@goodtek/vibeops 2.5.2 → 3.1.0

package/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.1.0 - 2026-10-03
+
+### Added
+
+- **Worktree-safe lifecycle:** VibeOps never needs to check out the integration branch, so it works when another `git worktree` has `develop` checked out (previously `fatal: 'develop' is already used by worktree at …`).
+  - `task add`: `git fetch <remote> <integration>`, then `git switch -c task/NNN-slug --no-track <remote>/<integration>`.
+  - The local integration branch is fast-forwarded only where safe: in this worktree with `merge --ff-only`; otherwise with `git fetch . refs/remotes/<remote>/<integration>:refs/heads/<integration>` — git itself refuses non-fast-forward updates and branches checked out in any worktree, and that refusal is reported as "left for the owning worktree", not an error.
+  - `task sync`: verifies the merge **before** moving HEAD; leaves the task branch by switching to the integration branch, or `git switch --detach <remote>/<integration>` when another worktree owns it; deletes local + remote task branch.
+  - `task del` / `task ship --new-cycle` (branch recreate) use the same rules; `vibeops pull` refuses to switch (exit 1, names the worktree) instead of failing inside git.
+- **Repository lock:** `task add` (id allocation → TASK file → branch), `task sync`, `task del`, `task ship --new-cycle` branch handling and `vibeops pull` run under an exclusive lock file `<git-common-dir>/vibeops-task.lock` (created atomically with content via temp file + `link`; pid, host, start time, operation, cwd). Another holder → wait up to `lock.waitSeconds` (default 60), then a clear error naming the holder. Stale lock (pid dead on this host, or older than `lock.staleSeconds`, default 600, on any host) → taken over under a breaker file with inode + token re-check, so concurrent takeovers never produce two holders. `.vibeops.json` `lock` is strictly validated. The git common dir must be on a local filesystem.
+- **Collision-free TASK ids:** next id = 1 + max over local `docs/tasks`, `docs/tasks` on `<remote>/<integration>`, every worktree's `docs/tasks`, and VibeOps task branches (local + `git fetch --prune <remote> +refs/heads/task/*:refs/remotes/<remote>/task/*`). A branch counts only in the generated form `task/<NNN>[-<slug>]` (NNN zero-padded ≥ 3 digits, slug = lowercase `a-z0-9` words joined by single hyphens) **and** when its tree contains that TASK file — `task/2026-q4-plan` does not inflate ids. If the remote cannot be fetched, `task add` refuses without creating a TASK file.
+- **Cross-machine id guard:** `task ship` runs `git ls-remote --heads <remote> 'task/*'` right before pushing and refuses when a different task branch with the same TASK number exists on the remote (or when the remote cannot be listed).
+
+### Fixed
+
+- **Shared `refs/stash`:** governance changes were set aside with `stash push` / `stash pop`, which act on the top of the stash list shared by all worktrees — another worktree's entry could be popped and the TASK file lost. Untracked governance files are no longer stashed (they move with the switch); tracked changes are saved with `git stash create` + `git stash store`, re-applied by SHA, and exactly that entry is dropped.
+
+### Changed
+
+- `task sync` checks merge verification before switching branches (a refused sync now leaves HEAD on the task branch).
+- New task branches are created with `--no-track`, so they never inherit `<remote>/<integration>` as upstream; `task ship` sets the upstream on first push as before.
+- Git Context `baseCommit` is recorded as a full SHA (was a 7-character prefix).
+- All git commands run with `LC_ALL=C` / `LANG=C` so parsed output (porcelain, refusal messages) is never localized.
+
+## 3.0.0 - 2026-10-03
+
+### Breaking changes
+
+- **`task merge` / `task release` refuse to merge a PR/MR with no checks at all** (default `merge.allowNoChecks: false`). Previously such PRs merged.
+  **Migration (repos without CI):** add to `.vibeops.json`:
+  ```json
+  { "merge": { "allowNoChecks": true } }
+  ```
+  A warning is printed on each such merge.
+- **Requires gh ≥ 2.13.0** (`gh pr merge --match-head-commit`). Check with `gh --version`; upgrade e.g. `brew upgrade gh`.
+- **Invalid `.vibeops.json` `merge` block** (non-object, unknown key, wrong type, out-of-range number) makes `task merge` / `task release` exit 1.
