yaver-feedback-react-native 0.9.0 → 0.9.3

package/src/P2PClient.ts

@@ -1,7 +1,9 @@
 import { Platform } from 'react-native';
 import {
+  AppInfo,
   CapabilitySnapshot,
   FeedbackBundle,
+  FeedbackProjectRef,
   IncidentEvent,
   OpenCodeConfigSummary,
   OperationState,
@@ -10,6 +12,27 @@ import {
   TestSession,
   VoiceCapability,
 } from './types';
+import { AGENT_ENDPOINTS } from './_core/endpoints';
+import { RELOAD_PATH, describeReloadFailure } from './reloadActions';
+import type { DevServerSnapshot, ReloadWireMode } from './reloadActions';
+
+function unrefTimer(timer: ReturnType<typeof setTimeout>): void {
+  const maybeNodeTimer = timer as unknown as { unref?: () => void };
+  if (typeof maybeNodeTimer.unref === 'function') {
+    maybeNodeTimer.unref();
+  }
+}
+
+async function dogfoodFetch(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  unrefTimer(timer);
+  try {
+    return await fetch(url, { ...init, signal: ctrl.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 export interface FeedbackEvent {
   type: string;
@@ -26,6 +49,56 @@ export interface ReloadAck {
   changeClass?: string;
 }
 
+export interface DogfoodDevServerStatus {
+  running?: boolean;
+  serving?: boolean;
+  starting?: boolean;
+  building?: boolean;
+  framework?: string;
+  workDir?: string;
+  bundleUrl?: string;
+  previewUrl?: string;
+  error?: string;
+  capabilityGap?: unknown;
+}
+
+export interface DogfoodDevEvent {
+  type: string;
+  framework?: string;
+  logLine?: string;
+  message?: string;
+  phase?: string;
+  pct?: number;
+  currentFile?: string;
+  snapshot?: { recentLogs?: string[]; [key: string]: unknown };
+  [key: string]: unknown;
+}
+
+export interface DogfoodRemoteRuntimeTarget {
+  id: string;
+  label: string;
+  enabled: boolean;
+  reason?: string;
+  platform?: string;
+  surface?: string;
+  displaySurface?: string;
+}
+
+export interface DogfoodRemoteRuntimeCapabilities {
+  remoteRuntimeEligible?: boolean;
+  targets: DogfoodRemoteRuntimeTarget[];
+}
+
+export interface DogfoodRemoteRuntimeSession {
+  id: string;
+  status: string;
+  targetId?: string;
+  targetLabel?: string;
+  transportMode?: string;
+  note?: string;
+  [key: string]: unknown;
+}
+
 /**
  * Try to resolve `{projectName, bundleId}` for the running app so the
  * agent can map the reload request to a MobileProject in its scan
@@ -76,6 +149,148 @@ export function resolveAppIdentity(opts?: {
   return out;
 }
 
+/**
+ * Is this JS running inside Yaver's own container as a pushed Hermes guest?
+ *
+ * The YaverInfo native module is registered only by Yaver's app, so its
+ * presence means the ambient runtime describes Yaver rather than the app
+ * whose code is executing. Mirrors the checks in YaverFeedback.ts,
+ * ShakeDetector.ts and QuickActionIcon.tsx.
+ */
+function isInsideYaverContainer(): boolean {
+  try {
+    const { NativeModules } = require('react-native');
+    return !!NativeModules?.YaverInfo;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Read the guest project Yaver's host shell pinned for this bundle.
+ *
+ * When an app's JS is pushed into Yaver's container as a Hermes guest, the
+ * ambient runtime describes the HOST — `expo-constants` and `SettingsManager`
+ * both answer `Yaver` / `io.yaver.mobile`. Auto-resolution would therefore
+ * file every guest report against Yaver's own repo, and the fix task would
+ * edit the SDK instead of the app under test.
+ *
+ * Yaver already knows the right answer: picking a project in the Hot Reload
+ * tab calls `YaverInfo.setInheritedGuestProject(name, path)`. Only the name
+ * is used here — the agent resolves the path itself and deliberately ignores
+ * client-supplied ones on feedback reports.
+ */
+function resolveInheritedGuestProjectName(): string | undefined {
+  try {
+    const { NativeModules } = require('react-native');
+    const name = String(NativeModules?.YaverInfo?.inheritedGuestProjectName || '').trim();
+    return name || undefined;
+  } catch {
+    // Not inside Yaver's container, or react-native unavailable (unit tests).
