Fix mx check tests and reconcile security on disconnect

Three issues fixed:

1. Test MDL syntax errors: missing colons in ADD ATTRIBUTE (5x),
   wrong CREATE ASSOCIATION syntax using (A -> B) instead of
   FROM A TO B (2x).

2. Tests used Execute() per statement instead of ExecuteProgram(),
   so ReconcileMemberAccesses never ran. Now combines steps into a
   single program.

3. REPL and disconnect didn't run finalization. The REPL now uses
   ExecuteProgram(), and execDisconnect() calls
   finalizeProgramExecution() before closing — ensuring security
   reconciliation happens regardless of execution mode.

Also: findMxBinary() searches repo-local, ~/.mxcli/mxbuild/*, and
PATH instead of hardcoding a single path. createTestProject() falls
back to mx create-project when test source project is missing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ako

mdl/executor/executor.go

@@ -551,6 +551,11 @@ func (e *Executor) execDisconnect() error {
 		return nil
 	}
 
+	// Reconcile any pending security changes before closing
+	if err := e.finalizeProgramExecution(); err != nil {
+		fmt.Fprintf(e.output, "Warning: finalization error: %v\n", err)
+	}
+
 	e.writer.Close()
 	fmt.Fprintf(e.output, "Disconnected from: %s\n", e.mprPath)
 	e.writer = nil

mdl/executor/roundtrip_helpers_test.go

@@ -13,6 +13,7 @@ import (
 	"bytes"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -40,6 +41,8 @@ type testEnv struct {
 }
 
 // copyTestProject copies the source project to a temp directory and returns the MPR path.
+// If the source project doesn't exist, it falls back to creating a fresh project
+// using `mx create-project` (requires the mx binary to be available).
 // The temp directory is automatically cleaned up when the test finishes.
 func copyTestProject(t *testing.T) string {
 	t.Helper()
@@ -48,8 +51,10 @@ func copyTestProject(t *testing.T) string {
 	if err != nil {
 		t.Fatalf("Failed to resolve source project path: %v", err)
 	}
+
 	if _, err := os.Stat(srcDir); os.IsNotExist(err) {
-		t.Skipf("Source project not found: %s", srcDir)
+		// Source project not found — try mx create-project as fallback
+		return createTestProject(t)
 	}
 
 	// Create temp directory (auto-cleaned by t.TempDir())
@@ -75,6 +80,33 @@ func copyTestProject(t *testing.T) string {
 	return destMPR
 }
 
+// createTestProject creates a fresh Mendix project using `mx create-project`.
+// Returns the path to the App.mpr file in a temp directory.
+func createTestProject(t *testing.T) string {
+	t.Helper()
+
+	mxPath := findMxBinary()
+	if mxPath == "" {
+		t.Skip("mx binary not available and source project not found")
+	}
+
+	destDir := t.TempDir()
+
+	cmd := exec.Command(mxPath, "create-project")
+	cmd.Dir = destDir
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Skipf("mx create-project failed: %v\n%s", err, output)
+	}
+
+	mprPath := filepath.Join(destDir, "App.mpr")
+	if _, err := os.Stat(mprPath); os.IsNotExist(err) {
+		t.Skipf("mx create-project did not produce App.mpr in %s", destDir)
+	}
+
+	return mprPath
+}
+
 // copyFile copies a single file from src to dst.
 func copyFile(src, dst string) error {
 	in, err := os.Open(src)

mdl/executor/roundtrip_mxcheck_test.go

@@ -3,38 +3,60 @@
 package executor
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
 )
 
 // --- MX Check Integration Tests ---
 // These tests verify that created documents pass Mendix's validation.
 
-// mxCheckPath is the path to the mx check command.
-const mxCheckPath = "../../reference/mxbuild/modeler/mx"
+// findMxBinary searches for the mx command in known locations.
+// Search order: reference/mxbuild/modeler/mx (repo-local), ~/.mxcli/mxbuild/*/modeler/mx
+// (cached downloads), PATH lookup.
+func findMxBinary() string {
+	// 1. Repo-local reference path
+	repoPath, err := filepath.Abs("../../reference/mxbuild/modeler/mx")
+	if err == nil {
+		if _, err := os.Stat(repoPath); err == nil {
+			return repoPath
+		}
+	}
+
+	// 2. Cached downloads (~/.mxcli/mxbuild/*/modeler/mx)
+	if home, err := os.UserHomeDir(); err == nil {
+		pattern := filepath.Join(home, ".mxcli", "mxbuild", "*", "modeler", "mx")
+		if matches, _ := filepath.Glob(pattern); len(matches) > 0 {
+			return matches[len(matches)-1]
+		}
+	}
+
+	// 3. PATH lookup
+	if p, err := exec.LookPath("mx"); err == nil {
+		return p
+	}
+
+	return ""
+}
 
 // mxCheckAvailable checks if the mx command is available.
 func mxCheckAvailable() bool {
-	absPath, err := filepath.Abs(mxCheckPath)
-	if err != nil {
-		return false
-	}
-	_, err = os.Stat(absPath)
-	return err == nil
+	return findMxBinary() != ""
 }
 
 // runMxCheck runs mx check on the given project and returns any errors.
 func runMxCheck(t *testing.T, projectPath string) (string, error) {
 	t.Helper()
 
