@goodtek/vibeops 3.3.1 → 3.4.1

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.4.1 - 2026-11-08
+
+### Fixed
+
+- **Merge gate: a re-run supersedes the earlier run of the same check.** `statusCheckRollup` keeps every run of a check on the head commit, and any failure among them refused the merge — so a check that failed once (e.g. a transient host error) and then passed on a re-run still blocked `task merge`. The gate now keeps the latest item per check identity (CheckRun: workflow + name; StatusContext: context), latest = started last (`startedAt`, then `completedAt`; still running = newest). A later failure still beats an earlier pass, a newer pending run still waits, and when the order is unknown (an item without `startedAt`, or an exact tie) every run of that check is kept, so the gate stays fail-closed (D-016, TASK-059).
+
+## 3.4.0 - 2026-11-07
+
+### Added
+
+- **`.vibeops.json` `git.commitTrailers`**: git trailers (e.g. `Co-Authored-By: …`) added with `git commit --trailer` to every commit `task ship` / `--new-cycle` makes, including the `mark shipped` and new-cycle metadata commits. Entries are validated strictly (one-line `Token: value`); an invalid entry exits 1 naming it. `--dry-run` lists them (TASK-057).
+
 ## 3.3.1 - 2026-10-18
 
 ### Changed

package/README.md

@@ -163,6 +163,26 @@ vibeops llm use auto   # auto | codex-oauth | cursor-agent | openai
 - **`status`**: Now / Next card — focus stage, checklist, PR, and the next command to run.
 - No force-push to shared branches.
 
+### Commit trailers (`.vibeops.json` → `git.commitTrailers`)
+
+Commits VibeOps makes itself (`task ship` implementation and `mark shipped` commits, `--new-cycle` metadata) can carry git trailers. git's `trailer.*` config only applies with `--trailer` / `interpret-trailers`, and `commit.template` is ignored for `-m`, so set them here:
+
+```json
+{
+  "git": {
+    "remote": "origin",
+    "host": "github",
+    "integrationBranch": "develop",
+    "productionBranch": "main",
+    "commitTrailers": ["Co-Authored-By: Name <name@example.com>"]
+  }
+}
+```
+
+- Each entry is passed as `git commit --trailer <entry>`; `--dry-run` lists them.
+- Validated strictly: an array of one-line `Token: value` strings (token: letters, digits, `-`). Anything else (not an array, newline, missing `: `, empty value) makes the command exit 1 naming the entry.
+- Unset → no trailers. Re-running `init` keeps the list. The initial `init` commit does not use it.
+
 ## Worktrees
 
 VibeOps supports several `git worktree` checkouts of one repo working in parallel. It never needs to check out the integration branch:
@@ -234,7 +254,8 @@ Before calling `gh pr merge` / `glab mr merge`:
   - **passed:** `SUCCESS`, `NEUTRAL`, `SKIPPED`
   - **failed:** `FAILURE`, `CANCELLED`, `TIMED_OUT`, `ACTION_REQUIRED`, `STARTUP_FAILURE`, `STALE`, `ERROR`
   - **pending:** CheckRun `REQUESTED`, `QUEUED`, `IN_PROGRESS`, `WAITING`, `PENDING`; StatusContext `PENDING`, `EXPECTED`
-  - **anything missing or undocumented fails closed** (treated as failed). Several checks with the same name: any failure fails.
+  - **anything missing or undocumented fails closed** (treated as failed).
+  - **Re-runs: the latest run of each check counts.** The rollup keeps every run of a check on the head commit (a re-run adds one). The gate keeps the latest per check identity — CheckRun: workflow + name (`test` in two workflows are two checks); StatusContext: context — where latest = started last (`startedAt`, ties by `completedAt`, a still-running item is newest). So a failure followed by a passing re-run passes, a pass followed by a failing re-run fails, and a newer queued / running re-run waits. If the order is unknown — an item without `startedAt` or an exact tie — all runs of that check are kept and any failure among them fails.
 - **GitHub Actions — the PR's own CI, not leftovers:** the rollup lists every check on the head commit, including checks from other events (e.g. a finished `push` workflow on `develop` when a release PR `develop → main` is opened). Right after a PR is opened or pushed, GitHub has not created its `pull_request` run — or that run's jobs — yet, so such a rollup looked green and 3.1.x merged before CI started. The gate therefore also reads the GitHub Actions API for the head SHA:
   - **Expected workflows:** every `.github/workflows/*.yml|yaml` at the head commit whose `on:` triggers `pull_request` for this PR, using GitHub's filter rules — `branches` / `branches-ignore` against the base branch, `paths` / `paths-ignore` against the PR's changed files (first 300, like GitHub), and `types` (a custom list must contain both `opened` and `synchronize`). Disabled workflows are skipped; `pull_request_target`, `workflow_call` and other events are not awaited. Each expected workflow must have a `pull_request` run for the head SHA — until it appears the gate **waits** (`workflow … (pull_request) has not started for <sha> yet`), then refuses at `waitTimeoutSeconds`.
   - **All runs for the head SHA** (any event, latest run per workflow + event) must be `completed` with `success`, `neutral` or `skipped`. A queued / in-progress / waiting run waits; any other conclusion refuses immediately — including `startup_failure` (no jobs, so nothing in the rollup) and `action_required` (fork PR awaiting approval).

