@skyhook-io/k8s-ui 1.18.0 → 1.18.1

package/src/components/resources/ResourcesSidebar.test.tsx

@@ -68,6 +68,7 @@ describe('ResourcesSidebar count visibility', () => {
         onSelectedKindChange={() => {}}
         apiResources={[horizontalPodAutoscaler]}
         resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 0 }}
+        resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'complete', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'all_namespaces' } } }}
       />
     )
 
@@ -82,6 +83,7 @@ describe('ResourcesSidebar count visibility', () => {
         onSelectedKindChange={() => {}}
         apiResources={[horizontalPodAutoscaler]}
         resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 0 }}
+        resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'complete', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'all_namespaces' } } }}
       />
     )
 
@@ -96,6 +98,7 @@ describe('ResourcesSidebar count visibility', () => {
         onSelectedKindChange={() => {}}
         apiResources={[horizontalPodAutoscaler]}
         resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 0 }}
+        resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'complete', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'all_namespaces' } } }}
         pinned={[{ name: 'horizontalpodautoscalers', kind: 'HorizontalPodAutoscaler', group: 'autoscaling' }]}
         isPinned={(name, group) => name === 'horizontalpodautoscalers' && group === 'autoscaling'}
       />
@@ -197,6 +200,33 @@ describe('ResourcesSidebar category workspaces', () => {
   })
 })
 
+describe('ResourcesSidebar counts from a Radar that predates coverage', () => {
+  it('hides an empty kind and shows plain counts, as before coverage', () => {
+    const hidden = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[horizontalPodAutoscaler]} resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 0 }} resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'unknown' } }} />)
+    expect(hidden).not.toContain('HorizontalPodAutoscaler')
+    const shown = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[horizontalPodAutoscaler]} resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 23 }} />)
+    expect(shown).toContain('>23</')
+    expect(shown).not.toContain('≥')
+  })
+})
+
+it('sizes the count badge to fit a bounded count in the thousands', () => {
+  const html = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[horizontalPodAutoscaler]} resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 12345 }} resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'partial', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'namespaces', namespaces: { names: ['alpha'], count: 1 } } } }} />)
+  const label = `≥${(12345).toLocaleString()}`
+  const badge = html.slice(html.lastIndexOf('<span', html.indexOf(label)), html.indexOf(label))
+  const classes = badge.match(/class="([^"]*)"/)?.[1].split(/\s+/) ?? []
+  expect(classes).toContain('min-w-8')
+  expect(classes).not.toContain('w-8')
+  expect(classes).not.toContain('w-9')
+})
+
+it('keeps a partial zero visible rather than hiding the kind as empty', () => {
+  const html = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[horizontalPodAutoscaler]} resourceCounts={{ 'autoscaling/HorizontalPodAutoscaler': 0 }} resourceCoverage={{ 'autoscaling/HorizontalPodAutoscaler': { status: 'partial', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'namespaces', namespaces: { names: ['alpha'], count: 1 } } } }} />)
+  expect(html).toContain('HorizontalPodAutoscaler')
+  expect(html).toContain('–')
+  expect(html).not.toContain('≥0')
+})
+
 describe('sidebarDestinationsMatching', () => {
   const views = ['Clusters', 'Backups', 'Declarations', 'Pooling', 'Operator'].map((label) => ({ id: label, label, onSelect: () => {} }))
   const resources = [{ group: 'postgresql.cnpg.io' }, { group: 'barmancloud.cnpg.io' }]
@@ -215,3 +245,22 @@ describe('sidebarDestinationsMatching', () => {
     expect(labels('  ')).toHaveLength(5)
   })
 })
+
+it('qualifies the collapsed category total as well as the individual kind', () => {
+  const widget = { name: 'widgets', kind: 'Widget', group: 'read.example.test', version: 'v1', namespaced: true, isCrd: true, verbs: ['get', 'list', 'watch'] }
+  const html = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[widget]} resourceCounts={{ 'read.example.test/Widget': 3 }} resourceCoverage={{ 'read.example.test/Widget': { status: 'partial', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'namespaces', namespaces: { names: ['alpha'], count: 1 } } } }} />)
+  const start = html.indexOf('>Test Read Example</span>')
+  expect(start).toBeGreaterThan(-1)
+  expect(html.slice(start, html.indexOf('</button>', start))).toContain('≥3')
+})
+
+it('bounds a category total over kinds Radar collects in only some namespaces', () => {
+  const widget = { name: 'widgets', kind: 'Widget', group: 'read.example.test', version: 'v1', namespaced: true, isCrd: true, verbs: ['get', 'list', 'watch'] }
+  const gadget = { ...widget, name: 'gadgets', kind: 'Gadget' }
+  const collected = (ns: string) => ({ status: 'complete' as const, narrowedBy: ['namespace_collection'], gaps: [], scope: { type: 'namespaces' as const, namespaces: { names: [ns], count: 1 } }, read: { type: 'namespaces' as const, namespaces: { names: [ns], count: 1 } } })
+  const html = renderToString(<ResourcesSidebar selectedKind={null} onSelectedKindChange={() => {}} apiResources={[widget, gadget]} resourceCounts={{ 'read.example.test/Widget': 3, 'read.example.test/Gadget': 2 }} resourceCoverage={{ 'read.example.test/Widget': collected('alpha'), 'read.example.test/Gadget': collected('beta') }} />)
+  const start = html.indexOf('>Test Read Example</span>')
+  expect(start).toBeGreaterThan(-1)
+  // Each kind is exact where Radar collects it; their sum is exact for no scope.
+  expect(html.slice(start, html.indexOf('</button>', start))).toContain('≥5')
+})

