[ako]

Syncs ako/mxcli:main into mendixlabs/mxcli:main: 25 commits since v0.26.0, landed in the fork through PRs ako#1115–ako#1126.

Domain model diagrams

• describe --format svg domainmodel <Module> writes a finished SVG: entities at their stored positions, coloured by kind, with attributes, associations with their multiplicities, and generalizations. No layout engine runs, so a client without a browser can show it as is. Boxes are sized for a proportional font, and the stored layout is pulled apart just enough to fit full names (capped at 2.5×) instead of clipping them. domainmodel is also available as --format elk.
• Companion: on surfaces that draw SVG, selecting a Domain Model node shows the diagram with hover tooltips, at actual size with pan, fit and a full-width view.

Lint: data the user cannot read

• SEC010 flags page data widgets (list views, data grids, reference selectors, pluggable grids, galleries and combo boxes) whose roles cannot read the entity. "Renders empty for them" is a warning, and XPath-only rules are info. A specialization's rule counts only for the members it grants. That case is a combo box over System.User, which rendered blank names for non-admins while check, mxbuild and the runtime log were clean.
• System module access rules are measured from the model.mdp mxbuild writes (Mendix 11.15.0, Production security), since they are not in the .mpr.

Check

• Flow verdicts are predicted for calls to flows the script itself creates. A change exec would refuse (MDL-V1-REBUILD) checked clean before, and exec wrote the earlier statements before refusing it.
• A module-qualified association hop in an attribute path (Module.Assoc/Attr) parses, instead of falling through to a division.

Pages

• DataGrid 2: an unnamed, uncaptioned column writes an empty header template, and an unbound attribute column writes an empty tooltip template, matching mx update-widgets (CE0463 before).

Testing

• mxcli test --local takes --app-port / --admin-port / --serve-port, probes each before touching the project, and names the holding process when a port is taken.
• A test whose call threw reports the raised message in its FAIL verdict. The test-microflows skill states that tests run with no current user.

Robustness: init, bootstrap, mxbuild

• One-shot mxbuild runs (mxcli new, docker build) have a timeout and a stall watchdog (default 30 m / 10 m stall, configurable) that kills the whole process tree and reports the last output.
• On macOS the project's JDK major is resolved through java_home, and /usr is never accepted as a Java home. Before, an 11.14+ project got the launcher stub and Gradle spun indefinitely during mxcli new.
• mxcli init titles the generated docs after the .mpr, not the folder. The bootstrap script pins MXCLI_TAG to the generating release, and a failed database provisioning is reported loudly instead of passing silently.

Syntax reference

• mxcli syntax no longer teaches spellings check flags as deprecated. A test holds every Example and Syntax block to the deprecation registry at error level.
• New topic: microflow.workflow-actions.
• Skill fixes: the create-page section index is regenerated, and bootstrap-app drops its dated Mendix version claim

[github-actions]

AI Code Review

Review Summary

This PR synchronizes 25 commits from ako/mxcli:main to mendixlabs/mxcli:main, introducing several new features and fixes:

• Domain model SVG visualization (describe --format svg domainmodel)
• SEC010 lint rule for unreadable data in widgets
• mxbuild watchdog for one-shot builds
• Test port improvements (mxcli test --local)
• Bootstrap/init fixes (Java resolution, DB provisioning, script defaults)
• Flow verdict enhancements
• Syntax deprecation testing
• Page widget fixes (DataGrid 2)

Critical Issues

None found.

Moderate Issues

None found.

Minor Issues

1. Inconsistent error handling in cmd_domainmodel_svg.go:

   • The renderDomainModelSVG function returns an empty SVG string for modules with no entities, but doesn't handle potential errors from textPx calculations (though none exist currently). This is low-risk as the function is pure.

2. Magic numbers in SVG generation:

   • Constants like svgMaxSpread = 2.5 and svgMaxNameLen = 60 lack explanation in comments. While reasonable, adding brief rationale would improve maintainability.

3. Test complexity in validate_flow_verdicts_script_flows_pedapp_test.go:

   • The test creates a complex script with multiple flows to verify verdict predictions. While thorough, it could benefit from clearer comments explaining the test scenario.

What Looks Good

• Full-stack consistency: The domain model SVG feature properly uses existing domain model AST/types without requiring new grammar/AST nodes (as it's a CLI command, not MDL syntax).
• Thorough test coverage: All major additions have corresponding tests (SVG generation, SEC010 rule, mxbuild watchdog, test ports, flow verdicts).
• Security focus: SEC010 rule correctly handles System module access rules via meta.SystemReadAccess and implements proper specialization inheritance logic.
• Robustness improvements: mxbuild watchdog addresses historical hanging issues with proper timeout/stall detection and process tree killing.
• Documentation: Bug findings are properly recorded in .claude/skills/fix-issue/findings/ following project conventions.
• Deprecation handling: New syntax deprecation test ensures mxcli syntax output doesn't teach deprecated spellings.
• Atomic commits: Individual commits in the sync appear focused (e.g., separate commits for SVG logic, tests, CLI wiring).

Recommendation

Approve. The PR introduces valuable features with proper testing and follows project conventions. The minor issues noted are trivial and don't block merging. The synchronization approach is acceptable given the fork's maintenance workflow.

Note: The VS Code extension companion feature mentioned in the PR body (hover tooltips for SVG) appears to be in the vscode-mdl/ directory, which wasn't shown in the diff (likely excluded as noise per instructions). This is expected as the PR focuses on CLI/backend changes.

---

Automated review via OpenRouter (Nemotron Super 120B) — workflow source