@goodtek/vibeops 2.4.2 → 2.4.4

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 2.4.4 - 2026-06-25
+
+### Fixed
+
+- **`task sync`:** After merge verification passes, delete the local `task/*` branch with `-D`. Squash-merged TASK branches no longer require `--force` for cleanup.
+- **`task merge` / `task release`:** Wait for MR/PR CI to finish before calling the host merge API. GitLab no longer gets an immediate `--auto-merge=false` merge while the pipeline is still running (405). Falls back to auto-merge when needed, then polls until `merged_at` is set.
+- **`task release`:** Default merge strategy is now **merge commit** (integration → production). Use `--squash` to squash.
+
+## 2.4.3 - 2026-06-25
+
+### Fixed
+
+- **`task merge` / `task release`:** GitLab merges use `--auto-merge=false` so CI running no longer schedules auto-merge and reports success prematurely. Commands poll the host until `merged_at` is set before succeeding.
+- **`task sync`:** Refuses branch cleanup when the MR is open, closed-not-merged, auto-merge pending, or integration branch does not contain task commits. `--force` bypasses merge verification (local branch delete still uses `-D` when needed).
+
+### Added
+
+- **`task-sync-guard`:** MR lifecycle and integration-branch ancestry checks before `task sync` deletes branches.
+
 ## 2.4.2 - 2026-06-24
 
 ### Fixed

package/dist/cli.js

@@ -165,7 +165,7 @@ task
     .description("After MR merge: integration pull and delete task branch (TASK md unchanged)")
     .option("--dry-run", "Plan only")
     .option("--no-remote-delete", "Keep the task branch on the remote")
-    .option("--force", "Delete local task branch with -D if not fully merged")
+    .option("--force", "Bypass MR merge verification before branch cleanup")
     .option("--cwd <path>", "Target directory")
     .action(async (taskRef, opts) => {
     await taskSyncCommand(taskRef, {
@@ -177,10 +177,11 @@ task
 });
 task
     .command("release")
-    .description("Open (and merge) release MR/PR: integration branch → production")
+    .description("Open (and merge) release MR/PR: integration branch → production (default: merge commit)")
     .option("--dry-run", "Plan only")
     .option("--no-merge", "Create release PR only")
-    .option("--merge", "Merge commit (instead of squash)")
+    .option("--squash", "Squash merge (default is merge commit for release)")
+    .option("--merge", "Merge commit (default for release)")
     .option("--rebase", "Rebase merge")
     .option("--cwd <path>", "Target directory")
     .action(async (opts) => {
@@ -188,6 +189,7 @@ task
         dryRun: Boolean(opts.dryRun),
         noMerge: Boolean(opts.noMerge),
         merge: Boolean(opts.merge),
+        squash: Boolean(opts.squash),
         rebase: Boolean(opts.rebase),
         cwd: opts.cwd,
     });

package/dist/commands/task-merge.js

@@ -6,6 +6,7 @@ import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
 import { getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 import { relPath } from "../lib/task-context.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
 import { resolveOpenTaskMergeRequest } from "../lib/task-effective-status.js";
@@ -101,7 +102,25 @@ export async function taskMergeCommand(taskRef, options = {}) {
             return;
         }
         try {
-            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method });
+            await mergeMergeRequest({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                method,
+                waitForCi: true,
+                immediate: true,
+            });
+            const verified = await assertMergeRequestMerged({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                integrationBranch: ctx.baseBranch,
+            });
+            if (!verified.ok) {
+                log.error(verified.message);
+                process.exitCode = 1;
+                return;
+            }
             log.ok(`${label} merged into ${ctx.baseBranch}.`);
         }
         catch (e) {
@@ -120,8 +139,26 @@ export async function taskMergeCommand(taskRef, options = {}) {
     else {
         log.warn(`Could not read ${label} state — attempting merge anyway.`);
         try {
-            await mergeMergeRequest({ cwd, host, url: mergeRequestUrl, method });
-            log.ok(`${label} merge command completed.`);
+            await mergeMergeRequest({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                method,
+                waitForCi: true,
+                immediate: true,
+            });
+            const verified = await assertMergeRequestMerged({
+                cwd,
+                host,
+                url: mergeRequestUrl,
+                integrationBranch: ctx.baseBranch,
+            });
+            if (!verified.ok) {
+                log.error(verified.message);
+                process.exitCode = 1;
+                return;
+            }
+            log.ok(`${label} merged into ${ctx.baseBranch}.`);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);