+    return undefined;
+  }
+}
+
+/**
+ * Build the app-identity half of a feedback report's metadata.
+ *
+ * `resolveAppIdentity()` has always fed /vibing/execute and /dev/reload-app,
+ * so the agent could route a "vibe on THIS app" request to the right repo —
+ * but nothing fed /feedback. Reports arrived with no identity at all, so the
+ * agent's fix router fell through to its own working directory and edited
+ * whichever repo it happened to be sitting in. This closes that gap by
+ * reusing the same resolver for the feedback path.
+ *
+ * Precedence, most to least trustworthy:
+ *   1. What the host app declared (`FeedbackConfig.projectName`/`bundleId`).
+ *      An app knows its own identity; nothing should override it.
+ *   2. The guest project Yaver's host shell pinned, when running as a Hermes
+ *      guest. Ambient lookups describe Yaver there, not the guest.
+ *   3. Ambient expo-constants / native modules — correct for a standalone
+ *      build, which is the common case.
+ *
+ * Every lookup is best-effort: a bare RN app with no expo-constants still
+ * produces a report, just one the agent resolves by its own means.
+ */
+export function resolveReportIdentity(opts?: {
+  projectName?: string;
+  bundleId?: string;
+  surface?: FeedbackProjectRef['surface'];
+  surfaces?: FeedbackProjectRef['surfaces'];
+  stack?: string;
+  stacks?: string[];
+  testSurfaces?: string[];
+  feedbackSdk?: string;
+  feedbackTransport?: string;
+  voiceCapabilities?: string[];
+  sttProvider?: string;
+  ttsProvider?: string;
+}): {
+  appName?: string;
+  app: AppInfo;
+  project?: FeedbackProjectRef;
+} {
+  let projectName = (opts?.projectName || '').trim() || undefined;
+  let bundleId = (opts?.bundleId || '').trim() || undefined;
+  let version: string | undefined;
+  let buildNumber: string | undefined;
+
+  if (isInsideYaverContainer()) {
+    // Every ambient lookup answers for the HOST here. Because the agent
+    // routes on bundle id first, letting Yaver's id through would resolve
+    // straight to Yaver's own repo and the guest's name would never be
+    // consulted — so nothing ambient is trusted in the container. The
+    // version is Yaver's too, and reporting it would only mislabel which
+    // build the report came from.
+    projectName = projectName || resolveInheritedGuestProjectName();
+  } else {
+    const ambient = resolveAppIdentity({ projectName, bundleId });
+    projectName = ambient.projectName;
+    bundleId = ambient.bundleId;
+    try {
+      const Constants = require('expo-constants').default ?? require('expo-constants');
+      const cfg = Constants?.expoConfig ?? Constants?.manifest ?? {};
+      version = Constants?.nativeAppVersion || cfg?.version;
+      buildNumber =
+        Constants?.nativeBuildVersion ||
+        cfg?.ios?.buildNumber ||
+        (cfg?.android?.versionCode != null ? String(cfg.android.versionCode) : undefined);
+    } catch {
+      // expo-constants not installed (bare RN). Version is cosmetic — the
+      // router keys off appName/bundleId, both of which survive without it.
+    }
+  }
+
+  const app: AppInfo = {};
+  if (bundleId) app.bundleId = bundleId;
+  if (version) app.version = version;
+  if (buildNumber) app.buildNumber = buildNumber;
+
+  if (!projectName && !bundleId) {
+    return { app };
+  }
+
+  const project: FeedbackProjectRef = { surface: opts?.surface ?? 'mobile' };
+  if (projectName) {
+    project.projectName = projectName;
+    project.appName = projectName;
+  }
+  // Note: projectPath is intentionally omitted — the agent ignores
+  // client-supplied paths on feedback reports and resolves them itself.
+  if (bundleId) project.bundleId = bundleId;
+  if (opts?.surfaces) project.surfaces = opts.surfaces;
+  if (opts?.stack) project.stack = opts.stack;
+  if (opts?.stacks) project.stacks = opts.stacks;
+  if (opts?.testSurfaces) project.testSurfaces = opts.testSurfaces;
+  if (opts?.feedbackSdk) project.feedbackSdk = opts.feedbackSdk;
+  if (opts?.feedbackTransport) project.feedbackTransport = opts.feedbackTransport;
+  if (opts?.voiceCapabilities) project.voiceCapabilities = opts.voiceCapabilities;
+  if (opts?.sttProvider) project.sttProvider = opts.sttProvider;
+  if (opts?.ttsProvider) project.ttsProvider = opts.ttsProvider;
+
+  return { appName: projectName, app, project };
+}
+
 /**
  * Translate a raw Go-agent error into something a user can act on.
