@skyhook-io/radar-app 1.11.0 → 1.12.3

package/src/components/home/CostCard.tsx

@@ -1,7 +1,8 @@
 import type { OpenCostSummary } from '../../api/client'
 import { useOpenCostSummary } from '../../api/client'
-import { DollarSign } from 'lucide-react'
+import { Coins } from 'lucide-react'
 import {
+  DEFAULT_COST_CURRENCY,
   formatCostPerHour,
   formatProjectedDailyRate,
   formatProjectedMonthlyCost,
@@ -21,6 +22,7 @@ export function CostCard({ onNavigate }: { onNavigate?: () => void }) {
 
 function CostCardContent({ data, onNavigate }: { data: OpenCostSummary; onNavigate?: () => void }) {
   const hourlyCost = data.totalHourlyCost ?? 0
+  const currency = data.currency ?? DEFAULT_COST_CURRENCY
   const namespaces = data.namespaces ?? []
   const topNamespaces = namespaces.slice(0, 5)
 
@@ -35,7 +37,7 @@ function CostCardContent({ data, onNavigate }: { data: OpenCostSummary; onNaviga
       <div className="flex flex-col h-full w-full">
         <div className="flex items-center justify-between px-5 py-3 border-b border-theme-border/50">
           <div className="flex items-center gap-2">
-            <DollarSign className="w-4 h-4 text-accent-text" />
+            <Coins className="w-4 h-4 text-accent-text" />
             <span className="text-xs font-semibold uppercase tracking-wider text-accent-text">Cost Insights</span>
             {namespaces.length > 0 && (
               <span className="badge-sm border border-theme-border bg-accent-muted text-accent-text">
@@ -50,14 +52,14 @@ function CostCardContent({ data, onNavigate }: { data: OpenCostSummary; onNaviga
           <div className="flex items-baseline gap-3 mb-3">
             <div className="flex items-baseline gap-1">
               <span className="text-2xl font-bold text-theme-text-primary tabular-nums">
-                {formatProjectedMonthlyCost(hourlyCost)}
+                {formatProjectedMonthlyCost(hourlyCost, currency)}
               </span>
               <span className="text-xs text-theme-text-tertiary">/mo</span>
             </div>
             <div className="flex items-baseline gap-1.5 text-theme-text-secondary">
-              <span className="text-xs font-medium tabular-nums">{formatProjectedDailyRate(hourlyCost)}</span>
+              <span className="text-xs font-medium tabular-nums">{formatProjectedDailyRate(hourlyCost, currency)}</span>
               <span className="text-[10px] text-theme-text-quaternary">·</span>
-              <span className="text-xs font-medium tabular-nums">{formatCostPerHour(hourlyCost)}</span>
+              <span className="text-xs font-medium tabular-nums">{formatCostPerHour(hourlyCost, currency)}</span>
             </div>
           </div>
 
@@ -72,7 +74,7 @@ function CostCardContent({ data, onNavigate }: { data: OpenCostSummary; onNaviga
                     <div className="h-full rounded-full bg-indigo-500/60" style={{ width: `${Math.max(pct, 2)}%` }} />
                   </div>
                   <span className="text-[10px] text-theme-text-tertiary tabular-nums w-20 text-right shrink-0">
-                    {formatProjectedMonthlyRate(ns.hourlyCost)}
+                    {formatProjectedMonthlyRate(ns.hourlyCost, currency)}
                   </span>
                 </div>
               )
@@ -85,7 +87,10 @@ function CostCardContent({ data, onNavigate }: { data: OpenCostSummary; onNaviga
 
         <div className="px-4 py-1.5 border-t border-theme-border/50 flex items-center justify-between">
           <span className="text-[10px] text-theme-text-tertiary">
-            {data.currency ?? 'USD'} &middot; projected monthly from {data.window ?? '1h'} window
+            {currency} &middot; projected monthly from {data.window ?? '1h'} window
+            {currency !== DEFAULT_COST_CURRENCY && (
+              <> &middot; no conversion</>
+            )}
           </span>
           <span className="flex items-center gap-1.5 text-[10px] font-semibold uppercase tracking-wider text-accent-text">
             OpenCost

