@skyhook-io/k8s-ui 1.14.10 → 1.14.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.14.10",
+  "version": "1.14.12",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",
@@ -19,6 +19,7 @@
       "./src/components/resources/*.ts",
       "./src/components/resources/*.tsx"
     ],
+    "./components/resources/KueueAdmissionSection": "./src/components/resources/KueueAdmissionSection.tsx",
     "./components/resources/renderers/*": [
       "./src/components/resources/renderers/*.tsx",
       "./src/components/resources/renderers/*.ts"
@@ -88,7 +89,7 @@
     "yaml": ">=2.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.6.2",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@xterm/addon-fit": "^0.11.0",
@@ -98,6 +99,7 @@
     "clsx": "^2.1.1",
     "diff": "^9.0.0",
     "elkjs": "^0.11.1",
+    "jsdom": "^29.1.1",
     "lucide-react": "^1.37.0",
     "monaco-editor": "0.55.1",
     "react": "^19.3.0",

package/src/components/applications/ApplicationDetail.tsx

@@ -37,12 +37,14 @@ import { EmptyState } from "../ui/EmptyState";
 import { ResourceRefBadge } from "../ui/drawer-components";
 import { TopologyGraph } from "../topology/TopologyGraph";
 import { pluralize } from "../../utils/pluralize";
+import { canonicalResourceGroup } from "../../utils/api-resources";
 import { kindToPluralWithGroup, refToSelectedResource } from "../../utils/navigation";
 import {
   batchRunParentNodes,
   tagWorkloadOwnership,
   seedNodeIds,
   ownershipOf,
+  topologyNodeResourceKind,
   workloadKey,
   type NeighborhoodSeed,
 } from "../../utils/topology-neighborhood";
@@ -534,9 +536,14 @@ export function ApplicationDetail({
         return;
       }
       const ns = (node.data?.namespace as string) || "";
+      const resourceKind = topologyNodeResourceKind(node);
+      const group = topologyGroup(node);
       const match = workloads.find(
         (w) =>
-          w.kind === node.kind && w.name === node.name && w.namespace === ns,
+          w.kind === resourceKind &&
+          canonicalResourceGroup(w.kind, w.group) === canonicalResourceGroup(resourceKind, group) &&
+          w.name === node.name &&
+          w.namespace === ns,
       );
       if (match) {
         setSelected(workloadKey(match));
@@ -545,9 +552,12 @@ export function ApplicationDetail({
       const parents = appGraph ? batchRunParentNodes(appGraph, node) : [];
       const parentWorkload = parents.flatMap((parent) => {
         const parentNamespace = (parent.data?.namespace as string) || "";
+        const parentKind = topologyNodeResourceKind(parent);
+        const parentGroup = topologyGroup(parent);
         const workload = workloads.find(
           (candidate) =>
-            candidate.kind === parent.kind &&
+            candidate.kind === parentKind &&
+            canonicalResourceGroup(candidate.kind, candidate.group) === canonicalResourceGroup(parentKind, parentGroup) &&
             candidate.name === parent.name &&
             candidate.namespace === parentNamespace,
         );
@@ -557,9 +567,8 @@ export function ApplicationDetail({
         onSelectWorkloadRun(parentWorkload, node);
         return;
       }
-      const group = topologyGroup(node);
       onNavigateToResource?.({
-        kind: kindToPluralWithGroup(node.kind, group ?? ""),
+        kind: kindToPluralWithGroup(resourceKind, group ?? ""),
         namespace: ns,
         name: node.name,
         group,
@@ -2446,14 +2455,18 @@ function ApplicationHistoryLine({
   onNavigateToResource?: (resource: ResourceRef) => void;
   onOpenSource?: (source: AppSourceRef) => void;
 }) {
-  const workload = item.resource
-    ? workloads.find(
-        (candidate) =>
-          candidate.kind.toLowerCase() === item.resource!.kind.toLowerCase() &&
-          candidate.namespace === item.resource!.namespace &&
-          candidate.name === item.resource!.name,
-      )
+  const candidates = item.resource
+    ? workloads.filter(candidate =>
+        candidate.kind.toLowerCase() === item.resource!.kind.toLowerCase() &&
+        candidate.namespace === item.resource!.namespace &&
+        candidate.name === item.resource!.name)
+    : [];
+  const resourceGroup = item.resource
+    ? canonicalResourceGroup(item.resource.kind, item.resource.group)
     : undefined;
+  const workload = resourceGroup !== undefined
+    ? candidates.find(candidate => canonicalResourceGroup(candidate.kind, candidate.group) === resourceGroup)
+    : candidates.length === 1 ? candidates[0] : undefined;
   const Icon =
     item.category === "deployment"
       ? GitCommit