package/dist/commands/task-release.js

@@ -4,12 +4,13 @@ import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
 import { gitRemoteUrl } from "../lib/git.js";
 import { bold, dim, log } from "../lib/logger.js";
 import { createMergeRequest, getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
-function resolveMergeMethod(opts) {
+import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
+function resolveReleaseMergeMethod(opts) {
     if (opts.rebase === true)
         return "rebase";
-    if (opts.merge === true)
-        return "merge";
-    return "squash";
+    if (opts.squash === true)
+        return "squash";
+    return "merge";
 }
 export async function taskReleaseCommand(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
@@ -50,7 +51,7 @@ export async function taskReleaseCommand(options = {}) {
         log.info(bold("dry-run — would:"));
         log.info(`  · ${label}: ${integrationBranch} → ${productionBranch}`);
         if (options.noMerge !== true) {
-            log.info(`  · merge ${label} (${resolveMergeMethod(options)})`);
+            log.info(`  · merge ${label} (${resolveReleaseMergeMethod(options)}, wait for CI)`);
         }
         return;
     }
@@ -89,9 +90,27 @@ export async function taskReleaseCommand(options = {}) {
         log.ok(`Release ${label} already merged.`);
         return;
     }
-    const method = resolveMergeMethod(options);
+    const method = resolveReleaseMergeMethod(options);
     try {
-        await mergeMergeRequest({ cwd, host, url: releaseUrl, method });
+        await mergeMergeRequest({
+            cwd,
+            host,
+            url: releaseUrl,
+            method,
+            waitForCi: true,
+            immediate: true,
+        });
+        const verified = await assertMergeRequestMerged({
+            cwd,
+            host,
+            url: releaseUrl,
+            integrationBranch: productionBranch,
+        });
+        if (!verified.ok) {
+            log.error(verified.message);
+            process.exitCode = 1;
+            return;
+        }
         log.ok(`Release ${label} merged into ${productionBranch}.`);
     }
     catch (e) {

