@skyhook-io/k8s-ui 1.17.1 → 1.18.1

package/src/components/resources/renderers/PodRenderer.test.tsx

@@ -21,6 +21,70 @@ const pod = {
   status: { phase: 'Running' },
 }
 
+describe('PodRenderer completed readiness conditions', () => {
+  const completionConditions = [
+    { type: 'PodReadyToStartContainers', status: 'False' },
+    { type: 'Initialized', status: 'True', reason: 'PodCompleted' },
+    { type: 'Ready', status: 'False', reason: 'PodCompleted' },
+    { type: 'ContainersReady', status: 'False', reason: 'PodCompleted' },
+    { type: 'PodScheduled', status: 'True' },
+  ]
+  const renderConditions = (phase: string | undefined, conditions = completionConditions) => renderToString(
+    <PodRenderer
+      data={{ ...pod, status: { phase, conditions } }}
+      onCopy={() => undefined}
+      copied={null}
+    />,
+  )
+
+  it('keeps completed readiness observations visible without counting them as failing', () => {
+    const html = renderConditions('Succeeded')
+
+    expect(html).toContain('Conditions (5)')
+    expect(html).not.toContain('failing')
+    expect(html).toContain('PodReadyToStartContainers')
+    expect(html).toContain('ContainersReady')
+    expect(html).toContain('PodCompleted')
+  })
+
+  it('uses successful completion even when readiness reasons are stale or absent', () => {
+    const html = renderConditions('Succeeded', [
+      { type: 'PodReadyToStartContainers', status: 'False' },
+      { type: 'Ready', status: 'False', reason: 'ContainersNotReady' },
+      { type: 'ContainersReady', status: 'False' },
+    ])
+
+    expect(html).toContain('Conditions (3)')
+    expect(html).not.toContain('failing')
+    expect(html).toContain('ContainersNotReady')
+  })
+
+  it.each(['Running', 'Failed', undefined])('retains readiness failures when phase is %s', (phase) => {
+    const html = renderConditions(phase, [
+      { type: 'PodReadyToStartContainers', status: 'False' },
+      { type: 'Ready', status: 'False', reason: 'PodFailed' },
+      { type: 'ContainersReady', status: 'False' },
+    ])
+
+    expect(html).toContain('Conditions (3) · 3 failing')
+  })
+
+  it('does not let a completion reason hide readiness failures on a failed Pod', () => {
+    expect(renderConditions('Failed')).toContain('Conditions (5) · 3 failing')
+  })
+
+  it('retains unrelated false conditions after successful completion', () => {
+    const html = renderConditions('Succeeded', [
+      ...completionConditions,
+      { type: 'example.com/controller-ready', status: 'False', reason: 'ControllerFailed' },
+    ])
+
+    expect(html).toContain('Conditions (6) · 1 failing')
+    expect(html).toContain('example.com/controller-ready')
+    expect(html).toContain('ControllerFailed')
+  })
+})
+
 describe('PodRenderer envFrom expansion', () => {
   it('keeps same-name ConfigMap and Secret values separate', () => {
     const resolvedEnvFrom: ResolvedEnvFrom = {
@@ -482,3 +546,54 @@ it('shows reported running-but-unready nginx readiness as degraded', () => {
   expect(html).toMatch(/bg-amber-100[^>]*>Not Ready</)
   expect(html).toMatch(/>running</)
 })
+
+describe('finished Pod resource usage',()=>{
+ it.each(['Succeeded','Failed'])('explains ended live usage for %s without cluster repair advice',phase=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase}}} onCopy={()=>{}} copied={null} metricsUnavailable metricsHistory={{containers:[],metricsUnavailableReason:'not found'}} />)
+  expect(html).toContain('Live resource usage has ended for this Pod')
+  expect(html).toContain('No recorded usage is available.')
+  expect(html).not.toContain('Metrics collection error:')
+  expect(html).not.toContain('Radar cannot read metrics.k8s.io')
+  expect(html).not.toContain('No usage yet: this Pod is not running')
+ })
+ it('keeps a genuine collector error qualified as current on a finished Pod',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Succeeded'}}} onCopy={()=>{}} copied={null} metricsHistory={{containers:[],collectionError:'forbidden: list pods.metrics.k8s.io'}} />)
+  expect(html).toContain('Current cluster metrics collection error:')
+  expect(html).toContain('forbidden: list pods.metrics.k8s.io')
+  expect(html).toContain('Live resource usage has ended for this Pod')
+ })
+ it('keeps recorded history and hides cached live usage after completion',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Succeeded'}}} onCopy={()=>{}} copied={null}
+   metrics={{timestamp:'2026-10-25T12:00:00Z',containers:[{name:'cached-live',usage:{cpu:'100m',memory:'1Mi'}}]}}
+   metricsHistory={{containers:[{name:'recorded-history',dataPoints:[{timestamp:'2026-10-25T11:59:00Z',cpu:100,memory:1024}]}]}} />)
+  expect(html).toContain('recorded-history')
+  expect(html).not.toContain('cached-live')
+  expect(html).not.toContain('Last updated:')
+ })
+ it('distinguishes loading from a loaded empty terminal history',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Succeeded'}}} onCopy={()=>{}} copied={null} metricsHistoryLoading />)
+  expect(html).toContain('Loading recorded usage...')
+  expect(html).not.toContain('No recorded usage is available.')
+ })
+ it('shows a failed terminal history fetch without claiming empty history',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Failed'}}} onCopy={()=>{}} copied={null} metricsHistoryError={new Error('Metrics history not available')} />)
+  expect(html).toContain('Recorded usage could not be loaded')
+  expect(html).toContain('Metrics history not available')
+  expect(html).not.toContain('No recorded usage is available.')
+ })
+ it('retains cached history when its refresh fails',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Succeeded'}}} onCopy={()=>{}} copied={null}
+   metricsHistory={{containers:[{name:'recorded-history',dataPoints:[{timestamp:'2026-10-25T11:59:00Z',cpu:100,memory:1024}]}]}}
+   metricsHistoryError={new Error('Network request failed')} />)
+  expect(html).toContain('Recorded usage could not be refreshed')
+  expect(html).toContain('recorded-history')
+  expect(html).not.toContain('No recorded usage is available.')
+ })
+
+ it('keeps usage absent when the host wires no metrics state',()=>{
+  const html=renderToString(<PodRenderer data={{...pod,status:{phase:'Succeeded'}}} onCopy={()=>{}} copied={null} />)
+  expect(html).not.toContain('Resource Usage')
+  expect(html).not.toContain('Live resource usage has ended')
+ })
+
+})

