@skyhook-io/k8s-ui 1.14.0 → 1.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",

package/src/components/gitops/GitOpsTableView.tsx

@@ -10,6 +10,7 @@ import {
   CircleDot,
   GitBranch,
   HeartPulse,
+  Layers,
   LayoutGrid,
   List,
   Pause,
@@ -291,6 +292,10 @@ const GITOPS_FILTER_SCHEMA = defineFilterSchema({
   automation: { param: 'automation', type: 'set' },
   labels: { param: 'labels', type: 'set' },
   lifecycle: { param: 'lifecycle', type: 'single', default: 'all' },
+  // Argo kind names ('Application' | 'ApplicationSet'). An empty set places no
+  // restriction: both are shown, as is every Flux kind, which this filter never
+  // narrows. A non-empty set selects among the Argo kinds only.
+  kind: { param: 'kind', type: 'set' },
 })
 
 export function GitOpsTableView({
@@ -334,7 +339,9 @@ export function GitOpsTableView({
   const labelFilters = filters.values.labels
   const automationFilters = filters.values.automation as Set<'auto' | 'manual' | 'suspended'>
   const lifecycleFilter = filters.values.lifecycle as 'all' | 'terminating' | 'active'
+  const kindFilters = filters.values.kind as Set<'Application' | 'ApplicationSet'>
   const toggleAutomation = useCallback((value: 'auto' | 'manual' | 'suspended') => filters.toggle('automation', value), [filters.toggle])
+  const toggleKind = useCallback((value: 'Application' | 'ApplicationSet') => filters.toggle('kind', value), [filters.toggle])
   const [namespaceFilters, setNamespaceFilters] = useState<Set<string>>(new Set())
   const [showLabelsDropdown, setShowLabelsDropdown] = useState(false)
   const [labelSearch, setLabelSearch] = useState('')
@@ -362,7 +369,8 @@ export function GitOpsTableView({
     namespaceFilters.size > 0 ||
     labelFilters.size > 0 ||
     automationFilters.size > 0 ||
-    lifecycleFilter !== 'all'
+    lifecycleFilter !== 'all' ||
+    kindFilters.size > 0
   const hasGlobalNamespaceFilter = !!onClearNamespaces && (globalNamespaces?.length ?? 0) > 0
   const hasAnyFilter = hasLocalFilters || hasGlobalNamespaceFilter
 
@@ -413,10 +421,17 @@ export function GitOpsTableView({
   )
   const syncCounts = useMemo(() => countMap(allRows.map((row) => row.sync)), [allRows])
   const healthCounts = useMemo(() => countMap(allRows.map((row) => row.health)), [allRows])
-  const automationCounts = useMemo(() => ({
-    auto: allRows.filter((row) => row.autoSync).length,
-    manual: allRows.filter((row) => !row.autoSync).length,
-    suspended: allRows.filter((row) => row.suspended).length,
+  const automationCounts = useMemo(() => {
+    const policyRows = allRows.filter(hasSyncPolicy)
+    return {
+      auto: policyRows.filter((row) => row.autoSync).length,
+      manual: policyRows.filter((row) => !row.autoSync).length,
+      suspended: policyRows.filter((row) => row.suspended).length,
+    }
+  }, [allRows])
+  const kindCounts = useMemo(() => ({
+    Application: allRows.filter((row) => row.kind === 'Application').length,
+    ApplicationSet: allRows.filter((row) => row.kind === 'ApplicationSet').length,
   }), [allRows])
   // The Destination column earns its width only when destinations actually vary
   // — in single-cluster OSS every row is the same in-cluster API server, so the
@@ -459,13 +474,17 @@ export function GitOpsTableView({
       if (projectFilters.size > 0 && !projectFilters.has(row.project || '(none)')) return false
       if (namespaceFilters.size > 0 && !namespaceFilters.has(row.namespace || '(cluster)')) return false
       if (activeLabels.length > 0 && !activeLabels.every(({ key, value }) => row.labels[key] === value)) return false
-      if (automationFilters.size > 0 && !(
+      if (automationFilters.size > 0 && (!hasSyncPolicy(row) || !(
         (automationFilters.has('auto') && row.autoSync) ||
         (automationFilters.has('manual') && !row.autoSync) ||
         (automationFilters.has('suspended') && row.suspended)
-      )) return false
+      ))) return false
       if (lifecycleFilter === 'terminating' && !row.terminating) return false
       if (lifecycleFilter === 'active' && row.terminating) return false
+      // Only constrains Argo Application/ApplicationSet rows — Flux kinds
+      // (Kustomization, HelmRelease) are never affected by this filter, by
+      // design (see GITOPS_FILTER_SCHEMA comment on `kind`).
+      if (kindFilters.size > 0 && (row.kind === 'Application' || row.kind === 'ApplicationSet') && !kindFilters.has(row.kind)) return false
       if (destinationFilter && destinationFilter !== 'all') {
         const match = row._destination?.match
         if (destinationFilter === 'this-cluster' && match !== 'in_cluster') return false
@@ -480,7 +499,7 @@ export function GitOpsTableView({
     })
     const eff = sort ?? { key: 'urgency' as SortKey, dir: 'asc' as SortDir }
     return [...rows].sort((a, b) => compareRows(a, b, eff.key) * (eff.dir === 'asc' ? 1 : -1))
-  }, [allRows, automationFilters, healthFilters, labelFilters, lifecycleFilter, mode, namespaceFilters, projectFilters, search, sort, syncFilters, destinationFilter])
+  }, [allRows, automationFilters, healthFilters, kindFilters, labelFilters, lifecycleFilter, mode, namespaceFilters, projectFilters, search, sort, syncFilters, destinationFilter])
 
