location.search);
   });
   el.querySelector(".scope-back")?.addEventListener("click", (e) => {
-    e.currentTarget.href = projectScopeHref(scope.backDir, location.hash);
+    e.currentTarget.href = projectScopeHref(scope.backDir, location.hash, location.search);
   });
 }
 
@@ -388,7 +401,7 @@ function renderTop(sessions) {
   topStripEl.classList.remove("loading");
   renderStripShow();
   if (scopeError) {
-    topStripEl.innerHTML = `<div class="hint scope-error">${escapeHtml(scopeError)} · <a href="${escapeHtml(allScopeHref(""))}">show every session</a></div>`;
+    topStripEl.innerHTML = `<div class="hint scope-error">${escapeHtml(scopeError)} · <a href="${escapeHtml(allScopeHref("", null, location.search))}">show every session</a></div>`;
     return;
   }
   // Only archived sessions: no cards, but the tile stays, the way to them.
@@ -686,6 +699,7 @@ function resetTurnView() {
   questionCards.forgetContinue();
   unmatchedMerge = false;
   setTurnRunning(false);
+  releaseDisplayWait();
 }
 
 // (Re)render the selected session from the server and stream on from the
@@ -711,6 +725,7 @@ async function resync({ endText = null } = {}) {
       return;
     }
     if (id !== selected) return;
+    releaseDisplayWait();
     resetTurnView();
     renderSessionView(data);
     // Preview is read-only: a worker is woken only by POST /turn, so attach
@@ -842,9 +857,17 @@ function setMarkdownWarning(warning) {
 // markdown, the status and the timing. Kept as turnEndRead, so an
 // answer_display re-read waits for it.
 let turnEndRead = Promise.resolve();
-// Resolves the wait of a turn_completed with display_pending (its
-// answer_display landed).
-let displayLanded = null;
+// The wait of a turn_completed with display_pending for its answer_display
+// (turn_events.js displayWait). The worker may die in between and never send
+// one, so workerGone (through resetTurnView) and a re-render release it as
+// well as its own timeout: it must never hold the turn's answer forever.
+let displayPending = null;
+
+function releaseDisplayWait() {
+  displayPending?.finish();
+  displayPending = null;
+}
+
 async function readTurnEnd() {
   if (!selected) return;
   const id = selected;
@@ -1322,6 +1345,9 @@ function removeRecap() {
 // The info bar's "copy chi --attach": the full id, which the page shows
 // only short; "copied ✓" for 2 s.
 let attachCopiedAt = 0;
+infoTextEl.addEventListener("click", (e) => {
+  if (e.target.closest(".worker-restart")) restartWorker();
+});
 infoTextEl.addEventListener("click", async (e) => {
   if (!e.target.closest(".copy-attach") || !selected) return;
   if (!(await copyText(`chi --attach ${selected}`))) return;
@@ -1330,6 +1356,44 @@ infoTextEl.addEventListener("click", async (e) => {
   setTimeout(updateInfoBar, 2000);
 });
 
