datagrok-tools 6.5.2 → 6.5.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Datagrok-tools changelog
 
+## 6.5.3 (2026-08-04)
+
+* GROK-18695: Security — bumped `adm-zip` to 0.6.0 (CVE-2026-39244). Below 0.6.0 it sized a buffer from the ZIP header's declared uncompressed size before validating it, so a ~120-byte crafted archive forced a multi-GB allocation; `grok report` opens archives fetched from a server. The APIs it uses are unchanged. Also refreshed the lockfile to clear five more high-severity audit findings (`brace-expansion`, `fast-uri`, `ip-address`, `js-yaml`, `postcss`), all within existing ranges.
+
 ## 6.5.2 (2026-07-27)
 
 * `grok publish` — a failed `docker push` is no longer reported as a successful one. `image.json` claimed the tag regardless, so the server recorded a container image that was never published and the spawner failed validation forever ("Image ... not found in any registry") with no recovery short of another publish. The push failure now falls back to an image that is actually in the registry, and says so.

package/bin/commands/server.js

@@ -45,6 +45,7 @@ async function server(argv) {
     if (entity === 'raw') return handleRaw(dapi, verb, rest, output);
     if (entity === 'describe') return handleDescribe(dapi, verb ?? rest[0], output);
     if (entity === 'healthcheck') return handleHealthcheck(dapi, argv, output);
+    if (entity === 'sync') return handleSync(dapi, verb, rest, argv, output);
     if (entity === 'functions' && verb === 'run') return handleFuncRun(dapi, rest, argv, output);
     if (entity === 'functions' && verb === 'list') return handleFunctionsList(dapi, argv, limit, offset, filter, output);
     if (entity === 'files' && verb === 'list') {
@@ -235,6 +236,89 @@ async function handleRaw(dapi, method, rest, output) {
   (0, _serverOutput.printOutput)(result, output);
   return true;
 }
+async function handleSync(dapi, subject, rest, argv, output) {
+  // `grok s sync` subcommands. Mirrors the API surface in
+  // core/server/datlas/lib/src/routers/sync.dart — pairs / setups /
+  // runs are read-only here; `run` triggers an actual push and prints
+  // the per-item summary. Full reference in
+  // core/docs/plans/instance-sync.md (Phase 7 / operational polish).
+  //
+  // `_callSync` does dual-path routing: tries `/api/sync/...` first
+  // (nginx-fronted deployments) and falls back to `/sync/...` (bare
+  // datlas on :8082). Same approach as the server-side handshake
+  // code so the CLI works against either layout.
+  const verb = rest[0];
+  const callSync = async (method, path, body) => {
+    for (const prefix of ['/api', '']) {
+      const r = body !== undefined ? await dapi.raw(method, `${prefix}${path}`, body) : await dapi.raw(method, `${prefix}${path}`);
+      // raw() returns `null` for 404, but the server returns HTML for
+      // 404 too — treat anything that isn't a sync-shaped object/array
+      // as a miss and fall through to the alternate prefix.
+      if (r && (Array.isArray(r) || typeof r === 'object') && r['#type'] !== 'ApiError') return r;
+    }
+    return null;
+  };
+  if (subject === 'pairs' && verb === 'list') {
+    const status = argv.status ? `?status=${encodeURIComponent(argv.status)}` : '';
+    const pairs = await callSync('GET', `/sync/pairs${status}`);
+    (0, _serverOutput.printOutput)(pairs, output);
+    return true;
+  }
+  if (subject === 'setups' && verb === 'list') {
+    const pairId = argv.pair ?? rest[1];
+    if (!pairId) {
+      (0, _serverOutput.printError)(new Error('Usage: grok s sync setups list --pair <pair-id>'));
+      return false;
+    }
+    const setups = await callSync('GET', `/sync/pairs/${encodeURIComponent(pairId)}/setups`);
+    (0, _serverOutput.printOutput)(setups, output);
+    return true;
+  }
+  if (subject === 'setup' && verb === 'get') {
+    const id = rest[1];
+    if (!id) {
+      (0, _serverOutput.printError)(new Error('Usage: grok s sync setup get <setup-id>'));
+      return false;
+    }
+    const setup = await callSync('GET', `/sync/setups/${encodeURIComponent(id)}`);
+    (0, _serverOutput.printOutput)(setup, output);
+    return true;
+  }
+  if (subject === 'run') {
+    // grok s sync run <setup-id>
+    const id = rest[1] ?? verb;
+    if (!id) {
+      (0, _serverOutput.printError)(new Error('Usage: grok s sync run <setup-id>'));
+      return false;
+    }
+    const result = await callSync('POST', `/sync/setups/${encodeURIComponent(id)}/run`, {});
+    if (output === 'json' || output === 'csv') {
+      (0, _serverOutput.printOutput)(result, output);
+      return true;
+    }
+    if (output === 'quiet') {
+      console.log(result?.runId ?? '');
+      return true;
+    }
+    if (!result) {
+      (0, _serverOutput.printError)(new Error(`Sync setup ${id} not found, or server has no /sync routes.`));
+      return false;
+    }
+    console.log(`Run ${result?.runId} → ${result?.remoteUrl} (${result?.status})`);
+    if (result?.counts) {
+      const cs = Object.keys(result.counts).filter(k => (result.counts[k] ?? 0) > 0).map(k => `${result.counts[k]} ${k}`).join(', ');
+      if (cs) console.log(`  ${cs}`);
+    }
+    const items = Array.isArray(result?.items) ? result.items : [];
+    if (items.length) {
+      console.log('\nItems:');
+      (0, _serverOutput.printOutput)(items, 'table');
+    }
+    return true;
+  }
+  (0, _serverOutput.printError)(new Error('Usage:\n' + '  grok s sync pairs list [--status active|pending|revoked]\n' + '  grok s sync setups list --pair <pair-id>\n' + '  grok s sync setup get <setup-id>\n' + '  grok s sync run <setup-id>'));
+  return false;
+}
 async function handleHealthcheck(dapi, argv, output) {
   const module = argv.module;
   const path = module ? `/api/public/v1/healthcheck?module=${encodeURIComponent(module)}` : '/api/public/v1/healthcheck';
@@ -618,6 +702,10 @@ Special commands:
   grok s batch <entity> <verb> arg1 [arg2 ...]        Batch operation (one round-trip)
   grok s batch <entity> <verb> --json params.json     Batch from JSON array
   grok s batch manifest.json                          Run a workflow manifest
+  grok s sync pairs list [--status <s>]               List cross-instance sync pairs (status: active|pending|revoked)
+  grok s sync setups list --pair <pair-id>            List the named sync setups under a pair
+  grok s sync setup get <setup-id>                    Inspect a setup (selections, direction, last run)
+  grok s sync run <setup-id>                          Trigger a push run; prints per-item outcome
 
 Options:
   --host <alias|url>    Server alias from config or full URL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "datagrok-tools",
-  "version": "6.5.2",
+  "version": "6.5.3",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {
@@ -9,7 +9,7 @@
     "@babel/traverse": "^7.29.7",
     "@typescript-eslint/typescript-estree": "^8.61.1",
     "@typescript-eslint/visitor-keys": "^8.61.1",
-    "adm-zip": "^0.5.17",
+    "adm-zip": "^0.6.0",
     "archiver": "^7.0.1",
     "datagrok-api": "^1.27.6",
     "estraverse": "^5.3.0",