package/src/components/resources/ResourcesSidebar.tsx

@@ -1,3 +1,5 @@
+import type { ResourceCoverage } from '../../types/resource-coverage'
+import { boundedCountLabel, isEmptyCount, isLowerBound, resourceCountHint, resourceCountLabel } from '../../utils/resource-coverage'
 import { useState, useMemo, useEffect, useRef, useCallback, useId, forwardRef, type ComponentType } from 'react'
 import {
   Search,
@@ -60,6 +62,7 @@ export interface ResourcesSidebarProps {
   onKindChange?: () => void
   apiResources?: APIResource[]
   resourceCounts?: Record<string, number | null>
+  resourceCoverage?: Record<string, ResourceCoverage>
   resourceUnavailable?: string[]
   resourceForbidden?: string[]
   pinned?: PinnedItem[]
@@ -143,6 +146,7 @@ interface ResourceTypeButtonProps {
   /** `null` means "count not loaded yet" — rendered as a placeholder so
    *  the badge doesn't flicker to "0" while the API call is in flight. */
   count: number | null
+  coverage?: ResourceCoverage
   isSelected: boolean
   /** Keyboard-highlight state (arrow nav in the filter input). */
   isHighlighted?: boolean
@@ -154,7 +158,7 @@ interface ResourceTypeButtonProps {
 }
 
 const ResourceTypeButton = forwardRef<HTMLButtonElement, ResourceTypeButtonProps>(
-  function ResourceTypeButton({ resource, count, isSelected, isHighlighted, isForbidden: forbidden, isPinned, onTogglePin, onClick, indent }, ref) {
+  function ResourceTypeButton({ resource, count, coverage, isSelected, isHighlighted, isForbidden: forbidden, isPinned, onTogglePin, onClick, indent }, ref) {
     const Icon = getResourceIcon(resource.kind, resource.group)
     return (
       <button
@@ -214,13 +218,14 @@ const ResourceTypeButton = forwardRef<HTMLButtonElement, ResourceTypeButtonProps
               </span>
             </Tooltip>
           ) : (
-            <span className={clsx(
-              'text-xs py-0.5 rounded text-center font-mono',
-              isSelected ? 'bg-skyhook-500/30 selection-text' : 'bg-theme-elevated',
-              count < 1000 ? 'w-8' : 'w-9',
-            )}>
-              {count}
-            </span>
+            <Tooltip disabled={!resourceCountHint(coverage)} content={resourceCountHint(coverage)} position="left">
+              <span className={clsx(
+                'text-xs py-0.5 px-1 min-w-8 rounded text-center font-mono',
+                isSelected ? 'bg-skyhook-500/30 selection-text' : 'bg-theme-elevated',
+              )}>
+                {resourceCountLabel(count, coverage)}
+              </span>
+            </Tooltip>
           )}
         </div>
       </button>
@@ -234,6 +239,7 @@ export function ResourcesSidebar({
   onKindChange,
   apiResources,
   resourceCounts,
+  resourceCoverage,
   resourceUnavailable,
   resourceForbidden,
   pinned = [],
@@ -401,20 +407,25 @@ export function ResourcesSidebar({
         (sum, resource) => sum + (counts[resource.group ? `${resource.group}/${resource.kind}` : resource.kind] ?? 0),
         0
       )
+      const lowerBound = category.resources.some(resource =>
+        isLowerBound(resourceCoverage?.[resource.group ? `${resource.group}/${resource.kind}` : resource.kind]))
+      const totalLabel = boundedCountLabel(total, lowerBound)
 
-      // Filter resources: hide only confirmed-empty kinds. Unknown counts stay
-      // visible as a dash so count coverage gaps do not masquerade as emptiness.
+      // Filter resources: hide only empty kinds. An unknown count stays visible
+      // as a dash, and a partial zero as one too, so count coverage gaps do not
+      // masquerade as emptiness.
       const visibleResources = category.resources.filter(resource => {
         const count = counts[resource.group ? `${resource.group}/${resource.kind}` : resource.kind]
         const isSelectedResource =
           (effectiveSelectedKind.name === resource.name && effectiveSelectedKind.group === resource.group) ||
           (effectiveSelectedKind.kind.toLowerCase() === resource.kind.toLowerCase() && effectiveSelectedKind.group === resource.group)
-        const shouldShow = isSelectedResource || count === null || (count ?? 0) > 0 || showEmptyKinds
+        const key = resource.group ? `${resource.group}/${resource.kind}` : resource.kind
+        const shouldShow = isSelectedResource || count === null || !isEmptyCount(count ?? 0, resourceCoverage?.[key]) || showEmptyKinds
         if (!shouldShow) totalHiddenKinds++
         return shouldShow
       })
 