package/src/components/resources/renderers/PodRenderer.tsx

@@ -4,7 +4,7 @@ import { clsx } from 'clsx'
 import { PolicySection } from './PolicySection'
 import type { PolicyResourceResponse } from '../../../types/policy'
 import { Section, PropertyList, Property, ConditionsSection, CopyHandler, AlertBanner, ResourceLink, useOperationalIssuesShown } from '../../ui/drawer-components'
-import { formatResources, formatDuration, getPodProblems, getPodPhaseDisplay, healthColors, SEVERITY_DOT_COLOR, getDefaultContainerName } from '../resource-utils'
+import { formatResources, formatDuration, getPodProblems, getPodPhaseDisplay, healthColors, SEVERITY_DOT_COLOR, getDefaultContainerName, getExecContainerNames } from '../resource-utils'
 import { getResourceStatusColor, SEVERITY_BORDER } from '../../../utils/badge-colors'
 import {
   rbacVerbBadgeClass,
@@ -87,11 +87,13 @@ interface PodRendererProps {
   // Metrics data injection
   metrics?: { containers?: any[]; timestamp?: string }
   metricsHistory?: { metricsAPIReachable?: boolean; containers?: any[]; collectionError?: string; metricsUnavailableReason?: string; metricsUnavailableDiagnosis?: string }
+  metricsHistoryLoading?: boolean
+  metricsHistoryError?: Error | null
   metricsUnavailable?: boolean
   hideMetricsServer?: boolean
   // Filesystem browser render props
   renderImageBrowser?: (props: { image: string; namespace: string; podName: string; pullSecrets: string[]; onClose: () => void; onSwitchToPodFiles?: () => void }) => ReactNode
-  renderPodBrowser?: (props: { namespace: string; podName: string; containers: string[]; initialContainer: string; onClose: () => void; onSwitchToImageFiles: () => void }) => ReactNode
+  renderPodBrowser?: (props: { namespace: string; podName: string; containers: string[]; initialContainer: string; onClose: () => void; onSwitchToImageFiles: (containerName?: string) => void }) => ReactNode
   /**
    * Resolved content for envFrom references.
    * When provided, expands ConfigMap/Secret keys inline instead of showing "(all keys)".
@@ -286,6 +288,8 @@ export function PodRenderer({
   renderPortAction,
   metrics,
   metricsHistory,
+  metricsHistoryLoading,
+  metricsHistoryError,
   metricsUnavailable,
   hideMetricsServer,
   renderImageBrowser,
@@ -320,6 +324,7 @@ export function PodRenderer({
   const namespace = data.metadata?.namespace
   const podName = data.metadata?.name
   const isRunning = data.status?.phase === 'Running'
+  const isTerminal = data.status?.phase === 'Succeeded' || data.status?.phase === 'Failed'
 