package/src/components/audit/AuditAlerts.tsx

@@ -7,9 +7,7 @@ import { Collapse, CollapseChevron, useDisclosure } from '../ui/Collapse'
 
 export interface AuditFinding {
   kind: string
-  /** API group, backfilled by the backend from the builtin Kind→group table
-   *  (built-ins → e.g. "apps"/"batch"; CRDs → ""). Part of the resource key
-   *  used to join findings onto topology nodes / list rows. */
+  /** Actual API group; part of the identity joining findings to topology nodes and list rows. */
   group?: string
   namespace: string
   name: string

package/src/components/audit/AuditCoveragePresentation.test.tsx

@@ -36,10 +36,56 @@ describe('audit coverage presentation', () => {
       )
       expect(html).toContain(expected)
       if (missingInputs.length) {
-        expect(html).toContain('Unavailable inputs:')
-        expect(html).toContain('secrets')
+        expect(html).toContain('Unavailable inputs (')
+        expect(html).toContain('Secret')
         expect(html).not.toContain('Every audited resource passed')
       }
     })
   }
 })
+
+describe('replica placement coverage explanation', () => {
+  for (const inputs of [['replicasets'], ['replicaset-ownership'], ['replicasets', 'replicaset-ownership', 'secrets']]) {
+    it(`names the unevaluated check for ${inputs.join(', ')}`, () => {
+      const html = renderToString(
+        <FilterLocationProvider value={{ searchParams: new URLSearchParams(), update: () => {} }}>
+          <ChecksView checks={[]} catalog={{}} anyData evaluated={0} missingInputs={inputs} />
+        </FilterLocationProvider>,
+      )
+      expect(html).toContain('Running replicas on same node')
+      expect(html).toContain('could not be fully evaluated')
+      expect(html).toContain('affected Deployments were skipped, not passed')
+      expect(html).toContain('No findings in the available data')
+      expect(html).not.toContain('replicaset-ownership')
+      if (inputs.includes('replicasets')) expect(html).toContain('ReplicaSet')
+      if (inputs.includes('replicaset-ownership')) expect(html).toContain('ReplicaSet ownership')
+    })
+  }
+  it('does not imply missing replica evidence for unrelated unavailable inputs', () => {
+    const html = renderToString(
+      <FilterLocationProvider value={{ searchParams: new URLSearchParams(), update: () => {} }}>
+        <ChecksView checks={[]} catalog={{}} anyData evaluated={4} missingInputs={['secrets']} />
+      </FilterLocationProvider>,
+    )
+    expect(html).toContain('Unavailable inputs (')
+    expect(html).toContain('Secret')
+    expect(html).not.toContain('Running replicas on same node')
+    expect(html).not.toContain('skipped, not passed')
+  })
+})
+
+
+describe('unavailable input details', () => {
+  it('keeps a long input list collapsed with readable kinds and preserves unknown reasons', () => {
+    const html = renderToString(
+      <FilterLocationProvider value={{ searchParams: new URLSearchParams(), update: () => {} }}>
+        <ChecksView checks={[]} catalog={{}} anyData evaluated={0}
+          missingInputs={['serviceaccounts', 'horizontalpodautoscalers', 'limitranges', 'poddisruptionbudgets', 'configmap-references', 'secret-references', 'unrecognized-input']} />
+      </FilterLocationProvider>,
+    )
+    expect(html).toContain('Unavailable inputs (7)')
+    expect(html).toContain('aria-expanded="false"')
+    expect(html).toContain('ServiceAccount, HorizontalPodAutoscaler, LimitRange, PodDisruptionBudget, ConfigMap references, Secret references, unrecognized-input')
+    expect(html).not.toContain('Every audited resource passed')
+  })
+})