package/dist/commands/task-ship.js

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
 import { readText } from "../lib/filesystem.js";
-import { requireGitConfig } from "../lib/git-config.js";
+import { readCommitTrailers, requireGitConfig } from "../lib/git-config.js";
 import { BASELINE_REPAIR_SECTION, preflightBaseline } from "../lib/project-baseline.js";
 import { gitCommitsAhead, gitHeadCommit, gitPush, gitRemoteBranchExists, readGitInfo, } from "../lib/git.js";
 import { askYesNo, isInteractiveSession } from "../lib/inquirer-helpers.js";
@@ -56,18 +56,20 @@ async function commitShipMetadata(opts) {
     if (opts.dryRun) {
         log.info(dim("  would set Status → Shipped"));
         log.info(dim("  would commit ship metadata"));
+        if (opts.trailers.length > 0)
+            log.info(dim(`  with trailers: ${opts.trailers.join(" | ")}`));
         return;
     }
     await updateInlineStatus(opts.taskFile, "shipped");
     log.ok("Status → Shipped");
-    const committed = await commitDirtyWorkingTree(opts.cwd, docsCommitMessageFor(opts.taskId, "mark shipped"), false);
+    const committed = await commitDirtyWorkingTree(opts.cwd, docsCommitMessageFor(opts.taskId, "mark shipped"), false, opts.trailers);
     if (!committed) {
         log.warn("No file changes for ship metadata commit — check TASK Status on the remote branch.");
     }
 }
 /** State 1: first submit — push the task branch and open a new PR/MR. */
 async function runFirstShip(ctx) {
-    const { cwd, taskId, taskFile, meta, relFile, dryRun, nonInteractive, options } = ctx;
+    const { cwd, taskId, taskFile, meta, relFile, dryRun, nonInteractive, options, trailers } = ctx;
     let body = ctx.body;
     let resultOk = hasNonEmptySection(body, "Result");
     let testOk = hasNonEmptySection(body, "Test Result");
@@ -127,7 +129,7 @@ async function runFirstShip(ctx) {
         log.info("  · commit implementation (TASK-scoped message) + ship metadata (Status → Shipped)");
         log.info("  · push task branch once, open a new MR/PR (unless --no-pr)");
         const partsDry = parseTaskFilename(taskFile);
-        await commitShipMetadata({ cwd, taskFile, taskId: partsDry.id, dryRun: true });
+        await commitShipMetadata({ cwd, taskFile, taskId: partsDry.id, dryRun: true, trailers });
         await finishTaskWithPullRequest({
             cwd,
             taskFile,
@@ -155,9 +157,9 @@ async function runFirstShip(ctx) {
             provided: options.message,
             nonInteractive,