-      return { ...category, total, visibleResources }
+      return { ...category, total, totalLabel, visibleResources }
     })
 
     // Sort: the category whose workspace is open first, then categories with
@@ -435,7 +446,7 @@ export function ResourcesSidebar({
     })
 
     return { sortedCategories: visibleCategories, hiddenKindsCount: totalHiddenKinds, hiddenGroupsCount: totalHiddenGroups }
-  }, [categories, counts, showEmptyKinds, effectiveSelectedKind.name, effectiveSelectedKind.kind, effectiveSelectedKind.group, categoryWorkspaces, activeDestinationCategory])
+  }, [categories, counts, resourceCoverage, showEmptyKinds, effectiveSelectedKind.name, effectiveSelectedKind.kind, effectiveSelectedKind.group, categoryWorkspaces, activeDestinationCategory])
 
   // Filter sidebar categories/kinds by the kind search term
   const filteredCategories = useMemo(() => {
@@ -621,6 +632,7 @@ export function ResourcesSidebar({
                       ref={highlighted ? highlightedRef : (isResourceSelected ? selectedSidebarRef : null)}
                       resource={{ name: p.name, kind: p.kind, group: p.group, version: '', namespaced: true, isCrd: false, verbs: [] }}
                       count={counts[p.group ? `${p.group}/${p.kind}` : p.kind] ?? null}
+                      coverage={resourceCoverage?.[p.group ? `${p.group}/${p.kind}` : p.kind]}
                       isSelected={isResourceSelected}
                       isHighlighted={highlighted}
                       isForbidden={forbiddenKinds.has(p.group ? `${p.group}/${p.kind}` : p.kind)}
@@ -653,8 +665,8 @@ export function ResourcesSidebar({
                   <CollapseChevron open={isExpanded} className="w-3 h-3" />
                   <span className="flex-1 text-left truncate" title={rawGroupTitle}>{category.name}</span>
                   {!isExpanded && (
-                    <span className={clsx('text-xs py-0.5 rounded bg-theme-elevated text-theme-text-secondary font-normal normal-case text-center font-mono', category.total < 1000 ? 'w-8' : 'w-9')}>
-                      {category.total}
+                    <span className="text-xs py-0.5 px-1 min-w-8 rounded bg-theme-elevated text-theme-text-secondary font-normal normal-case text-center font-mono">
+                      {category.totalLabel}
                     </span>
                   )}
                 </button>
@@ -692,6 +704,7 @@ export function ResourcesSidebar({
                         ref={highlighted ? highlightedRef : (isResourceSelected ? selectedSidebarRef : null)}
                         resource={resource}
                         count={counts[resource.group ? `${resource.group}/${resource.kind}` : resource.kind] ?? null}
+                        coverage={resourceCoverage?.[resource.group ? `${resource.group}/${resource.kind}` : resource.kind]}
                         isSelected={showSelected}
                         isHighlighted={highlighted}
                         isForbidden={forbiddenKinds.has(resource.group ? `${resource.group}/${resource.kind}` : resource.kind)}
@@ -748,12 +761,14 @@ export function ResourcesSidebar({
                     </span>
                   </Tooltip>
                 ) : (
-                  <span className={clsx(
-                    'badge font-mono',
-                    isSelected ? 'bg-skyhook-500/30 selection-text' : 'bg-theme-elevated',
-                  )}>
-                    {count}
-                  </span>
+                  <Tooltip disabled={!resourceCountHint(resourceCoverage?.[kindKey])} content={resourceCountHint(resourceCoverage?.[kindKey])} position="left">
+                    <span className={clsx(
+                      'badge font-mono',
+                      isSelected ? 'bg-skyhook-500/30 selection-text' : 'bg-theme-elevated',
+                    )}>
+                      {resourceCountLabel(count, resourceCoverage?.[kindKey])}
+                    </span>
+                  </Tooltip>
                 )}
               </button>
             )