package/dist/commands/task-sync.js

@@ -1,14 +1,13 @@
 import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
-import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
+import { detectGitHost } from "../lib/git-host.js";
 import { gitBranchExists, gitDeleteBranch, gitDeleteRemoteBranch, gitFetchRemote, gitPullFastForwardOnly, gitRemoteBranchExists, gitRemoteUrl, gitSwitchToBranch, readGitInfo, } from "../lib/git.js";
-import { bold, cyan, dim, log, yellow } from "../lib/logger.js";
-import { probeMergeRequestCli } from "../lib/pr-create.js";
+import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
 import { relPath } from "../lib/task-context.js";
-import { getTaskMergeRequestLifecycle, isMergeRequestMerged, } from "../lib/task-effective-status.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
+import { checkTaskSyncReady } from "../lib/task-sync-guard.js";
 import { readTaskFile } from "../lib/task.js";
 function isProtectedBranch(name, integration, production) {
     return name === integration || name === production || name === "main" || name === "master";
@@ -53,35 +52,16 @@ export async function taskSyncCommand(taskRef, options = {}) {
     log.info(`  ${dim("file")}          ${relPath(cwd, taskFile)}`);
     log.info(`  ${dim("note")}        ${dim("Git cleanup only — TASK md stays Shipped")}`);
     log.blank();
-    const meta = await readTaskFile(taskFile);
-    if (!dryRun) {
-        const lifecycle = await getTaskMergeRequestLifecycle(cwd, taskFile);
-        if (lifecycle !== "none") {
-            const remoteUrl = await gitRemoteUrl(cwd, remote);
-            const host = remoteUrl !== null && detectGitHost(remoteUrl) !== null
-                ? detectGitHost(remoteUrl)
-                : gitCfg.host;
-            const label = mergeRequestLabel(host);
-            if (lifecycle === "open") {
-                log.warn(`${yellow(label)} still open — merge with task merge or the host UI before sync.`);
-            }
-            else if (lifecycle === "merged") {
-                log.ok(`${label} merged.`);
-            }
-        }
-        else if (await probeMergeRequestCli(gitCfg.host)) {
-            log.warn("Could not read MR state — continuing with branch cleanup.");
-        }
-    }
-    else if (meta.status === "shipped" && !(await isMergeRequestMerged(cwd, meta))) {
-        log.warn(`${yellow("MR")} not merged yet — merge on the host or \`task merge\`, then rerun task sync.`);
-    }
     if (dryRun) {
+        const meta = await readTaskFile(taskFile);
+        if (meta.status === "shipped" && options.force !== true) {
+            log.info(dim("Would verify MR is merged and integration branch contains task commits before cleanup."));
+        }
         log.info(bold("dry-run — would:"));
         log.info(`  · git fetch ${remote} --prune`);
         log.info(`  · git switch ${integrationBranch}`);
         log.info(`  · git pull --ff-only ${remote} ${integrationBranch}`);
-        log.info(`  · git branch ${options.force === true ? "-D" : "-d"} ${taskBranch}`);
+        log.info(`  · git branch -D ${taskBranch}`);
         if (options.noRemoteDelete !== true) {
             log.info(`  · git push ${remote} --delete ${taskBranch} (if exists)`);
         }
@@ -129,15 +109,39 @@ export async function taskSyncCommand(taskRef, options = {}) {
     else {
         log.warn(`No ${remote}/${integrationBranch} — skipped pull.`);
     }
+    const remoteUrl = await gitRemoteUrl(cwd, remote);
+    const host = remoteUrl !== null && detectGitHost(remoteUrl) !== null
+        ? detectGitHost(remoteUrl)
+        : gitCfg.host;
+    const syncGuard = await checkTaskSyncReady({
+        cwd,
+        taskFile,
+        remote,
+        integrationBranch,
+        taskBranch,
+        host,
+        force: options.force === true,
+    });
+    if (!syncGuard.ok) {
+        log.error(syncGuard.message ?? "Refusing task sync — merge checks failed.");
+        if (options.force !== true) {
+            log.info(dim("Use --force only if you intentionally want to delete the task branch without merge verification."));
+        }
+        process.exitCode = 1;
+        return;
+    }
+    log.ok(`Ready to sync — ${integrationBranch} contains the task commits.`);
     if (await gitBranchExists(cwd, taskBranch)) {
         try {
-            await gitDeleteBranch(cwd, taskBranch, { force: options.force === true });
+            // Guard verified integration contains the work — squash merges leave task/* SHAs
+            // off develop ancestry, so -D is required even without --force.
+            await gitDeleteBranch(cwd, taskBranch, { force: true });
             log.ok(`Deleted local branch ${taskBranch}`);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
             log.error(`Could not delete local ${taskBranch}: ${msg}`);
-            log.info(dim("Merge the MR into the integration branch first, or rerun with --force (discards unmerged branch)."));
+            log.info(dim("Merge the MR into the integration branch first, or rerun with --force (skip merge verification)."));
             process.exitCode = 1;
             return;
         }

package/dist/lib/git.js

@@ -79,6 +79,20 @@ export async function gitHeadCommit(cwd, short = true) {
     const res = await tryGit(cwd, short ? ["rev-parse", "--short", "HEAD"] : ["rev-parse", "HEAD"]);
     return res ? res.stdout.trim() : null;
 }
+export async function gitRevParse(cwd, ref) {
+    const res = await tryGit(cwd, ["rev-parse", ref]);
+    return res ? res.stdout.trim() : null;
+}
+/** True when `ancestor` is contained in `descendant`'s history. */
+export async function gitIsAncestor(cwd, ancestor, descendant) {
+    try {
+        await runGit(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function gitBranchExists(cwd, name) {
     const res = await tryGit(cwd, ["show-ref", "--verify", "--quiet", `refs/heads/${name}`]);
     return res !== null;

