datagrok-tools 6.5.1 → 6.5.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Datagrok-tools changelog
 
+## 6.5.2 (2026-07-27)
+
+* `grok publish` — a failed `docker push` is no longer reported as a successful one. `image.json` claimed the tag regardless, so the server recorded a container image that was never published and the spawner failed validation forever ("Image ... not found in any registry") with no recovery short of another publish. The push failure now falls back to an image that is actually in the registry, and says so.
+
 ## 6.5.1 (2026-07-22)
 
 * `grok test` — the Node-pass report now merges into the browser report by column name. The line-wise merge assumed identical column order, so node rows landed misaligned (string values in the integer `ms` column) and the CI test-report upload failed with `invalid input syntax for type integer`.

package/bin/__tests__/build.test.js

@@ -0,0 +1,116 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _build = require("../commands/build");
+(0, _vitest.describe)('getNestedValue', () => {
+  (0, _vitest.it)('returns value for a simple key', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      name: 'Chem'
+    }, 'name')).toBe('Chem');
+  });
+  (0, _vitest.it)('returns value for a nested path', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      a: {
+        b: {
+          c: 42
+        }
+      }
+    }, 'a.b.c')).toBe(42);
+  });
+  (0, _vitest.it)('returns undefined for a missing key', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      name: 'Chem'
+    }, 'version')).toBeUndefined();
+  });
+  (0, _vitest.it)('returns undefined when a mid-path segment is null', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      a: null
+    }, 'a.b')).toBeUndefined();
+  });
+  (0, _vitest.it)('returns undefined when a mid-path segment is missing', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      a: {}
+    }, 'a.b.c')).toBeUndefined();
+  });
+  (0, _vitest.it)('returns undefined for an empty path (splits to empty string key)', () => {
+    (0, _vitest.expect)((0, _build.getNestedValue)({
+      x: 1
+    }, '')).toBeUndefined();
+  });
+});
+const pkg = overrides => ({
+  dir: '/tmp/pkg',
+  name: overrides.name ?? 'test-pkg',
+  friendlyName: overrides.friendlyName ?? overrides.name ?? 'Test Pkg',
+  version: overrides.version ?? '1.0.0',
+  packageJson: overrides
+});
+(0, _vitest.describe)('applyFilter', () => {
+  const packages = [pkg({
+    name: 'Chem',
+    version: '1.5.0',
+    category: 'Cheminformatics'
+  }), pkg({
+    name: 'Bio',
+    version: '2.0.0',
+    category: 'Bioinformatics'
+  }), pkg({
+    name: 'PowerGrid',
+    version: '1.5.0',
+    category: 'Viewers'
+  })];
+  (0, _vitest.it)('returns all packages when filter matches all', () => {
+    (0, _vitest.expect)((0, _build.applyFilter)(packages, 'name:.')).toHaveLength(3);
+  });
+  (0, _vitest.it)('filters by exact name match', () => {
+    const result = (0, _build.applyFilter)(packages, 'name:^Chem$');
+    (0, _vitest.expect)(result).toHaveLength(1);
+    (0, _vitest.expect)(result[0].name).toBe('Chem');
+  });
+  (0, _vitest.it)('filters by partial name (regex substring)', () => {
+    const result = (0, _build.applyFilter)(packages, 'name:Bio');
+    (0, _vitest.expect)(result).toHaveLength(1);
+    (0, _vitest.expect)(result[0].name).toBe('Bio');
+  });
+  (0, _vitest.it)('returns empty array when nothing matches', () => {
+    (0, _vitest.expect)((0, _build.applyFilter)(packages, 'name:NOMATCH')).toHaveLength(0);
+  });
+  (0, _vitest.it)('filters by version', () => {
+    const result = (0, _build.applyFilter)(packages, 'version:^1\\.5');
+    (0, _vitest.expect)(result).toHaveLength(2);
+    (0, _vitest.expect)(result.map(p => p.name)).toEqual(_vitest.expect.arrayContaining(['Chem', 'PowerGrid']));
+  });
+  (0, _vitest.it)('applies && conjunction (both conditions must match)', () => {
+    const result = (0, _build.applyFilter)(packages, 'name:Chem && version:1\\.5');
+    (0, _vitest.expect)(result).toHaveLength(1);
+    (0, _vitest.expect)(result[0].name).toBe('Chem');
+  });
+  (0, _vitest.it)('returns empty when one part of && conjunction fails', () => {
+    (0, _vitest.expect)((0, _build.applyFilter)(packages, 'name:Chem && version:^2')).toHaveLength(0);
+  });
+  (0, _vitest.it)('filters by nested field', () => {
+    const withNested = [pkg({
+      name: 'A',
+      datagrok: {
+        apiVersion: '1.0'
+      }
+    }), pkg({
+      name: 'B',
+      datagrok: {
+        apiVersion: '2.0'
+      }
+    })];
+    const result = (0, _build.applyFilter)(withNested, 'datagrok.apiVersion:^1');
+    (0, _vitest.expect)(result).toHaveLength(1);
+    (0, _vitest.expect)(result[0].name).toBe('A');
+  });
+  (0, _vitest.it)('returns empty when field does not exist', () => {
+    (0, _vitest.expect)((0, _build.applyFilter)(packages, 'nonexistent:anything')).toHaveLength(0);
+  });
+  (0, _vitest.it)('treats filter with no colon as field name with match-all pattern', () => {
+    // No colon → field = whole string, pattern = /./  (matches any value)
+    // The function returns packages where the field exists and is non-empty
+    const result = (0, _build.applyFilter)(packages, 'name');
+    (0, _vitest.expect)(result).toHaveLength(3);
+  });
+});