package/src/components/resources/ResourcesView.selected-kind.test.ts

@@ -3,6 +3,7 @@ import type { APIResource } from '../../types'
 import {
   canonicalizeSelectedKind,
   deriveSidebarResourceCounts,
+  deriveSidebarResourceCoverage,
   LOADED_RESOURCE_COUNT_TTL_MS,
   resourceQueryMatchesSelectedKind,
 } from './ResourcesView'
@@ -141,3 +142,16 @@ describe('resourceQueryMatchesSelectedKind', () => {
     ).toBe(true)
   })
 })
+
+
+describe('loaded count coverage', () => {
+  const partial = { status: 'partial' as const, scope: { type: 'all_namespaces' as const }, read: { type: 'namespaces' as const, namespaces: { names: ['alpha'], count: 1 } }, gaps: [{ code: 'radar_namespace_not_collected' }] }
+  it('retains a cached partial count qualification and expires both together', () => {
+    const cache = { Endpoints: { count: 0, expiresAt: 20, coverage: partial } }
+    expect(deriveSidebarResourceCoverage({}, {}, cache, 10)).toEqual({ Endpoints: partial })
+    expect(deriveSidebarResourceCoverage({}, {}, cache, 20)).toEqual({})
+  })
+  it('does not pair older unqualified count responses with cached newer metadata', () => {
+    expect(deriveSidebarResourceCoverage({ Endpoints: 0 }, undefined, { Endpoints: { count: 0, expiresAt: 20, coverage: partial } }, 10)).toEqual({ Endpoints: { status: 'unknown' } })
+  })
+})

package/src/components/resources/ResourcesView.trivy-search.test.tsx

@@ -0,0 +1,59 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ResourcesView } from './ResourcesView'
+import { KeyboardShortcutProvider } from '../../hooks/useKeyboardShortcuts'
+import type { APIResource } from '../../types'
+
+;(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true
+window.matchMedia = vi.fn().mockReturnValue({ matches: false, addEventListener: vi.fn(), removeEventListener: vi.fn() })
+Element.prototype.scrollIntoView = vi.fn()
+
+const group = 'aquasecurity.github.io'
+const vulnReports: APIResource = { group, version: 'v1alpha1', kind: 'VulnerabilityReport', name: 'vulnerabilityreports', namespaced: true, isCrd: true, verbs: ['get', 'list'] }
+const report = (name: string, vulnerabilityID: string) => ({
+  apiVersion: `${group}/v1alpha1`, kind: 'VulnerabilityReport',
+  metadata: { name, namespace: 'legacy', uid: name },
+  report: { artifact: { repository: 'trafex/php-nginx', tag: '3.6.0' }, vulnerabilities: [{ vulnerabilityID, resource: 'php83', installedVersion: '8.3.20-r0', fixedVersion: '8.3.36-r0' }] },
+})
+// The match sorts last, so selecting the first row proves the filter ran.
+const billing = report('replicaset-billing-5cfccf7776-php-nginx', 'CVE-2025-0001')
+const web = report('replicaset-web-7685556d86-php', 'CVE-2026-109618')
+
+let root: ReturnType<typeof createRoot>
+let host: HTMLDivElement
+afterEach(() => { act(() => root?.unmount()); host?.remove(); localStorage.clear(); window.history.replaceState(null, '', '/') })
+
+function render(search: string, onResourceClick = vi.fn()) {
+  const locationSearch = `?apiGroup=${group}&search=${encodeURIComponent(search)}`
+  window.history.replaceState(null, '', `/resources/vulnerabilityreports${locationSearch}`)
+  host = document.createElement('div'); document.body.append(host); root = createRoot(host)
+  act(() => root.render(<KeyboardShortcutProvider><ResourcesView
+    namespaces={[]}
+    apiResources={[vulnReports]}
+    resourceCounts={{ VulnerabilityReport: 2 }}
+    selectedKindQuery={{ isLoading: false, data: [web, billing], resourceName: 'vulnerabilityreports', group }}
+    locationPathname="/resources/vulnerabilityreports"
+    locationSearch={locationSearch}
+    onNavigate={() => {}}
+    onResourceClick={onResourceClick}
+  /></KeyboardShortcutProvider>))
+  return onResourceClick
+}
+
+describe('Trivy report table search', () => {
+  it('finds a report by a CVE in its findings', () => {
+    const selected = render('CVE-2026-109618')
+    act(() => document.body.dispatchEvent(new KeyboardEvent('keydown', { key: 'j', bubbles: true })))
+    act(() => document.body.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true })))
+    expect(selected).toHaveBeenCalledTimes(1)
+    expect(selected).toHaveBeenCalledWith(expect.objectContaining({ name: web.metadata.name }))
+  })
+
+  it('says what it searched when nothing matches', () => {
+    render('CVE-1999-0001')
+    expect(host.textContent).toContain('No results for "CVE-1999-0001"')
+    expect(host.textContent).toContain('Searched names, namespaces and report findings')
+  })
+})

