@goodtek/vibeops 2.5.2 → 3.1.0

package/dist/commands/task-merge.js

@@ -1,12 +1,13 @@
 import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
+import { MergeConfigError, mergeGateTiming, readMergeConfig } from "../lib/merge-config.js";
 import { formatHostCliHint, formatHostCliMissingMessage } from "../lib/git-host-cli.js";
 import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
 import { gitRemoteUrl } from "../lib/git.js";
 import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
-import { getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { getMergeRequestState, MergeGateError, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
 import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 import { relPath } from "../lib/task-context.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
@@ -19,6 +20,12 @@ function resolveMergeMethod(opts) {
         return "merge";
     return "squash";
 }
+function mergeFailureHint(error) {
+    if (error instanceof MergeGateError) {
+        return "Not merged. Fix the failing checks (re-run `vibeops task ship` to push a fix and re-run CI), then rerun `vibeops task merge`.";
+    }
+    return "Merge in the host UI if branch protection blocks CLI merge.";
+}
 export async function taskMergeCommand(taskRef, options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const dryRun = options.dryRun === true;
@@ -35,6 +42,20 @@ export async function taskMergeCommand(taskRef, options = {}) {
         }
         throw e;
     }
+    let mergeCfg;
+    try {
+        mergeCfg = await readMergeConfig(cwd);
+    }
+    catch (e) {
+        if (e instanceof MergeConfigError) {
+            log.error(e.message);
+            process.exitCode = 1;
+            return;
+        }
+        throw e;
+    }
+    const requiredChecks = mergeCfg.requiredChecks;
+    const gate = { ...mergeGateTiming(mergeCfg), allowNoChecks: mergeCfg.allowNoChecks };
     const target = await resolveLifecycleTarget(paths, cwd, taskRef);
     if (target === null) {
         if (taskRef?.trim()) {
@@ -74,6 +95,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
     log.info(`  ${dim("MR/PR")}      ${mergeRequestUrl}`);
     log.info(`  ${dim("target")}     ${ctx.baseBranch} (${gitCfg.integrationBranch})`);
     log.info(`  ${dim("method")}     ${method}`);
+    log.info(`  ${dim("checks")}     all green${requiredChecks.length > 0 ? ` + required: ${requiredChecks.join(", ")}` : ""}${mergeCfg.allowNoChecks ? dim(" (allowNoChecks: true)") : ""}`);
     log.blank();
     if (dryRun) {
         await mergeMergeRequest({
@@ -81,6 +103,8 @@ export async function taskMergeCommand(taskRef, options = {}) {
             host,
             url: mergeRequestUrl,
             method,
+            requiredChecks,
+            gate,
             dryRun: true,
         });
         log.blank();
@@ -112,7 +136,8 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 url: mergeRequestUrl,
                 method,
                 waitForCi: true,
-                immediate: true,
+                requiredChecks,
+                gate,
             });
             const verified = await assertMergeRequestMerged({
                 cwd,
@@ -130,7 +155,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
             log.error(`Merge failed: ${msg}`);
-            log.info(dim("Merge in the host UI if branch protection blocks CLI merge."));
+            log.info(dim(mergeFailureHint(e)));
             process.exitCode = 1;
             return;
         }
@@ -149,7 +174,8 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 url: mergeRequestUrl,
                 method,
                 waitForCi: true,
-                immediate: true,
+                requiredChecks,
+                gate,
             });
             const verified = await assertMergeRequestMerged({
                 cwd,
@@ -167,6 +193,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
             log.error(`Merge failed: ${msg}`);
+            log.info(dim(mergeFailureHint(e)));
             process.exitCode = 1;
             return;
         }