   const terminatingCount = useMemo(() => allRows.filter((row) => row.terminating).length, [allRows])
 
@@ -503,6 +522,7 @@ export function GitOpsTableView({
       namespaceFilters.size === 0 &&
       labelFilters.size === 0 &&
       automationFilters.size === 0 &&
+      kindFilters.size === 0 &&
       lifecycleFilter === 'all' &&
       (!destinationFilter || destinationFilter === 'all'),
     [
@@ -513,6 +533,7 @@ export function GitOpsTableView({
       namespaceFilters,
       labelFilters,
       automationFilters,
+      kindFilters,
       lifecycleFilter,
       destinationFilter,
     ],
@@ -665,6 +686,9 @@ export function GitOpsTableView({
         automationFilters={automationFilters}
         automationCounts={automationCounts}
         onToggleAutomation={toggleAutomation}
+        kindFilters={kindFilters}
+        kindCounts={kindCounts}
+        onToggleKind={toggleKind}
         lifecycleFilter={lifecycleFilter}
         onLifecycleFilterChange={(v) => filters.setString('lifecycle', v)}
         terminatingCount={terminatingCount}
@@ -841,6 +865,9 @@ function GitOpsFilterSidebar({
   automationFilters,
   automationCounts,
   onToggleAutomation,
+  kindFilters,
+  kindCounts,
+  onToggleKind,
   lifecycleFilter,
   onLifecycleFilterChange,
   terminatingCount,
@@ -865,6 +892,9 @@ function GitOpsFilterSidebar({
   automationFilters: Set<'auto' | 'manual' | 'suspended'>
   automationCounts: { auto: number; manual: number; suspended: number }
   onToggleAutomation: (value: 'auto' | 'manual' | 'suspended') => void
+  kindFilters: Set<'Application' | 'ApplicationSet'>
+  kindCounts: { Application: number; ApplicationSet: number }
+  onToggleKind: (value: 'Application' | 'ApplicationSet') => void
   lifecycleFilter: 'all' | 'terminating' | 'active'
   onLifecycleFilterChange: (value: 'all' | 'terminating' | 'active') => void
   terminatingCount: number
@@ -940,6 +970,17 @@ function GitOpsFilterSidebar({
           <GitOpsFacetButton label="Unknown" count={healthCounts.get('Unknown') ?? 0} active={healthFilters.has('Unknown')} onClick={() => onToggleHealth('Unknown')} />
         </GitOpsFilterSection>
 
