datagrok-tools 6.5.5 → 6.5.7

package/.devcontainer/docker-compose.yaml

@@ -8,6 +8,29 @@
 # On Windows, use `grok claude` instead — it handles path conversion
 # and Docker socket mapping automatically.
 
+# Shared by every jkg_* gateway below. They differ only in image and network alias.
+x-jkg: &jkg
+  platform: linux/amd64
+  environment:
+    GROK_PARAMETERS: |
+      {
+        "queueSettings": {
+          "useQueue": true,
+          "amqpHost": "rabbitmq",
+          "amqpUser": "guest",
+          "amqpPassword": "guest",
+          "amqpPort": 5672,
+          "pipeHost": "grok_pipe",
+          "pipePort": 3000,
+          "pipeKey": "test-key",
+          "maxConcurrentCalls": 16
+        }
+      }
+  restart: unless-stopped
+  depends_on:
+    rabbitmq:
+      condition: service_started
+
 services:
   postgres:
     image: pgvector/pgvector:pg17
@@ -118,33 +141,54 @@ services:
     restart: unless-stopped
     profiles: ["full"]
 
-  jupyter_kernel_gateway:
-    image: datagrok/jupyter_kernel_gateway:${DG_VERSION:-latest}
-    platform: linux/amd64
-    depends_on:
-      rabbitmq:
-        condition: service_started
-    environment:
-      GROK_PARAMETERS: |
-        {
-          "queueSettings": {
-            "useQueue": true,
-            "amqpHost": "rabbitmq",
-            "amqpUser": "guest",
-            "amqpPassword": "guest",
-            "amqpPort": 5672,
-            "pipeHost": "grok_pipe",
-            "pipePort": 3000,
-            "pipeKey": "test-key",
-            "maxConcurrentCalls": 16
-          }
-        }
+  # Per-language kernel gateways, which replaced the single all-languages
+  # datagrok/jupyter_kernel_gateway image. They version with the Scripting package, not with
+  # the platform, so they take their own JKG_VERSION. `scripting`/`full` starts Python and R;
+  # add `jkg_octave`, `jkg_julia` or `jkg_nodejs` when a package needs those languages.
+  jkg_python:
+    <<: *jkg
+    image: datagrok/jkg_python:${JKG_VERSION:-latest}
     networks:
       dg:
         aliases:
-          - jupyter_kernel_gateway
-    restart: unless-stopped
-    profiles: ["scripting", "full"]
+          - jkg_python
+    profiles: ["scripting", "full", "jkg_python"]
+
+  jkg_r:
+    <<: *jkg
+    image: datagrok/jkg_r:${JKG_VERSION:-latest}
+    networks:
+      dg:
+        aliases:
+          - jkg_r
+    profiles: ["scripting", "full", "jkg_r"]
+
+  jkg_octave:
+    <<: *jkg
+    image: datagrok/jkg_octave:${JKG_VERSION:-latest}
+    networks:
+      dg:
+        aliases:
+          - jkg_octave
+    profiles: ["jkg_octave"]
+
+  jkg_julia:
+    <<: *jkg
+    image: datagrok/jkg_julia:${JKG_VERSION:-latest}
+    networks:
+      dg:
+        aliases:
+          - jkg_julia
+    profiles: ["jkg_julia"]
+
+  jkg_nodejs:
+    <<: *jkg
+    image: datagrok/jkg_nodejs:${JKG_VERSION:-latest}
+    networks:
+      dg:
+        aliases:
+          - jkg_nodejs
+    profiles: ["jkg_nodejs"]
 
   world:
     image: datagrok/demo_db_postgres:12-1.1.0

package/CHANGELOG.md

@@ -1,7 +1,19 @@
 # Datagrok-tools changelog
 
-## 6.5.5 (WIP)
+## 6.5.7 (2026-08-28)
 
+* GROK-20789: `grok s packages` — full package lifecycle from the CLI: `install <name>... [--version <v>]` (server pulls released versions from the configured package repository / npm, `latest` by default), `uninstall`, `update <name>... | --all` (preserves `latest` auto-update tracking; pins pinned packages to the concrete registry-latest), `outdated`, `versions`, `set-version`, and `share`. Multi-package install/update runs sequentially with a per-package status table; a nonexistent package or version is a per-package `error` and exit code 1. Also fixed the generic `packages delete`, which was hitting a nonexistent `/public/v1` endpoint.
+* `grok s` — handler errors now print a clean `{"error": ...}` and exit 1 instead of a raw stack trace with exit 255 (handler dispatch was not awaited, so rejections escaped the error boundary).
+* `--version` values are no longer numerically coerced (`--version 1.10` used to arrive as `1.1`; affected `grok claude` too).
+* `grok test` — a Playwright pass that fails before running specs now reports a failing test instead of nothing. It returned an empty CSV, and the caller drops an empty Playwright result whenever the Puppeteer pass produced rows, so a suite whose config would not load (or that collected zero specs) was indistinguishable from a clean run — Build-Deploy #1277 printed "Playwright: no JSON report produced" and then "Tests passed", exit 0, for six packages. Every early exit now writes one failing row to `test-report-playwright.csv` and the merged report, and a report containing no specs is treated as a failure rather than a pass.
+
+## 6.5.6 (2026-08-20)
+
+* `grok report` (`ticket`, `comment`, `label`, `attach`) — support Atlassian **service-account** tokens alongside user API tokens, chosen by the token itself. A user token (`ATATT...`) keeps HTTP Basic with `JIRA_USER` + `JIRA_TOKEN` against the site. A service-account token (`ATSTT...`, minted at admin.atlassian.com) is a scoped token that the site host will not accept — Basic returns 401 and Bearer returns 403 `"Failed to parse Connect Session Auth Token"` — so it is sent as Bearer to the API gateway at `api.atlassian.com/ex/jira/<cloudId>`, with the cloud id read once from the site's public `/_edge/tenant_info` (override with `$JIRA_CLOUD_ID`). `$JIRA_URL` and `--jira-url` still mean the SITE; the gateway address is derived from it, never substituted for it. A service token needs no `JIRA_USER`, so the credential checks no longer demand one.
+
+## 6.5.5 (2026-08-12)
+
+* `grok test` — added a Node (browserless) pass: tests annotated `{node: true}` run headless under the js-api Node runtime before the browser launches; the browser pass excludes them and is skipped entirely when nothing browser-only matches. New flags: `--skip-node`, `--node-only`. Packages opt in by exporting `testNode()` from `package-test.ts`; others keep the previous behavior.
 * GROK-20298: `grok api --ui` — a relation-bearing table's `<Table>Ui` handle carries `<Table>Update` as its fifth generic too (`<Table>Ui.client`, `.table()` and the `<Schema>UiDb` property), so `<table>Ui.client.update(id, {labels: [...]})` compiles instead of failing the excess-property check.
 * GROK-20298: `grok api` — typed many-to-many relations: a table's `relations` block is validated with the server's rules (via/target declared in the same manifest, junction distinct from both sides, self-referential relations explicit, FK sides unique-or-explicit, junction `businessKey` covering both) and emitted as an expand-map entry `'<name>': {<name>?: {id: string; name: string}[]}`, a `<name>?: string[]` link set on `<Table>Insert`, and a new `<Table>Update` type (`Partial<<Table>Row>` plus the link sets) used by the transaction op union and passed as the client's fifth generic, so `update()` takes the link sets directly. Manifests without relations generate byte-identically.
 * GROK-20298: `grok api --ui` — also emits the typed SCHEMA handle: `export function <schema>UiDb(): Promise<<Schema>UiDb>` (a typed `domains.db(...)`), and the `<Schema>UiDb` interface types each table property (`const db = await gritUiDb(); db.issues.form({values: {...}})` is compile-checked).
@@ -28,10 +40,6 @@
 
 * `grok test` — the Node-pass report now merges into the browser report by column name. The line-wise merge assumed identical column order, so node rows landed misaligned (string values in the integer `ms` column) and the CI test-report upload failed with `invalid input syntax for type integer`.
 
-## 6.5.5 (WIP)
-
-* `grok test` — added a Node (browserless) pass: tests annotated `{node: true}` run headless under the js-api Node runtime before the browser launches; the browser pass excludes them and is skipped entirely when nothing browser-only matches. New flags: `--skip-node`, `--node-only`. Packages opt in by exporting `testNode()` from `package-test.ts`; others keep the previous behavior.
-
 ## 6.4.8 (2026-07-22)
 
 * GROK-20452: `grok publish` — always `docker build` the tools-generated worker dirs (`dockerfiles/queue`, `dockerfiles/celery`, `dockerfiles/<app>-celery`) instead of reusing a cached local tag. The "found local image" shortcut froze the worker at whatever stock base the daemon had when the tag was first built (CI ran day-old worker code with a fresh base available); the layer cache keeps an unchanged rebuild near-instant.

package/CLAUDE.md

@@ -251,6 +251,16 @@ grok s connections test --json conn.json                      # test a connectio
 grok s functions run 'Chem:smilesToMw("ccc")'
 grok s functions run 'Pkg:fn({a:5,b:22})'
 
+# Manage packages (server pulls released versions from the package repository / npm)
+grok s packages install Chem Bio PowerGrid     # install latest of each
+grok s packages install Chem --version 1.14.0  # pin a version
+grok s packages outdated                       # installed vs registry-latest
+grok s packages update --all                   # upgrade everything outdated
+grok s packages versions Chem                  # published versions + current/latest flags
+grok s packages set-version Chem 1.13.0        # activate a specific version
+grok s packages uninstall Chem                 # repo entry stays installable
+grok s packages share Chem Chemists --access View
+
 # Browse file storage
 grok s files list "System:AppData" -r          # list files recursively
 grok s files list "System:AppData/MyPlugin"

package/GROK_S.md

@@ -29,6 +29,8 @@ browser or a logged-in session.
 | List / browse files in a file share                         | `grok s files list "System:AppData" -r`                |
 | Upload / download a table (CSV or d42)                      | `grok s tables upload <name> file.csv\|file.d42` / `tables download <name> -O out.csv` |
 | Check whether a package is deployed                         | `grok s packages list --filter "MyPlugin"`             |
+| Install / update / uninstall server plugins                 | `grok s packages install Chem Bio` / `packages update --all` / `packages uninstall Chem` |
+| See installed vs latest plugin versions                     | `grok s packages outdated` / `packages versions Chem`  |
 | Hit any undocumented endpoint                               | `grok s raw GET /api/users/current`                    |
 | Check server + per-module health                            | `grok s healthcheck [--module <name>]`                 |
 | Bulk operations in one round-trip                           | `grok s batch <entity> <verb> --json items.json`       |
@@ -226,6 +228,56 @@ table|json|csv|quiet`), which still controls how the upload result is printed.
 Download is CSV-only — the server reads the stored d42 blob and converts. If you
 need the raw d42 bytes, hit `/tables/data/<id>` directly via `grok s raw`.
 
