Address PR review: fix existing-group save, auth, and race

- Frontend sends groupName (not groupId UUID) as targetName so
  mode=existing resolves to the right registry directory.
- Remove silent exception swallow in _compute_next_version so
  transient ls() errors no longer fall through to v1 and overwrite
  existing versions.
- Add auth dependencies to save_model_to_registry to match the
  dataset endpoint.
- Eagerly create the destination vN directory as a reservation to
  close the TOCTOU race between version computation and the
  background copy; return 409 on collision.

Author: aliasaria

api/transformerlab/routers/experiment/jobs.py

@@ -1529,15 +1529,12 @@ async def _compute_next_version(group_dir: str) -> str:
 
     highest = 0
     if await storage.exists(group_dir):
-        try:
-            entries = await storage.ls(group_dir, detail=False)
-            for entry in entries:
-                name = entry.rstrip("/").split("/")[-1]
-                match = re.match(r"^v(\d+)$", name)
-                if match:
-                    highest = max(highest, int(match.group(1)))
-        except Exception:
-            pass
+        entries = await storage.ls(group_dir, detail=False)
+        for entry in entries:
+            name = entry.rstrip("/").split("/")[-1]
+            match = re.match(r"^v(\d+)$", name)
+            if match:
+                highest = max(highest, int(match.group(1)))
     return f"v{highest + 1}"
 
 
@@ -1597,6 +1594,16 @@ async def save_dataset_to_registry(
         dest_path = storage.join(datasets_registry_dir, group_name, version_label)
         asset_id = f"{group_name}/{version_label}"
 
+        # Eagerly create the destination directory as a reservation to prevent
+        # concurrent saves from computing the same version label (TOCTOU).
+        try:
+            await storage.makedirs(dest_path, exist_ok=False)
+        except FileExistsError:
+            raise HTTPException(
+                status_code=409,
+                detail=f"Version '{version_label}' for group '{group_name}' already exists — please retry",
+            )
+
         asyncio.create_task(
             _save_dataset_to_registry(
                 job_id=job_id,
@@ -1659,6 +1666,8 @@ async def save_model_to_registry(
     mode: str = Query("new", description="'new' to create a new entry, 'existing' to add version to existing group"),
     tag: str = Query("latest", description="Tag to assign to the new version"),
     description: Optional[str] = Query(None, description="Human-readable description for the version"),
+    user_and_team=Depends(get_user_and_team),
+    session: AsyncSession = Depends(get_async_session),
 ):
     """Copy a model from job's models directory to the global models registry."""
 
@@ -1704,6 +1713,16 @@ async def save_model_to_registry(
         dest_path = storage.join(models_registry_dir, group_name, version_label)
         asset_id = f"{group_name}/{version_label}"
 
+        # Eagerly create the destination directory as a reservation to prevent
+        # concurrent saves from computing the same version label (TOCTOU).
+        try:
+            await storage.makedirs(dest_path, exist_ok=False)
+        except FileExistsError:
+            raise HTTPException(
+                status_code=409,
+                detail=f"Version '{version_label}' for group '{group_name}' already exists — please retry",
+            )
+
         asyncio.create_task(
             _save_model_to_registry(
                 job_id=job_id,

src/renderer/components/Experiment/Tasks/JobArtifacts/DatasetsSection.tsx

@@ -119,7 +119,7 @@ export default function DatasetsSection({
         experimentId: experimentInfo?.id,
         jobId: jobId.toString(),
         datasetName,
-        targetName: info.groupId || info.groupName,
+        targetName: info.groupName,
         mode: info.mode,
         tag: info.tag,
         description: info.description,

src/renderer/components/Experiment/Tasks/JobArtifacts/ModelsSection.tsx

@@ -119,7 +119,7 @@ export default function ModelsSection({
         experimentId: experimentInfo?.id,
         jobId: jobId.toString(),
         modelName,
-        targetName: info.groupId || info.groupName,
+        targetName: info.groupName,
         mode: info.mode,
         tag: info.tag,
         description: info.description,