[ako]

Closes #1512 (mirror of mendixlabs#1602). Closes #1562 (mirror of mendixlabs#1630).

diff-local counted a unit as modified and printed nothing for it. One commit per issue; the #1512 commit also carries the class-level fix.

#1512 — a project-settings change prints nothing

Cause: bsonToMDL (cmd_diff_local.go) had no case for Settings$ProjectSettings, so the unit rendered as two comment lines that read the same at every revision. Unified printed nothing, side printed an identical table, struct printed "(no changes)".

Fix:

• The settings unit renders with describe settings' own writer (writeProjectSettingsMDL, split out of describeSettings). The old revision is parsed by a new backend method, ParseProjectSettingsFromRaw; mock stub returns "not configured", MCP returns unsupported.
• Configuration constant values are masked, as the issue asks, because they often hold secrets. Each side is rendered knowing the other's value, so a change still shows as a -/+ pair (<masked: old value> / <masked: new value>); an unchanged value is <masked>. The mask is not a string literal, so pasted output fails to parse instead of storing the text.
• Class fix: git has already said the bytes differ, so a modified unit whose two renderings are equal now prints one line, in every format, naming the changed property paths (never values), e.g. Modified: ModuleSecurity M: changed in properties the MDL rendering does not show: ModuleRoles (0 -> 1 items). diff-local now prints through WriteDiffResults, the writer mxcli diff already used, and the path walker moved from mdl/scriptdiff to executor.ChangedPaths so both commands share it. The walker no longer counts Mendix's leading list marker as an item.

#1562 — a grant on an entity prints nothing

Cause: domainModelBsonToMDL rendered attributes and associations but never AccessRules.
Fix: each entity is followed by its rules, written by outputEntityAccessGrants, the writer describe entity uses, from a parse of that revision (new backend method ParseDomainModelFromRaw). If the parse fails, a comment line says the rules are not shown.

Verified

• Tests drive diff-local through the real modelsdk backend on a copy of the v2 fixture (cmd_diff_local_unrendered_test.go, cmd_diff_local_access_rules_test.go), plus raw-parse vs stored-read tests for both new backend methods. Controls: a re-run that writes nothing reports "No local changes found"; an attribute change renders byte for byte as before.
• Revert proofs: without the settings case and the note the output is exactly the reported Summary: 0 new, 1 modified, 0 deleted; without the mask the value 'secret123' is printed; without the grant rendering the grant shows only as the note.
• Real 11.13 app in git: before, Summary: 0 new, 2 modified, 0 deleted and nothing else; after, the masked constant pair, the BcryptCost hunk and -grant read * … / +grant read *, write * …. Range mode (--ref HEAD~1..HEAD) gives the same; mx check 0 errors.
• Probe of other unit types, all silent before and now printing the note: navigation menu item, app security, user role, module role, page grant, published REST grant, constant default, entity index.
• Full go test ./..., go vet, gofmt and CI's doc checks pass with all five of this batch's branches merged onto main. Bug-tests difflocal-1512-settings-silent-modified.mdl, difflocal-1562-entity-grant-silent-modified.mdl; findings recorded; diff-local command doc and docs-site updated.
• Not verified: the MCP backend path (the new methods return unsupported there, so the unit falls back to the note).

Noticed, not fixed

1. diff-local runs git diff in the process's working directory, not the project's repo, so it fails from outside the repo.
2. Struct and side formats align the two sides by line number (compareGeneric): one inserted line marks every following line as changed.
3. Project-level units (settings, navigation, project security) are named by their unit UUID in headers and notes.
4. A unit with both a rendered and an unrendered change shows only the rendered hunk.
5. Projects$ModuleSettings and Security$ModuleSecurity dispatch to moduleBsonToMDL (their type names contain "Module") and render as create module ;.
6. The durable fix is for diff-local to stop keeping its own renderers: check the old revision out into a scratch folder and describe both sides, as mxcli diff does.

🤖 Generated with Claude Code