package/src/components/home/HomeView.tsx

@@ -1,5 +1,5 @@
 import { useMemo, type ReactNode } from 'react'
-import { useDashboard, useDashboardCRDs, useDashboardHelm, useIssues, type IssuesResponse } from '../../api/client'
+import { useCloudConnectSelf, useDashboard, useDashboardCRDs, useDashboardHelm, useIssues, useVersionCheck, type IssuesResponse } from '../../api/client'
 import { useConnection } from '../../context/ConnectionContext'
 import type { ClusterLoadState } from '../../types/clusterLoadState'
 import type { ExtendedMainView, Topology, SelectedResource } from '../../types'
@@ -22,7 +22,8 @@ import {
   StatusDot,
   categoryLabel,
   groupLabel,
-  issueTiming,
+  issueFirstSeenTitle,
+  issueTimingForDisplay,
   subjectRef,
   type Issue,
 } from '@skyhook-io/k8s-ui'
@@ -30,6 +31,8 @@ import { formatCompactAge } from '@skyhook-io/k8s-ui/utils/format'
 import { ClusterHealthCard } from './ClusterHealthCard'
 import { AlertTriangle, CheckCircle, Loader2, Shield } from 'lucide-react'
 import { clsx } from 'clsx'
+import { getVersionUpdateStatus } from '../../utils/version'
+import { RadarVersionLine } from './RadarVersionLine'
 
 interface HomeViewProps {
   namespaces: string[]
@@ -45,14 +48,19 @@ interface HomeViewProps {
    * standalone OSS → the card drills into secrets as before.
    */
   onNavigateToCerts?: () => void
+  // Omitted when an embedded host owns /checks, leaving the version as plain text.
+  onNavigateToUpgradeImpact?: () => void
+  onNavigateToHelmRelease?: (namespace: string, release: string) => void
+  onNavigateToManagerPath?: (path: string) => void
 }
 
-export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNavigateToView, onNavigateToResourceKind, onNavigateToResource, onNavigateToCerts }: HomeViewProps) {
+export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNavigateToView, onNavigateToResourceKind, onNavigateToResource, onNavigateToCerts, onNavigateToUpgradeImpact, onNavigateToHelmRelease, onNavigateToManagerPath }: HomeViewProps) {
   // The card itself decides whether the cluster has a capacity story
   // (available, softened-denied, or karpenterless-with-managers/groups) and
   // returns null otherwise — the outer gate only excludes states with nothing
   // to fetch against.
-  const karpenterState = useCapabilitiesContext().karpenter?.state
+  const capabilities = useCapabilitiesContext()
+  const karpenterState = capabilities.karpenter?.state
   const capacityCardPossible =
     karpenterState === 'available' || karpenterState === 'denied' || karpenterState === 'not_detected'
   const { data, isLoading, error, dataUpdatedAt, refetch } = useDashboard(namespaces)
@@ -61,6 +69,12 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
   const issues = issuesData?.issues ?? []
   const issueCount = issuesData?.total_matched ?? issuesData?.total ?? issues.length
   const hasCriticalIssues = issues.some((issue) => issue.severity === 'critical')
+  const deploymentMode = capabilities.deployment?.mode ?? 'local'
+  const { data: versionInfo } = useVersionCheck()
+  const showHomeUpgrade = deploymentMode === 'in-cluster'
+    && !!versionInfo?.updateAvailable
+    && getVersionUpdateStatus(versionInfo.currentVersion, versionInfo.latestVersion).tier !== 'none'
+  const { data: installationManager, isLoading: installationManagerLoading } = useCloudConnectSelf(showHomeUpgrade)
 
