@skyhook-io/k8s-ui 1.16.3 → 1.17.1

package/src/utils/log-format.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { highlightJson, tokenizeJson, unescapeJsonStrings } from './log-format'
+
+describe('unescapeJsonStrings', () => {
+  it('expands whitespace inside strings while leaving escapes outside them untouched', () => {
+    expect(unescapeJsonStrings('{"msg":"first\\r\\nsecond\\nthird\\tend"}')).toBe('{"msg":"first\r\nsecond\nthird\tend"}')
+    expect(unescapeJsonStrings('outside\\n {"msg":"inside\\n"} outside\\t')).toBe('outside\\n {"msg":"inside\n"} outside\\t')
+  })
+
+  it('keeps escaped quotes and backslashes in their original string', () => {
+    expect(unescapeJsonStrings('{"msg":"say \\"hello\\"\\nnext","path":"C:\\\\docs"}')).toBe('{"msg":"say \\"hello\\"\nnext","path":"C:\\\\docs"}')
+    expect(unescapeJsonStrings(JSON.stringify({ empty: '', nested: ['a\nb', 'c\td'], number: 42, yes: true }))).toBe('{"empty":"","nested":["a\nb","c\td"],"number":42,"yes":true}')
+  })
+
+  it('stops once at an unterminated string with many escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000) + '\\n'
+    expect(unescapeJsonStrings(text)).toBe(text)
+  })
+})
+
+describe('JSON highlighting', () => {
+  it('keeps primitive-looking words inside strings and preserves JSON token colors', () => {
+    const tokens = tokenizeJson('{ "text" : "true null 123 \\"quoted\\"", "values": [-1.2e+3, true, false, null, ""] }')
+    expect(tokens.filter((token) => token.type === 'string').map((token) => token.value)).toEqual(['"true null 123 \\"quoted\\""', '""'])
+    expect(tokens.filter((token) => token.type === 'number').map((token) => token.value)).toEqual(['-1.2e+3'])
+    expect(highlightJson('{"a":true,"b":null,"n":12}')).toBe('{<span style="color:#7cacf8">"a"</span>:<span style="color:#c678dd">true</span>,<span style="color:#7cacf8">"b"</span>:<span style="color:#808080">null</span>,<span style="color:#7cacf8">"n"</span>:<span style="color:#e5c07b">12</span>}')
+  })
+
+  it('escapes HTML in log values before inserting highlighting markup', () => {
+    const html = highlightJson(JSON.stringify({ msg: '<script>alert("x")</script>&' }))
+    expect(html).toContain('&lt;script&gt;')
+    expect(html).toContain('&lt;/script&gt;&amp;')
+    expect(html).not.toContain('<script>')
+  })
+
+  it('leaves a long unterminated string as plain text without rescanning escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000)
+    expect(tokenizeJson(text)).toEqual([{ type: 'text', value: text }])
+    expect(highlightJson(text)).toBe(text)
+  })
+})

package/src/utils/log-format.ts

@@ -363,24 +363,71 @@ export const SYNTAX_COLOR_NUMBER = '#e5c07b'
 export const SYNTAX_COLOR_BOOLEAN = '#c678dd'
 export const SYNTAX_COLOR_NULL = '#808080'
 
