@skyhook-io/radar-app 1.11.0 → 1.12.3

package/src/api/client.ts

@@ -11,6 +11,9 @@ import type {
   CapacityOverviewResponse,
   CapacityPoolDetailResponse,
   CapacityPoolListResponse,
+  SetWorkloadImagesResult,
+  WorkloadImageInventory,
+  WorkloadImageUpdate,
   YamlDocumentIdentity,
   YamlSchemaLoadResult,
 } from '@skyhook-io/k8s-ui'
@@ -52,8 +55,9 @@ import type {
   PodEnvironmentRevealResponse,
 } from '../types'
 import type { GitOpsOperationResponse } from '../types/gitops'
-import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath, stripBasename } from './config'
-import { pluralToKind } from '../utils/navigation'
+import { apiUrl, getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath, stripBasename } from './config'
+import { apiVersionToGroup, pluralToKind } from '../utils/navigation'
+import type { DeploymentMode } from '../types'
 
 // Auto-refresh cadences (ms) — named constants for each polled hook's
 // refetchInterval below, so the poll rate reads clearly at each call site.
@@ -292,6 +296,9 @@ export interface DashboardCluster {
   platform: string;
   version: string;
   connected: boolean;
+  // Newest Kubernetes minor the upgrade-impact catalog covers (e.g. "1.37").
+  // Static catalog fact — safe to compare against `version` without a scan.
+  upgradeReviewedThrough?: string;
 }
 
 export interface DashboardHealth {
@@ -481,6 +488,12 @@ export interface UpgradeReadinessResponse {
   currentVersion: string
   targetVersion: string
   reviewedThrough: string
+  // When the underlying scan ran. The server memoizes scans (~60s), so a
+  // response can be older than the fetch that returned it — surface this,
+  // not dataUpdatedAt, as the scan time.
+  observedAt: string
+  scanId: string
+  fromCache?: boolean
   verdict: UpgradeReadinessVerdict
   summary: { blocked: number; warnings: number; reviews: number; passed: number; unknown: number; notApplicable: number; findings: number }
   checks: UpgradeReadinessCheck[]
@@ -590,15 +603,28 @@ export function useAudit(namespaces: string[] = []) {
 }
 
 export function useUpgradeReadiness(target?: string) {
-  const params = new URLSearchParams()
-  if (target) params.set('target', target)
-  const query = params.toString()
-  return useQuery<UpgradeReadinessResponse>({
+  // The server memoizes scans per caller (~60s). Ordinary and background
+  // refetches read that memo; only the explicit manual refresh passes
+  // refresh=true to force a fresh live scan (e.g. after fixing a finding).
+  const forceRefresh = useRef(false)
+  const query = useQuery<UpgradeReadinessResponse>({
     queryKey: ['upgrade-readiness', target ?? 'next'],
-    queryFn: ({ signal }) => fetchJSON(`/upgrade-readiness${query ? `?${query}` : ''}`, signal),
+    queryFn: ({ signal }) => {
+      const params = new URLSearchParams()
+      if (target) params.set('target', target)
+      if (forceRefresh.current) params.set('refresh', 'true')
+      forceRefresh.current = false
+      const qs = params.toString()
+      return fetchJSON(`/upgrade-readiness${qs ? `?${qs}` : ''}`, signal)
+    },
     staleTime: 30000,
     placeholderData: (previous) => previous,
   })
+  const refreshScan = () => {
+    forceRefresh.current = true
+    return query.refetch()
+  }
+  return { ...query, refreshScan }
 }
 
 // Live cluster Issues — the grouped triage queue (radar's /api/issues =
@@ -937,6 +963,7 @@ export interface OpenCostWorkloadCost {
 export interface OpenCostWorkloadResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   namespace: string;
   workloads: OpenCostWorkloadCost[];
 }
@@ -964,6 +991,7 @@ export function useOpenCostWorkloads(
 export interface OpenCostWorkloadDetailResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   namespace: string;
   kind: string;
   name: string;
@@ -1008,6 +1036,7 @@ export interface OpenCostTrendSeries {
 export interface OpenCostTrendResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   range: string;
   series?: OpenCostTrendSeries[];
 }
@@ -1029,6 +1058,7 @@ export function useOpenCostTrend(range_: CostTimeRange = "24h") {
 export interface OpenCostWorkloadTrendResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   namespace: string;
   kind: string;
   name: string;
@@ -1101,6 +1131,7 @@ export interface OpenCostApplicationWorkloadCost extends OpenCostApplicationWork
 export interface OpenCostApplicationCostResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   partial?: boolean;
   totals: OpenCostApplicationCostTotals;
   coverage: OpenCostApplicationCostCoverage;
@@ -1115,6 +1146,7 @@ export interface OpenCostApplicationCostTrendSeries extends OpenCostApplicationW
 export interface OpenCostApplicationCostTrendResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   range: string;
   partial?: boolean;
   windowTotalCost?: number;
@@ -1206,6 +1238,7 @@ export interface OpenCostNodeCost {
 export interface OpenCostNodeResponse {
   available: boolean;
   reason?: CostUnavailableReason;
+  currency?: string;
   nodes?: OpenCostNodeCost[];
 }
 