   // SSE is cluster-wide on small/medium clusters; the picker only narrows the
   // dashboard summary, so re-apply the filter here or the legend disagrees.
@@ -124,6 +138,15 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
         )}
         {/* Row 1: Cluster Health Card (combined health + resource counts) */}
         <ClusterHealthCard
+          radarVersion={deploymentMode === 'in-cluster' && versionInfo ? (
+            <RadarVersionLine
+              version={versionInfo}
+              manager={installationManager}
+              managerLoading={installationManagerLoading}
+              onNavigateToHelmRelease={onNavigateToHelmRelease}
+              onNavigateToGitOps={onNavigateToManagerPath}
+            />
+          ) : undefined}
           freshness={
             <FreshnessControl
               mode="auto"
@@ -143,6 +166,7 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
           nodeVersionSkew={data.nodeVersionSkew}
           onNavigateToKind={onNavigateToResourceKind}
           onNavigateToView={() => onNavigateToView('resources')}
+          onNavigateToUpgradeImpact={onNavigateToUpgradeImpact}
           onWarningEventsClick={() => onNavigateToView('timeline', { view: 'list', filter: 'warnings', time: 'all' })}
           onIssuesClick={() => onNavigateToView('issues')}
         />
@@ -383,8 +407,10 @@ function ProblemsPanel({
               <div className="divide-y divide-theme-border">
                 {issues.map((issue) => {
                   const ref = subjectRef(issue)
-                  const age = issue.first_seen ? formatCompactAge(issue.first_seen) : ''
-                  const timing = issueTiming(issue)
+                  const partialUnknown = issue.onset_coverage?.unknown ?? 0
+                  const partialOnset = Boolean(issue.first_seen && partialUnknown > 0)
+                  const age = issue.first_seen ? `${partialOnset ? '≥' : ''}${formatCompactAge(issue.first_seen)}` : ''
+                  const timing = issueTimingForDisplay(issue)
 
                   return (
                     <button
@@ -402,12 +428,11 @@ function ProblemsPanel({
                         <div className="flex items-center gap-1.5">
                           <span className="text-[10px] text-theme-text-tertiary bg-theme-elevated px-1 py-0.5 rounded">{issue.kind}</span>
                           <span className="text-xs text-theme-text-primary truncate font-medium">{issue.name}</span>
-                          {(age || timing || issue.onset_unknown) && (
+                          {(age || timing) && (
                             <span className="ml-auto flex shrink-0 items-center gap-1">
-                              {age && <span className="text-[10px] text-theme-text-tertiary tabular-nums">{age}</span>}
-                              {issue.onset_unknown && (
-                                <Tooltip content="Radar can confirm this issue is active, but current Kubernetes state does not reveal when it began." delay={100}>
-                                  <span className="text-[10px] text-theme-text-tertiary">Onset unknown</span>
+                              {age && (
+                                <Tooltip content={issueFirstSeenTitle(issue)} delay={100}>
+                                  <span className="text-[10px] text-theme-text-tertiary tabular-nums">{age}</span>
                                 </Tooltip>
                               )}
                               {timing && (

package/src/components/home/MCPSetupDialog.tsx

@@ -204,16 +204,17 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
               <a href="https://modelcontextprotocol.io" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">
                 Model Context Protocol
               </a>{' '}
-              (MCP) server that lets AI agents query your cluster through Radar.
+              (MCP) server that lets AI agents inspect, diagnose, and operate your cluster through Radar.
               Unlike raw kubectl access, Radar gives your AI pre-processed, enriched data —
               topology graphs, health assessments, deduplicated events, filtered logs — so it
               can understand your cluster state quickly without burning through context on
               verbose YAML output.
             </p>
             <p className="text-sm text-theme-text-secondary leading-relaxed">
-              Read tools are strictly read-only. Write tools (restart, scale, sync, apply,
-              node drain) are annotated as destructive so your AI client can flag them and
-              prompt before running.
+              Most read tools do not change cluster state. Live route diagnosis can create up
+              to five self-deleting probe pods when explicitly requested. Write tools (restart,
+              scale, sync, apply, node drain) are annotated as destructive so your AI client
+              can flag them and prompt before running.
             </p>
           </div>
 