package/bin/__tests__/jira-wiki-converter.test.js

@@ -0,0 +1,101 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _report = require("../commands/report");
+(0, _vitest.describe)('markdownToJiraWiki — basic rules', () => {
+  (0, _vitest.it)('converts H1', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('# Title')).toBe('h1. Title');
+  });
+  (0, _vitest.it)('converts H2 / H3 / H6', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('## Sub')).toBe('h2. Sub');
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('### Sub-sub')).toBe('h3. Sub-sub');
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('###### Deep')).toBe('h6. Deep');
+  });
+  (0, _vitest.it)('converts bold', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('hello **world** foo')).toBe('hello *world* foo');
+  });
+  (0, _vitest.it)('converts italic with single asterisks', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('hello *world* foo')).toBe('hello _world_ foo');
+  });
+  (0, _vitest.it)('converts strikethrough', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('~~gone~~')).toBe('-gone-');
+  });
+  (0, _vitest.it)('converts links', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('see [docs](https://x.example/y)')).toBe('see [docs|https://x.example/y]');
+  });
+  (0, _vitest.it)('converts blockquote', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('> quoted line')).toBe('bq. quoted line');
+  });
+  (0, _vitest.it)('converts unordered list', () => {
+    const md = '- one\n- two\n- three';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('* one\n* two\n* three');
+  });
+  (0, _vitest.it)('converts one level of nested unordered list', () => {
+    const md = '- top\n  - sub\n- back';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('* top\n** sub\n* back');
+  });
+  (0, _vitest.it)('converts ordered list', () => {
+    const md = '1. one\n2. two\n3. three';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('# one\n# two\n# three');
+  });
+  (0, _vitest.it)('converts inline code', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('use `foo()` here')).toBe('use {{foo()}} here');
+  });
+  (0, _vitest.it)('converts plain code fence to noformat', () => {
+    const md = '```\nraw code\nmore\n```';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('{noformat}\nraw code\nmore\n{noformat}');
+  });
+  (0, _vitest.it)('converts code fence with language tag to {code:lang}', () => {
+    const md = '```js\nconst x = 1;\n```';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('{code:js}\nconst x = 1;\n{code}');
+  });
+  (0, _vitest.it)('converts HTML entities   / & / < / >', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('a b')).toBe('a b');
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('a&b')).toBe('a&b');
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('a&lt;b&gt;c')).toBe('a<b>c');
+  });
+});
+(0, _vitest.describe)('markdownToJiraWiki — content-protection inside code fences', () => {
+  (0, _vitest.it)('does not transform `{{plates}}` inside a fenced block (run-#4 false-positive case)', () => {
+    const md = ['Before', '```', 'context: {{plates}} should stay literal', '# not a heading', '- not a list', '```', 'After'].join('\n');
+    const out = (0, _report.markdownToJiraWiki)(md);
+    (0, _vitest.expect)(out).toContain('{noformat}\ncontext: {{plates}} should stay literal');
+    (0, _vitest.expect)(out).toContain('# not a heading');
+    (0, _vitest.expect)(out).toContain('- not a list');
+    (0, _vitest.expect)(out).not.toContain('h1.');
+  });
+  (0, _vitest.it)('does not transform headings/links/lists inside an inline code span', () => {
+    const md = 'use `# not a heading` and `[ref](u)` here';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(md)).toBe('use {{# not a heading}} and {{[ref](u)}} here');
+  });
+});
+(0, _vitest.describe)('markdownToJiraWiki — edge cases', () => {
+  (0, _vitest.it)('handles bold containing italic: **bold *inside* bold**', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('**bold *inside* bold**')).toBe('*bold _inside_ bold*');
+  });
+  (0, _vitest.it)('preserves bold and italic on the same line', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('**a** and *b*')).toBe('*a* and _b_');
+  });
+  (0, _vitest.it)('handles a heading whose text contains backticks', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('## use `foo()` for x')).toBe('h2. use {{foo()}} for x');
+  });
+  (0, _vitest.it)('passes plain text through unchanged', () => {
+    const plain = 'Just a normal sentence with no markdown.';
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)(plain)).toBe(plain);
+  });
+  (0, _vitest.it)('returns empty string unchanged', () => {
+    (0, _vitest.expect)((0, _report.markdownToJiraWiki)('')).toBe('');
+  });
+  (0, _vitest.it)('handles a multi-block document end-to-end', () => {
+    const md = ['# Handoff', '', 'Some **bold** intro and a [link](https://x.example).', '', '## Findings', '', '- first', '- second', '', '> note: this matters', '', '```js', 'const x = 1;', '```', '', 'Done&nbsp;here.'].join('\n');
+    const out = (0, _report.markdownToJiraWiki)(md);
+    (0, _vitest.expect)(out).toContain('h1. Handoff');
+    (0, _vitest.expect)(out).toContain('h2. Findings');
+    (0, _vitest.expect)(out).toContain('Some *bold* intro and a [link|https://x.example].');
+    (0, _vitest.expect)(out).toContain('* first\n* second');
+    (0, _vitest.expect)(out).toContain('bq. note: this matters');
+    (0, _vitest.expect)(out).toContain('{code:js}\nconst x = 1;\n{code}');
+    (0, _vitest.expect)(out).toContain('Done here.');
+    (0, _vitest.expect)(out).not.toContain('&nbsp;');
+  });
+});