         });
-        await commitDirtyWorkingTree(cwd, message, false);
+        await commitDirtyWorkingTree(cwd, message, false, trailers);
     }
-    await commitShipMetadata({ cwd, taskFile, taskId: parts.id, dryRun: false });
+    await commitShipMetadata({ cwd, taskFile, taskId: parts.id, dryRun: false, trailers });
     const prResult = await finishTaskWithPullRequest({
         cwd,
         taskFile,
@@ -183,7 +185,7 @@ async function runFirstShip(ctx) {
 }
 /** State 2: an open PR exists — commit + push to update it (no new PR). */
 async function runUpdateOpenPr(ctx) {
-    const { cwd, taskId, taskFile, meta, body, prCtx, dryRun, nonInteractive, options } = ctx;
+    const { cwd, taskId, taskFile, meta, body, prCtx, dryRun, nonInteractive, options, trailers } = ctx;
     const gitCtx = await readGitContext(taskFile);
     if (gitCtx === null) {
         log.error(`No Git Context — cannot update the open PR: ${await gitContextProblem(taskFile)}.`);
@@ -220,7 +222,7 @@ async function runUpdateOpenPr(ctx) {
     if (meta.status === "in_progress") {
         await updateInlineStatus(taskFile, "shipped");
         log.ok("Status → Shipped");
-        await commitDirtyWorkingTree(cwd, docsCommitMessageFor(taskId, "mark shipped"), false);
+        await commitDirtyWorkingTree(cwd, docsCommitMessageFor(taskId, "mark shipped"), false, trailers);
     }
     if (options.noCommit === true) {
         const git = await readGitInfo(cwd);
@@ -236,7 +238,7 @@ async function runUpdateOpenPr(ctx) {
             provided: options.message,
             nonInteractive,
         });
-        await commitDirtyWorkingTree(cwd, message, false);
+        await commitDirtyWorkingTree(cwd, message, false, trailers);
     }
     const remoteExists = await gitRemoteBranchExists(cwd, remote, gitCtx.taskBranch);
     const ahead = remoteExists
@@ -338,6 +340,15 @@ export async function taskShipCommand(taskRef, options = {}) {
         process.exitCode = 1;
         return;
     }
+    let trailers;
+    try {
+        trailers = await readCommitTrailers(cwd);
+    }
+    catch (e) {
+        log.error(e instanceof Error ? e.message : String(e));
+        process.exitCode = 1;
+        return;
+    }
     const ctx = {
         cwd,
         taskId,
@@ -349,6 +360,7 @@ export async function taskShipCommand(taskRef, options = {}) {
         dryRun,
         nonInteractive,
         options,
+        trailers,
     };
     switch (action) {
         case "update-open":