package/src/components/checks/ChecksView.test.tsx

@@ -0,0 +1,55 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+import { ChecksView } from './ChecksView'
+import type { Check, EffectiveCheckFinding } from './types'
+
+function check(messages: string[], cluster = 'one'): Check {
+  const findings: EffectiveCheckFinding[] = messages.map((message, i) => ({
+    source: 'radar_builtin',
+    resource: { cluster_id: cluster, group: '', kind: 'Secret', namespace: 'test', name: `cert-${i}` },
+    checkID: 'tlsCertificateExpiry', category: 'Reliability', originalSeverity: 'danger',
+    effectiveSeverity: 'high', message,
+    state: { visibility: 'visible', source: 'detector_default', scoreImpact: 'counts', alertImpact: 'alerts', complianceImpact: 'counts' },
+  }))
+  return {
+    id: cluster, source: 'radar_builtin', subject: findings[0].resource,
+    checkID: 'tlsCertificateExpiry', category: 'Reliability', effectiveSeverity: 'high',
+    title: 'TLS certificate expiring', message: messages[0], affectedFindings: findings.length,
+    affectedResources: findings.length, representativeFinding: findings[0], findings,
+  }
+}
+
+function render(checks: Check[]) {
+  return renderToStaticMarkup(<ChecksView checks={checks} catalog={{}} anyData clusterLabel={(c) => c.subject.cluster_id} />)
+}
+
+const deadline = 'TLS certificate expires in 2d (2026-09-22T12:00:00Z)'
+
+describe('finding evidence', () => {
+  it.each([1, 2])('preserves common evidence once for %i findings', (count) => {
+    expect(render([check(Array(count).fill(deadline))]).split(deadline)).toHaveLength(2)
+  })
+
+  it('preserves distinct evidence, including messages that differ only by resource name', () => {
+    const messages = ['cert-0 expires tomorrow', 'cert-1 expires tomorrow']
+    const html = render([check(messages)])
+    for (const message of messages) expect(html).toContain(message)
+  })
+
+  it('preserves the nonempty evidence in a mixed empty list', () => {
+    expect(render([check(['', deadline])])).toContain(deadline)
+    expect(render([check(['', ''])])).not.toContain('whitespace-pre-wrap')
+  })
+
+  it('compares hidden findings too instead of applying the first deadline to the whole list', () => {
+    const html = render([check([...Array(8).fill(deadline), 'A different deadline'])])
+    expect(html.split(deadline)).toHaveLength(9)
+    expect(html).toContain('View all 9')
+  })
+
+  it('keeps common evidence within each cluster group', () => {
+    const html = render([check([deadline, deadline], 'one'), check(['Different cluster deadline'], 'two')])
+    expect(html.split(deadline)).toHaveLength(2)
+    expect(html).toContain('Different cluster deadline')
+  })
+})