package/bin/__tests__/node-dapi.connections.test.js

@@ -0,0 +1,120 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _nodeDapi = require("../utils/node-dapi");
+function makeMock(responder) {
+  const calls = [];
+  const client = {
+    async request(method, path, body) {
+      calls.push({
+        method,
+        path,
+        body
+      });
+      return responder(method, path, body);
+    },
+    get(path) {
+      return this.request('GET', path);
+    },
+    post(path, body) {
+      return this.request('POST', path, body);
+    },
+    del(path) {
+      return this.request('DELETE', path);
+    }
+  };
+  return {
+    client,
+    calls
+  };
+}
+const CONN = {
+  name: 'TestPg',
+  dataSource: 'PostgreSQL',
+  server: 'localhost',
+  port: 5432,
+  db: 'datagrok'
+};
+(0, _vitest.describe)('NodeConnectionsDataSource.save', () => {
+  (0, _vitest.it)('POSTs to /public/v1/connections without saveCredentials by default', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path, body) => {
+      if (method === 'POST' && path === '/public/v1/connections') return {
+        ...body,
+        id: 'new-id'
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    const saved = await ds.save(CONN);
+    (0, _vitest.expect)(saved.id).toBe('new-id');
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/connections');
+    (0, _vitest.expect)(calls[0].body).toEqual(CONN);
+  });
+  (0, _vitest.it)('appends saveCredentials=true when requested', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path, body) => {
+      if (method === 'POST' && path === '/public/v1/connections?saveCredentials=true') return {
+        ...body,
+        id: 'new-id'
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await ds.save(CONN, true);
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/connections?saveCredentials=true');
+  });
+  (0, _vitest.it)('omits saveCredentials query param when false', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'POST' && path === '/public/v1/connections') return {
+        id: 'new-id'
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await ds.save(CONN, false);
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/connections');
+  });
+});
+(0, _vitest.describe)('NodeConnectionsDataSource.test', () => {
+  (0, _vitest.it)('POSTs the connection body to /public/v1/connections/test and resolves on "ok"', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'POST' && path === '/public/v1/connections/test') return 'ok';
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await ds.test(CONN);
+    (0, _vitest.expect)(calls[0].body).toEqual(CONN);
+  });
+  (0, _vitest.it)('strips surrounding quotes on a JSON-encoded "ok"', async () => {
+    const {
+      client
+    } = makeMock(() => '"ok"');
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await (0, _vitest.expect)(ds.test(CONN)).resolves.toBeUndefined();
+  });
+  (0, _vitest.it)('throws the server error text when the response is not ok', async () => {
+    const {
+      client
+    } = makeMock(() => 'connection refused: tcp://localhost:5432');
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await (0, _vitest.expect)(ds.test(CONN)).rejects.toThrow(/connection refused/);
+  });
+  (0, _vitest.it)('throws a generic message on empty response', async () => {
+    const {
+      client
+    } = makeMock(() => '');
+    const ds = new _nodeDapi.NodeConnectionsDataSource(client);
+    await (0, _vitest.expect)(ds.test(CONN)).rejects.toThrow(/failed/i);
+  });
+});

