feat(vibe): adapt sessions to context and exploration

backend/src/routes/vibe-sessions.routes.ts

@@ -6,6 +6,7 @@ import {
   VibeSessionNotFoundError,
   VibePlanNotFoundError,
 } from '../services/vibe-session-coordinator.service.js';
+import { isValidVibeContext } from '../services/vibe-context.service.js';
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
@@ -56,6 +57,9 @@ export default async function vibeSessionsRoutes(
     if (body.context !== undefined && !isObject(body.context)) {
       return reply.code(400).send({ error: 'context must be an object' });
     }
+    if (isObject(body.context) && !isValidVibeContext(body.context)) {
+      return reply.code(400).send({ error: 'context contains an invalid structured Vibe value' });
+    }
     if (body.intent !== undefined && typeof body.intent !== 'string') {
       return reply.code(400).send({ error: 'intent must be a string' });
     }
@@ -125,6 +129,11 @@ export default async function vibeSessionsRoutes(
     if (body.payload !== undefined && !isObject(body.payload)) {
       return reply.code(400).send({ error: 'payload must be an object' });
     }
+    if (body.type === 'context_changed' && isObject(body.payload)
+      && body.payload.context !== undefined
+      && (!isObject(body.payload.context) || !isValidVibeContext(body.payload.context))) {
+      return reply.code(400).send({ error: 'context_changed payload.context must be structured Vibe context' });
+    }
     try {
       return reply.send(await coordinator.appendEvent(userId, sessionId, {
         eventId: body.eventId as string | undefined,