+
+### Fixed
+
+- **`task merge` / `task release` (GitHub):** GitHub Actions checks (`CheckRun`) were read from a `state` field they do not have, so a **failed Actions check counted as green** and the PR merged. Checks are now classified from `status` + `conclusion` (CheckRun) and `state` (StatusContext); missing or undocumented values fail closed.
+- **`task merge` / `task release` (GitLab):** `manual` and unknown head-pipeline statuses no longer count as mergeable; `scheduled` / `waiting_for_callback` / `canceling` count as running. A `405` on merge no longer falls back to scheduling auto-merge; it re-runs the gate and retries once with `--auto-merge=false`.
+
+### Added
+
+- **Merge gate:** refuse on any failed check (immediately), wait bounded on pending checks then refuse, refuse on merge conflicts. No override flag. Merges are pinned to the checked commit (`gh pr merge --match-head-commit`, `glab mr merge --sha`).
+- **`.vibeops.json` `merge` block:** `requiredChecks`, `releaseRequiredChecks` (exact or `*` glob; absent → `required check "X" never ran`), `waitTimeoutSeconds` (900), `pollIntervalSeconds` (5), `emptyRollupGraceSeconds` (30), `allowNoChecks` (false). Strictly validated; `task release --dry-run` shows the release required checks.
+
+### Behaviour changes
+
+- No checks at all: refused after a 30 s grace (`emptyRollupGraceSeconds`) for checks not registered yet — see Breaking changes.
+- **Host output is verified:** missing or empty `state` / `mergeable` / `headRefOid` / `statusCheckRollup` from `gh pr view` (GitLab: `state` / `sha` / `merge_status` / `detailed_merge_status` / `head_pipeline`) refuses the merge instead of being treated as green.
+- **GitLab `manual` head pipelines refuse** (previously merged when the MR was otherwise mergeable).
+- **Pending checks are always waited for** on `task merge` / `task release` (up to `waitTimeoutSeconds`); a PR whose checks are still running is no longer merged or auto-merge-scheduled.
+- `glab mr merge --sha` verified with glab 1.106.
+
 ## 2.5.2 - 2026-07-20
 
 ### Fixed

package/README.md

@@ -153,15 +153,100 @@ vibeops llm use auto   # auto | codex-oauth | cursor-agent | openai
 ## Git
 
 - **Init** records branch policy in `.vibeops.json` (`integrationBranch`, `productionBranch`, `host`). Interactive remote setup: ask GitHub/GitLab, create or connect; soft-gate when `gh`/`glab` is missing.
-- **`task add`**: `task/<slug>` from **integration** (e.g. `develop`).
+- **`task add`**: `task/<NNN-slug>` from **`<remote>/<integration>`** (e.g. `origin/develop`), after `git fetch`. See [Worktrees](#worktrees) and [TASK ids](#task-ids).
 - **`task ship`** (state-aware): **no PR** → commit + ship metadata (Status **Shipped**) → push → open MR/PR; **open PR** → commit + push the same branch, CI re-runs, no new PR; **merged PR** → new PR cycle (carries uncommitted work onto the task branch, integrates `develop`, opens a **new** PR). Use `--new-cycle` in non-interactive mode. Commit messages are TASK-id-scoped (`feat(task-001): …`). Refuses when HEAD is not the task branch.
-- **`task merge`**: merge MR/PR into integration (CLI or host UI; TASK md unchanged).
-- **`task sync`**: integration ff-only pull → delete `task/*` branches (TASK md unchanged).
-- **`pull`**: fetch + switch to integration branch + `git pull --ff-only` (one command).
+- **`task merge`**: merge MR/PR into integration (TASK md unchanged) — **only when every check is green** (see [Merge gate](#merge-gate)).
+- **`task sync`**: verify merge → leave the task branch (switch to integration, or detach at `<remote>/<integration>` when another worktree owns it) → fast-forward local integration where safe → delete local + remote `task/*` branch (TASK md unchanged).
+- **`pull`**: fetch + switch to integration branch + `git pull --ff-only` (one command). Refuses (exit 1) when another worktree has the integration branch checked out — run it there.
 - **`task release`**: integration → production PR + merge (skipped on trunk policy).
 - **`status`**: Now / Next card — focus stage, checklist, PR, and the next command to run.
 - No force-push to shared branches.