package/bin/__tests__/node-dapi.groups.test.js

@@ -0,0 +1,467 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _nodeDapi = require("../utils/node-dapi");
+function makeMock(responder) {
+  const calls = [];
+  const client = {
+    async request(method, path, body) {
+      calls.push({
+        method,
+        path,
+        body
+      });
+      return responder(method, path, body);
+    },
+    get(path) {
+      return this.request('GET', path);
+    },
+    post(path, body) {
+      return this.request('POST', path, body);
+    },
+    del(path) {
+      return this.request('DELETE', path);
+    }
+  };
+  return {
+    client,
+    calls
+  };
+}
+const PARENT_ID = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+const ALICE_ID = 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb';
+const BOB_ID = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
+function makeParent(children = []) {
+  return {
+    id: PARENT_ID,
+    friendlyName: 'Admins',
+    children
+  };
+}
+(0, _vitest.describe)('NodeGroupsDataSource.resolve', () => {
+  (0, _vitest.it)('treats a UUID as a direct ID and calls find()', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((_m, path) => {
+      if (path.startsWith(`/public/v1/groups/${PARENT_ID}`)) return makeParent();
+      throw new Error(`unexpected ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const g = await ds.resolve(PARENT_ID);
+    (0, _vitest.expect)(g.id).toBe(PARENT_ID);
+    (0, _vitest.expect)(calls[0].path).toBe(`/public/v1/groups/${PARENT_ID}`);
+  });
+  (0, _vitest.it)('uses /lookup for non-UUID names and returns the unique match', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((_m, path) => {
+      if (path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        name: 'alice',
+        friendlyName: 'alice',
+        personal: true
+      }];
+      throw new Error(`unexpected ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const g = await ds.resolve('alice');
+    (0, _vitest.expect)(g.id).toBe(ALICE_ID);
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/groups/lookup?query=alice');
+  });
+  (0, _vitest.it)('errors with a list when lookup returns multiple matches', async () => {
+    const {
+      client
+    } = makeMock((_m, path) => {
+      if (path.startsWith('/public/v1/groups/lookup')) return [{
+        id: 'g1',
+        friendlyName: 'alice',
+        personal: false
+      }, {
+        id: 'g2',
+        friendlyName: 'alice',
+        personal: true
+      }];
+      throw new Error(`unexpected ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await (0, _vitest.expect)(ds.resolve('alice')).rejects.toThrow(/Multiple groups match 'alice'/);
+  });
+  (0, _vitest.it)('personalOnly filters lookup results to personal groups', async () => {
+    const {
+      client
+    } = makeMock((_m, path) => {
+      if (path.startsWith('/public/v1/groups/lookup')) return [{
+        id: 'g1',
+        friendlyName: 'alice',
+        personal: false
+      }, {
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      throw new Error(`unexpected ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const g = await ds.resolve('alice', {
+      personalOnly: true
+    });
+    (0, _vitest.expect)(g.id).toBe(ALICE_ID);
+  });
+  (0, _vitest.it)('errors when personalOnly yields no matches', async () => {
+    const {
+      client
+    } = makeMock((_m, path) => {
+      if (path.startsWith('/public/v1/groups/lookup')) return [{
+        id: 'g1',
+        friendlyName: 'alice',
+        personal: false
+      }];
+      throw new Error(`unexpected ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await (0, _vitest.expect)(ds.resolve('alice', {
+      personalOnly: true
+    })).rejects.toThrow(/No group matching 'alice' \(personal\)/);
+  });
+});
+(0, _vitest.describe)('NodeGroupsDataSource.save', () => {
+  (0, _vitest.it)('POSTs the group body to /public/v1/groups and auto-generates an id when missing', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path, body) => {
+      if (method === 'POST' && path === '/public/v1/groups') return {
+        ...body,
+        friendlyName: 'Chemists'
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.save({
+      friendlyName: 'Chemists'
+    });
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/groups');
+    (0, _vitest.expect)(calls[0].body.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+  });
+  (0, _vitest.it)('appends saveRelations=true when requested', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'POST' && path === '/public/v1/groups?saveRelations=true') return {
+        id: 'g'
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.save({
+      id: 'g',
+      friendlyName: 'Chemists'
+    }, true);
+    (0, _vitest.expect)(calls[0].path).toBe('/public/v1/groups?saveRelations=true');
+  });
+});
+(0, _vitest.describe)('NodeGroupsDataSource.addMembers', () => {
+  (0, _vitest.it)('appends new relations and POSTs with saveRelations=true', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path, _body) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST' && path === '/public/v1/groups?saveRelations=true') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.addMembers(PARENT_ID, ['alice']);
+    (0, _vitest.expect)(results).toEqual([{
+      member: 'alice',
+      status: 'added'
+    }]);
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.path).toBe('/public/v1/groups?saveRelations=true');
+    (0, _vitest.expect)(post.body.children).toEqual([{
+      parent: {
+        id: PARENT_ID
+      },
+      child: {
+        id: ALICE_ID
+      },
+      isAdmin: false
+    }]);
+  });
+  (0, _vitest.it)('supports --admin by setting isAdmin on the new relation', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.addMembers(PARENT_ID, ['alice'], true);
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.body.children[0].isAdmin).toBe(true);
+  });
+  (0, _vitest.it)('is idempotent: re-adding with the same role reports noop and skips POST', async () => {
+    const existing = {
+      parent: {
+        id: PARENT_ID
+      },
+      child: {
+        id: ALICE_ID
+      },
+      isAdmin: false
+    };
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent([existing]);
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.addMembers(PARENT_ID, ['alice']);
+    (0, _vitest.expect)(results).toEqual([{
+      member: 'alice',
+      status: 'noop'
+    }]);
+    (0, _vitest.expect)(calls.find(c => c.method === 'POST')).toBeUndefined();
+  });
+  (0, _vitest.it)('flips isAdmin when re-adding an existing member with a different role', async () => {
+    const existing = {
+      parent: {
+        id: PARENT_ID
+      },
+      child: {
+        id: ALICE_ID
+      },
+      isAdmin: false
+    };
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent([existing]);
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.addMembers(PARENT_ID, ['alice'], true);
+    (0, _vitest.expect)(results).toEqual([{
+      member: 'alice',
+      status: 'updated'
+    }]);
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.body.children).toHaveLength(1);
+    (0, _vitest.expect)(post.body.children[0].isAdmin).toBe(true);
+  });
+  (0, _vitest.it)('processes a mixed batch: one valid, one unresolvable', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === '/public/v1/groups/lookup?query=alice') return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'GET' && path === '/public/v1/groups/lookup?query=nobody') return [];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.addMembers(PARENT_ID, ['alice', 'nobody']);
+    (0, _vitest.expect)(results[0]).toEqual({
+      member: 'alice',
+      status: 'added'
+    });
+    (0, _vitest.expect)(results[1].member).toBe('nobody');
+    (0, _vitest.expect)(results[1].status).toBe('error');
+    (0, _vitest.expect)(results[1].error).toMatch(/No group matching 'nobody'/);
+    // POST should still happen for the valid member
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.body.children).toHaveLength(1);
+    (0, _vitest.expect)(post.body.children[0].child.id).toBe(ALICE_ID);