package/src/components/checks/ChecksView.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useId, useMemo, useRef, useState, type ComponentType, type ReactNode } from 'react'
 import { createPortal } from 'react-dom'
 import { AlertCircle, AlertOctagon, AlertTriangle, ChevronDown, ExternalLink, EyeOff, Info, Layers, MoreHorizontal, Search, ShieldCheck, Wrench, X } from 'lucide-react'
-import { AlertBanner, CardBody, CardSection, ClusterName, EmptyState, FilterPill, DistributionBar, DistributionLegendChip, Input, NEUTRAL_CHIP_CLASS, renderProse } from '../ui'
+import { AlertBanner, Disclosure, CardBody, CardSection, ClusterName, EmptyState, FilterPill, DistributionBar, DistributionLegendChip, Input, NEUTRAL_CHIP_CLASS, renderProse } from '../ui'
 import { Collapse, CollapseChevron, useDisclosure, disclosurePanelId } from '../ui/Collapse'
 import { useFilterState, defineFilterSchema } from '../../filter-state'
 import type { CheckMeta, CheckReference } from '../audit'
@@ -17,9 +17,19 @@ import {
 } from './severity'
 import { useAnimatedUnmount } from '../../hooks/useAnimatedUnmount'
 import { TRANSITION_MENU, overlayExitMs, overlayTransitionStyle } from '../../utils/animation'
+import { CORE_RESOURCES } from '../../utils/api-resources'
 
 const CATEGORIES: readonly string[] = ['Security', 'Reliability', 'Efficiency']
 
+const AUDIT_INPUT_LABELS = new Map<string, string>([
+  ...CORE_RESOURCES.map(({ name, kind }) => [name, kind] as const),
+  ['limitranges', 'LimitRange'],
+  ['poddisruptionbudgets', 'PodDisruptionBudget'],
+  ['replicaset-ownership', 'ReplicaSet ownership'],
+  ['configmap-references', 'ConfigMap references'],
+  ['secret-references', 'Secret references'],
+])
+
 // Leading severity glyph, one per tier of the 4-tier ladder: critical = octagon,
 // high = triangle, medium = circle, low = info.
 const CHECK_SEVERITY_ICON: Record<CheckSeverity, ComponentType<{ className?: string }>> = {
@@ -355,7 +365,19 @@ export function ChecksView({ checks, catalog, anyData, evaluated, missingInputs
         <AlertBanner
           variant="warning"
           title="Some checks could not run"
-          message={<>Findings cover only available inputs. Unavailable inputs: {missingInputs.join(', ')}.</>}
+          message={
+            <>
+              Findings cover only available inputs.
+              <Disclosure summary={`Unavailable inputs (${missingInputs.length})`} className="mt-2">
+                {missingInputs.map(input => AUDIT_INPUT_LABELS.get(input) ?? input).join(', ')}.
+              </Disclosure>
+              {(missingInputs.includes('replicasets') || missingInputs.includes('replicaset-ownership')) && (
+                <p className="mt-2">
+                  <em>Running replicas on same node</em> could not be fully evaluated: ReplicaSet inventory or ownership evidence was unavailable, so affected Deployments were skipped, not passed.
+                </p>
+              )}
+            </>
+          }
         />
       )}
 
@@ -803,32 +825,21 @@ function ResourceList({
   onResourceClick?: (ref: CheckResourceRef) => void
 }) {
   const [showAll, setShowAll] = useState(false)
-  // The per-finding message only earns a place when it adds something the line
-  // doesn't already show. Normalize each message by removing its own resource
-  // name, then compare: all-same → it repeats the check or varies only by the
-  // object name (already on the line) → drop it; still-different → real new info
-  // (e.g. a container name) → keep it.
-  const showMessage = useMemo(() => {
-    if (check.findings.length === 0) return false
-    const norm = (f: EffectiveCheckFinding) => {
-      const n = f.resource.name
-      return n ? (f.message ?? '').split(n).join('') : f.message ?? ''
-    }
-    const first = norm(check.findings[0])
-    return check.findings.some((f) => norm(f) !== first)
-  }, [check.findings])
+  const commonMessage = check.findings[0]?.message || ''
+  const shareMessage = !!commonMessage && check.findings.every((f) => f.message === commonMessage)
   const list = showAll ? check.findings : check.findings.slice(0, RESOURCE_CAP)
   const hidden = check.findings.length - list.length
 
