@goodtek/vibeops 2.4.2 → 2.4.3

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 2.4.3 - 2026-06-25
+
+### Fixed
+
+- **`task merge` / `task release`:** GitLab merges use `--auto-merge=false` so CI running no longer schedules auto-merge and reports success prematurely. Commands poll the host until `merged_at` is set before succeeding.
+- **`task sync`:** Refuses branch cleanup when the MR is open, closed-not-merged, auto-merge pending, or integration branch does not contain task commits. `--force` bypasses merge verification (local branch delete still uses `-D` when needed).
+
+### Added
+
+- **`task-sync-guard`:** MR lifecycle and integration-branch ancestry checks before `task sync` deletes branches.
+
 ## 2.4.2 - 2026-06-24
 
 ### Fixed

package/dist/cli.js

@@ -165,7 +165,7 @@ task
     .description("After MR merge: integration pull and delete task branch (TASK md unchanged)")
     .option("--dry-run", "Plan only")
     .option("--no-remote-delete", "Keep the task branch on the remote")
-    .option("--force", "Delete local task branch with -D if not fully merged")
+    .option("--force", "Bypass MR merge checks and delete local task branch with -D if not fully merged")
     .option("--cwd <path>", "Target directory")
     .action(async (taskRef, opts) => {
     await taskSyncCommand(taskRef, {

package/dist/commands/task-merge.js

@@ -6,6 +6,7 @@ import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
 import { getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 import { relPath } from "../lib/task-context.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
 import { resolveOpenTaskMergeRequest } from "../lib/task-effective-status.js";
@@ -101,7 +102,18 @@ export async function taskMergeCommand(taskRef, options = {}) {
             return;
         }
         try {
-            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method });
+            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method, immediate: true });
+            const verified = await assertMergeRequestMerged({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                integrationBranch: ctx.baseBranch,
+            });
+            if (!verified.ok) {
+                log.error(verified.message);
+                process.exitCode = 1;
+                return;
+            }
             log.ok(`${label} merged into ${ctx.baseBranch}.`);
         }
         catch (e) {
@@ -120,8 +132,19 @@ export async function taskMergeCommand(taskRef, options = {}) {
     else {
         log.warn(`Could not read ${label} state — attempting merge anyway.`);
         try {
-            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method });
-            log.ok(`${label} merge command completed.`);
+            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method, immediate: true });
+            const verified = await assertMergeRequestMerged({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                integrationBranch: ctx.baseBranch,
+            });
+            if (!verified.ok) {
+                log.error(verified.message);
+                process.exitCode = 1;
+                return;
+            }
+            log.ok(`${label} merged into ${ctx.baseBranch}.`);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);

package/dist/commands/task-release.js

@@ -4,6 +4,7 @@ import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
 import { gitRemoteUrl } from "../lib/git.js";
 import { bold, dim, log } from "../lib/logger.js";
 import { createMergeRequest, getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 function resolveMergeMethod(opts) {
     if (opts.rebase === true)
         return "rebase";
@@ -91,7 +92,18 @@ export async function taskReleaseCommand(options = {}) {
     }
     const method = resolveMergeMethod(options);
     try {
-        await mergeMergeRequest({ cwd, host, url: releaseUrl, method });
+        await mergeMergeRequest({ cwd, host, url: releaseUrl, method, immediate: true });
+        const verified = await assertMergeRequestMerged({
+            cwd,
+            host,
+            url: releaseUrl,
+            integrationBranch: productionBranch,
+        });
+        if (!verified.ok) {
+            log.error(verified.message);
+            process.exitCode = 1;
+            return;
+        }
         log.ok(`Release ${label} merged into ${productionBranch}.`);
     }
     catch (e) {

