@goodtek/vibeops 3.1.4 → 3.1.6

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.1.6 - 2026-10-17
+
+### Fixed
+
+- **`task release` failed when the release PR was already open.** It now reuses the open integration → production PR; a failing lookup refuses. The dry-run now says the merge waits for the PR's own CI runs (it already did since 3.1.2) and shows `requiredChecks` as an extra by-name list (TASK-030).
+- **An unreadable Git Context was skipped quietly.** `task ship` printed "push/MR skipped" and exited 0; it now exits 1 before committing or pushing and names the problem (e.g. ``line 160 is `## ## Git Context` ``). `task add` no longer "resumes" an In Progress TASK whose Git Context is damaged — that wrote a second section and blocked new TASKs in every worktree (TASK-030).
+
+## 3.1.5 - 2026-10-16
+
+### Fixed
+
+- **`task merge` merged stale branches.** It now refuses unless the head commit the gate approved contains the current `<remote>/<base>` (`git merge-base --is-ancestor` after fetching both); the error says how many commits behind and how to update. Observed in a consumer repo: a branch rebuilt with `git reset --soft` on a stale `origin/develop` was squash-merged after `develop` had moved and silently reverted other TASKs' work. Fetch errors refuse. `task release` is unchanged (D-008, TASK-029).
+- **`task ship -m` joined multi-line messages** into one line, so a `Co-Authored-By:` trailer ended up in the subject. Only the subject is TASK-scoped now; the body and trailers are kept (TASK-029).
+
+### Security
+
+- `js-yaml` 3.14.2 → 3.15.2 (via `gray-matter`; GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh, GHSA-h67p-54hq-rp68). Dev: `tsx` ^4.23.15 → `esbuild` 0.28.2 (GHSA-g7r4-m6w7-qqqr). `sprintf-js` (GHSA-hp3w-g68c-fv3c) has no fixed release; it is only used by `js-yaml`'s command-line tool, which vibeops does not run (TASK-027).
+
 ## 3.1.4 - 2026-10-16
 
 ### Changed

package/README.md

@@ -158,7 +158,7 @@ vibeops llm use auto   # auto | codex-oauth | cursor-agent | openai
 - **`task merge`**: merge MR/PR into integration (TASK md unchanged) — **only when every check is green** (see [Merge gate](#merge-gate)).
 - **`task sync`**: verify merge → leave the task branch (switch to integration, or detach at `<remote>/<integration>` when another worktree owns it) → fast-forward local integration where safe → delete local + remote `task/*` branch (TASK md unchanged).
 - **`pull`**: fetch + switch to integration branch + `git pull --ff-only` (one command). Refuses (exit 1) when another worktree has the integration branch checked out — run it there.
-- **`task release`**: integration → production PR + merge (skipped on trunk policy).
+- **`task release`**: integration → production PR + merge (skipped on trunk policy). Reuses the open release PR when there is one; the merge waits for that PR's own CI like `task merge`.
 - **`status`**: Now / Next card — focus stage, checklist, PR, and the next command to run.
 - No force-push to shared branches.
 
