@skyhook-io/k8s-ui 1.7.14 → 1.7.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.7.14",
+  "version": "1.7.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",
@@ -69,7 +69,7 @@
     "@monaco-editor/react": "^4.7.0",
     "html-to-image": "^1.11.0",
     "react-virtuoso": "^4.18.7",
-    "shiki": "^4.0.0"
+    "shiki": "^4.2.0"
   },
   "peerDependencies": {
     "@xterm/addon-fit": ">=0.10.0",
@@ -85,8 +85,7 @@
     "yaml": ">=2.0.0"
   },
   "devDependencies": {
-    "@types/diff": "^7.0.2",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-web-links": "^0.12.0",
@@ -96,10 +95,10 @@
     "diff": "^9.0.0",
     "elkjs": "^0.11.1",
     "lucide-react": "^1.16.0",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.8",
     "yaml": "^2.9.0"
   }
 }

package/src/components/issues/IssuesView.tsx

@@ -271,11 +271,9 @@ function Diagnosis({ issue }: { issue: Issue }) {
           .join(' · ')
       : null;
   const { headline, detail } = issueMessageParts(issue);
-  // When the issue carries a parsed plain-English cause (GitOps controller
-  // errors), lead with it — the raw controller message is long and buries the
-  // useful part, and the detector reason ("OperationFailed") just repeats the
-  // category chip. The raw message is kept below as de-emphasized detail.
-  const rawMessage = [headline, detail].filter(Boolean).join(' ');
+  // When the issue carries a parsed plain-English cause, lead with it. The raw
+  // detector message is kept below as de-emphasized detail.
+  const rawMessage = issue.cause ? issue.message ?? '' : [headline, detail].filter(Boolean).join(' ');
   return (
     <section className="flex flex-col gap-1">
       <h4 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">What's wrong</h4>
@@ -310,7 +308,7 @@ function Diagnosis({ issue }: { issue: Issue }) {
           {issue.operation_retry_count ? ` · retried ${issue.operation_retry_count}×` : ''}
         </p>
       ) : null}
-      {/* Raw controller message, de-emphasized — shown below the parsed cause so
+      {/* Raw detector message, de-emphasized — shown below the parsed cause so
           the precise error (URLs, resource names) is available without leading. */}
       {issue.cause && rawMessage ? (
         <p className="break-words font-mono text-[11px] leading-relaxed text-theme-text-tertiary">{rawMessage}</p>

package/src/components/issues/types.ts

@@ -108,6 +108,16 @@ export interface IssueRecentChange {
   change_category?: 'spec_config' | 'lifecycle' | 'runtime_status' | string;
   rank_reason?: string;
   fields?: IssueRecentChangeField[];
+  /** Workloads that mount/reference this ConfigMap directly ("Deployment/flagd").
+   *  Direct spec references only — runtime consumers via an intermediary
+   *  service are not captured. */
+  consumed_by?: string[];
+}
+
+/** "No tracked non-status changes in the window" — the claim is scoped by
+ *  window_seconds so a change just outside it can't be misread as absent. */
+export interface IssueNoRecentChanges {
+  window_seconds: number;
 }
 
 /**
@@ -143,8 +153,8 @@ export interface Issue {
 
   reason: string;
   message?: string;
-  /** Parsed domain diagnosis (today GitOps controller errors): plain-English
-   *  cause, suggested next step, and an optional structured one-click fix.
+  /** Parsed domain diagnosis: plain-English cause, suggested next step, and
+   *  an optional structured one-click fix.
    *  Server-emitted (omitempty); empty for issues without a parser. */
   cause?: string;
   action?: string;
@@ -185,6 +195,16 @@ export interface Issue {
   issue_timing?: 'started_at_resource_creation' | 'started_after_resource_was_healthy';
   /** The evidence that determined issue_timing (for auditability). */
   issue_timing_basis?: 'condition' | 'owner_condition' | 'pod_creation' | 'deletion' | 'phase' | 'spec';
+
+  /** Recent non-status changes (spec/config and lifecycle) on this issue's
+   *  subject (and, for workload subjects, its referenced ConfigMaps) —
+   *  deterministic evidence, not a causal claim. Populated only on
+   *  single-namespace MCP issue responses; never set on /api/issues today. */
+  correlated_changes?: IssueRecentChange[];
+  /** Explicit "no tracked changes in the window" evidence. An issue with
+   *  NEITHER correlation field was not checked — absence must not be read as
+   *  "no changes". MCP-only, like correlated_changes. */
+  no_recent_changes?: IssueNoRecentChanges;
 }
 
 /** subjectRef builds a deep-linkable ref for an issue's subject — the row's

package/src/components/logs/WorkloadLogsViewer.tsx

@@ -82,6 +82,11 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
     pods.forEach((pod, i) => m.set(pod.name, i))
     return m
   }, [pods])
+  const podColorIndexRef = useRef<Map<string, number>>(new Map())
+
+  useEffect(() => {
+    podColorIndexRef.current = podColorIndex
+  }, [podColorIndex])
 
   const podsInitialized = useRef(false)
 
@@ -94,6 +99,7 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
       const resultPods = result.pods ?? []
       const resultLogs = result.logs ?? []
 