   return (
     <section className="flex flex-col gap-1.5">
       {label && <h4 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{label}</h4>}
+      {shareMessage && <p className="px-2 text-xs whitespace-pre-wrap [overflow-wrap:anywhere] text-theme-text-secondary">{commonMessage}</p>}
       <ul className="flex flex-col gap-px">
         {list.map((f, i) => (
           <FindingLine
             key={`${f.resource.group}/${f.resource.kind}/${f.resource.namespace}/${f.resource.name}#${i}`}
             finding={f}
-            showMessage={showMessage}
+            showMessage={!shareMessage}
             resourceHref={resourceHref}
             onResourceClick={onResourceClick}
           />
@@ -862,18 +873,18 @@ function FindingLine({
   const linkable = !!(onResourceClick || resourceHref)
   const body = (
     <>
-      <span className="shrink-0 font-mono text-[11px] uppercase tracking-wide text-theme-text-tertiary">{r.kind}</span>
-      <span className={`shrink-0 font-medium ${linkable ? 'text-[var(--color-radar-accent)]' : 'text-theme-text-primary'}`}>
-        {r.namespace ? `${r.namespace} / ` : ''}
-        {r.name}
+      <span className="flex min-w-0 items-baseline gap-2">
+        <span className="shrink-0 font-mono text-[11px] uppercase tracking-wide text-theme-text-tertiary">{r.kind}</span>
+        <span className={`min-w-0 break-all font-medium ${linkable ? 'text-[var(--color-radar-accent)]' : 'text-theme-text-primary'}`}>
+          {r.namespace ? `${r.namespace} / ` : ''}
+          {r.name}
+        </span>
+        {linkable && <ExternalLink className="h-3 w-3 shrink-0 text-theme-text-tertiary opacity-0 transition-opacity group-hover/f:opacity-100" />}
       </span>
-      {linkable && <ExternalLink className="h-3 w-3 shrink-0 text-theme-text-tertiary opacity-0 transition-opacity group-hover/f:opacity-100" />}
-      {showMessage && <span className="ml-1 truncate text-xs text-theme-text-tertiary">{finding.message}</span>}
+      {showMessage && finding.message && <span className="text-xs whitespace-pre-wrap [overflow-wrap:anywhere] text-theme-text-tertiary">{finding.message}</span>}
     </>
   )
-  // items-baseline so the smaller mono kind label shares a baseline with the
-  // larger resource name (their line-heights differ).
-  const cls = 'group/f flex w-full items-baseline gap-2 rounded-md px-2 py-1 text-left text-sm transition-colors hover:bg-theme-hover/60'
+  const cls = 'group/f flex w-full min-w-0 flex-col gap-0.5 rounded-md px-2 py-1 text-left text-sm transition-colors hover:bg-theme-hover/60'
   return (
     <li>
       {onResourceClick ? (
@@ -889,7 +900,7 @@ function FindingLine({
           {body}
         </a>
       ) : (
-        <span className="flex items-center gap-2 rounded-md px-2 py-1 text-sm">{body}</span>
+        <span className="flex min-w-0 flex-col gap-0.5 rounded-md px-2 py-1 text-sm">{body}</span>
       )}
     </li>
   )