+// The open session's worker runs an older chi than the newest installed:
+// a badge, with Restart when the worker can (else the stop command).
+function currentWorkerBadge() {
+  if (!selected || current.owner !== "worker") return null;
+  return workerBadge({ workerVersion: current.workerVersion, features: current.workerFeatures,
+                       installed: versions.installed, served: versions.served, sessionId: selected });
+}
+
+function workerBadgeHtml() {
+  const badge = currentWorkerBadge();
+  if (!badge) return "";
+  const busy = restartingId === selected;
+  const button = badge.restart
+    ? `<button type="button" class="worker-restart"${busy ? " disabled" : ""}>${busy ? "restarting…" : "Restart"}</button>`
+    : "";
+  return `<span class="worker-badge" title="${escapeHtml(badge.title)}">${escapeHtml(badge.text)}${button}</span>`;
+}
+
+// Restart: the session moves to a new worker on the newest chi; the page
+// follows it (its bridge_up), the composer's draft stays as it is.
+async function restartWorker() {
+  const badge = currentWorkerBadge();
+  if (!badge || !badge.restart || restartingId) return;
+  if (!confirm(restartConfirmText(current.workerVersion, badge.newest))) return;
+  const id = selected;
+  restartingId = id;
+  updateInfoBar();
+  try {
+    const result = await restartSession(id);
+    showToast(result.version ? `Restarted on chi ${result.version}` : "Restarting: the new worker is starting");
+  } catch (e) {
+    showToast(`Can't restart: ${String(e.message).replace(/ \(\d+\)$/, "")}`, null, { sticky: true });
+  } finally {
+    restartingId = null;
+    updateInfoBar();
+  }
+}
+
 function updateInfoBar() {
   const stopBtn = document.getElementById("infoStopBtn");
   const deleteBtn = document.getElementById("infoDeleteBtn");
@@ -1362,7 +1426,7 @@ function updateInfoBar() {
   const attachCmd = `chi --attach ${selected}`;
   const copied = Date.now() - attachCopiedAt < 2000;
   const copyHtml = `<button type="button" class="copy-attach" title="Copy &quot;${escapeHtml(attachCmd)}&quot; to attach a terminal">${copied ? "copied ✓" : "copy chi --attach"}</button>`;
-  const metaHtml = `<div class="meta"><span class="id" title="${escapeHtml(selected)}">${escapeHtml(idShort)}</span>${copyHtml}<span class="${statusClass}">${escapeHtml(current.status||"")}</span><span class="model${label.mismatch ? " served-mismatch" : ""}" title="${escapeHtml(label.title)}">${escapeHtml(label.text)}</span>${parentHtml}<span class="dir" title="${escapeHtml(current.dir||"")}">${escapeHtml((current.dir||"").slice(0,48))}</span>${ctxText ? `<span class="model">${escapeHtml(ctxText)}</span>` : ""}${timingText ? `<span class="model">${escapeHtml(timingText)}</span>` : ""}</div>`;
+  const metaHtml = `<div class="meta"><span class="id" title="${escapeHtml(selected)}">${escapeHtml(idShort)}</span>${copyHtml}<span class="${statusClass}">${escapeHtml(current.status||"")}</span><span class="model${label.mismatch ? " served-mismatch" : ""}" title="${escapeHtml(label.title)}">${escapeHtml(label.text)}</span>${parentHtml}<span class="dir" title="${escapeHtml(current.dir||"")}">${escapeHtml((current.dir||"").slice(0,48))}</span>${ctxText ? `<span class="model">${escapeHtml(ctxText)}</span>` : ""}${timingText ? `<span class="model">${escapeHtml(timingText)}</span>` : ""}${workerBadgeHtml()}</div>`;
   const previewHtml = `<div class="preview-line"><span class="preview">${escapeHtml(current.firstPreview || "—")}</span> · <span class="mem" title="${escapeHtml(current.usedMemories.join(", "))}">mem: ${escapeHtml(memText)}</span></div>`;
   infoTextEl.innerHTML = metaHtml + previewHtml;
   infoTextEl.title = memoriesTooltip(current.usedMemories, current.preloadedMemories, current.mutedMemories);
@@ -1618,8 +1682,11 @@ const streamHandlers = {
     const out = turnOutput(data);
     if (out) appendChunk(out);
     // after_turn hooks are running and may present the answer: its
-    // answer_display (display: null when they didn't) comes next.
-    const display = data.display_pending ? new Promise((resolve) => { displayLanded = resolve; }) : null;
+    // answer_display (display: null when they didn't) comes next. A worker
+    // that dies before it never sends one: workerGone releases the wait, and
+    // displayWait's timeout ends it whatever happens (4.14).
+    const display = data.display_pending ? displayWait() : null;
+    if (display) displayPending = display;
     turnEndRead = readTurnEnd();
     await turnEndRead;
     // The answer bubble the turn view held at its box's height pops now
@@ -1627,7 +1694,7 @@ const streamHandlers = {
     // plain text pops), and the display if one was coming, so the links
     // never swap in after the pop. The hold reveals by itself after
     // HOLD_MS whatever comes. The stage has no hold.
-    if (display) await display;
+    if (display) await display.promise;
     turnDom.answerReady?.();
   },
   // An after_turn hook presented the answer (AnswerDisplay): it comes after
@@ -1640,8 +1707,7 @@ const streamHandlers = {
       if (Array.isArray(d.messages)) applyFinalMarkdown(d.messages);
     } catch (_) {
     } finally {
-      displayLanded?.();
-      displayLanded = null;
+      releaseDisplayWait();
     }
   },
   turn_canceled: (data) => {
@@ -1822,7 +1888,9 @@ async function handleSendTurn() {
   // An image-only send's text is its placeholders: not for ↑.
   const typed = promptEl.value.trim() !== "";
   if (!selected) {
-    const local = startPageReply(prompt, { images: chips.length });
+    // The start page's own reply (a web-local command) or the hint for a
+    // typo: neither needs a session, so none is made for it (2.29).
+    const local = startPageReplyOrHint(prompt, { commands: current.commands, images: chips.length });
     if (local) {
       promptEl.value = "";
       fitPrompt();
@@ -1885,9 +1953,10 @@ async function handleSendTurn() {
     if (ack?.enqueued_id) sentIds.add(ack.enqueued_id);
     refreshHistory();
     // A turn that failed fast was restored before this ack: its prompt
-    // (and images) go back into the composer.
+    // (and images) go back into the composer, without replacing text typed
+    // since (4.13). The composer still holds the text just sent: it goes.
     const restored = restoreOnAck(ack?.enqueued_id, earlyRestores, { myId: clientId, sentIds });
-    promptEl.value = restored?.refill || "";
+    promptEl.value = composerAfterAck({ sent: prompt, current: promptEl.value, refill: restored?.refill || "" });
     fitPrompt();
     clearChips();
     if (restored?.images?.length) setChips(restoredChips(selected, restored.images));
@@ -1903,6 +1972,10 @@ async function handleSendTurn() {
     if (!streamControl?.live) startStream(selected, selectSeq ?? 0);
   } catch (e) {
     echo.remove();
+    // The turn never reached the worker's queue: an early restore waiting
+    // for its ack is never taken back (4.13), so drop it here. The prompt
+    // is still in the composer, as the echo was removed.
+    dropEarlyRestores(earlyRestores);
     // The chips stay (uploaded ones keep their ref) for another try.
     if (/bad_image|too_large/.test(e.message)) {
       alert(e.message);