package/dist/lib/check-rollup.js

@@ -5,6 +5,11 @@
  * GitHub returns two item shapes:
  * - `CheckRun` (GitHub Actions, check apps): `status` + `conclusion`, no `state`.
  * - `StatusContext` (commit status API): `state`, no `status`/`conclusion`.
+ *
+ * The rollup keeps every run of a check: a re-run (new attempt or new workflow run on the
+ * same head SHA) adds an item next to the old one. {@link latestPerCheck} keeps the latest
+ * item per check identity, so a passed re-run supersedes an earlier failure and a later
+ * failure supersedes an earlier pass.
  */
 /** GitHub GraphQL `CheckStatusState` values other than COMPLETED. */
 const CHECK_RUN_IN_FLIGHT = new Set(["REQUESTED", "QUEUED", "IN_PROGRESS", "WAITING", "PENDING"]);
@@ -32,7 +37,23 @@ function isCheckRun(item) {
     // Unknown typename: infer from fields.
     return (item.status ?? null) !== null || (item.conclusion ?? null) !== null;
 }
+/** RFC 3339 → epoch ms; missing, unparseable or Go's zero time (`0001-01-01T00:00:00Z`) → `null`. */
+function timestamp(raw) {
+    if (raw === null || raw === undefined || raw.trim() === "")
+        return null;
+    const ms = Date.parse(raw);
+    return Number.isFinite(ms) && ms > 0 ? ms : null;
+}
 export function classifyRollupItem(item) {
+    const base = classifyVerdict(item);
+    return {
+        ...base,
+        workflow: base.kind === "CheckRun" ? (item.workflowName ?? "").trim() || null : null,
+        startedAt: timestamp(item.startedAt),
+        completedAt: timestamp(item.completedAt),
+    };
+}
+function classifyVerdict(item) {
     if (isCheckRun(item)) {
         const name = (item.name ?? "").trim() || "(unnamed check run)";
         const status = upper(item.status);
@@ -72,8 +93,62 @@ export function classifyRollupItem(item) {
     // Missing or undocumented state — fail closed.
     return { name, kind: "StatusContext", verdict: "failed", detail: state || "MISSING_STATE" };
 }
+/** Classified, latest item per check identity ({@link latestPerCheck}). */
 export function classifyRollup(items) {
-    return (items ?? []).map(classifyRollupItem);
+    return latestPerCheck((items ?? []).map(classifyRollupItem));
+}
+/**
+ * Check identity: CheckRun = workflow + name (two workflows may both have a `test` job);
+ * StatusContext = context. GitHub's `workflowName` carries no event, so runs of one workflow
+ * from different events share an identity here; the Actions part of the gate
+ * (`evaluateActionsRuns`) still judges the latest run per workflow + event.
+ */
+function checkIdentity(c) {
+    return c.kind === "CheckRun"
+        ? `CheckRun\u0000${c.workflow ?? ""}\u0000${c.name}`
+        : `StatusContext\u0000${c.name}`;
+}
+/**
+ * Keep the latest item per check identity, like GitHub's merge box, which shows the latest
+ * result of each check. "Latest" = the item that started last (`startedAt`; a re-run starts
+ * after the run it repeats), ties broken by `completedAt` (an in-flight item with no
+ * `completedAt` is newest). Its verdict stands: a newer pending item is pending, a newer
+ * failure fails even after an earlier pass.
+ *
+ * Fail closed when the order is unknown: if any item of an identity lacks `startedAt`
+ * (e.g. queued, or an older gh), or the latest items tie exactly, every item of that
+ * identity is kept — so any failure among them still fails and any pending still waits.
+ */
+export function latestPerCheck(checks) {
+    const groups = new Map();
+    for (const c of checks) {
+        const key = checkIdentity(c);
+        const group = groups.get(key);
+        if (group === undefined)
+            groups.set(key, [c]);
+        else
+            group.push(c);
+    }
+    const out = [];
+    for (const group of groups.values()) {
+        if (group.length === 1 || group.some((c) => (c.startedAt ?? null) === null)) {
+            out.push(...group);
+            continue;
+        }
+        const sorted = [...group].sort(compareRecency);
+        const newest = sorted[sorted.length - 1];
+        out.push(...sorted.filter((c) => compareRecency(c, newest) === 0));
+    }
+    return out;
+}
+/** Ascending recency: `startedAt`, then `completedAt` (missing = still running = newest). */
+function compareRecency(a, b) {
+    const started = (a.startedAt ?? 0) - (b.startedAt ?? 0);
+    if (started !== 0)
+        return started;
+    const ac = a.completedAt ?? Number.POSITIVE_INFINITY;
+    const bc = b.completedAt ?? Number.POSITIVE_INFINITY;
+    return ac === bc ? 0 : ac < bc ? -1 : 1;
 }
 /** Exact name, or a `*` glob (e.g. `lint*`, `* · linux`). */
 export function checkNameMatches(name, pattern) {