@@ -1484,13 +1517,68 @@ export interface VersionInfo {
   error?: string;
 }
 
+const UPDATE_CHECK_STORAGE_KEY_PREFIX = 'radar-update-check';
+
+export function utcDay(now: Date): string {
+  return now.toISOString().slice(0, 10)
+}
+
+export function markDailyUpdateCheckAttempt(
+  storage: Pick<Storage, 'getItem' | 'setItem'>,
+  apiBase: string,
+  now: Date,
+): boolean {
+  const storageKey = `${UPDATE_CHECK_STORAGE_KEY_PREFIX}:${apiBase}`
+  const day = utcDay(now)
+  try {
+    if (storage.getItem(storageKey) === day) return false
+
+    storage.setItem(storageKey, day)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function markUpdateCheckAttempt(): boolean {
+  try {
+    return markDailyUpdateCheckAttempt(localStorage, getApiBase(), new Date())
+  } catch {
+    return false
+  }
+}
+
+export async function triggerDailyUpdateCheck(
+  deploymentMode: DeploymentMode | undefined,
+): Promise<void> {
+  if (deploymentMode !== 'in-cluster' || !markUpdateCheckAttempt()) return
+  await fetch(apiUrl('/version-check/browser'), {
+    method: 'POST',
+    headers: getAuthHeaders(),
+    credentials: getCredentialsMode(),
+    keepalive: true,
+  })
+}
+
 export function useVersionCheck() {
-  return useQuery<VersionInfo>({
-    queryKey: ["version-check"],
-    queryFn: () => fetchJSON("/version-check"),
+  const capabilities = useCapabilities()
+  const apiBase = getApiBase()
+  const deploymentMode = capabilities.data
+    ? (capabilities.data.deployment?.mode ?? 'local')
+    : undefined
+
+  const query = useQuery<VersionInfo>({
+    queryKey: ["version-check", apiBase],
+    queryFn: () => fetchJSON('/version-check'),
     staleTime: 60 * 60 * 1000, // 1 hour
     retry: false, // Don't retry on failure
   });
+
+  useEffect(() => {
+    if (query.isSuccess) void triggerDailyUpdateCheck(deploymentMode).catch(() => {})
+  }, [apiBase, deploymentMode, query.isSuccess])
+
+  return query;
 }
 
 // ============================================================================
@@ -1763,6 +1851,11 @@ export const cloudInstallActive = (state: CloudInstallState | undefined): boolea
 export interface CloudConnectInfo {
   assurances?: string[]
   notice?: string
+  // Free-tier terms as a prose fragment completing "Radar Cloud is ___."
+  // (e.g. "free for 3 clusters"). Separate from assurances: chip copy and
+  // sentence copy have different grammar, and reusing one as the other breaks
+  // whenever either is reworded.
+  freeTier?: string
 }
 
 // Deliberately a bare cross-origin GET: no credentials, no identifiers, no
@@ -1810,6 +1903,12 @@ export interface CloudConnectSelf {
   deploymentName?: string
   chart?: string
   controller?: string
+  controllerRef?: {
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+  }
   wizardUrl?: string
 }
 
@@ -2193,25 +2292,32 @@ export function useArgoRevisionMetadata(
 
 // Generic resource fetching - returns resource with relationships
 // Uses '_' as placeholder for cluster-scoped resources (empty namespace)
-export function useResource<T>(
+export function fetchResourceWithRelationships<T>(
   kind: string,
   namespace: string,
   name: string,
   group?: string,
-  options?: { enabled?: boolean; refetchInterval?: number | false },
-) {
-  // For cluster-scoped resources, use '_' as namespace placeholder
+): Promise<ResourceWithRelationships<T>> {
   const ns = namespace || "_";
   const params = new URLSearchParams();
   if (group) params.set("group", group);
   const queryString = params.toString();
 