package/dist/commands/task-sync.js

@@ -1,14 +1,13 @@
 import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
-import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
+import { detectGitHost } from "../lib/git-host.js";
 import { gitBranchExists, gitDeleteBranch, gitDeleteRemoteBranch, gitFetchRemote, gitPullFastForwardOnly, gitRemoteBranchExists, gitRemoteUrl, gitSwitchToBranch, readGitInfo, } from "../lib/git.js";
-import { bold, cyan, dim, log, yellow } from "../lib/logger.js";
-import { probeMergeRequestCli } from "../lib/pr-create.js";
+import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
 import { relPath } from "../lib/task-context.js";
-import { getTaskMergeRequestLifecycle, isMergeRequestMerged, } from "../lib/task-effective-status.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
+import { checkTaskSyncReady } from "../lib/task-sync-guard.js";
 import { readTaskFile } from "../lib/task.js";
 function isProtectedBranch(name, integration, production) {
     return name === integration || name === production || name === "main" || name === "master";
@@ -53,30 +52,11 @@ export async function taskSyncCommand(taskRef, options = {}) {
     log.info(`  ${dim("file")}          ${relPath(cwd, taskFile)}`);
     log.info(`  ${dim("note")}        ${dim("Git cleanup only — TASK md stays Shipped")}`);
     log.blank();
-    const meta = await readTaskFile(taskFile);
-    if (!dryRun) {
-        const lifecycle = await getTaskMergeRequestLifecycle(cwd, taskFile);
-        if (lifecycle !== "none") {
-            const remoteUrl = await gitRemoteUrl(cwd, remote);
-            const host = remoteUrl !== null && detectGitHost(remoteUrl) !== null
-                ? detectGitHost(remoteUrl)
-                : gitCfg.host;
-            const label = mergeRequestLabel(host);
-            if (lifecycle === "open") {
-                log.warn(`${yellow(label)} still open — merge with task merge or the host UI before sync.`);
-            }
-            else if (lifecycle === "merged") {
-                log.ok(`${label} merged.`);
-            }
-        }
-        else if (await probeMergeRequestCli(gitCfg.host)) {
-            log.warn("Could not read MR state — continuing with branch cleanup.");
-        }
-    }
-    else if (meta.status === "shipped" && !(await isMergeRequestMerged(cwd, meta))) {
-        log.warn(`${yellow("MR")} not merged yet — merge on the host or \`task merge\`, then rerun task sync.`);
-    }
     if (dryRun) {
+        const meta = await readTaskFile(taskFile);
+        if (meta.status === "shipped" && options.force !== true) {
+            log.info(dim("Would verify MR is merged and integration branch contains task commits before cleanup."));
+        }
         log.info(bold("dry-run — would:"));
         log.info(`  · git fetch ${remote} --prune`);
         log.info(`  · git switch ${integrationBranch}`);
@@ -129,6 +109,28 @@ export async function taskSyncCommand(taskRef, options = {}) {
     else {
         log.warn(`No ${remote}/${integrationBranch} — skipped pull.`);
     }
+    const remoteUrl = await gitRemoteUrl(cwd, remote);
+    const host = remoteUrl !== null && detectGitHost(remoteUrl) !== null
+        ? detectGitHost(remoteUrl)
+        : gitCfg.host;
+    const syncGuard = await checkTaskSyncReady({
+        cwd,
+        taskFile,
+        remote,
+        integrationBranch,
+        taskBranch,
+        host,
+        force: options.force === true,
+    });
+    if (!syncGuard.ok) {
+        log.error(syncGuard.message ?? "Refusing task sync — merge checks failed.");
+        if (options.force !== true) {
+            log.info(dim("Use --force only if you intentionally want to delete the task branch without merge verification."));
+        }
+        process.exitCode = 1;
+        return;
+    }
+    log.ok(`Ready to sync — ${integrationBranch} contains the task commits.`);
     if (await gitBranchExists(cwd, taskBranch)) {
         try {
             await gitDeleteBranch(cwd, taskBranch, { force: options.force === true });

package/dist/lib/git.js

@@ -79,6 +79,20 @@ export async function gitHeadCommit(cwd, short = true) {
     const res = await tryGit(cwd, short ? ["rev-parse", "--short", "HEAD"] : ["rev-parse", "HEAD"]);
     return res ? res.stdout.trim() : null;
 }
+export async function gitRevParse(cwd, ref) {
+    const res = await tryGit(cwd, ["rev-parse", ref]);
+    return res ? res.stdout.trim() : null;
+}
+/** True when `ancestor` is contained in `descendant`'s history. */
+export async function gitIsAncestor(cwd, ancestor, descendant) {
+    try {
+        await runGit(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function gitBranchExists(cwd, name) {
     const res = await tryGit(cwd, ["show-ref", "--verify", "--quiet", `refs/heads/${name}`]);
     return res !== null;