  *
@@ -255,6 +470,37 @@ export class P2PClient {
     return Array.isArray(data.runners) ? (data.runners as RunnerAuthStatusRow[]) : [];
   }
 
+  /** Canonical runner + model catalogue used by Vibing routing controls. */
+  async getAvailableRunners(): Promise<RunnerAuthStatusRow[]> {
+    const resp = await fetch(`${this.baseUrl}/agent/runners`, {
+      headers: this.authHeaders(),
+    });
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => '');
+      throw new Error(`getAvailableRunners HTTP ${resp.status}: ${text}`);
+    }
+    const data = await resp.json().catch(() => ({} as Record<string, unknown>));
+    return Array.isArray(data.runners) ? (data.runners as RunnerAuthStatusRow[]) : [];
+  }
+
+  /** Discovered runnable projects on the selected owner machine. Paths stay
+   * on that machine/transport; they are never registered in Yaver's backend. */
+  async listDogfoodProjects(): Promise<Array<{
+    name: string;
+    path: string;
+    framework?: string;
+    frameworks?: string[];
+    surfaces?: string[];
+  }>> {
+    const resp = await fetch(`${this.baseUrl}/projects`, { headers: this.authHeaders() });
+    if (!resp.ok) {
+      const body = await resp.text().catch(() => '');
+      throw new Error(`listDogfoodProjects HTTP ${resp.status}: ${body}`);
+    }
+    const data = await resp.json().catch(() => ({} as Record<string, unknown>));
+    return Array.isArray(data.projects) ? data.projects : [];
+  }
+
   async getOpenCodeConfig(): Promise<OpenCodeConfigSummary | null> {
     const resp = await fetch(`${this.baseUrl}/runner/opencode/config`, {
       headers: this.authHeaders(),
@@ -360,19 +606,22 @@ export class P2PClient {
 
   /** Health check — returns true if the agent is reachable. */
   async health(): Promise<boolean> {
+    let timeoutId: ReturnType<typeof setTimeout> | null = null;
     try {
       const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 3000);
+      timeoutId = setTimeout(() => controller.abort(), 3000);
+      unrefTimer(timeoutId);
 
       const response = await fetch(`${this.baseUrl}/health`, {
         method: 'GET',
         signal: controller.signal,
       });
 
-      clearTimeout(timeoutId);
       return response.ok;
     } catch {
       return false;
+    } finally {
+      if (timeoutId) clearTimeout(timeoutId);
     }
   }
 
@@ -545,6 +794,281 @@ export class P2PClient {
    * via the BlackBox command channel.
    * @param mode - "dev" for hot reload, "bundle" for native bundle rebuild
    */
+  /**
+   * Read the dev server's state so the overlay can decide WHICH reload
+   * actions to offer, and disable the rest with a reason.
+   *
+   * Returns null when the machine cannot be reached at all — which the
+   * caller must render as "not connected", never as "no dev server".
+   * Those are two different problems with two different fixes.
+   */
+  async getDevServerStatus(): Promise<DevServerSnapshot | null> {
+    try {
+      const resp = await fetch(`${this.baseUrl}${AGENT_ENDPOINTS.devStatus}`, {
+        headers: this.authHeaders(),
+      });
+      if (!resp.ok) return null;
+      const data = await resp.json().catch(() => ({} as Record<string, unknown>));
+      return {
+        running: data.running === true,
+        building: data.building === true,
+        framework: typeof data.framework === 'string' ? data.framework : undefined,
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Start the ordinary Projects runtime for an embedded Dogfood host.
+   * Requires a full signed-in-user token because /dev/start can spawn tools;
+   * a narrow feedback SDK token intentionally cannot use it.