 
+## Worktrees
+
+VibeOps supports several `git worktree` checkouts of one repo working in parallel. It never needs to check out the integration branch:
+
+- New task branches start from `<remote>/<integration>` (`git switch -c task/NNN-slug --no-track origin/develop`).
+- The local integration branch is fast-forwarded only when safe: in the worktree that has it checked out (`merge --ff-only`), otherwise with `git fetch . refs/remotes/origin/develop:refs/heads/develop`, which git refuses for non-fast-forward updates and for a branch checked out in another worktree — then it is left alone and the log says so (update it in that worktree).
+- `task sync` / `task del` / `task ship --new-cycle` leave the task branch by detaching at `<remote>/<integration>` when the integration branch is checked out elsewhere.
+- Governance changes set aside for a branch switch are restored by stash SHA, never by `stash pop` (the stash list is shared by all worktrees). Untracked files are not stashed.
+- Nothing is ever forced; local integration commits that are not on the remote stop `task add` / `task sync` with fix commands.
+
+### Repository lock
+
+`task add`, `task sync`, `task del`, `task ship --new-cycle` (branch step) and `vibeops pull` take an exclusive lock, `<git-common-dir>/vibeops-task.lock` (shared by all worktrees), recording pid, host, start time, operation and directory. A second command waits, then fails with a message naming the holder.
+
+- The lock file is created atomically with its content (temp file + `link`), so it is never seen half-written.
+- **Stale** = holder on this host whose pid is not running, or a lock older than `staleSeconds` (any host; covers pid reuse). A start time in the future (clock skew) is respected, not stale.
+- Every removal (release or stale takeover) happens under a short breaker file `vibeops-task.lock.break` and only after re-checking the lock's inode and token, so concurrent takeovers of one stale lock never yield two holders.
+- Breaker timings are internal (not in `.vibeops.json`) because the breaker is held for microseconds and only matters after a crash: a breaker older than 30 s is treated as left by a crash; waiting for it is bounded by 60 s (a stale takeover waits at most `waitSeconds`; a release always uses the full 60 s so the lock is not left behind).
+- **The git common dir must be on a local filesystem.** Network filesystems (NFS, SMB, cloud-synced folders) are not supported: their `link` / rename / O_EXCL semantics and clocks are not reliable enough for the lock.
+
+| `.vibeops.json` `lock` key | Default | Allowed | Meaning |
+|---|---|---|---|
+| `waitSeconds` | `60` | integer 0–600 | How long to wait for another holder. |
+| `staleSeconds` | `600` | integer 60–86400 | A lock older than this is stale (any host). On this host a lock is also stale as soon as its pid is no longer running. |
+
+## TASK ids
+
+`task add` picks **1 + the highest TASK number found anywhere** so parallel worktrees and unmerged branches never reuse an id:
+
+1. `docs/tasks` in this worktree (including uncommitted files);
+2. `docs/tasks` on `<remote>/<integration>` (`git ls-tree`);
+3. `docs/tasks` in every worktree (`git worktree list`) — covers task branches whose TASK file is not committed yet;
+4. VibeOps task branches, local and on the remote (`git fetch --prune <remote> '+refs/heads/task/*:refs/remotes/<remote>/task/*'`).
+
+A branch counts only when its name has the **generated form** `task/<NNN>` or `task/<NNN>-<slug>` — NNN is the TASK number zero-padded to at least 3 digits, slug is lowercase `a-z0-9` words joined by single hyphens (exactly what `task add` creates from `TASK-<NNN>-<slug>.md`) — **and** its tree contains `docs/tasks/TASK-<NNN>…md`. Other branches (`task/2026-q4-plan`, `task/task-020-x`) are ignored.
+
+If a configured remote cannot be fetched, `task add` stops without creating a TASK file. Across machines, `task ship` re-checks the remote (`git ls-remote`) right before pushing and refuses if another task branch with the same number already exists there.
+
+## Merge gate
+
+> **3.0.0 breaking:** a PR/MR with **no checks at all** is refused by default. Repos without CI: set `"merge": {"allowNoChecks": true}` in `.vibeops.json`. Requires **gh ≥ 2.13.0**.
+
+`task merge` and `task release` are a client-side CI gate (useful when the host plan has no branch protection / required checks, e.g. private GitHub repos on the free plan). **Where server-side branch protection / required checks are available, enable them — the host remains the final authority;** this gate only stops VibeOps itself from merging red work (a human can still merge in the host UI).