+      podColorIndexRef.current = new Map(resultPods.map((pod, i) => [pod.name, i]))
       setPods(resultPods)
 
       if (!podsInitialized.current && resultPods.length > 0) {
@@ -148,10 +154,12 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
       {
         onConnected: (data: any) => {
           if (data?.pods) {
-            setPods(data.pods)
-            if (selectedPods.size === 0) {
-              setSelectedPods(new Set((data.pods as WorkloadPodInfo[]).map((p: WorkloadPodInfo) => p.name)))
-            }
+            const nextPods = data.pods as WorkloadPodInfo[]
+            podColorIndexRef.current = new Map(nextPods.map((pod, i) => [pod.name, i]))
+            setPods(nextPods)
+            setSelectedPods(prev => (
+              prev.size === 0 ? new Set(nextPods.map((p: WorkloadPodInfo) => p.name)) : prev
+            ))
           }
         },
         onLog: (data: any) => {
@@ -161,7 +169,7 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
               content: data.content || '',
               container: data.container || '',
               pod: data.pod || '',
-              podColorIndex: podColorIndex.get(data.pod || ''),
+              podColorIndex: podColorIndexRef.current.get(data.pod || ''),
             })
           }
         },
@@ -171,7 +179,8 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
             setPods(prev => {
               const existing = new Set(prev.map(p => p.name))
               const toAdd = newPods.filter(p => !existing.has(p.name))
-              return toAdd.length > 0 ? [...prev, ...toAdd] : prev
+              if (toAdd.length === 0) return prev
+              return [...prev, ...toAdd]
             })
             setSelectedPods(prev => {
               const next = new Set(prev)
@@ -191,7 +200,7 @@ export function WorkloadLogsViewer({ name, fetchAll, createStream, overrideDownl
       },
       'Workload log stream connection failed',
     )
-  }, [createStream, startStreaming, selectedContainer, sinceSeconds, append, podColorIndex, selectedPods.size, clear])
+  }, [createStream, startStreaming, selectedContainer, sinceSeconds, append, clear])
 
   const handleStopStreaming = useCallback(() => {
     userStoppedRef.current = true

package/src/components/resources/ResourcesView.tsx

@@ -25,6 +25,8 @@ import {
   GitCompare,
   Regex,
   ListChecks,
+  Minus,
+  Scale,
 } from 'lucide-react'
 import { clsx } from 'clsx'
 import { ResourceBar } from '../ui/ResourceBar'
@@ -165,6 +167,8 @@ import { ConfirmDialog } from '../ui/ConfirmDialog'
 const POD_PROBLEMS = ['CrashLoopBackOff', 'ImagePullBackOff', 'OOMKilled', 'Unschedulable', 'Not Ready', 'High Restarts', 'Init Failed', 'Exit Code Error', 'Failed', 'Other'] as const
 const WORKLOAD_PROBLEMS = ['Unavailable', 'Rollout Stuck', 'Rollout In Progress'] as const
 const WORKLOAD_KINDS = new Set(['deployments', 'statefulsets', 'daemonsets'])
+const BULK_RESTART_WORKLOAD_KINDS = new Set(['deployments', 'statefulsets', 'daemonsets', 'rollouts'])
+const BULK_SCALE_WORKLOAD_KINDS = new Set(['deployments', 'statefulsets'])
 
 // Columns to skip for auto-detected filters (high cardinality, text-like, or non-filterable)
 export const SKIP_FILTER_COLUMNS = new Set([
@@ -203,6 +207,8 @@ interface Column {
   minWidth?: number // minimum width in px
 }
 
+type BulkResourceItem = { kind: string; group?: string; namespace: string; name: string }
+
 /**
  * Extra column injected by the parent — for example, a leading "Cluster"
  * column when the table is rendered inside a multi-cluster host.
@@ -1906,8 +1912,12 @@ interface ResourcesViewProps {
    */
   onClearNamespaces?: () => void
   // Bulk operations
-  onBulkDelete?: (items: Array<{ kind: string; group?: string; namespace: string; name: string }>, options?: { force?: boolean; onSuccess?: () => void }) => void
+  onBulkDelete?: (items: BulkResourceItem[], options?: { force?: boolean; onSuccess?: () => void }) => void
   isBulkDeleting?: boolean
+  onBulkRestart?: (items: BulkResourceItem[], options?: { onSuccess?: () => void }) => void
+  isBulkRestarting?: boolean
+  onBulkScale?: (items: BulkResourceItem[], replicas: number, options?: { onSuccess?: () => void }) => void
+  isBulkScaling?: boolean
 }
 
 // Default selected kind
@@ -2058,6 +2068,10 @@ export function ResourcesView({
   onClearNamespaces,
   onBulkDelete,
   isBulkDeleting = false,
+  onBulkRestart,
+  isBulkRestarting = false,
+  onBulkScale,
+  isBulkScaling = false,
 }: ResourcesViewProps) {
   const initialFilters = getInitialFiltersFromURL()
   const [selectedKind, setSelectedKind] = useState<SelectedKindInfo>(() => getInitialKindFromURL(basePath, defaultKind, locationPathname, locationSearch))
@@ -2077,6 +2091,10 @@ export function ResourcesView({
     onSelectedKindChange?.(selectedKind)
     setBulkMode(false)
     setCheckedResources(new Set())
+    setShowBulkDeleteConfirm(false)
+    setShowBulkRestartConfirm(false)
+    setShowBulkScaleDialog(false)
+    setBulkForceDelete(false)
   }, [selectedKind.name, selectedKind.group]) // eslint-disable-line react-hooks/exhaustive-deps
   const [searchTerm, setSearchTerm] = useState(initialFilters.search)
   const [regexMode, setRegexMode] = useState(false)
@@ -2112,12 +2130,15 @@ export function ResourcesView({
   const [ownerName, setOwnerName] = useState<string>(initialFilters.ownerName)
 