package/dist/commands/task-release.js

@@ -1,10 +1,11 @@
 import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
+import { MergeConfigError, mergeGateTiming, readMergeConfig } from "../lib/merge-config.js";
 import { formatHostCliHint, formatHostCliMissingMessage } from "../lib/git-host-cli.js";
 import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
 import { gitRemoteUrl } from "../lib/git.js";
 import { bold, dim, log } from "../lib/logger.js";
-import { createMergeRequest, getMergeRequestState, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { createMergeRequest, getMergeRequestState, MergeGateError, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
 import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 function resolveReleaseMergeMethod(opts) {
     if (opts.rebase === true)
@@ -29,6 +30,19 @@ export async function taskReleaseCommand(options = {}) {
         throw e;
     }
     const { integrationBranch, productionBranch, remote } = gitCfg;
+    let mergeCfg;
+    try {
+        mergeCfg = await readMergeConfig(cwd);
+    }
+    catch (e) {
+        if (e instanceof MergeConfigError) {
+            log.error(e.message);
+            process.exitCode = 1;
+            return;
+        }
+        throw e;
+    }
+    const requiredChecks = mergeCfg.releaseRequiredChecks;
     if (integrationBranch === productionBranch) {
         log.info("Trunk policy: integration and production are the same branch — no release PR step.");
         return;
@@ -52,7 +66,11 @@ export async function taskReleaseCommand(options = {}) {
         log.info(bold("dry-run — would:"));
         log.info(`  · ${label}: ${integrationBranch} → ${productionBranch}`);
         if (options.noMerge !== true) {
-            log.info(`  · merge ${label} (${resolveReleaseMergeMethod(options)}, wait for CI)`);
+            log.info(`  · merge ${label} (${resolveReleaseMergeMethod(options)}) only when all checks are green`);
+            log.info(`  · required checks: ${requiredChecks.length > 0 ? requiredChecks.join(", ") : "(none configured)"}`);
+            if (mergeCfg.allowNoChecks) {
+                log.info("  · allowNoChecks: true (a release PR with no checks would merge)");
+            }
         }
         return;
     }
@@ -101,7 +119,8 @@ export async function taskReleaseCommand(options = {}) {
             url: releaseUrl,
             method,
             waitForCi: true,
-            immediate: true,
+            requiredChecks,
+            gate: { ...mergeGateTiming(mergeCfg), allowNoChecks: mergeCfg.allowNoChecks },
         });
         const verified = await assertMergeRequestMerged({
             cwd,
@@ -119,7 +138,12 @@ export async function taskReleaseCommand(options = {}) {
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         log.error(`Release merge failed: ${msg}`);
-        log.info(dim(`Complete merge in the host UI: ${releaseUrl}`));
+        if (e instanceof MergeGateError) {
+            log.info(dim(`Not merged. Fix the failing checks on ${releaseUrl}, then rerun task release.`));
+        }
+        else {
+            log.info(dim(`Complete merge in the host UI: ${releaseUrl}`));
+        }
         process.exitCode = 1;
     }
 }

package/dist/commands/task-ship.js

@@ -15,6 +15,7 @@ import { applyTaskShipMemory, fallbackResultSections, llmCompleteTaskShip, write
 import { detectShipPrState, prRefLabel, resolveShipAction, } from "../lib/task-ship-state.js";
 import { finishTaskWithPullRequest } from "../lib/task-push-pr.js";
 import { hasNonEmptySection, parseTaskFilename, readGitContext, readTaskFile, updateInlineStatus, } from "../lib/task.js";
+import { assertTaskIdFreeOnRemote } from "../lib/task-id-allocation.js";
 function describePushFailure(message) {
     const lower = message.toLowerCase();
     if (lower.includes("protected") ||
@@ -245,6 +246,12 @@ async function runUpdateOpenPr(ctx) {
         log.info(`Nothing to ship (working tree clean, PR ${prRefLabel(prCtx.number)} up to date).`);
         return;
     }
+    const idFree = await assertTaskIdFreeOnRemote(cwd, remote, gitCtx.taskBranch);
+    if (!idFree.ok) {
+        log.error(idFree.message);
+        process.exitCode = 1;
+        return;
+    }
     try {
         await gitPush(cwd, remote, gitCtx.taskBranch, false);
         log.ok(`Pushed ${gitCtx.taskBranch} → ${remote}`);