+export interface JsonToken {
+  type: 'text' | 'key' | 'string' | 'number' | 'boolean' | 'null'
+  value: string
+}
+
+function jsonStringEnd(text: string, start: number): number {
+  let offset = start + 1
+  while (offset < text.length) {
+    const char = text[offset++]
+    if (char === '\\') offset++
+    else if (char === '"') return offset
+  }
+  return -1
+}
+
+export function tokenizeJson(text: string): JsonToken[] {
+  const tokens: JsonToken[] = []
+  const primitiveRe = /(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/y
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    const start = offset
+    let type: JsonToken['type']
+    let value: string
+    if (text[offset] === '"') {
+      const end = jsonStringEnd(text, offset)
+      if (end < 0) break
+      value = text.slice(start, end)
+      let colon = end
+      while (colon < text.length && /\s/.test(text[colon])) colon++
+      type = text[colon] === ':' ? 'key' : 'string'
+      offset = type === 'key' ? colon + 1 : end
+    } else {
+      primitiveRe.lastIndex = offset
+      const match = primitiveRe.exec(text)
+      if (!match) {
+        offset++
+        continue
+      }
+      type = match[1] !== undefined ? 'number' : match[2] !== undefined ? 'boolean' : 'null'
+      value = match[0]
+      offset = primitiveRe.lastIndex
+    }
+    if (start > copied) tokens.push({ type: 'text', value: text.slice(copied, start) })
+    tokens.push({ type, value })
+    copied = offset
+  }
+  if (copied < text.length) tokens.push({ type: 'text', value: text.slice(copied) })
+  return tokens
+}
+
 /**
  * Syntax-highlight a pretty-printed JSON string for HTML display.
  * Wraps keys, string values, numbers, booleans, and null in colored spans.
  * Applies HTML escaping internally — do not pre-escape the input.
  */
 export function highlightJson(json: string): string {
-  const escaped = escapeHtml(json)
-  // Single-pass tokenizer: matches all JSON tokens at once so content inside strings
-  // is consumed and can't be re-matched by number/boolean/null patterns.
-  const tokenRe = /("(?:\\.|[^"\\])*")\s*:|("(?:\\.|[^"\\])*")|(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/g
-  return escaped.replace(tokenRe, (match, key, str, num, bool, nil) => {
-    if (key) return `<span style="color:${SYNTAX_COLOR_KEY}">${key}</span>:`
-    if (str) return `<span style="color:${SYNTAX_COLOR_STRING}">${str}</span>`
-    if (num) return `<span style="color:${SYNTAX_COLOR_NUMBER}">${num}</span>`
-    if (bool) return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${bool}</span>`
-    if (nil) return `<span style="color:${SYNTAX_COLOR_NULL}">${nil}</span>`
-    return match
-  })
+  return tokenizeJson(escapeHtml(json)).map(({ type, value }) => {
+    if (type === 'key') return `<span style="color:${SYNTAX_COLOR_KEY}">${value}</span>:`
+    if (type === 'string') return `<span style="color:${SYNTAX_COLOR_STRING}">${value}</span>`
+    if (type === 'number') return `<span style="color:${SYNTAX_COLOR_NUMBER}">${value}</span>`
+    if (type === 'boolean') return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${value}</span>`
+    if (type === 'null') return `<span style="color:${SYNTAX_COLOR_NULL}">${value}</span>`
+    return value
+  }).join('')
 }
 
 /**
@@ -389,12 +436,21 @@ export function highlightJson(json: string): string {
  * making stack traces and multi-line messages readable in the expanded view.
  */
 export function unescapeJsonStrings(text: string): string {
-  return text.replace(/"(?:[^"\\]|\\.)*"/g, (match) => {
-    return match
+  let result = ''
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    if (text[offset++] !== '"') continue
+    const start = offset - 1
+    offset = jsonStringEnd(text, start)
+    if (offset < 0) break
+    result += text.slice(copied, start) + text.slice(start, offset)
       .replace(/\\r\\n/g, '\r\n')
       .replace(/\\n/g, '\n')
       .replace(/\\t/g, '\t')
-  })
+    copied = offset
+  }
+  return result + text.slice(copied)
 }
 
 // logfmt detection and parsing

package/src/utils/log-level.ts

@@ -49,14 +49,22 @@ export function normalizeLevel(raw: unknown): LogLevel | null {
   return 'unknown'
 }
 
-// PostgreSQL's error_severity values (every DEBUGn is written as DEBUG);
-// anything else under `record` isn't PostgreSQL's.
+// PostgreSQL writes every DEBUGn severity as DEBUG.
 const POSTGRES_SEVERITIES: Record<string, LogLevel> = {
   DEBUG: 'debug', LOG: 'info', INFO: 'info', NOTICE: 'info', WARNING: 'warn', ERROR: 'error', FATAL: 'error', PANIC: 'error',
 }
 
