@vodmal/vdx-cli 0.32.0 → 0.33.0

package/README.md

@@ -127,11 +127,16 @@ By default the bundled `rubric/vdx-rubric.yaml` is used (a mirror of canonical
 each CLI release). Override via `--rubric <path>` or the env var `VDX_RUBRIC`.
 
 `branch-protection` is the one axis the files cannot answer: `vdx audit` asks
-GitHub whether the default branch of `origin` takes changes only after a check
-required of everyone, admins included. A public repo needs no token; a private
-one takes it from `GH_TOKEN`, `GITHUB_TOKEN` or `gh auth token`. Another
-hosting, no network or no token where one is needed leave the axis unknown,
-with the reason in the report; `VDX_OFFLINE=1` does not ask at all.
+the hosting of `origin` whether its default branch takes changes only after a
+check required of everyone, admins included. GitHub: protection or a ruleset
+nobody bypasses; a public repo needs no token, a private one takes it from
+`GH_TOKEN`, `GITHUB_TOKEN` or `gh auth token`. GitLab (a host with `gitlab` in
+its name, or one glab has a token for): nobody may push to the branch directly,
+and a merge request needs a passing pipeline; the token is glab's for that
+host, or `GITLAB_TOKEN` when the host is `GITLAB_HOST` (`gitlab.com` unless
+set) — vdx never sends a token to a host it does not belong to. Not met comes with the reason; another hosting, no network or no token
+where one is needed leave the axis unknown, with the reason too;
+`VDX_OFFLINE=1` does not ask at all.
 
 ## Dev
 
@@ -172,8 +177,8 @@ npm run typecheck
 ## Not implemented yet
 
 - Above L1 the `ci` axis reads GitHub Actions only; other CI systems answer
-  "unknown". `branch-protection` is "unknown" everywhere until a hosting
-  extension exists.
+  "unknown". `branch-protection` reads GitHub and GitLab; other hostings
+  (gitolite, Bitbucket) answer "unknown".
 - Baseline loading from a git ref is documented but evaluator still reads file
   paths only — `baseline:` in `mise.toml` is recorded but does not auto-fetch.
 - Watermark drift (phase 2 of `drift-algorithm.md`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vodmal/vdx-cli",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "vdx — unified lifecycle interface (up/down/build/test/check/fix) + versioned maturity audit with drift detection. Pairs with the vdx Claude Code plugin.",
   "keywords": [
     "vdx",

package/src/gate.ts

@@ -119,11 +119,16 @@ export function pushThroughGate(t: GateTarget, d: GateDeps): void {
   const names = t.checks.join(', ');
   const link = `https://github.com/${t.repo}/commit/${sha}/checks`;
   const again = `once they pass: vdx push (${link})`;
-  const ask = () => {
+  // No answer at all — a timeout, the network — is not a refusal: the wait asks again
+  // (0.32.0's release push stopped on one ETIMEDOUT at a load of ~7, 2026-10-20).
+  let silent: string | null = null;
+  const ask = (): CheckState[] | Unknown | null => {
     try {
+      silent = null;
       return commitChecks(d.io, t.repo, sha, t.checks, t.token);
     } catch (e) {
-      return { unknown: `GitHub did not answer: ${errorMessage(e)}` };
+      silent = `GitHub did not answer: ${errorMessage(e)}`;
+      return null;
     }
   };
   const toBranch = () => {
@@ -137,7 +142,7 @@ export function pushThroughGate(t: GateTarget, d: GateDeps): void {
   // A commit not pushed yet is not asked about — GitHub would only answer 422.
   if (d.io.git(['rev-parse', '--verify', '--quiet', `refs/remotes/${t.remote}/${gate}`]) === sha) {
     const before = ask();
-    if (!isUnknown(before) && passed(before)) {
+    if (before !== null && !isUnknown(before) && passed(before)) {
       d.log(`✓ ${short} has passed ${names}`);
       toBranch();
       return;
@@ -165,6 +170,15 @@ export function pushThroughGate(t: GateTarget, d: GateDeps): void {
     }
     const states = ask();
     d.progress?.('');
+    if (states === null) {
+      if (d.now() - started >= d.timeoutMs) {
+        throw new Error(
+          `${silent} after ${Math.round(d.timeoutMs / 60_000)} min — ${t.branch} did not take ${short}; ${again}`,
+        );
+      }
+      d.log(`  … ${seconds()} s — ${silent}; asking again`);
+      continue;
+    }
     if (isUnknown(states)) throw new Error(`${states.unknown} — ${t.branch} did not take ${short}; ${again}`);
     const failed = states.filter((s) => s.state === 'failed');
     if (failed.length > 0) {

package/src/hosting.ts

@@ -4,7 +4,7 @@ import type { Ctx } from './facts.ts';
 import { at, errorMessage, list, str } from './narrow.ts';
 import type { Unknown, Verdict } from './predicates.ts';
 