package/src/components/resources/ResourcesView.tsx

@@ -1,3 +1,5 @@
+import type { ResourceCoverage } from '../../types/resource-coverage'
+import { resourceCoverageNotice, resourceEmptyMessage, resourceNarrowedNotice } from '../../utils/resource-coverage'
 import React, { useState, useMemo, useEffect, useCallback, useDeferredValue, useRef, useContext, useId } from 'react'
 import { TableVirtuoso, type TableVirtuosoHandle } from 'react-virtuoso'
 import { useDebouncedValue } from '../../hooks/useDebouncedValue'
@@ -148,6 +150,7 @@ import {
   SEVERITY_DOT_COLOR,
   healthColors,
 } from './resource-utils'
+import { TRIVY_GROUP, searchTrivyFindings, type TrivyFindingMatch, type TrivyFindingsSearch } from './resource-utils-trivy'
 import { getGenericResourceStatus } from './generic-status'
 import { ActiveFilterBar } from './ActiveFilterBar'
 import { getIstioGatewayServerCount, getIstioGatewaySelectorString } from './resource-utils-istio'
@@ -156,7 +159,7 @@ import {
   printerCellTone, printerColumnKey, printerColumnWidth, printerTableKey, printerTableMatchesKind, readPrinterCell,
 } from './printer-columns'
 import { SEVERITY_BADGE, SEVERITY_TEXT, healthToSeverity, EVENT_TYPE_COLORS } from '../../utils/badge-colors'
-import { pluralize } from '../../utils/pluralize'
+import { englishPlural, isEnglishPlural, pluralize } from '../../utils/pluralize'
 import { getPodGpuCount, getNodeGpuCount } from '../../utils/extended-resources'
 import { formatRelativeAgeTime, parseQuantityToNumber } from '../../utils/format'
 import { type CustomColumnDef, type CustomColumnSource, customColumnKey, readCustomColumnValue, sanitizeCustomColumnDefs } from '../../utils/custom-columns'
@@ -3363,6 +3366,7 @@ interface ResourcesViewData {
 export const ResourcesViewDataContext = React.createContext<ResourcesViewData>({})
 
 export interface ResourceQueryResult {
+  coverage?: ResourceCoverage
   resourceName?: string
   group?: string
   data?: any[]
@@ -3398,6 +3402,7 @@ interface ResourcesViewProps {
   resourceQueries?: ResourceQueryResult[]
   // Lightweight counts for sidebar badges (from /api/resource-counts)
   resourceCounts?: Record<string, number | null>
+  resourceCoverage?: Record<string, ResourceCoverage>
   resourceForbidden?: string[]
   /** Per-kind reason a forbidden kind is hidden ("rbac_denied" | "unavailable"),
    *  keyed by the same count key as resourceForbidden. Drives RestrictedState copy. */
@@ -3551,6 +3556,7 @@ const DEFAULT_KIND_INFO: SelectedKindInfo = { name: 'pods', kind: 'Pod', group:
 export const LOADED_RESOURCE_COUNT_TTL_MS = 5 * 60 * 1000
 
 interface LoadedResourceCount {
+  coverage?: ResourceCoverage
   count: number
   expiresAt: number
 }
@@ -3660,6 +3666,22 @@ export function deriveSidebarResourceCounts(
   return results
 }
 
+export function deriveSidebarResourceCoverage(
+  resourceCounts: Record<string, number | null> | undefined,
+  resourceCoverage: Record<string, ResourceCoverage> | undefined,
+  loadedCountCache: LoadedResourceCountCache,
+  now = Date.now(),
+): Record<string, ResourceCoverage> {
+  const result: Record<string, ResourceCoverage> = { ...resourceCoverage }
+  for (const key of Object.keys(resourceCounts ?? {})) {
+    if (!(key in result)) result[key] = { status: 'unknown' }
+  }
+  for (const [key, cached] of Object.entries(loadedCountCache)) {
+    if (!(key in result) && cached.expiresAt > now) result[key] = cached.coverage ?? { status: 'unknown' }
+  }
+  return result
+}
+
 const FILTER_INTENT_PARAMS = [...RESOURCE_LIST_FILTER_PARAMS, 'resource']
 
 /**
@@ -3694,6 +3716,7 @@ export function ResourcesView({
   apiResources: apiResourcesProp,
   resourceQueries: resourceQueriesProp,
   resourceCounts: resourceCountsProp,
+  resourceCoverage: resourceCoverageProp,
   resourceForbidden: resourceForbiddenProp,
   resourceReasons,
   resourceUnavailable: resourceUnavailableProp,
@@ -5165,16 +5188,16 @@ export function ResourcesView({
       }
 
       const existing = next[selectedKindCountKey]
-      if (existing?.count === selectedLoadedResourceCount && existing.expiresAt === expiresAt) {
+      if (existing?.count === selectedLoadedResourceCount && existing.expiresAt === expiresAt && existing.coverage === selectedQuery?.coverage) {
         return changed ? next : prev
       }
 
       return {
         ...next,
-        [selectedKindCountKey]: { count: selectedLoadedResourceCount, expiresAt },
+        [selectedKindCountKey]: { count: selectedLoadedResourceCount, expiresAt, coverage: selectedQuery?.coverage },
       }
     })
-  }, [selectedQueryHasLoadedCount, selectedLoadedResourceCount, selectedKindCountKey, selectedQuery?.dataUpdatedAt])
+  }, [selectedQueryHasLoadedCount, selectedLoadedResourceCount, selectedKindCountKey, selectedQuery?.dataUpdatedAt, selectedQuery?.coverage])
 