 const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level'] as const
 
+export function selectPostgresRecord(obj: Record<string, unknown>): { record: Record<string, unknown>; raw: string; level: LogLevel } | null {
+  const record = obj.record
+  if (obj.logger !== 'postgres' || obj.msg !== 'record' || !record || typeof record !== 'object' || Array.isArray(record)) return null
+  const fields = record as Record<string, unknown>
+  const raw = fields.error_severity
+  const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
+  return typeof raw === 'string' && level ? { record: fields, raw, level } : null
+}
+
 /**
  * Pick the level field of a structured record. Shared by detection and the
  * structured-line badge so the badge text and the line's resolved level always
@@ -65,12 +73,8 @@ const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level']
 export function selectLevelField(obj: Record<string, unknown>): { raw: unknown; level: LogLevel } | null {
   // CloudNativePG wraps each PostgreSQL line in an instance-manager record
   // whose own level is usually info; the database's severity is nested.
-  const pgRecord = obj.record
-  if (pgRecord && typeof pgRecord === 'object' && !Array.isArray(pgRecord)) {
-    const raw = (pgRecord as Record<string, unknown>).error_severity
-    const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
-    if (level) return { raw, level }
-  }
+  const pgRecord = selectPostgresRecord(obj)
+  if (pgRecord) return { raw: pgRecord.raw, level: pgRecord.level }
   for (const key of LEVEL_FIELD_KEYS) {
     const level = normalizeLevel(obj[key])
     if (level) return { raw: obj[key], level }

package/src/utils/navigation.test.ts

@@ -193,6 +193,63 @@ describe('pluralToKind', () => {
 })
 
 describe('initNavigationMap', () => {
+  const coreNode = { group: '', version: 'v1', kind: 'Node', name: 'nodes', namespaced: false, isCrd: false, verbs: ['get'] }
+  const customNode = { group: 'collision.example.io', version: 'v1', kind: 'Node', name: 'workerhosts', namespaced: false, isCrd: true, verbs: ['get'] }
+
+  test.each([
+    ['core listed first', [coreNode, customNode]],
+    ['custom listed first', [customNode, coreNode]],
+  ])('keeps the core plural for a Kind a CRD reuses under another plural (%s)', (_, resources) => {
+    initNavigationMap(resources)
+    expect(kindToPlural('Node')).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', '')).toBe('nodes')
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('workerhosts')
+  })
+
+  test('keeps the core plural when partial discovery omits the core group', () => {
+    initNavigationMap([customNode])
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('workerhosts')
+  })
+
+  test.each([
+    ['partial discovery', [{ ...customNode, name: 'node' }]],
+    ['full discovery', [coreNode, { ...customNode, name: 'node' }]],
+  ])('keeps the core plural when a CRD registers the core Kind word as its plural (%s)', (_, resources) => {
+    initNavigationMap(resources)
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPlural('node')).toBe('node')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('node')
+  })
+
+  test('resolves a group-qualified Kind spelled like a core plural to its own resource', () => {
+    initNavigationMap([
+      { group: '', version: 'v1', kind: 'Endpoints', name: 'endpoints', namespaced: true, isCrd: false, verbs: ['get'] },
+      { group: 'custom.example.io', version: 'v1', kind: 'Endpoints', name: 'virtualendpoints', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(kindToPluralWithGroup('Endpoints', 'custom.example.io')).toBe('virtualendpoints')
+    expect(kindToPluralWithGroup('Endpoints', '')).toBe('endpoints')
+  })
+
+  test('keeps a lowercase group plural rather than reading it as another Kind', () => {
+    initNavigationMap([
+      { group: 'shapes.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+      { group: 'shapes.example.io', version: 'v1', kind: 'Widgets', name: 'widgetsets', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(kindToPluralWithGroup('widgets', 'shapes.example.io')).toBe('widgets')
+    expect(kindToPluralWithGroup('Widgets', 'shapes.example.io')).toBe('widgetsets')
+    expect(kindToPluralWithGroup('Widget', 'shapes.example.io')).toBe('widgets')
+  })
+
+  test('keeps last-wins for Kinds that only CRDs declare', () => {
+    initNavigationMap([
+      { group: 'a.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: [] },
+      { group: 'b.example.io', version: 'v1', kind: 'Widget', name: 'gadgets', namespaced: true, isCrd: true, verbs: [] },
+    ])
+    expect(kindToPlural('Widget')).toBe('gadgets')
+  })
+
   test('discovered API resources override heuristic pluralization', () => {
     // Before init, an unknown CRD would hit the heuristic fallback
     // After init, it uses the discovered plural name
@@ -305,6 +362,19 @@ describe('refToSelectedResource', () => {
     })
   })
 