package/dist/commands/task-sync.js

@@ -1,11 +1,13 @@
 import { resolve } from "node:path";
 import { GitConfigError, requireGitConfig } from "../lib/git-config.js";
 import { detectGitHost } from "../lib/git-host.js";
-import { gitBranchExists, gitDeleteBranch, gitDeleteRemoteBranch, gitFetchRemote, gitPullFastForwardOnly, gitRemoteBranchExists, gitRemoteUrl, gitSwitchToBranch, readGitInfo, } from "../lib/git.js";
+import { gitBranchExists, gitDeleteBranch, gitDeleteRemoteBranch, gitFetchRemote, gitRemoteBranchExists, gitRemoteUrl, readGitInfo, } from "../lib/git.js";
+import { branchCheckedOutElsewhere, fastForwardLocalIntegration, leaveTaskBranch, logLocalIntegrationUpdate, } from "../lib/git-worktree.js";
 import { bold, cyan, dim, log } from "../lib/logger.js";
 import { projectPaths } from "../lib/paths.js";
 import { taskNotFoundMessage } from "../lib/resolve-task.js";
 import { relPath } from "../lib/task-context.js";
+import { runUnderTaskLock } from "../lib/task-lock.js";
 import { resolveLifecycleTarget } from "../lib/task-lifecycle-target.js";
 import { checkTaskSyncReady } from "../lib/task-sync-guard.js";
 import { readTaskFile } from "../lib/task.js";
@@ -13,6 +15,13 @@ function isProtectedBranch(name, integration, production) {
     return name === integration || name === production || name === "main" || name === "master";
 }
 export async function taskSyncCommand(taskRef, options = {}) {
+    const cwd = resolve(options.cwd ?? process.cwd());
+    if (options.dryRun === true)
+        return taskSyncUnlocked(taskRef, options);
+    // D-006: branch switch / stash / delete are serialized across worktrees.
+    await runUnderTaskLock(cwd, "task sync", () => taskSyncUnlocked(taskRef, options));
+}
+async function taskSyncUnlocked(taskRef, options) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const dryRun = options.dryRun === true;
     const paths = projectPaths(cwd);
@@ -57,10 +66,20 @@ export async function taskSyncCommand(taskRef, options = {}) {
         if (meta.status === "shipped" && options.force !== true) {
             log.info(dim("Would verify MR is merged and integration branch contains task commits before cleanup."));
         }
+        const owner = (await readGitInfo(cwd)).isRepo
+            ? await branchCheckedOutElsewhere(cwd, integrationBranch)
+            : null;
         log.info(bold("dry-run — would:"));
         log.info(`  · git fetch ${remote} --prune`);
-        log.info(`  · git switch ${integrationBranch}`);
-        log.info(`  · git pull --ff-only ${remote} ${integrationBranch}`);
+        log.info(`  · verify the MR is merged (${remote}/${integrationBranch} contains the task commits)`);
+        if (owner === null) {
+            log.info(`  · if on ${taskBranch}: git switch ${integrationBranch}`);
+            log.info(`  · fast-forward local ${integrationBranch} to ${remote}/${integrationBranch} (--ff-only)`);
+        }
+        else {
+            log.info(`  · if on ${taskBranch}: git switch --detach ${remote}/${integrationBranch}`);
+            log.info(dim(`  · ${integrationBranch} is checked out in worktree ${owner} — left unchanged`));
+        }
         log.info(`  · git branch -D ${taskBranch}`);
         if (options.noRemoteDelete !== true) {
             log.info(`  · git push ${remote} --delete ${taskBranch} (if exists)`);
@@ -76,9 +95,6 @@ export async function taskSyncCommand(taskRef, options = {}) {
         process.exitCode = 1;
         return;
     }
-    if (git.branch === taskBranch) {
-        log.info(dim(`On ${taskBranch} — switching to ${integrationBranch} first.`));