   // Check for problems. Suppressed when the detail already shows the dedicated
   // Operational Issues section (the Issues pipeline covers the same pod failures,
@@ -329,9 +334,10 @@ export function PodRenderer({
   const hasProblems = podProblems.length > 0 && !operationalIssuesShown
   const notRunning = data.status?.phase === 'Pending' && ![...containerStatuses, ...initContainerStatuses].some((s: any) => s.state?.running)
   const noUsageYet = notRunning && metricsHistory?.metricsAPIReachable === true && !metricsHistory.collectionError && !metricsHistory.containers?.length && !metrics?.containers?.length
-  const showMetricsUnavailable = !!metricsUnavailable && !metricsHistory?.collectionError && !noUsageYet
+  const showMetricsUnavailable = !isTerminal && !!metricsUnavailable && !metricsHistory?.collectionError && !noUsageYet
   const hasMetricsHistory = !!metricsHistory?.containers?.length
-  const currentMetrics = metricsUnavailable ? undefined : metrics
+  const showTerminalUsage = isTerminal && (metricsHistory !== undefined || metricsHistoryLoading || !!metricsHistoryError || !!metrics || metricsUnavailable)
+  const currentMetrics = isTerminal || metricsUnavailable ? undefined : metrics
 
   // Image filesystem modal state
   const [selectedImage, setSelectedImage] = useState<string | null>(null)
@@ -340,6 +346,16 @@ export function PodRenderer({
   // Pod filesystem modal state
   const [podFilesContainer, setPodFilesContainer] = useState<string | null>(null)
 
+  // A sidecar can be running while the pod is still Pending, and a stopped
+  // container has no live files, so match the image against running containers.
+  const runningImageContainer = selectedImage
+    ? getExecContainerNames(data).find((name) => {
+        const spec = [...containers, ...initContainers].find((c: any) => c.name === name)
+        const status = [...containerStatuses, ...initContainerStatuses].find((st: any) => st.name === name)
+        return spec?.image === selectedImage && !!status?.state?.running
+      })
+    : undefined
+
   const handleOpenTerminal = (containerName?: string) => {
     const container = containerName || getDefaultContainerName(data)
     if (namespace && podName && container) {
@@ -347,7 +363,7 @@ export function PodRenderer({
         namespace,
         podName,
         containerName: container,
-        containers: containers.map((c: { name: string }) => c.name),
+        containers: getExecContainerNames(data),
       })
     }
   }
@@ -512,6 +528,7 @@ export function PodRenderer({
               const isFailed = stateKey === 'terminated' && exitCode != null && exitCode !== 0
               const isWaiting = stateKey === 'waiting'
               const isInitRunning = stateKey === 'running'
+              const isSidecar = container.restartPolicy === 'Always'
 
               // Status label and color
               let statusLabel: string
@@ -553,6 +570,26 @@ export function PodRenderer({
                       <span className="text-sm font-medium text-theme-text-primary">{container.name}</span>
                     </div>
                     <div className="flex items-center gap-2">
+                      {isSidecar && isInitRunning && canExec && onOpenTerminal && (
+                        <Tooltip content="Terminal" delay={150}>
+                          <button
+                            onClick={() => handleOpenTerminal(container.name)}
+                            className="p-1 text-slate-400 hover:text-blue-400 hover:bg-slate-600/50 rounded transition-colors"
+                          >
+                            <TerminalIcon className="w-4 h-4" />
+                          </button>
+                        </Tooltip>
+                      )}
+                      {isSidecar && isInitRunning && canExec && renderPodBrowser && (
+                        <Tooltip content="Browse files" delay={150}>
+                          <button
+                            onClick={() => setPodFilesContainer(container.name)}
+                            className="p-1 text-slate-400 hover:text-blue-400 hover:bg-slate-600/50 rounded transition-colors"
+                          >
+                            <FolderOpen className="w-4 h-4" />
+                          </button>
+                        </Tooltip>
+                      )}
                       {canViewLogs && (
                         <Tooltip content="Logs" delay={150}>
                           <button
@@ -841,15 +878,30 @@ export function PodRenderer({
       )}
 