   // Derive counts — prefer lightweight resourceCounts prop over full query data
   const counts = useMemo(() => {
@@ -5195,6 +5218,12 @@ export function ResourcesView({
     return results
   }, [useNewCountsMode, resourcesToCount, resourceCountsProp, resourceUnavailableProp, loadedCountCache, selectedQueryHasLoadedCount, selectedLoadedResourceCount, selectedKindCountKey, resourceQueries])
 
+  const sidebarResourceCoverage = useMemo(() => {
+    const result = deriveSidebarResourceCoverage(resourceCountsProp, resourceCoverageProp, loadedCountCache)
+    if (selectedQueryHasLoadedCount) result[selectedKindCountKey] = selectedQuery?.coverage ?? { status: 'unknown' }
+    return result
+  }, [resourceCountsProp, resourceCoverageProp, loadedCountCache, selectedQueryHasLoadedCount, selectedKindCountKey, selectedQuery?.coverage])
+
   const sidebarResourceUnavailable = useMemo(() => {
     if (!resourceUnavailableProp?.length) {
       return resourceUnavailableProp
@@ -5462,13 +5491,18 @@ export function ResourcesView({
     }
   }, [regexMode, deferredSearchTerm])
 
+  const isTrivyKind = selectedKind.group === TRIVY_GROUP
+
   // Filter resources by search term, status, problems, and sort
-  const filteredResources = useMemo(() => {
-    if (!tableActive || !resources) return []
+  const { list: filteredResources, findings: findingsSearch } = useMemo((): { list: any[]; findings: TrivyFindingsSearch | null } => {
+    if (!tableActive || !resources) return { list: [], findings: null }
 
     let result = resources
+    let findings: TrivyFindingsSearch | null = null
 
-    // Apply search filter
+    // Apply search filter. On Trivy report kinds a plain search also matches
+    // findings and runs below, after the other filters. Regex mode stays on
+    // names: a pattern run over every finding could backtrack for seconds.
     if (deferredSearchTerm) {
       if (regexMode) {
         const re = searchRegex.re
@@ -5478,7 +5512,7 @@ export function ResourcesView({
             re.test(r.metadata?.namespace ?? '')
           )
         }
-      } else {
+      } else if (!isTrivyKind) {
         const term = deferredSearchTerm.toLowerCase()
         result = result.filter((r: any) =>
           r.metadata?.name?.toLowerCase().includes(term) ||
@@ -5554,6 +5588,19 @@ export function ResourcesView({
       })
     }
 
+    // Trivy findings are searched after the other filters, so rows they hide
+    // don't spend the findings budget.
+    if (deferredSearchTerm && !regexMode && isTrivyKind) {
+      const term = deferredSearchTerm.toLowerCase()
+      const matched = searchTrivyFindings(result, term)
+      findings = matched
+      result = result.filter((r: any) =>
+        r.metadata?.name?.toLowerCase().includes(term) ||
+        r.metadata?.namespace?.toLowerCase().includes(term) ||
+        matched.matches.has(r)
+      )
+    }
+
     // Apply custom sorting if set. Extra columns override
     // the built-in getSortValue for their key.
     if (effectiveSortColumn && sortDirection) {
@@ -5649,8 +5696,8 @@ export function ResourcesView({
       }
     }
 
-    return result
-  }, [tableActive, resources, deferredSearchTerm, regexMode, searchRegex, columnFilters, columnFilterExcludes, problemFilters, showInactiveReplicaSets, labelSelector, ownerKind, ownerName, selectedKind.name, effectiveSortColumn, sortDirection, getSortValue, getDisplayFilterValue, extraColumnsByKey, podMatchesProblemFilter])
+    return { list: result, findings }
+  }, [tableActive, resources, deferredSearchTerm, regexMode, searchRegex, isTrivyKind, columnFilters, columnFilterExcludes, problemFilters, showInactiveReplicaSets, labelSelector, ownerKind, ownerName, selectedKind.name, effectiveSortColumn, sortDirection, getSortValue, getDisplayFilterValue, extraColumnsByKey, podMatchesProblemFilter])
 