@@ -223,6 +223,8 @@ Before calling `gh pr merge` / `glab mr merge`:
 - **No checks at all → refuse** unless `allowNoChecks: true`. "No checks" means: empty rollup, no GitHub Actions run and no expected workflow for the head commit (GitLab: no pipeline). For CI outside GitHub Actions (commit statuses / check apps), the empty list is re-polled for `emptyRollupGraceSeconds` first; list such checks in `requiredChecks` so the gate waits for them by name.
 - **Waiting** polls the host (`gh pr view` + the Actions REST API) every `pollIntervalSeconds` (default 10 s, the default of `gh pr checks --watch`) until the state changes, bounded by `waitTimeoutSeconds` (default 900 s). Host read errors back off exponentially with jitter (capped at 60 s, GitHub's guidance for rate-limited clients).
 - **The merge is pinned to the checked commit:** right before merging the gate re-reads the PR head; if it moved, the new head is evaluated from scratch. The merge itself uses `gh pr merge --match-head-commit <sha>` (requires **gh ≥ 2.13.0**) / `glab mr merge --auto-merge=false --sha <sha>` (verified with glab 1.106), so a push between the last check and the merge makes the host refuse. A GitLab `405` re-runs the gate and retries once with the same flags.
+- **Unreadable Git Context stops `task ship` / `task add`:** a TASK file whose `## Git Context` cannot be read (e.g. an edit left `## ## Git Context`) makes `task ship` exit 1 before committing or pushing, naming the line; `task add` refuses to "resume" such a TASK (it would write a second section) and names the file and line.
+- **`task merge` refuses a stale base:** the head commit the gate approved must contain the current `<remote>/<base>` (`git merge-base --is-ancestor`, after fetching the base branch and the head commit). A head that does not — the base moved since the branch was pushed, or the branch was rebuilt on an old base (e.g. `git reset --soft <stale origin/develop>` + commit) — can silently revert work merged into the base since, and a squash merge lands that revert. Bring the branch up to date (`git fetch` + `git merge <remote>/<base>`, test, `task ship`), wait for CI, then rerun `task merge`. A fetch failure refuses (fail closed). `task release` does not apply this check (with merge-commit releases the production branch is normally not an ancestor of the integration branch).
 
 ### Configuration (`.vibeops.json` → `merge`)
 

package/dist/commands/task-add.js

@@ -12,7 +12,7 @@ import { findBlockingTask, relPath } from "../lib/task-context.js";
 import { allocateTaskId, TaskIdAllocationError } from "../lib/task-id-allocation.js";
 import { readTaskLockConfig, TaskLockConfigError, TaskLockHeldError, withTaskLock, } from "../lib/task-lock.js";
 import { isIncompleteTaskStart, startTaskBranch } from "../lib/task-start.js";
-import { branchNameForTaskFile, loadActionableTasks, readGitContext } from "../lib/task.js";
+import { branchNameForTaskFile, damagedGitContext, loadActionableTasks, readGitContext, } from "../lib/task.js";
 async function loadGitConfigOrNull(root, dryRun) {
     try {
         return await requireGitConfig(root);
@@ -98,6 +98,15 @@ export async function taskAddCommand(opts = {}) {
         const blocking = await findBlockingTask(paths, root);
         // Resume: In Progress file exists but task branch / Git Context was never finished.
         if (blocking !== null && gitCfg !== null) {
+            // A damaged Git Context is not an unfinished add: resuming would write a second section.
+            const damaged = await damagedGitContext(blocking.filePath);
+            if (damaged !== null) {
+                log.error(`${bold(blocking.id)} is In Progress but its Git Context cannot be read: ${damaged}.`);
+                log.info(`  ${dim("file")}   ${relPath(root, blocking.filePath)}`);
+                log.info(dim("No TASK was created. Fix the TASK file (then ship it), and rerun task add."));
+                process.exitCode = 1;
+                return "done";
+            }
             const incomplete = await isIncompleteTaskStart(root, blocking.filePath);
             if (incomplete) {
                 log.warn(`${yellow("Incomplete")} — ${bold(blocking.id)} exists but the task branch was not created.`);

package/dist/commands/task-merge.js

@@ -22,6 +22,9 @@ function resolveMergeMethod(opts) {
 }
 function mergeFailureHint(error) {
     if (error instanceof MergeGateError) {
+        if (error.problems.some((p) => p.startsWith("stale base:"))) {
+            return "Not merged. Bring the task branch up to date with its base (see above), push, wait for CI, then rerun `vibeops task merge`.";
+        }
         return "Not merged. Fix the failing checks (re-run `vibeops task ship` to push a fix and re-run CI), then rerun `vibeops task merge`.";
     }
     return "Merge in the host UI if branch protection blocks CLI merge.";
@@ -105,6 +108,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
             method,
             requiredChecks,
             gate,
+            requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             dryRun: true,
         });
         log.blank();
@@ -138,6 +142,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 waitForCi: true,
                 requiredChecks,
                 gate,
+                requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             });
             const verified = await assertMergeRequestMerged({
                 cwd,
@@ -176,6 +181,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
                 waitForCi: true,
                 requiredChecks,
                 gate,
+                requireBaseInHead: { remote: gitCfg.remote, baseBranch: ctx.baseBranch },
             });
             const verified = await assertMergeRequestMerged({
                 cwd,