-    }
     try {
         await gitFetchRemote(cwd, remote);
         log.ok(`Fetched ${remote} (--prune)`);
@@ -87,32 +103,11 @@ export async function taskSyncCommand(taskRef, options = {}) {
         const msg = e instanceof Error ? e.message : String(e);
         log.warn(`git fetch failed (${msg}). Continuing with local refs.`);
     }
-    const switched = await gitSwitchToBranch(cwd, integrationBranch, remote);
-    if (!switched) {
-        log.error(`Integration branch "${integrationBranch}" not found locally or on ${remote}.`);
-        process.exitCode = 1;
-        return;
-    }
-    log.ok(`On ${integrationBranch}`);
-    if (await gitRemoteBranchExists(cwd, remote, integrationBranch)) {
-        try {
-            await gitPullFastForwardOnly(cwd, remote, integrationBranch);
-            log.ok(`Up to date with ${remote}/${integrationBranch} (--ff-only)`);
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            log.error(`Could not fast-forward ${integrationBranch}: ${msg}. Resolve locally, then rerun.`);
-            process.exitCode = 1;
-            return;
-        }
-    }
-    else {
-        log.warn(`No ${remote}/${integrationBranch} — skipped pull.`);
-    }
     const remoteUrl = await gitRemoteUrl(cwd, remote);
     const host = remoteUrl !== null && detectGitHost(remoteUrl) !== null
         ? detectGitHost(remoteUrl)
         : gitCfg.host;
+    // Verify the merge BEFORE moving HEAD or touching any branch.
     const syncGuard = await checkTaskSyncReady({
         cwd,
         taskFile,
@@ -131,6 +126,43 @@ export async function taskSyncCommand(taskRef, options = {}) {
         return;
     }
     log.ok(`Ready to sync — ${integrationBranch} contains the task commits.`);
+    // Worktree-safe (D-006): leave the task branch without requiring the
+    // integration branch when another worktree has it checked out.
+    if (git.branch === taskBranch) {
+        const left = await leaveTaskBranch(cwd, remote, integrationBranch);
+        if (!left.ok) {
+            log.error(left.message);
+            process.exitCode = 1;
+            return;
+        }
+        log.ok(left.on === "integration" ? `On ${integrationBranch}` : `Detached at ${left.ref}`);
+    }
+    if (await gitRemoteBranchExists(cwd, remote, integrationBranch)) {
+        try {
+            const update = await fastForwardLocalIntegration(cwd, remote, integrationBranch);
+            if (update.kind === "up_to_date") {
+                log.ok(`Local ${integrationBranch} is up to date with ${remote}/${integrationBranch}`);
+            }
+            else if (update.kind === "not_fast_forward") {
+                // Same outcome as the former `git pull --ff-only` failure: stop before cleanup.
+                log.error(`Local ${integrationBranch} has commits not on ${remote}/${integrationBranch} — cannot fast-forward (never forced). Push or reset it, then rerun.`);
+                process.exitCode = 1;
+                return;
+            }
+            else {
+                logLocalIntegrationUpdate(update, remote, integrationBranch);
+            }
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            log.error(`Could not fast-forward ${integrationBranch}: ${msg}. Resolve locally, then rerun.`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        log.warn(`No ${remote}/${integrationBranch} — skipped fast-forward.`);
+    }
     if (await gitBranchExists(cwd, taskBranch)) {
         try {
             // Guard verified integration contains the work — squash merges leave task/* SHAs