+  return fetchJSON(
+    `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
+  );
+}
+
+export function useResource<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  options?: { enabled?: boolean; refetchInterval?: number | false },
+) {
   const query = useQuery<ResourceWithRelationships<T>>({
     queryKey: ["resource", kind, namespace, name, group],
-    queryFn: () =>
-      fetchJSON(
-        `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
-      ),
+    queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
     refetchInterval: options?.refetchInterval,
   });
@@ -2233,17 +2339,9 @@ export function useResourceWithRelationships<T>(
   name: string,
   group?: string,
 ) {
-  const ns = namespace || "_";
-  const params = new URLSearchParams();
-  if (group) params.set("group", group);
-  const queryString = params.toString();
-
   return useQuery<ResourceWithRelationships<T>>({
     queryKey: ["resource", kind, namespace, name, group],
-    queryFn: () =>
-      fetchJSON(
-        `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
-      ),
+    queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: Boolean(kind && name),
   });
 }
@@ -3104,6 +3202,7 @@ export interface ArgoStatus {
   configured: boolean;
   connected: boolean;
   address?: string;
+  reason?: string;
 }
 
 export function useArgoStatus(enabled = true) {
@@ -3611,6 +3710,7 @@ export function useUpdateResource() {
         queryKey: ["resources", variables.kind],
       });
       queryClient.invalidateQueries({ queryKey: ["topology"] });
+      queryClient.invalidateQueries({ queryKey: ["applications"] });
     },
   });
 }
@@ -3932,6 +4032,7 @@ export interface ApplyResourceResult {
   name: string;
   namespace: string;
   kind: string;
+  apiVersion: string;
   created: boolean;
 }
 
@@ -4319,6 +4420,90 @@ export function useRestartWorkload() {
   });
 }
 
+export function fetchWorkloadImages(
+  kind: string,
+  namespace: string,
+  name: string,
+): Promise<WorkloadImageInventory> {
+  return fetchJSON(`/workloads/${kind}/${namespace}/${name}/images`);
+}
+
+export function setWorkloadImages(params: {
+  kind: string;
+  namespace: string;
+  name: string;
+  updates: WorkloadImageUpdate[];
+}): Promise<SetWorkloadImagesResult> {
+  return fetchJSON<SetWorkloadImagesResult>(
+    `/workloads/${params.kind}/${params.namespace}/${params.name}/images`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ updates: params.updates }),
+    },
+  );
+}
+
+export function useSetWorkloadImages() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (params: {
+      kind: string;
+      namespace: string;
+      name: string;
+      updates: WorkloadImageUpdate[];
+    }) => setWorkloadImages(params),
+    meta: {
+      successMessage: "Container images updated",
+    },
+    onSuccess: async (result, variables) => {
+      await queryClient.cancelQueries({
+        queryKey: ["resource", result.target.resource, result.target.namespace, result.target.name],
+      });
+      queryClient.setQueriesData<ResourceWithRelationships<Record<string, unknown>>>(
+        {
+          predicate: (query) => {
+            const [scope, resource, namespace, name, group] = query.queryKey;
+            return scope === "resource" &&
+              resource === result.target.resource &&
+              namespace === result.target.namespace &&
+              name === result.target.name &&
+              (group === result.target.group || group === undefined || group === "");
+          },
+        },
+        (current) => {
+          if (!current) return current;
+          const apiVersion = current.resource.apiVersion;
+          if (typeof apiVersion !== "string" || apiVersionToGroup(apiVersion) !== result.target.group) {
+            return current;
+          }
+          return { ...current, resource: result.object };
+        },
+      );
+      if (result.target.resource !== variables.kind || result.target.name !== variables.name) {
+        queryClient.invalidateQueries({
+          queryKey: ["resource", variables.kind, variables.namespace, variables.name],
+        });
+      }
+      queryClient.invalidateQueries({ queryKey: ["resources", variables.kind] });
+      if (result.target.resource !== variables.kind) {
+        queryClient.invalidateQueries({ queryKey: ["resources", result.target.resource] });
+      }
+      queryClient.invalidateQueries({ queryKey: ["applications"] });
+      queryClient.invalidateQueries({
+        queryKey: [
+          "workload-revisions",
+          variables.kind,
+          variables.namespace,
+          variables.name,
+        ],
+      });
+      queryClient.invalidateQueries({ queryKey: ["topology"] });
+    },
+  });
+}
+
 // Scale a workload (Deployment, StatefulSet)
 export function useScaleWorkload() {
   const queryClient = useQueryClient();
@@ -4482,6 +4667,7 @@ export interface RolloutCapabilities {
   skipStep: boolean;
   rollback: boolean;
   restart: boolean;
+  setImage?: boolean;
   strategy: string;
   terminating: boolean;
 }
@@ -4498,33 +4684,35 @@ export function useRolloutCapabilities(
   });
 }
 
+// Fallbacks only. The server reports what it actually did — including when it found
+// nothing to do — so its message is preferred over anything asserted here.
 const ROLLOUT_ACTION_MESSAGES: Record<
   RolloutAction,
   { errorMessage: string; successMessage: string }
 > = {
   abort: {
     errorMessage: "Failed to abort rollout",
-    successMessage: "Rollout aborted — traffic reverted to the stable version",
+    successMessage: "Abort sent",
   },
   retry: {
     errorMessage: "Failed to retry rollout",
-    successMessage: "Rollout retried",
+    successMessage: "Retry sent",
   },
   promote: {
     errorMessage: "Failed to promote rollout",
-    successMessage: "Rollout promoted",
+    successMessage: "Promote sent",
   },
   "promote-full": {
     errorMessage: "Failed to promote rollout",
-    successMessage: "Rollout promoted to full — remaining steps skipped",
+    successMessage: "Promote full sent",
   },
   "skip-step": {
     errorMessage: "Failed to skip step",
-    successMessage: "Skipped to the next step",
+    successMessage: "Skip step sent",
   },
 };
 
-export function useRolloutAction() {
+export function useRolloutAction(options?: { reportErrors?: boolean }) {
   const queryClient = useQueryClient();
   return useMutation({
     mutationFn: async ({
@@ -4544,14 +4732,26 @@ export function useRolloutAction() {
         const error = await response
           .json()
           .catch(() => ({ error: "Unknown error" }));
-        throw new Error(error.error || `HTTP ${response.status}`);
+        // The code, not the status, says whether retrying can help: a lost cluster
+        // connection answers 503 on this route too.
+        throw new ApiError(
+          error.error || `HTTP ${response.status}`,
+          response.status,
+          error,
+        );
       }
       return response.json();
     },
-    // meta is static, so per-action success wording goes through onSuccess.
-    meta: { errorMessage: "Rollout action failed" },
-    onSuccess: (_, variables) => {
-      showApiSuccess(ROLLOUT_ACTION_MESSAGES[variables.action].successMessage);
+    // meta is static, so per-action success wording goes through onSuccess. Callers that
+    // render the failure themselves opt out, so the toast handler stays silent.
+    meta:
+      options?.reportErrors === false
+        ? undefined
+        : { errorMessage: "Rollout action failed" },
+    onSuccess: (data, variables) => {
+      showApiSuccess(
+        data?.message || ROLLOUT_ACTION_MESSAGES[variables.action].successMessage,
+      );
       queryClient.invalidateQueries({ queryKey: ["resources", "rollouts"] });
       queryClient.invalidateQueries({
         queryKey: ["resource", "rollouts", variables.namespace, variables.name],
@@ -5939,6 +6139,8 @@ export interface NamespaceScope {
    */
   mode: "cluster-wide" | "namespace" | "restricted";
   accessibleNamespaces: string[];
+  /** Namespaces where Radar cannot list pods or deployments. */
+  deniedNamespaces: string[];
   /** false when accessibleNamespaces is a best-effort short list (no list perm). */
   authoritative: boolean;
   /** false when clearing would leave no usable namespace fallback. */
@@ -6405,10 +6607,13 @@ export interface DiagnosticsSnapshot {
     errorType?: string;
   };
   kubeconfig?: {
-    mode: "" | "in-cluster" | "single" | "multi-env" | "multi-dir";
+    mode: "" | "in-cluster" | "single" | "multi-env" | "multi-dir" | "multi-source";
     fileCount: number;
+    directoryFileCount: number;
     contextCount: number;
     enrichedFromShell: boolean;
+    kubeconfigEnvIgnored: boolean;
+    kubeconfigEnvIgnoredReason: string;
     currentContextUsesExec: boolean;
     execPluginsPresent?: string[];
     execPluginsMissing?: string[];

