@skyhook-io/k8s-ui 1.17.1 → 1.18.1

package/src/components/workload/WorkloadView.tsx

@@ -43,7 +43,7 @@ import type { NavigateToResource } from '../../utils/navigation'
 import { refToSelectedResource, pluralToKind, knownKindForPluralWithGroup, kindToPlural, kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
 import { neighborhoodFor, seedNodeIds, topologyNodeResourceKind } from '../../utils/topology-neighborhood'
 import { TopologyGraph } from '../topology/TopologyGraph'
-import { gitOpsOwnerFromRelationships, type GitOpsOwnerRef } from '../../utils/gitops-owner'
+import { gitOpsOwnerFromRelationships, managerListing, type GitOpsOwnerRef } from '../../utils/gitops-owner'
 import { gitOpsRouteForResource } from '../../utils/gitops-route'
 import { buildResourceHierarchy, getAllEventsFromHierarchy, isProblematicEvent, type ResourceLane } from '../../utils/resource-hierarchy'
 import { TimelineSwimlanes, type TimeWindow } from '../timeline/TimelineSwimlanes'
@@ -57,7 +57,7 @@ import {
 import { ResourceRendererDispatch, getResourceStatus, diagnoseHealthHint, type DiagnoseHealthHint, type RendererOverrides } from '../shared/ResourceRendererDispatch'
 import type { ScalerDiagnosis } from '../resources/renderers/WorkloadRenderer'
 import { DetailShell, type DetailShellTab } from '../shared/DetailShell'
-import { HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from '../shared/ManagedByChip'
+import { gitOpsOwnerKindLabel, HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from '../shared/ManagedByChip'
 import { AlertBanner, getKindColorOutline, displayKindName, OperationalIssuesShownContext, ResourceRefBadge } from '../ui/drawer-components'
 import { Badge, type BadgeSeverity } from '../ui/Badge'
 import { Tooltip } from '../ui/Tooltip'
@@ -216,6 +216,8 @@ interface WorkloadViewProps {
   /** Timeline events the history lanes are built from: this workload's own
    *  history, or events for its namespace from a host that has no scoped query. */
   allEvents?: TimelineEvent[]
+  /** Reveals one event, loading older pages if needed. Use a new object for each navigation request. */
+  timelineFocusEvent?: { id: string }
   /** Older history exists beyond allEvents. */
   historyTruncated?: boolean
   /** Loads the next older page of history; omit when the host can't page. */
@@ -353,6 +355,8 @@ interface WorkloadViewProps {
     namespace: string
     name: string
     resource: any
+    /** Place resource notices within the replacement layout's content area. */
+    leadContent?: ReactNode
   }) => ReactNode
   /** Render the metrics tab content */
   renderMetricsTab?: (props: { kind: string; namespace: string; name: string }) => ReactNode
@@ -398,6 +402,8 @@ interface WorkloadViewProps {
    *  live issues for this resource). Avoids showing the same failure twice.
    *  Also gates the `renderOverviewLead` wrapper (see above). */
   hasOperationalIssues?: boolean
+  /** Also show the lead for neutral context without suppressing renderer problems. */
+  hasOverviewLead?: boolean
   /** True while the live-issues fetch is still pending. Renderers suppress their
    *  banners during this window too — a banner whose failure the pipeline covers
    *  would otherwise flash on first paint before the issues arrive and hide it. */
@@ -465,6 +471,7 @@ export function WorkloadView({
   refetch: refetchProp,
   // Timeline
   allEvents,
+  timelineFocusEvent,
   historyTruncated = false,
   onLoadOlderHistory,
   loadingOlderHistory = false,
@@ -518,6 +525,7 @@ export function WorkloadView({
   renderOverviewIntro,
   renderOverviewLead,
   hasOperationalIssues,
+  hasOverviewLead,
   operationalIssuesPending,
   // Actions bar
   actionsBarProps,
@@ -718,6 +726,18 @@ export function WorkloadView({
   const metadata = useMemo(() => extractMetadata(kind, resource), [kind, resource])
   const relationshipGitOpsOwner = useMemo(() => gitOpsOwnerFromRelationships(relationships), [relationships])
   const gitopsOwner = resolvedGitOpsOwner ?? relationshipGitOpsOwner
+  const listing = useMemo(
+    () => managerListing(gitopsOwner, relationships?.managers, gitOpsOwnerVerified, !relationships?.ownership?.managers),
+    [gitopsOwner, relationships?.managers, relationships?.ownership?.managers, gitOpsOwnerVerified],
+  )
+  // When the chip's manager is the only one whose status lists the resource,
+  // the chip says it all: Related Resources would repeat it.
+  const rendererRelationships = useMemo(
+    () => (relationships && listing?.state === 'confirmed' ? { ...relationships, managers: undefined } : relationships),
+    [relationships, listing],
+  )
+  // When they disagree, Related Resources says which manager the label names.
+  const trackedBy = listing?.state === 'conflict' && gitopsOwner ? `${gitOpsOwnerKindLabel(gitopsOwner)} ${gitopsOwner.namespace ? `${gitopsOwner.namespace}/` : ''}${gitopsOwner.name}` : undefined
   // When the resource itself is a portal GitOps CR (Application, Kustomization,
   // HelmRelease, etc.), surface a link to its dedicated GitOps detail page —
   // the drawer's renderer is thorough but the tab has the tree + insights +
@@ -930,7 +950,12 @@ export function WorkloadView({
   useEffect(() => {
     if (shouldCommitFallback && activeTab !== 'overview') onTabChange?.('overview', { replace: true })
   }, [activeTab, onTabChange, shouldCommitFallback])
-  const expandedOverview = expanded ? renderExpandedOverview?.({ kind, apiKind, namespace, name, resource }) : null
+  const expandedOverview = expanded ? renderExpandedOverview?.({
+    kind, apiKind, namespace, name, resource,
+    leadContent: (hasOverviewLead ?? hasOperationalIssues) && renderOverviewLeadForState
+      ? renderOverviewLeadForState({ kind, namespace, name })
+      : undefined,
+  }) : null
   const overviewIntro = renderOverviewIntro?.({ kind, namespace, name })
 