+        {/* Stays rendered while a kind filter is set even if this scope has no
+            ApplicationSets - otherwise the facet vanishes while still hiding
+            every Application, leaving an empty table with nothing on screen to
+            explain it or switch it off. */}
+        {(kindCounts.ApplicationSet > 0 || kindFilters.size > 0) && (
+          <GitOpsFilterSection icon={Layers} title="Kind">
+            <GitOpsFacetButton label="Applications" count={kindCounts.Application} active={kindFilters.has('Application')} onClick={() => onToggleKind('Application')} />
+            <GitOpsFacetButton label="ApplicationSets" count={kindCounts.ApplicationSet} active={kindFilters.has('ApplicationSet')} onClick={() => onToggleKind('ApplicationSet')} />
+          </GitOpsFilterSection>
+        )}
+
         <GitOpsFilterSection icon={CircleDot} title="Automation (Sync policy)">
           <GitOpsFacetButton label="Auto-sync" count={automationCounts.auto} active={automationFilters.has('auto')} onClick={() => onToggleAutomation('auto')} />
           <GitOpsFacetButton label="Manual" count={automationCounts.manual} active={automationFilters.has('manual')} onClick={() => onToggleAutomation('manual')} />
@@ -1327,7 +1368,7 @@ function GitOpsTable({
               {showDestination && (
                 <TableCell>
                   <DestinationCell row={row} onDestinationClick={onDestinationClick} destinationHrefFor={destinationHrefFor} />
-                  <div className="truncate text-xs text-theme-text-tertiary">{row.destinationNamespace || row.namespace || '-'}</div>
+                  <div className="truncate text-xs text-theme-text-tertiary">{destinationNamespaceLabel(row) || '-'}</div>
                 </TableCell>
               )}
               <TableCell>
@@ -1370,7 +1411,13 @@ function buildRowActionItems(
   const suspendedReason = 'Cannot sync while suspended. Resume first.'
   const items: RowActionItem[] = []
 
-  if (row.tool === 'argo') {
+  // Gate on the kind, not the tool. Every action below posts to
+  // /argo/applications/{namespace}/{name}, which resolves the name against the
+  // Application GVR - so offering them on any other argoproj.io kind either
+  // 404s or, when an Application happens to share the name, mutates that
+  // unrelated Application instead. The detail page gates the same actions the
+  // same way.
+  if (row.kindName === 'applications') {
     const operationInProgress = isArgoOperationInProgress(row.raw)
     items.push({
       key: 'sync',
@@ -1445,6 +1492,7 @@ function buildRowActionItems(
   }
 
   // Flux (Kustomization / HelmRelease)
+  if (row.tool !== 'flux') return items
   items.push({
     key: 'reconcile',
     label: 'Reconcile',
@@ -1521,7 +1569,7 @@ function GitOpsTile({
   const lastSyncRaw = row.lastSync || row.createdAt
   const recencyClass = recencyTone(lastSyncRaw)
   const dest = row.destination ? compactClusterURL(row.destination) : ''
-  const ns = row.destinationNamespace || row.namespace
+  const ns = destinationNamespaceLabel(row)
   const tileClass = clsx(
     'group relative flex min-w-0 flex-col overflow-hidden rounded-md border border-theme-border bg-theme-surface text-left shadow-theme-sm transition-all hover:border-theme-text-tertiary/40 hover:shadow-theme-md focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-theme-text-primary/20',
     row.terminating && 'opacity-80',
@@ -1732,6 +1780,25 @@ export function summarizeGitOpsRows(rows: GitOpsRow[]) {
   )
 }
 
+// hasSyncPolicy answers whether the Automation (sync policy) facet means
+// anything for a row. An ApplicationSet never syncs - it generates
+// Applications, and the policy on its template belongs to those. Counting it
+// as Manual would answer "what is not auto-syncing" with objects that were
+// never going to sync in the first place.
+// destinationNamespaceLabel resolves what to show under a row's destination.
+// Falling back to the row's own namespace suits a resource that lives beside
+// what it deploys. An ApplicationSet sits in the controller namespace and
+// generates Applications that land somewhere else, so that fallback would name
+// a namespace it never deploys to.
+export function destinationNamespaceLabel(row: GitOpsRow): string {
+  if (row.destinationNamespace) return row.destinationNamespace
+  return row.kind === 'ApplicationSet' ? '' : row.namespace
+}
+
+export function hasSyncPolicy(row: GitOpsRow): boolean {
+  return row.kind !== 'ApplicationSet'
+}
+
 // Natural direction per column, used the first time a column is clicked: the
 // urgency-ordered facets default ascending (most-urgent first); recency defaults
 // to newest-first.
@@ -1930,6 +1997,96 @@ export function normalizeArgoApplication(resource: any): GitOpsRow {
   }
 }
 