   // For nodes table: compute the majority minor version so outliers can be highlighted
   const majorityNodeMinorVersion = useMemo(() => {
@@ -6063,6 +6110,7 @@ export function ResourcesView({
           onKindChange={onKindChange}
           apiResources={apiResourcesProp}
           resourceCounts={counts}
+          resourceCoverage={sidebarResourceCoverage}
           resourceForbidden={Array.from(forbiddenKinds)}
           resourceUnavailable={sidebarResourceUnavailable}
           pinned={pinned}
@@ -6088,7 +6136,7 @@ export function ResourcesView({
               <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-theme-text-tertiary" />
               <Input
                 ref={searchInputRef}
-                placeholder={regexMode ? 'Search by regex... (press /)' : 'Search... (press /)'}
+                placeholder={regexMode ? 'Search by regex... (press /)' : isTrivyKind ? 'Search names and findings... (press /)' : 'Search... (press /)'}
                 value={searchTerm}
                 onChange={(e) => setSearchTerm(e.target.value)}
                 onKeyDown={(e) => {
@@ -6150,6 +6198,11 @@ export function ResourcesView({
                   <X className="w-3.5 h-3.5" />
                 </button>
               )}
+              {!searchRegex.error && findingsSearch?.truncated && (
+                <div className="absolute left-0 top-full mt-1 z-10 px-2 py-1 rounded bg-theme-elevated border border-theme-border text-xs text-theme-text-secondary shadow-theme-sm">
+                  Too many findings to search them all here; some weren't searched.
+                </div>
+              )}
               {searchRegex.error && (
                 <div
                   title={searchRegex.error}
@@ -6524,6 +6577,18 @@ export function ResourcesView({
           </div>
         )}
 
+        {!isLoading && !selectedQueryError && resourceCoverageNotice(selectedQuery?.coverage, isEnglishPlural(selectedKind.kind) ? selectedKind.kind : englishPlural(selectedKind.kind)) && (
+          <div role="status" className="px-4 py-2 text-xs text-warning-text border-b border-theme-border bg-theme-surface">
+            {resourceCoverageNotice(selectedQuery?.coverage, isEnglishPlural(selectedKind.kind) ? selectedKind.kind : englishPlural(selectedKind.kind))}
+          </div>
+        )}
+
+        {!isLoading && !selectedQueryError && resourceNarrowedNotice(selectedQuery?.coverage) && (
+          <div role="status" className="px-4 py-2 text-xs text-theme-text-tertiary border-b border-theme-border bg-theme-surface">
+            {resourceNarrowedNotice(selectedQuery?.coverage)}
+          </div>
+        )}
+
         {!isLoading && !isSelectedForbidden && !largeListGuard && filteredResources.length > 0 && (
           <ActiveFilterBar
             columnFilters={columnFilters}
@@ -6565,7 +6630,7 @@ export function ResourcesView({
                 />
               </div>
             </div>
-          ) : selectedQueryError && !Array.isArray(resources) ? (
+          ) : selectedQueryError && !Array.isArray(resources) && !largeListGuard ? (
             // A failed fetch with no rows to fall back on must not reach the
             // empty state below — it would tell the user the cluster has none.
             <FetchResult
@@ -6585,7 +6650,9 @@ export function ResourcesView({
               <p className="text-sm mt-1 max-w-xl">
                 {largeListGuard.reason === 'count-unavailable'
                   ? 'Radar could not verify this list is small enough to load. Choose a namespace or smaller namespace set to try again.'
-                  : `${largeListGuard.count?.toLocaleString()} ${largeListGuard.kind.toLowerCase()} are in the current scope. Choose a namespace or smaller namespace set to load this view.`}
+                  : largeListGuard.count == null
+                    ? 'This list exceeds the resource limit. Choose a namespace or smaller namespace set to load this view.'
+                    : `${largeListGuard.count.toLocaleString()} ${largeListGuard.kind.toLowerCase()} were read in the current scope. Choose a namespace or smaller namespace set to load this view.`}
               </p>
               <p className="text-xs mt-2 text-theme-text-disabled">
                 Radar limits full table loads to {largeListGuard.limit.toLocaleString()} resources to keep the UI responsive.
@@ -6596,8 +6663,8 @@ export function ResourcesView({
             </div>
           ) : filteredResources.length === 0 ? (
             <div className="absolute inset-0 flex flex-col items-center justify-center text-theme-text-tertiary">
-              <p>No {selectedKind.kind} found</p>
-              {emptyKindNote(selectedKind.kind, selectedKind.group, resources?.length ?? 0) && (
+              <p>{resourceEmptyMessage(selectedKind.kind, selectedQuery?.coverage, (resources?.length ?? 0) > 0)}</p>
+              {selectedQuery?.coverage?.status !== 'partial' && emptyKindNote(selectedKind.kind, selectedKind.group, resources?.length ?? 0) && (
                 <p className="text-xs mt-2 max-w-md text-center text-theme-text-disabled">
                   {emptyKindNote(selectedKind.kind, selectedKind.group, resources?.length ?? 0)}
                 </p>
@@ -6614,6 +6681,13 @@ export function ResourcesView({
                   <X className="w-3.5 h-3.5" />
                 </button>
               )}
+              {searchTerm && isTrivyKind && (
+                <p className="text-xs mt-1 text-theme-text-tertiary">
+                  {regexMode
+                    ? 'Regex search matches names and namespaces only.'
+                    : 'Searched names, namespaces and report findings (CVE, package, check ID, image).'}
+                </p>
+              )}
               {namespaces.length > 0 && <p className="text-sm mt-1 text-theme-text-disabled">Searching in {namespaces.length === 1 ? `namespace: ${namespaces[0]}` : `${namespaces.length} namespaces`}</p>}
               <ActiveFilterBar
                 columnFilters={columnFilters}
@@ -6922,6 +6996,7 @@ export function ResourcesView({
                     comparePickIndex={pickIdx}
                     rowHref={rowHrefFor?.(resource)}
                     onRowCheckToggle={toggleChecked}
+                    findingMatch={findingsSearch?.matches.get(resource)}
                   />
                 )
               }}
@@ -7089,6 +7164,9 @@ interface ResourceRowCellsProps {
    *  is unaffected (still toggles picks). */
   rowHref?: string
   onRowCheckToggle?: (resource: any) => void
+  /** What a Trivy report matched the table search through, when its name
+   *  and namespace didn't. */
+  findingMatch?: TrivyFindingMatch
 }
 
 function rowHighlightClass(
@@ -7110,7 +7188,7 @@ function rowHighlightClass(
   return 'group-hover/row:bg-theme-surface/50'
 }
 
-const ResourceRowCells = React.memo(function ResourceRowCells({ resource, kind, group, columns, extraColumnsByKey, hasSpacerColumn, isSelected, isHighlighted, isChecked, showCheckbox, majorityNodeMinorVersion, storeProviders, onRowClick, onRowMouseEnter, compareMode, comparePickIndex = -1, rowHref, onRowCheckToggle }: ResourceRowCellsProps) {
+const ResourceRowCells = React.memo(function ResourceRowCells({ resource, kind, group, columns, extraColumnsByKey, hasSpacerColumn, isSelected, isHighlighted, isChecked, showCheckbox, majorityNodeMinorVersion, storeProviders, onRowClick, onRowMouseEnter, compareMode, comparePickIndex = -1, rowHref, onRowCheckToggle, findingMatch }: ResourceRowCellsProps) {
   const rowHighlight = rowHighlightClass(compareMode, comparePickIndex, isSelected, isHighlighted, isChecked)
   const pickedSide = comparePickIndex === 0 ? 'a' : comparePickIndex === 1 ? 'b' : null
   const onClick = onRowClick ? () => onRowClick(resource, !!isSelected) : undefined
@@ -7180,6 +7258,7 @@ const ResourceRowCells = React.memo(function ResourceRowCells({ resource, kind,
             storeProviders={storeProviders}
             extraColumn={extraColumnsByKey?.get(col.key)}
             nameHref={col.key === 'name' ? rowHref : undefined}
+            findingMatch={col.key === 'name' ? findingMatch : undefined}
           />
         </td>
       ))}
@@ -7229,9 +7308,10 @@ interface CellContentProps {
   /** When set on the name column, the resource name renders as `<a href>`
    *  so ⌘-click / copy-link / hover-URL all work. */
   nameHref?: string
+  findingMatch?: TrivyFindingMatch
 }
 
-function CellContent({ resource, kind, column, group, majorityNodeMinorVersion, storeProviders, extraColumn, nameHref }: CellContentProps) {
+function CellContent({ resource, kind, column, group, majorityNodeMinorVersion, storeProviders, extraColumn, nameHref, findingMatch }: CellContentProps) {
   const { auditBadges } = useContext(ResourcesViewDataContext)
   // Parent-injected extra columns short-circuit the built-in switch.
   // Used by hosts that inject leading columns (e.g. a multi-cluster Cluster column).
@@ -7249,7 +7329,7 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
     const auditTotal = audit ? audit.danger + audit.warning : 0
     return (
       <div className="flex items-center gap-1.5 min-w-0">
-        <Tooltip content={meta.name}>
+        <Tooltip content={meta.name} wrapperClassName={findingMatch ? 'min-w-0' : undefined}>
           {nameHref ? (
             <a
               href={nameHref}
@@ -7264,6 +7344,13 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
           )}
         </Tooltip>
         <CopyNameButton name={meta.name} />
+        {findingMatch && (
+          <Tooltip content={findingMatch.text}>
+            <span className="shrink-0 text-xs italic text-theme-text-tertiary cursor-help">
+              {findingMatch.site === 'image' ? 'in image' : 'in findings'}
+            </span>
+          </Tooltip>
+        )}
         {auditTotal > 0 && audit && (
           <Tooltip content={audit.messages && audit.messages.length > 0
             ? <AuditBadgeTooltip messages={audit.messages} />
@@ -7400,7 +7487,7 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
       // Disambiguate Gateway API vs Istio Gateway by apiVersion. Retained
       // alongside the case above because not every call site normalizes the
       // kind through GROUP_QUALIFIED_COLUMN_KEYS before dispatching.
-      if (resource.apiVersion?.includes('networking.istio.io')) {
+      if (isApiGroup(resource.apiVersion, 'networking.istio.io')) {
         return <IstioGatewayCell resource={resource} column={column} />
       }
       return <GatewayCell resource={resource} column={column} />