-	mxPath, err := filepath.Abs(mxCheckPath)
-	if err != nil {
-		return "", err
+	mxPath := findMxBinary()
+	if mxPath == "" {
+		return "", fmt.Errorf("mx binary not found")
 	}
 
 	cmd := exec.Command(mxPath, "check", projectPath)
@@ -340,8 +362,8 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 				`CREATE MODULE ROLE ` + mod + `.S2Admin;`,
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S2Entity (Name: String(100));`,
 				`GRANT ` + mod + `.S2Admin ON ` + mod + `.S2Entity (CREATE, DELETE, READ *, WRITE *);`,
-				`ALTER ENTITY ` + mod + `.S2Entity ADD ATTRIBUTE Email String(200);`,
-				`ALTER ENTITY ` + mod + `.S2Entity ADD ATTRIBUTE Active Boolean DEFAULT false;`,
+				`ALTER ENTITY ` + mod + `.S2Entity ADD ATTRIBUTE Email: String(200);`,
+				`ALTER ENTITY ` + mod + `.S2Entity ADD ATTRIBUTE Active: Boolean DEFAULT false;`,
 			},
 		},
 		{
@@ -351,7 +373,7 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S3Parent (Name: String(100));`,
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S3Child (Label: String(100));`,
 				`GRANT ` + mod + `.S3Admin ON ` + mod + `.S3Parent (CREATE, DELETE, READ *, WRITE *);`,
-				`CREATE ASSOCIATION ` + mod + `.S3Child_S3Parent (` + mod + `.S3Child -> ` + mod + `.S3Parent);`,
+				`CREATE ASSOCIATION ` + mod + `.S3Child_S3Parent FROM ` + mod + `.S3Child TO ` + mod + `.S3Parent;`,
 			},
 		},
 		{
@@ -368,7 +390,7 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 			steps: []string{
 				`CREATE MODULE ROLE ` + mod + `.S5Admin;`,
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S5Entity (Name: String(100));`,
-				`ALTER ENTITY ` + mod + `.S5Entity ADD ATTRIBUTE Email String(200);`,
+				`ALTER ENTITY ` + mod + `.S5Entity ADD ATTRIBUTE Email: String(200);`,
 				`GRANT ` + mod + `.S5Admin ON ` + mod + `.S5Entity (CREATE, DELETE, READ *, WRITE *);`,
 			},
 		},
@@ -378,7 +400,7 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 				`CREATE MODULE ROLE ` + mod + `.S6Admin;`,
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S6Entity (Name: String(100));`,
 				`GRANT ` + mod + `.S6Admin ON ` + mod + `.S6Entity (READ *);`,
-				`ALTER ENTITY ` + mod + `.S6Entity ADD ATTRIBUTE Code String(50);`,
+				`ALTER ENTITY ` + mod + `.S6Entity ADD ATTRIBUTE Code: String(50);`,
 				`GRANT ` + mod + `.S6Admin ON ` + mod + `.S6Entity (CREATE, DELETE, READ *, WRITE *);`,
 			},
 		},
@@ -402,7 +424,7 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S8Entity (Name: String(100));`,
 				`GRANT ` + mod + `.S8Admin ON ` + mod + `.S8Entity (CREATE, DELETE, READ *, WRITE *);`,
 				`GRANT ` + mod + `.S8Viewer ON ` + mod + `.S8Entity (READ *);`,
-				`ALTER ENTITY ` + mod + `.S8Entity ADD ATTRIBUTE Status String(50);`,
+				`ALTER ENTITY ` + mod + `.S8Entity ADD ATTRIBUTE Status: String(50);`,
 			},
 		},
 		{
@@ -412,8 +434,8 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S9Main (Name: String(100));`,
 				`CREATE OR MODIFY PERSISTENT ENTITY ` + mod + `.S9Related (Value: Integer);`,
 				`GRANT ` + mod + `.S9Admin ON ` + mod + `.S9Main (CREATE, DELETE, READ *, WRITE *);`,
-				`ALTER ENTITY ` + mod + `.S9Main ADD ATTRIBUTE Extra String(200);`,
-				`CREATE ASSOCIATION ` + mod + `.S9Related_S9Main (` + mod + `.S9Related -> ` + mod + `.S9Main);`,
+				`ALTER ENTITY ` + mod + `.S9Main ADD ATTRIBUTE Extra: String(200);`,
+				`CREATE ASSOCIATION ` + mod + `.S9Related_S9Main FROM ` + mod + `.S9Related TO ` + mod + `.S9Main;`,
 			},
 		},
 	}
@@ -423,11 +445,16 @@ func TestMxCheck_CE0066_Scenarios(t *testing.T) {
 			env := setupTestEnv(t)
 			defer env.teardown()
 
-			for i, step := range sc.steps {
-				if err := env.executeMDL(step); err != nil {
-					if !strings.Contains(err.Error(), "already exists") {
-						t.Fatalf("Step %d failed: %v\nMDL: %s", i+1, err, step)
-					}
+			// Combine all steps into a single script so ExecuteProgram
+			// runs finalizeProgramExecution (ReconcileMemberAccesses).
+			allMDL := strings.Join(sc.steps, "\n")
+			prog, errs := visitor.Build(allMDL)
+			if len(errs) > 0 {
+				t.Fatalf("Parse failed: %v\nMDL:\n%s", errs[0], allMDL)
+			}
+			if err := env.executor.ExecuteProgram(prog); err != nil {
+				if !strings.Contains(err.Error(), "already exists") {
+					t.Fatalf("ExecuteProgram failed: %v\nMDL:\n%s", err, allMDL)
 				}
 			}
 

mdl/repl/repl.go

@@ -220,11 +220,9 @@ func (r *REPL) execute(input string) error {
 		return nil // Don't return error, just print and continue
 	}
 
-	// Execute all statements
-	for _, stmt := range prog.Statements {
-		if err := r.executor.Execute(stmt); err != nil {
-			return err
-		}
+	// Execute all statements and run finalization (e.g. ReconcileMemberAccesses)
+	if err := r.executor.ExecuteProgram(prog); err != nil {
+		return err
 	}
 
 	return nil