package/src/components/dock/NodeTerminalTab.test.tsx

@@ -0,0 +1,89 @@
+// @vitest-environment jsdom
+import { act, StrictMode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { NodeTerminalTab, type NodeDebugPod } from './NodeTerminalTab'
+
+vi.mock('./TerminalTab', () => ({ TerminalTab: () => <div>terminal</div> }))
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const roots = new Set<Root>()
+const pod = (uid: string): NodeDebugPod => ({ namespace: 'default', podName: `debug-${uid}`, uid, containerName: 'debug' })
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>(done => { resolve = done })
+  return { promise, resolve }
+}
+async function mount(create: () => Promise<NodeDebugPod>, cleanup = vi.fn(async (_nodeName: string, _pod: NodeDebugPod) => {}), strict = false) {
+  const element = document.createElement('div')
+  document.body.appendChild(element)
+  const root = createRoot(element)
+  roots.add(root)
+  const component = <NodeTerminalTab nodeName="same-node" createNodeDebugPod={create} cleanupNodeDebugPod={cleanup} createSession={async () => ({ wsUrl: '' })} />
+  await act(async () => { root.render(strict ? <StrictMode>{component}</StrictMode> : component) })
+  return { root, element, cleanup }
+}
+async function unmount(root: Root) {
+  await act(async () => root.unmount())
+  roots.delete(root)
+}
+afterEach(async () => {
+  for (const root of roots) await unmount(root)
+  document.body.replaceChildren()
+})
+
+describe('node terminal pod ownership', () => {
+  it('closing one terminal cleans only its pod on a shared node', async () => {
+    const cleanup = vi.fn(async (_nodeName: string, _pod: NodeDebugPod) => {})
+    const first = await mount(async () => pod('a'), cleanup)
+    const second = await mount(async () => pod('b'), cleanup)
+    await unmount(first.root)
+    expect(cleanup.mock.calls).toEqual([['same-node', pod('a')]])
+    expect(second.element.textContent).toBe('terminal')
+    await unmount(second.root)
+    expect(cleanup.mock.calls).toEqual([['same-node', pod('a')], ['same-node', pod('b')]])
+  })
+
+  it('cleans a late creation exactly once after unload and unmount', async () => {
+    const pending = deferred<NodeDebugPod>()
+    const terminal = await mount(() => pending.promise)
+    await act(async () => { window.dispatchEvent(new Event('beforeunload')) })
+    await unmount(terminal.root)
+    expect(terminal.cleanup).not.toHaveBeenCalled()
+    await act(async () => { pending.resolve(pod('late')) })
+    expect(terminal.cleanup.mock.calls).toEqual([['same-node', pod('late')]])
+  })
+
+  it('does not duplicate cleanup when unload precedes unmount', async () => {
+    const terminal = await mount(async () => pod('ready'))
+    await act(async () => { window.dispatchEvent(new Event('beforeunload')) })
+    await unmount(terminal.root)
+    expect(terminal.cleanup.mock.calls).toEqual([['same-node', pod('ready')]])
+  })
+
+  it('gives a retry its own cleanup even when it resolves after unmount', async () => {
+    const pending = deferred<NodeDebugPod>()
+    const create = vi.fn<() => Promise<NodeDebugPod>>()
+      .mockRejectedValueOnce(new Error('creation failed'))
+      .mockReturnValueOnce(pending.promise)
+    const terminal = await mount(create)
+    await act(async () => { terminal.element.querySelector('button')!.click() })
+    expect(create).toHaveBeenCalledTimes(2)
+    await unmount(terminal.root)
+    await act(async () => { pending.resolve(pod('retry')) })
+    expect(terminal.cleanup.mock.calls).toEqual([['same-node', pod('retry')]])
+  })
+
+  it('isolates Strict Mode creation results resolving out of order', async () => {
+    const old = deferred<NodeDebugPod>()
+    const current = deferred<NodeDebugPod>()
+    const create = vi.fn<() => Promise<NodeDebugPod>>()
+      .mockReturnValueOnce(old.promise).mockReturnValueOnce(current.promise)
+    const terminal = await mount(create, undefined, true)
+    await act(async () => { current.resolve(pod('current')); old.resolve(pod('old')) })
+    expect(terminal.cleanup.mock.calls).toEqual([['same-node', pod('old')]])
+    expect(terminal.element.textContent).toBe('terminal')
+    await unmount(terminal.root)
+    expect(terminal.cleanup.mock.calls).toEqual([['same-node', pod('old')], ['same-node', pod('current')]])
+  })
+})

package/src/components/dock/NodeTerminalTab.tsx

@@ -2,17 +2,20 @@ import { useEffect, useRef, useState, useCallback } from 'react'
 import { Loader2, AlertCircle, RefreshCw } from 'lucide-react'
 import { TerminalTab } from './TerminalTab'
 