+
+Before calling `gh pr merge` / `glab mr merge`:
+
+- **GitHub:** every item in the PR `statusCheckRollup` is classified from GitHub's documented enums — `CheckRun` (Actions) by `status` + `conclusion`, `StatusContext` by `state`:
+  - **passed:** `SUCCESS`, `NEUTRAL`, `SKIPPED`
+  - **failed:** `FAILURE`, `CANCELLED`, `TIMED_OUT`, `ACTION_REQUIRED`, `STARTUP_FAILURE`, `STALE`, `ERROR`
+  - **pending:** CheckRun `REQUESTED`, `QUEUED`, `IN_PROGRESS`, `WAITING`, `PENDING`; StatusContext `PENDING`, `EXPECTED`
+  - **anything missing or undocumented fails closed** (treated as failed). Several checks with the same name: any failure fails.
+- **GitLab:** the MR head pipeline must be `success` or `skipped`. `failed`, `canceled`, `manual` and unknown statuses refuse; `created` / `pending` / `running` / `scheduled` / … wait.
+- **Host output is verified:** if `gh pr view` lacks or has empty `state`, `mergeable`, `headRefOid`, or `statusCheckRollup` is not a list (GitLab: `state`, `sha`, `merge_status`, `detailed_merge_status`, `head_pipeline`), the merge is refused.
+- **Failed check → refuse immediately** (exit code 1, checks named). **Pending → wait** up to `waitTimeoutSeconds`, then refuse. There is no override flag: fix CI (re-run `task ship`) and rerun `task merge`.
+- **No checks at all → refuse** (after `emptyRollupGraceSeconds`, which covers checks not yet registered right after a push) unless `allowNoChecks: true`.
+- **The merge is pinned to the checked commit:** `gh pr merge --match-head-commit <sha>` (requires **gh ≥ 2.13.0**) / `glab mr merge --auto-merge=false --sha <sha>` (verified with glab 1.106). A push after the check makes the host refuse. A GitLab `405` re-runs the gate and retries once with the same flags.
+
+### Configuration (`.vibeops.json` → `merge`)
+
+```json
+{
+  "merge": {
+    "requiredChecks": ["build", "lint*"],
+    "releaseRequiredChecks": ["release smoke"],
+    "waitTimeoutSeconds": 900,
+    "pollIntervalSeconds": 5,
+    "emptyRollupGraceSeconds": 30,
+    "allowNoChecks": false
+  }
+}
+```
+
+| Key | Default | Allowed | Meaning |
+|-----|---------|---------|---------|
+| `requiredChecks` | `[]` | array of non-empty strings | Checks that must be present and green for `task merge`. A missing one refuses: `required check "X" never ran`. |
+| `releaseRequiredChecks` | `[]` | array of non-empty strings | Same for `task release` (integration → production). Shown by `task release --dry-run`. |
+| `waitTimeoutSeconds` | `900` | integer 1–7200 | Max wait for pending checks. |
+| `pollIntervalSeconds` | `5` | integer 1–300, ≤ timeout | Poll interval while waiting. |
+| `emptyRollupGraceSeconds` | `30` | integer 0–600 | How long an empty check list is re-polled before "no checks" applies. |
+| `allowNoChecks` | `false` | boolean | Merge a PR that has no checks at all (repo without CI). Prints one warning per such merge. |
+
+- Check names are exact (`CheckRun.name` / `StatusContext.context`) or a `*` glob (`"lint*"`, `"* · linux"`). Required checks are GitHub-only; GitLab gates on the head pipeline.
+- The block is validated strictly: it must be an object, unknown keys (typos) and wrong types are errors, and `task merge` / `task release` exit 1 naming the key.
+- **Recommended:** list your CI jobs in `requiredChecks`. Without it, the gate only sees the checks that happened to start — a workflow that never triggers is invisible.
+
 ## License
 
 MIT

package/dist/commands/pull.js

@@ -2,11 +2,19 @@ import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
 import { diagnoseIntegrationSync, printIntegrationSyncDiagnosis, } from "../lib/git-integration-sync.js";
 import { gitFetchRemote, gitPullFastForwardOnly, gitRemoteBranchExists, gitRemoteUrl, gitSwitchToBranch, readGitInfo, } from "../lib/git.js";
+import { branchCheckedOutElsewhere } from "../lib/git-worktree.js";
 import { bold, cyan, dim, log } from "../lib/logger.js";
+import { runUnderTaskLock } from "../lib/task-lock.js";
 /**
  * One-step remote sync: fetch, switch to integration branch, fast-forward pull.