       {/* Resource Usage (from metrics-server) — hidden when Prometheus has CPU/memory data */}
-      {!hideMetricsServer && !!(currentMetrics?.containers?.length || hasMetricsHistory || metricsHistory?.collectionError || showMetricsUnavailable || noUsageYet) && (
+      {!hideMetricsServer && !!(showTerminalUsage || currentMetrics?.containers?.length || hasMetricsHistory || metricsHistory?.collectionError || showMetricsUnavailable || noUsageYet) && (
         <Section title="Resource Usage" icon={Activity} defaultExpanded>
+          {isTerminal && (
+            <div className="mb-3 text-sm text-theme-text-tertiary">
+              Live resource usage has ended for this Pod.{metricsHistory && !hasMetricsHistory && !metricsHistoryLoading && !metricsHistoryError && ' No recorded usage is available.'}
+            </div>
+          )}
+          {isTerminal && metricsHistoryLoading && (
+            <p className="mb-3 text-sm text-theme-text-tertiary">Loading recorded usage...</p>
+          )}
+          {isTerminal && metricsHistoryError && (
+            <AlertBanner
+              variant="warning"
+              title={metricsHistory ? 'Recorded usage could not be refreshed' : 'Recorded usage could not be loaded'}
+              message={metricsHistoryError.message}
+            />
+          )}
           {noUsageYet && <MetricsUnavailableNotice noUsageYet />}
           {showMetricsUnavailable && (
             <MetricsUnavailableNotice rawError={metricsHistory?.metricsUnavailableReason} diagnosis={metricsHistory?.metricsUnavailableDiagnosis} />
           )}
           {metricsHistory?.collectionError && (
             <div className="mb-3 rounded-lg border border-yellow-500/30 bg-yellow-500/5 px-3 py-2 text-xs text-yellow-400">
-              <span className="font-medium">Metrics collection error:</span>{' '}
+              <span className="font-medium">{isTerminal ? 'Current cluster metrics collection error:' : 'Metrics collection error:'}</span>{' '}
               <span className="break-all">{metricsHistory.collectionError}</span>
             </div>
           )}
@@ -939,14 +991,16 @@ export function PodRenderer({
         </Section>
       )}
 
-      {/* Conditions. A completed pod's Ready/ContainersReady flip to False with
-          reason "PodCompleted" — that's expected for a finished pod, not a failure,
-          so tone it neutral (gray) instead of red. Gated on the PodCompleted reason
-          so a genuinely not-ready pod (any other reason) still reads red. */}
+      {/* Sandbox teardown and lost serving readiness are expected after success;
+          custom conditions retain their own meaning. */}
       <ConditionsSection
         conditions={data.status?.conditions}
         getConditionTone={(cond) =>
-          cond?.status === 'False' && cond?.reason === 'PodCompleted' ? 'unknown' : undefined
+          data.status?.phase === 'Succeeded'
+            && cond?.status === 'False'
+            && ['Ready', 'ContainersReady', 'PodReadyToStartContainers'].includes(cond?.type)
+            ? 'unknown'
+            : undefined
         }
       />
 
@@ -973,10 +1027,8 @@ export function PodRenderer({
         podName: podName || '',
         pullSecrets: imagePullSecrets,
         onClose: () => setSelectedImage(null),
-        onSwitchToPodFiles: isRunning && canExec && renderPodBrowser ? () => {
-          // Find which container uses this image and open pod files for it
-          const match = containers.find((c: any) => c.image === selectedImage)
-          setPodFilesContainer(match?.name || containers[0]?.name)
+        onSwitchToPodFiles: canExec && renderPodBrowser && (isRunning || runningImageContainer) ? () => {
+          setPodFilesContainer(runningImageContainer || containers[0]?.name)
         } : undefined,
       })}
 
@@ -984,12 +1036,12 @@ export function PodRenderer({
       {podFilesContainer && renderPodBrowser && renderPodBrowser({
         namespace: namespace || '',
         podName: podName || '',
-        containers: containers.map((c: { name: string }) => c.name),
+        containers: getExecContainerNames(data),
         initialContainer: podFilesContainer,
         onClose: () => setPodFilesContainer(null),
-        onSwitchToImageFiles: () => {
-          // Find which image this container uses and open image filesystem
-          const match = containers.find((c: any) => c.name === podFilesContainer)
+        onSwitchToImageFiles: (containerName?: string) => {
+          const selected = containerName || podFilesContainer
+          const match = [...containers, ...initContainers].find((c: any) => c.name === selected)
           if (match?.image) setSelectedImage(match.image)
         },
       })}