package/dist/lib/check-rollup.js

@@ -0,0 +1,128 @@
+/**
+ * Classify GitHub `statusCheckRollup` items and evaluate the merge gate
+ * (`task merge` / `task release` refuse to merge on red or missing checks).
+ *
+ * GitHub returns two item shapes:
+ * - `CheckRun` (GitHub Actions, check apps): `status` + `conclusion`, no `state`.
+ * - `StatusContext` (commit status API): `state`, no `status`/`conclusion`.
+ */
+/** GitHub GraphQL `CheckStatusState` values other than COMPLETED. */
+const CHECK_RUN_IN_FLIGHT = new Set(["REQUESTED", "QUEUED", "IN_PROGRESS", "WAITING", "PENDING"]);
+/** GitHub GraphQL `CheckConclusionState`, split into pass / fail (exhaustive). */
+const CHECK_RUN_PASS = new Set(["SUCCESS", "NEUTRAL", "SKIPPED"]);
+const CHECK_RUN_FAIL = new Set([
+    "FAILURE",
+    "CANCELLED",
+    "TIMED_OUT",
+    "ACTION_REQUIRED",
+    "STARTUP_FAILURE",
+    "STALE",
+]);
+/** GitHub GraphQL `StatusState` (exhaustive): SUCCESS | PENDING | EXPECTED | FAILURE | ERROR. */
+const STATUS_CONTEXT_PENDING = new Set(["PENDING", "EXPECTED"]);
+const STATUS_CONTEXT_FAIL = new Set(["FAILURE", "ERROR"]);
+function upper(raw) {
+    return (raw ?? "").trim().toUpperCase();
+}
+function isCheckRun(item) {
+    if (item.__typename === "CheckRun")
+        return true;
+    if (item.__typename === "StatusContext")
+        return false;
+    // Unknown typename: infer from fields.
+    return (item.status ?? null) !== null || (item.conclusion ?? null) !== null;
+}
+export function classifyRollupItem(item) {
+    if (isCheckRun(item)) {
+        const name = (item.name ?? "").trim() || "(unnamed check run)";
+        const status = upper(item.status);
+        const conclusion = upper(item.conclusion);
+        if (CHECK_RUN_IN_FLIGHT.has(status)) {
+            return { name, kind: "CheckRun", verdict: "pending", detail: status };
+        }
+        if (status !== "COMPLETED") {
+            // Missing or undocumented status — fail closed.
+            return { name, kind: "CheckRun", verdict: "failed", detail: status || "MISSING_STATUS" };
+        }
+        if (CHECK_RUN_PASS.has(conclusion)) {
+            return { name, kind: "CheckRun", verdict: "passed", detail: conclusion };
+        }
+        if (CHECK_RUN_FAIL.has(conclusion)) {
+            return { name, kind: "CheckRun", verdict: "failed", detail: conclusion };
+        }
+        // Completed with a missing or undocumented conclusion — fail closed.
+        return {
+            name,
+            kind: "CheckRun",
+            verdict: "failed",
+            detail: conclusion || "MISSING_CONCLUSION",
+        };
+    }
+    const name = (item.context ?? item.name ?? "").trim() || "(unnamed status)";
+    const state = upper(item.state);
+    if (state === "SUCCESS") {
+        return { name, kind: "StatusContext", verdict: "passed", detail: state };
+    }
+    if (STATUS_CONTEXT_PENDING.has(state)) {
+        return { name, kind: "StatusContext", verdict: "pending", detail: state };
+    }
+    if (STATUS_CONTEXT_FAIL.has(state)) {
+        return { name, kind: "StatusContext", verdict: "failed", detail: state };
+    }
+    // Missing or undocumented state — fail closed.
+    return { name, kind: "StatusContext", verdict: "failed", detail: state || "MISSING_STATE" };
+}
+export function classifyRollup(items) {
+    return (items ?? []).map(classifyRollupItem);
+}
+/** Exact name, or a `*` glob (e.g. `lint*`, `* · linux`). */
+export function checkNameMatches(name, pattern) {
+    const p = pattern.trim();
+    if (p.length === 0)
+        return false;
+    if (!p.includes("*"))
+        return name === p;
+    const re = new RegExp(`^${p
+        .split("*")
+        .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+        .join(".*")}$`);
+    return re.test(name);
+}
+/**
+ * Evaluate classified checks against optional required patterns.
+ * - any failed → red
+ * - any pending, or a required check not (yet) present → pending
+ * - otherwise green (including "no checks at all" when nothing is required)
+ */
+export function evaluateCheckGate(checks, requiredChecks = []) {
+    const failed = checks.filter((c) => c.verdict === "failed");
+    const pending = checks.filter((c) => c.verdict === "pending");
+    const passed = checks.filter((c) => c.verdict === "passed");
+    const missingRequired = requiredChecks
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0)
+        .filter((p) => !checks.some((c) => checkNameMatches(c.name, p)));
+    let state = "green";
+    if (failed.length > 0)
+        state = "red";
+    else if (pending.length > 0 || missingRequired.length > 0)
+        state = "pending";
+    return { state, failed, pending, passed, missingRequired };
+}
+function describe(c) {
+    return `"${c.name}" (${c.detail})`;
+}
+/** Human-readable lines for a refused merge. */
+export function formatCheckGateProblems(gate) {
+    const lines = [];
+    if (gate.failed.length > 0) {
+        lines.push(`failed checks: ${gate.failed.map(describe).join(", ")}`);
+    }
+    if (gate.pending.length > 0) {
+        lines.push(`checks still pending: ${gate.pending.map(describe).join(", ")}`);
+    }
+    for (const p of gate.missingRequired) {
+        lines.push(`required check "${p}" never ran`);
+    }
+    return lines;
+}

package/dist/lib/config.js

@@ -64,6 +64,7 @@ export async function readConfig(root) {
             parsed.schemaVersion === VIBEOPS_CONFIG_SCHEMA_VERSION) {
             const llm = parseLlmBlock(parsed.llm);
             const git = parseGitBlock(parsed.git);
+            const merge = parsed.merge;
             const clients = parseClientsBlock(parsed.clients) ?? ["cursor"];
             return {
                 name: parsed.name,
@@ -73,6 +74,7 @@ export async function readConfig(root) {
                 clients,
                 ...(git ? { git } : {}),
                 ...(llm ? { llm } : {}),
+                ...(merge !== undefined ? { merge } : {}),
             };
         }
         return null;
@@ -90,6 +92,7 @@ export function buildConfig(name, clients, git, existing, nowIso) {
         clients,
         git,
         llm: existing?.llm ?? { provider: "auto" },
+        ...(existing?.merge !== undefined ? { merge: existing.merge } : {}),
     };
 }
 export function configToJson(config) {