+  test('resolves AWS IngressClassParams without discovery', () => {
+    expect(refToSelectedResource({ kind: 'IngressClassParams', name: 'alb', group: 'elbv2.k8s.aws' })).toEqual({
+      kind: 'ingressclassparams',
+      name: 'alb',
+      namespace: '',
+      group: 'elbv2.k8s.aws',
+    })
+    expect(knownKindForPluralWithGroup('ingressclassparams', 'elbv2.k8s.aws')).toBe('IngressClassParams')
+    // Hosts without discovery fold the plural back to a Kind and re-pluralize it.
+    expect(pluralToKind('ingressclassparams')).toBe('IngressClassParams')
+    expect(kindToPlural(pluralToKind('ingressclassparams'))).toBe('ingressclassparams')
+  })
+
   test('normalizes an omitted namespace for cluster-scoped references', () => {
     expect(refToSelectedResource({ kind: 'NodePool', name: 'spot' })).toEqual({
       kind: 'nodepools',

package/src/utils/navigation.ts

@@ -1,6 +1,6 @@
 import type { SelectedResource, ResourceRef, APIResource } from '../types/core'
 import { englishPlural, englishSingular, isEnglishPlural } from './pluralize'
-import { CORE_RESOURCES } from './api-resources'
+import { CORE_RESOURCES, isBuiltinCoreKind } from './api-resources'
 
 /**
  * Canonical callback type for navigating to a resource.
@@ -41,6 +41,10 @@ const BUILTIN_PLURAL_TO_KIND: Record<string, string> = {
   clusterrolebindings: 'ClusterRoleBinding',
   serviceaccounts: 'ServiceAccount',
   networkpolicies: 'NetworkPolicy',
+  // AWS Load Balancer Controller's IngressClass parameters. The Kind is
+  // singular and plural at once, so English rules cannot recover it in hosts
+  // that never load discovery.
+  ingressclassparams: 'IngressClassParams',
 }
 
 const BUILTIN_GROUP_KIND_TO_PLURAL: Record<string, string> = {
@@ -54,6 +58,7 @@ const BUILTIN_GROUP_PLURAL_TO_KIND: Record<string, string> = {
   'metrics.k8s.io/pods': 'PodMetrics',
   'metrics.k8s.io/nodes': 'NodeMetrics',
   'scheduling.k8s.io/podgroups': 'PodGroup',
+  'elbv2.k8s.aws/ingressclassparams': 'IngressClassParams',
 }
 
 // Dynamic map built from API discovery — populated by initNavigationMap().
@@ -62,6 +67,18 @@ let discoveredPluralToKind: Record<string, string> | null = null
 let discoveredKindToPlural: Record<string, string> | null = null
 let discoveredGroupKindToPlural: Record<string, string> | null = null
 let discoveredGroupPluralToKind: Record<string, string> | null = null
+let discoveredGroupKindNamespaced: Record<string, boolean> | null = null
+let discoveredCRDNames: Record<string, string> | null = null
+const crdDefinitionListeners = new Set<() => void>()
+
+export function subscribeCRDDefinitions(listener: () => void): () => void {
+  crdDefinitionListeners.add(listener)
+  return () => { crdDefinitionListeners.delete(listener) }
+}
+
+export function getCRDDefinitionsSnapshot(): Readonly<Record<string, string>> | null {
+  return discoveredCRDNames
+}
 