-/** One answer of the GitHub API: its status and its body, parsed (null when not JSON). */
+/** One answer of a hosting's API: its status and its body, parsed (null when not JSON). */
 export interface Answer {
   status: number;
   body: unknown;
@@ -17,7 +17,9 @@ export interface HostingIo {
   git: (args: string[]) => string | null;
   /** The token `gh` keeps; null without gh or a login. */
   ghToken: () => string | null;
-  /** GET of an api.github.com path. Throws when no answer came at all. */
+  /** The token `glab` keeps for a GitLab host; null without glab or a login there. */
+  glabToken: (host: string) => string | null;
+  /** GET of an api.github.com path, or of a whole https:// URL. Throws when no answer came at all. */
   get: (apiPath: string, token: string | null) => Answer;
 }
 
@@ -26,9 +28,9 @@ export interface HostingIo {
 // environment, not its arguments — those are visible in ps.
 const GET = `
 const headers = { accept: 'application/vnd.github+json', 'x-github-api-version': '2022-11-28', 'user-agent': 'vdx' };
-if (process.env.VDX_GITHUB_TOKEN) headers.authorization = 'Bearer ' + process.env.VDX_GITHUB_TOKEN;
+if (process.env.VDX_HOSTING_TOKEN) headers.authorization = 'Bearer ' + process.env.VDX_HOSTING_TOKEN;
 try {
-  const r = await fetch(process.argv[1], { headers, signal: AbortSignal.timeout(8000) });
+  const r = await fetch(process.argv[1], { headers, signal: AbortSignal.timeout(15000) });
   process.stdout.write(JSON.stringify({ status: r.status, text: await r.text() }));
 } catch (e) {
   process.stdout.write(JSON.stringify({ error: String(e?.cause?.code ?? e?.cause?.message ?? e?.message ?? e) }));
@@ -37,13 +39,15 @@ try {
 
 function get(apiPath: string, token: string | null): Answer {
   const env = { ...process.env };
-  delete env.VDX_GITHUB_TOKEN;
-  if (token) env.VDX_GITHUB_TOKEN = token;
+  delete env.VDX_HOSTING_TOKEN;
+  if (token) env.VDX_HOSTING_TOKEN = token;
+  const url = apiPath.startsWith('https://') ? apiPath : `https://api.github.com${apiPath}`;
   const out: unknown = JSON.parse(
-    execFileSync(process.execPath, ['--input-type=module', '-e', GET, `https://api.github.com${apiPath}`], {
+    execFileSync(process.execPath, ['--input-type=module', '-e', GET, url], {
       encoding: 'utf8',
       env,
-      timeout: 10_000,
+      // node's own start counts too: at a load of ~7 on lft 10 s ran out (2026-10-20).
+      timeout: 20_000,
       stdio: ['ignore', 'pipe', 'ignore'],
     }),
   );
@@ -75,6 +79,7 @@ export function machineIo(root: string): HostingIo {
     env: process.env,
     git: (args) => run('git', ['--no-optional-locks', '-C', root, ...args]),
     ghToken: () => run('gh', ['auth', 'token']),
+    glabToken: (host) => run('glab', ['config', 'get', 'token', '--host', host]),
     get,
   };
 }
@@ -159,7 +164,7 @@ function judge(io: HostingIo, repo: string, token: string | null): Verdict {
 
 /**
  * Whether the default branch on the hosting of `origin` takes changes only after a check
- * required of everyone. GitHub only; what vdx cannot ask is unknown, with the reason.
+ * required of everyone. GitHub and GitLab; what vdx cannot ask is unknown, with the reason.
  */
 export function branchRequiresChecks(ctx: Ctx, io: HostingIo = machineIo(ctx.projectRoot)): Verdict {
   const key = 'hosting:branch-requires-checks';
@@ -171,12 +176,90 @@ export function branchRequiresChecks(ctx: Ctx, io: HostingIo = machineIo(ctx.pro
 