package/src/components/home/RadarVersionLine.test.tsx

@@ -0,0 +1,145 @@
+import { renderToString } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+import type { VersionInfo } from '../../api/client'
+import { RadarVersionLine } from './RadarVersionLine'
+
+const version: VersionInfo = {
+  currentVersion: '1.2.3',
+  latestVersion: '1.3.0',
+  updateAvailable: true,
+  installMethod: 'direct',
+  releaseUrl: 'https://github.com/skyhook-io/radar/releases/tag/v1.3.0',
+}
+
+describe('RadarVersionLine', () => {
+  it('shows the running version without an upgrade affordance when up to date', () => {
+    const html = renderToString(
+      <RadarVersionLine version={{ ...version, latestVersion: '1.2.3', updateAvailable: false }} />,
+    )
+    expect(html).toContain('Radar')
+    expect(html).toContain('v1.2.3')
+    expect(html).not.toContain('available')
+  })
+
+  it('shows patch upgrades with the quiet treatment', () => {
+    const html = renderToString(
+      <RadarVersionLine version={{ ...version, latestVersion: '1.2.4' }} />,
+    )
+    expect(html).toContain('v1.2.3')
+    expect(html).toContain('v1.2.4')
+    expect(html).toContain('available')
+    expect(html).toContain('text-accent-text hover:text-accent')
+  })
+
+  it('makes minor upgrades more prominent', () => {
+    const html = renderToString(<RadarVersionLine version={version} />)
+    expect(html).toContain('font-medium text-accent hover:text-accent-light')
+    expect(html).not.toContain('minor releases behind')
+  })
+
+  it('uses warning emphasis and explains when an installation is three minor releases behind', () => {
+    const html = renderToString(
+      <RadarVersionLine version={{ ...version, currentVersion: '1.0.9', latestVersion: '1.3.0' }} />,
+    )
+    expect(html).toContain('font-medium text-warning-text hover:opacity-80')
+    expect(html).toContain('This installation is 3 minor releases behind')
+  })
+
+  it('uses warning emphasis for a major upgrade', () => {
+    const html = renderToString(
+      <RadarVersionLine version={{ ...version, currentVersion: '0.12.0', latestVersion: '1.3.0' }} />,
+    )
+    expect(html).toContain('font-medium text-warning-text hover:opacity-80')
+    expect(html).toContain('A major Radar upgrade is available')
+  })
+
+  it('does not claim manager discovery has failed while it is loading', () => {
+    const html = renderToString(<RadarVersionLine version={version} managerLoading />)
+    expect(html).toContain('v1.3.0')
+    expect(html).toContain('available')
+    expect(html).toContain('lucide-circle-arrow-up')
+    expect(html).toContain('Checking how this installation is managed')
+    expect(html).not.toContain('could not be confirmed')
+    expect(html).not.toContain('<a')
+    expect(html).not.toContain('<button')
+    expect(html).toContain('class="sr-only"')
+    expect(html).not.toContain('aria-label=')
+  })
+
+  it('opens actionable upgrade instructions when the installation manager is unknown', () => {
+    const html = renderToString(<RadarVersionLine version={version} />)
+    expect(html).toContain('https://radarhq.io/docs/configuration/in-cluster')
+    expect(html).not.toContain('#upgrading')
+    expect(html).toContain('Open the in-cluster upgrade instructions')
+    expect(html).not.toContain(version.releaseUrl)
+    expect(html).toContain('font-medium text-accent hover:text-accent-light')
+  })
+
+  it('keeps the visible upgrade label in the accessible name', () => {
+    const html = renderToString(<RadarVersionLine version={version} />)
+    expect(html).toContain('aria-label="v1.3.0 available —')
+  })
+
+  it('deep-links exact Helm ownership when the host supports it', () => {
+    const html = renderToString(
+      <RadarVersionLine
+        version={version}
+        manager={{ ownership: 'helm', namespace: 'radar-system', release: 'radar' }}
+        onNavigateToHelmRelease={() => {}}
+      />,
+    )
+    expect(html).toContain('Managed by Helm release radar-system/radar')
+    expect(html).toContain('Open the release to upgrade')
+  })
+
+  it('describes the docs fallback when a Helm navigation callback is unavailable', () => {
+    const html = renderToString(
+      <RadarVersionLine
+        version={version}
+        manager={{ ownership: 'helm', namespace: 'radar-system', release: 'radar' }}
+      />,
+    )
+    expect(html).toContain('https://radarhq.io/docs/configuration/in-cluster')
+    expect(html).toContain('Managed by Helm release radar-system/radar')
+    expect(html).toContain('Open the in-cluster upgrade instructions')
+    expect(html).not.toContain('Open the release to upgrade')
+  })
+
+  it('deep-links verified GitOps ownership', () => {
+    const controllerRef = { group: 'kustomize.toolkit.fluxcd.io', kind: 'Kustomization', namespace: 'flux-system', name: 'radar' }
+    const verified = renderToString(
+      <RadarVersionLine
+        version={version}
+        manager={{ ownership: 'gitops', controller: 'Kustomization flux-system/radar', controllerRef }}
+        onNavigateToGitOps={() => {}}
+      />,
+    )
+    expect(verified).toContain('Managed by Kustomization flux-system/radar')
+    expect(verified).toContain('Open it to upgrade through GitOps')
+
+    const suspected = renderToString(
+      <RadarVersionLine
+        version={version}
+        manager={{ ownership: 'gitops', controller: 'Kustomization flux-system/radar' }}
+        onNavigateToGitOps={() => {}}
+      />,
+    )
+    expect(suspected).toContain('appears to be managed through GitOps (Kustomization flux-system/radar)')
+    expect(suspected).toContain('Open the upgrade instructions')
+    expect(suspected).not.toContain('Managed by Kustomization')
+  })
+
+  it('describes the docs fallback when a GitOps navigation callback is unavailable', () => {
+    const controllerRef = { group: 'kustomize.toolkit.fluxcd.io', kind: 'Kustomization', namespace: 'flux-system', name: 'radar' }
+    const html = renderToString(
+      <RadarVersionLine
+        version={version}
+        manager={{ ownership: 'gitops', controller: 'Kustomization flux-system/radar', controllerRef }}
+      />,
+    )
+    expect(html).toContain('https://radarhq.io/docs/configuration/in-cluster')
+    expect(html).toContain('Managed by Kustomization flux-system/radar')
+    expect(html).toContain('Open the in-cluster upgrade instructions and apply the change through GitOps')
+    expect(html).not.toContain('Open it to upgrade through GitOps')
+  })
+})