+  });
+  (0, _vitest.it)('handles multiple members in a single call', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === '/public/v1/groups/lookup?query=alice') return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'GET' && path === '/public/v1/groups/lookup?query=bob') return [{
+        id: BOB_ID,
+        friendlyName: 'bob',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.addMembers(PARENT_ID, ['alice', 'bob']);
+    (0, _vitest.expect)(results.map(r => r.status)).toEqual(['added', 'added']);
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.body.children.map(c => c.child.id)).toEqual([ALICE_ID, BOB_ID]);
+    // exactly one POST regardless of batch size
+    (0, _vitest.expect)(calls.filter(c => c.method === 'POST')).toHaveLength(1);
+  });
+});
+(0, _vitest.describe)('NodeGroupsDataSource.removeMembers', () => {
+  (0, _vitest.it)('filters the relation out and POSTs with saveRelations=true', async () => {
+    const existing = {
+      parent: {
+        id: PARENT_ID
+      },
+      child: {
+        id: ALICE_ID
+      },
+      isAdmin: false
+    };
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent([existing]);
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.removeMembers(PARENT_ID, ['alice']);
+    (0, _vitest.expect)(results).toEqual([{
+      member: 'alice',
+      status: 'removed'
+    }]);
+    const post = calls.find(c => c.method === 'POST');
+    (0, _vitest.expect)(post.path).toBe('/public/v1/groups?saveRelations=true');
+    (0, _vitest.expect)(post.body.children).toEqual([]);
+  });
+  (0, _vitest.it)('reports not-member and skips POST when the member isn\'t in the group', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path.startsWith('/public/v1/groups/lookup')) return [{
+        id: ALICE_ID,
+        friendlyName: 'alice',
+        personal: true
+      }];
+      if (method === 'POST') return {
+        id: PARENT_ID
+      };
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    const results = await ds.removeMembers(PARENT_ID, ['alice']);
+    (0, _vitest.expect)(results).toEqual([{
+      member: 'alice',
+      status: 'not-member'
+    }]);
+    (0, _vitest.expect)(calls.find(c => c.method === 'POST')).toBeUndefined();
+  });
+});
+(0, _vitest.describe)('NodeGroupsDataSource.getMembers', () => {
+  (0, _vitest.it)('calls /members without an admin query when admin is undefined', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}/members`) return [];
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.getMembers(PARENT_ID);
+    (0, _vitest.expect)(calls.map(c => c.path)).toContain(`/public/v1/groups/${PARENT_ID}/members`);
+  });
+  (0, _vitest.it)('passes admin=true', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}/members?admin=true`) return [];
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.getMembers(PARENT_ID, true);
+    (0, _vitest.expect)(calls.map(c => c.path)).toContain(`/public/v1/groups/${PARENT_ID}/members?admin=true`);
+  });
+  (0, _vitest.it)('passes admin=false', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}/members?admin=false`) return [];
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.getMembers(PARENT_ID, false);
+    (0, _vitest.expect)(calls.map(c => c.path)).toContain(`/public/v1/groups/${PARENT_ID}/members?admin=false`);
+  });
+});
+(0, _vitest.describe)('NodeGroupsDataSource.getMemberships', () => {
+  (0, _vitest.it)('calls /memberships with admin flag when provided', async () => {
+    const {
+      client,
+      calls
+    } = makeMock((method, path) => {
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}`) return makeParent();
+      if (method === 'GET' && path === `/public/v1/groups/${PARENT_ID}/memberships?admin=true`) return [];
+      throw new Error(`unexpected ${method} ${path}`);
+    });
+    const ds = new _nodeDapi.NodeGroupsDataSource(client);
+    await ds.getMemberships(PARENT_ID, true);
+    (0, _vitest.expect)(calls.map(c => c.path)).toContain(`/public/v1/groups/${PARENT_ID}/memberships?admin=true`);
+  });
+});

