Self-hosting room (mirror): dangerous-mode reload, crash backup + hot-restore, and hardening

[RonTuretzky]

Context — what already shipped (merged to main, 6dd9248)

The room can build itself: ./run-room.sh --self (VIBERSYN_SELF_MODE=1) pins a standing "Vibersyn Room" project (upid self, spoken callsign "mirror"). Steering it (click-steer or "mirror, <instruction>") launches a durable vibersyn-self gateway run (Claude subscription via .smithers/workflows/vibersyn-self.tsx) whose agent edits the room's own source under guardrails:

• smallest change satisfying the instruction; never touches gesture-wall/**, .smithers/**, dirty files
• must pass bunx tsc --noEmit + bun run build, then commits self: <summary>
• on green: POST /api/self/reload (honored only in self mode) → server drains ~750ms → exit 87 → scripts/self-supervisor.sh rebuilds (bun run build) → relaunches → walls detect the new bootId via SSE reconnect and location.reload() (with a "room is reloading itself…" overlay)
• failed gate → error surfaced on the card, no reload, no commit; reloads serialized; emergency stop aborts self-runs
• proven live: commit 2bf0bfc ("self: retitle help overlay…") was authored by the room about itself

Key files: src/self/commission.ts, src/server/composition.ts (bootId / #selfMode / #selfCommission / resolveSelfReloadDelayMs), src/server/app.ts (/api/self/reload), scripts/self-supervisor.sh, .smithers/workflows/vibersyn-self.tsx, src/ui/self-reload.ts.

Requested, not yet built (this issue's scope)

1. Dangerous-permissions toggle ("YOLO self mode")

A toggle (env VIBERSYN_SELF_DANGEROUS=1 + a HUD toggle on the mirror card/deck) that skips the green gate entirely:

• the self-agent applies the change and triggers the rebuild+restart immediately — no tsc/test gate, no green-commit requirement
• if the new build crashes on boot, so be it: the supervisor performs a fresh restart
• semantics requested verbatim: "doesn't wait for a green self commit — it just does the change, and if it crashes, so be it: fresh restart."

2. Crash backup + hot-restore (the safety net that makes YOLO survivable)

• Last-good snapshot: before each dangerous apply, snapshot the last known-good state — at minimum the built dist/ + the git ref of the last commit that booted successfully (a self/last-good tag or ref updated after each healthy boot, e.g. N seconds of healthy /api/health post-launch)
• Crash-loop detection in the supervisor: if the relaunched server exits non-zero (or fails health) within T seconds, K times in a row → automatic hot-restore: redeploy the snapshot dist (no rebuild needed — instant), optionally git reset/revert the offending self-commit (or park it on a self/broken-<ts> branch for inspection), relaunch, walls reload
• The wall should show what happened ("self-change crashed the room — restored last good build; the change is parked on <branch>")
• Backup rotation: keep the last N snapshots (dist tarballs are small)

3. Known hardening gaps (pre-existing, documented)

• The reload loop only re-executes server + UI; self-edits to gateway workflows / the supervisor itself need a manual restart (deliberate — keeps the recovery machinery outside the blast radius; YOLO mode should NOT change this)
• Steer signals sent while a self-run's task is executing aren't replayed into the next steer window (smithers 0.23 signal-matching limitation; at most one queued steer consumed per window)
• Supervisor is session-bound today — a supervised (launchd) deployment would let self-reloads survive host restarts
• bun test is not part of the self green gate (only tsc + build) — consider a fast test subset for gated mode

Acceptance criteria

• VIBERSYN_SELF_DANGEROUS=1 + HUD toggle switches the mirror pipeline to apply-without-gate
• Crashing self-change → automatic hot-restore to last-good within ~10s, walls reload, incident surfaced on the card
• Broken change preserved (branch/park) for post-mortem, never silently lost
• Gated (default) mode behavior unchanged
• Supervisor unit tests for crash-loop detection + restore path; e2e: deliberately ship a crashing change in dangerous mode and watch the room self-restore