+// An ApplicationSet is a generator, not a deployed app — it has no sync/health
+// of its own in the sense the fleet table shows for Applications. Its own
+// status.conditions use a different vocabulary (ErrorOccurred,
+// ParametersGenerated, ResourcesUpToDate — never Ready), so the generic
+// getGitOpsResourceStatus fallback below correctly bottoms out at
+// Unknown/Unknown rather than us inventing a fleet-health rollup from
+// generator-run conditions that don't mean what a Synced/Healthy chip implies.
+// An ApplicationSet's template fields may carry generator placeholders
+// ({{path}}, {{cluster.name}}, …) that only resolve per generated Application.
+// Rendering the raw placeholder is worse than rendering nothing, so a value is
+// only surfaced when it is literal.
+function resolvedTemplateValue(value: unknown): string {
+  if (typeof value !== 'string' || value.includes('{{')) return ''
+  return value
+}
+
+export function normalizeArgoApplicationSet(resource: any): GitOpsRow {
+  const status = getGitOpsResourceStatus('applicationsets', resource)
+  const templateSpec = resource.spec?.template?.spec ?? {}
+  // Destination is templated as often as the source is ({{server}},
+  // {{cluster.name}}), and a cluster generator templates it by definition.
+  const dest = resolvedTemplateValue(templateSpec.destination?.server)
+    || resolvedTemplateValue(templateSpec.destination?.name)
+  // The source the generated Applications deploy from lives on the template.
+  // A git generator's repo is a different thing - it is scanned to produce
+  // parameters and is often not a deployment source at all - so it is only a
+  // fallback for templates that carry no literal source of their own.
+  const templateSource = templateSpec.source ?? {}
+  const gitGenerator = (resource.spec?.generators ?? []).find((g: any) => g?.git)?.git
+  // Repo, revision and path are taken from one place or the other, never
+  // mixed. A template repo paired with a generator's path would name a tree
+  // that exists in neither, which reads as a real location and is not one.
+  //
+  // The branch turns on whether the template declares a source at all, not on
+  // whether that source resolved. A template whose repoURL is itself a
+  // placeholder still means "the generated Applications deploy from here", so
+  // falling back would present the generator's own tree as the deployed one.
+  // Multi-source templates take the same branch and render blank, matching
+  // what the rest of the view does with spec.sources.
+  const fromTemplate = templateSpec.source != null || Array.isArray(templateSpec.sources)
+  const repository = fromTemplate ? resolvedTemplateValue(templateSource.repoURL) : (gitGenerator?.repoURL ?? '')
+  const targetRevision = fromTemplate
+    ? resolvedTemplateValue(templateSource.targetRevision)
+    : (gitGenerator?.revision ?? '')
+  const path = fromTemplate
+    ? resolvedTemplateValue(templateSource.path)
+    : (resolvedTemplateValue(gitGenerator?.directories?.[0]?.path)
+      || resolvedTemplateValue(gitGenerator?.files?.[0]?.path))
+  return {
+    id: `argo/applicationsets/${resource.metadata?.namespace ?? ''}/${resource.metadata?.name ?? ''}`,
+    mode: 'applications',
+    tool: 'argo',
+    kindName: 'applicationsets',
+    kind: 'ApplicationSet',
+    group: 'argoproj.io',
+    name: resource.metadata?.name ?? '',
+    namespace: resource.metadata?.namespace ?? '',
+    // The project every generated Application lands in, when the template
+    // names one literally. A templated project varies per generated app, so
+    // it resolves to blank rather than to a placeholder.
+    project: resolvedTemplateValue(templateSpec.project),
+    labels: (resource.metadata?.labels ?? {}) as Record<string, string>,
+    sync: status?.sync ?? 'Unknown',
+    health: status?.health ?? 'Unknown',
+    reconciling: status?.reconciling,
+    reconcilingSince: status?.reconcilingSince,
+    suspended: false,
+    repository,
+    targetRevision,
+    path,
+    chart: fromTemplate ? resolvedTemplateValue(templateSource.chart) : '',
+    destination: dest,
+    destinationNamespace: resolvedTemplateValue(templateSpec.destination?.namespace),
+    createdAt: resource.metadata?.creationTimestamp ?? '',
+    // When the generator last ran, taken from the condition that reported it.
+    // Left empty the Last Sync column falls back to the creation timestamp,
+    // which dates the object rather than any activity on it.
+    lastSync: status?.lastSyncTime ?? '',
+    // An ApplicationSet has no sync policy of its own; the template's policy
+    // belongs to the Applications it generates. Automation counts and the
+    // sync-policy filter skip this kind rather than read this field.
+    autoSync: false,
+    terminating: isTerminating(resource),
+    terminationStartedAt: terminationStartedAt(resource),
+    raw: resource,
+    _cluster: resource._cluster,
+    _destination: resource._destination,
+  }
+}
+
 export function normalizeFluxKustomization(resource: any, fluxSourceUrls?: Map<string, string>): GitOpsRow {
   const status = getGitOpsResourceStatus('kustomizations', resource)
   const sourceName = resource.spec?.sourceRef?.name ?? ''