package/src/components/resources/resource-utils-trivy.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest'
+import { searchTrivyFindings, trivyReportImageRef } from './resource-utils-trivy'
+
+const vuln = {
+  metadata: { name: 'replicaset-billing-5cfccf7776-php-nginx', namespace: 'legacy' },
+  report: {
+    registry: { server: 'index.docker.io' },
+    artifact: { repository: 'trafex/php-nginx', tag: '3.6.0', digest: 'sha256:abc' },
+    vulnerabilities: [
+      { vulnerabilityID: 'CVE-2025-0001', resource: 'libssl3', installedVersion: '3.3.2-r0', fixedVersion: '3.3.3-r0' },
+      { vulnerabilityID: 'CVE-2026-109618', resource: 'php83', installedVersion: '8.3.20-r0', fixedVersion: '8.3.36-r0' },
+      { vulnerabilityID: 'CVE-2026-0002', resource: 'busybox', installedVersion: '1.36.1-r29' },
+    ],
+  },
+}
+const secrets = {
+  metadata: { name: 'replicaset-billing-secrets', namespace: 'legacy' },
+  report: { secrets: [{ ruleID: 'aws-access-key-id', target: '/var/www/html/.env', match: 'AWS_ACCESS_KEY_ID=AKIAREVIEWFIXTURE01' }] },
+}
+const audit = {
+  metadata: { name: 'replicaset-api-8467889d75', namespace: 'team-b' },
+  report: { checks: [{ checkID: 'KSV012', success: false }, { checkID: 'KSV001', success: true }] },
+}
+const sbom = {
+  metadata: { name: 'replicaset-web-sbom', namespace: 'shop' },
+  report: { components: { components: [{ name: 'guzzlehttp/guzzle', version: '7.8.1' }] } },
+}
+
+describe('searchTrivyFindings', () => {
+  it('matches a CVE and names the finding with its versions', () => {
+    const { matches, truncated } = searchTrivyFindings([vuln, secrets], 'cve-2026-109618')
+    expect(truncated).toBe(false)
+    expect([...matches.keys()]).toEqual([vuln])
+    expect(matches.get(vuln)).toEqual({ site: 'finding', text: 'CVE-2026-109618 php83 8.3.20-r0 → 8.3.36-r0' })
+  })
+
+  it('matches packages, unfixed findings, SBOM components and failed checks', () => {
+    const text = (r: any, term: string) => searchTrivyFindings([r], term).matches.get(r)?.text
+    expect(text(vuln, 'php83')).toContain('php83')
+    expect(text(vuln, 'busybox')).toBe('CVE-2026-0002 busybox 1.36.1-r29 → unfixed')
+    expect(text(sbom, 'guzzle')).toBe('guzzlehttp/guzzle 7.8.1')
+    expect(text(audit, 'ksv012')).toBe('KSV012')
+  })
+
+  it('tells an image match apart from a finding', () => {
+    expect(searchTrivyFindings([vuln], 'sha256:abc').matches.get(vuln)).toEqual({ site: 'image', text: 'index.docker.io/trafex/php-nginx:3.6.0@sha256:abc' })
+  })
+
+  it('treats the term as text, not a pattern', () => {
+    expect(searchTrivyFindings([vuln], '8.3.20-r0 →').matches.has(vuln)).toBe(true)
+    expect(searchTrivyFindings([vuln], 'php8.').matches.size).toBe(0)
+  })
+
+  it('caps a finding at 256 UTF-8 bytes for phrases, like server search', () => {
+    const wide = { metadata: { name: 'r', namespace: 'n' }, report: { components: { components: [{ name: 'é'.repeat(128), version: 'needle' }] } } }
+    expect(searchTrivyFindings([wide], 'é needle').matches.size).toBe(0)
+    expect(searchTrivyFindings([wide], 'needle').matches.size).toBe(1)
+  })
+
+  it('matches a phrase across one finding, never across findings', () => {
+    expect(searchTrivyFindings([vuln], 'php83 8.3.20').matches.has(vuln)).toBe(true)
+    expect(searchTrivyFindings([vuln], 'libssl3 8.3.20').matches.has(vuln)).toBe(false)
+  })
+
+  it('never searches a passing check or a secret finding\'s matched text', () => {
+    expect(searchTrivyFindings([audit], 'ksv001').matches.size).toBe(0)
+    expect(searchTrivyFindings([secrets], 'akiareview').matches.size).toBe(0)
+    expect(searchTrivyFindings([secrets], 'aws-access-key-id').matches.get(secrets)?.text).toBe('aws-access-key-id /var/www/html/.env')
+  })
+
+  it('skips rows whose name or namespace already match', () => {
+    expect(searchTrivyFindings([vuln], 'legacy').matches.size).toBe(0)
+  })
+
+  it('stops at the findings limit and says the search was cut short', () => {
+    const { matches, truncated } = searchTrivyFindings([vuln, vuln], 'cve-2026-0002', 4)
+    expect(truncated).toBe(true)
+    expect(matches.size).toBe(1)
+  })
+})
+
+describe('trivyReportImageRef', () => {
+  it('renders registry/repository:tag@digest like server search', () => {
+    expect(trivyReportImageRef(vuln)).toBe('index.docker.io/trafex/php-nginx:3.6.0@sha256:abc')
+    expect(trivyReportImageRef({ report: {} })).toBe('')
+  })
+})

package/src/components/resources/resource-utils-trivy.ts

@@ -55,6 +55,128 @@ export function getVulnerabilityReportContainer(report: any): string {
   return report.metadata?.labels?.['trivy-operator.container.name'] || '-'
 }
 
