@skyhook-io/radar-app 0.2.2 → 0.3.1

package/src/api/client.yaml.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { ApplyResourceError, formatApplyResourceError } from './client'
+
+describe('formatApplyResourceError', () => {
+  it('reports resources persisted before a multi-document failure', () => {
+    expect(
+      formatApplyResourceError(
+        {
+          error: 'document 3: admission denied the Service',
+          failedIndex: 2,
+          total: 4,
+          results: [
+            { kind: 'Namespace', namespace: '', name: 'checkout', created: true },
+            { kind: 'Deployment', namespace: 'checkout', name: 'api', created: true },
+          ],
+        },
+        422,
+      ),
+    ).toBe(
+      '2 of 4 resources were applied before document 3 failed. Applied: Namespace checkout, Deployment checkout/api. admission denied the Service',
+    )
+  })
+
+  it('preserves ordinary apply errors', () => {
+    expect(formatApplyResourceError({ error: 'field is invalid' }, 422)).toBe('field is invalid')
+  })
+
+  it('preserves structured partial-apply results for recovery', () => {
+    const result = { kind: 'Namespace', namespace: '', name: 'checkout', created: true }
+    const error = new ApplyResourceError(
+      {
+        error: 'document 2: admission denied',
+        failedIndex: 1,
+        total: 3,
+        results: [result],
+      },
+      422,
+    )
+
+    expect(error.message).toContain('1 of 3 resource was applied')
+    expect(error.appliedResults).toEqual([result])
+    expect(error.failedIndex).toBe(1)
+    expect(error.total).toBe(3)
+  })
+})

package/src/api/diagnose.ts

@@ -0,0 +1,289 @@
+// Client for the local AI-diagnose engine (OSS BYO-agent). The agent CLI runs
+// on the user's own machine/subscription against Radar's MCP; this just starts
+// the investigation and consumes its SSE event stream.
+import { getApiBase, getCredentialsMode } from "./config";
+
+export interface AgentInfo {
+  name: string;
+  label: string;
+  path: string;
+  version: string;
+  present: boolean;
+  supported: boolean;
+  hosted?: boolean;
+}
+
+export interface AgentsResponse {
+  agents: AgentInfo[];
+  enabled: boolean;
+  // Machine-scoped consent per disclosure surface, recorded server-side
+  // (~/.radar) — one acknowledgment covers the web panel and the CLI.
+  consented?: { standard?: boolean; cursor?: boolean };
+}
+
+export interface DiagnoseStep {
+  id: string;
+  tool: string;
+  status: "running" | "done";
+  ms?: number;
+  summary?: string; // input args (on running)
+  result?: string; // result text (on done), capped
+  truncated?: boolean; // result was capped — payload shown/copied is partial
+}
+
+export interface Diagnosis {
+  healthy?: boolean;
+  inconclusive?: boolean; // investigated but couldn't determine — distinct from healthy
+  rootCause: string;
+  report: string;
+  remediation: string[];
+  recommendedIndex?: number; // 1-based index into remediation of the step Apply performs
+  recommendedReason?: string; // why the recommended step is the safe pick
+  confidence?: number;
+  costUsd?: number;
+  turns?: number;
+  sessionId?: string;
+}
+
+export interface HealthLine {
+  severity?: string;
+  reason?: string; // issue Reason / audit CheckID
+  message?: string;
+}
+
+export interface ResourceHealthSignal {
+  health?: string;
+  issueCount?: number;
+  highestSeverity?: string;
+  topReason?: string;
+  issues?: HealthLine[];
+  auditCount?: number;
+  auditSeverity?: string;
+  topFinding?: string;
+  auditFindings?: HealthLine[];
+}
+
+export interface DiagnoseStreamEvent {
+  type:
+    | "turn"
+    | "phase"
+    | "step"
+    | "thinking"
+    | "done"
+    | "error"
+    | "closed";
+  phase?: string;
+  step?: DiagnoseStep;
+  token?: string;
+  diagnosis?: Diagnosis;
+  error?: string;
+  question?: string; // on "turn"
+  apply?: boolean; // on "turn"
+}
+
+// A run is a durable, server-owned investigation. Its lifetime is independent of
+// any browser tab — it survives panel close / navigation / refresh while the radar
+// server runs.