package/dist/lib/merge-request-readiness.js

@@ -0,0 +1,57 @@
+const ACTIVE_PIPELINE_STATUSES = new Set([
+    "pending",
+    "running",
+    "created",
+    "waiting_for_resource",
+    "preparing",
+]);
+const TERMINAL_PIPELINE_FAILURES = new Set(["failed", "canceled"]);
+function normalizePipelineStatus(raw) {
+    if (raw === null || raw === undefined || raw.trim().length === 0)
+        return "none";
+    const status = raw.trim().toLowerCase();
+    if (status === "success")
+        return "success";
+    if (status === "skipped")
+        return "skipped";
+    if (status === "failed")
+        return "failed";
+    if (status === "canceled" || status === "cancelled")
+        return "canceled";
+    if (ACTIVE_PIPELINE_STATUSES.has(status))
+        return "running";
+    return "unknown";
+}
+export function pipelineStatusFromHost(raw) {
+    return normalizePipelineStatus(raw);
+}
+export function isPipelineActive(status) {
+    return status === "running" || status === "pending";
+}
+/** True when the host reports the MR can be merged now (CI done or not required). */
+export function isMergeRequestReadyToMerge(readiness) {
+    if (readiness.state === "merged")
+        return true;
+    if (readiness.state !== "open")
+        return false;
+    if (readiness.hasConflicts === true)
+        return false;
+    const detailed = readiness.detailedMergeStatus?.trim().toLowerCase() ?? "";
+    if (detailed === "conflict" ||
+        detailed === "not_approved" ||
+        detailed === "draft_status" ||
+        detailed === "ci_still_running" ||
+        detailed === "checking" ||
+        detailed === "not_open" ||
+        detailed === "discussions_not_resolved" ||
+        detailed === "need_rebase" ||
+        detailed === "blocked_status") {
+        return false;
+    }
+    if (TERMINAL_PIPELINE_FAILURES.has(readiness.pipelineStatus))
+        return false;
+    if (isPipelineActive(readiness.pipelineStatus))
+        return false;
+    const mergeStatus = readiness.mergeStatus?.trim().toLowerCase() ?? "";
+    return mergeStatus === "can_be_merged" || detailed === "mergeable";
+}