package/src/components/home/RadarVersionLine.tsx

@@ -0,0 +1,137 @@
+import { ArrowUpCircle } from 'lucide-react'
+import { gitOpsRouteForResource } from '@skyhook-io/k8s-ui'
+import type { CloudConnectSelf, VersionInfo } from '../../api/client'
+import {
+  getVersionUpdateStatus,
+  IN_CLUSTER_UPGRADE_URL,
+  type VersionUpdateTier,
+} from '../../utils/version'
+import { Tooltip } from '../ui/Tooltip'
+
+interface RadarVersionLineProps {
+  version: VersionInfo
+  manager?: CloudConnectSelf
+  managerLoading?: boolean
+  onNavigateToHelmRelease?: (namespace: string, release: string) => void
+  onNavigateToGitOps?: (path: string) => void
+}
+
+function displayVersion(version: string): string {
+  return version === 'dev' || version.startsWith('v') ? version : `v${version}`
+}
+
+export function RadarVersionLine({
+  version,
+  manager,
+  managerLoading = false,
+  onNavigateToHelmRelease,
+  onNavigateToGitOps,
+}: RadarVersionLineProps) {
+  const latestVersion = version.latestVersion
+  const updateStatus = getVersionUpdateStatus(version.currentVersion, latestVersion)
+  const showUpgrade = version.updateAvailable && !!latestVersion && updateStatus.tier !== 'none'
+
+  if (!showUpgrade) {
+    return <span>Radar <span className="font-mono">{displayVersion(version.currentVersion)}</span></span>
+  }
+
+  const controller = manager?.controllerRef
+  const gitOpsPath = controller
+    ? gitOpsRouteForResource({
+        apiVersion: controller.group ? `${controller.group}/v1` : undefined,
+        kind: controller.kind,
+        metadata: { namespace: controller.namespace, name: controller.name },
+      })
+    : null
+
+  let detail = managerLoading
+    ? 'Checking how this installation is managed.'
+    : 'The installation manager could not be confirmed. Open the in-cluster upgrade instructions.'
+  let onClick: (() => void) | undefined
+  const actionClassName = `inline-flex items-center gap-1 transition-colors ${upgradeActionClassName(updateStatus.tier)}`
+
+  if (manager?.ownership === 'helm' && manager.namespace && manager.release) {
+    if (onNavigateToHelmRelease) {
+      detail = `Managed by Helm release ${manager.namespace}/${manager.release}. Open the release to upgrade.`
+      onClick = () => onNavigateToHelmRelease(manager.namespace!, manager.release!)
+    } else {
+      detail = `Managed by Helm release ${manager.namespace}/${manager.release}. Open the in-cluster upgrade instructions.`
+    }
+  } else if (controller && gitOpsPath) {
+    const objectName = `${controller.namespace ? `${controller.namespace}/` : ''}${controller.name}`
+    if (onNavigateToGitOps) {
+      detail = `Managed by ${controller.kind} ${objectName}. Open it to upgrade through GitOps.`
+      onClick = () => onNavigateToGitOps(gitOpsPath)
+    } else {
+      detail = `Managed by ${controller.kind} ${objectName}. Open the in-cluster upgrade instructions and apply the change through GitOps.`
+    }
+  } else if (manager?.ownership === 'gitops') {
+    detail = manager.controller
+      ? `This installation appears to be managed through GitOps (${manager.controller}). Open the upgrade instructions and apply the change through its source of truth.`
+      : 'This installation appears to be managed through GitOps. Open the upgrade instructions and apply the change through its source of truth.'
+  }
+
+  const ageDetail = updateAgeDetail(updateStatus)
+  const accessibleLabel = `${displayVersion(latestVersion)} available${ageDetail ? `. ${ageDetail}` : ''} — ${detail}`
+  const action = managerLoading ? (
+    <span className={actionClassName}>
+      <UpgradeLabel version={latestVersion} />
+      <span className="sr-only">{detail}</span>
+    </span>
+  ) : onClick ? (
+    <button
+      type="button"
+      className={actionClassName}
+      onClick={onClick}
+      aria-label={accessibleLabel}
+    >
+      <UpgradeLabel version={latestVersion} />
+    </button>
+  ) : (
+    <a
+      href={IN_CLUSTER_UPGRADE_URL}
+      target="_blank"
+      rel="noreferrer"
+      className={actionClassName}
+      aria-label={accessibleLabel}
+    >
+      <UpgradeLabel version={latestVersion} />
+    </a>
+  )
+
+  return (
+    <span className="inline-flex flex-wrap items-center gap-x-1">
+      <span>Radar <span className="font-mono">{displayVersion(version.currentVersion)}</span></span>
+      <span className="inline-flex items-center gap-1">
+        <span aria-hidden>·</span>
+        <Tooltip
+          content={accessibleLabel}
+          className="!whitespace-normal !max-w-sm"
+        >
+          {action}
+        </Tooltip>
+      </span>
+    </span>
+  )
+}
+
+function upgradeActionClassName(tier: VersionUpdateTier): string {
+  if (tier === 'patch') return 'text-accent-text hover:text-accent'
+  if (tier === 'minor') return 'font-medium text-accent hover:text-accent-light'
+  return 'font-medium text-warning-text hover:opacity-80'
+}
+
+function updateAgeDetail(status: ReturnType<typeof getVersionUpdateStatus>): string | undefined {
+  if (status.majorVersionBehind) return 'A major Radar upgrade is available.'
+  if (status.tier !== 'stale' || !status.minorVersionsBehind) return undefined
+  return `This installation is ${status.minorVersionsBehind} minor releases behind.`
+}
+
+function UpgradeLabel({ version }: { version: string }) {
+  return (
+    <>
+      <ArrowUpCircle className="h-3.5 w-3.5 shrink-0" aria-hidden />
+      <span><span className="font-mono">{displayVersion(version)}</span> available</span>
+    </>
+  )
+}