  */
 export async function pullCommand(options = {}) {
+    if (options.dryRun === true)
+        return pullUnlocked(options);
+    // D-006: branch switch / fast-forward are serialized across worktrees.
+    await runUnderTaskLock(resolve(options.cwd ?? process.cwd()), "pull", () => pullUnlocked(options));
+}
+async function pullUnlocked(options) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const dryRun = options.dryRun === true;
     let gitCfg;
@@ -56,6 +64,14 @@ export async function pullCommand(options = {}) {
         log.warn(`git fetch failed (${msg}). Continuing with local refs.`);
     }
     if (needsSwitch) {
+        // Worktree-safe (D-006): git refuses to check out a branch another worktree has.
+        const owner = await branchCheckedOutElsewhere(cwd, integrationBranch);
+        if (owner !== null) {
+            log.error(`${integrationBranch} is checked out in worktree ${owner} — not switching this worktree.`);
+            log.info(dim(`Fetched ${remote}. Update ${integrationBranch} there: vibeops pull --cwd "${owner}"`));
+            process.exitCode = 1;
+            return;
+        }
         const switched = await gitSwitchToBranch(cwd, integrationBranch, remote);
         if (!switched) {
             log.error(`Branch "${integrationBranch}" not found locally or on ${remote}. Push integration first or check the remote URL.`);

package/dist/commands/task-add.js

@@ -9,6 +9,8 @@ import { slugify } from "../lib/slug.js";
 import { fallbackTaskDraft, llmScaffoldTask } from "../lib/task-add-llm.js";
 import { allocateNextTaskNumber, formatTaskId, uniqueTaskPath, } from "../lib/task-scaffold.js";
 import { findBlockingTask, relPath } from "../lib/task-context.js";
+import { allocateTaskId, TaskIdAllocationError } from "../lib/task-id-allocation.js";
+import { readTaskLockConfig, TaskLockConfigError, TaskLockHeldError, withTaskLock, } from "../lib/task-lock.js";
 import { isIncompleteTaskStart, startTaskBranch } from "../lib/task-start.js";
 import { loadActionableTasks, readGitContext } from "../lib/task.js";
 async function loadGitConfigOrNull(root, dryRun) {
@@ -51,6 +53,24 @@ async function finishWithBranch(root, taskId, filePath, gitCfg, opts) {
     log.info(`  Agent: same file — implement`);
     log.info(`  Ship: ${cyan(`vibeops task ship ${taskId}`)}`);
 }
+/**
+ * Run `fn` under the repository task lock (D-006). Lock errors are reported and
+ * end the command with exit code 1.
+ */
+async function underLock(root, lockCfg, fn) {
+    try {
+        return await withTaskLock(root, "task add", fn, lockCfg);
+    }
+    catch (e) {
+        if (e instanceof TaskLockHeldError) {
+            log.error(e.message);
+            log.info(dim("No TASK file was created."));
+            process.exitCode = 1;
+            return "done";
+        }
+        throw e;
+    }
+}
 export async function taskAddCommand(opts = {}) {
     const root = resolve(opts.cwd ?? process.cwd());
     const dryRun = opts.dryRun === true;
@@ -60,76 +80,96 @@ export async function taskAddCommand(opts = {}) {
     const gitCfg = await loadGitConfigOrNull(root, dryRun);
     if (!dryRun && gitCfg === null)
         return;
-    const paths = projectPaths(root);
-    const blocking = await findBlockingTask(paths, root);
-    // Resume: In Progress file exists but task branch / Git Context was never finished.