package/dist/lib/pr-create.js

@@ -1,7 +1,8 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mergeRequestLabel } from "./git-host.js";
-import { log } from "./logger.js";
+import { isMergeRequestReadyToMerge, isPipelineActive, pipelineStatusFromHost, } from "./merge-request-readiness.js";
+import { dim, log } from "./logger.js";
 const execFileAsync = promisify(execFile);
 async function ghPrCreate(opts) {
     const { stdout } = await execFileAsync("gh", [
@@ -64,6 +65,7 @@ export async function probeMergeRequestCli(host) {
         return false;
     }
 }
+export { isMergeRequestReadyToMerge, isPipelineActive };
 function normalizeGhMergeRequestState(raw) {
     const state = raw.trim().toUpperCase();
     if (state === "MERGED")
@@ -187,33 +189,105 @@ function prRefFromUrl(url) {
     return prNumberFromUrl(url) ?? url.trim();
 }
 export async function getMergeRequestState(cwd, host, url) {
+    const details = await getMergeRequestDetails(cwd, host, url);
+    return details?.state ?? "unknown";
+}
+export async function getMergeRequestDetails(cwd, host, url) {
     const ref = prRefFromUrl(url);
     try {
         if (host === "gitlab") {
             const { stdout } = await execFileAsync("glab", ["mr", "view", ref, "-F", "json"], { cwd, maxBuffer: 1024 * 1024 });
             const parsed = JSON.parse(stdout.trim());
-            const state = (parsed.state ?? "").toLowerCase();
-            if (state === "merged")
-                return "merged";
-            if (state === "opened" || state === "open")
-                return "open";
-            if (state === "closed")
-                return "closed";
-            return "unknown";
+            const state = normalizeGlabMergeRequestState(parsed.state ?? "");
+            return {
+                state,
+                mergedAt: parsed.merged_at ?? null,
+                mergeCommitSha: parsed.merge_commit_sha ?? null,
+                squashCommitSha: parsed.squash_commit_sha ?? null,
+                mergeStatus: parsed.merge_status ?? null,
+                detailedMergeStatus: parsed.detailed_merge_status ?? null,
+                pipelineStatus: pipelineStatusFromHost(parsed.head_pipeline?.status),
+                hasConflicts: parsed.has_conflicts ?? null,
+            };
+        }
+        const { stdout } = await execFileAsync("gh", ["pr", "view", ref, "--json", "state,mergedAt,mergeCommit,mergeable,statusCheckRollup"], { cwd, maxBuffer: 1024 * 1024 });
+        const parsed = JSON.parse(stdout.trim());
+        const checks = parsed.statusCheckRollup ?? [];
+        let pipelineStatus = "none";
+        if (checks.some((c) => (c.state ?? "").toUpperCase() === "PENDING")) {
+            pipelineStatus = "running";
+        }
+        else if (checks.some((c) => (c.state ?? "").toUpperCase() === "FAILURE")) {
+            pipelineStatus = "failed";
         }
-        const { stdout } = await execFileAsync("gh", ["pr", "view", ref, "--json", "state", "-q", ".state"], { cwd, maxBuffer: 1024 * 1024 });
-        const state = stdout.trim().toUpperCase();
-        if (state === "MERGED")
-            return "merged";
-        if (state === "OPEN")
-            return "open";
-        if (state === "CLOSED")
-            return "closed";
-        return "unknown";
+        else if (checks.length > 0) {
+            pipelineStatus = "success";
+        }
+        const mergeable = parsed.mergeable?.trim().toUpperCase() ?? "";
+        return {
+            state: normalizeGhMergeRequestState(parsed.state ?? ""),
+            mergedAt: parsed.mergedAt ?? null,
+            mergeCommitSha: parsed.mergeCommit?.oid ?? null,
+            squashCommitSha: null,
+            mergeStatus: mergeable === "MERGEABLE" ? "can_be_merged" : mergeable.toLowerCase(),
+            detailedMergeStatus: mergeable.toLowerCase(),
+            pipelineStatus,
+            hasConflicts: mergeable === "CONFLICTING" ? true : mergeable === "MERGEABLE" ? false : null,
+        };
     }
     catch {
-        return "unknown";
+        return null;
+    }
+}
+/** Poll host until MR/PR state is merged (or timeout). */
+export async function waitForMergeRequestMerged(cwd, host, url, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    const intervalMs = options.intervalMs ?? 2_000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const details = await getMergeRequestDetails(cwd, host, url);
+        if (details?.state === "merged" && details.mergedAt !== null) {