package/src/api/client.yaml.test.ts

@@ -10,8 +10,8 @@ describe('formatApplyResourceError', () => {
           failedIndex: 2,
           total: 4,
           results: [
-            { kind: 'Namespace', namespace: '', name: 'checkout', created: true },
-            { kind: 'Deployment', namespace: 'checkout', name: 'api', created: true },
+            { apiVersion: 'v1', kind: 'Namespace', namespace: '', name: 'checkout', created: true },
+            { apiVersion: 'apps/v1', kind: 'Deployment', namespace: 'checkout', name: 'api', created: true },
           ],
         },
         422,
@@ -26,7 +26,7 @@ describe('formatApplyResourceError', () => {
   })
 
   it('preserves structured partial-apply results for recovery', () => {
-    const result = { kind: 'Namespace', namespace: '', name: 'checkout', created: true }
+    const result = { apiVersion: 'v1', kind: 'Namespace', namespace: '', name: 'checkout', created: true }
     const error = new ApplyResourceError(
       {
         error: 'document 2: admission denied',

package/src/api/version-check.test.ts

@@ -0,0 +1,78 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { markDailyUpdateCheckAttempt, triggerDailyUpdateCheck, utcDay } from './client'
+
+function memoryStorage() {
+  const values = new Map<string, string>()
+  return {
+    getItem: (key: string) => values.get(key) ?? null,
+    setItem: (key: string, value: string) => values.set(key, value),
+  }
+}
+
+describe('daily update checks', () => {
+  it('uses UTC days', () => {
+    expect(utcDay(new Date('2026-08-29T23:59:59-07:00'))).toBe('2026-08-30')
+  })
+
+  it('attempts once per API base and UTC day', () => {
+    const storage = memoryStorage()
+    expect(markDailyUpdateCheckAttempt(storage, '/api', new Date('2026-08-29T10:00:00Z'))).toBe(true)
+    expect(markDailyUpdateCheckAttempt(storage, '/api', new Date('2026-08-29T20:00:00Z'))).toBe(false)
+    expect(markDailyUpdateCheckAttempt(storage, '/api', new Date('2026-08-30T10:00:00Z'))).toBe(true)
+    expect(markDailyUpdateCheckAttempt(storage, '/c/cluster-a/api', new Date('2026-08-30T10:00:00Z'))).toBe(true)
+  })
+
+  it('skips the attempt when storage is unavailable', () => {
+    const storage = {
+      getItem: () => null,
+      setItem: () => { throw new Error('blocked') },
+    }
+    expect(markDailyUpdateCheckAttempt(storage, '/api', new Date('2026-08-29T10:00:00Z'))).toBe(false)
+  })
+})
+
+describe('triggerDailyUpdateCheck', () => {
+  beforeEach(() => {
+    const values = new Map<string, string>()
+    vi.stubGlobal('localStorage', {
+      getItem: (key: string) => values.get(key) ?? null,
+      setItem: (key: string, value: string) => values.set(key, value),
+    })
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it.each(['local', 'cloud', undefined] as const)('does not report in %s mode', async (mode) => {
+    const fetch = vi.fn<typeof globalThis.fetch>(async () => new Response(null, { status: 204 }))
+    vi.stubGlobal('fetch', fetch)
+    await triggerDailyUpdateCheck(mode)
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('sends one bodyless in-cluster attempt per day', async () => {
+    const fetch = vi.fn<typeof globalThis.fetch>(async () => new Response(null, { status: 204 }))
+    vi.stubGlobal('fetch', fetch)
+
+    await triggerDailyUpdateCheck('in-cluster')
+    await triggerDailyUpdateCheck('in-cluster')
+
+    expect(fetch).toHaveBeenCalledOnce()
+    expect(fetch).toHaveBeenCalledWith('/api/version-check/browser', expect.objectContaining({
+      method: 'POST',
+      credentials: 'same-origin',
+      keepalive: true,
+    }))
+    expect(fetch.mock.calls[0][1]).not.toHaveProperty('body')
+  })
+
+  it('does not retry a failed daily attempt', async () => {
+    const fetch = vi.fn<typeof globalThis.fetch>(async () => { throw new Error('offline') })
+    vi.stubGlobal('fetch', fetch)
+
+    await expect(triggerDailyUpdateCheck('in-cluster')).rejects.toThrow('offline')
+    await triggerDailyUpdateCheck('in-cluster')
+    expect(fetch).toHaveBeenCalledOnce()
+  })
+})