-    if (blocking !== null && gitCfg !== null) {
-        const incomplete = await isIncompleteTaskStart(root, blocking.filePath);
-        if (incomplete) {
-            log.warn(`${yellow("Incomplete")} — ${bold(blocking.id)} exists but the task branch was not created.`);
-            log.info(`  ${dim("file")}   ${relPath(root, blocking.filePath)}`);
-            log.info(dim("Resuming branch setup (will not create a new TASK)…"));
-            if (!dryRun) {
-                const synced = await ensureIntegrationSynced({
-                    cwd: root,
-                    remote: gitCfg.remote,
-                    integrationBranch: gitCfg.integrationBranch,
-                    fetch: true,
-                });
-                if (!synced.ok) {
-                    printIntegrationSyncDiagnosis(synced.diagnosis);
-                    process.exitCode = 1;
-                    return;
-                }
-                if (synced.pulled)
-                    log.info(dim(synced.diagnosis.summary));
-            }
-            await finishWithBranch(root, blocking.id, blocking.filePath, gitCfg, {
-                dryRun,
-                skipIntegrationPull: true,
-            });
+    let lockCfg;
+    try {
+        lockCfg = await readTaskLockConfig(root);
+    }
+    catch (e) {
+        if (e instanceof TaskLockConfigError) {
+            log.error(e.message);
+            process.exitCode = 1;
             return;
         }
-        const ctx = await readGitContext(blocking.filePath);
-        log.warn(`${yellow("Blocked")} — ${bold(blocking.id)} is still open (${blocking.title || "no title"}).`);
-        if (ctx) {
-            log.info(`  ${dim("branch")}  ${ctx.taskBranch}`);
-        }
-        log.info(`  ${dim("file")}   ${relPath(root, blocking.filePath)}`);
-        log.blank();
-        log.info(`Finish it first: ${cyan(`vibeops task ship ${blocking.id}`)}.`);
-        log.info(`Then run ${cyan("vibeops task add")} again.`);
-        process.exitCode = 1;
-        return;
+        throw e;
     }
-    // Preflight: sync integration BEFORE writing a new TASK file (avoids half-created TASKs).
-    if (!dryRun && gitCfg !== null) {
-        log.step("Checking integration branch…");
-        const synced = await ensureIntegrationSynced({
-            cwd: root,
-            remote: gitCfg.remote,
-            integrationBranch: gitCfg.integrationBranch,
-            fetch: true,
-        });
-        if (!synced.ok) {
-            printIntegrationSyncDiagnosis(synced.diagnosis);
+    const paths = projectPaths(root);
+    // Phase 1 (locked): resume an incomplete add, or preflight the integration branch.
+    const phase1 = async () => {
+        const blocking = await findBlockingTask(paths, root);
+        // Resume: In Progress file exists but task branch / Git Context was never finished.
+        if (blocking !== null && gitCfg !== null) {
+            const incomplete = await isIncompleteTaskStart(root, blocking.filePath);
+            if (incomplete) {
+                log.warn(`${yellow("Incomplete")} — ${bold(blocking.id)} exists but the task branch was not created.`);
+                log.info(`  ${dim("file")}   ${relPath(root, blocking.filePath)}`);
+                log.info(dim("Resuming branch setup (will not create a new TASK)…"));
+                if (!dryRun) {
+                    const synced = await ensureIntegrationSynced({
+                        cwd: root,
+                        remote: gitCfg.remote,
+                        integrationBranch: gitCfg.integrationBranch,
+                        fetch: true,
+                    });
+                    if (!synced.ok) {
+                        printIntegrationSyncDiagnosis(synced.diagnosis);
+                        process.exitCode = 1;
+                        return "done";
+                    }
+                    if (synced.pulled)
+                        log.info(dim(synced.diagnosis.summary));
+                }
+                await finishWithBranch(root, blocking.id, blocking.filePath, gitCfg, {
+                    dryRun,
+                    skipIntegrationPull: true,
+                });
+                return "done";
+            }
+            const ctx = await readGitContext(blocking.filePath);
+            log.warn(`${yellow("Blocked")} — ${bold(blocking.id)} is still open (${blocking.title || "no title"}).`);
+            if (ctx) {
+                log.info(`  ${dim("branch")}  ${ctx.taskBranch}`);
+            }
+            log.info(`  ${dim("file")}   ${relPath(root, blocking.filePath)}`);
             log.blank();
-            log.info(dim("No TASK file was created. Fix the integration branch, then rerun task add."));
+            log.info(`Finish it first: ${cyan(`vibeops task ship ${blocking.id}`)}.`);
+            log.info(`Then run ${cyan("vibeops task add")} again.`);
             process.exitCode = 1;
-            return;
-        }
-        if (synced.pulled) {
-            log.ok(synced.diagnosis.summary);
-        }
-        else if (synced.diagnosis.kind === "no_remote_branch" ||
-            synced.diagnosis.kind === "no_remote") {
-            log.info(dim(synced.diagnosis.summary));
+            return "done";
         }
-        else {
-            log.info(dim(`Integration ${gitCfg.integrationBranch} is ready.`));
+        // Preflight: sync integration BEFORE writing a new TASK file (avoids half-created TASKs).