package/src/components/home/mcpToolCatalog.ts

@@ -147,6 +147,18 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
       { arg: 'limit', desc: 'max findings (default 30, max 100)' },
     ],
   },
+  {
+    name: 'get_cluster_upgrade_readiness',
+    desc: 'Upgrade impact analysis for a target Kubernetes minor: the evidenced check catalog (version skew, removed/deprecated APIs, node runtime, drain feasibility, webhook readiness) with per-check coverage and caveats, expandable into findings with evidence and remediation. The first call runs a live scan; results are briefly cached per caller.',
+    params: [
+      { arg: 'target', desc: 'target Kubernetes minor (default: next minor above current)' },
+      { arg: 'check', desc: 'check id to expand into findings' },
+      { arg: 'level', desc: 'filter expanded findings: blocker, warning, or review' },
+      { arg: 'offset', desc: 'page through findings beyond the per-call cap' },
+      { arg: 'scan_id', desc: 'binds paging to one scan snapshot (required with offset)' },
+      { arg: 'refresh', desc: 'bypass the cached scan after changing something' },
+    ],
+  },
   {
     name: 'list_helm_releases',
     desc: 'All Helm releases with status, resource health, storage namespace, Flux ownership, current lastOperation, and capped operation trails for failed upgrades, rollbacks, or stuck pending operations.',