   // Multi-select state for bulk operations. Checkboxes only render while
-  // bulk mode is active — entered via the toolbar toggle — so the risky
-  // bulk-delete surface stays out of the way during normal browsing.
+  // bulk mode is active — entered via the toolbar toggle — so mutating
+  // actions stay out of the way during normal browsing.
   const [bulkMode, setBulkMode] = useState(false)
   const [checkedResources, setCheckedResources] = useState<Set<string>>(new Set())
   const [showBulkDeleteConfirm, setShowBulkDeleteConfirm] = useState(false)
+  const [showBulkRestartConfirm, setShowBulkRestartConfirm] = useState(false)
+  const [showBulkScaleDialog, setShowBulkScaleDialog] = useState(false)
   const [bulkForceDelete, setBulkForceDelete] = useState(false)
+  const [bulkScaleReplicas, setBulkScaleReplicas] = useState(0)
 
   const exitBulkMode = useCallback(() => {
     setBulkMode(false)
@@ -3652,13 +3673,44 @@ export function ResourcesView({
     return filteredResources.filter(r => checkedResources.has(getResourceKey(r)))
   }, [filteredResources, checkedResources, getResourceKey])
 
+  const checkedBulkItems = useMemo(() => {
+    return checkedItems.map(r => ({
+      kind: selectedKind.name,
+      group: selectedKind.group,
+      namespace: r.metadata?.namespace || '',
+      name: r.metadata?.name || '',
+    }))
+  }, [checkedItems, selectedKind.name, selectedKind.group])
+
+  const checkedItemDetails = useMemo(() => {
+    return checkedItems.map(r => `${r.metadata?.namespace ? r.metadata.namespace + '/' : ''}${r.metadata?.name}`).join('\n')
+  }, [checkedItems])
+
+  const selectedKindName = selectedKind.name.toLowerCase()
+  const canBulkRestartSelectedKind = onBulkRestart != null && BULK_RESTART_WORKLOAD_KINDS.has(selectedKindName)
+  const canBulkScaleSelectedKind = onBulkScale != null && BULK_SCALE_WORKLOAD_KINDS.has(selectedKindName)
+  const canBulkSelect = onBulkDelete != null || canBulkRestartSelectedKind || canBulkScaleSelectedKind
+  const isBulkMutating = isBulkDeleting || isBulkRestarting || isBulkScaling
+
+  const openBulkScaleDialog = useCallback(() => {
+    const replicas = checkedItems[0]?.spec?.replicas
+    setBulkScaleReplicas(typeof replicas === 'number' ? replicas : 0)
+    setShowBulkScaleDialog(true)
+  }, [checkedItems])
+
+  const commonBulkScaleReplicas = useMemo(() => {
+    if (checkedItems.length === 0) return null
+    const first = checkedItems[0]?.spec?.replicas ?? 0
+    return checkedItems.every(r => (r.spec?.replicas ?? 0) === first) ? first : null
+  }, [checkedItems])
+
   const allVisibleChecked = filteredResources.length > 0 && checkedItems.length === filteredResources.length
 
   const toggleCheckAll = useCallback(() => {
     setCheckedResources(allVisibleChecked ? new Set() : new Set(filteredResources.map(getResourceKey)))
   }, [allVisibleChecked, filteredResources, getResourceKey])
 
-  const isCheckboxMode = onBulkDelete != null && bulkMode
+  const isCheckboxMode = canBulkSelect && bulkMode
 