+        if (!dryRun && gitCfg !== null) {
+            log.step("Checking integration branch…");
+            const synced = await ensureIntegrationSynced({
+                cwd: root,
+                remote: gitCfg.remote,
+                integrationBranch: gitCfg.integrationBranch,
+                fetch: true,
+            });
+            if (!synced.ok) {
+                printIntegrationSyncDiagnosis(synced.diagnosis);
+                log.blank();
+                log.info(dim("No TASK file was created. Fix the integration branch, then rerun task add."));
+                process.exitCode = 1;
+                return "done";
+            }
+            if (synced.pulled) {
+                log.ok(synced.diagnosis.summary);
+            }
+            else if (synced.diagnosis.kind === "no_remote_branch" ||
+                synced.diagnosis.kind === "no_remote") {
+                log.info(dim(synced.diagnosis.summary));
+            }
+            else {
+                log.info(dim(`Integration ${gitCfg.integrationBranch} is ready.`));
+            }
+            log.blank();
         }
-        log.blank();
-    }
+        return "continue";
+    };
+    if ((dryRun ? await phase1() : await underLock(root, lockCfg, phase1)) === "done")
+        return;
+    // Phase 2 (unlocked): ask + draft. The draft uses a provisional id; the final id
+    // is allocated under the lock in phase 3 so a slow prompt / LLM never holds it.
     const ideaDefault = "New work slice";
     const idea = await askInput({
         message: "What are you doing now? (short)",
@@ -137,58 +177,96 @@ export async function taskAddCommand(opts = {}) {
         default: opts.idea?.trim() || ideaDefault,
         required: true,
     });
-    const tasks = await loadActionableTasks(paths.docsTasks);
-    const taskId = formatTaskId(allocateNextTaskNumber(tasks));
+    const provisionalId = formatTaskId(allocateNextTaskNumber(await loadActionableTasks(paths.docsTasks)));
     let title;
     let slug;
-    let markdown;
+    let draftMarkdown;
     if (dryRun || nonInteractive) {
-        const fb = fallbackTaskDraft(taskId, idea);
+        const fb = fallbackTaskDraft(provisionalId, idea);
         title = fb.title;
         slug = fb.slug;
-        markdown = fb.markdown;
+        draftMarkdown = fb.markdown;
     }
     else {
-        const llm = await llmScaffoldTask({ cwd: root, taskId, idea });
+        const llm = await llmScaffoldTask({ cwd: root, taskId: provisionalId, idea });
         if (llm !== null) {
             title = llm.title;
             slug = llm.slug;
-            markdown = llm.markdown;
+            draftMarkdown = llm.markdown;
             log.skip(`Scaffold via ${llm.provider}`);
         }
         else {
             log.warn("LLM unavailable — using minimal TASK template.");
             log.info(dim(`  Run ${cyan("vibeops llm connect")} to set up Codex, Cursor Agent CLI, or OpenAI.`));
-            const fb = fallbackTaskDraft(taskId, idea);
+            const fb = fallbackTaskDraft(provisionalId, idea);
             title = fb.title;
             slug = fb.slug;
-            markdown = fb.markdown;
+            draftMarkdown = fb.markdown;
         }
     }
-    const { filePath } = uniqueTaskPath(paths.docsTasks, taskId, slugify(slug || title), tasks.map((t) => t.filePath));
-    const relFile = relPath(root, filePath);
-    const integration = gitCfg?.integrationBranch ?? "integration";
-    if (dryRun) {
-        log.info(`[dry-run] Would create ${bold(taskId)} → ${cyan(relFile)}`);
-        log.info(dim(`  branch task/${slugify(slug || title).replace(/^(\d+)-/, "$1-")} from ${integration}`));
-        if (gitCfg) {
-            await startTaskBranch({
-                cwd: root,
-                taskFile: filePath,
-                integrationBranch: gitCfg.integrationBranch,
-                remote: gitCfg.remote,
-                dryRun: true,
-            });
+    // Phase 3 (locked): allocate id → write TASK file → create branch.