+// ============================================================================
+// TRIVY OPERATOR — TABLE SEARCH OVER FINDINGS
+// ============================================================================
+
+export const TRIVY_GROUP = 'aquasecurity.github.io'
+
+// Bounds one table search over findings. The filter runs on the main thread,
+// and a cluster can hold thousands of reports with hundreds of findings each.
+const MAX_TABLE_FINDINGS = 200_000
+
+// Server search caps one indexed finding at 256 bytes (internal/search/trivy.go).
+const MAX_FINDING_LABEL = 256
+
+export interface TrivyFindingMatch {
+  site: 'finding' | 'image'
+  text: string
+}
+
+export interface TrivyFindingsSearch {
+  // Rows that matched only through a finding or the scanned image.
+  matches: Map<object, TrivyFindingMatch>
+  truncated: boolean
+}
+
+function str(v: unknown): string {
+  return typeof v === 'string' ? v : ''
+}
+
+function asArray(v: unknown): any[] {
+  return Array.isArray(v) ? v : []
+}
+
+// findingLabel joins a finding's parts and caps it at MAX_FINDING_LABEL
+// UTF-8 bytes on a character boundary, as server search does, so a phrase
+// that falls past the cap matches in neither place.
+function findingLabel(...parts: string[]): string {
+  const label = parts.filter(Boolean).join(' ')
+  // A UTF-16 unit is at most 3 UTF-8 bytes, so short labels need no count.
+  if (label.length * 3 <= MAX_FINDING_LABEL) return label
+  let bytes = 0
+  let end = 0
+  for (const ch of label) {
+    const cp = ch.codePointAt(0) ?? 0
+    const size = cp < 0x80 ? 1 : cp < 0x800 ? 2 : cp < 0x10000 ? 3 : 4
+    if (bytes + size > MAX_FINDING_LABEL) break
+    bytes += size
+    end += ch.length
+  }
+  return label.slice(0, end)
+}
+
+// trivyReportImageRef renders a report's scanned image the way search
+// indexes it: registry/repository:tag@digest.
+export function trivyReportImageRef(resource: any): string {
+  const report = resource?.report
+  const repo = str(report?.artifact?.repository)
+  if (!repo) return ''
+  const registry = str(report?.registry?.server)
+  let ref = registry ? `${registry}/${repo}` : repo
+  const tag = str(report?.artifact?.tag)
+  if (tag) ref += `:${tag}`
+  const digest = str(report?.artifact?.digest)
+  if (digest) ref += `@${digest}`
+  return ref
+}
+
+// searchTrivyFindings finds reports whose findings contain term, over the
+// entries server search indexes (internal/search/trivy.go): CVE IDs with
+// package and versions, SBOM components, failed check IDs, secret rule IDs
+// and targets, plus the scanned image. A secret finding's `match` is the
+// matched line itself and is never searched. A term with a space matches
+// within one finding, never across two. Rows whose name or namespace already
+// contain term are skipped, since they match without a finding.
+export function searchTrivyFindings(resources: readonly any[], term: string, limit = MAX_TABLE_FINDINGS): TrivyFindingsSearch {
+  const matches = new Map<object, TrivyFindingMatch>()
+  const re = new RegExp(term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i')
+  const spaced = term.includes(' ')
+  const hit = (...parts: string[]): boolean =>
+    spaced ? re.test(findingLabel(...parts)) : parts.some((p) => p !== '' && re.test(p))
+  let left = limit
+  for (const r of resources) {
+    const meta = r?.metadata
+    if (re.test(str(meta?.name)) || re.test(str(meta?.namespace))) continue
+    const report = r?.report
+    if (!report || typeof report !== 'object') continue
+    const image = trivyReportImageRef(r)
+    if (image && re.test(image)) {
+      matches.set(r, { site: 'image', text: image })
+      continue
+    }
+    let found = ''
+    let truncated = false
+    scan: {
+      for (const v of asArray(report.vulnerabilities)) {
+        if (--left < 0) { truncated = true; break scan }
+        const id = str(v?.vulnerabilityID)
+        if (!id) continue
+        const parts = [id, str(v.resource), str(v.installedVersion), '→', str(v.fixedVersion) || 'unfixed']
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+      for (const c of asArray(report.components?.components)) {
+        if (--left < 0) { truncated = true; break scan }
+        const parts = [str(c?.name), str(c?.version)]
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+      for (const c of asArray(report.checks)) {
+        if (--left < 0) { truncated = true; break scan }
+        if (c?.success !== false) continue
+        if (hit(str(c.checkID))) { found = findingLabel(str(c.checkID)); break scan }
+      }
+      for (const sec of asArray(report.secrets)) {
+        if (--left < 0) { truncated = true; break scan }
+        const parts = [str(sec?.ruleID), str(sec?.target)]
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+    }
+    if (found) matches.set(r, { site: 'finding', text: found })
+    if (truncated) return { matches, truncated: true }
+  }
+  return { matches, truncated: false }
+}
+
 // ============================================================================
 // TRIVY OPERATOR — CONFIG AUDIT REPORT UTILITIES
 // ============================================================================

package/src/components/resources/resource-utils.ts

@@ -106,7 +106,7 @@ export function summarizeSchedulerMessage(message?: string, options: { plain?: b
     [/^(\d+) (?:node\(s\) )?Insufficient memory(?: \(0\/\d+ nodes available\))?$/i, 'do not have enough memory'],
     [/^(\d+) node\(s\) (?:didn.t match Pod.s node affinity\/selector|node affinity\/selector mismatch)(?: \(0\/\d+ nodes available\))?$/i, 'do not match the Pod’s node affinity or selector'],
     [/^(\d+) node\(s\) (?:had )?untolerated taint(?:\(s\))?(?: \{[^}]*\}| [^\s]+)?(?: \(0\/\d+ nodes available\))?$/i, 'have taints the Pod does not tolerate'],
-    [/^(\d+) node\(s\) (?:had )?volume node[- ]affinity conflict(?: \(0\/\d+ nodes available\))?$/i, 'do not match the volume’s node affinity'],
+    [/^(\d+) node\(s\) (?:(?:had )?volume node[- ]affinity conflict|didn.t match PersistentVolume.s node affinity)(?: \(0\/\d+ nodes available\))?$/i, 'do not match the volume’s node affinity'],
   ]
   return splitSchedulerClauses(m).filter((part) => part.trim()).map((part) => {
     const clause = part.trim()
@@ -738,6 +738,19 @@ export function getDefaultContainerName(pod: any): string | undefined {
   return containers[0]?.name
 }
 
+/**
+ * The containers a terminal can target: the regular containers, then native
+ * sidecars (init containers with restartPolicy: Always, Kubernetes 1.29+),
+ * which keep running for the pod's lifetime like regular containers.
+ */
+export function getExecContainerNames(pod: any): string[] {
+  const regular = (pod?.spec?.containers || []).map((c: any) => c.name)
+  const sidecars = (pod?.spec?.initContainers || [])
+    .filter((c: any) => c.restartPolicy === 'Always')
+    .map((c: any) => c.name)
+  return [...regular, ...sidecars].filter(Boolean)
+}
+
 export function getContainerSquareStates(pod: any): ContainerSquareState[] {
   const result: ContainerSquareState[] = []
   const initStatuses = pod.status?.initContainerStatuses || []
@@ -1314,7 +1327,7 @@ export function getCronJobStatus(cj: any): StatusBadge {
   if (activeJobs > 0) {
     return { text: `Active (${activeJobs})`, color: healthColors.neutral, level: 'neutral' }
   }
-  return { text: 'Scheduled', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Enabled', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getCronJobSchedule(cj: any): { cron: string; readable: string } {

package/src/components/resources/summarize-scheduler-message.test.ts

@@ -44,6 +44,7 @@ it.each([
   ['2 node(s) node affinity/selector mismatch (0/2 nodes available)', 'both nodes do not match the Pod’s node affinity or selector'],
   ['unbound PersistentVolumeClaim, 1 node(s) volume node-affinity conflict (0/2 nodes available)', 'a required volume claim is not bound; 1 node does not match the volume’s node affinity'],
   ['0/2 nodes are available: 1 node(s) had volume node affinity conflict, 1 Insufficient memory.', '1 node does not match the volume’s node affinity; 1 node does not have enough memory'],
+  ["0/3 nodes are available: 1 node(s) didn't satisfy existing pods anti-affinity rules, 2 node(s) didn't match PersistentVolume's node affinity.", "1 node(s) didn't satisfy existing pods anti-affinity rules; 2 nodes do not match the volume’s node affinity"],
   ['no node has kubernetes.io/arch=arm64 — 2 node(s) carry kubernetes.io/arch: [amd64]; 1 node(s) insufficient cpu (0/3 nodes available)', 'no node has kubernetes.io/arch=arm64 — 2 node(s) carry kubernetes.io/arch: [amd64]; 1 node does not have enough CPU'],
   ['custom scheduler says 2 Insufficient cpu, 1 Insufficient memory', 'custom scheduler says 2 Insufficient cpu; 1 node does not have enough memory'],
   ['1 node(s) pod anti-affinity conflict, 1 node(s) insufficient memory, no node has zone=west — 2 node(s) carry zone: [east, north]', '1 node(s) pod anti-affinity conflict; 1 node does not have enough memory; no node has zone=west — 2 node(s) carry zone: [east, north]'],