+export interface NodeDebugPod {
+  podName: string
+  namespace: string
+  uid: string
+  containerName: string
+}
+
 export interface NodeTerminalTabProps {
   nodeName: string
   isActive?: boolean
-  /** Create a debug pod on the node, returns pod coordinates for exec */
-  createNodeDebugPod: (nodeName: string) => Promise<{
-    podName: string
-    namespace: string
-    containerName: string
-  }>
-  /** Clean up debug pod(s) for this node */
-  cleanupNodeDebugPod: (nodeName: string) => Promise<void>
+  /** Create a debug pod and return its identity and exec coordinates. */
+  createNodeDebugPod: (nodeName: string) => Promise<NodeDebugPod>
+  /** Clean up only this creation result, using its UID as a precondition. */
+  cleanupNodeDebugPod: (nodeName: string, pod: NodeDebugPod) => Promise<void>
   /** Return WebSocket URL for exec into a pod container */
   createSession: (namespace: string, podName: string, containerName: string) => Promise<{ wsUrl: string }>
 }
@@ -24,15 +27,11 @@ export function NodeTerminalTab({
   cleanupNodeDebugPod,
   createSession,
 }: NodeTerminalTabProps) {
-  const [debugPod, setDebugPod] = useState<{
-    podName: string
-    namespace: string
-    containerName: string
-  } | null>(null)
+  const [debugPod, setDebugPod] = useState<NodeDebugPod | null>(null)
   const [error, setError] = useState<string | null>(null)
   const [isCreating, setIsCreating] = useState(true)
-  const cleanupDoneRef = useRef(false)
-  // Stable refs for callbacks
+  const [attempt, setAttempt] = useState(0)
+  // Stable refs avoid restarting creation when the host renders new callbacks.
   const createNodeDebugPodRef = useRef(createNodeDebugPod)
   const cleanupNodeDebugPodRef = useRef(cleanupNodeDebugPod)
   const createSessionRef = useRef(createSession)
@@ -40,44 +39,49 @@ export function NodeTerminalTab({
   useEffect(() => { cleanupNodeDebugPodRef.current = cleanupNodeDebugPod }, [cleanupNodeDebugPod])
   useEffect(() => { createSessionRef.current = createSession }, [createSession])
 
-  const createPod = useCallback(async () => {
-    cleanupDoneRef.current = false
-    setIsCreating(true)
-    setError(null)
-    try {
-      const result = await createNodeDebugPodRef.current(nodeName)
-      setDebugPod(result)
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to create debug pod')
-    } finally {
-      setIsCreating(false)
-    }
-  }, [nodeName])
+  const createPod = useCallback(() => setAttempt(value => value + 1), [])
 
   useEffect(() => {
-    createPod()
-    return () => {
-      if (!cleanupDoneRef.current) {
-        cleanupDoneRef.current = true
-        cleanupNodeDebugPodRef.current(nodeName).catch((err) => {
-          console.warn('[NodeTerminal] Cleanup on unmount failed:', err)
-        })
-      }
+    // Each attempt owns its result, including retries and Strict Mode remounts.
+    let disposed = false
+    let pod: NodeDebugPod | null = null
+    let cleanupDone = false
+    const cleanup = cleanupNodeDebugPodRef.current
+    const dispose = () => {
+      disposed = true
+      if (!pod || cleanupDone) return
+      cleanupDone = true
+      cleanup(nodeName, pod).catch((err) => {
+        console.warn('[NodeTerminal] Cleanup failed:', err)
+      })
     }
-  }, [nodeName, createPod])
 