   // Filter columns by visibility
   const columns = useMemo(() => {
@@ -4330,7 +4382,7 @@ export function ResourcesView({
               </button>
             </Tooltip>
           )}
-          {onBulkDelete && (
+          {canBulkSelect && (
             <Tooltip content={bulkMode ? 'Exit bulk select mode' : 'Select multiple resources'}>
               <button
                 onClick={() => {
@@ -4358,15 +4410,41 @@ export function ResourcesView({
             <span className="text-sm font-medium text-theme-text-primary">
               {checkedItems.length} selected
             </span>
+            {canBulkRestartSelectedKind && (
+              <button
+                type="button"
+                onClick={() => setShowBulkRestartConfirm(true)}
+                disabled={checkedItems.length === 0 || isBulkMutating}
+                className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium btn-brand-muted disabled:opacity-50 disabled:pointer-events-none rounded-lg transition-colors"
+              >
+                <RefreshCw className={clsx('w-3.5 h-3.5', isBulkRestarting && 'animate-spin')} />
+                {isBulkRestarting ? 'Restarting...' : 'Restart'}
+              </button>
+            )}
+            {canBulkScaleSelectedKind && (
+              <button
+                type="button"
+                onClick={openBulkScaleDialog}
+                disabled={checkedItems.length === 0 || isBulkMutating}
+                className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium bg-theme-elevated hover:bg-theme-hover disabled:opacity-50 disabled:pointer-events-none text-theme-text-primary border border-theme-border rounded-lg transition-colors"
+              >
+                <Scale className="w-3.5 h-3.5" />
+                {isBulkScaling ? 'Scaling...' : 'Scale'}
+              </button>
+            )}
+            {onBulkDelete && (
+              <button
+                type="button"
+                onClick={() => setShowBulkDeleteConfirm(true)}
+                disabled={checkedItems.length === 0 || isBulkMutating}
+                className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium bg-red-600 hover:bg-red-700 disabled:opacity-50 disabled:pointer-events-none text-white rounded-lg transition-colors"
+              >
+                <Trash2 className="w-3.5 h-3.5" />
+                Delete
+              </button>
+            )}
             <button
-              onClick={() => setShowBulkDeleteConfirm(true)}
-              disabled={checkedItems.length === 0}
-              className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium bg-red-600 hover:bg-red-700 disabled:opacity-50 disabled:pointer-events-none text-white rounded-lg transition-colors"
-            >
-              <Trash2 className="w-3.5 h-3.5" />
-              Delete
-            </button>
-            <button
+              type="button"
               onClick={exitBulkMode}
               className="px-3 py-1.5 text-xs text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded-lg transition-colors"
             >
@@ -4724,13 +4802,7 @@ export function ResourcesView({
       open={showBulkDeleteConfirm}
       onClose={() => { setShowBulkDeleteConfirm(false); setBulkForceDelete(false) }}
       onConfirm={() => {
-        const items = checkedItems.map(r => ({
-          kind: selectedKind.name,
-          group: selectedKind.group,
-          namespace: r.metadata?.namespace || '',
-          name: r.metadata?.name || '',
-        }))
-        onBulkDelete?.(items, {
+        onBulkDelete?.(checkedBulkItems, {
           force: bulkForceDelete,
           onSuccess: () => {
             exitBulkMode()
@@ -4741,7 +4813,7 @@ export function ResourcesView({
       }}
       title={`Delete ${checkedItems.length} ${selectedKind.kind}${checkedItems.length > 1 ? 's' : ''}?`}
       message={`You are about to delete ${checkedItems.length} resource${checkedItems.length > 1 ? 's' : ''}. This action cannot be undone.`}
-      details={checkedItems.map(r => `${r.metadata?.namespace ? r.metadata.namespace + '/' : ''}${r.metadata?.name}`).join('\n')}
+      details={checkedItemDetails}
       confirmLabel={bulkForceDelete ? `Force Delete ${checkedItems.length} resource${checkedItems.length > 1 ? 's' : ''}` : `Delete ${checkedItems.length} resource${checkedItems.length > 1 ? 's' : ''}`}
       variant="danger"
       isLoading={isBulkDeleting}
@@ -4757,6 +4829,80 @@ export function ResourcesView({
         <span>Force delete (strips finalizers and bypasses grace period)</span>
       </label>
     </ConfirmDialog>
+    <ConfirmDialog
+      open={showBulkRestartConfirm}
+      onClose={() => setShowBulkRestartConfirm(false)}
+      onConfirm={() => {
+        onBulkRestart?.(checkedBulkItems, {
+          onSuccess: () => {
+            exitBulkMode()
+            setShowBulkRestartConfirm(false)
+          },
+        })
+      }}
+      title={`Restart ${checkedItems.length} ${selectedKind.kind}${checkedItems.length > 1 ? 's' : ''}?`}
+      message={`This will trigger a rolling restart for ${checkedItems.length} selected workload${checkedItems.length > 1 ? 's' : ''}.`}
+      details={checkedItemDetails}
+      confirmLabel={`Restart ${checkedItems.length} workload${checkedItems.length > 1 ? 's' : ''}`}
+      variant="warning"
+      isLoading={isBulkRestarting}
+      isClosable
+    />
+    <ConfirmDialog
+      open={showBulkScaleDialog}
+      onClose={() => setShowBulkScaleDialog(false)}
+      onConfirm={() => {
+        onBulkScale?.(checkedBulkItems, bulkScaleReplicas, {
+          onSuccess: () => {
+            exitBulkMode()
+            setShowBulkScaleDialog(false)
+          },
+        })
+      }}
+      title={`Scale ${checkedItems.length} ${selectedKind.kind}${checkedItems.length > 1 ? 's' : ''}?`}
+      message={`Set every selected workload to exactly ${bulkScaleReplicas} replica${bulkScaleReplicas === 1 ? '' : 's'}.`}
+      details={checkedItemDetails}
+      confirmLabel={`Scale to ${bulkScaleReplicas}`}
+      variant={bulkScaleReplicas === 0 ? 'danger' : 'warning'}
+      isLoading={isBulkScaling}
+      isClosable
+    >
+      <div className="space-y-3">
+        <div className="flex items-center justify-center gap-3">
+          <button
+            type="button"
+            onClick={() => setBulkScaleReplicas(Math.max(0, bulkScaleReplicas - 1))}
+            disabled={bulkScaleReplicas <= 0}
+            className="p-2 rounded-lg bg-theme-elevated hover:bg-theme-hover text-theme-text-secondary hover:text-theme-text-primary transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+          >
+            <Minus className="w-5 h-5" />
+          </button>
+          <input
+            type="number"
+            min="0"
+            max="10000"
+            value={bulkScaleReplicas}
+            onChange={(e) => setBulkScaleReplicas(Math.min(10000, Math.max(0, Number.parseInt(e.target.value, 10) || 0)))}
+            className="w-24 text-center text-2xl font-semibold bg-theme-elevated border border-theme-border rounded-lg py-2 text-theme-text-primary focus:outline-none focus:border-skyhook-500"
+            autoFocus
+          />
+          <button
+            type="button"
+            onClick={() => setBulkScaleReplicas(Math.min(10000, bulkScaleReplicas + 1))}
+            disabled={bulkScaleReplicas >= 10000}
+            className="p-2 rounded-lg bg-theme-elevated hover:bg-theme-hover text-theme-text-secondary hover:text-theme-text-primary transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+          >
+            <Plus className="w-5 h-5" />
+          </button>
+        </div>
+        <div className="text-xs text-theme-text-tertiary text-center">
+          {commonBulkScaleReplicas === null ? 'Current replicas vary across the selected workloads.' : `Current: ${commonBulkScaleReplicas} replicas`}
+        </div>
+        <p className="text-xs text-theme-text-secondary text-center">
+          All selected workloads will be set to the same replica count. Autoscalers may override it.
+        </p>
+      </div>
+    </ConfirmDialog>
     </ResourcesViewDataContext.Provider>
   )
 }