package/bin/commands/publish.js

@@ -343,6 +343,11 @@ async function processDockerImages(packageName, version, registry, devKey, host,
           color.log(`  Tagged as ${canonicalTag}`);
         }
         result = pushImage(img.imageName, registryTag, registry);
+        if (!result) {
+          const fallback = await fallbackImage(img, host, devKey, registry, version, contentHash);
+          if (fallback.serverError) color.error(`Cannot resolve fallback: ${fallback.serverError}`);else if (fallback.image) color.warn(`Falling back to ${fallback.image}` + `${fallback.hashMatch === false ? ' (hash mismatch — container will run older code)' : ''}`);else color.error(`No published image available for ${img.imageName}. No container will be available.`);
+          result = fallback;
+        }
       } else {
         color.warn(`Local image not found. Expected: ${img.fullLocalName}`);
         color.log(`  Build it with: docker build -t ${img.fullLocalName} -f ${dockerfilePath} ${dockerfileDir}`);
@@ -364,7 +369,7 @@ async function processDockerImages(packageName, version, registry, devKey, host,
             fallback: true,
             requestedVersion: registryTag
           };
-          if (!result || result.fallback) color.warn(`Build failed. Falling back to ${fallback.image} (hash mismatch)`);
+          if (!result || result.fallback) color.warn(`Could not publish a new image. Falling back to ${fallback.image} (hash mismatch)`);
         } else {
           // The server has no compatible record, but the image may already be
           // published in the configured registry / Docker Hub (e.g. pushed by an
@@ -394,7 +399,7 @@ async function processDockerImages(packageName, version, registry, devKey, host,
                 fallback: true,
                 requestedVersion: registryTag
               };
-              color.error(`Failed to build ${img.fullLocalName}. No container will be available.`);
+              color.error(`Failed to publish ${img.fullLocalName}. No container will be available.`);
             }
           }
         }
@@ -408,6 +413,12 @@ async function processDockerImages(packageName, version, registry, devKey, host,
     color.log(`Added ${imageJsonPath}`);
   }
 }
+
+// Returns null when the push failed. Never claim a tag that was not published: the server
+// records it as the container's image and the spawner then fails validation forever
+// ("not found in any registry") with no way back except another publish.
+// With no registry configured the local tag is all there is — dev stacks share the host
+// docker daemon and the spawner resolves local images, so that stays a warning.
 function pushImage(imageName, tag, registry) {
   const canonicalImage = `datagrok/${imageName}:${tag}`;
   if (registry) {
@@ -417,11 +428,8 @@ function pushImage(imageName, tag, registry) {
       image: canonicalImage,
       fallback: false
     };
-    color.warn(`Push failed, image tagged locally only: ${remoteTag}`);
-    return {
-      image: canonicalImage,
-      fallback: false
-    };
+    color.error(`${remoteTag} was not published — check \`docker login ${registry}\` and your developer key.`);
+    return null;
   }
   color.warn(`No registry configured. Image tagged locally only. Run \`grok config --registry\` to configure.`);
   return {

package/bin/commands/stress-tests.js

@@ -50,6 +50,9 @@ async function run(config, args) {
   processArgs.push('src/package-test-node.ts');
   processArgs.push(`--apiUrl=${config.url}`);
   processArgs.push(`--devKey=${config.key}`);
+  // Explicit even though it's the runner default: the stress baseline must only run
+  // stressTest-marked tests regardless of how the runner's default evolves.
+  processArgs.push('--mode=stress');
   if (args["concurrent-runs"]) processArgs.push(`--concurrentRuns=${args["concurrent-runs"]}`);
   if (args['loop']) processArgs.push(`--loop`);
   if (args['concurrency-range']) processArgs.push(`--concurrencyRange=${args["concurrency-range"]}`);

package/package-template/src/package-test.ts

@@ -8,12 +8,20 @@ export { tests };
 //input: string category {optional: true}
 //input: string test {optional: true}
 //input: object testContext {optional: true}
+//input: bool excludeNodeTests {optional: true}
 //output: dataframe result
-export async function test(category: string, test: string, testContext: TestContext): Promise<DG.DataFrame> {
-  const data = await runTests({ category, test, testContext });
+export async function test(category: string, test: string, testContext: TestContext, excludeNodeTests?: boolean): Promise<DG.DataFrame> {
+  const data = await runTests({ category, test, testContext, excludeNodeTests });
   return DG.DataFrame.fromObjects(data)!;
 }
 
+/** Headless entry for the `grok test` Node pass — runs only tests marked {node: true}. */
+export async function testNode(pkg: DG.Package,
+  options: {category?: string, test?: string, stressTest?: boolean, verbose?: boolean}): Promise<any[]> {
+  return await runTests({category: options.category, test: options.test, stressTest: options.stressTest,
+    verbose: options.verbose, nodeOnly: true, nodeOptions: {package: pkg}});
+}
+
 //name: initAutoTests
 export async function initAutoTests() {
   await initTests(_package, _package.getModule('package-test.js'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "datagrok-tools",
-  "version": "6.5.1",
+  "version": "6.5.2",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {