datagrok-tools 6.5.9 → 6.6.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Datagrok-tools changelog
 
+## 6.6.0 (WIP)
+
+* The developer key is sent in the `Authorization` header (`Dev <key>`) instead of the URL path. `POST /users/login/dev/<key>` and `POST /packages/dev/<key>/<package>` put a long-lived credential into every nginx access log, proxy log and shell history along the way; the key-less routes (`/users/login/dev`, `/packages/dev/<package>`) take it as a header. Servers that predate the header form answer 404/401 and the old URL is used instead, so publishing to an older server still works - but a server from 1.28 on rejects the URL form and asks for datagrok-tools 6.6.0 or later.
+
+## 6.5.10 (2026-09-11)
+
+* `grok s pull` — a bundle file name is capped at 200 bytes plus a digest of the full name, so it stays unique and stable across pulls. A nested view under a long space spells a longer name than a path component may hold (255 bytes on ext4 and NTFS): one TWIG snapshot reached 268 and the write failed with `ENAMETOOLONG`, taking down the whole part rather than the entity — a `--by-namespace` part that only touched the space as a dependency died with it.
+
 ## 6.5.9 (2026-09-11)
 
 * `grok s push/migrate` — placement no longer claims an entity the walk refused. Containment is exclusive, so asserting a project's relation to a platform entity takes it away from whatever holds it on the target: migrating a dashboard built on demo data moved `System:DemoFiles` into the migrated space, and every reference to it by name broke stand-wide until its `System` row was restored by hand. The guard covered a space's own `Files` connection but not `System:` connections, personal `Home` shares, package projects or built-in groups; it now defers to the same `untransferableReason` the walk uses.

package/CLAUDE.md

@@ -94,7 +94,9 @@ The `publish` command executes these steps:
 3. Process environment variables in `/connections/*.json` files (replace `${VAR}`)
 4. **Process Docker images** (see below)
 5. Create ZIP archive with archiver-promise (includes `image.json` metadata per container)
-6. Upload to server: `POST ${host}/packages/dev/${devKey}/${packageName}`
+6. Upload to server: `POST ${host}/packages/dev/${packageName}` with `Authorization: Dev ${devKey}`
+   (older servers only know `POST ${host}/packages/dev/${devKey}/${packageName}`; `devKeyFetch` in
+   `bin/utils/dev-key.ts` falls back to it on 404/401)
 
 **Key flags:**
 - `--debug` (default) - Package visible only to developer

package/README.md

@@ -100,6 +100,11 @@ For more information on configuring connections, refer to the [Connections](http
   - `--suffix`: a string containing package version hash
 
   Running `grok publish` is the same as running `grok publish defaultHost --build --debug`.
+- `report` works with user error reports on a Datagrok instance (the instance is a server alias from
+  `config.yaml`): `grok report fetch <instance> <number>` downloads the report zip, `grok report read
+  <zip|json|instance number>` prints one normalized JSON object (flags `--extract-screenshot`,
+  `--extract-d42`, `--extract-client-log`), `grok report resolve <instance> <number>` marks it resolved.
+  `ticket`, `comment`, `label`, `attach` talk to JIRA with `JIRA_TOKEN`. See `grok report --help`.
 - `check` checks package content (function signatures, import statements of external modules,
   etc.). The check is also run during package publication.
 - `init` modifies a package template by adding config files for linters, IDE, and so on

package/bin/_deprecated/upload.js

@@ -72,7 +72,8 @@ async function processPackage() {
   let timestamps = {};
   if (debug) {
     try {
-      timestamps = await (await fetch(`${host}/packages/dev/${devKey}/${packageName}/timestamps`)).json();
+      timestamps = await (await fetch(`${host}/packages/dev/${packageName}/timestamps`,
+        {headers: {Authorization: `Dev ${devKey}`}})).json();
       if (timestamps['#type'] === 'ApiError') {
         console.log(timestamps.message);
         return 1;
@@ -134,8 +135,9 @@ async function processPackage() {
 
   //upload
   const uploadPromise = new Promise((resolve, reject) => {
-    fetch(`${host}/packages/dev/${devKey}/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
+    fetch(`${host}/packages/dev/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
       method: 'POST',
+      headers: {Authorization: `Dev ${devKey}`},
       body: zip,
     }).then((body) => body.json()).then((j) => resolve(j)).catch((err) => {
       reject(err);

package/bin/commands/help.js

@@ -371,10 +371,17 @@ Usage: grok report <subcommand> [args]
 Manage Datagrok user error reports
 
 Subcommands:
-    fetch    Download a report zip from a managed instance
+    fetch    Download a report zip from a managed instance (writes <stem>_meta.json next to it)
     read     Normalize a report (zip or json) into one JSON object on stdout
-    resolve  Mark a report as resolved
-    ticket   Create a JIRA ticket for a report via the Datlas API
+    resolve  Mark a report as resolved (needs the _meta.json written by fetch)
+    ticket   Create a JIRA ticket for a report directly in JIRA (no dedup; the key is NOT
+             written back to the report — prefer POST /reports/{id}/jira for that)
+    comment  Add a comment to a JIRA ticket (--body <text> | --body-file <path>)
+    label    Add labels to a JIRA ticket
+    attach   Attach a file to a JIRA ticket
+
+JIRA subcommands need JIRA_TOKEN (plus JIRA_USER for a user API token); ticket also needs
+--project or $JIRA_PROJECT.
 