package/dist/commands/task-release.js

@@ -5,7 +5,7 @@ import { formatHostCliHint, formatHostCliMissingMessage } from "../lib/git-host-
 import { detectGitHost, mergeRequestLabel } from "../lib/git-host.js";
 import { gitRemoteUrl } from "../lib/git.js";
 import { bold, dim, log } from "../lib/logger.js";
-import { createMergeRequest, getMergeRequestState, MergeGateError, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
+import { createMergeRequest, findMergeRequestByBranches, getMergeRequestState, MergeGateError, mergeMergeRequest, probeMergeRequestCli, } from "../lib/pr-create.js";
 import { assertMergeRequestMerged } from "../lib/task-merge-verify.js";
 function resolveReleaseMergeMethod(opts) {
     if (opts.rebase === true)
@@ -65,9 +65,10 @@ export async function taskReleaseCommand(options = {}) {
     if (dryRun) {
         log.info(bold("dry-run — would:"));
         log.info(`  · ${label}: ${integrationBranch} → ${productionBranch}`);
+        log.info(`  · reuse the open ${label} ${integrationBranch} → ${productionBranch} if there is one`);
         if (options.noMerge !== true) {
-            log.info(`  · merge ${label} (${resolveReleaseMergeMethod(options)}) only when all checks are green`);
-            log.info(`  · required checks: ${requiredChecks.length > 0 ? requiredChecks.join(", ") : "(none configured)"}`);
+            log.info(`  · merge ${label} (${resolveReleaseMergeMethod(options)}) only when every check on its head commit is green — waits for the ${label}'s own CI runs`);
+            log.info(`  · required checks (by name, in addition): ${requiredChecks.length > 0 ? requiredChecks.join(", ") : "none configured"}`);
             if (mergeCfg.allowNoChecks) {
                 log.info("  · allowNoChecks: true (a release PR with no checks would merge)");
             }
@@ -84,24 +85,46 @@ export async function taskReleaseCommand(options = {}) {
         return;
     }
     let releaseUrl;
+    let open;
     try {
-        const { url } = await createMergeRequest({
+        open = await findMergeRequestByBranches({
             cwd,
             host,
-            baseBranch: productionBranch,
             headBranch: integrationBranch,
-            title,
-            body,
+            baseBranch: productionBranch,
+            state: "open",
         });
-        releaseUrl = url;
-        log.ok(`${label}: ${url}`);
     }
     catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        log.error(`Could not create release ${label}: ${msg}`);
+        const msg = e instanceof Error ? e.message.split("\n")[0] : String(e);
+        log.error(`Could not look up an open release ${label}: ${msg}`);
         process.exitCode = 1;
         return;
     }
+    if (open !== null) {
+        releaseUrl = open.url;
+        log.ok(`${label} already open — reusing: ${releaseUrl}`);
+    }
+    else {
+        try {
+            const { url } = await createMergeRequest({
+                cwd,
+                host,
+                baseBranch: productionBranch,
+                headBranch: integrationBranch,
+                title,
+                body,
+            });
+            releaseUrl = url;
+            log.ok(`${label}: ${url}`);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            log.error(`Could not create release ${label}: ${msg}`);
+            process.exitCode = 1;
+            return;
+        }
+    }
     if (options.noMerge === true) {
         log.info(dim("Merge skipped (--no-merge)."));
         return;