+            return true;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+    return false;
+}
+function mergeRequestReadinessFromDetails(details) {
+    if (details === null)
+        return null;
+    return {
+        state: details.state,
+        mergeStatus: details.mergeStatus,
+        detailedMergeStatus: details.detailedMergeStatus,
+        pipelineStatus: details.pipelineStatus,
+        hasConflicts: details.hasConflicts,
+    };
+}
+/** Poll until MR/PR CI finished and host reports mergeable (or already merged). */
+export async function waitForMergeRequestReadyToMerge(cwd, host, url, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 900_000;
+    const intervalMs = options.intervalMs ?? 5_000;
+    const deadline = Date.now() + timeoutMs;
+    const label = mergeRequestLabel(host);
+    let loggedWait = false;
+    while (Date.now() < deadline) {
+        const details = await getMergeRequestDetails(cwd, host, url);
+        const readiness = mergeRequestReadinessFromDetails(details);
+        if (readiness !== null && isMergeRequestReadyToMerge(readiness)) {
+            return true;
+        }
+        if (!loggedWait) {
+            log.info(dim(`Waiting for ${label} pipeline / merge checks…`));
+            loggedWait = true;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
     }
+    return false;
+}
+function isMergeHttp405(error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return msg.includes("405") || msg.toLowerCase().includes("method not allowed");
 }
 export async function closeMergeRequest(opts) {
     const ref = prRefFromUrl(opts.url);
@@ -238,9 +312,21 @@ export async function mergeMergeRequest(opts) {
     const ref = prRefFromUrl(opts.url);
     const method = opts.method ?? "squash";
     const label = mergeRequestLabel(opts.host);
+    if (opts.waitForCi === true && opts.dryRun !== true) {
+        const ready = await waitForMergeRequestReadyToMerge(opts.cwd, opts.host, opts.url);
+        if (!ready) {
+            throw new Error(`${label} is not ready to merge yet (pipeline running, checks pending, or timeout).`);
+        }
+    }
+    const details = await getMergeRequestDetails(opts.cwd, opts.host, opts.url);
+    const readiness = mergeRequestReadinessFromDetails(details);
+    const pipelineActive = readiness !== null ? isPipelineActive(readiness.pipelineStatus) : false;
     if (opts.dryRun === true) {
         if (opts.host === "gitlab") {
-            log.info(`would ${label} merge ${ref} (glab mr merge)`);
+            const immediate = opts.immediate !== false && !pipelineActive;
+            const flags = immediate ? " --auto-merge=false" : " (auto-merge when pipeline succeeds)";
+            const methodFlag = method === "squash" ? " --squash" : method === "rebase" ? " --rebase" : "";
+            log.info(`would ${label} merge ${ref} (glab mr merge${flags}${methodFlag})`);
         }
         else {
             log.info(`would gh pr merge ${ref} --${method}`);
@@ -248,12 +334,46 @@ export async function mergeMergeRequest(opts) {
         return;
     }
     if (opts.host === "gitlab") {
-        await execFileAsync("glab", ["mr", "merge", ref], {
+        await mergeGitLabMergeRequest({
             cwd: opts.cwd,
-            maxBuffer: 4 * 1024 * 1024,
+            ref,
+            method,
+            immediate: opts.immediate !== false && !pipelineActive,
         });
         return;
     }
     const args = ["pr", "merge", ref, `--${method}`];
     await execFileAsync("gh", args, { cwd: opts.cwd, maxBuffer: 4 * 1024 * 1024 });
 }
+async function mergeGitLabMergeRequest(input) {
+    const attempt = async (immediate) => {
+        const args = ["mr", "merge", input.ref];
+        if (immediate) {
+            args.push("--auto-merge=false");
+        }
+        if (input.method === "squash") {
+            args.push("--squash");
+        }
+        else if (input.method === "rebase") {
+            args.push("--rebase");
+        }
+        await execFileAsync("glab", args, {
+            cwd: input.cwd,
+            maxBuffer: 4 * 1024 * 1024,
+        });
+    };
+    try {
+        await attempt(input.immediate);
+    }
+    catch (error) {
+        if (!input.immediate && isMergeHttp405(error)) {
+            await attempt(false);
+            return;
+        }
+        if (input.immediate && isMergeHttp405(error)) {
+            await attempt(false);
+            return;
+        }
+        throw error;
+    }
+}