package/src/components/gitops/applicationset-row.test.ts

@@ -0,0 +1,214 @@
+import { describe, test, expect } from 'vitest'
+
+import { destinationNamespaceLabel, hasSyncPolicy, normalizeArgoApplicationSet, normalizeArgoApplication } from './GitOpsTableView'
+
+// Mirrors scripts/gitops-demo/05-argo-applicationset.yaml: a list generator,
+// so nothing about the deployed source is discoverable from the generator.
+const listGeneratorSet = {
+  metadata: { name: 'radar-demo-set', namespace: 'argocd', creationTimestamp: '2026-01-01T00:00:00Z' },
+  spec: {
+    generators: [{ list: { elements: [{ name: 'vanilla', path: 'guestbook' }] } }],
+    template: {
+      spec: {
+        project: 'radar-demo',
+        source: { repoURL: 'https://github.com/argoproj/argocd-example-apps', targetRevision: 'HEAD', path: '{{path}}' },
+        destination: { server: 'https://kubernetes.default.svc', namespace: 'demo-set' },
+        syncPolicy: { automated: { prune: true, selfHeal: true } },
+      },
+    },
+  },
+  status: { conditions: [{ type: 'ResourcesUpToDate', status: 'True' }] },
+}
+
+describe('normalizeArgoApplicationSet source and project', () => {
+  // The source the generated Applications deploy from lives on the template.
+  // List, cluster and SCM generators carry no repo at all, so the template is
+  // the only place it can come from for those.
+  test('reads the repo from the template, not the generator', () => {
+    const row = normalizeArgoApplicationSet(listGeneratorSet)
+    expect(row.repository).toBe('https://github.com/argoproj/argocd-example-apps')
+    expect(row.targetRevision).toBe('HEAD')
+  })
+
+  // A templated value only resolves per generated Application, so the literal
+  // "{{path}}" would be noise in the Source column.
+  test('blanks a templated path rather than printing the placeholder', () => {
+    expect(normalizeArgoApplicationSet(listGeneratorSet).path).toBe('')
+  })
+
+  test('reads a literal project from the template', () => {
+    expect(normalizeArgoApplicationSet(listGeneratorSet).project).toBe('radar-demo')
+  })
+
+  test('blanks a templated project', () => {
+    const templated = structuredClone(listGeneratorSet)
+    templated.spec.template.spec.project = '{{cluster.name}}'
+    expect(normalizeArgoApplicationSet(templated).project).toBe('')
+  })
+
+  // A git generator's repo is scanned for parameters, not necessarily deployed
+  // from. It stays available for templates that carry no literal source.
+  test('falls back to the git generator when the template has no source', () => {
+    const gitGen: any = structuredClone(listGeneratorSet)
+    delete gitGen.spec.template.spec.source
+    gitGen.spec.generators = [{ git: { repoURL: 'https://github.com/org/infra', revision: 'main', directories: [{ path: 'apps/prod' }] } }]
+    const row = normalizeArgoApplicationSet(gitGen)
+    expect(row.repository).toBe('https://github.com/org/infra')
+    expect(row.targetRevision).toBe('main')
+    expect(row.path).toBe('apps/prod')
+  })
+
+  // A glob is how git-generator directories are normally written, and it is a
+  // real literal - not a per-app placeholder - so it survives.
+  test('keeps a directory glob from the git generator', () => {
+    const gitGen: any = structuredClone(listGeneratorSet)
+    delete gitGen.spec.template.spec.source
+    gitGen.spec.generators = [{ git: { repoURL: 'https://github.com/org/infra', directories: [{ path: 'apps/*' }] } }]
+    expect(normalizeArgoApplicationSet(gitGen).path).toBe('apps/*')
+  })
+
+  test('a set with neither template source nor git generator stays blank', () => {
+    const bare: any = structuredClone(listGeneratorSet)
+    delete bare.spec.template.spec.source
+    const row = normalizeArgoApplicationSet(bare)
+    expect(row.repository).toBe('')
+    expect(row.path).toBe('')
+  })
+})
+
+describe('hasSyncPolicy', () => {
+  // The Automation facet answers "what is not auto-syncing". An ApplicationSet
+  // never syncs, so counting it as Manual puts objects in that answer that
+  // were never going to sync.
+  test('an ApplicationSet has no sync policy of its own', () => {
+    expect(hasSyncPolicy(normalizeArgoApplicationSet(listGeneratorSet))).toBe(false)
+  })
+
+  test('an Application does', () => {
+    const app = normalizeArgoApplication({
+      metadata: { name: 'guestbook', namespace: 'argocd' },
+      spec: { project: 'default', source: {}, destination: {}, syncPolicy: { automated: {} } },
+      status: {},
+    })
+    expect(hasSyncPolicy(app)).toBe(true)
+  })
+})
+
+describe('normalizeArgoApplicationSet destination', () => {
+  // A cluster generator templates the destination by definition. Rendering
+  // "{{server}}" in the Destination column is the same class of noise as a
+  // templated path, and the table shows a dash for an empty destination.
+  test('blanks a templated destination server', () => {
+    const clusterGen = structuredClone(listGeneratorSet)
+    clusterGen.spec.template.spec.destination = { server: '{{server}}', namespace: 'demo-set' } as any
+    const row = normalizeArgoApplicationSet(clusterGen)
+    expect(row.destination).toBe('')
+    expect(row.destinationNamespace).toBe('demo-set')
+  })
+
+  test('keeps a literal destination server', () => {
+    expect(normalizeArgoApplicationSet(listGeneratorSet).destination).toBe('https://kubernetes.default.svc')