package/dist/lib/commit-trailers.js

@@ -0,0 +1,33 @@
+/**
+ * Git trailers for commits VibeOps creates itself (`.vibeops.json` `git.commitTrailers`).
+ * Each entry is passed as `git commit --trailer <entry>` (git-commit(1), git-interpret-trailers(1)).
+ */
+export class CommitTrailersConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CommitTrailersConfigError";
+    }
+}
+/** `Token: value` — token of letters, digits and `-` (git trailer key), non-empty single-line value. */
+const TRAILER_RE = /^[A-Za-z0-9][A-Za-z0-9-]*: \S.*$/;
+/**
+ * Validate the raw `git.commitTrailers` value. Absent → `undefined`; anything that is not
+ * an array of single-line `Token: value` strings throws (fail closed, entry named).
+ */
+export function parseCommitTrailers(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        throw new CommitTrailersConfigError(".vibeops.json git.commitTrailers must be an array of \"Token: value\" strings.");
+    }
+    return raw.map((entry, i) => {
+        if (typeof entry !== "string" || /[\r\n]/.test(entry) || !TRAILER_RE.test(entry)) {
+            throw new CommitTrailersConfigError(`.vibeops.json git.commitTrailers[${i}] is invalid: ${JSON.stringify(entry)} — expected one line "Token: value" (e.g. "Co-Authored-By: Name <name@example.com>").`);
+        }
+        return entry;
+    });
+}
+/** `git commit` arguments for the trailers (`--trailer <t>` each). */
+export function commitTrailerArgs(trailers) {
+    return trailers.flatMap((t) => ["--trailer", t]);
+}

package/dist/lib/config.js

@@ -4,6 +4,7 @@ import { VIBEOPS_CONFIG_FILE } from "./paths.js";
 import { VERSION } from "../version.js";
 import { VIBEOPS_CONFIG_SCHEMA_VERSION, } from "../types/config.js";
 import { isVibeopsClientId } from "./init-clients.js";
+import { CommitTrailersConfigError, parseCommitTrailers } from "./commit-trailers.js";
 function parseClientsBlock(raw) {
     if (!Array.isArray(raw))
         return undefined;
@@ -40,7 +41,14 @@ function parseGitBlock(raw) {
         : undefined;
     if (!host || !integrationBranch || !productionBranch)
         return undefined;
-    return { remote, host, integrationBranch, productionBranch };
+    const commitTrailers = parseCommitTrailers(o.commitTrailers);
+    return {
+        remote,
+        host,
+        integrationBranch,
+        productionBranch,
+        ...(commitTrailers ? { commitTrailers } : {}),
+    };
 }
 function parseLlmBlock(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw)) {
@@ -81,7 +89,10 @@ export async function readConfig(root) {
         }
         return null;
     }
-    catch {
+    catch (e) {
+        // An invalid commitTrailers entry is a visible error, not "no config".
+        if (e instanceof CommitTrailersConfigError)
+            throw e;
         return null;
     }
 }
@@ -92,7 +103,12 @@ export function buildConfig(name, clients, git, existing, nowIso) {
         schemaVersion: VIBEOPS_CONFIG_SCHEMA_VERSION,
         createdAt: existing?.createdAt ?? nowIso ?? new Date().toISOString(),
         clients,
-        git,
+        git: {
+            ...git,
+            ...(git.commitTrailers === undefined && existing?.git?.commitTrailers
+                ? { commitTrailers: existing.git.commitTrailers }
+                : {}),
+        },
         llm: existing?.llm ?? { provider: "auto" },
         ...(existing?.merge !== undefined ? { merge: existing.merge } : {}),
         ...(existing?.baseline !== undefined ? { baseline: existing.baseline } : {}),

package/dist/lib/git-config.js

@@ -19,3 +19,7 @@ export async function requireGitConfig(cwd) {
     }
     return config.git;
 }
+/** `git.commitTrailers` from `.vibeops.json` (empty when unset or no config); throws when invalid. */
+export async function readCommitTrailers(cwd) {
+    return (await readConfig(cwd))?.git?.commitTrailers ?? [];
+}