+   */
+  async startDogfoodDevServer(input: {
+    framework: string;
+    workDir: string;
+    lane: 'browser' | 'hermes';
+  }): Promise<DogfoodDevServerStatus> {
+    if (input.lane === 'hermes') {
+      const ack = await this.reloadApp('bundle', { projectPath: input.workDir });
+      return { running: ack.ok, framework: input.framework, workDir: input.workDir };
+    }
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 45_000);
+    unrefTimer(timer);
+    try {
+      const response = await fetch(`${this.baseUrl}/dev/start`, {
+        method: 'POST',
+        headers: this.authHeaders({ 'Content-Type': 'application/json' }),
+        body: JSON.stringify({
+          framework: input.framework,
+          workDir: input.workDir,
+          platform: 'web',
+          caller: 'sdk',
+        }),
+        signal: ctrl.signal,
+      });
+      const data = (await response.json().catch(() => ({}))) as DogfoodDevServerStatus & {
+        code?: string; remedy?: string; retryable?: boolean;
+      };
+      if (!response.ok) {
+        const error = new Error(data.error || `Dogfood preview start failed with HTTP ${response.status}`) as Error & {
+          code?: string; remedy?: string; retryable?: boolean; capabilityGap?: unknown;
+        };
+        error.code = data.code || `DOGFOOD_DEV_START_HTTP_${response.status}`;
+        error.remedy = data.remedy || 'Fix the named dev-server failure, then retry Dogfood.';
+        error.retryable = data.retryable !== false;
+        error.capabilityGap = data.capabilityGap;
+        throw error;
+      }
+      return data;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  /** Full status for Dogfood startup; unlike the compact feedback snapshot,
+   * this retains render URLs and structured startup failures. */
+  async getDogfoodDevServerStatus(): Promise<DogfoodDevServerStatus | null> {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 10_000);
+    unrefTimer(timer);
+    try {
+      const response = await fetch(`${this.baseUrl}${AGENT_ENDPOINTS.devStatus}`, {
+        headers: this.authHeaders(),
+        signal: ctrl.signal,
+      });
+      if (!response.ok) return null;
+      return await response.json().catch(() => null) as DogfoodDevServerStatus | null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  async getDogfoodRemoteRuntimeCapabilities(
+    workDir: string,
+    framework: string,
+  ): Promise<DogfoodRemoteRuntimeCapabilities> {
+    const query = `?workDir=${encodeURIComponent(workDir)}&framework=${encodeURIComponent(framework)}`;
+    const response = await dogfoodFetch(`${this.baseUrl}/remote-runtime/capabilities${query}`, {
+      headers: this.authHeaders(),
+    }, 20_000);
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(data?.error || `Remote-runtime capabilities failed with HTTP ${response.status}`);
+    return { ...data, targets: Array.isArray(data?.targets) ? data.targets : [] };
+  }
+
+  async startDogfoodRemoteRuntime(
+    workDir: string,
+    framework: string,
+    targetId: string,
+  ): Promise<DogfoodRemoteRuntimeSession> {
+    const response = await dogfoodFetch(`${this.baseUrl}/remote-runtime/sessions`, {
+      method: 'POST',
+      headers: this.authHeaders({ 'Content-Type': 'application/json' }),
+      body: JSON.stringify({ workDir, framework, targetId, surface: 'sdk' }),
+    }, 45_000);
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(data?.error || `Remote-runtime start failed with HTTP ${response.status}`);
+    return data as DogfoodRemoteRuntimeSession;
+  }
+
+  async stopDogfoodRemoteRuntime(sessionId: string): Promise<void> {
+    const response = await dogfoodFetch(`${this.baseUrl}/remote-runtime/sessions/${encodeURIComponent(sessionId)}`, {
+      method: 'DELETE', headers: this.authHeaders(),
+    }, 15_000);
+    if (!response.ok) throw new Error(`Remote-runtime stop failed with HTTP ${response.status}`);
+  }
+
+  /** Stop the runtime this SDK host started. Full user auth, same as start. */
+  async stopDogfoodDevServer(): Promise<void> {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 15_000);
+    unrefTimer(timer);
+    try {
+      const response = await fetch(`${this.baseUrl}/dev/stop`, {
+        method: 'POST', headers: this.authHeaders(), signal: ctrl.signal,
+      });
+      if (!response.ok) throw new Error(`Dogfood preview stop failed with HTTP ${response.status}`);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  /** Resolve an agent-reported /dev/ or /dev-web/ route without putting auth in the URL. */
+  resolveDogfoodUrl(path: string): string {
+    return new URL(path, `${this.baseUrl.replace(/\/+$/, '')}/`).toString();
+  }
+
+  /**
+   * React-Native-safe /dev/events stream. XHR is intentional: Hermes fetch
+   * exposes no streaming response body. Reconnects are bounded and every
+   * reconnect/loss is surfaced to the host console.