+  })
+
+  test('blanks a templated destination namespace', () => {
+    const templatedNs = structuredClone(listGeneratorSet)
+    templatedNs.spec.template.spec.destination = { server: 'https://kubernetes.default.svc', namespace: '{{ns}}' } as any
+    expect(normalizeArgoApplicationSet(templatedNs).destinationNamespace).toBe('')
+  })
+})
+
+describe('normalizeArgoApplicationSet last activity', () => {
+  // The Last Sync column falls back to the creation timestamp when this is
+  // empty, which would date the object rather than report activity on it.
+  test('carries the condition transition time, not the creation time', () => {
+    const withTime = structuredClone(listGeneratorSet)
+    withTime.metadata.creationTimestamp = '2026-01-01T00:00:00Z'
+    withTime.status.conditions = [
+      { type: 'ResourcesUpToDate', status: 'True', lastTransitionTime: '2026-06-15T09:30:00Z' },
+    ] as any
+    expect(normalizeArgoApplicationSet(withTime).lastSync).toBe('2026-06-15T09:30:00Z')
+  })
+
+  test('a failing generator reports when it failed', () => {
+    const failed = structuredClone(listGeneratorSet)
+    failed.status.conditions = [
+      { type: 'ErrorOccurred', status: 'True', message: 'boom', lastTransitionTime: '2026-06-15T10:00:00Z' },
+    ] as any
+    expect(normalizeArgoApplicationSet(failed).lastSync).toBe('2026-06-15T10:00:00Z')
+  })
+})
+
+describe('source is taken from one place, never mixed', () => {
+  // A template repo paired with a git generator's path would name a tree that
+  // exists in neither the generated Application nor the generator.
+  test('a literal template repo does not borrow the generator path', () => {
+    const mixed: any = structuredClone(listGeneratorSet)
+    mixed.spec.template.spec.source = { repoURL: 'https://github.com/org/deploy', path: '{{path}}' }
+    mixed.spec.generators = [{ git: { repoURL: 'https://github.com/org/config', revision: 'main', directories: [{ path: 'apps/*' }] } }]
+    const row = normalizeArgoApplicationSet(mixed)
+    expect(row.repository).toBe('https://github.com/org/deploy')
+    expect(row.path).toBe('')
+    expect(row.targetRevision).toBe('')
+  })
+
+  test('with no literal template repo the generator supplies all three', () => {
+    const gen: any = structuredClone(listGeneratorSet)
+    delete gen.spec.template.spec.source
+    gen.spec.generators = [{ git: { repoURL: 'https://github.com/org/config', revision: 'main', directories: [{ path: 'apps/*' }] } }]
+    const row = normalizeArgoApplicationSet(gen)
+    expect(row.repository).toBe('https://github.com/org/config')
+    expect(row.targetRevision).toBe('main')
+    expect(row.path).toBe('apps/*')
+  })
+})
+
+describe('destinationNamespaceLabel', () => {
+  // An ApplicationSet lives in the controller namespace and deploys elsewhere,
+  // so naming its own namespace as the destination would be a real-looking
+  // value that is simply wrong.
+  test('an ApplicationSet with a templated namespace resolves to nothing', () => {
+    const templatedNs: any = structuredClone(listGeneratorSet)
+    templatedNs.spec.template.spec.destination = { server: 'https://kubernetes.default.svc', namespace: '{{ns}}' }
+    expect(destinationNamespaceLabel(normalizeArgoApplicationSet(templatedNs))).toBe('')
+  })
+
+  test('a literal namespace is used as-is', () => {
+    expect(destinationNamespaceLabel(normalizeArgoApplicationSet(listGeneratorSet))).toBe('demo-set')
+  })
+
+  test('an Application still falls back to its own namespace', () => {
+    const app = normalizeArgoApplication({
+      metadata: { name: 'guestbook', namespace: 'argocd' },
+      spec: { project: 'default', source: {}, destination: {} },
+      status: {},
+    })
+    expect(destinationNamespaceLabel(app)).toBe('argocd')
+  })
+})
+
+describe('a declared template source claims the row even when unresolved', () => {
+  // A templated repoURL still means "the generated Applications deploy from
+  // here". Falling back would present the generator's own tree as the
+  // deployed one.
+  test('a fully templated template source does not fall back to the generator', () => {
+    const templatedRepo: any = structuredClone(listGeneratorSet)
+    templatedRepo.spec.template.spec.source = { repoURL: '{{url}}', targetRevision: '{{rev}}', path: '{{path}}' }
+    templatedRepo.spec.generators = [{ git: { repoURL: 'https://github.com/org/config', revision: 'main', directories: [{ path: 'apps/*' }] } }]
+    const row = normalizeArgoApplicationSet(templatedRepo)
+    expect(row.repository).toBe('')
+    expect(row.targetRevision).toBe('')
+    expect(row.path).toBe('')
+  })
+
+  // Multi-source is unrendered across this view, so a sources-only template
+  // reads blank rather than borrowing the generator.
+  test('a multi-source template does not fall back to the generator', () => {
+    const multi: any = structuredClone(listGeneratorSet)
+    delete multi.spec.template.spec.source
+    multi.spec.template.spec.sources = [{ repoURL: 'https://github.com/org/a', path: 'x' }]
+    multi.spec.generators = [{ git: { repoURL: 'https://github.com/org/config', directories: [{ path: 'apps/*' }] } }]
+    const row = normalizeArgoApplicationSet(multi)
+    expect(row.repository).toBe('')
+    expect(row.path).toBe('')
+  })
+})