package/dist/commands/task-ship.js

@@ -14,7 +14,7 @@ import { runPostMergeNewCycle } from "../lib/task-new-cycle.js";
 import { applyTaskShipMemory, fallbackResultSections, llmCompleteTaskShip, writeTaskResultSections, } from "../lib/task-ship-llm.js";
 import { detectShipPrState, prRefLabel, resolveShipAction, } from "../lib/task-ship-state.js";
 import { finishTaskWithPullRequest } from "../lib/task-push-pr.js";
-import { hasNonEmptySection, parseTaskFilename, readGitContext, readTaskFile, updateInlineStatus, } from "../lib/task.js";
+import { hasNonEmptySection, parseTaskFilename, gitContextProblem, readGitContext, readTaskFile, updateInlineStatus, } from "../lib/task.js";
 import { assertTaskIdFreeOnRemote } from "../lib/task-id-allocation.js";
 function describePushFailure(message) {
     const lower = message.toLowerCase();
@@ -111,6 +111,13 @@ async function runFirstShip(ctx) {
         process.exitCode = 1;
         return;
     }
+    const gitCtx = await readGitContext(taskFile);
+    if (gitCtx === null) {
+        log.error(`No Git Context in ${relPath(cwd, taskFile)}: ${await gitContextProblem(taskFile)}. Nothing was committed or pushed.`);
+        log.info(dim("`vibeops task add` writes this section with the task branch; restore it, then rerun task ship."));
+        process.exitCode = 1;
+        return;
+    }
     if (dryRun) {
         log.info(bold("dry-run — would:"));
         if (!resultOk || !testOk) {
@@ -128,8 +135,7 @@ async function runFirstShip(ctx) {
         });
         return;
     }
-    const gitCtx = await readGitContext(taskFile);
-    if (gitCtx !== null && !(await ensureOnTaskBranch(cwd, gitCtx, dryRun))) {
+    if (!(await ensureOnTaskBranch(cwd, gitCtx, dryRun))) {
         process.exitCode = 1;
         return;
     }
@@ -150,10 +156,6 @@ async function runFirstShip(ctx) {
         });
         await commitDirtyWorkingTree(cwd, message, false);
     }
-    if (gitCtx === null) {
-        log.info(dim("No Git Context — push/MR skipped."));
-        return;
-    }
     await commitShipMetadata({ cwd, taskFile, taskId: parts.id, dryRun: false });
     const prResult = await finishTaskWithPullRequest({
         cwd,
@@ -183,7 +185,7 @@ async function runUpdateOpenPr(ctx) {
     const { cwd, taskId, taskFile, meta, body, prCtx, dryRun, nonInteractive, options } = ctx;
     const gitCtx = await readGitContext(taskFile);
     if (gitCtx === null) {
-        log.error("No Git Context — cannot update the open PR.");
+        log.error(`No Git Context — cannot update the open PR: ${await gitContextProblem(taskFile)}.`);
         process.exitCode = 1;
         return;
     }