 /**
  * Initialize navigation maps from discovered API resources.
@@ -70,17 +87,35 @@ let discoveredGroupPluralToKind: Record<string, string> | null = null
  */
 export function initNavigationMap(resources: APIResource[]) {
   const p2k: Record<string, string> = { ...BUILTIN_PLURAL_TO_KIND }
-  const k2p: Record<string, string> = {}
+  // Seeded from the built-in table so core protection survives partial
+  // discovery (the server forwards whatever groups it could list).
+  const k2p: Record<string, string> = Object.fromEntries(
+    CORE_RESOURCES.filter(r => r.group === '').map(r => [r.kind.toLowerCase(), r.name]),
+  )
   const gk2p: Record<string, string> = {}
   const gp2k: Record<string, string> = { ...BUILTIN_GROUP_PLURAL_TO_KIND }
+  const scopes: Record<string, boolean> = {}
+  const crdNames: Record<string, string> = {}
+  const coreKinds = new Set(Object.keys(k2p))
   for (const r of resources) {
     const plural = r.name.toLowerCase()
+    const kindLower = r.kind.toLowerCase()
+    if (r.definitionName) crdNames[`${r.group}/${r.kind}`] = r.definitionName
     // First-wins on plurals: BUILTIN_PLURAL_TO_KIND seeds canonical core mappings
     // (e.g. "pods" → "Pod") so a colliding API resource (metrics.k8s.io exposes
     // "pods" with kind "PodMetrics") cannot hijack the core mapping.
     if (!(plural in p2k)) p2k[plural] = r.kind
-    k2p[r.kind.toLowerCase()] = plural
-    gk2p[`${r.group}/${r.kind.toLowerCase()}`] = plural
+    // Kind-only lookups (core links carry an empty group) likewise keep the core
+    // plural: a CRD that reuses a core Kind under another plural must not win
+    // just because discovery happened to list it later.
+    if (r.group === '') {
+      k2p[kindLower] = plural
+      coreKinds.add(kindLower)
+    } else if (!coreKinds.has(kindLower)) {
+      k2p[kindLower] = plural
+    }
+    gk2p[`${r.group}/${kindLower}`] = plural
+    scopes[`${r.group}/${kindLower}`] = r.namespaced
     const groupPlural = `${r.group}/${plural}`
     if (!(groupPlural in gp2k)) gp2k[groupPlural] = r.kind
   }
@@ -88,14 +123,20 @@ export function initNavigationMap(resources: APIResource[]) {
   discoveredKindToPlural = k2p
   discoveredGroupKindToPlural = gk2p
   discoveredGroupPluralToKind = gp2k
+  discoveredGroupKindNamespaced = scopes
+  discoveredCRDNames = crdNames
+  crdDefinitionListeners.forEach(listener => listener())
 }
 
-/** Reset navigation maps to builtin-only state. For testing. */
+/** Reset navigation maps to builtin-only state on cluster changes. */
 export function resetNavigationMap() {
   discoveredPluralToKind = null
   discoveredKindToPlural = null
   discoveredGroupKindToPlural = null
   discoveredGroupPluralToKind = null
+  discoveredGroupKindNamespaced = null
+  discoveredCRDNames = null
+  crdDefinitionListeners.forEach(listener => listener())
 }
 
 function getPluralToKind(): Record<string, string> {
@@ -112,6 +153,11 @@ export function kindToPlural(kind: string): string {
   const kindLower = kind.toLowerCase()
   const pluralToKindMap = getPluralToKind()
 
+  // An exact core Kind (PascalCase, unlike plural slugs) keeps its core plural
+  // even when a CRD registered that word as its own plural.
+  const core = kind !== kindLower ? CORE_RESOURCES.find(r => r.group === '' && r.kind === kind) : undefined
+  if (core) return core.name
+
   // Already a known plural — return as-is to prevent double-pluralization
   if (kindLower in pluralToKindMap) return kindLower
 
@@ -151,10 +197,15 @@ export function kindToPlural(kind: string): string {
 export function kindToPluralWithGroup(kind: string, group: string): string {
   if (!group) return kindToPlural(kind)
   const kindLower = kind.toLowerCase()
-  const pluralToKindMap = getPluralToKind()
-  if (kindLower in pluralToKindMap) return kindLower
+  // The group's own plural, then its exact Kind, before the group-blind plural
+  // shortcut: a custom Kind spelled like a core plural (Endpoints) has its own
+  // resource, while a lowercase plural must not be read as another Kind.
+  if (kind === kindLower && discoveredGroupPluralToKind?.[`${group}/${kindLower}`]) return kindLower
   const groupKind = `${group}/${kindLower}`
-  return discoveredGroupKindToPlural?.[groupKind] ?? BUILTIN_GROUP_KIND_TO_PLURAL[groupKind] ?? kindToPlural(kind)
+  const exact = discoveredGroupKindToPlural?.[groupKind] ?? BUILTIN_GROUP_KIND_TO_PLURAL[groupKind]
+  if (exact) return exact
+  if (kindLower in getPluralToKind()) return kindLower
+  return kindToPlural(kind)
 }
 