-  // Best-effort cleanup on page unload — uses keepalive so the browser
-  // does not cancel the request when the page navigates away.
-  useEffect(() => {
-    const handleUnload = () => {
-      if (!cleanupDoneRef.current) {
-        cleanupDoneRef.current = true
-        cleanupNodeDebugPodRef.current(nodeName).catch(() => {})
+    setDebugPod(null)
+    setIsCreating(true)
+    setError(null)
+    const create = async () => {
+      try {
+        pod = await createNodeDebugPodRef.current(nodeName)
+        if (disposed) {
+          dispose()
+        } else {
+          setDebugPod(pod)
+        }
+      } catch (err) {
+        if (!disposed) setError(err instanceof Error ? err.message : 'Failed to create debug pod')
+      } finally {
+        if (!disposed) setIsCreating(false)
       }
     }
-    window.addEventListener('beforeunload', handleUnload)
-    return () => window.removeEventListener('beforeunload', handleUnload)
-  }, [nodeName])
+    void create()
+
+    // The host uses keepalive for best-effort delivery during page unload.
+    window.addEventListener('beforeunload', dispose)
+    return () => {
+      window.removeEventListener('beforeunload', dispose)
+      dispose()
+    }
+  }, [nodeName, attempt])
 
   if (isCreating) {
     return (

package/src/components/gitops/GitOpsHealthSourceNotice.tsx

@@ -9,10 +9,11 @@ import type { GitOpsChange, GitOpsInsightSummary } from '../../types'
 //    3.0+ default). Radar then reads the live resources itself, and every
 //    problem below is Radar's finding — the "Radar" markers say so per row;
 //    this line says so once.
-//  - The Application deploys to another cluster. Radar can't read its
-//    resources from here at all, so nothing is derived. A standalone Radar
-//    may add a pointer to Radar Cloud (the host passes it; embedded hosts
-//    pass nothing).
+//  - The Application (or a Flux object with spec.kubeConfig) deploys to
+//    another cluster. Radar can't read its resources from here at all, so
+//    nothing is derived. For Argo, a standalone Radar may add a pointer to
+//    Radar Cloud (the host passes it; embedded hosts pass nothing); Radar
+//    Cloud doesn't resolve Flux targets, so Flux gets no pointer.
 //
 // Copy stays in plain words; the field names live behind the docs link.
 
@@ -35,6 +36,8 @@ export const APP_TREE_API_ERROR_NO_FINDINGS = "Radar didn't find a problem on it
 
 export const REMOTE_DESTINATION_NOTICE =
   "This application deploys to a different cluster, so its resources aren't visible from here."
+export const REMOTE_FLUX_TARGET_NOTICE =
+  "This applies its resources to a different cluster, so they aren't visible from here."
 
 export type HealthSourceNoticeSummary = Pick<GitOpsInsightSummary, 'tool' | 'health' | 'resourceHealthMode' | 'remoteDestination' | 'resourceHealthFromApi' | 'resourceHealthApiError'>
 
@@ -43,8 +46,9 @@ export type HealthSourceNoticeSummary = Pick<GitOpsInsightSummary, 'tool' | 'hea
 // there), and when the host read Argo's verdicts from its API server there
 // is nothing of Radar's to explain either.
 export function healthSourceNoticeKind(summary: HealthSourceNoticeSummary | undefined): 'remote' | 'appTree' | null {
-  if (!summary || summary.tool !== 'argocd') return null
+  if (!summary) return null
   if (summary.remoteDestination) return 'remote'
+  if (summary.tool !== 'argocd') return null
   if (summary.resourceHealthMode === 'appTree' && !summary.resourceHealthFromApi && summary.health !== 'Healthy') return 'appTree'
   return null
 }
@@ -100,10 +104,14 @@ export function GitOpsHealthSourceNotice({
       <Info className="mt-px h-3.5 w-3.5 shrink-0 text-theme-text-tertiary" />
       <span className="min-w-0">
         {kind === 'remote' ? (
-          <>
-            {REMOTE_DESTINATION_NOTICE}
-            {remoteDestinationHint ? <> {remoteDestinationHint}</> : null}
-          </>
+          summary?.tool === 'argocd' ? (
+            <>
+              {REMOTE_DESTINATION_NOTICE}
+              {remoteDestinationHint ? <> {remoteDestinationHint}</> : null}
+            </>
+          ) : (
+            REMOTE_FLUX_TARGET_NOTICE
+          )
         ) : (
           <>
             {apiError ? (