 Read flags:
     --extract-screenshot <path>  Write the screenshot binary to <path>

package/bin/commands/publish.js

@@ -20,6 +20,7 @@ var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _check = require("./check");
 var _pythonCeleryGen = require("../utils/python-celery-gen");
 var _queueWorkerGen = require("../utils/queue-worker-gen");
+var _devKey = require("../utils/dev-key");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 // @ts-ignore
 
@@ -243,7 +244,7 @@ function listRecursive(basePath, rel) {
 async function getUserLogin(host, devKey) {
   let loginResp;
   try {
-    loginResp = await (0, _nodeFetch.default)(`${host}/users/login/dev/${devKey}`, {
+    loginResp = await (0, _devKey.devKeyFetch)(`${host}/users/login/dev`, `${host}/users/login/dev/${devKey}`, devKey, {
       method: 'POST'
     });
   } catch (e) {
@@ -485,9 +486,10 @@ async function fallbackImage(img, host, devKey, registry, version, contentHash)
 async function processPackage(debug, rebuild, host, devKey, packageName, dropDb, suffix, hostAlias, registry, rebuildDocker, skipDockerRebuild) {
   // Validate server connectivity and dev key
   let timestamps = {};
-  let url = `${host}/packages/dev/${devKey}/${packageName}`;
+  const url = `${host}/packages/dev/${packageName}`;
+  const legacyUrl = `${host}/packages/dev/${devKey}/${packageName}`;
   try {
-    const checkResp = await (0, _nodeFetch.default)(url + '/timestamps');
+    const checkResp = await (0, _devKey.devKeyFetch)(`${url}/timestamps`, `${legacyUrl}/timestamps`, devKey);
     const checkData = await checkResp.json();
     if (checkData['#type'] === 'ApiError') {
       color.error(checkData.message);
@@ -614,12 +616,12 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
   });
 
   // Upload
-  url += `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
-  if (suffix) url += `&suffix=${suffix.toString()}`;
+  let query = `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
+  if (suffix) query += `&suffix=${suffix.toString()}`;
   await zip.finalize();
   const zipBuffer = Buffer.concat(chunks);
   try {
-    const body = await (0, _nodeFetch.default)(url, {
+    const body = await (0, _devKey.devKeyFetch)(url + query, legacyUrl + query, devKey, {
       method: 'POST',
       body: zipBuffer
     });

package/bin/utils/dev-key.js

@@ -0,0 +1,31 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.devKeyFetch = devKeyFetch;
+exports.devKeyHeaders = devKeyHeaders;
+const fetch = require('node-fetch');
+
+/** `Authorization` header carrying the developer key. */
+function devKeyHeaders(key, headers = {}) {
+  return {
+    ...headers,
+    'Authorization': `Dev ${key}`
+  };
+}
+
+/**
+ * Calls [url] with the developer key in the `Authorization` header, falling back to
+ * [legacyUrl] - which carries the key as a path segment - for servers that predate the
+ * header form. Those answer 404 (no such route) or 401 (the route-less path is not on
+ * their anonymous allow-list); a server that knows the header form answers neither.
+ */
+async function devKeyFetch(url, legacyUrl, key, init = {}) {
+  const response = await fetch(url, {
+    ...init,
+    headers: devKeyHeaders(key, init.headers)
+  });
+  if (response.status !== 404 && response.status !== 401) return response;
+  return await fetch(legacyUrl, init);
+}

package/bin/utils/migrate/registry.js

@@ -16,6 +16,7 @@ exports.resolveTypes = resolveTypes;
 exports.stripCredentials = stripCredentials;
 exports.typeOptionsOf = typeOptionsOf;
 exports.untransferableReason = untransferableReason;
+var _crypto = require("crypto");
 /// Docs: [Entity export / import](/docs/features/grok-tool/export-import/DESIGN.md)
 