package/src/components/resources/get-pod-problems.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from 'vitest'
+import { getPodProblems } from './resource-utils'
+
+describe('getPodProblems', () => {
+  it('includes the pod status message for evicted pods', () => {
+    const detail = 'Usage of EmptyDir volume "logs-nginx" exceeds the limit "2Gi".'
+
+    expect(
+      getPodProblems({
+        status: {
+          phase: 'Failed',
+          reason: 'Evicted',
+          message: detail,
+        },
+      }),
+    ).toContainEqual({ severity: 'high', message: 'Evicted', detail })
+  })
+
+  it('keeps exit-code labels stable while surfacing terminated messages', () => {
+    const detail = 'Container process exited after receiving SIGKILL.'
+
+    expect(
+      getPodProblems({
+        status: {
+          phase: 'Running',
+          containerStatuses: [
+            {
+              name: 'api',
+              restartCount: 0,
+              state: {
+                terminated: {
+                  exitCode: 137,
+                  reason: 'Error',
+                  message: detail,
+                },
+              },
+            },
+          ],
+        },
+      }),
+    ).toContainEqual({ severity: 'high', message: 'Exit Code 137', detail })
+  })
+
+  it('keeps waiting-state labels stable while surfacing kubelet messages', () => {
+    const detail = 'Back-off pulling image "registry.example.com/api:missing".'
+
+    expect(
+      getPodProblems({
+        status: {
+          phase: 'Pending',
+          containerStatuses: [
+            {
+              name: 'api',
+              restartCount: 0,
+              state: {
+                waiting: {
+                  reason: 'ImagePullBackOff',
+                  message: detail,
+                },
+              },
+            },
+          ],
+        },
+      }),
+    ).toContainEqual({ severity: 'critical', message: 'ImagePullBackOff', detail })
+  })
+
+  it('infers sandbox startup stalls only for scheduled pods and follows backend severity gates', () => {
+    expect(
+      getPodProblems({
+        metadata: { creationTimestamp: new Date(Date.now() - 20 * 60 * 1000).toISOString() },
+        spec: { nodeName: 'worker-1' },
+        status: {
+          phase: 'Pending',
+          containerStatuses: [
+            {
+              name: 'api',
+              restartCount: 0,
+              state: { waiting: { reason: 'ContainerCreating' } },
+            },
+          ],
+        },
+      }),
+    ).toContainEqual({ severity: 'high', message: 'Sandbox Startup Stalled' })
+
+    expect(
+      getPodProblems({
+        metadata: { creationTimestamp: new Date(Date.now() - 45 * 60 * 1000).toISOString() },
+        spec: { nodeName: 'worker-1' },
+        status: {
+          phase: 'Pending',
+          containerStatuses: [
+            {
+              name: 'api',
+              restartCount: 0,
+              state: { waiting: { reason: 'ContainerCreating' } },
+            },
+          ],
+        },
+      }),
+    ).toContainEqual({ severity: 'critical', message: 'Sandbox Startup Stalled' })
+
+    expect(
+      getPodProblems({
+        metadata: { creationTimestamp: new Date(Date.now() - 45 * 60 * 1000).toISOString() },
+        spec: { nodeName: 'worker-1' },
+        status: {
+          phase: 'Pending',
+          conditions: [
+            {
+              type: 'PodScheduled',
+              status: 'False',
+              reason: 'Unschedulable',
+            },
+          ],
+          containerStatuses: [
+            {
+              name: 'api',
+              restartCount: 0,
+              state: { waiting: { reason: 'ContainerCreating' } },
+            },
+          ],
+        },
+      }),
+    ).not.toContainEqual(expect.objectContaining({ message: 'Sandbox Startup Stalled' }))
+  })
+})

package/src/components/resources/renderers/PodRenderer.test.tsx

@@ -51,3 +51,59 @@ describe('PodRenderer envFrom expansion', () => {
     expect(html).not.toContain('PUBLIC_URL<!-- -->=')
   })
 })
+
+describe('PodRenderer issues banner', () => {
+  it('renders pod status messages for evicted pods', () => {
+    const html = renderToString(
+      <PodRenderer
+        data={{
+          metadata: { name: 'nginx', namespace: 'default' },
+          spec: { containers: [{ name: 'nginx', image: 'nginx:latest' }] },
+          status: {
+            phase: 'Failed',
+            reason: 'Evicted',
+            message: 'Usage of EmptyDir volume "logs-nginx" exceeds the limit "2Gi".',
+          },
+        }}
+        onCopy={() => undefined}
+        copied={null}
+      />,
+    )
+
+    expect(html).toContain('Issues Detected')
+    expect(html).toContain('Evicted')
+    expect(html).toContain('Usage of EmptyDir volume')
+    expect(html).toContain('exceeds the limit')
+  })
+
+  it('wraps long issue detail text inside the banner', () => {
+    const html = renderToString(
+      <PodRenderer
+        data={{
+          metadata: { name: 'api', namespace: 'default' },
+          spec: { containers: [{ name: 'api', image: 'registry.example.com/api:missing' }] },
+          status: {
+            phase: 'Pending',
+            containerStatuses: [
+              {
+                name: 'api',
+                restartCount: 0,
+                state: {
+                  waiting: {
+                    reason: 'ImagePullBackOff',
+                    message: `Back-off pulling image "${'a'.repeat(240)}"`,
+                  },
+                },
+              },
+            ],
+          },
+        }}
+        onCopy={() => undefined}
+        copied={null}
+      />,
+    )
+
+    expect(html).toContain('ImagePullBackOff')
+    expect(html).toContain('min-w-0 break-words')
+  })
+})

package/src/components/resources/renderers/PodRenderer.tsx

@@ -347,7 +347,7 @@ export function PodRenderer({
             {podProblems.map((p, i) => (
               <li key={i} className="flex items-start gap-1.5">
                 <span className={clsx('w-1.5 h-1.5 rounded-full shrink-0 mt-1', SEVERITY_DOT_COLOR[p.severity])} />
-                <span className="text-red-600 dark:text-red-400">
+                <span className="min-w-0 break-words text-red-600 dark:text-red-400">
                   {p.message}
                   {p.detail && <span className="text-theme-text-secondary">: {p.detail}</span>}
                 </span>

package/src/components/resources/resource-utils.ts

@@ -267,26 +267,39 @@ export function getPodProblems(pod: any): PodProblem[] {
   const initContainerStatuses = pod.status?.initContainerStatuses || []
   const conditions = pod.status?.conditions || []
   const phase = pod.status?.phase
+  const podStatusMessage = pod.status?.message || undefined
+  const hasPodIP = Boolean(pod.status?.podIP || pod.status?.podIPs?.some((ip: any) => ip?.ip))
+  const hasScheduledNode = Boolean(pod.spec?.nodeName)
+  const hasUnschedulableCondition = conditions.some((cond: any) => cond.type === 'PodScheduled' && cond.status === 'False')
+  const hasContainerCreating = containerStatuses.some((cs: any) => cs.state?.waiting?.reason === 'ContainerCreating')
+  const createdAtMs = pod.metadata?.creationTimestamp ? new Date(pod.metadata.creationTimestamp).getTime() : NaN
+  const podAgeMs = Number.isFinite(createdAtMs) ? Date.now() - createdAtMs : 0
+  const sandboxStartupStallAgeMs = 10 * 60 * 1000
+  const sandboxStartupStallCriticalAgeMs = 30 * 60 * 1000
+  const inferredSandboxStartupStall = phase === 'Pending' && hasScheduledNode && !hasUnschedulableCondition && hasContainerCreating && !hasPodIP && podAgeMs > sandboxStartupStallAgeMs
+  const inferredSandboxStartupStallSeverity: PodProblem['severity'] = podAgeMs >= sandboxStartupStallCriticalAgeMs ? 'critical' : 'high'
+  let hasSandboxStartupStallProblem = false
 
   // Failed or Unknown phase
   if (phase === 'Failed' && pod.status?.reason !== 'Evicted') {
-    problems.push({ severity: 'critical', message: 'Failed' })
+    problems.push({ severity: 'critical', message: 'Failed', detail: podStatusMessage })
   } else if (phase === 'Unknown') {
-    problems.push({ severity: 'high', message: 'Unknown' })
+    problems.push({ severity: 'high', message: 'Unknown', detail: podStatusMessage })
   }
 