package/dist/lib/pr-create.js

@@ -187,34 +187,50 @@ function prRefFromUrl(url) {
     return prNumberFromUrl(url) ?? url.trim();
 }
 export async function getMergeRequestState(cwd, host, url) {
+    const details = await getMergeRequestDetails(cwd, host, url);
+    return details?.state ?? "unknown";
+}
+export async function getMergeRequestDetails(cwd, host, url) {
     const ref = prRefFromUrl(url);
     try {
         if (host === "gitlab") {
             const { stdout } = await execFileAsync("glab", ["mr", "view", ref, "-F", "json"], { cwd, maxBuffer: 1024 * 1024 });
             const parsed = JSON.parse(stdout.trim());
-            const state = (parsed.state ?? "").toLowerCase();
-            if (state === "merged")
-                return "merged";
-            if (state === "opened" || state === "open")
-                return "open";
-            if (state === "closed")
-                return "closed";
-            return "unknown";
+            const state = normalizeGlabMergeRequestState(parsed.state ?? "");
+            return {
+                state,
+                mergedAt: parsed.merged_at ?? null,
+                mergeCommitSha: parsed.merge_commit_sha ?? null,
+                squashCommitSha: parsed.squash_commit_sha ?? null,
+            };
         }
-        const { stdout } = await execFileAsync("gh", ["pr", "view", ref, "--json", "state", "-q", ".state"], { cwd, maxBuffer: 1024 * 1024 });
-        const state = stdout.trim().toUpperCase();
-        if (state === "MERGED")
-            return "merged";
-        if (state === "OPEN")
-            return "open";
-        if (state === "CLOSED")
-            return "closed";
-        return "unknown";
+        const { stdout } = await execFileAsync("gh", ["pr", "view", ref, "--json", "state,mergedAt,mergeCommit"], { cwd, maxBuffer: 1024 * 1024 });
+        const parsed = JSON.parse(stdout.trim());
+        return {
+            state: normalizeGhMergeRequestState(parsed.state ?? ""),
+            mergedAt: parsed.mergedAt ?? null,
+            mergeCommitSha: parsed.mergeCommit?.oid ?? null,
+            squashCommitSha: null,
+        };
     }
     catch {
-        return "unknown";
+        return null;
     }
 }
+/** Poll host until MR/PR state is merged (or timeout). */
+export async function waitForMergeRequestMerged(cwd, host, url, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    const intervalMs = options.intervalMs ?? 2_000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const details = await getMergeRequestDetails(cwd, host, url);
+        if (details?.state === "merged" && details.mergedAt !== null) {
+            return true;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+    return false;
+}
 export async function closeMergeRequest(opts) {
     const ref = prRefFromUrl(opts.url);
     const label = mergeRequestLabel(opts.host);
@@ -240,7 +256,10 @@ export async function mergeMergeRequest(opts) {
     const label = mergeRequestLabel(opts.host);
     if (opts.dryRun === true) {
         if (opts.host === "gitlab") {
-            log.info(`would ${label} merge ${ref} (glab mr merge)`);
+            const immediate = opts.immediate !== false;
+            const flags = immediate ? " --auto-merge=false" : "";
+            const methodFlag = method === "squash" ? " --squash" : method === "rebase" ? " --rebase" : "";
+            log.info(`would ${label} merge ${ref} (glab mr merge${flags}${methodFlag})`);
         }
         else {
             log.info(`would gh pr merge ${ref} --${method}`);
@@ -248,7 +267,17 @@ export async function mergeMergeRequest(opts) {
         return;
     }
     if (opts.host === "gitlab") {
-        await execFileAsync("glab", ["mr", "merge", ref], {
+        const args = ["mr", "merge", ref];
+        if (opts.immediate !== false) {
+            args.push("--auto-merge=false");
+        }
+        if (method === "squash") {
+            args.push("--squash");
+        }
+        else if (method === "rebase") {
+            args.push("--rebase");
+        }
+        await execFileAsync("glab", args, {
             cwd: opts.cwd,
             maxBuffer: 4 * 1024 * 1024,
         });

package/dist/lib/task-merge-verify.js

@@ -0,0 +1,23 @@
+import { mergeRequestLabel } from "./git-host.js";
+import { getMergeRequestDetails, waitForMergeRequestMerged, } from "./pr-create.js";
+export async function assertMergeRequestMerged(input) {
+    const label = mergeRequestLabel(input.host);
+    if (input.wait !== false) {
+        const merged = await waitForMergeRequestMerged(input.cwd, input.host, input.url);
+        if (!merged) {
+            return {
+                ok: false,
+                message: `${label} merge did not complete (still open or auto-merge pending). Wait for Merged on the host, or rerun \`vibeops task merge\`.`,
+            };
+        }
+    }
+    const details = await getMergeRequestDetails(input.cwd, input.host, input.url);
+    if (details?.state !== "merged" || details.mergedAt === null) {
+        const state = details?.state ?? "unknown";
+        return {
+            ok: false,
+            message: `${label} is ${state}, not merged into ${input.integrationBranch}. Do not run task sync until the host shows Merged.`,
+        };
+    }
+    return { ok: true };
+}