package/src/components/gitops/detail-helpers.test.ts

@@ -3,6 +3,7 @@ import { describe, test, expect } from 'vitest'
 import {
   formatGitOpsDestination,
   formatGitOpsSourceUrl,
+  getGitOpsResourceStatus,
   getGitOpsTool,
   parseArgoRollbackID,
 } from './detail-helpers'
@@ -95,3 +96,56 @@ describe('getGitOpsTool', () => {
     expect(getGitOpsTool('somecustomresource', 'unknown.io')).toBe('flux')
   })
 })
+
+describe('getGitOpsResourceStatus - ApplicationSet', () => {
+  // An ApplicationSet reports through ErrorOccurred / ParametersGenerated /
+  // ResourcesUpToDate and never sets Ready. Routed to the Flux reader - which
+  // looks for Ready - every one of these cases collapses to Unknown, and a
+  // generator that is failing outright reads exactly like a healthy one.
+  const appSet = (conditions: Array<Record<string, string>>) => ({
+    status: { conditions },
+  })
+
+  test('a failed generator is Degraded, not Unknown', () => {
+    const status = getGitOpsResourceStatus('applicationsets', appSet([
+      { type: 'ErrorOccurred', status: 'True', message: 'error generating params from git' },
+      { type: 'ResourcesUpToDate', status: 'False', reason: 'ErrorOccurred' },
+    ]))
+    expect(status?.health).toBe('Degraded')
+    expect(status?.message).toBe('error generating params from git')
+  })
+
+  test('a generator that produced its Applications is Healthy', () => {
+    const status = getGitOpsResourceStatus('applicationsets', appSet([
+      { type: 'ResourcesUpToDate', status: 'True', reason: 'ApplicationSetUpToDate' },
+      { type: 'ParametersGenerated', status: 'True', reason: 'ParametersGenerated' },
+    ]))
+    expect(status?.health).toBe('Healthy')
+  })
+
+  test('no conditions yet is Unknown', () => {
+    expect(getGitOpsResourceStatus('applicationsets', appSet([]))?.health).toBe('Unknown')
+  })
+
+  // Sync answers "is the declared state applied". An ApplicationSet applies
+  // nothing - it generates Applications, each of which carries its own sync.
+  // Unknown is the honest answer in every case, including the healthy one.
+  test('sync stays Unknown regardless of health', () => {
+    expect(getGitOpsResourceStatus('applicationsets', appSet([
+      { type: 'ResourcesUpToDate', status: 'True' },
+    ]))?.sync).toBe('Unknown')
+    expect(getGitOpsResourceStatus('applicationsets', appSet([
+      { type: 'ErrorOccurred', status: 'True', message: 'boom' },
+    ]))?.sync).toBe('Unknown')
+  })
+
+  // ErrorOccurred=False is the steady state of a working generator; only
+  // status 'True' means a fault.
+  test('ErrorOccurred=False does not count as a fault', () => {
+    const status = getGitOpsResourceStatus('applicationsets', appSet([
+      { type: 'ErrorOccurred', status: 'False' },
+      { type: 'ResourcesUpToDate', status: 'True' },
+    ]))
+    expect(status?.health).toBe('Healthy')
+  })
+})