package/dist/lib/task-merge-verify.js

@@ -0,0 +1,23 @@
+import { mergeRequestLabel } from "./git-host.js";
+import { getMergeRequestDetails, waitForMergeRequestMerged, } from "./pr-create.js";
+export async function assertMergeRequestMerged(input) {
+    const label = mergeRequestLabel(input.host);
+    if (input.wait !== false) {
+        const merged = await waitForMergeRequestMerged(input.cwd, input.host, input.url);
+        if (!merged) {
+            return {
+                ok: false,
+                message: `${label} merge did not complete (still open or auto-merge pending). Wait for Merged on the host, or rerun \`vibeops task merge\`.`,
+            };
+        }
+    }
+    const details = await getMergeRequestDetails(input.cwd, input.host, input.url);
+    if (details?.state !== "merged" || details.mergedAt === null) {
+        const state = details?.state ?? "unknown";
+        return {
+            ok: false,
+            message: `${label} is ${state}, not merged into ${input.integrationBranch}. Do not run task sync until the host shows Merged.`,
+        };
+    }
+    return { ok: true };
+}

package/dist/lib/task-sync-guard.js

@@ -0,0 +1,113 @@
+import { mergeRequestLabel } from "./git-host.js";
+import { gitIsAncestor, gitRemoteBranchExists, gitRevParse } from "./git.js";
+import { getMergeRequestDetails } from "./pr-create.js";
+import { resolveTaskMergeRequestLifecycle } from "./task-effective-status.js";
+import { readGitContext } from "./task.js";
+export function mrLifecycleBlocksSync(lifecycle) {
+    if (lifecycle === "open")
+        return "mr-open";
+    if (lifecycle === "closed")
+        return "mr-closed-not-merged";
+    return null;
+}
+function integrationRef(remote, branch) {
+    return `${remote}/${branch}`;
+}
+async function resolveMergedCommitOnIntegration(cwd, host, mrUrl, remote, integrationBranch, taskBranch) {
+    const details = await getMergeRequestDetails(cwd, host, mrUrl);
+    const fromMr = details?.squashCommitSha?.trim() ||
+        details?.mergeCommitSha?.trim() ||
+        null;
+    if (fromMr)
+        return fromMr;
+    const taskRemoteRef = integrationRef(remote, taskBranch);
+    if (await gitRemoteBranchExists(cwd, remote, taskBranch)) {
+        return gitRevParse(cwd, taskRemoteRef);
+    }
+    const integrationSha = await gitRevParse(cwd, integrationRef(remote, integrationBranch));
+    return integrationSha;
+}
+async function integrationContainsTaskWork(cwd, remote, integrationBranch, taskBranch, host, mrUrl, lifecycle) {
+    const target = integrationRef(remote, integrationBranch);
+    const targetSha = await gitRevParse(cwd, target);
+    if (targetSha === null)
+        return false;
+    if (lifecycle === "merged" && mrUrl !== null && host !== null) {
+        const mergedCommit = await resolveMergedCommitOnIntegration(cwd, host, mrUrl, remote, integrationBranch, taskBranch);
+        if (mergedCommit !== null) {
+            return gitIsAncestor(cwd, mergedCommit, target);
+        }
+    }
+    const taskRemoteRef = integrationRef(remote, taskBranch);
+    if (await gitRemoteBranchExists(cwd, remote, taskBranch)) {
+        const taskTip = await gitRevParse(cwd, taskRemoteRef);
+        if (taskTip !== null) {
+            return gitIsAncestor(cwd, taskTip, target);
+        }
+    }
+    // No remote task branch and no merged commit to verify — allow cleanup only when MR is merged.
+    return lifecycle === "merged";
+}
+export async function checkTaskSyncReady(input) {
+    if (input.force === true) {
+        return { ok: true };
+    }
+    const lifecycleInfo = await resolveTaskMergeRequestLifecycle(input.cwd, input.taskFile);
+    const lifecycle = lifecycleInfo.state;
+    const mrUrl = lifecycleInfo.url;
+    const host = lifecycleInfo.host ?? input.host;
+    const label = mergeRequestLabel(host ?? "github");
+    const lifecycleBlock = mrLifecycleBlocksSync(lifecycle);
+    if (lifecycleBlock === "mr-open") {
+        return {
+            ok: false,
+            reason: "mr-open",
+            message: `${label} is still open. Run \`vibeops task merge\` (or merge in the host UI) and confirm it shows Merged before sync.`,
+        };
+    }
+    if (lifecycleBlock === "mr-closed-not-merged") {
+        return {
+            ok: false,
+            reason: "mr-closed-not-merged",
+            message: `${label} is closed but not merged. Re-open or recreate the MR and merge into ${input.integrationBranch} before sync.`,
+        };
+    }
+    if (lifecycle === "unknown" && mrUrl !== null) {
+        return {
+            ok: false,
+            reason: "mr-state-unknown",
+            message: `Could not verify ${label} state. Merge on the host, then rerun sync (or use --force to skip checks).`,
+        };
+    }
+    if (lifecycle === "merged") {
+        if (mrUrl !== null && host !== null) {
+            const details = await getMergeRequestDetails(input.cwd, host, mrUrl);
+            if (details?.state !== "merged" || details.mergedAt === null) {
+                return {
+                    ok: false,
+                    reason: "mr-not-merged",
+                    message: `${label} is not merged yet (auto-merge may still be pending). Wait for Merged on the host, then rerun sync.`,
+                };
+            }
+        }
+    }
+    else if (lifecycle === "none") {
+        const ctx = await readGitContext(input.taskFile);
+        if (ctx === null) {
+            return {
+                ok: false,
+                reason: "mr-state-unknown",
+                message: "No Git Context on TASK — cannot verify merge before sync.",
+            };
+        }
+    }
+    const integrated = await integrationContainsTaskWork(input.cwd, input.remote, input.integrationBranch, input.taskBranch, host, mrUrl, lifecycle);
+    if (!integrated) {
+        return {
+            ok: false,
+            reason: "integration-not-updated",
+            message: `${input.integrationBranch} does not contain the task branch commits yet. Merge the ${label} into ${input.integrationBranch} before sync.`,
+        };
+    }
+    return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "author": "VibeOps contributors",