package/dist/lib/task-git-commit.js

@@ -1,3 +1,4 @@
+import { commitTrailerArgs } from "./commit-trailers.js";
 import { dim, log } from "./logger.js";
 import { gitAddPaths, gitPush, listUnstagedRelPaths, listWorkingTreeRelPaths, partitionPathsForAutoCommit, readGitInfo, runGit, } from "./git.js";
 export function featCommitMessageFor(taskId, title) {
@@ -40,9 +41,10 @@ export function taskScopedCommitMessage(taskId, rawMessage, defaultType = "feat"
  * Commit all committable dirty paths (staged and unstaged, including deletions
  * and renames); returns whether a commit was created. Only paths whose
  * working-tree state is not yet in the index are passed to `git add`; staged
- * changes are already part of the commit.
+ * changes are already part of the commit. Each `trailers` entry
+ * (`.vibeops.json` `git.commitTrailers`) is added with `git commit --trailer`.
  */
-export async function commitDirtyWorkingTree(cwd, message, dryRun) {
+export async function commitDirtyWorkingTree(cwd, message, dryRun, trailers) {
     const git = await readGitInfo(cwd);
     if (!git.isRepo || git.dirty !== true)
         return false;
@@ -54,11 +56,13 @@ export async function commitDirtyWorkingTree(cwd, message, dryRun) {
     }
     if (dryRun) {
         log.info(dim(`  would commit ${committable.length} path(s): ${message}`));
+        if (trailers.length > 0)
+            log.info(dim(`  with trailers: ${trailers.join(" | ")}`));
         return true;
     }
     const committableSet = new Set(committable);
     await gitAddPaths(cwd, (await listUnstagedRelPaths(cwd)).filter((p) => committableSet.has(p)));
-    await runGit(cwd, ["commit", "-q", "-m", message]);
+    await runGit(cwd, ["commit", "-q", "-m", message, ...commitTrailerArgs(trailers)]);
     log.ok(`Committed: ${message}`);
     return true;
 }

package/dist/lib/task-new-cycle.js

@@ -7,6 +7,7 @@ import { projectPaths } from "./paths.js";
 import { prNumberFromUrl } from "./pr-create.js";
 import { relPath } from "./task-context.js";
 import { resolveShipCommitMessage } from "./task-commit-msg.js";
+import { readCommitTrailers } from "./git-config.js";
 import { commitDirtyWorkingTree, docsCommitMessageFor } from "./task-git-commit.js";
 import { finishTaskWithPullRequest } from "./task-push-pr.js";
 import { applyTaskShipMemory, llmCompleteTaskReship, writeTaskResultSections, } from "./task-ship-llm.js";
@@ -33,7 +34,7 @@ async function commitReshipMetadata(opts) {
         log.info(dim("  would commit new-cycle metadata (Status stays Shipped)"));
         return;
     }
-    const committed = await commitDirtyWorkingTree(opts.cwd, docsCommitMessageFor(opts.taskId, "new PR cycle metadata"), false);
+    const committed = await commitDirtyWorkingTree(opts.cwd, docsCommitMessageFor(opts.taskId, "new PR cycle metadata"), false, opts.trailers);
     if (!committed) {
         log.info(dim("No new-cycle metadata commit (Git Context already on disk)."));
     }
@@ -66,6 +67,18 @@ export async function runPostMergeNewCycle(taskRef, options = {}) {
         process.exitCode = 1;
         return;
     }
+    let trailers;
+    try {
+        trailers = await readCommitTrailers(cwd);
+    }
+    catch (e) {
+        log.error(e instanceof Error ? e.message : String(e));
+        process.exitCode = 1;
+        return;
+    }
+    if (dryRun && trailers.length > 0) {
+        log.info(dim(`  commits would carry trailers: ${trailers.join(" | ")}`));
+    }
     const integrationBranch = gitCfg?.integrationBranch ?? "develop";
     const remote = gitCfg?.remote ?? "origin";
     const updateOpenMr = options.allowOpenMr === true;
@@ -173,7 +186,7 @@ export async function runPostMergeNewCycle(taskRef, options = {}) {
             provided: options.message,
             nonInteractive: options.nonInteractive === true,
         });
-        await commitDirtyWorkingTree(cwd, message, false);
+        await commitDirtyWorkingTree(cwd, message, false, trailers);
     }
     else {
         // Work may already be committed on the task branch (not merged into the base yet).
@@ -213,6 +226,7 @@ export async function runPostMergeNewCycle(taskRef, options = {}) {
             taskFile,
             taskId: parts.id,
             dryRun: false,
+            trailers,
         });
     }
     const prResult = await finishTaskWithPullRequest({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.3.1",
+  "version": "3.4.1",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",