   // Init container failures
   for (const cs of initContainerStatuses) {
     if (cs.state?.waiting?.reason && cs.state.waiting.reason !== 'PodInitializing') {
       const reason = cs.state.waiting.reason
+      const detail = cs.state.waiting.message || undefined
       if (['CrashLoopBackOff', 'ImagePullBackOff', 'ErrImagePull'].includes(reason)) {
-        problems.push({ severity: 'critical', message: `Init: ${reason}` })
+        problems.push({ severity: 'critical', message: `Init: ${reason}`, detail })
       } else {
-        problems.push({ severity: 'high', message: `Init: ${reason}` })
+        problems.push({ severity: 'high', message: `Init: ${reason}`, detail })
       }
     }
     if (cs.state?.terminated?.exitCode && cs.state.terminated.exitCode !== 0) {
-      problems.push({ severity: 'high', message: `Init: Exit Code ${cs.state.terminated.exitCode}` })
+      problems.push({ severity: 'high', message: `Init: Exit Code ${cs.state.terminated.exitCode}`, detail: cs.state.terminated.message || undefined })
     }
   }
 
@@ -294,30 +307,32 @@ export function getPodProblems(pod: any): PodProblem[] {
     // Check waiting state
     if (cs.state?.waiting?.reason) {
       const reason = cs.state.waiting.reason
+      const detail = cs.state.waiting.message || undefined
       if (['CrashLoopBackOff', 'ImagePullBackOff', 'ErrImagePull'].includes(reason)) {
-        problems.push({ severity: 'critical', message: reason })
+        problems.push({ severity: 'critical', message: reason, detail })
       } else if (reason === 'CreateContainerConfigError') {
-        problems.push({ severity: 'critical', message: 'Config Error' })
+        problems.push({ severity: 'critical', message: 'Config Error', detail })
       } else if (reason === 'ContainerCannotRun') {
-        problems.push({ severity: 'critical', message: 'Cannot Run' })
+        problems.push({ severity: 'critical', message: 'Cannot Run', detail })
       } else if (reason !== 'ContainerCreating' && reason !== 'PodInitializing') {
-        problems.push({ severity: 'high', message: reason })
+        problems.push({ severity: 'high', message: reason, detail })
       }
     }
     // Check terminated state
     if (cs.state?.terminated?.reason === 'OOMKilled') {
-      problems.push({ severity: 'critical', message: 'OOMKilled' })
+      problems.push({ severity: 'critical', message: 'OOMKilled', detail: cs.state.terminated.message || undefined })
     } else if (cs.state?.terminated?.exitCode && cs.state.terminated.exitCode !== 0) {
-      problems.push({ severity: 'high', message: `Exit Code ${cs.state.terminated.exitCode}` })
+      problems.push({ severity: 'high', message: `Exit Code ${cs.state.terminated.exitCode}`, detail: cs.state.terminated.message || undefined })
     }
     // High restart count
     if (cs.restartCount > 5) {
       problems.push({ severity: 'medium', message: `${cs.restartCount} restarts` })
     }
     // Volume mount issues from last state
-    const lastMsg = cs.lastState?.terminated?.message?.toLowerCase() || ''
+    const lastMsgRaw = cs.lastState?.terminated?.message || ''
+    const lastMsg = lastMsgRaw.toLowerCase()
     if (lastMsg.includes('failed to mount') || lastMsg.includes('failedattachvolume')) {
-      problems.push({ severity: 'high', message: 'Volume Mount Failed' })
+      problems.push({ severity: 'high', message: 'Volume Mount Failed', detail: lastMsgRaw || undefined })
     }
   }
 
@@ -332,23 +347,29 @@ export function getPodProblems(pod: any): PodProblem[] {
     if (cond.type === 'ContainersReady' && cond.status === 'False') {
       const msg = (cond.message || '').toLowerCase()
       if (msg.includes('readiness')) {
-        problems.push({ severity: 'medium', message: 'Readiness Probe Failing' })
+        problems.push({ severity: 'medium', message: 'Readiness Probe Failing', detail: cond.message || undefined })
       } else if (msg.includes('liveness')) {
-        problems.push({ severity: 'high', message: 'Liveness Probe Failing' })
+        problems.push({ severity: 'high', message: 'Liveness Probe Failing', detail: cond.message || undefined })
       }
     }
     // IP allocation failures (subnet exhaustion)
     if (cond.type === 'PodReadyToStartContainers' && cond.status === 'False') {
       const msg = (cond.message || '').toLowerCase()
-      if (msg.includes('failed to assign an ip') || msg.includes('pod sandbox')) {
-        problems.push({ severity: 'critical', message: 'IP Allocation Failed' })
+      if (msg.includes('failed to assign an ip')) {
+        problems.push({ severity: 'critical', message: 'IP Allocation Failed', detail: cond.message || undefined })
+      } else if (msg.includes('pod sandbox')) {
+        problems.push({ severity: 'critical', message: 'Sandbox Startup Stalled', detail: cond.message || undefined })
+        hasSandboxStartupStallProblem = true
       }
     }
   }
+  if (inferredSandboxStartupStall && !hasSandboxStartupStallProblem) {
+    problems.push({ severity: inferredSandboxStartupStallSeverity, message: 'Sandbox Startup Stalled' })
+  }
 
   // Evicted pods
   if (phase === 'Failed' && pod.status?.reason === 'Evicted') {
-    problems.push({ severity: 'high', message: 'Evicted' })
+    problems.push({ severity: 'high', message: 'Evicted', detail: podStatusMessage })
   }
 
   // Stuck terminating (zombie pod)

package/src/types/core.ts

@@ -47,6 +47,15 @@ export const OPTIONAL_RESOURCE_KINDS: ReadonlyArray<keyof ResourcePermissions> =
   'verticalPodAutoscalers',
 ]
 
+// Per-workload write permissions. Field names must match
+// WorkloadWritePermissions in internal/k8s/capabilities.go.
+export interface WorkloadWritePermissions {
+  deployments: boolean
+  daemonSets: boolean
+  statefulSets: boolean
+  rollouts: boolean
+}
+
 // Feature capabilities based on RBAC permissions
 export interface Capabilities {
   exec: boolean           // Terminal feature (pods/exec)
@@ -57,6 +66,7 @@ export interface Capabilities {
   secretsUpdate: boolean  // Update secrets (inline editing)
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
+  workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
   mcpEnabled: boolean     // MCP server is running
   // How / where this Radar binary is running. Optional on the wire so a
   // newer frontend (e.g. radar-hub-web bundling a fresher @skyhook-io/radar-app)

package/src/utils/bulk-workload-actions.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest'
+import {
+  canBulkRestartKind,
+  canBulkScaleKind,
+  intersectWorkloadWrites,
+} from './bulk-workload-actions'
+import type { Capabilities, WorkloadWritePermissions } from '../types/core'
+
+const writes = (overrides: Partial<WorkloadWritePermissions> = {}): WorkloadWritePermissions => ({
+  deployments: false,
+  daemonSets: false,
+  statefulSets: false,
+  rollouts: false,
+  ...overrides,
+})
+
+const caps = (workloadWrites: WorkloadWritePermissions): Pick<Capabilities, 'workloadWrites'> => ({
+  workloadWrites,
+})
+
+describe('bulk workload action gating', () => {
+  it('allows restart for patchable workload kinds', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })
+
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'daemonsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'statefulsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(true)
+  })
+
+  it('requires the apps group for built-in workload restart', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true })
+
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'deployments', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'deployments' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'daemonsets', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'statefulsets', group: 'example.com' }, all)).toBe(false)
+  })
+
+  it('requires the Argo group for rollout restart', () => {
+    const all = writes({ rollouts: true })
+
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'rollouts' }, all)).toBe(false)
+  })
+
+  it('allows scale only for deployments and statefulsets', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })
+
+    expect(canBulkScaleKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkScaleKind({ name: 'statefulsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkScaleKind({ name: 'daemonsets', group: 'apps' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments' }, all)).toBe(false)
+  })
+
+  it('withholds actions when permissions are absent', () => {
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, undefined)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments', group: 'apps' }, undefined)).toBe(false)
+    expect(intersectWorkloadWrites(undefined)).toBeUndefined()
+    expect(intersectWorkloadWrites([])).toBeUndefined()
+  })
+
+  it('intersects multi-namespace permissions with AND semantics', () => {
+    expect(intersectWorkloadWrites([
+      caps(writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })),
+      caps(writes({ deployments: true, statefulSets: true })),
+    ])).toEqual({
+      deployments: true,
+      daemonSets: false,
+      statefulSets: true,
+      rollouts: false,
+    })
+  })
+})

package/src/utils/bulk-workload-actions.ts

@@ -0,0 +1,50 @@
+import type { Capabilities, WorkloadWritePermissions } from '../types/core'
+
+export type BulkWorkloadKindInfo = {
+  name: string
+  group?: string
+}
+
+export function canBulkRestartKind(
+  kind: BulkWorkloadKindInfo | null | undefined,
+  writes: WorkloadWritePermissions | undefined,
+): boolean {
+  switch (kind?.name.toLowerCase()) {
+    case 'deployments':
+      return kind.group === 'apps' && writes?.deployments === true
+    case 'daemonsets':
+      return kind.group === 'apps' && writes?.daemonSets === true
+    case 'statefulsets':
+      return kind.group === 'apps' && writes?.statefulSets === true
+    case 'rollouts':
+      return kind.group === 'argoproj.io' && writes?.rollouts === true
+    default:
+      return false
+  }
+}
+
+export function canBulkScaleKind(
+  kind: BulkWorkloadKindInfo | null | undefined,
+  writes: WorkloadWritePermissions | undefined,
+): boolean {
+  switch (kind?.name.toLowerCase()) {
+    case 'deployments':
+      return kind.group === 'apps' && writes?.deployments === true
+    case 'statefulsets':
+      return kind.group === 'apps' && writes?.statefulSets === true
+    default:
+      return false
+  }
+}
+
+export function intersectWorkloadWrites(
+  capabilities: Array<Pick<Capabilities, 'workloadWrites'>> | undefined,
+): WorkloadWritePermissions | undefined {
+  if (!capabilities || capabilities.length === 0) return undefined
+  return {
+    deployments: capabilities.every(c => c.workloadWrites?.deployments === true),
+    daemonSets: capabilities.every(c => c.workloadWrites?.daemonSets === true),
+    statefulSets: capabilities.every(c => c.workloadWrites?.statefulSets === true),
+    rollouts: capabilities.every(c => c.workloadWrites?.rollouts === true),
+  }
+}

package/src/utils/index.ts

@@ -22,3 +22,4 @@ export * from './rbac-badges'
 export * from './git-provider-urls'
 export * from './applications'
 export * from './topology-neighborhood'
+export * from './bulk-workload-actions'