[bifrost0x]

Problem

The restart hint written by the Updates and restart status template stayed until the template ran again. After a restart, and even after logging in again, the overview still showed "Restart required" for up to a week.

Change

• Login recheck. While a saved host shows a restart hint, each login to it rereads only the restart marker: [ -e /var/run/reboot-required ] || [ -e /run/reboot-required ]. No sudo, no package manager, no writes.
  • Exactly reboot=no lowers the hint to False. Update counts and the check time stay as the last full check reported them.
  • Exactly reboot=yes keeps the hint and asks again on the next login.
  • Any other answer, or none, keeps the hint and stops the rereads until the next full check. A forced command (command= in authorized_keys, ForceCommand) may have answered in place of the test and must not run on every login.
• Scope. Hosts without a current hint are never asked. Neither are hints older than a week, quick connections, other users' sessions, changed endpoints or cancelled connects.
• No overwrite. The profile write happens under the profile lock, and only while the stored check is still the one that was read. A newer check is never overwritten.
• Overview. The restart item offers Check restart status again. It opens the template as a draft for the affected hosts, only while Automation is enabled, and is available in all six languages.

Security notes

• The recheck is the one deliberate exception to "nothing runs on its own". It only repeats a read the user already chose by running or scheduling the full check over the same login.
• A malicious host can only lower its own hint.
• The host_maintenance socket event carries just the profile id and goes only to the connecting client.
• An independent review found a repeat-on-every-login risk with forced-command keys, a race with a concurrent check, and a loose answer parser. All three are fixed here, and each has tests.
• Known, unchanged: like the existing platform detection, the recheck runs before the connect handler clears its in-memory credentials. That adds at most about 3 s, and only while a hint is shown.

Tests

• Python unit tests for:
  • the exact answer parser;
  • lowering on a gone marker, keeping on a present one;
  • stopping after an unclear answer, timeout or banner, and restarting after a new full check;
  • a busy collector, which sends nothing;
  • a concurrent newer check;
  • the session closing, being replaced, moving or being cancelled during the recheck;
  • the cases where nothing may be sent.
• OpenSSH integration: the real command on Debian answers reboot=yes or reboot=no with empty stderr.
• E2E: the overview button opens the draft with exactly the affected hosts, without saving or contacting a host.
• Full Python suite, JS suite, ESLint, the automation and overview E2E specs and the OpenSSH lab pass locally.