 /**
@@ -191,6 +242,13 @@ export function knownKindForPluralWithGroup(plural: string, group: string): stri
     ?? BUILTIN_GROUP_PLURAL_TO_KIND[groupPlural]
 }
 
+/** Return a CRD definition only when exact group/kind discovery identifies a CRD. */
+export function customResourceDefinitionRef(apiVersion: string | undefined, kind: string | undefined): ResourceRef | null {
+  if (!apiVersion || !kind) return null
+  const name = discoveredCRDNames?.[`${apiVersionToGroup(apiVersion)}/${kind}`]
+  return name ? { kind: 'CustomResourceDefinition', group: 'apiextensions.k8s.io', namespace: '', name } : null
+}
+
 /**
  * Convert a ResourceRef (from backend relationships) to a SelectedResource (for navigation).
  * Handles kind singular→plural conversion.
@@ -220,6 +278,31 @@ export function apiVersionToGroup(apiVersion?: string | null): string {
   return i === -1 ? '' : apiVersion.slice(0, i)
 }
 
+/** A Kubernetes ObjectReference retains its own API identity and namespace.
+ * Cluster scope comes from exact group/kind discovery (or known built-ins).
+ * Core controllers omit apiVersion for core objects (the EndpointSlice
+ * controller writes Pod targets as kind/namespace/name/uid), so an omitted
+ * apiVersion means the core group only for a built-in core Kind. Any other
+ * missing identity or scope stays non-navigable rather than guessing an API
+ * or borrowing the referring object's namespace. UID is not a drawer locator.
+ */
+export function objectReferenceToResourceRef(ref: {
+  apiVersion?: string
+  kind?: string
+  namespace?: string
+  name?: string
+} | null | undefined): ResourceRef | null {
+  if (!ref?.kind || !ref.name) return null
+  const kindLower = ref.kind.toLowerCase()
+  if (!ref.apiVersion && !isBuiltinCoreKind(ref.kind)) return null
+  const group = apiVersionToGroup(ref.apiVersion)
+  const key = `${group}/${kindLower}`
+  const namespaced = discoveredGroupKindNamespaced?.[key]
+    ?? CORE_RESOURCES.find(r => r.group === group && r.kind.toLowerCase() === kindLower)?.namespaced
+  if (namespaced !== false && !ref.namespace) return null
+  return { kind: ref.kind, group, namespace: namespaced === false ? '' : ref.namespace!, name: ref.name }
+}
+
 // -----------------------------------------------------------------------------
 // Timeline lane identity. A lane's id includes the API group so two CRDs that
 // share a kind name across vendors (CAPI `Cluster` in cluster.x-k8s.io vs CNPG