package/src/components/nav/PrimaryNavRail.tsx

@@ -10,7 +10,7 @@ import {
   GitBranch,
   Boxes,
   Activity,
-  DollarSign,
+  Coins,
   Gauge,
   ShieldCheck,
   Settings,
@@ -80,7 +80,7 @@ const NAV_ITEMS: NavItemDef[] = [
   { view: "gitops", icon: GitBranch, label: "GitOps" },
   { view: "checks", icon: ShieldCheck, label: "Checks" },
   { view: "capacity", icon: Gauge, label: "Capacity" },
-  { view: "cost", icon: DollarSign, label: "Cost" },
+  { view: "cost", icon: Coins, label: "Cost" },
 ];
 
 interface PrimaryNavRailProps {

package/src/components/resources/PodFilesystemModal.tsx

@@ -1,4 +1,4 @@
-import { useState, useRef, useEffect, useMemo, useCallback } from 'react'
+import { createElement, useState, useRef, useEffect, useMemo, useCallback } from 'react'
 import { createPortal } from 'react-dom'
 import { X, File, Link2, ChevronRight, AlertTriangle, Loader2, Search, Download, FolderOpen } from 'lucide-react'
 import { PaneLoader, Input } from '@skyhook-io/k8s-ui'
@@ -7,6 +7,9 @@ import type { FileNode } from '../../types'
 import { formatBytes } from '../../utils/format'
 import { downloadBlob, filterTree } from './file-browser-utils'
 import { apiUrl, getAuthHeaders, getCredentialsMode } from '../../api/config'
+import { isDesktopApp } from '../../utils/desktop-download'
+import { openFile, openFolder } from '../../utils/desktop-open-folder'
+import { useToast } from '../ui/Toast'
 import { Tooltip } from '../ui/Tooltip'
 
 interface PodFilesystem {
@@ -35,6 +38,36 @@ async function fetchPodFiles(
   return response.json()
 }
 
+/**
+ * Desktop only: has the backend write the pod file straight to disk. The browser
+ * route would hand the whole file to the webview only to have it hand every byte
+ * back to be saved, which is what puts a large file out of reach there.
+ * Returns the path it was saved to.
+ */
+async function savePodFileToDisk(
+  namespace: string,
+  podName: string,
+  container: string,
+  filePath: string,
+): Promise<string> {
+  const params = new URLSearchParams()
+  params.set('container', container)
+  params.set('path', filePath)
+
+  const response = await fetch(apiUrl(`/pods/${namespace}/${podName}/files/save?${params.toString()}`), {
+    method: 'POST',
+    credentials: getCredentialsMode(),
+    headers: getAuthHeaders(),
+  })
+  if (response.status === 204) throw new Error('cancelled')
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ error: 'Save failed' }))
+    throw new Error(error.error || `HTTP ${response.status}`)
+  }
+  const body = await response.json()
+  return body.path
+}
+
 interface PodFilesystemModalProps {
   open: boolean
   onClose: () => void
@@ -309,6 +342,7 @@ interface PodFileTreeNodeProps {
 
 function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: PodFileTreeNodeProps) {
   const [downloading, setDownloading] = useState(false)
+  const { showSuccess, showError } = useToast()
   const isDir = node.type === 'dir'
   const isSymlink = node.type === 'symlink'
   const isDownloadable = !isDir // files and symlinks can be downloaded
@@ -319,6 +353,21 @@ function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: Po
 
     setDownloading(true)
     try {
+      if (await isDesktopApp()) {
+        const savedPath = await savePodFileToDisk(namespace, podName, container, node.path)
+        showSuccess(
+          'File saved',
+          savedPath,
+          {
+            label: 'Show in Finder',
+            icon: createElement(FolderOpen, { className: 'w-3.5 h-3.5' }),
+            onClick: () => openFolder(savedPath),
+          },
+          () => openFile(savedPath),
+        )
+        return
+      }
+
       const params = new URLSearchParams()
       params.set('container', container)
       params.set('path', node.path)
@@ -335,7 +384,10 @@ function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: Po
       const blob = await response.blob()
       await downloadBlob(blob, node.name)
     } catch (err) {
-      console.error('Download failed:', err)
+      const message = err instanceof Error ? err.message : String(err)
+      if (message !== 'cancelled') {
+        showError(`Could not download ${node.name}`, message)
+      }
     } finally {
       setDownloading(false)
     }