+export interface RunSummary {
+  id: string;
+  kind: string;
+  namespace: string;
+  name: string;
+  context: string;
+  agent?: string; // backend CLI that drove this run ("claude"/"codex")
+  isolated?: boolean;
+  model?: string;
+  effort?: string;
+  managedBy?: string; // GitOps/Helm owner of the target ("Argo CD"/"Flux"/"Helm"), for the Apply warning
+  health?: ResourceHealthSignal;
+  status: "running" | "done" | "error" | "stopped" | "stale";
+  sessionId?: string;
+  preview?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export async function fetchAgents(
+  signal?: AbortSignal,
+): Promise<AgentsResponse> {
+  const res = await fetch(`${getApiBase()}/agents`, {
+    credentials: getCredentialsMode(),
+    signal,
+  });
+  if (!res.ok) throw new Error(`agents: ${res.status}`);
+  return res.json();
+}
+
+async function errorText(res: Response): Promise<string> {
+  try {
+    const d = await res.json();
+    if (d && typeof d.error === "string") return d.error;
+  } catch {
+    /* ignore */
+  }
+  return `request failed (${res.status})`;
+}
+
+// DiagnoseError carries the HTTP status so callers can special-case (e.g. 409 cap).
+export class DiagnoseError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+  }
+}
+
+const RUNS = () => `${getApiBase()}/diagnose/runs`;
+
+// createRun starts a server-side investigation (or focuses a live one for the same
+// target) and returns its run summary.
+export async function createRun(
+  target: {
+    kind: string;
+    namespace: string;
+    name: string;
+  },
+  opts?: {
+    agent?: string;
+    isolated?: boolean;
+    model?: string;
+    effort?: string;
+  },
+): Promise<RunSummary> {
+  const res = await fetch(RUNS(), {
+    method: "POST",
+    credentials: getCredentialsMode(),
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ ...target, ...opts }),
+  });
+  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  return res.json();
+}
+
+export interface RunsResponse {
+  runs: RunSummary[];
+  // Persistence stopped working (disk error) — history will NOT survive a
+  // restart; the UI should say so instead of letting the user assume otherwise.
+  historyDegraded?: boolean;
+}
+
+// listRuns returns all server-side runs (newest first) — the source of truth for
+// the recent-investigations list.
+export async function listRuns(signal?: AbortSignal): Promise<RunsResponse> {
+  const res = await fetch(RUNS(), {
+    credentials: getCredentialsMode(),
+    signal,
+  });
+  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  const d = await res.json();
+  return { runs: d.runs ?? [], historyDegraded: !!d.historyDegraded };
+}
+
+// recordConsent acknowledges the current disclosure for a surface, server-side.
+export async function recordConsent(
+  surface: "standard" | "cursor",
+): Promise<void> {
+  const res = await fetch(`${getApiBase()}/diagnose/consent`, {
+    method: "POST",
+    credentials: getCredentialsMode(),
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ surface }),
+  });
+  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+}
+
+// clearHistory wipes the persisted investigation history (finished runs); live
+// investigations survive.
+export async function clearHistory(): Promise<void> {
+  const res = await fetch(`${getApiBase()}/diagnose/history/clear`, {
+    method: "POST",
+    credentials: getCredentialsMode(),
+  });
+  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+}
+
+// addTurn appends a follow-up (question) or an apply turn (apply + confirmed fix).
+export async function addTurn(
+  id: string,
+  body: { question?: string; apply?: boolean; fix?: string },
+): Promise<void> {
+  const res = await fetch(`${RUNS()}/${id}/turns`, {
+    method: "POST",
+    credentials: getCredentialsMode(),
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+}
+
+// stopRun cancels a run's in-flight agent.