+   */
+  subscribeDogfoodDevEvents(
+    onEvent: (event: DogfoodDevEvent) => void,
+    onHealth?: (health: { kind: 'reattaching' | 'lost'; message: string } | null) => void,
+  ): () => void {
+    let disposed = false;
+    let xhr: XMLHttpRequest | null = null;
+    let retryTimer: ReturnType<typeof setTimeout> | null = null;
+    let attempt = 0;
+
+    const open = () => {
+      if (disposed) return;
+      const request = new XMLHttpRequest();
+      xhr = request;
+      let parsed = 0;
+      let carry = '';
+      const consume = () => {
+        const text = request.responseText || '';
+        if (text.length <= parsed) return;
+        carry += text.slice(parsed);
+        parsed = text.length;
+        const normalized = carry.replace(/\r\n/g, '\n');
+        const frames = normalized.split('\n\n');
+        carry = frames.pop() || '';
+        for (const frame of frames) {
+          const data = frame.split('\n')
+            .filter((line) => line.startsWith('data:'))
+            .map((line) => line.slice(5).replace(/^ /, ''))
+            .join('\n');
+          if (!data) continue;
+          try {
+            attempt = 0;
+            onHealth?.(null);
+            onEvent(JSON.parse(data));
+          } catch { /* comments and non-JSON keepalives are valid SSE */ }
+        }
+      };
+      const reconnect = (reason: string) => {
+        if (disposed) return;
+        if (attempt >= 5) {
+          onHealth?.({ kind: 'lost', message: `Dev-server logs stopped: ${reason}` });
+          return;
+        }
+        const wait = Math.min(8_000, 500 * (2 ** attempt));
+        attempt += 1;
+        onHealth?.({ kind: 'reattaching', message: `Dev-server logs interrupted; reconnecting (${attempt}/5): ${reason}` });
+        retryTimer = setTimeout(open, wait);
+        unrefTimer(retryTimer);
+      };
+      request.open('GET', `${this.baseUrl}/dev/events`, true);
+      for (const [key, value] of Object.entries(this.authHeaders({ Accept: 'text/event-stream' }))) {
+        try { request.setRequestHeader(key, value); } catch { /* restricted RN header */ }
+      }
+      request.onprogress = consume;
+      request.onload = () => { consume(); reconnect(`HTTP ${request.status || 0}`); };
+      request.onerror = () => reconnect('connection failed');
+      request.onabort = () => reconnect('connection aborted');
+      request.ontimeout = () => reconnect('connection timed out');
+      try {
+        request.send();
+      } catch (error) {
+        reconnect(error instanceof Error ? error.message : 'connection could not start');
+      }
+    };
+    open();
+    return () => {
+      disposed = true;
+      if (retryTimer) clearTimeout(retryTimer);
+      try { xhr?.abort(); } catch { /* idempotent */ }
+    };
+  }
+
+  /**
+   * Trigger a reload with an EXPLICIT fast/full mode — no bundle fallback.
+   *
+   * `reloadApp('dev')` silently falls through to a bundle rebuild when the
+   * dev server is down, which is right for a one-button UX and wrong the
+   * moment the user picks between two named actions: someone who pressed
+   * "Full Reload" must not get a 60-second bundle rebuild without being
+   * told. So this method reports the failure instead, with a named cause.
+   *
+   * Auth: the SAME bearer used for the feedback POST. `/dev/reload` is
+   * registered under `authSDK` in desktop/agent/httpserver.go and is already
+   * in the `reload` SDK-token scope list — nothing widens.
+   */
+  async reloadWithMode(
+    mode: ReloadWireMode,
+    snapshot?: DevServerSnapshot | null,
+  ): Promise<ReloadAck> {
+    if (mode === 'bundle') return this.reloadApp('bundle');
+
+    let resp: Response;
+    try {
+      resp = await fetch(`${this.baseUrl}${RELOAD_PATH}`, {
+        method: 'POST',
+        headers: this.authHeaders({ 'Content-Type': 'application/json' }),
+        body: JSON.stringify({ mode }),
+      });
+    } catch (err) {
+      throw new Error(
+        describeReloadFailure(0, err instanceof Error ? err.message : '', snapshot),
+      );
+    }
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => '');
+      throw new Error(describeReloadFailure(resp.status, text, snapshot));
+    }
+    const payload = await resp.json().catch(() => ({} as Record<string, unknown>));
+    const nativeChangesDetected = payload.nativeChangesDetected === true;
+    return {
+      ok: true,
+      mode: 'dev',
+      acknowledged: true,
+      nativeChangesDetected,
+      changeClass: typeof payload.changeClass === 'string' ? payload.changeClass : undefined,
+      message: nativeChangesDetected
+        ? 'Reload accepted, but native files changed — a rebuild is required.'