package/dist/lib/merge-base-freshness.js

@@ -0,0 +1,55 @@
+import { gitIsAncestor, runGit } from "./git.js";
+/**
+ * The MR/PR head must contain the current tip of its base branch.
+ *
+ * A head that does not (base moved, or the branch was rebuilt on a stale base,
+ * e.g. `git reset --soft <old base>` + commit) can silently revert work merged
+ * into the base since; a squash merge then lands that revert. Fetches the base
+ * branch and the head commit first; any fetch / read failure fails closed.
+ */
+export async function checkBaseInHead(opts) {
+    const { cwd, remote, baseBranch, headSha } = opts;
+    const baseRef = `refs/remotes/${remote}/${baseBranch}`;
+    try {
+        await runGit(cwd, ["fetch", "--no-tags", remote, `+refs/heads/${baseBranch}:${baseRef}`]);
+        if (!(await commitExists(cwd, headSha))) {
+            await runGit(cwd, ["fetch", "--no-tags", remote, headSha]);
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message.split("\n")[0] : String(e);
+        return {
+            ok: false,
+            problem: `could not fetch ${remote}/${baseBranch} and head ${short(headSha)} to check the base is current (${msg})`,
+        };
+    }
+    if (await gitIsAncestor(cwd, baseRef, headSha))
+        return { ok: true };
+    let behind = "";
+    try {
+        const { stdout } = await runGit(cwd, ["rev-list", "--count", `${headSha}..${baseRef}`]);
+        behind = ` (${stdout.trim()} commit(s) behind)`;
+    }
+    catch {
+        // count is informational only
+    }
+    return {
+        ok: false,
+        problem: `stale base: head ${short(headSha)} does not contain ${remote}/${baseBranch}${behind}. ` +
+            `Merging it can silently revert work merged into ${baseBranch} since. ` +
+            `Update the task branch (git fetch ${remote} && git merge ${remote}/${baseBranch}, resolve, test), ` +
+            `push it (vibeops task ship), wait for CI, then rerun vibeops task merge.`,
+    };
+}
+async function commitExists(cwd, sha) {
+    try {
+        await runGit(cwd, ["cat-file", "-e", `${sha}^{commit}`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function short(sha) {
+    return sha.slice(0, 7);
+}

package/dist/lib/pr-create.js

@@ -5,6 +5,7 @@ import { classifyRollup, evaluateCheckGate, formatCheckGateProblems, } from "./c
 import { isMergeRequestReadyToMerge, isPipelineActive, pipelineGateState, pipelineStatusFromHost, } from "./merge-request-readiness.js";
 import { evaluateActionsRuns, listExpectedPullRequestWorkflows, listWorkflowRunsForSha, parseGitHubPullUrl, } from "./github-actions-gate.js";
 import { dim, log } from "./logger.js";
+import { checkBaseInHead } from "./merge-base-freshness.js";
 import { MERGE_GATE_DEFAULTS, mergeGateTiming } from "./merge-config.js";
 const execFileAsync = promisify(execFile);
 async function ghPrCreate(opts) {
@@ -607,6 +608,10 @@ export async function mergeMergeRequest(opts) {
             ? ` + required: ${opts.requiredChecks.join(", ")}`
             : "";
         log.info(`would check ${label} status checks (all green${required}) before merging`);
+        if (opts.requireBaseInHead !== undefined) {
+            const { remote, baseBranch } = opts.requireBaseInHead;
+            log.info(`would refuse unless the head commit contains ${remote}/${baseBranch} (stale base)`);
+        }
         if (opts.host === "gitlab") {
             log.info(`would ${label} merge ${ref} (glab ${gitLabMergeArgs(ref, method, "<head sha>").join(" ")})`);
         }
@@ -629,6 +634,16 @@ export async function mergeMergeRequest(opts) {
             // Strict read already guarantees this; never merge unpinned.
             throw new MergeGateError(label, ["host did not report the head commit SHA"]);
         }
+        if (opts.requireBaseInHead !== undefined) {
+            const fresh = await checkBaseInHead({
+                cwd: opts.cwd,
+                remote: opts.requireBaseInHead.remote,
+                baseBranch: gate.details.baseBranch ?? opts.requireBaseInHead.baseBranch,
+                headSha: gate.details.headSha,
+            });
+            if (!fresh.ok)
+                throw new MergeGateError(label, [fresh.problem]);
+        }
         return gate.details;
     };
     const details = await runGate();