+export async function stopRun(id: string): Promise<void> {
+  await fetch(`${RUNS()}/${id}/stop`, {
+    method: "POST",
+    credentials: getCredentialsMode(),
+  }).catch(() => {});
+}
+
+export interface SubscribeHandlers {
+  onEvent: (ev: DiagnoseStreamEvent) => void;
+  onClosed?: () => void; // the run can no longer produce events (stale/evicted)
+}
+
+/**
+ * Subscribes to a run's event stream: the server replays everything (so a fresh
+ * tab reconstructs the whole transcript) then streams live. Closing this only
+ * unsubscribes — the run keeps running server-side. The EventSource auto-reconnects
+ * on transient errors (resuming via Last-Event-ID); a "closed" event means the run
+ * is gone, so we stop for good.
+ */
+export function subscribeRun(
+  id: string,
+  handlers: SubscribeHandlers,
+): () => void {
+  const es = new EventSource(`${RUNS()}/${id}/stream`, {
+    withCredentials: getCredentialsMode() === "include",
+  });
+  let closed = false;
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    es.close();
+  };
+  const dispatch = (e: MessageEvent) => {
+    let ev: DiagnoseStreamEvent;
+    try {
+      ev = JSON.parse(e.data);
+    } catch {
+      return;
+    }
+    if (ev.type === "closed") {
+      close();
+      handlers.onClosed?.();
+      return;
+    }
+    handlers.onEvent(ev);
+  };
+  for (const t of [
+    "turn",
+    "phase",
+    "step",
+    "thinking",
+    "done",
+    "error",
+    "closed",
+  ] as const) {
+    es.addEventListener(t, dispatch);
+  }
+  es.onerror = () => {
+    // A permanent failure (readyState CLOSED) means the run is gone — a 404 because
+    // it was evicted (retention cap) or lost on a server restart. Surface it as
+    // closed so the view shows a "no longer available" state instead of a silent
+    // blank. Transient blips stay CONNECTING and auto-reconnect (Last-Event-ID
+    // replays only what we missed), so leave those to EventSource.
+    if (es.readyState === EventSource.CLOSED) {
+      close();
+      handlers.onClosed?.();
+    }
+  };
+  return close;
+}

package/src/api/quotas.ts

@@ -0,0 +1,16 @@
+import { useQuery } from '@tanstack/react-query'
+import { fetchJSON } from './client'
+
+// useNamespaceQuotas fetches a namespace's ResourceQuota objects via
+// /api/resources/resourcequotas?namespace=<ns> (a bare array). Backs the
+// NamespaceRenderer quota-usage section — quota saturation is otherwise
+// surfaced nowhere in the UI, yet it's exactly why a namespace stops
+// admitting new pods.
+export function useNamespaceQuotas(namespace: string, enabled = true) {
+  return useQuery<any[]>({
+    queryKey: ['resourcequotas', namespace],
+    queryFn: () => fetchJSON<any[]>(`/resources/resourcequotas?namespace=${encodeURIComponent(namespace)}`),
+    enabled: enabled && !!namespace,
+    staleTime: 15000,
+  })
+}

package/src/api/rbac.ts

@@ -0,0 +1,57 @@
+import { useQuery } from '@tanstack/react-query'
+import type {
+  RBACSubjectResponse,
+  RBACRoleResponse,
+  RBACWhoamiResponse,
+  RBACNamespaceResponse,
+} from '@skyhook-io/k8s-ui'
+import { fetchJSON } from './client'
+
+// /api/rbac/subject/{kind}/{namespace}/{name}   (ServiceAccount)
+// /api/rbac/subject/{kind}/{name}               (User/Group — no namespace)
+export function useRBACSubject(kind: 'ServiceAccount' | 'User' | 'Group', namespace: string, name: string, enabled = true) {
+  // Subject lookups depend on cluster-wide RBAC. They don't change often,
+  // and operators bouncing between Pod/SA pages re-hit the same SA. Use a
+  // 15s stale window so cross-page navigation is instant.
+  const path =
+    kind === 'ServiceAccount'
+      ? `/rbac/subject/${kind}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`
+      : `/rbac/subject/${kind}/${encodeURIComponent(name)}`
+  return useQuery<RBACSubjectResponse>({
+    queryKey: ['rbac', 'subject', kind, namespace, name],
+    queryFn: () => fetchJSON<RBACSubjectResponse>(path),
+    enabled: enabled && !!name && (kind !== 'ServiceAccount' || !!namespace),
+    staleTime: 15000,
+  })
+}
+
+// /api/rbac/role/{kind}/{namespace}/{name}  (use "_" for ClusterRole's empty namespace)
+export function useRBACRole(kind: 'Role' | 'ClusterRole', namespace: string, name: string, enabled = true) {
+  const nsSegment = kind === 'ClusterRole' ? '_' : encodeURIComponent(namespace)
+  return useQuery<RBACRoleResponse>({
+    queryKey: ['rbac', 'role', kind, namespace, name],
+    queryFn: () => fetchJSON<RBACRoleResponse>(`/rbac/role/${kind}/${nsSegment}/${encodeURIComponent(name)}`),
+    enabled: enabled && !!name && (kind !== 'Role' || !!namespace),
+    staleTime: 15000,
+  })
+}
+
+// /api/rbac/namespace/{namespace}
+export function useRBACNamespace(namespace: string, enabled = true) {
+  return useQuery<RBACNamespaceResponse>({
+    queryKey: ['rbac', 'namespace', namespace],
+    queryFn: () => fetchJSON<RBACNamespaceResponse>(`/rbac/namespace/${encodeURIComponent(namespace)}`),
+    enabled: enabled && !!namespace,
+    staleTime: 15000,
+  })
+}
+
+// /api/rbac/whoami?namespace=<ns>
+export function useRBACWhoami(namespace: string, enabled = true) {
+  return useQuery<RBACWhoamiResponse>({
+    queryKey: ['rbac', 'whoami', namespace],
+    queryFn: () => fetchJSON<RBACWhoamiResponse>(`/rbac/whoami?namespace=${encodeURIComponent(namespace)}`),
+    enabled: enabled && !!namespace,
+    staleTime: 30000,
+  })
+}

package/src/api/timelineSource.test.ts

@@ -0,0 +1,217 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+// The retained NDJSON parser goes through apiFetch; mock the client module so a
+// test can hand fetchRetainedWindow an arbitrary streamed body. ApiError is only
+// hit on the non-ok branch (not exercised here) but must exist for module load.
+vi.mock('./client', () => ({
+  apiFetch: vi.fn(),
+  useChanges: vi.fn(),
+  ApiError: class ApiError extends Error {
+    status: number
+    constructor(message: string, status: number) {
+      super(message)
+      this.status = status
+    }
+  },
+}))
+
+import { apiFetch } from './client'
+import {
+  fetchRetainedWindow,
+  applyClientFilters,
+  localOverviewFromEvents,
+  LIVE_WINDOW_MS,
+} from './timelineSource'
+import { BASE_QUANTIZE_STEP_MS } from '@skyhook-io/k8s-ui'
+import type { TimelineEvent } from '../types'
+
+const mockApiFetch = vi.mocked(apiFetch)
+
+// A minimal streamed Response: each string in `chunks` is delivered as one
+// reader.read() so tests can split a JSON line across chunk boundaries.
+function streamResponse(chunks: string[]): Response {
+  const encoder = new TextEncoder()
+  let i = 0
+  const body = {
+    getReader() {
+      return {
+        read() {
+          if (i < chunks.length) {
+            return Promise.resolve({ done: false, value: encoder.encode(chunks[i++]) })
+          }
+          return Promise.resolve({ done: true, value: undefined })
+        },
+      }
+    },
+  }
+  return { ok: true, body } as unknown as Response
+}
+
+const T0 = Date.parse('2024-01-01T00:00:00.000Z')
+
+function ev(over: Partial<TimelineEvent> & { id: string }): TimelineEvent {
+  return {
+    timestamp: new Date(T0).toISOString(),
+    source: 'informer',
+    kind: 'Pod',
+    namespace: 'default',
+    name: over.id,
+    eventType: 'update',
+    ...over,
+  }
+}
+
+beforeEach(() => {
+  mockApiFetch.mockReset()
+})
+
+describe('fetchRetainedWindow (NDJSON stream parser)', () => {
+  it('reassembles a JSON line split across chunk boundaries', async () => {
+    mockApiFetch.mockResolvedValue(
+      streamResponse([
+        '{"id":"a","kind":"Pod","name":"a","namespace":"ns","source":"informer","eventType":"update"',
+        ',"timestamp":"2024-01-01T00:00:00.000Z"}\n{"type":"end"}\n',
+      ]),
+    )
+    const { events } = await fetchRetainedWindow(0, 1000)
+    expect(events).toHaveLength(1)
+    expect(events[0].id).toBe('a')
+    expect(events[0].kind).toBe('Pod')
+  })
+
+  it('separates coverage records from events', async () => {
+    mockApiFetch.mockResolvedValue(
+      streamResponse([
+        '{"id":"a","kind":"Pod","name":"a","namespace":"ns","source":"informer","eventType":"update","timestamp":"2024-01-01T00:00:00.000Z"}\n',
+        '{"type":"coverage","eventTimeStartMs":1,"eventTimeEndMs":2}\n',
+        '{"type":"end"}\n',
+      ]),
+    )
+    const { events, coverage } = await fetchRetainedWindow(0, 1000)
+    expect(events).toHaveLength(1)
+    expect(coverage).toHaveLength(1)
+  })
+
+  it('throws on a truncated stream (missing terminal record)', async () => {
+    mockApiFetch.mockResolvedValue(
+      streamResponse([
+        '{"id":"a","kind":"Pod","name":"a","namespace":"ns","source":"informer","eventType":"update","timestamp":"2024-01-01T00:00:00.000Z"}\n',
+      ]),
+    )
+    await expect(fetchRetainedWindow(0, 1000)).rejects.toThrow('truncated')
+  })
+
+  it('throws the message carried by an error terminal record', async () => {
+    mockApiFetch.mockResolvedValue(
+      streamResponse(['{"type":"error","message":"backend exploded"}\n']),
+    )
+    await expect(fetchRetainedWindow(0, 1000)).rejects.toThrow('backend exploded')
+  })
+})
+
+describe('applyClientFilters', () => {
+  const events: TimelineEvent[] = [
+    ev({ id: 'p1', kind: 'Pod', namespace: 'ns-a', timestamp: new Date(T0 + 3000).toISOString() }),
+    ev({ id: 'd1', kind: 'Deployment', namespace: 'ns-b', timestamp: new Date(T0 + 1000).toISOString() }),
+    ev({ id: 'k1', kind: 'Pod', namespace: 'ns-a', source: 'k8s_event', eventType: 'Warning', timestamp: new Date(T0 + 2000).toISOString() }),
+    ev({ id: 'del1', kind: 'Pod', namespace: 'ns-b', eventType: 'delete', timestamp: new Date(T0 + 4000).toISOString() }),
+  ]
+
+  it('filters by namespace', () => {
+    const out = applyClientFilters(events, { namespaces: ['ns-a'] })
+    expect(out.map((e) => e.id).sort()).toEqual(['k1', 'p1'])
+  })
+
+  it('filters by kind', () => {
+    const out = applyClientFilters(events, { kinds: ['Deployment'] })
+    expect(out.map((e) => e.id)).toEqual(['d1'])
+  })
+
+  it('drops k8s events when includeK8sEvents is false', () => {
+    const out = applyClientFilters(events, { includeK8sEvents: false })
+    expect(out.some((e) => e.id === 'k1')).toBe(false)
+  })
+
+  it('drops deletes when includeDeleted is false', () => {
+    const out = applyClientFilters(events, { includeDeleted: false })
+    expect(out.some((e) => e.id === 'del1')).toBe(false)
+  })
+
+  it('bounds the result by [fromMs,toMs] event time', () => {
+    const out = applyClientFilters(events, { fromMs: T0 + 1500, toMs: T0 + 3500 })
+    expect(out.map((e) => e.id).sort()).toEqual(['k1', 'p1'])
+  })
+
+  it('sorts newest-first', () => {
+    const out = applyClientFilters(events, {})
+    expect(out.map((e) => e.id)).toEqual(['del1', 'p1', 'k1', 'd1'])
+  })
+
+  it('caps the result at limit (keeping the newest)', () => {
+    const out = applyClientFilters(events, { limit: 2 })
+    expect(out.map((e) => e.id)).toEqual(['del1', 'p1'])
+  })
+
+  // Mirrors Go's TimelineEvent.IsManaged: owned, or ReplicaSet/Pod/Event.
+  // Enforced client-side so retained mode (whose endpoint has no
+  // include_managed param) behaves exactly like local mode.
+  it('drops managed rows only when includeManaged is explicitly false', () => {
+    const mixed: TimelineEvent[] = [
+      ev({ id: 'dep', kind: 'Deployment', namespace: 'ns-a' }),
+      ev({ id: 'pod', kind: 'Pod', namespace: 'ns-a' }),
+      ev({ id: 'rs', kind: 'ReplicaSet', namespace: 'ns-a' }),
+      ev({ id: 'owned-cm', kind: 'ConfigMap', namespace: 'ns-a', owner: { kind: 'Deployment', name: 'web' } }),
+    ]
+    const filtered = applyClientFilters(mixed, { includeManaged: false })
+    expect(filtered.map((e) => e.id)).toEqual(['dep'])
+    // Default (unset) keeps machinery rows — the swimlane's child lanes need them.
+    expect(applyClientFilters(mixed, {})).toHaveLength(4)
+  })
+})
+
+describe('localOverviewFromEvents', () => {
+  it('buckets by the hour, floors availableFromMs, and tallies by type', () => {
+    const h0 = Date.parse('2024-01-01T00:10:00.000Z')
+    const h0b = Date.parse('2024-01-01T00:50:00.000Z')
+    const h1 = Date.parse('2024-01-01T01:05:00.000Z')
+    const res = localOverviewFromEvents([
+      ev({ id: 'a', eventType: 'add', timestamp: new Date(h0).toISOString() }),
+      ev({ id: 'b', eventType: 'update', timestamp: new Date(h0b).toISOString() }),
+      ev({ id: 'c', eventType: 'delete', timestamp: new Date(h1).toISOString(), namespace: 'other' }),
+    ])
+    expect(res.buckets).toHaveLength(2)
+    expect(res.availableFromMs).toBe(h0)
+    const [b0, b1] = res.buckets
+    expect(b0.startMs).toBe(Date.parse('2024-01-01T00:00:00.000Z'))
+    expect(b0.summary.total).toBe(2)
+    expect(b0.summary.adds).toBe(1)
+    expect(b0.summary.updates).toBe(1)
+    expect(b0.summary.namespaces).toEqual(['default'])
+    expect(b1.summary.deletes).toBe(1)
+  })
+
+  it('marks a bucket unhealthy when it holds a Warning event', () => {
+    const res = localOverviewFromEvents([
+      ev({ id: 'w', eventType: 'Warning', source: 'k8s_event', timestamp: new Date(T0 + 60_000).toISOString() }),
+    ])
+    expect(res.buckets[0].summary.warnings).toBe(1)
+    expect(res.buckets[0].summary.worstHealth).toBe('unhealthy')
+  })
+
+  it('rebuckets finer with a custom bucketSizeMs', () => {
+    const FIVE_MIN = 5 * 60_000
+    const events = [
+      ev({ id: 'a', timestamp: new Date(T0).toISOString() }),
+      ev({ id: 'b', timestamp: new Date(T0 + 10 * 60_000).toISOString() }),
+    ]
+    // Same hour → one hourly bucket, but two distinct 5-minute buckets.
+    expect(localOverviewFromEvents(events).buckets).toHaveLength(1)
+    expect(localOverviewFromEvents(events, FIVE_MIN).buckets).toHaveLength(2)
+  })
+})
+
+describe('cross-package live-window invariant', () => {
+  it('quantization step stays under the live poll window so no fetch hole opens', () => {
+    expect(BASE_QUANTIZE_STEP_MS).toBeLessThan(LIVE_WINDOW_MS)
+  })
+})