package/src/utils/node-lifecycle.test.ts

@@ -0,0 +1,36 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it, vi } from 'vitest'
+import { getNodeLifecycle } from './node-lifecycle'
+import { getNodeConditions, getNodeStatus } from '../components/resources/resource-utils'
+
+const fixture = JSON.parse(readFileSync(fileURLToPath(new URL('../../../../pkg/health/testdata/node_lifecycle.json', import.meta.url)), 'utf8'))
+
+describe('node lifecycle shared Go/TS scenarios', () => {
+  for (const vector of fixture.vectors) {
+    it(vector.name, () => {
+      expect(getNodeLifecycle(vector.node, Date.parse(fixture.now))).toEqual({
+        label: vector.label, level: vector.level, readinessFailed: vector.readinessFailed, delayed: vector.delayed,
+        removing: vector.removing, actor: vector.actor, startedAt: vector.startedAt ? Date.parse(vector.startedAt) : undefined, problems: vector.problems,
+      })
+    })
+  }
+  it('handles the actions bar loading before node data arrives', () => {
+    expect(getNodeLifecycle(undefined)).toMatchObject({ level: 'unknown', removing: false })
+  })
+  it('keeps badges and table warning icons calm for expected readiness loss', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(fixture.now))
+    try {
+      const node = fixture.vectors.find((vector: any) => vector.name === 'autoscaler-Unknown').node
+      expect(getNodeStatus(node)).toMatchObject({ text: 'Removing (cluster autoscaler)', level: 'neutral' })
+      expect(getNodeConditions(node).problems).toEqual([])
+      expect(getNodeConditions(node).readinessLabel).toBe('Readiness unknown during removal')
+      const shutdown = fixture.vectors.find((vector: any) => vector.name === 'autoscaler-False').node
+      expect(getNodeConditions(shutdown).readinessLabel).toBe('Not ready (expected during removal)')
+      expect(getNodeConditions({ status: { conditions: [] } })).toMatchObject({ healthy: false, readinessLabel: 'Readiness unknown' })
+      const failed = fixture.vectors.find((vector: any) => vector.name === 'preexisting-failure').node
+      expect(getNodeConditions(failed).problems).toContain('NotReady')
+    } finally { vi.useRealTimers() }
+  })
+})

package/src/utils/node-lifecycle.ts

@@ -0,0 +1,77 @@
+import type { HealthLevel } from '../components/resources/resource-utils'
+
+const REMOVAL_ACTORS: Record<string, string> = {
+  ToBeDeletedByClusterAutoscaler: 'cluster autoscaler',
+  'karpenter.sh/disrupted': 'Karpenter',
+}
+
+const NETWORK_UNAVAILABLE_GRACE_MS = 2 * 60_000
+
+export const NODE_REMOVAL_WARNING_MS = 10 * 60_000
+export const NODE_REMOVAL_CRITICAL_MS = 30 * 60_000
+
+export interface NodeLifecycleState {
+  label: string
+  level: HealthLevel
+  removing: boolean
+  actor?: string
+  startedAt?: number
+  readinessFailed: boolean
+  delayed: boolean
+  problems: string[]
+}
+
+export type NodeLifecycleObservation = Omit<NodeLifecycleState, 'startedAt' | 'problems'> & {
+  startedAt?: string
+  problems?: string[]
+}
+
+export function getNodeLifecycle(node: any, now = Date.now()): NodeLifecycleState {
+  const ready = node?.status?.conditions?.find((condition: any) => condition.type === 'Ready')
+  const createdAt = Date.parse(node?.metadata?.creationTimestamp)
+  const validTime = (timestamp: number) => Number.isFinite(timestamp) && timestamp > 0 && timestamp <= now && (!Number.isFinite(createdAt) || timestamp >= createdAt) ? timestamp : undefined
+  let startedAt = validTime(Date.parse(node?.metadata?.deletionTimestamp))
+  let removing = Boolean(node?.metadata?.deletionTimestamp)
+  let actor: string | undefined
+  let candidate = false
+  for (const taint of node?.spec?.taints ?? []) {
+    if (taint.key === 'DeletionCandidateOfClusterAutoscaler' && taint.effect === 'PreferNoSchedule') candidate = true
+    if (taint.effect !== 'NoSchedule') continue
+    const source = REMOVAL_ACTORS[taint.key]
+    if (!source) continue
+    removing = true
+    actor = source
+    if (taint.key === 'ToBeDeletedByClusterAutoscaler' && /^\d+$/.test(taint.value ?? '')) {
+      const markerTime = validTime(Number(taint.value) * 1000)
+      if (markerTime !== undefined && (startedAt === undefined || markerTime < startedAt)) startedAt = markerTime
+    }
+  }
+  const readyTime = Date.parse(ready?.lastTransitionTime)
+  const readinessFailed = Boolean(ready && ready.status !== 'True' && !(removing && startedAt !== undefined && Number.isFinite(readyTime) && readyTime >= startedAt && readyTime <= now))
+  const delayed = removing && startedAt !== undefined && now - startedAt >= NODE_REMOVAL_WARNING_MS
+  let label = 'Unknown'
+  let level: HealthLevel = 'unknown'
+  if (removing) {
+    label = actor ? `Removing (${actor})` : 'Removing'
+    level = readinessFailed || (delayed && now - startedAt! >= NODE_REMOVAL_CRITICAL_MS) ? 'unhealthy' : delayed ? 'degraded' : 'neutral'
+  } else if (readinessFailed) {
+    label = 'NotReady'
+    level = 'unhealthy'
+  } else if (ready?.status === 'True') {
+    label = node?.spec?.unschedulable ? 'Cordoned' : candidate ? 'Scale-down candidate' : 'Ready'
+    level = node?.spec?.unschedulable ? 'degraded' : candidate ? 'neutral' : 'healthy'
+  }
+  const problems: string[] = []
+  if (removing && readinessFailed) label += ' · NotReady'
+  const problemLabels: Record<string, string> = { MemoryPressure: 'Memory pressure', DiskPressure: 'Disk pressure', PIDPressure: 'PID pressure', NetworkUnavailable: 'Network unavailable' }
+  for (const condition of node?.status?.conditions ?? []) {
+    if (condition.status !== 'True' || !problemLabels[condition.type]) continue
+    const conditionTime = Date.parse(condition.lastTransitionTime)
+    if (condition.type === 'NetworkUnavailable' && Number.isFinite(conditionTime) && conditionTime <= now && now - conditionTime < NETWORK_UNAVAILABLE_GRACE_MS) continue
+    problems.push(condition.type)
+    label += ` · ${problemLabels[condition.type]}`
+    if (condition.type !== 'NetworkUnavailable') level = 'unhealthy'
+    else if (level !== 'unhealthy') level = 'degraded'
+  }
+  return { label, level, removing, actor, startedAt, readinessFailed, delayed, problems }
+}

package/src/utils/object-reference-navigation.test.ts

@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { initNavigationMap, objectReferenceToResourceRef, resetNavigationMap } from './navigation'
+
+afterEach(resetNavigationMap)
+
+describe('objectReferenceToResourceRef', () => {
+  it('keeps the reference namespace and drops it for cluster-scoped core kinds', () => {
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Pod', namespace: 'other', name: 'backend' }))
+      .toEqual({ kind: 'Pod', group: '', namespace: 'other', name: 'backend' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Node', namespace: 'irrelevant', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: '', namespace: '', name: 'worker' })
+  })
+
+  it('resolves a core Kind without apiVersion, the shape the EndpointSlice controller writes', () => {
+    expect(objectReferenceToResourceRef({ kind: 'Pod', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Pod', group: '', namespace: 'team', name: 'backend' })
+    expect(objectReferenceToResourceRef({ kind: 'Endpoints', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Endpoints', group: '', namespace: 'team', name: 'backend' })
+    expect(objectReferenceToResourceRef({ kind: 'Deployment', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ kind: 'Services', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ kind: 'Nodes', namespace: 'team', name: 'worker' })).toBeNull()
+  })
+
+  it('uses exact discovered scope for colliding API kinds', () => {
+    initNavigationMap([
+      { group: 'cluster.example.io', version: 'v1', kind: 'Node', name: 'nodes', namespaced: false, isCrd: true, verbs: ['get'] },
+      { group: 'team.example.io', version: 'v1', kind: 'Node', name: 'nodes', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(objectReferenceToResourceRef({ apiVersion: 'cluster.example.io/v1', kind: 'Node', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: 'cluster.example.io', namespace: '', name: 'worker' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'team.example.io/v1', kind: 'Node', namespace: 'team', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: 'team.example.io', namespace: 'team', name: 'worker' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'team.example.io/v1', kind: 'Node', name: 'worker' })).toBeNull()
+  })
+
+  it('does not invent a custom API group, a namespace, or an unknown cluster scope', () => {
+    expect(objectReferenceToResourceRef({ kind: 'Widget', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Pod', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'unknown.example.io/v1', kind: 'Node', name: 'worker' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'unknown.example.io/v1', kind: 'Widget', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Widget', group: 'unknown.example.io', namespace: 'team', name: 'backend' })
+  })
+})