+    const phase3 = async () => {
+        const tasks = await loadActionableTasks(paths.docsTasks);
+        let taskNumber = allocateNextTaskNumber(tasks);
+        if (gitCfg !== null) {
+            // D-006: ids are unique across the integration branch, every worktree and
+            // every local / remote VibeOps task branch — not just this worktree's docs/tasks.
+            try {
+                const alloc = await allocateTaskId({
+                    cwd: root,
+                    tasksDir: paths.docsTasks,
+                    remote: gitCfg.remote,
+                    integrationBranch: gitCfg.integrationBranch,
+                    fetchRemote: !dryRun,
+                });
+                taskNumber = Math.max(taskNumber, alloc.next);
+            }
+            catch (e) {
+                if (e instanceof TaskIdAllocationError) {
+                    log.error(e.message);
+                    log.info(dim("No TASK file was created."));
+                    process.exitCode = 1;
+                    return "done";
+                }
+                if (!dryRun)
+                    throw e;
+                // dry-run outside a git repo: local docs/tasks only.
+            }
         }
-        return;
-    }
-    if (await pathExists(filePath)) {
-        throw new Error(`TASK file already exists: ${relFile}`);
-    }
-    await writeText(filePath, markdown);
-    log.ok(`Created ${bold(taskId)} → ${cyan(relFile)}`);
-    await finishWithBranch(root, taskId, filePath, gitCfg, {
-        dryRun: false,
-        skipIntegrationPull: true,
-    });
+        const taskId = formatTaskId(taskNumber);
+        const markdown = taskId === provisionalId
+            ? draftMarkdown
+            : draftMarkdown.replace(new RegExp(`\\b${provisionalId}\\b`, "g"), taskId);
+        const { filePath } = uniqueTaskPath(paths.docsTasks, taskId, slugify(slug || title), tasks.map((t) => t.filePath));
+        const relFile = relPath(root, filePath);
+        const integration = gitCfg?.integrationBranch ?? "integration";
+        if (dryRun) {
+            log.info(`[dry-run] Would create ${bold(taskId)} → ${cyan(relFile)}`);
+            log.info(dim(`  branch task/${slugify(slug || title).replace(/^(\d+)-/, "$1-")} from ${gitCfg?.remote ?? "origin"}/${integration}`));
+            if (gitCfg) {
+                await startTaskBranch({
+                    cwd: root,
+                    taskFile: filePath,
+                    integrationBranch: gitCfg.integrationBranch,
+                    remote: gitCfg.remote,
+                    dryRun: true,
+                });
+            }
+            return "done";
+        }
+        if (await pathExists(filePath)) {
+            throw new Error(`TASK file already exists: ${relFile}`);
+        }
+        await writeText(filePath, markdown);
+        log.ok(`Created ${bold(taskId)} → ${cyan(relFile)}`);
+        await finishWithBranch(root, taskId, filePath, gitCfg, {
+            dryRun: false,
+            skipIntegrationPull: true,
+        });
+        return "done";
+    };
+    if (dryRun)
+        await phase3();
+    else
+        await underLock(root, lockCfg, phase3);
 }

package/dist/commands/task-del.js

@@ -4,7 +4,14 @@ import { projectPaths } from "../lib/paths.js";
 import { relPath } from "../lib/task-context.js";
 import { assertTaskDeletable, assertWorkingTreeForDel, closeOpenTaskMergeRequestIfNeeded, deleteTaskBranches, deleteTaskMarkdown, loadGitConfigForDel, resolveDelTarget, taskDelNotFoundMessage, validateTaskBranchForDel, } from "../lib/task-del.js";
 import { readGitContext, statusDisplay } from "../lib/task.js";
+import { runUnderTaskLock } from "../lib/task-lock.js";
 export async function taskDelCommand(taskRef, options = {}) {
+    if (options.dryRun === true)
+        return taskDelUnlocked(taskRef, options);
+    // D-006: branch switch / stash / delete are serialized across worktrees.
+    await runUnderTaskLock(resolve(options.cwd ?? process.cwd()), "task del", () => taskDelUnlocked(taskRef, options));
+}
+async function taskDelUnlocked(taskRef, options) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const dryRun = options.dryRun === true;
     const paths = projectPaths(cwd);