package/src/components/shared/DetailShell.tsx

@@ -77,22 +77,24 @@ export function DetailShell<TId extends string = string>({
       <div className="shrink-0 border-b border-theme-border bg-theme-base">
         {!compactHeader && (
           <>
-            {breadcrumb && <div className="px-6 pt-2.5">{breadcrumb}</div>}
-            <div className={clsx('px-6 flex items-start gap-4', wrapHeader && 'flex-wrap gap-y-2', breadcrumb ? 'pb-3 pt-1.5' : 'py-3')}>
+            {breadcrumb && <div className="px-6 pt-2.5 phone:px-4">{breadcrumb}</div>}
+            {/* Phones always wrap: the identity takes the row beside the back
+                button and the actions drop below it. */}
+            <div className={clsx('px-6 flex items-start gap-4 phone:px-4 phone:flex-wrap phone:gap-x-3 phone:gap-y-2', wrapHeader && 'flex-wrap gap-y-2', breadcrumb ? 'pb-3 pt-1.5' : 'py-3')}>
               {nav}
               {/* Wrapping on, the identity's basis is its one-line width, so the
                   actions move below whenever the whole title line would not fit
                   beside them — never squeezing the name to keep them up. */}
-              <div className={clsx('min-w-0', wrapHeader ? 'flex-auto' : 'flex-1')}>{identity}</div>
+              <div className={clsx('min-w-0 phone:basis-[calc(100%-3rem)]', wrapHeader ? 'flex-auto' : 'flex-1')}>{identity}</div>
               {wrapHeader ? <div className="ml-auto flex shrink-0 items-start gap-4">{headerActions}</div> : headerActions}
             </div>
-            {subheader && <div className="-mt-1 px-6 pb-3">{subheader}</div>}
+            {subheader && <div className="-mt-1 px-6 pb-3 phone:px-4">{subheader}</div>}
           </>
         )}
 
         {/* Tabs (left) + scope controls / actions (right) */}
-        <div className={clsx('flex items-center', compactHeader ? 'px-0' : 'border-t border-theme-border px-6')}>
-          <div ref={stripRef} className={clsx('flex min-w-0 flex-auto overflow-x-auto', compact ? 'gap-0' : 'gap-1')} role="tablist">
+        <div className={clsx('flex items-center phone:flex-wrap', compactHeader ? 'px-0' : 'border-t border-theme-border px-6 phone:px-4')}>
+          <div ref={stripRef} className={clsx('flex min-w-0 flex-auto overflow-x-auto phone:basis-full', compact ? 'gap-0' : 'gap-1')} role="tablist">
             {visibleTabs.map((t) => (
               <DetailShellTabButton key={t.id} active={activeTab === t.id} compact={compact} onClick={() => onTabChange(t.id)}>
                 {!compact && t.icon}
@@ -102,7 +104,7 @@ export function DetailShell<TId extends string = string>({
             ))}
           </div>
           {(scopeControls || tabStripEnd) && (
-            <div className="ml-auto flex min-w-0 flex-wrap items-center justify-end gap-2 pl-2">
+            <div className="ml-auto flex min-w-0 flex-wrap items-center justify-end gap-2 pl-2 phone:py-2">
               {scopeControls}
               {tabStripEnd}
             </div>

package/src/components/shared/DrainPlanDialog.test.tsx

@@ -108,6 +108,13 @@ describe('DrainPlanContent', () => {
     expect(html).toContain('About this estimate')
   })
 
+  it('distinguishes expected exclusions from protected workloads before draining', () => {
+    const html = render({ plan: plan([pod('agent', 'skip', { expectedSkip: true }), pod('bare', 'skip', { expectedSkip: false })]) })
+    expect(html).toContain('left by design')
+    expect(html).toContain('requires attention')
+    expect(html).toContain('bare reason')
+  })
+
   it('offers a refresh only when the host can recompute the plan', () => {
     const p = plan([pod('web', 'evict')])
     expect(render({ plan: p, onRefreshPlan: noop })).toContain('Recompute the plan')