package/dist/lib/task-sync-guard.js

@@ -0,0 +1,113 @@
+import { mergeRequestLabel } from "./git-host.js";
+import { gitIsAncestor, gitRemoteBranchExists, gitRevParse } from "./git.js";
+import { getMergeRequestDetails } from "./pr-create.js";
+import { resolveTaskMergeRequestLifecycle } from "./task-effective-status.js";
+import { readGitContext } from "./task.js";
+export function mrLifecycleBlocksSync(lifecycle) {
+    if (lifecycle === "open")
+        return "mr-open";
+    if (lifecycle === "closed")
+        return "mr-closed-not-merged";
+    return null;
+}
+function integrationRef(remote, branch) {
+    return `${remote}/${branch}`;
+}
+async function resolveMergedCommitOnIntegration(cwd, host, mrUrl, remote, integrationBranch, taskBranch) {
+    const details = await getMergeRequestDetails(cwd, host, mrUrl);
+    const fromMr = details?.squashCommitSha?.trim() ||
+        details?.mergeCommitSha?.trim() ||
+        null;
+    if (fromMr)
+        return fromMr;
+    const taskRemoteRef = integrationRef(remote, taskBranch);
+    if (await gitRemoteBranchExists(cwd, remote, taskBranch)) {
+        return gitRevParse(cwd, taskRemoteRef);
+    }
+    const integrationSha = await gitRevParse(cwd, integrationRef(remote, integrationBranch));
+    return integrationSha;
+}
+async function integrationContainsTaskWork(cwd, remote, integrationBranch, taskBranch, host, mrUrl, lifecycle) {
+    const target = integrationRef(remote, integrationBranch);
+    const targetSha = await gitRevParse(cwd, target);
+    if (targetSha === null)
+        return false;
+    if (lifecycle === "merged" && mrUrl !== null && host !== null) {
+        const mergedCommit = await resolveMergedCommitOnIntegration(cwd, host, mrUrl, remote, integrationBranch, taskBranch);
+        if (mergedCommit !== null) {
+            return gitIsAncestor(cwd, mergedCommit, target);
+        }
+    }
+    const taskRemoteRef = integrationRef(remote, taskBranch);
+    if (await gitRemoteBranchExists(cwd, remote, taskBranch)) {
+        const taskTip = await gitRevParse(cwd, taskRemoteRef);
+        if (taskTip !== null) {
+            return gitIsAncestor(cwd, taskTip, target);
+        }
+    }
+    // No remote task branch and no merged commit to verify — allow cleanup only when MR is merged.
+    return lifecycle === "merged";
+}
+export async function checkTaskSyncReady(input) {
+    if (input.force === true) {
+        return { ok: true };
+    }
+    const lifecycleInfo = await resolveTaskMergeRequestLifecycle(input.cwd, input.taskFile);
+    const lifecycle = lifecycleInfo.state;
+    const mrUrl = lifecycleInfo.url;
+    const host = lifecycleInfo.host ?? input.host;
+    const label = mergeRequestLabel(host ?? "github");
+    const lifecycleBlock = mrLifecycleBlocksSync(lifecycle);
+    if (lifecycleBlock === "mr-open") {
+        return {
+            ok: false,
+            reason: "mr-open",
+            message: `${label} is still open. Run \`vibeops task merge\` (or merge in the host UI) and confirm it shows Merged before sync.`,
+        };
+    }
+    if (lifecycleBlock === "mr-closed-not-merged") {
+        return {
+            ok: false,
+            reason: "mr-closed-not-merged",
+            message: `${label} is closed but not merged. Re-open or recreate the MR and merge into ${input.integrationBranch} before sync.`,
+        };
+    }
+    if (lifecycle === "unknown" && mrUrl !== null) {
+        return {
+            ok: false,
+            reason: "mr-state-unknown",
+            message: `Could not verify ${label} state. Merge on the host, then rerun sync (or use --force to skip checks).`,
+        };
+    }
+    if (lifecycle === "merged") {
+        if (mrUrl !== null && host !== null) {
+            const details = await getMergeRequestDetails(input.cwd, host, mrUrl);
+            if (details?.state !== "merged" || details.mergedAt === null) {
+                return {
+                    ok: false,
+                    reason: "mr-not-merged",
+                    message: `${label} is not merged yet (auto-merge may still be pending). Wait for Merged on the host, then rerun sync.`,
+                };
+            }
+        }
+    }
+    else if (lifecycle === "none") {
+        const ctx = await readGitContext(input.taskFile);
+        if (ctx === null) {
+            return {
+                ok: false,
+                reason: "mr-state-unknown",
+                message: "No Git Context on TASK — cannot verify merge before sync.",
+            };
+        }
+    }
+    const integrated = await integrationContainsTaskWork(input.cwd, input.remote, input.integrationBranch, input.taskBranch, host, mrUrl, lifecycle);
+    if (!integrated) {
+        return {
+            ok: false,
+            reason: "integration-not-updated",
+            message: `${input.integrationBranch} does not contain the task branch commits yet. Merge the ${label} into ${input.integrationBranch} before sync.`,
+        };
+    }
+    return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "author": "VibeOps contributors",