[engalar]

Closes #1669.

Why

A commit made with plain git (agent, CI, or anyone outside Studio Pro) leaves the repository missing what Studio Pro writes when it commits: the mx_metadata note (history shows (unknown), the version check fails), the local git config (core.autocrlf=False keeps a checkout from rewriting line endings inside .mxunit files; mendix.commits-since-gc / mendix.lineEndingResetDone are its bookkeeping), an HTTPS-only remote — and git itself cannot merge Mendix models (the .mpr is SQLite, .mxunit files are BSON, so every two-sided model change is a binary conflict). A field repair script for exactly this state circulates internally. mxcli git note (#1337) already computes better notes than that script's template, but nothing audits a repository, commits the way Studio Pro does, or merges.

What

mxcli git commit -m <msg> -p app.mpr [--push] [--dry-run] — Studio Pro's commit for commits made outside it: repairs ContentsHash mismatches from the files (MISSING/ORPHAN refuse), stages everything and unstages what Studio Pro never commits (project-settings.user.json, *.mpr.lock, *.mpr.bak, .mendix-cache/, deployment/, theme-cache/, .mxcli/; NUL-split --name-only -z, spaces safe), commits, computes and attaches the note, prints (or with --push runs) the branch+notes push. Refused while .mpr.lock exists (honouring MXCLI_ALLOW_STUDIO_PRO_OPEN=1) and during unresolved merges; --dry-run writes nothing.

mxcli git merge <ref> [--plan <file>] [--ours|--theirs] [-m] [--push] — model-aware merging on the command line, on top of mx git-merge (Studio Pro's own merge engine, resolved for the project's Mendix version):

• git merge runs first; a merge git resolves itself is annotated like git commit does;
• a model conflict goes to mx git-merge with base/ours/theirs checked out into temporary worktrees — what it auto-resolves is committed as the two-parent merge commit with the note (measured: AutoResolved, both sides kept);
• a ManualResolutionRequired conflict is a review step, never a silent choice: the merge aborts, both sides' changes are printed at property level (via mx diff: New type > Length: 200 → 180 / → 250), and a plan template (<mpr>.merge-plan.json) is written. The human then re-runs with --plan to resolve per unit ("take": "ours"|"theirs" per conflicted unit; the .mpr index is repaired from the mixed files), --ours/--theirs wholesale, or in Studio Pro (Version Control › Merge Changes Here) — which stays the tool for within-unit mixed resolutions. Added/deleted/moved conflicts are refused to Studio Pro by plan validation. Non-model conflicts are left like plain git.

mxcli git doctor [-p app.mpr] [--fix] — one read-only audit, exit 1 while an issue remains: the local config Studio Pro writes (core.autocrlf judged — true/input is repaired; the mendix.* counters only backfilled when missing, their values are Studio Pro's own — measured on a real checkout), the remote URL scheme (SSH git@host:…/ssh://… rewritten to HTTPS by --fix; other non-HTTPS reported), the remote's notes ref, and every commit's mx_metadata note on the checked-out branch — missing or malformed notes are reported; --fix computes real notes from the model (-p), falling back to a template note (--version, else the newest valid note in history) where the model at a commit cannot be read. Notes Studio Pro wrote are never touched. --fix does not push.

Tests

TDD against real git repositories and real SQLite .mpr fixtures throughout (cmd/mxcli/gitdoctor_test.go, gitmerge_test.go): 30+ tests — commit end-to-end (note content, junk exclusion incl. spaced paths, hash-drift repair, lock refusal + override, unresolved-merge refusal, dry run writing nothing, --push against a bare remote); doctor config/SSH/notes audit and repair (Studio Pro's own lowercase values pass; misspelled -p refused; --version validated); merge clean/model-auto/manual-report/plan-mix/stale-plan/non-model/side-taking (notes asserted, worktrees verified removed). go build ./..., go vet (both tag sets), gofmt clean. Windows-only pre-existing failures (file-mode 0600 asserts, TempDir SQLite-handle cleanup) fail on main too; Linux CI should not see them.

Measured end-to-end in a dedicated lab repository (Studio Pro 11.12.6, real Team Server-shaped history): mxcli git commit's note for the same model change is byte-identical to Studio Pro's own; Studio Pro opens every resulting revision cleanly.

Docs

CHANGELOG (three Added entries), docs-site "Working Outside Studio Pro" (three new sections: One commit, all the steps, Merging branches, Auditing a repository), and the teamserver-git skill updated (commit section leads with mxcli git commit; the model-merge rule now names mxcli git merge and the review flow; index regenerated).