package/dist/lib/task-git-commit.js

@@ -16,20 +16,25 @@ const CONVENTIONAL_COMMIT_RE = /^([a-z]+)(?:\(([^)]*)\))?(!)?:\s*(.+)$/is;
  * - `"fix(login): handle null"`     → `fix(task-001): handle null` (scope rewritten)
  * - `"handle null"`                 → `feat(task-001): handle null` (defaultType)
  * - already-scoped correct messages are returned unchanged.
+ * - only the subject (first line) is scoped; a body and trailers after it
+ *   (e.g. `Co-Authored-By:`) are kept line by line.
  */
 export function taskScopedCommitMessage(taskId, rawMessage, defaultType = "feat") {
     const scope = taskId.toLowerCase();
-    const msg = rawMessage.trim().replace(/\s+/g, " ");
+    const lines = rawMessage.replace(/\r\n?/g, "\n").trim().split("\n");
+    const msg = (lines[0] ?? "").replace(/\s+/g, " ").trim();
+    const body = lines.slice(1).map((l) => l.trimEnd()).join("\n").replace(/^\n+/, "");
+    const withBody = (subject) => (body.length > 0 ? `${subject}\n\n${body}` : subject);
     if (msg.length === 0)
-        return `${defaultType}(${scope}): ${taskId}`;
+        return withBody(`${defaultType}(${scope}): ${taskId}`);
     const m = CONVENTIONAL_COMMIT_RE.exec(msg);
     if (m) {
         const type = m[1].toLowerCase();
         const bang = m[3] ?? "";
         const subject = m[4].trim();
-        return `${type}(${scope})${bang}: ${subject}`;
+        return withBody(`${type}(${scope})${bang}: ${subject}`);
     }
-    return `${defaultType}(${scope}): ${msg}`;
+    return withBody(`${defaultType}(${scope}): ${msg}`);
 }
 /**
  * Commit all committable dirty paths (staged and unstaged, including deletions

package/dist/lib/task.js

@@ -221,6 +221,25 @@ function locateSection(text, title, level = 2) {
     }
     return null;
 }
+/**
+ * A line that looks like the `## <title>` heading but is not one (e.g. `## ## Git Context`
+ * or `#Git Context`), when no well-formed heading exists. 1-based line number, or `null`.
+ */
+export function findMalformedSectionHeading(text, title, level = 2) {
+    if (locateSection(text, title, level) !== null)
+        return null;
+    const want = title.toLowerCase();
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!/^\s*#/.test(line))
+            continue;
+        const name = line.replace(/^[\s#]+/, "").replace(/[\s#]+$/, "").toLowerCase();
+        if (name === want)
+            return { line: i + 1, text: line.trim() };
+    }
+    return null;
+}
 export function readSection(body, title) {
     const block = locateSection(body, title);
     if (block === null)
@@ -420,6 +439,30 @@ export async function upsertGitContext(filePath, ctx) {
         await writeText(filePath, updated);
     }
 }
+/**
+ * The Git Context exists but cannot be read (malformed heading, or the section lacks
+ * its fields): the problem text, else `null` (readable, or no section at all).
+ */
+export async function damagedGitContext(filePath) {
+    if ((await readGitContext(filePath)) !== null)
+        return null;
+    const raw = await readText(filePath);
+    const malformed = findMalformedSectionHeading(raw, "Git Context") !== null;
+    const unparsable = readSection(raw, "Git Context").length > 0;
+    return malformed || unparsable ? gitContextProblem(filePath) : null;
+}
+/** Why {@link readGitContext} returned `null` for this file — for error messages. */
+export async function gitContextProblem(filePath) {
+    const raw = await readText(filePath);
+    const bad = findMalformedSectionHeading(raw, "Git Context");
+    if (bad !== null) {
+        return `line ${bad.line} is \`${bad.text}\`, not \`## Git Context\` — fix that heading`;
+    }
+    if (readSection(raw, "Git Context").length === 0) {
+        return "the file has no `## Git Context` section";
+    }
+    return "`## Git Context` lacks Base Branch / Base Commit / Task Branch / Started At";
+}
 const GIT_CTX_RE = {
     baseBranch: /^-\s+Base Branch:\s*`([^`]+)`/m,
     baseCommit: /^-\s+Base Commit:\s*`([^`]+)`/m,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.1.4",
+  "version": "3.1.6",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",
@@ -63,7 +63,7 @@
     "@eslint/js": "10.0.1",
     "@types/node": "^20.14.0",
     "eslint": "10.11.0",
-    "tsx": "^4.19.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.5.4",
     "typescript-eslint": "8.71.0"
   }