   // ── Collapsed (drawer) mode ──────────────────────────────────────────────
@@ -1012,7 +1037,7 @@ export function WorkloadView({
             <p className="text-sm text-theme-text-tertiary">{namespace}</p>
             {(gitopsOwner || helmOwner || (gitOpsResourcePath && onNavigateGitOpsPath) || onOpenLiveTraffic) && (
               <div className="mt-1 flex flex-wrap items-center gap-1.5">
-                {gitopsOwner && <ManagedByChip owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} onOpen={onOpenGitOpsResource} />}
+                {gitopsOwner && <ManagedByChip owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} listing={listing} onOpen={onOpenGitOpsResource} />}
                 {helmOwner && <HelmManagedByChip owner={helmOwner} source={helmOwnerSource} onOpen={onOpenHelmRelease} />}
                 {gitOpsResourcePath && onNavigateGitOpsPath && (
                   <OpenInGitOpsChip onClick={() => onNavigateGitOpsPath(gitOpsResourcePath)} />
@@ -1090,15 +1115,17 @@ export function WorkloadView({
                 drawerSummary
               ) : (
               <>
-              {renderOverviewLeadForState && hasOperationalIssues && (
+              {renderOverviewLeadForState && (hasOverviewLead ?? hasOperationalIssues) && (
                 <div className="px-4 pt-4">
                   {renderOverviewLeadForState({ kind, namespace, name })}
                 </div>
               )}
+              {overviewIntro && <div className="px-4 pt-4">{overviewIntro}</div>}
               <ResourceRendererDispatch
                 resource={selectedResource}
                 data={resource}
-                relationships={relationships}
+                relationships={rendererRelationships}
+                trackedBy={trackedBy}
                 certificateInfo={certificateInfo}
                 hpaDiagnosis={hpaDiagnosis}
                 scalerDiagnostics={scalerDiagnostics}
@@ -1196,7 +1223,7 @@ export function WorkloadView({
             </Tooltip>
           ),
           gitopsOwner && (
-            <ManagedByChip key="gitops" owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} onOpen={onOpenGitOpsResource} variant="block" />
+            <ManagedByChip key="gitops" owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} listing={listing} onOpen={onOpenGitOpsResource} variant="block" />
           ),
           helmOwner && (
             <HelmManagedByChip key="helm" owner={helmOwner} source={helmOwnerSource} onOpen={onOpenHelmRelease} variant="block" />
@@ -1303,11 +1330,6 @@ export function WorkloadView({
           <div className="h-full min-h-0 overflow-y-auto">{expandedSummary}</div>
         ) : effectiveTab === 'overview' && expandedOverview ? (
           <div className="h-full min-h-0">
-            {hasOperationalIssues && renderOverviewLeadForState && (
-              <div className="px-4 pt-4">
-                {renderOverviewLeadForState({ kind, namespace, name })}
-              </div>
-            )}
             {expandedOverview}
           </div>
         ) : effectiveTab === 'spec' && specTab?.render && !resourceGone ? (
@@ -1316,7 +1338,8 @@ export function WorkloadView({
             <InfoTab
               resource={resource}
               selectedResource={selectedResource}
-              relationships={relationships}
+              relationships={rendererRelationships}
+              trackedBy={trackedBy}
               certificateInfo={certificateInfo}
               hpaDiagnosis={hpaDiagnosis}
               scalerDiagnostics={scalerDiagnostics}
@@ -1350,7 +1373,7 @@ export function WorkloadView({
                 // A host's spec lead replaces the operational issues there: its Overview already leads with them.
                 effectiveTab === 'spec' && specTab?.lead
                   ? specTab.lead
-                  : hasOperationalIssues && renderOverviewLeadForState
+                  : (hasOverviewLead ?? hasOperationalIssues) && renderOverviewLeadForState
                     ? renderOverviewLeadForState({ kind, namespace, name })
                     : undefined
               }
@@ -1377,6 +1400,7 @@ export function WorkloadView({
         )}
         {effectiveTab === 'timeline' && (
           <EventsTab
+            focusEvent={timelineFocusEvent}
             events={resourceEvents}
             isLoading={eventsLoading}
             truncated={historyTruncated}
@@ -1682,6 +1706,7 @@ function OwnershipHeading({
 // ============================================================================
 
 function EventsTab({
+  focusEvent,
   events,
   isLoading,
   truncated,
@@ -1697,6 +1722,7 @@ function EventsTab({
   topology,
   onResourceClick,
 }: {
+  focusEvent?: { id: string }
   events: TimelineEvent[]
   isLoading: boolean
   truncated?: boolean
@@ -1792,6 +1818,22 @@ function EventsTab({
     onSelectEvent(id)
   }, [onSelectEvent])
 
+  const focusedRequest = useRef<typeof focusEvent>(undefined)
+  const requestedPage = useRef<{ focus: typeof focusEvent; events: TimelineEvent[] } | undefined>(undefined)
+  const focusFound = Boolean(focusEvent && cleanEvents.some((event) => event.id === focusEvent.id))
+  useEffect(() => {
+    if (!focusEvent || focusedRequest.current === focusEvent || isLoading) return
+    if (focusFound) {
+      handleSelect(focusEvent.id)
+      focusedRequest.current = focusEvent
+    } else if (truncated && onLoadOlder && !loadingOlder && !olderError && !error) {
+      // Strict Mode can replay this effect before the loading prop updates.
+      if (requestedPage.current?.focus === focusEvent && requestedPage.current.events === events) return
+      requestedPage.current = { focus: focusEvent, events }
+      onLoadOlder()
+    }
+  }, [focusEvent, focusFound, events, isLoading, truncated, onLoadOlder, loadingOlder, olderError, error, handleSelect])
+
   if (isLoading) {
     return (
       <div className="flex items-center justify-center h-full text-theme-text-tertiary">
@@ -1821,6 +1863,15 @@ function EventsTab({
 
   return (
     <div className="h-full flex flex-col overflow-hidden">
+      {focusEvent && !focusFound && (
+        <div className="shrink-0 border-b border-theme-border px-4 py-2 text-xs text-theme-text-secondary" role="status">
+          {olderError || error
+            ? "Couldn't find the reported error because some history couldn't be loaded."
+            : truncated && onLoadOlder
+              ? 'Finding the reported error in older history…'
+              : 'The reported error is not available in the retained timeline history.'}
+        </div>
+      )}
       {error && (
         <div className="shrink-0 flex flex-wrap items-center gap-x-2 border-b border-theme-border bg-theme-base px-4 py-1.5 text-xs" role="alert">
           <span className="text-[var(--color-error)]" title={error.message}>
@@ -1926,6 +1977,7 @@ function InfoTab({
   resource,
   selectedResource,
   relationships,
+  trackedBy,
   certificateInfo,
   hpaDiagnosis,
   scalerDiagnostics,
@@ -1962,6 +2014,7 @@ function InfoTab({
   resource: any
   selectedResource: SelectedResource
   relationships?: Relationships
+  trackedBy?: string
   certificateInfo?: any
   hpaDiagnosis?: HPADiagnosis
   scalerDiagnostics?: ScalerDiagnosis[]
@@ -2016,6 +2069,7 @@ function InfoTab({
           resource={selectedResource}
           data={resource}
           relationships={relationships}
+          trackedBy={trackedBy}
           certificateInfo={certificateInfo}
           hpaDiagnosis={hpaDiagnosis}
           scalerDiagnostics={scalerDiagnostics}

package/src/hooks/index.ts

@@ -1,6 +1,8 @@
 export { useAnimatedUnmount } from './useAnimatedUnmount'
 export { useDebouncedValue } from './useDebouncedValue'
 export { useRefreshAnimation } from './useRefreshAnimation'
+export { useMediaQuery } from './useMediaQuery'
+export { usePhoneLayout, PHONE_MEDIA_QUERY } from './usePhoneLayout'
 export {
   KeyboardShortcutProvider,
   useRegisterShortcut,

package/src/hooks/useMediaQuery.ts

@@ -0,0 +1,21 @@
+import { useEffect, useState } from 'react'
+
+// Subscribe to a CSS media query. SSR-safe (returns false before mount) and
+// updates on viewport changes.
+export function useMediaQuery(query: string): boolean {
+  const [matches, setMatches] = useState(() => {
+    if (typeof window === 'undefined' || !window.matchMedia) return false
+    return window.matchMedia(query).matches
+  })
+
+  useEffect(() => {
+    if (typeof window === 'undefined' || !window.matchMedia) return
+    const mql = window.matchMedia(query)
+    const onChange = () => setMatches(mql.matches)
+    onChange()
+    mql.addEventListener('change', onChange)
+    return () => mql.removeEventListener('change', onChange)
+  }, [query])
+
+  return matches
+}

package/src/hooks/usePhoneLayout.ts

@@ -0,0 +1,12 @@
+import { useMediaQuery } from './useMediaQuery'
+
+// A phone: a narrow screen whose primary pointer is touch. A desktop browser
+// narrowed below this width keeps the desktop layout (and its content floor),
+// since a wider window can show the full UI; browser dev-tools device mode
+// emulates touch and gets the phone layout. Keep in sync with the `phone:`
+// variant in theme/tailwind-theme.css.
+export const PHONE_MEDIA_QUERY = '(max-width: 639px) and (pointer: coarse)'
+
+export function usePhoneLayout(): boolean {
+  return useMediaQuery(PHONE_MEDIA_QUERY)
+}

package/src/theme/tailwind-theme.css

@@ -6,6 +6,11 @@
  * Import after variables.css.
  */
 
+/* `phone:` styles apply on a narrow touch-first screen only (see
+ * PHONE_MEDIA_QUERY in hooks/usePhoneLayout.ts). A narrowed desktop window
+ * keeps the desktop layout. */
+@custom-variant phone (@media (max-width: 639px) and (pointer: coarse));
+
 @theme inline {
   /* Backgrounds */
   --color-theme-sidebar: var(--bg-sidebar);

package/src/types/core.ts

@@ -126,6 +126,7 @@ export interface Capabilities {
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
   workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
+  mcpReadOnly?: boolean  // Full MCP endpoint is disabled; read-only endpoints remain available
   mcpEnabled: boolean     // MCP server is running
   // Karpenter discovery and NodePool read state. Optional on the wire for the
   // same newer-frontend/older-backend reason as `deployment` below — consumers
@@ -160,6 +161,9 @@ export interface CloudConnectCapability {
 }
 
 export interface FeatureCapabilities {
+ helmSourceIdentity?: boolean
+  resourceReadCoverage?: boolean
+  searchCoverage?: boolean
   yamlReview?: boolean
   yamlSchemas?: boolean
   workloadImages?: boolean
@@ -650,10 +654,23 @@ export interface Relationships {
     sourceResourceVersion?: string
     mirrors?: ResourceRef[]
   }
-  owner?: ResourceRef
+  owner?: ResourceRef        // The owner Kubernetes acts through: the controller reference, else the only reference
+  owners?: ResourceRef[]     // Every owner reference that resolves to an existing owner
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
   managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
-  children?: ResourceRef[]
+  children?: ResourceRef[]   // Objects whose owner references name this one, less olderRevisions
+  // Children kept apart because they only keep history: ReplicaSets that run
+  // no Pods and aren't their owner's current revision. ownership.children
+  // covers both lists together.
+  olderRevisions?: ResourceRef[]
+  // Management without an owner reference: GitOps member lists, class
+  // bindings, spec and status references. Never ownership or garbage collection.
+  managers?: ResourceRef[]
+  manages?: ResourceRef[]
+  /** How complete the owner-reference and recorded-membership answers are.
+   * Absent: no completeness is claimed, whether because the server answers
+   * Owner and Children from graph edges or because the resource is an Event. */
+  ownership?: OwnershipCoverage
   services?: ResourceRef[]
   ingresses?: ResourceRef[]
   gateways?: ResourceRef[]
@@ -680,6 +697,51 @@ export interface Relationships {
   resourceClaims?: ResourceRef[]    // For Pods: DRA ResourceClaims (direct + template-generated)
 }
 
+/** A kind Radar couldn't read, in namespace or (without one) in several or all of them, or the cluster for a cluster-scoped kind; reason is a readreason code. No kind stands for kinds discovery didn't list; no group is the core group. */
+export interface OwnershipGap {
+  group?: string
+  kind?: string
+  namespace?: string
+  reason: string
+}
+
+export interface OwnershipCoverage {
+  /** The owner reference's state when no owner is named: gone, replaced, withheld, unknown, unresolvable, excluded (it names an Event) or several. */
+  primaryOwnerState?: string
+  /** The owner the reference names when it is gone, replaced or unknown. */
+  ownerRef?: ResourceRef
+  /** A readreason code saying why an unknown owner couldn't be checked. */
+  ownerReason?: string
+  children: {
+    /** Children are every child the viewer may read. */
+    complete: boolean
+    notChecked?: OwnershipGap[]
+    truncated?: boolean
+    /** The viewer may read only some of the places children could be. */
+    narrowed?: boolean
+  }
+  /** For a GitOps manager whose status lists its members. */
+  manages?: {
+    membership: 'recorded' | 'remote' | 'unreadable'
+    /** A readreason code when the member list couldn't be read, as opposed to the status recording none. */
+    unavailableReason?: string
+    missing?: number
+    withheld?: number
+    unknown?: number
+    truncated?: boolean
+  }
+  /** Set when the search for the GitOps managers whose status lists this resource, for `managers`, couldn't settle every one the viewer may read. */
+  managers?: {
+    /** Managers with a member list Radar can't read, any of which may list this resource. */
+    unreadable?: number
+    /** Managers listing this resource's coordinates for a cluster Radar can't confirm is this one. */
+    remote?: number
+    notChecked?: OwnershipGap[]
+  }
+  /** A readreason code when Radar couldn't answer at all. */
+  unavailableReason?: string
+}
+
 // Parsed X.509 certificate metadata (from backend cert parsing)
 export interface CertificateInfo {
   subject: string
@@ -1089,7 +1151,7 @@ export interface UpgradeInfo {
   error?: string
   // Machine-readable source-resolution failure, used to make the Helm drawer
   // explain whether tracking an OCI source can help.
-  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository' | 'ambiguous_source' | 'source_unavailable'
+  sourceIssue?: 'source_confirmation_required' | 'source_change_required' | 'release_changing' | 'untracked' | 'repo_index_error' | 'ambiguous_repository' | 'ambiguous_source' | 'source_unavailable'
   // True only when the error is a genuinely untracked source (registering a
   // chart source could fix it). Kept for compatibility; prefer sourceIssue.
   untracked?: boolean
@@ -1099,7 +1161,26 @@ export type ChartSourceCandidate =
   | { type: 'repository'; reference: string; url: string }
   | { type: 'oci'; reference: string; url?: never }
 
+export interface SourceUpgradeSelection {
+ source: ChartSourceCandidate
+ expectedRevision: number
+ expectedSource: ChartSourceCandidate | null
+ previewDigest?: string
+}
+
+export interface ChartSourceSuggestion {
+ source: ChartSourceCandidate
+ current: boolean
+ hasInstalledVersion: boolean
+ state: 'available' | 'index_unavailable' | 'unchecked'
+}
+
 export interface ChartSourceStatus {
+ changing?: boolean
+ revision?: number
+ confirmed?: boolean
+ sourceChangeRequired?: boolean
+ suggestions?: ChartSourceSuggestion[]
   recorded?: ChartSourceCandidate
   configured: boolean
   available: boolean
@@ -1120,6 +1201,9 @@ export interface ApplyValuesRequest {
 
 // Response for previewing values changes
 export interface ValuesPreviewResponse {
+	baselineSource?: ChartSourceCandidate
+ previewDigest?: string
+ baselineRevision?: number
   currentValues: Record<string, unknown>
   newValues: Record<string, unknown>
   manifestDiff: string
@@ -1188,6 +1272,7 @@ export interface InstallChartRequest {
 
 // ArtifactHub chart with rich metadata
 export interface ArtifactHubChart {
+  official?: boolean
   packageId: string
   name: string
   version: string
@@ -1210,6 +1295,9 @@ export interface ArtifactHubChart {
 
 // ArtifactHub repository info
 export interface ArtifactHubRepository {
+  organizationDisplayName?: string
+  userAlias?: string
+  displayName?: string
   name: string
   url: string
   official?: boolean

package/src/types/gitops-flux-inventory.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { parseFluxInventory } from './gitops'
+
+// Mirrors TestParseFluxInventoryID in pkg/gitops/helpers_test.go: the
+// Kustomization renderer and the Go tree read the same inventory IDs.
+describe('parseFluxInventory', () => {
+  it('reads a colon in an RBAC name, written as a double underscore', () => {
+    expect(
+      parseFluxInventory([
+        { id: '_system__metrics-server_rbac.authorization.k8s.io_ClusterRole', v: 'v1' },
+        { id: 'kube-system_cert-manager__leaderelection_rbac.authorization.k8s.io_Role', v: 'v1' },
+      ]),
+    ).toEqual([
+      { group: 'rbac.authorization.k8s.io', kind: 'ClusterRole', namespace: '', name: 'system:metrics-server' },
+      { group: 'rbac.authorization.k8s.io', kind: 'Role', namespace: 'kube-system', name: 'cert-manager:leaderelection' },
+    ])
+  })
+
+  it('keeps single underscores in a name and the empty core group', () => {
+    expect(parseFluxInventory([{ id: 'ns_my_weird_name__ConfigMap' }])).toEqual([
+      { group: '', kind: 'ConfigMap', namespace: 'ns', name: 'my_weird_name' },
+    ])
+  })
+})

package/src/types/gitops-insights.ts

@@ -170,6 +170,7 @@ export interface GitOpsChange {
   hookPhase?: string
   hasDesired: boolean
   hasLive: boolean
+  missing?: boolean
   // Structured per-field diff between the desired state (parsed from
   // kubectl.kubernetes.io/last-applied-configuration) and the live spec.
   // Undefined when the diff couldn't be computed (no annotation, SSA-applied

package/src/types/gitops-tree.ts

@@ -24,6 +24,8 @@ export interface GitOpsTreeNode {
   tool: GitOpsTreeTool
   sync?: SyncStatus
   health?: GitOpsHealthStatus
+  // A local lookup confirmed NotFound; independent of controller health.
+  missing?: boolean
   // Who assessed `health`. 'controller' is the GitOps controller's own
   // verdict; 'radar' is Radar's read of the live object (topology status, or
   // the issues engine's finding when the controller's verdict isn't

package/src/types/gitops.ts

@@ -446,9 +446,7 @@ export function argoApplicationSetConditionsToGitOpsStatus(
 export function parseFluxInventory(entries: Array<{ id: string; v?: string }>): ManagedResource[] {
   return entries
     .map(entry => {
-      // Format: namespace_name_group_kind
-      // The challenge is that namespace, name, and group can all contain underscores
-      // But the format is always: ns_name_group_kind where kind is the last part
+      // Format: namespace_name_group_kind; only the name can hold an underscore.
       const id = entry.id || ''
       const parts = id.split('_')
 
@@ -460,9 +458,11 @@ export function parseFluxInventory(entries: Array<{ id: string; v?: string }>):
       // Kind is always last, group is second-to-last
       const kind = parts[parts.length - 1]
       const group = parts[parts.length - 2]
-      // Namespace is first, name is everything in between
+      // Namespace is first, name is everything in between. Flux writes a colon
+      // in an RBAC object's name as a double underscore (system:metrics-server
+      // is system__metrics-server) and reads every "__" back as a colon.
       const namespace = parts[0]
-      const name = parts.slice(1, -2).join('_')
+      const name = parts.slice(1, -2).join('_').replaceAll('__', ':')
 
       // Validate required fields
       if (!kind || !name) {

package/src/types/index.ts

@@ -1,4 +1,5 @@
 export * from './core'
+export * from './read-coverage'
 export * from './fetch-error'
 export * from './gitops'
 export * from './gitops-tree'
@@ -6,3 +7,5 @@ export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
 export * from './policy'
+export * from './read-coverage'
+export * from './resource-coverage'

package/src/types/read-coverage.ts

@@ -0,0 +1,65 @@
+// Coverage of a Radar read, as Radar's pkg/resourceapi serializes it. Codes
+// come from Radar's pkg/readreason.
+
+/**
+ * A known, finite set of `count` members. `names` lists all of them, sorted,
+ * when there are few enough for the response; otherwise it is absent and which
+ * members are in the set is unknown.
+ */
+export interface ReadNameSet {
+  count: number
+  names?: string[]
+}
+
+/**
+ * How far a gap reaches along one axis when it can't list it: `all` of the
+ * answer's scope, or an `unknown` part of it. A value a client doesn't know
+ * reads as unknown.
+ */
+export type ReadExtent = 'all' | 'unknown' | (string & {})
+
+/** A gap's set along one axis: listed like a ReadNameSet, or an extent. */
+export type ReadGapSet<T> = { count: number; names?: T[]; extent?: undefined } | { extent: ReadExtent; count?: undefined; names?: undefined }
+
+/** A kind; an omitted group is the core group. */
+export interface ReadKindRef {
+  kind: string
+  group?: string
+}
+
+export interface ReadObjectRef {
+  kind: string
+  group?: string
+  namespace?: string
+  name: string
+}
+
+/**
+ * Part of an answer Radar did not read, and why. A gap covers every
+ * combination of its axes. An axis that applies is always present, listed or
+ * as an extent; an absent axis doesn't apply to the gap (namespaces on a
+ * cluster-scoped kind). Within one answer a namespace is in at most one gap.
+ * `action` is what the code calls for, so a code the client doesn't know still
+ * says what resolves it.
+ */
+export interface ReadGap {
+  code: string
+  action?: string
+  kinds?: ReadGapSet<ReadKindRef>
+  namespaces?: ReadGapSet<string>
+  objects?: { count: number; names?: ReadObjectRef[] }
+}
+
+/** Why an implicitly broad read covers less than everything. */
+export type ReadNarrowing = 'user_access' | 'namespace_pin' | 'namespace_collection' | 'kind_collection' | (string & {})
+
+/**
+ * A search's coverage: `partial` when something the query named couldn't be
+ * searched or a read failed; `narrowedBy` when a broad query searched only
+ * what the caller's access and Radar's collection allow.
+ */
+export interface SearchCoverage {
+  status: 'complete' | 'partial'
+  narrowedBy?: ReadNarrowing[]
+  gaps: ReadGap[]
+}

package/src/types/resource-coverage.ts

@@ -0,0 +1,40 @@
+import type { ReadGap, ReadNameSet, ReadNarrowing } from './read-coverage'
+
+export interface ResourceReadScope {
+  type: 'cluster' | 'all_namespaces' | 'namespaces'
+  namespaces?: ReadNameSet
+}
+
+/**
+ * A single-kind read's coverage. `status` is relative to `scope`: the
+ * namespaces the request named, or what remained of every namespace after
+ * `narrowedBy` (the caller's access, Radar's pin, what Radar collects) narrowed it.
+ */
+export interface ResourceReadCoverage {
+  status: 'complete' | 'partial'
+  scope: ResourceReadScope
+  narrowedBy?: ReadNarrowing[]
+  /** What Radar read; on every successful answer, never on a failed read's coverage. */
+  read?: ResourceReadScope
+  gaps: ReadGap[]
+}
+
+export type ResourceCoverage = ResourceReadCoverage | { status: 'unknown' }
+
+export interface ResourceListResponse<T> {
+  items: T[]
+  coverage: ResourceReadCoverage
+  /** The lowercased plural from the request path, not a Kubernetes Kind. */
+  kind?: string
+  /** Omitted for the core group. */
+  group?: string
+  columns?: import('../components/resources/printer-columns').PrinterColumnDef[] | null
+  cells?: Record<string, unknown[]> | null
+}
+
+/** A failed resource read's body, on REST and in MCP results alike. */
+export interface ResourceReadErrorBody {
+  error: string
+  error_code: string
+  coverage?: ResourceReadCoverage
+}

package/src/utils/format.test.ts

@@ -50,6 +50,13 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('1E3')).toBe(1000)
     expect(formatMemoryString('1e9')).toBe('954 MiB')
   })
+
+  it('reads sub-unit suffixes as fractions of a byte', () => {
+    expect(parseMemoryToBytes('1181116006400m')).toBeCloseTo(1181116006.4)
+    expect(parseMemoryToBytes('1000000u')).toBeCloseTo(1)
+    expect(parseMemoryToBytes('1000000000n')).toBeCloseTo(1)
+    expect(formatMemoryString('18360985190400m')).toBe('17.1 GiB')
+  })
 })
 
 describe('parseQuantityToNumber', () => {