 function ask(io: HostingIo): Verdict {
   const gh = githubRepo(io, 'origin');
-  if (isUnknownRepo(gh)) return gh;
-  try {
-    return judge(io, gh.repo, gh.token);
-  } catch (e) {
-    return { unknown: `GitHub did not answer: ${errorMessage(e)}` };
+  if (!isUnknownRepo(gh)) {
+    try {
+      return judge(io, gh.repo, gh.token);
+    } catch (e) {
+      return { unknown: `GitHub did not answer: ${errorMessage(e)}` };
+    }
+  }
+  if (io.env.VDX_OFFLINE) return gh;
+  const url = io.git(['remote', 'get-url', 'origin']);
+  if (!url) return gh;
+  const { host, path: repo } = remoteParts(url);
+  // GitLab: the host GITLAB_HOST names, one glab has a token for (gitlab.finam.ru, DL #12),
+  // or one with gitlab in its name. A token goes only where it belongs: GITLAB_TOKEN to
+  // GITLAB_HOST, as glab sends it; glab's to its own host. Any other host is asked without
+  // one — an origin is the repository's to name, and may point anywhere.
+  const tokenHost = (io.env.GITLAB_HOST || 'gitlab.com')
+    .replace(/^https?:\/\//, '')
+    .replace(/\/.*$/, '')
+    .toLowerCase();
+  const glab = io.glabToken(host);
+  const token = (host.toLowerCase() === tokenHost ? io.env.GITLAB_TOKEN : undefined) || glab;
+  if (host.toLowerCase() === tokenHost || glab || host.includes('gitlab')) {
+    try {
+      return judgeGitlab(io, host, repo, token);
+    } catch (e) {
+      return { unknown: `${host} did not answer: ${errorMessage(e)}` };
+    }
+  }
+  return { unknown: `origin is on ${host || 'a host vdx cannot tell'} — vdx reads GitHub and GitLab` };
+}
+
+/** A refusal of a GitLab API as the reason the answer is unknown; null for a 200. */
+function gitlabRefusal(a: Answer, host: string, repo: string, token: string | null): Unknown | null {
+  if (a.status === 200) return null;
+  const message = str(at(a.body, 'message')) ?? str(at(a.body, 'error')) ?? '';
+  if (a.status === 429) return { unknown: `${host}'s rate limit is spent` };
+  if ((a.status === 401 || a.status === 404) && !token) {
+    return {
+      unknown: `${host} does not show ${repo} without a token — private? glab auth login --hostname ${host}, or GITLAB_TOKEN`,
+    };
+  }
+  return { unknown: `${host} answered ${a.status} for ${repo}${message ? `: ${message}` : ''}` };
+}
+
+/**
+ * GitLab: the default branch takes changes only after a pipeline when nobody may push to
+ * it directly — a push skips the pipeline — and a merge request needs one that passed
+ * (`only_allow_merge_if_pipeline_succeeds`). The agent pushes as the owner (DL #3).
+ */
+function judgeGitlab(io: HostingIo, host: string, repo: string, token: string | null): Verdict {
+  const base = `https://${host}/api/v4/projects/${encodeURIComponent(repo)}`;
+  const p = io.get(base, token);
+  const refused = gitlabRefusal(p, host, repo, token);
+  if (refused) return refused;
+  const branch =
+    io.git(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'])?.replace(/^origin\//, '') ||
+    str(at(p.body, 'default_branch'));
+  if (!branch) return { unknown: `${host} names no default branch for ${repo}` };
+  const pipeline = at(p.body, 'only_allow_merge_if_pipeline_succeeds') === true;
+
+  const pb = io.get(`${base}/protected_branches/${encodeURIComponent(branch)}`, token);
+  const isProtected = pb.status === 200;
+  if (!isProtected && pb.status !== 404) {
+    const refusedBranch = gitlabRefusal(pb, host, repo, token);
+    if (refusedBranch) return refusedBranch;
   }
+  // Who may push straight to the branch: a role above "No one" (0), a user, a group, a deploy key.
+  const pushers = list(at(pb.body, 'push_access_levels'))
+    .filter(
+      (l) =>
+        at(l, 'access_level') !== 0 ||
+        at(l, 'user_id') != null ||
+        at(l, 'group_id') != null ||
+        at(l, 'deploy_key_id') != null,
+    )
+    .map((l) => str(at(l, 'access_level_description')) ?? 'someone');
+  if (isProtected && pushers.length === 0 && pipeline) return true;
+
+  const why: string[] = [];
+  if (!isProtected) why.push(`${branch} is not protected`);
+  else if (pushers.length > 0)
+    why.push(`${branch} takes direct pushes from ${pushers.join(', ')} — a push skips the pipeline`);
+  if (!pipeline) why.push(`merge requests into ${branch} do not need a passing pipeline`);
+  return { no: why.join('; ') };
 }
 
 /** A remote's repository on GitHub and the token to ask with; unknown, with the reason, when vdx cannot ask. */

package/src/index.ts

@@ -127,9 +127,12 @@ const COMMANDS: Record<string, CommandSpec> = {
     usage: 'vdx audit [project_path] [--rubric <path>] [--stack <stack>] [--format=ansi|markdown|json] [--json]',
     help: `Scores the project (default: cwd) against the rubric and prints the report.
 Reads only. The rubric is the bundled one unless --rubric or $VDX_RUBRIC names another.
-For branch-protection it asks GitHub whether the default branch of origin requires
-a check, with a token from $GH_TOKEN, $GITHUB_TOKEN or gh when there is one;
-VDX_OFFLINE=1 does not ask, and the axis says unknown.
+For branch-protection it asks the hosting of origin whether its default branch
+takes changes only after a check required of everyone: GitHub, with a token from
+$GH_TOKEN, $GITHUB_TOKEN or gh when there is one; GitLab, with glab's token for that host,
+or $GITLAB_TOKEN when the host is $GITLAB_HOST (gitlab.com unless set) — no
+other host gets it. Another hosting is unknown; VDX_OFFLINE=1 does not ask, and the axis says
+unknown.
 `,
     bools: ['json'],
     values: ['rubric', 'stack', 'format'],