 /** Extra listing rules a `--type` alias adds on top of its entity type. */
@@ -344,6 +345,20 @@ function fileNameFor(json) {
   const cleaned = String(nqName).replace(/[:/\\?*"<>|]+/g, '.').replace(/^\.+|\.+$/g, '');
   // Windows resolves `NUL.json` (and `COM1.csv.json`) to a device, whatever the extension.
   const head = cleaned.split('.')[0];
-  return RESERVED_RE.test(head) ? `${head}-${json.id ?? 'entity'}${cleaned.slice(head.length)}` : cleaned;
+  return shorten(RESERVED_RE.test(head) ? `${head}-${json.id ?? 'entity'}${cleaned.slice(head.length)}` : cleaned);
 }
-const RESERVED_RE = /^(NUL|CON|PRN|AUX|COM[1-9]|LPT[1-9])$/i;
+const RESERVED_RE = /^(NUL|CON|PRN|AUX|COM[1-9]|LPT[1-9])$/i;
+
+/**
+ * A path component caps at 255 bytes on ext4 and NTFS, and a nested view under a long space
+ * reaches that: one TWIG snapshot spelled 268. The write is what fails, so the whole part dies
+ * rather than the entity. The digest keeps a truncated name unique and stable across pulls.
+ */
+const MAX_FILE_NAME = 200;
+function shorten(name) {
+  if (Buffer.byteLength(name) <= MAX_FILE_NAME) return name;
+  const digest = (0, _crypto.createHash)('sha1').update(name).digest('hex').slice(0, 8);
+  let head = name;
+  while (Buffer.byteLength(head) > MAX_FILE_NAME - 9) head = head.slice(0, -1);
+  return `${head}-${digest}`;
+}

package/bin/utils/migrate/registry.ts

@@ -1,4 +1,5 @@
 /// Docs: [Entity export / import](/docs/features/grok-tool/export-import/DESIGN.md)
+import {createHash} from 'crypto';
 
 export type BytesKind = 'tables' | 'files';
 
@@ -249,7 +250,22 @@ export function fileNameFor(json: any): string {
   const cleaned = String(nqName).replace(/[:/\\?*"<>|]+/g, '.').replace(/^\.+|\.+$/g, '');
   // Windows resolves `NUL.json` (and `COM1.csv.json`) to a device, whatever the extension.
   const head = cleaned.split('.')[0];
-  return RESERVED_RE.test(head) ? `${head}-${json.id ?? 'entity'}${cleaned.slice(head.length)}` : cleaned;
+  return shorten(RESERVED_RE.test(head) ? `${head}-${json.id ?? 'entity'}${cleaned.slice(head.length)}` : cleaned);
 }
 
 const RESERVED_RE = /^(NUL|CON|PRN|AUX|COM[1-9]|LPT[1-9])$/i;
+
+/**
+ * A path component caps at 255 bytes on ext4 and NTFS, and a nested view under a long space
+ * reaches that: one TWIG snapshot spelled 268. The write is what fails, so the whole part dies
+ * rather than the entity. The digest keeps a truncated name unique and stable across pulls.
+ */
+const MAX_FILE_NAME = 200;
+
+function shorten(name: string): string {
+  if (Buffer.byteLength(name) <= MAX_FILE_NAME) return name;
+  const digest = createHash('sha1').update(name).digest('hex').slice(0, 8);
+  let head = name;
+  while (Buffer.byteLength(head) > MAX_FILE_NAME - 9) head = head.slice(0, -1);
+  return `${head}-${digest}`;
+}

package/bin/utils/node-dapi.js

@@ -68,7 +68,15 @@ class NodeApiClient {
     this.devKey = devKey;
   }
   static async login(baseUrl, devKey) {
-    const res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
+    // Servers before 1.28 only knew the key-in-URL form, where it leaked into every
+    // access log on the way; they answer 404 or 401 to the key-less route.
+    let res = await fetch(`${baseUrl}/users/login/dev`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Dev ${devKey}`
+      }
+    });
+    if (res.status === 404 || res.status === 401) res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
       method: 'POST'
     });
     const json = (res.headers.get('content-type') ?? '').includes('application/json') ? await res.json() : null;

package/bin/utils/test-utils.js

@@ -35,6 +35,7 @@ var utils = _utils;
 var _puppeteer = _interopRequireDefault(require("puppeteer"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _papaparse = _interopRequireDefault(require("papaparse"));
+var _devKey = require("./dev-key");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const fetch = require('node-fetch');
 const grokDir = _path.default.join(_os.default.homedir(), '.grok');
@@ -57,7 +58,7 @@ async function getToken(url, key) {
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {
-      const response = await fetch(`${url}/users/login/dev/${key}`, {
+      const response = await (0, _devKey.devKeyFetch)(`${url}/users/login/dev`, `${url}/users/login/dev/${key}`, key, {
         method: 'POST'
       });
       const text = await response.text();

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/datagrok-ai/public.git"
   },
-  "version": "6.5.9",
+  "version": "6.6.0",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {