@goodtek/vibeops 3.1.3 → 3.1.5

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.1.5 - 2026-10-16
+
+### Fixed
+
+- **`task merge` merged stale branches.** It now refuses unless the head commit the gate approved contains the current `<remote>/<base>` (`git merge-base --is-ancestor` after fetching both); the error says how many commits behind and how to update. Observed in a consumer repo: a branch rebuilt with `git reset --soft` on a stale `origin/develop` was squash-merged after `develop` had moved and silently reverted other TASKs' work. Fetch errors refuse. `task release` is unchanged (D-008, TASK-029).
+- **`task ship -m` joined multi-line messages** into one line, so a `Co-Authored-By:` trailer ended up in the subject. Only the subject is TASK-scoped now; the body and trailers are kept (TASK-029).
+
+### Security
+
+- `js-yaml` 3.14.2 → 3.15.2 (via `gray-matter`; GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh, GHSA-h67p-54hq-rp68). Dev: `tsx` ^4.23.15 → `esbuild` 0.28.2 (GHSA-g7r4-m6w7-qqqr). `sprintf-js` (GHSA-hp3w-g68c-fv3c) has no fixed release; it is only used by `js-yaml`'s command-line tool, which vibeops does not run (TASK-027).
+
+## 3.1.4 - 2026-10-16
+
+### Changed
+
+- No CLI changes. First release published from GitHub Actions (`publish.yml`, npm Trusted Publishing with provenance) instead of a maintainer machine.
+
 ## 3.1.3 - 2026-10-16
 
 ### Fixed

package/README.md

@@ -223,6 +223,7 @@ Before calling `gh pr merge` / `glab mr merge`:
 - **No checks at all → refuse** unless `allowNoChecks: true`. "No checks" means: empty rollup, no GitHub Actions run and no expected workflow for the head commit (GitLab: no pipeline). For CI outside GitHub Actions (commit statuses / check apps), the empty list is re-polled for `emptyRollupGraceSeconds` first; list such checks in `requiredChecks` so the gate waits for them by name.
 - **Waiting** polls the host (`gh pr view` + the Actions REST API) every `pollIntervalSeconds` (default 10 s, the default of `gh pr checks --watch`) until the state changes, bounded by `waitTimeoutSeconds` (default 900 s). Host read errors back off exponentially with jitter (capped at 60 s, GitHub's guidance for rate-limited clients).
 - **The merge is pinned to the checked commit:** right before merging the gate re-reads the PR head; if it moved, the new head is evaluated from scratch. The merge itself uses `gh pr merge --match-head-commit <sha>` (requires **gh ≥ 2.13.0**) / `glab mr merge --auto-merge=false --sha <sha>` (verified with glab 1.106), so a push between the last check and the merge makes the host refuse. A GitLab `405` re-runs the gate and retries once with the same flags.
+- **`task merge` refuses a stale base:** the head commit the gate approved must contain the current `<remote>/<base>` (`git merge-base --is-ancestor`, after fetching the base branch and the head commit). A head that does not — the base moved since the branch was pushed, or the branch was rebuilt on an old base (e.g. `git reset --soft <stale origin/develop>` + commit) — can silently revert work merged into the base since, and a squash merge lands that revert. Bring the branch up to date (`git fetch` + `git merge <remote>/<base>`, test, `task ship`), wait for CI, then rerun `task merge`. A fetch failure refuses (fail closed). `task release` does not apply this check (with merge-commit releases the production branch is normally not an ancestor of the integration branch).
 
 ### Configuration (`.vibeops.json` → `merge`)
 

package/dist/commands/task-merge.js

@@ -22,6 +22,9 @@ function resolveMergeMethod(opts) {
 }
 function mergeFailureHint(error) {
     if (error instanceof MergeGateError) {
+        if (error.problems.some((p) => p.startsWith("stale base:"))) {
+            return "Not merged. Bring the task branch up to date with its base (see above), push, wait for CI, then rerun `vibeops task merge`.";
+        }
         return "Not merged. Fix the failing checks (re-run `vibeops task ship` to push a fix and re-run CI), then rerun `vibeops task merge`.";
     }
     return "Merge in the host UI if branch protection blocks CLI merge.";
@@ -105,6 +108,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
             method,
             requiredChecks,
             gate,
+            requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             dryRun: true,
         });
         log.blank();
@@ -138,6 +142,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 waitForCi: true,
                 requiredChecks,
                 gate,
+                requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             });
             const verified = await assertMergeRequestMerged({
                 cwd,
@@ -176,6 +181,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 waitForCi: true,
                 requiredChecks,
                 gate,
+                requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             });
             const verified = await assertMergeRequestMerged({
                 cwd,

package/dist/lib/merge-base-freshness.js

@@ -0,0 +1,55 @@
+import { gitIsAncestor, runGit } from "./git.js";
+/**
+ * The MR/PR head must contain the current tip of its base branch.
+ *
+ * A head that does not (base moved, or the branch was rebuilt on a stale base,
+ * e.g. `git reset --soft <old base>` + commit) can silently revert work merged
+ * into the base since; a squash merge then lands that revert. Fetches the base
+ * branch and the head commit first; any fetch / read failure fails closed.
+ */
+export async function checkBaseInHead(opts) {
+    const { cwd, remote, baseBranch, headSha } = opts;
+    const baseRef = `refs/remotes/${remote}/${baseBranch}`;
+    try {
+        await runGit(cwd, ["fetch", "--no-tags", remote, `+refs/heads/${baseBranch}:${baseRef}`]);
+        if (!(await commitExists(cwd, headSha))) {
+            await runGit(cwd, ["fetch", "--no-tags", remote, headSha]);
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message.split("\n")[0] : String(e);
+        return {
+            ok: false,
+            problem: `could not fetch ${remote}/${baseBranch} and head ${short(headSha)} to check the base is current (${msg})`,
+        };
+    }
+    if (await gitIsAncestor(cwd, baseRef, headSha))
+        return { ok: true };
+    let behind = "";
+    try {
+        const { stdout } = await runGit(cwd, ["rev-list", "--count", `${headSha}..${baseRef}`]);
+        behind = ` (${stdout.trim()} commit(s) behind)`;
+    }
+    catch {
+        // count is informational only
+    }
+    return {
+        ok: false,
+        problem: `stale base: head ${short(headSha)} does not contain ${remote}/${baseBranch}${behind}. ` +
+            `Merging it can silently revert work merged into ${baseBranch} since. ` +
+            `Update the task branch (git fetch ${remote} && git merge ${remote}/${baseBranch}, resolve, test), ` +
+            `push it (vibeops task ship), wait for CI, then rerun vibeops task merge.`,
+    };
+}
+async function commitExists(cwd, sha) {
+    try {
+        await runGit(cwd, ["cat-file", "-e", `${sha}^{commit}`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function short(sha) {
+    return sha.slice(0, 7);
+}

package/dist/lib/pr-create.js

@@ -5,6 +5,7 @@ import { classifyRollup, evaluateCheckGate, formatCheckGateProblems, } from "./c
 import { isMergeRequestReadyToMerge, isPipelineActive, pipelineGateState, pipelineStatusFromHost, } from "./merge-request-readiness.js";
 import { evaluateActionsRuns, listExpectedPullRequestWorkflows, listWorkflowRunsForSha, parseGitHubPullUrl, } from "./github-actions-gate.js";
 import { dim, log } from "./logger.js";
+import { checkBaseInHead } from "./merge-base-freshness.js";
 import { MERGE_GATE_DEFAULTS, mergeGateTiming } from "./merge-config.js";
 const execFileAsync = promisify(execFile);
 async function ghPrCreate(opts) {
@@ -607,6 +608,10 @@ export async function mergeMergeRequest(opts) {
             ? ` + required: ${opts.requiredChecks.join(", ")}`
             : "";
         log.info(`would check ${label} status checks (all green${required}) before merging`);
+        if (opts.requireBaseInHead !== undefined) {
+            const { remote, baseBranch } = opts.requireBaseInHead;
+            log.info(`would refuse unless the head commit contains ${remote}/${baseBranch} (stale base)`);
+        }
         if (opts.host === "gitlab") {
             log.info(`would ${label} merge ${ref} (glab ${gitLabMergeArgs(ref, method, "<head sha>").join(" ")})`);
         }
@@ -629,6 +634,16 @@ export async function mergeMergeRequest(opts) {
             // Strict read already guarantees this; never merge unpinned.
             throw new MergeGateError(label, ["host did not report the head commit SHA"]);
         }
+        if (opts.requireBaseInHead !== undefined) {
+            const fresh = await checkBaseInHead({
+                cwd: opts.cwd,
+                remote: opts.requireBaseInHead.remote,
+                baseBranch: gate.details.baseBranch ?? opts.requireBaseInHead.baseBranch,
+                headSha: gate.details.headSha,
+            });
+            if (!fresh.ok)
+                throw new MergeGateError(label, [fresh.problem]);
+        }
         return gate.details;
     };
     const details = await runGate();

package/dist/lib/task-git-commit.js

@@ -16,20 +16,25 @@ const CONVENTIONAL_COMMIT_RE = /^([a-z]+)(?:\(([^)]*)\))?(!)?:\s*(.+)$/is;
  * - `"fix(login): handle null"`     → `fix(task-001): handle null` (scope rewritten)
  * - `"handle null"`                 → `feat(task-001): handle null` (defaultType)
  * - already-scoped correct messages are returned unchanged.
+ * - only the subject (first line) is scoped; a body and trailers after it
+ *   (e.g. `Co-Authored-By:`) are kept line by line.
  */
 export function taskScopedCommitMessage(taskId, rawMessage, defaultType = "feat") {
     const scope = taskId.toLowerCase();
-    const msg = rawMessage.trim().replace(/\s+/g, " ");
+    const lines = rawMessage.replace(/\r\n?/g, "\n").trim().split("\n");
+    const msg = (lines[0] ?? "").replace(/\s+/g, " ").trim();
+    const body = lines.slice(1).map((l) => l.trimEnd()).join("\n").replace(/^\n+/, "");
+    const withBody = (subject) => (body.length > 0 ? `${subject}\n\n${body}` : subject);
     if (msg.length === 0)
-        return `${defaultType}(${scope}): ${taskId}`;
+        return withBody(`${defaultType}(${scope}): ${taskId}`);
     const m = CONVENTIONAL_COMMIT_RE.exec(msg);
     if (m) {
         const type = m[1].toLowerCase();
         const bang = m[3] ?? "";
         const subject = m[4].trim();
-        return `${type}(${scope})${bang}: ${subject}`;
+        return withBody(`${type}(${scope})${bang}: ${subject}`);
     }
-    return `${defaultType}(${scope}): ${msg}`;
+    return withBody(`${defaultType}(${scope}): ${msg}`);
 }
 /**
  * Commit all committable dirty paths (staged and unstaged, including deletions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",
@@ -63,7 +63,7 @@
     "@eslint/js": "10.0.1",
     "@types/node": "^20.14.0",
     "eslint": "10.11.0",
-    "tsx": "^4.19.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.5.4",
     "typescript-eslint": "8.71.0"
   }