+        : mode === 'full'
+          ? 'Full reload requested.'
+          : 'Hot reload requested.',
+    };
+  }
+
   async reloadApp(
     mode: 'dev' | 'bundle' = 'bundle',
     opts?: { projectName?: string; bundleId?: string; projectPath?: string },
@@ -631,14 +1155,14 @@ export class P2PClient {
    * the project context plus the user's prompt. Returns the task id the
    * caller can poll via `/tasks/{id}` if needed.
    *
-   * Requires an owner/CLI/paired token — the `/vibing*` routes do not
+   * Requires an owner/CLI token — the `/vibing*` routes do not
    * currently accept SDK-minted tokens. Power users typically drive
    * vibing from Claude Code / the Yaver mobile app; this method is a
    * convenience for the SDK's one-tap bug-report-to-vibing path.
    */
   async vibing(
     prompt: string,
-    opts?: { projectName?: string; bundleId?: string; projectPath?: string },
+    opts?: { projectName?: string; bundleId?: string; projectPath?: string; runner?: string; model?: string },
   ): Promise<{ taskId: string }> {
     // Resolve app identity exactly the same way we do for
     // reloadApp — bundle ID from expo-constants or native config.
@@ -656,6 +1180,8 @@ export class P2PClient {
         projectPath: identity.projectPath ?? opts?.projectPath ?? '',
         projectName: identity.projectName,
         bundleId: identity.bundleId,
+        runner: opts?.runner,
+        model: opts?.model,
       }),
     });
     if (!response.ok) {
@@ -956,6 +1482,56 @@ export class P2PClient {
     return { taskId: json.taskId, raw: json };
   }
 
+  /** Existing task history, filtered by the agent to Vibing/feedback topics. */
+  async listVibeThreads(input?: { projectName?: string; projectPath?: string }): Promise<Array<{
+    id: string;
+    title: string;
+    status: string;
+    createdAt?: string;
+    projectName?: string;
+    turnCount?: number;
+  }>> {
+    const params = new URLSearchParams();
+    if (input?.projectName) params.set('projectName', input.projectName);
+    if (input?.projectPath) params.set('projectPath', input.projectPath);
+    const query = params.toString();
+    const resp = await fetch(`${this.baseUrl}/vibing/tasks${query ? `?${query}` : ''}`, {
+      headers: this.authHeaders(),
+    });
+    if (!resp.ok) throw new Error(`listVibeThreads HTTP ${resp.status}`);
+    const json = (await resp.json().catch(() => ({}))) as { tasks?: Array<any> };
+    return (json.tasks || []).map((task) => ({
+      id: String(task.id),
+      title: String(task.title || 'New topic'),
+      status: String(task.status || 'completed'),
+      createdAt: task.createdAt,
+      projectName: task.projectName,
+      turnCount: task.turnCount,
+    }));
+  }
+
+  async getVibeThread(taskId: string): Promise<{
+    id: string;
+    title: string;
+    status: string;
+    turns?: Array<{ role: 'user' | 'assistant'; content: string; timestamp?: string }>;
+  }> {
+    const resp = await fetch(`${this.baseUrl}/vibing/task/${encodeURIComponent(taskId)}`, {
+      headers: this.authHeaders(),
+    });
+    if (!resp.ok) throw new Error(`getVibeThread HTTP ${resp.status}`);
+    const json = (await resp.json().catch(() => ({}))) as { task?: any };
+    return json.task || json as any;
+  }
+
+  async deleteVibeThread(taskId: string): Promise<void> {
+    const resp = await fetch(`${this.baseUrl}/vibing/task/${encodeURIComponent(taskId)}`, {
+      method: 'DELETE',
+      headers: this.authHeaders(),
+    });
+    if (!resp.ok) throw new Error(`deleteVibeThread HTTP ${resp.status}`);
+  }
+
   /**
    * Subscribe to a task's live stdout/stderr stream. Returns an abort
    * function — call it to detach. The agent emits NDJSON lines on