package/src/components/gitops/detail-helpers.ts

@@ -1,4 +1,4 @@
-import { argoStatusToGitOpsStatus, fluxConditionsToGitOpsStatus, type FluxCondition, type GitOpsStatus } from '../../types/gitops'
+import { argoApplicationSetConditionsToGitOpsStatus, argoStatusToGitOpsStatus, fluxConditionsToGitOpsStatus, type FluxCondition, type GitOpsStatus } from '../../types/gitops'
 import { formatCompactAge } from '../../utils/format'
 
 // =============================================================================
@@ -91,14 +91,24 @@ export function describeGitOpsTerminating(summary?: {
   }
 }
 
-// getGitOpsResourceStatus dispatches sync/health extraction by tool. Argo
-// reads from .status (rich operationState + sync state); Flux reads from
+// getGitOpsResourceStatus dispatches sync/health extraction by kind. Argo
+// Applications read from .status (rich operationState + sync state); Argo
+// ApplicationSets read their own generator conditions; Flux kinds read
 // .status.conditions + .spec.suspend. Returns null if the resource has
 // no recognizable status (e.g. just-created, status not yet populated).
 export function getGitOpsResourceStatus(kind: string, resource: any): GitOpsStatus | null {
   if (kind === 'applications') {
     return argoStatusToGitOpsStatus(resource?.status ?? {})
   }
+  // ApplicationSets carry Argo's generator conditions, not Flux's. Without
+  // this they fall through to the Flux reader below, which looks for Ready /
+  // Reconciling / Stalled, finds none, and reports a failing generator as
+  // Unknown.
+  if (kind === 'applicationsets') {
+    return argoApplicationSetConditionsToGitOpsStatus(
+      (resource?.status?.conditions ?? []) as FluxCondition[]
+    )
+  }
   const conditions = (resource?.status?.conditions ?? []) as FluxCondition[]
   return fluxConditionsToGitOpsStatus(conditions, resource?.spec?.suspend === true, {
     generation: resource?.metadata?.generation,

package/src/components/gitops/index.ts

@@ -15,6 +15,7 @@ export {
   shortClusterName,
   summarizeGitOpsRows,
   normalizeArgoApplication,
+  normalizeArgoApplicationSet,
   normalizeFluxKustomization,
   normalizeFluxHelmRelease,
   buildFluxSourceUrlMap,

package/src/components/gitops/tree/GitOpsTreeGraph.tsx

@@ -582,6 +582,13 @@ const GitOpsResourceNode = memo(function GitOpsResourceNode({ data }: NodeProps<
           // border lift telegraphs "this responds to clicks" without
           // looking like a primary action.
           node.role === 'group' && 'cursor-pointer hover:border-theme-text-tertiary/50 hover:bg-theme-hover',
+          // The root node is this page's own subject, so it deliberately
+          // skips the portal ring/tool-badge above (clicking it can't
+          // "dive into" anything — it's already the page you're on). It's
+          // still clickable — opens the standard resource drawer — so it
+          // gets its own quieter affordance: a hover ring, no ring at rest,
+          // so it doesn't visually compete with real portal children.
+          node.role === 'root' && !data.highlighted && 'cursor-pointer hover:ring-1 hover:ring-theme-text-tertiary/40',
         )}
         style={{ width: dim.width, minHeight: dim.height, borderLeftWidth: 4 }}
       >