+## Packages
+
+Manage server plugins the same way the Package Manager UI does — the server pulls
+published packages from its configured package repository (npm). This is for
+installing **released** packages on a running server; publishing your own local
+package sources is still `grok publish`.
+
+```bash
+grok s packages install Chem Bio PowerGrid       # install latest of each, one line
+grok s packages install Chem --version 1.14.0    # pin a specific version (single package only)
+grok s packages outdated                         # installed vs registry-latest
+grok s packages update Chem Bio                  # upgrade named packages to latest
+grok s packages update --all                     # upgrade everything outdated
+grok s packages versions Chem                    # published versions w/ current/latest/debug flags
+grok s packages set-version Chem 1.13.0          # activate a specific version (pulls it if needed)
+grok s packages uninstall Chem                   # remove; repository entry stays installable
+grok s packages share Chem Chemists --access View
+```
+
+Semantics worth knowing:
+
+- **`install` without `--version` sets the package to `latest`**, which is an
+  auto-update intent: the server re-resolves it against the registry every ~15
+  minutes, so the package keeps itself current. A pinned `--version` (and `update`,
+  which pins the concrete latest version) stays put until you change it.
+- **Install is synchronous** — the call returns once the version is downloaded,
+  published, and made current. A heavy first-time install (e.g. Chem) can take
+  minutes; if the HTTP call times out, just re-run it — install is idempotent, and
+  a version that finished installing server-side is activated instantly on retry.
+- Multi-package `install`/`update` runs sequentially and prints a per-package
+  status table (`installed` / `noop` / `error`); a partial failure sets exit code 1.
+- **`update` preserves auto-update tracking**: a package whose desired version is
+  `latest` is updated by re-resolving `latest` (it keeps auto-updating); a pinned
+  package gets pinned to the concrete registry-latest version. Note that a
+  locally-published dev build counts as outdated once the registry moves past its
+  base version, so `update --all` will replace it with the registry release.
+- Status semantics: `noop` means "already at the requested latest"; installing an
+  explicit `--version` reports `installed` (with the published-version id) even
+  when that version was already current — the server re-activates it.
+- **`uninstall` of a repository-backed package keeps the package entry** (it shows
+  up as installable again); only locally-published packages are deleted outright.
+  It also clears the desired version, so the package drops out of `outdated` until
+  reinstalled. Neither path cleans up package credentials or package DB schemas.
+- `versions`, `outdated`, and name resolution read the repository catalog, so they
+  need a configured package repository — check with `grok s raw GET /api/packages/repos`.
+- `share` targets the package's project under the hood (same as sharing from the UI),
+  so the whole package — functions, queries, connections — is shared at once. For the
+  same reason `grok s shares list <package-uuid>` won't show the grant — it lives on
+  the package's project, not the package entity itself.
+
 ## Server health
 
 ```bash

package/bin/commands/help.js

@@ -424,6 +424,14 @@ Special commands:
   grok s connections test --json conn.json           Test connectivity of a connection defined in JSON
   grok s tables upload <name> <file.csv>             Upload a CSV as a Datagrok table
   grok s tables download <name-or-id> [-O <file>]    Download a table as CSV (stdout by default)
+  grok s packages install <name>... [--version <v>]  Install latest (or pinned) versions from the registry
+  grok s packages uninstall <name>                   Uninstall a package
+  grok s packages update <name>... | --all           Upgrade to the latest registry version
+  grok s packages outdated                           Show installed vs latest registry versions
+  grok s packages versions <name>                    List published versions
+  grok s packages set-version <name> <version>       Activate a specific published version
+  grok s packages share <name> <group> [--access View|Edit]
+                                                     Share a package with groups
   grok s raw <METHOD> <path>                         Hit any API endpoint
   grok s describe <entity-type>                      Show entity JSON schema
 
@@ -449,6 +457,8 @@ Examples:
   grok s shares add "JohnDoe:MyConnection" Chemists,Admins --access Edit
   grok s shares list <entity-uuid>
   grok s functions run 'Chem:smilesToMw("ccc")'
+  grok s packages install Chem Bio PowerGrid
+  grok s packages update --all
   grok s files list "System:AppData" -r
   grok s raw GET /api/users/current
   grok s describe connections

package/bin/commands/report.js

@@ -367,10 +367,10 @@ async function handleTicket(args) {
   const issueType = args['type'] || 'Bug';
   const auth = jiraAuthHeader();
   if (auth == null) {
-    color.error('JIRA_USER and JIRA_TOKEN env vars are required for `grok report ticket`.');
+    color.error('Set JIRA_TOKEN (plus JIRA_USER for a user API token) for `grok report ticket`.');
     return false;
   }
-  const jiraBase = resolveJiraBase(args);
+  const jiraBase = await resolveJiraBase(args);
   try {
     const {
       url,
@@ -444,10 +444,23 @@ async function handleTicket(args) {
 
 // ─── JIRA REST helpers (used by `grok report comment` / `grok report label`) ─
 //
-// These talk DIRECTLY to Atlassian Cloud REST v2 (not Datagrok). Auth is HTTP
-// Basic with `JIRA_USER` (Atlassian email) + `JIRA_TOKEN` (API token from
-// id.atlassian.com/manage-profile/security/api-tokens). Base URL defaults to
-// the Datagrok org instance; override via --jira-url or $JIRA_URL.
+// These talk DIRECTLY to Atlassian Cloud REST v2 (not Datagrok). Two auth schemes, picked from
+// the token itself:
+//
+//   * user API token (`ATATT...`, from id.atlassian.com/manage-profile/security/api-tokens) —
+//     HTTP Basic with `JIRA_USER` + `JIRA_TOKEN`, against the site. The original path.
+//   * service-account token (`ATSTT...`, from admin.atlassian.com) — a SCOPED token. The site
+//     host will not take it: Basic gives 401, and Bearer gives 403 "Failed to parse Connect
+//     Session Auth Token" because Jira tries to read it as a Connect session. Only the API
+//     gateway accepts it, addressed by cloud id, with Bearer. No JIRA_USER is involved.
+//
+// Both are supported on purpose. Automation moved to a service account when its bot mailbox
+// became a Google group (a group holds no Atlassian identity and cannot mint tokens), while
+// release-notes CI and every developer's local setup still use user tokens.
+//
+// Base URL defaults to the Datagrok org instance; override via --jira-url or $JIRA_URL. That
+// value stays the SITE — the gateway address is derived from it, never substituted for it, so
+// human-facing links elsewhere keep working.
 //
 // Why v2 and not v3: v3 requires comment bodies in ADF (Atlassian Document
 // Format) JSON, which is much heavier to construct. v2 accepts a plain string
@@ -455,15 +468,49 @@ async function handleTicket(args) {
 // becomes a top-level ordered-list item, ` ` shows up literally, etc.
 // `markdownToJiraWiki` below bridges the gap for Markdown-emitting callers.
 
-function resolveJiraBase(args) {
+const JIRA_SERVICE_TOKEN_RE = /^ATSTT/;
+function isJiraServiceToken() {
+  return JIRA_SERVICE_TOKEN_RE.test(process.env.JIRA_TOKEN || '');
+}
+
+// The site, as configured. Human-facing links are built from this.
+function resolveJiraSite(args) {
   const cli = args['jira-url'] || '';
   const env = process.env.JIRA_URL || '';
   return (cli || env || 'https://reddata.atlassian.net').replace(/\/+$/, '');
 }
+let cloudIdCache = null;
+
+// The gateway addresses a site by cloud id rather than hostname. Public endpoint, no credentials
+// needed, cached for the process.
+async function resolveJiraCloudId(site) {
+  if (process.env.JIRA_CLOUD_ID) return process.env.JIRA_CLOUD_ID.trim();
+  if (cloudIdCache !== null) return cloudIdCache;
+  try {
+    const r = await fetch(`${site}/_edge/tenant_info`);
+    const j = r.ok ? await r.json() : {};
+    cloudIdCache = (j.cloudId || '').trim();
+  } catch {
+    cloudIdCache = '';
+  }
+  return cloudIdCache;
+}
+
+// Where REST calls go. A service token needs the gateway; anything else keeps the site. If the
+// cloud id cannot be resolved, fall back to the site rather than failing outright — the request
+// then reports a normal auth error instead of a confusing lookup one.
+async function resolveJiraBase(args) {
+  const site = resolveJiraSite(args);
+  if (!isJiraServiceToken()) return site;
+  const cloudId = await resolveJiraCloudId(site);
+  return cloudId ? `https://api.atlassian.com/ex/jira/${cloudId}` : site;
+}
 function jiraAuthHeader() {
-  const user = process.env.JIRA_USER;
   const token = process.env.JIRA_TOKEN;
-  if (!user || !token) return null;
+  if (!token) return null;
+  if (isJiraServiceToken()) return `Bearer ${token}`;
+  const user = process.env.JIRA_USER;
+  if (!user) return null;
   return 'Basic ' + Buffer.from(`${user}:${token}`).toString('base64');
 }
 
@@ -544,7 +591,7 @@ async function handleComment(args) {
   }
   const auth = jiraAuthHeader();
   if (auth == null) {
-    color.error('JIRA_USER and JIRA_TOKEN env vars are required for `grok report comment`.');
+    color.error('Set JIRA_TOKEN (plus JIRA_USER for a user API token) for `grok report comment`.');
     return false;
   }
   let body;
@@ -566,7 +613,7 @@ async function handleComment(args) {
     color.error('Comment body is empty (use --body, --body-file, or pipe to stdin).');
     return false;
   }
-  const base = resolveJiraBase(args);
+  const base = await resolveJiraBase(args);
   const url = `${base}/rest/api/2/issue/${encodeURIComponent(ticket)}/comment`;
   // Callers (especially the dg-fix-reports M2 handoff) emit Markdown, but JIRA
   // REST v2 renders the body as wiki markup. Convert before posting so headings,
@@ -614,13 +661,15 @@ async function handleAttach(args) {
     color.error(`File not found: ${filePath}`);
     return false;
   }
-  const user = process.env.JIRA_USER;
-  const token = process.env.JIRA_TOKEN;
-  if (!user || !token) {
-    color.error('JIRA_USER and JIRA_TOKEN env vars are required for `grok report attach`.');
+
+  // Through the same helper as every other call: a service token authenticates with Bearer and
+  // has no JIRA_USER at all, so checking for one here would refuse a working setup.
+  const auth = jiraAuthHeader();
+  if (auth == null) {
+    color.error('Set JIRA_TOKEN (plus JIRA_USER for a user API token) for `grok report attach`.');
     return false;
   }
-  const base = resolveJiraBase(args);
+  const base = await resolveJiraBase(args);
   const url = `${base}/rest/api/2/issue/${encodeURIComponent(ticket)}/attachments`;
 
   // node-fetch v2 has no built-in FormData and the codebase doesn't depend on
@@ -630,7 +679,7 @@ async function handleAttach(args) {
   const {
     spawnSync
   } = require('child_process');
-  const r = spawnSync('curl', ['-sS', '-X', 'POST', '-u', `${user}:${token}`, '-H', 'X-Atlassian-Token: no-check', '-F', `file=@${filePath}`, '-w', '\n%{http_code}\n', url], {
+  const r = spawnSync('curl', ['-sS', '-X', 'POST', '-H', `Authorization: ${auth}`, '-H', 'X-Atlassian-Token: no-check', '-F', `file=@${filePath}`, '-w', '\n%{http_code}\n', url], {
     encoding: 'utf8',
     timeout: 120_000,
     maxBuffer: 4 * 1024 * 1024
@@ -671,10 +720,10 @@ async function handleLabel(args) {
   }
   const auth = jiraAuthHeader();
   if (auth == null) {
-    color.error('JIRA_USER and JIRA_TOKEN env vars are required for `grok report label`.');
+    color.error('Set JIRA_TOKEN (plus JIRA_USER for a user API token) for `grok report label`.');
     return false;
   }
-  const base = resolveJiraBase(args);
+  const base = await resolveJiraBase(args);
   const url = `${base}/rest/api/2/issue/${encodeURIComponent(ticket)}`;
   const update = {
     labels: labels.map(l => ({

package/bin/commands/server.js

@@ -41,13 +41,15 @@ async function server(argv) {
   }
   const dapi = new _nodeDapi.NodeDapi(client);
   try {
-    if (entity === 'batch') return handleBatch(dapi, argv, verb, rest, output);
-    if (entity === 'raw') return handleRaw(dapi, verb, rest, output);
-    if (entity === 'describe') return handleDescribe(dapi, verb ?? rest[0], output);
-    if (entity === 'healthcheck') return handleHealthcheck(dapi, argv, output);
-    if (entity === 'sync') return handleSync(dapi, verb, rest, argv, output);
-    if (entity === 'functions' && verb === 'run') return handleFuncRun(dapi, rest, argv, output);
-    if (entity === 'functions' && verb === 'list') return handleFunctionsList(dapi, argv, limit, offset, filter, output);
+    // await each handler so a rejection lands in the catch below instead of
+    // escaping to grok.js as an unhandled rejection (stack trace + exit 255)
+    if (entity === 'batch') return await handleBatch(dapi, argv, verb, rest, output);
+    if (entity === 'raw') return await handleRaw(dapi, verb, rest, output);
+    if (entity === 'describe') return await handleDescribe(dapi, verb ?? rest[0], output);
+    if (entity === 'healthcheck') return await handleHealthcheck(dapi, argv, output);
+    if (entity === 'sync') return await handleSync(dapi, verb, rest, argv, output);
+    if (entity === 'functions' && verb === 'run') return await handleFuncRun(dapi, rest, argv, output);
+    if (entity === 'functions' && verb === 'list') return await handleFunctionsList(dapi, argv, limit, offset, filter, output);
     if (entity === 'files' && verb === 'list') {
       const path = rest[0] ?? '';
       const result = await dapi.files.list(path, recursive);
@@ -64,21 +66,28 @@ async function server(argv) {
       if (output !== 'quiet') console.log(`Deleted ${rest[0]}`);
       return true;
     }
-    if (entity === 'files' && verb === 'put') return handleFilesPut(dapi, rest, output);
-    if (entity === 'shares' && verb === 'add') return handleSharesAdd(dapi, rest, argv, output);
-    if (entity === 'shares' && verb === 'list') return handleSharesList(dapi, rest, output);
-    if (entity === 'users' && verb === 'save') return handleUserSave(dapi, argv, output);
-    if (entity === 'groups' && verb === 'save') return handleGroupSave(dapi, argv, output);
-    if (entity === 'connections' && verb === 'save') return handleConnSave(dapi, argv, output);
-    if (entity === 'connections' && verb === 'test') return handleConnTest(dapi, rest, argv, output);
-    if (entity === 'groups' && verb === 'add-members') return handleGroupAddMembers(dapi, rest, argv, output);
-    if (entity === 'groups' && verb === 'remove-members') return handleGroupRemoveMembers(dapi, rest, argv, output);
-    if (entity === 'groups' && verb === 'list-members') return handleGroupListMembers(dapi, rest, argv, output);
-    if (entity === 'groups' && verb === 'list-memberships') return handleGroupListMemberships(dapi, rest, argv, output);
-    if (entity === 'users' && verb === 'block') return handleUserBlock(dapi, rest, output);
-    if (entity === 'users' && verb === 'unblock') return handleUserUnblock(dapi, rest, output);
-    if (entity === 'tables' && verb === 'download') return handleTablesDownload(dapi, rest, argv, output);
-    if (entity === 'tables' && verb === 'upload') return handleTablesUpload(dapi, rest, output);
+    if (entity === 'files' && verb === 'put') return await handleFilesPut(dapi, rest, output);
+    if (entity === 'shares' && verb === 'add') return await handleSharesAdd(dapi, rest, argv, output);
+    if (entity === 'shares' && verb === 'list') return await handleSharesList(dapi, rest, output);
+    if (entity === 'users' && verb === 'save') return await handleUserSave(dapi, argv, output);
+    if (entity === 'groups' && verb === 'save') return await handleGroupSave(dapi, argv, output);
+    if (entity === 'connections' && verb === 'save') return await handleConnSave(dapi, argv, output);
+    if (entity === 'connections' && verb === 'test') return await handleConnTest(dapi, rest, argv, output);
+    if (entity === 'groups' && verb === 'add-members') return await handleGroupAddMembers(dapi, rest, argv, output);
+    if (entity === 'groups' && verb === 'remove-members') return await handleGroupRemoveMembers(dapi, rest, argv, output);
+    if (entity === 'groups' && verb === 'list-members') return await handleGroupListMembers(dapi, rest, argv, output);
+    if (entity === 'groups' && verb === 'list-memberships') return await handleGroupListMemberships(dapi, rest, argv, output);
+    if (entity === 'users' && verb === 'block') return await handleUserBlock(dapi, rest, output);
+    if (entity === 'users' && verb === 'unblock') return await handleUserUnblock(dapi, rest, output);
+    if (entity === 'tables' && verb === 'download') return await handleTablesDownload(dapi, rest, argv, output);
+    if (entity === 'tables' && verb === 'upload') return await handleTablesUpload(dapi, rest, output);
+    if (entity === 'packages' && verb === 'install') return await handlePackagesInstall(dapi, rest, argv, output);
+    if (entity === 'packages' && verb === 'uninstall') return await handlePackagesUninstall(dapi, rest, output);
+    if (entity === 'packages' && verb === 'share') return await handlePackagesShare(dapi, rest, argv, output);
+    if (entity === 'packages' && verb === 'versions') return await handlePackagesVersions(dapi, rest, output);
+    if (entity === 'packages' && verb === 'set-version') return await handlePackagesSetVersion(dapi, rest, output);
+    if (entity === 'packages' && verb === 'outdated') return await handlePackagesOutdated(dapi, output);
+    if (entity === 'packages' && verb === 'update') return await handlePackagesUpdate(dapi, rest, argv, output);
     const source = dapi[entity];
     if (!source || !ENTITIES.includes(entity)) {
       (0, _serverOutput.printError)(new Error(`Unknown entity type: '${entity}'. Valid: ${ENTITIES.join(', ')}`));
@@ -112,7 +121,8 @@ async function server(argv) {
       if (output !== 'quiet') console.log(`Deleted ${entity}/${rest[0]}`);
       return true;
     }
-    (0, _serverOutput.printError)(new Error(`Unknown verb: '${verb}'. Valid: ${VERBS.join(', ')}`));
+    const extraVerbs = entity === 'packages' ? ', install, uninstall, update, outdated, versions, set-version, share' : '';
+    (0, _serverOutput.printError)(new Error(`Unknown verb: '${verb}'. Valid: ${VERBS.join(', ')}${extraVerbs}`));
     return false;
   } catch (err) {
     (0, _serverOutput.printError)(err);
@@ -168,6 +178,208 @@ async function handleTablesDownload(dapi, rest, argv, output) {
   } else process.stdout.write(csv);
   return true;
 }
+async function installPackages(dapi, targets, output) {
+  const results = [];
+  for (const t of targets) {
+    let name = t.name;
+    try {
+      const pkg = await dapi.packages.resolve(t.name);
+      if (pkg) name = pkg.name;
+      if (output === 'table') console.log(`Installing ${name} (${t.version})...`);
+      const id = await dapi.packages.install(name, t.version);
+      // the server returns the published id for any existing explicit version
+      // (even an already-current one), so null means the version doesn't exist
+      if (!id && t.version !== 'latest') results.push({
+        package: name,
+        version: t.version,
+        status: 'error',
+        error: `Version '${t.version}' not found`
+      });else results.push({
+        package: name,
+        version: t.version,
+        status: id ? 'installed' : 'noop',
+        id: id ?? undefined
+      });
+    } catch (err) {
+      results.push({
+        package: name,
+        version: t.version,
+        status: 'error',
+        error: (err?.message ?? String(err)).replace(/\s*\n\s*/g, '; ')
+      });
+    }
+  }
+  return results;
+}
+function printPackageOps(results, output) {
+  if (output === 'quiet') {
+    for (const r of results) if (r.id) console.log(r.id);
+  } else (0, _serverOutput.printOutput)(results, output);
+  if (results.some(r => r.status === 'error')) process.exitCode = 1;
+}
+async function handlePackagesInstall(dapi, rest, argv, output) {
+  if (!rest.length) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages install <name> [<name> ...] [--version <v>]'));
+    return false;
+  }
+  if (argv.version !== undefined && rest.length > 1) {
+    (0, _serverOutput.printError)(new Error('--version applies to a single package'));
+    return false;
+  }
+  const version = argv.version !== undefined ? String(argv.version) : 'latest';
+  const results = await installPackages(dapi, rest.map(r => ({
+    name: String(r),
+    version
+  })), output);
+  printPackageOps(results, output);
+  return true;
+}
+async function handlePackagesUninstall(dapi, rest, output) {
+  if (!rest[0]) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages uninstall <name-or-id>'));
+    return false;
+  }
+  const result = await dapi.packages.uninstall(rest[0]);
+  if (output === 'json' || output === 'csv') (0, _serverOutput.printOutput)(result, output);else if (output === 'quiet') console.log(result.id);else console.log(result.repoBacked ? `Uninstalled ${result.name} (package entry kept — reinstall with 'grok s packages install ${result.name}')` : `Deleted local package ${result.name}`);
+  return true;
+}
+async function handlePackagesShare(dapi, rest, argv, output) {
+  const [name, ...groupArgs] = rest;
+  if (!name || !groupArgs.length) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages share <name-or-id> <group>[,<group>...] [--access View|Edit]'));
+    return false;
+  }
+  const groups = groupArgs.flatMap(g => g.split(',')).map(g => g.trim()).filter(Boolean).join(',');
+  const access = typeof argv.access === 'string' ? argv.access : 'View';
+  if (access !== 'View' && access !== 'Edit') {
+    (0, _serverOutput.printError)(new Error(`Invalid --access '${access}'. Use 'View' or 'Edit'.`));
+    return false;
+  }
+  const pkg = await dapi.packages.resolve(name);
+  if (!pkg) {
+    (0, _serverOutput.printError)(new Error(`Package '${name}' not found`));
+    return false;
+  }
+  const result = await dapi.shares.share(pkg.id, groups, access);
+  (0, _serverOutput.printOutput)(result, output);
+  if (result?.status === 'failed') process.exitCode = 1;
+  return true;
+}
+async function handlePackagesVersions(dapi, rest, output) {
+  if (!rest[0]) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages versions <name-or-id>'));
+    return false;
+  }
+  const versions = await dapi.packages.versions(rest[0]);
+  const flat = versions.map(v => ({
+    version: v?.version ?? '',
+    current: v?.isCurrent ?? false,
+    latest: v?.isLatest ?? false,
+    local: v?.isLocal ?? false,
+    remote: v?.isRemote ?? false,
+    debug: v?.debug ?? false,
+    id: v?.id ?? ''
+  }));
+  (0, _serverOutput.printOutput)(flat, output);
+  return true;
+}
+async function handlePackagesSetVersion(dapi, rest, output) {
+  if (!rest[0] || rest[1] === undefined) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages set-version <name> <version>'));
+    return false;
+  }
+  const version = String(rest[1]);
+  const pkg = await dapi.packages.resolve(String(rest[0]));
+  const name = pkg?.name ?? String(rest[0]);
+  const id = await dapi.packages.install(name, version);
+  if (!id) {
+    (0, _serverOutput.printError)(new Error(`Version '${version}' not found for package '${name}'`));
+    return false;
+  }
+  if (output === 'quiet') console.log(id);else if (output === 'json' || output === 'csv') (0, _serverOutput.printOutput)({
+    package: name,
+    version,
+    id
+  }, output);else console.log(`${name} -> ${version} (published package ${id})`);
+  return true;
+}
+async function handlePackagesOutdated(dapi, output) {
+  const rows = await dapi.packages.outdated();
+  if (!rows.length && output === 'table') {
+    console.log('All packages up to date.');
+    return true;
+  }
+  (0, _serverOutput.printOutput)(rows, output);
+  return true;
+}
+async function handlePackagesUpdate(dapi, rest, argv, output) {
+  const all = argv.all === true;
+  if (!all && !rest.length) {
+    (0, _serverOutput.printError)(new Error('Usage: grok s packages update <name> [<name> ...] | --all'));
+    return false;
+  }
+  const outdated = await dapi.packages.outdated();
+  const results = [];
+  // a package tracking 'latest' keeps that auto-update intent; a pinned one gets
+  // pinned to the concrete registry-latest version
+  const targetVersion = o => o.desiredVersion === 'latest' ? 'latest' : o.latest;
+  let targets;
+  if (all) {
+    targets = outdated.map(o => ({
+      name: o.name,
+      version: targetVersion(o)
+    }));
+    if (!targets.length && output === 'table') {
+      console.log('All packages up to date.');
+      return true;
+    }
+  } else {
+    targets = [];
+    for (const r of rest) {
+      const raw = String(r);
+      let pkg = null;
+      try {
+        pkg = await dapi.packages.resolve(raw);
+      } catch (err) {
+        results.push({
+          package: raw,
+          version: '',
+          status: 'error',
+          error: (err?.message ?? String(err)).replace(/\s*\n\s*/g, '; ')
+        });
+        continue;
+      }
+      if (!pkg) {
+        results.push({
+          package: raw,
+          version: '',
+          status: 'error',
+          error: 'Package not found'
+        });
+        continue;
+      }
+      const o = outdated.find(x => x.name === pkg.name);
+      if (o) {
+        targets.push({
+          name: pkg.name,
+          version: targetVersion(o)
+        });
+        continue;
+      }
+      const versions = Array.isArray(pkg.publishedVersions) ? pkg.publishedVersions : [];
+      const installed = versions.some(v => v?.isCurrent && !v?.debug);
+      results.push({
+        package: pkg.name,
+        version: '',
+        status: 'noop',
+        note: installed ? 'already up to date' : 'not installed'
+      });
+    }
+  }
+  results.push(...(await installPackages(dapi, targets, output)));
+  printPackageOps(results, output);
+  return true;
+}
 async function handleTablesUpload(dapi, rest, output) {
   const [name, localPath] = rest;
   if (!name || !localPath) {
@@ -699,6 +911,14 @@ Special commands:
   grok s users unblock <id-or-login>                  Unblock a previously blocked user
   grok s tables upload <name> <file.csv|file.d42>     Upload a CSV or d42 binary as a Datagrok table
   grok s tables download <name-or-id> [-O <file>]     Download a table as CSV (stdout by default)
+  grok s packages install <name>... [--version <v>]   Install latest (or pinned) versions from the registry
+  grok s packages uninstall <name>                    Uninstall a package (repository entry is kept)
+  grok s packages update <name>... | --all            Upgrade to the latest registry version
+  grok s packages outdated                            Show installed vs latest registry versions
+  grok s packages versions <name>                     List published versions (current/latest/debug flags)
+  grok s packages set-version <name> <version>        Activate a specific published version
+  grok s packages share <name> <group>[,...] [--access View|Edit]
+                                                      Share a package with one or more groups
   grok s batch <entity> <verb> arg1 [arg2 ...]        Batch operation (one round-trip)
   grok s batch <entity> <verb> --json params.json     Batch from JSON array
   grok s batch manifest.json                          Run a workflow manifest
@@ -719,6 +939,8 @@ Options:
   --type <t>            Function discriminator: script | query | function | package
   --language <lang>     Script language: python, r, julia, nodejs, octave, grok
   --package <name>      Restrict to functions belonging to a package (by short name)
+  --version <v>         Package version for 'packages install' (default: latest)
+  --all                 For 'packages update': upgrade every outdated package
 
 Batch manifest options (in manifest.json):
   stopOnError           Stop on first failure (default: true)
@@ -745,6 +967,11 @@ Examples:
   grok s functions list --package PowerPack --type package --filter 'name contains "grid"'
   grok s files list "System:AppData" -r
   grok s files put ./smiles.csv "System:DemoFiles/smiles.csv"
+  grok s packages install Chem Bio PowerGrid
+  grok s packages install Chem --version 1.14.0
+  grok s packages update --all
+  grok s packages versions Chem
+  grok s packages share Chem Chemists --access View
   grok s raw GET /api/users/current
   grok s describe connections
   grok s users list --host dev

package/bin/grok.js

@@ -2,6 +2,8 @@
 const argv = require('minimist')(process.argv.slice(2), {
   alias: {k: 'key', h: 'help', r: 'recursive'},
   boolean: ['dartium'],
+  // keep versions verbatim — minimist would coerce '1.10' to the number 1.1
+  string: ['version'],
 });
 // minimist maps `--no-retry` to `{retry: false}`, so the `args['no-retry']` checks in
 // test.ts / playwright-runner.ts never fired and `--no-retry` was silently ignored

package/bin/utils/node-dapi.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.NodeUsersDataSource = exports.NodeTablesDataSource = exports.NodeSharesDataSource = exports.NodeHttpDataSource = exports.NodeGroupsDataSource = exports.NodeFuncsDataSource = exports.NodeFilesDataSource = exports.NodeDapi = exports.NodeConnectionsDataSource = exports.NodeApiClient = void 0;
+exports.NodeUsersDataSource = exports.NodeTablesDataSource = exports.NodeSharesDataSource = exports.NodePackagesDataSource = exports.NodeHttpDataSource = exports.NodeGroupsDataSource = exports.NodeFuncsDataSource = exports.NodeFilesDataSource = exports.NodeDapi = exports.NodeConnectionsDataSource = exports.NodeApiClient = void 0;
 exports.ensureBodyId = ensureBodyId;
 var _crypto = require("crypto");
 /// Docs: [Grok Dapi](/docs/plans/grok-dapi/)
@@ -400,6 +400,101 @@ function tryParseJson(s) {
     return null;
   }
 }
+class NodePackagesDataSource extends NodeHttpDataSource {
+  constructor(client) {
+    super(client, 'packages');
+  }
+
+  /** GET /packages (internal API) — includes publishedVersions and repository. */
+  async listFull(text) {
+    return this.client.get(`/packages${buildQuery({
+      text
+    })}`);
+  }
+
+  /** Resolve by UUID, name, or friendlyName (case-insensitive). Returns null when
+      not found so callers can pass the raw string through and let the server's own
+      'Package not found' surface. */
+  async resolve(idOrName) {
+    const all = await this.listFull();
+    if (UUID_RE.test(idOrName)) return all.find(p => p?.id === idOrName) ?? null;
+    const want = idOrName.toLowerCase();
+    const matches = all.filter(p => (p?.name ?? '').toLowerCase() === want || (p?.friendlyName ?? '').toLowerCase() === want);
+    if (matches.length > 1) {
+      const list = matches.map(p => `  ${p.id}  ${p.name}`).join('\n');
+      throw new Error(`Multiple packages match '${idOrName}':\n${list}\nUse the ID to disambiguate.`);
+    }
+    return matches[0] ?? null;
+  }
+
+  /** Install/activate via the DeployPackageVersion server func: pulls the version
+      from the package repository (npm) when needed, then makes it current.
+      'latest' marks the package for server-side auto-update. Synchronous — returns
+      the new published-package id, or null when nothing changed. */
+  async install(name, desiredVersion = 'latest') {
+    const result = await new NodeFuncsDataSource(this.client, 'functions').run('DeployPackageVersion', {
+      name,
+      desiredVersion
+    });
+    const value = result && typeof result === 'object' ? result.result ?? result.id ?? null : result;
+    const text = typeof value === 'string' ? value.replace(/^"|"$/g, '') : '';
+    return text && text !== 'null' ? text : null;
+  }
+  async uninstall(idOrName) {
+    const pkg = await this.resolve(idOrName);
+    if (!pkg) throw new Error(`Package '${idOrName}' not found`);
+    await this.client.del(`/packages/${encodeURIComponent(pkg.id)}`);
+    return {
+      id: pkg.id,
+      name: pkg.name,
+      repoBacked: !!pkg.repository
+    };
+  }
+  async versions(idOrName) {
+    const pkg = await this.resolve(idOrName);
+    if (!pkg) throw new Error(`Package '${idOrName}' not found`);
+    return Array.isArray(pkg.publishedVersions) ? pkg.publishedVersions : [];
+  }
+  async outdated() {
+    const all = await this.listFull();
+    const rows = [];
+    for (const p of all) {
+      const versions = Array.isArray(p?.publishedVersions) ? p.publishedVersions : [];
+      // isLocal is not reliably serialized, so 'installed' = has a current non-debug version
+      const current = versions.find(v => v?.isCurrent && !v?.debug);
+      const latest = versions.find(v => v?.isLatest);
+      // Numeric compare so locally published builds (1.2.3.X-suffix) don't count
+      // as outdated against an equal or older registry version.
+      if (current && latest && NodePackagesDataSource.compareVersions(latest.version, current.version) > 0) rows.push({
+        name: p.name,
+        installed: current.version,
+        latest: latest.version,
+        desiredVersion: p.desiredVersion ?? ''
+      });
+    }
+    return rows;
+  }
+
+  /** Compare the leading numeric dot-groups of two version strings (suffixes like
+      '.X-4e32bb91' are ignored): positive when a > b. */
+  static compareVersions(a, b) {
+    const nums = s => (String(s).match(/^\d+(\.\d+)*/)?.[0] ?? '').split('.').map(Number);
+    const av = nums(a),
+      bv = nums(b);
+    for (let i = 0; i < Math.max(av.length, bv.length); i++) {
+      const d = (av[i] ?? 0) - (bv[i] ?? 0);
+      if (d !== 0) return d;
+    }
+    return 0;
+  }
+
+  /** The public API has no DELETE for packages — route to the internal endpoint. */
+  async delete(idOrEntity) {
+    const id = typeof idOrEntity === 'string' ? idOrEntity : idOrEntity?.id ?? '';
+    await this.client.del(`/packages/${encodeURIComponent(id)}`);
+  }
+}
+exports.NodePackagesDataSource = NodePackagesDataSource;
 class NodeFilesDataSource {
   constructor(client) {
     this.client = client;
@@ -538,7 +633,7 @@ class NodeDapi {
     return new NodeHttpDataSource(this.client, 'scripts');
   }
   get packages() {
-    return new NodeHttpDataSource(this.client, 'packages');
+    return new NodePackagesDataSource(this.client);
   }
   get reports() {
     return new NodeHttpDataSource(this.client, 'reports');

package/bin/utils/playwright-runner.js

@@ -82,6 +82,49 @@ function rowsToCsv(rows) {
     data: rows.map(r => header.map(h => r[h]))
   });
 }
+function writePlaywrightCsv(pkgDir, csv) {
+  // Persist a Playwright-only CSV so the pipeline can ship it to the Datlas
+  // 'playwright' bucket, separate from the merged Puppeteer+Playwright
+  // test-report.csv that feeds the legacy 'package' bucket and JUnit.
+  try {
+    _fs.default.writeFileSync(_path.default.join(pkgDir, 'test-report-playwright.csv'), csv, 'utf-8');
+  } catch (e) {
+    color.warn(`Playwright: failed to write test-report-playwright.csv: ${e.message || e}`);
+  }
+}
+
+// A pass that dies before running specs still has to report a failure. Returning an empty CSV
+// let the caller drop it whenever the Puppeteer pass had rows, so a suite that never launched
+// (a config that fails to load, an unreachable host) was reported as a clean run.
+function runnerFailure(pkgDir, args, message) {
+  const rows = [{
+    date: new Date().toISOString(),
+    category: 'playwright',
+    name: 'Playwright suite',
+    success: false,
+    result: message,
+    ms: 0,
+    skipped: false,
+    logs: '',
+    owner: '',
+    package: process.env.TARGET_PACKAGE || args.package || '',
+    widgetsDifference: '',
+    flaking: false
+  }];
+  const csv = rowsToCsv(rows);
+  writePlaywrightCsv(pkgDir, csv);
+  color.error(`Playwright: ${message}`);
+  return {
+    failed: true,
+    passedAmount: 0,
+    failedAmount: 1,
+    skippedAmount: 0,
+    verbosePassed: '',
+    verboseSkipped: '',
+    verboseFailed: `Playwright: ${message}\n`,
+    csv: csv
+  };
+}
 async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
   const empty = {
     failed: false,
@@ -101,25 +144,13 @@ async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
       key
     } = testUtils.getDevKey(hostKey));
   } catch (e) {
-    color.error(`Playwright: cannot resolve host '${hostKey}': ${e.message || e}`);
-    return {
-      ...empty,
-      failed: true,
-      failedAmount: 1,
-      verboseFailed: `Playwright: ${e.message || e}\n`
-    };
+    return runnerFailure(pkgDir, args, `cannot resolve host '${hostKey}': ${e.message || e}`);
   }
   let token;
   try {
     token = await testUtils.getToken(url, key);
   } catch (e) {
-    color.error(`Playwright: cannot exchange dev key for token: ${e.message || e}`);
-    return {
-      ...empty,
-      failed: true,
-      failedAmount: 1,
-      verboseFailed: `Playwright: ${e.message || e}\n`
-    };
+    return runnerFailure(pkgDir, args, `cannot exchange dev key for token: ${e.message || e}`);
   }
   let webUrl;
   try {
@@ -137,15 +168,7 @@ async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
     }
   }
   const configPath = _path.default.join(testDir, 'playwright.config.ts');
-  if (!_fs.default.existsSync(configPath)) {
-    color.error(`Playwright: ${configPath} not found.`);
-    return {
-      ...empty,
-      failed: true,
-      failedAmount: 1,
-      verboseFailed: 'Playwright: missing playwright.config.ts\n'
-    };
-  }
+  if (!_fs.default.existsSync(configPath)) return runnerFailure(pkgDir, args, `${configPath} not found`);
   const reportFile = _path.default.join(pkgDir, 'test-playwright-report.json');
   if (_fs.default.existsSync(reportFile)) _fs.default.unlinkSync(reportFile);
   const cliArgs = ['--no-install', 'playwright', 'test', `--config=${configPath}`];
@@ -219,20 +242,18 @@ async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
     } catch {/* ignore */}
   }
   if (!report) {
-    color.error('Playwright: no JSON report produced.');
     const tail = Buffer.concat(stderrChunks).toString('utf-8').slice(-2000);
-    return {
-      ...empty,
-      failed: true,
-      failedAmount: 1,
-      verboseFailed: `Playwright: no JSON report. stderr tail:\n${tail}\n`
-    };
+    return runnerFailure(pkgDir, args, `no JSON report produced — the suite never ran. stderr tail:\n${tail}`);
   }
   const pkgJson = JSON.parse(_fs.default.readFileSync(_path.default.join(pkgDir, 'package.json'), 'utf-8'));
   const owner = pkgJson.author && (pkgJson.author.email || pkgJson.author) || '';
   const pkgName = process.env.TARGET_PACKAGE || args.package || pkgJson.name || '';
   const rows = [];
   flattenSuites(report.suites, testDir, pkgName, typeof owner === 'string' ? owner : '', args.verbose === true, rows);
+
+  // A report with no specs is the same non-event as no report at all: the config loaded but
+  // collection found nothing, or died on a spec that cannot be imported.
+  if (rows.length === 0) return runnerFailure(pkgDir, args, 'the run produced a report with no specs — check the spec imports and testMatch');
   let passedAmount = 0;
   let failedAmount = 0;
   let skippedAmount = 0;
@@ -253,14 +274,7 @@ async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
     }
   }
   const csv = rowsToCsv(rows);
-  // Persist a Playwright-only CSV so the pipeline can ship it to the Datlas
-  // 'playwright' bucket, separate from the merged Puppeteer+Playwright
-  // test-report.csv that feeds the legacy 'package' bucket and JUnit.
-  try {
-    _fs.default.writeFileSync(_path.default.join(pkgDir, 'test-report-playwright.csv'), csv, 'utf-8');
-  } catch (e) {
-    color.warn(`Playwright: failed to write test-report-playwright.csv: ${e.message || e}`);
-  }
+  writePlaywrightCsv(pkgDir, csv);
   return {
     failed: failedAmount > 0,
     passedAmount: passedAmount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "datagrok-tools",
-  "version": "6.5.5",
+  "version": "6.5.7",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {