@skyhook-io/radar-app 1.12.2 → 1.12.3

package/src/components/audit/AuditView.tsx

@@ -88,9 +88,14 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
 
   return (
     <div className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      {/* Tabs above the header: the header describes best practices only, so
+          tabs rendered below it read as part of that page rather than as the
+          switch between the two Checks surfaces. */}
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldCheck}
-        title="Checks"
+        title="Best practices"
         description="Security, reliability, and efficiency best practices (NSA/CISA, CIS, Polaris, Kubescape), grouped into a remediation queue."
         actions={
           <>
@@ -115,8 +120,6 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
         }
       />
 
-      <ChecksViewTabs />
-
       <ChecksView
         checks={data.groupedChecks ?? []}
         catalog={data.checks ?? {}}

package/src/components/audit/UpgradeReadinessView.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { ApiError } from '../../api/client'
-import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary } from './UpgradeReadinessView'
+import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary, upgradeEvidenceCoverageLabel, upgradeUnavailableKindsMessage } from './UpgradeReadinessView'
 
 describe('UpgradeReadinessError', () => {
   it('maps an unmatched endpoint 404 to the v1.9 upgrade message', () => {
@@ -40,7 +40,7 @@ describe('upgradeEvaluationSummary', () => {
       unknown: 1,
       notApplicable: 2,
       findings: 1,
-    })).toBe('18 evaluated · 16 applicable · 1 with partial evidence · 2 not applicable')
+    })).toBe('18 evaluated · 16 applicable · 1 with incomplete evidence · 2 not applicable')
   })
 
   it('does not imply incomplete coverage when every applicable check completed', () => {
@@ -68,6 +68,30 @@ describe('upgradeEvaluationSummary', () => {
   })
 })
 
+describe('upgradeUnavailableKindsMessage', () => {
+  it('does not guess why webhook evidence is unavailable', () => {
+    const message = upgradeUnavailableKindsMessage(['mutatingwebhookconfigurations', 'validatingwebhookconfigurations'])
+
+    expect(message).toContain('Affected checks are marked incomplete')
+    expect(message).not.toContain('rbac.viewWebhooks')
+    expect(message).not.toContain('grant')
+  })
+
+  it('does not suggest webhook access for unrelated evidence gaps', () => {
+    expect(upgradeUnavailableKindsMessage(['apiservices'])).not.toContain('rbac.viewWebhooks')
+  })
+})
+
+describe('upgradeEvidenceCoverageLabel', () => {
+  it('distinguishes absent evidence from partial evidence', () => {
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 0, caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 1, caveat: 'one object malformed' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'blocked', inspected: 1, caveat: 'some nodes unavailable' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'passed', inspected: 1 })).toBe('')
+  })
+})
+
 describe('groupFindings', () => {
   it('groups repeated remediation inside a check without merging distinct action levels', () => {
     const base = {

package/src/components/audit/UpgradeReadinessView.tsx

@@ -127,6 +127,8 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
 
   return (
     <div aria-busy={isFetching} className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldAlert}
         title="Upgrade impact"
@@ -162,8 +164,6 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         }
       />
 
-      <ChecksViewTabs />
-
       {showingPreviousTarget && (
         <CoverageNotice
           headline={`Analyzing Kubernetes ${requestedTarget}`}
@@ -202,7 +202,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
       {data.coverage.state !== 'no_access' && (data.coverage.unavailableKinds?.length ?? 0) > 0 && (
         <CoverageNotice
           headline="Some live resources were unavailable"
-          body={`Radar could not inspect: ${(data.coverage.unavailableKinds ?? []).join(', ')}. Affected checks are marked incomplete.`}
+          body={upgradeUnavailableKindsMessage(data.coverage.unavailableKinds ?? [])}
         />
       )}
       {data.coverage.state !== 'no_access' && scopedKinds.length > 0 && (
@@ -212,7 +212,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         />
       )}
       {data.coverage.state === 'partial' && !data.coverage.scopedNamespaces?.length && !data.coverage.unavailableKinds?.length && scopedKinds.length === 0 && (
-        <CoverageNotice headline="Some evidence is incomplete" body="Rows marked Partial evidence explain what Radar could not verify." />
+        <CoverageNotice headline="Some evidence is incomplete" body="Evidence labels on affected rows explain what Radar could not verify." />
       )}
       {data.coverage.state === 'no_access' ? (
         <section className="shrink-0">
@@ -291,8 +291,17 @@ export function incompleteUpgradeCheckCount(checks: Pick<UpgradeReadinessCheck,
 
 export function upgradeEvaluationSummary(total: number, summary: UpgradeReadinessResponse['summary'], incomplete = summary.unknown) {
   const applicable = Math.max(0, total - summary.notApplicable)
-  const partialEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with partial evidence` : ''
-  return `${total} evaluated · ${applicable} applicable${partialEvidenceLabel} · ${summary.notApplicable} not applicable`
+  const incompleteEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with incomplete evidence` : ''
+  return `${total} evaluated · ${applicable} applicable${incompleteEvidenceLabel} · ${summary.notApplicable} not applicable`
+}
+
+export function upgradeUnavailableKindsMessage(unavailableKinds: string[]) {
+  return `Radar could not inspect: ${unavailableKinds.join(', ')}. Affected checks are marked incomplete.`
+}
+
+export function upgradeEvidenceCoverageLabel(check: Pick<UpgradeReadinessCheck, 'status' | 'inspected' | 'caveat'>) {
+  if (!check.caveat) return ''
+  return check.status === 'unknown' && (check.inspected ?? 0) === 0 ? 'No evidence' : 'Partial evidence'
 }
 
 function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
@@ -323,7 +332,7 @@ function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
           </p>
           <p>
             Results use live cluster resources and the row-specific evidence scope shown below. {unavailable.length > 0
-              ? `Radar could not inspect ${unavailable.join(', ')}; affected checks are marked incomplete.`
+              ? upgradeUnavailableKindsMessage(unavailable)
               : scopedKinds.length > 0
                 ? `Cached evidence has per-kind namespace ceilings for ${formatScopedKinds(scopedKinds)}.`
               : data.coverage.state === 'complete'
@@ -433,6 +442,7 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
   const detailID = `upgrade-check-${check.id}`
   const findingGroups = groupFindings(check.findings)
   const label = evidenceLabel(check)
+  const coverageLabel = upgradeEvidenceCoverageLabel(check)
   const checkReferences = check.references ?? []
   return (
     <div>
@@ -456,10 +466,10 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
           <div className="min-w-0">
             <Badge severity={meta.badgeSeverity}>{meta.label}</Badge>
             {label && <div className="mt-1 text-[11px] text-theme-text-tertiary">{label}</div>}
-            {check.caveat && (
+            {coverageLabel && (
               <div className="mt-1 inline-flex items-center gap-1 text-[11px] font-medium text-amber-700 dark:text-amber-300">
                 <AlertTriangle className="h-3 w-3 shrink-0" />
-                Partial evidence
+                {coverageLabel}
               </div>
             )}
           </div>

package/src/components/diagnose/DiagnoseSurface.tsx

@@ -33,6 +33,7 @@ import { ConsentCard } from "./parts";
 import { buildLaunchCommand, launchAgentLabel, openInTerminal } from "./launch";
 import { type RunSummary, type ExecutionProfile } from "../../api/diagnose";
 import { routePath } from "../../api/config";
+import { useCapabilitiesContext } from "../../contexts/CapabilitiesContext";
 
 function capWord(s: string): string {
   return s ? s[0].toUpperCase() + s.slice(1) : s;
@@ -68,6 +69,7 @@ function buildConfigLine(cfg: {
 function InvestigationMenu({ run }: { run: RunSummary }) {
   const [open, setOpen] = useState(false);
   const [copied, setCopied] = useState(false);
+  const { localTerminal } = useCapabilitiesContext();
   const label = launchAgentLabel(run);
   const command = buildLaunchCommand(run, `${window.location.origin}${routePath('/mcp')}`);
   // No resumable session yet (or stale run) → nothing to hand off.
@@ -122,16 +124,18 @@ function InvestigationMenu({ run }: { run: RunSummary }) {
                 )}
               </span>
             </button>
-            <button
-              onClick={() => {
-                openInTerminal(command, "Diagnose");
-                setOpen(false);
-              }}
-              className="flex w-full items-center gap-2 px-3 py-1.5 text-left text-sm text-theme-text-primary hover:bg-theme-hover"
-            >
-              <TerminalSquare className="h-4 w-4 shrink-0 text-theme-text-tertiary" />
-              Run in a Radar terminal
-            </button>
+            {localTerminal && (
+              <button
+                onClick={() => {
+                  openInTerminal(command, "Diagnose");
+                  setOpen(false);
+                }}
+                className="flex w-full items-center gap-2 px-3 py-1.5 text-left text-sm text-theme-text-primary hover:bg-theme-hover"
+              >
+                <TerminalSquare className="h-4 w-4 shrink-0 text-theme-text-tertiary" />
+                Run in a Radar terminal
+              </button>
+            )}
           </div>
         </>
       )}

package/src/components/gitops/GitOpsView.tsx

@@ -23,7 +23,7 @@ import {
   isArgoSuspendedByRadar,
   gitOpsInsightChangeKey,
   initNavigationMap,
-  kindToPlural,
+  kindToPluralWithGroup,
   normalizeArgoApplication,
   normalizeFluxHelmRelease,
   normalizeFluxKustomization,
@@ -458,7 +458,7 @@ function GitOpsDetailView({ namespaces, onOpenResource, onOpenSettings }: GitOps
 
   function openResourceFromTree(ref: GitOpsTreeRef | GitOpsInsightRef) {
     if (isGitOpsDetailRef(ref) && isValidKubernetesName(ref.name)) {
-      const detailKind = kindToPlural(ref.kind)
+      const detailKind = kindToPluralWithGroup(ref.kind, ref.group ?? '')
       // The tree's root node is this page's own subject — clicking it must not
       // open a nested copy of the same detail page (which stacks an identical
       // "GitOps / X / X" breadcrumb, and again, ad infinitum). A self-reference
@@ -483,7 +483,12 @@ function GitOpsDetailView({ namespaces, onOpenResource, onOpenSettings }: GitOps
       navigate({ pathname: gitOpsDetailPath(detailKind, ref.namespace || '_', ref.name), search: params.toString() })
       return
     }
-    onOpenResource({ kind: kindToPlural(ref.kind), namespace: ref.namespace || '', name: ref.name, group: ref.group })
+    onOpenResource({
+      kind: kindToPluralWithGroup(ref.kind, ref.group ?? ''),
+      namespace: ref.namespace || '',
+      name: ref.name,
+      group: ref.group,
+    })
   }
 
   const isRunning = resourceQ.data?.status?.operationState?.phase === 'Running'

package/src/components/helm/HelmReleaseDrawer.tsx

@@ -15,7 +15,7 @@ import { ConfirmDialog } from '../ui/ConfirmDialog'
 import { Tooltip } from '../ui/Tooltip'
 import { Markdown } from '../ui/Markdown'
 import type { SelectedHelmRelease, HelmHook, ChartDependency, HelmOperation, HelmOperationInsight, HelmOwnedResource, HookDiagnostic, HookLogEvidence, UpgradeInfo, ValuesPreviewResponse } from '../../types'
-import { apiVersionToGroup, kindToPlural, type NavigateToResource } from '../../utils/navigation'
+import { apiVersionToGroup, kindToPluralWithGroup, type NavigateToResource } from '../../utils/navigation'
 import { formatDate } from './helm-utils'
 import { getHelmStatusColor, getKindBadgeColor, getResourceStatusColor, SEVERITY_BADGE, SEVERITY_TEXT } from '../../utils/badge-colors'
 import { useCanHelmAct, useCloudRole } from '../../api/client'
@@ -1245,11 +1245,12 @@ function PrimaryOperationResourceSignal({
   const resourceTooltip = `Open ${resource.kind} ${resourceTarget}`
   const showInlineReady = Boolean(resource.ready && !resource.summary)
   const openResource = () => {
+    const group = apiVersionToGroup(resource.apiVersion)
     onNavigateToResource?.({
-      kind: kindToPlural(resource.kind),
+      kind: kindToPluralWithGroup(resource.kind, group),
       namespace: resource.namespace,
       name: resource.name,
-      group: apiVersionToGroup(resource.apiVersion),
+      group,
     })
   }
 

package/src/components/helm/OwnedResources.tsx

@@ -4,7 +4,7 @@ import { getResourceIcon } from '../../utils/resource-icons'
 import { clsx } from 'clsx'
 import type { HelmOwnedResource } from '../../types'
 import type { NavigateToResource } from '../../utils/navigation'
-import { kindToPlural, apiVersionToGroup } from '../../utils/navigation'
+import { kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
 import { getResourceStatusColor, SEVERITY_BADGE } from '../../utils/badge-colors'
 import { useQueryClient } from '@tanstack/react-query'
 import { useOpenTerminal, useOpenLogs } from '../dock'
@@ -207,7 +207,15 @@ function ResourceItem({ resource, onNavigate }: ResourceItemProps) {
 
   const handleClick = () => {
     if (onNavigate) {
-      onNavigate({ kind: kindToPlural(resource.kind), namespace: resource.namespace, name: resource.name, group: apiVersionToGroup(resource.apiVersion) })
+      onNavigate({
+        kind: kindToPluralWithGroup(
+          resource.kind,
+          apiVersionToGroup(resource.apiVersion),
+        ),
+        namespace: resource.namespace,
+        name: resource.name,
+        group: apiVersionToGroup(resource.apiVersion),
+      })
     }
   }
 

package/src/components/home/ClusterHealthCard.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { minorsBehind } from "./ClusterHealthCard";
+
+describe("minorsBehind", () => {
+  it("counts minors between plain versions", () => {
+    expect(minorsBehind("1.33", "1.37")).toBe(4);
+    expect(minorsBehind("1.36", "1.37")).toBe(1);
+  });
+
+  it("returns 0 when current matches or exceeds the catalog", () => {
+    expect(minorsBehind("1.37", "1.37")).toBe(0);
+    expect(minorsBehind("1.38", "1.37")).toBe(0);
+  });
+
+  it("handles distribution version suffixes", () => {
+    expect(minorsBehind("v1.33.6+k3s1", "1.37")).toBe(4);
+    expect(minorsBehind("1.31.5-gke.1023000", "1.37")).toBe(6);
+    expect(minorsBehind("v1.32.4-eks-abc123", "1.37")).toBe(5);
+  });
+
+  it("stays quiet on cross-major or unparseable input", () => {
+    expect(minorsBehind("2.0.0", "1.37")).toBe(0);
+    expect(minorsBehind("unknown", "1.37")).toBe(0);
+    expect(minorsBehind("", "1.37")).toBe(0);
+  });
+
+  it("stays quiet when the catalog version is missing", () => {
+    expect(minorsBehind("1.33", undefined)).toBe(0);
+    expect(minorsBehind("1.33", "")).toBe(0);
+  });
+});

package/src/components/home/ClusterHealthCard.tsx

@@ -13,6 +13,7 @@ import { MCPSetupDialog } from './MCPSetupDialog'
 import { assetUrl, pluralize, parseContextName } from '@skyhook-io/k8s-ui'
 import { Tooltip } from '../ui/Tooltip'
 import { routePath } from '../../api/config'
+import { parseMajorMinor } from '../../utils/version'
 import gkeIcon from '../../assets/platform-icons/google_kubernetes_engine.png'
 import eksIcon from '../../assets/platform-icons/aws_eks.png'
 import aksIcon from '../../assets/platform-icons/azure-aks.svg'
@@ -33,11 +34,14 @@ interface ClusterHealthCardProps {
   nodeVersionSkew: DashboardResponse['nodeVersionSkew']
   onNavigateToKind: (kind: string, group?: string) => void
   onNavigateToView: () => void
+  // Left unset in Cloud takeover mode, where /checks is owned by the host.
+  onNavigateToUpgradeImpact?: () => void
   onWarningEventsClick?: () => void
   onIssuesClick?: () => void
   // Freshness/refresh control for the dashboard poll — rendered under the
   // cluster metadata so the overview carries a freshness signal without a band.
   freshness?: ReactNode
+  radarVersion?: ReactNode
 }
 
 function getMetricsInstallHint(platform: string): string {
@@ -130,9 +134,11 @@ export function ClusterHealthCard({
   nodeVersionSkew,
   onNavigateToKind,
   onNavigateToView,
+  onNavigateToUpgradeImpact,
   onWarningEventsClick,
   onIssuesClick,
   freshness,
+  radarVersion,
 }: ClusterHealthCardProps) {
   void _topCRDs // Reserved for future CRD display
 
@@ -251,8 +257,13 @@ export function ClusterHealthCard({
                 </Tooltip>
               )}
               {cluster.version && (
-                <span>Kubernetes {cluster.version}</span>
+                <KubernetesVersionLine
+                  version={cluster.version}
+                  reviewedThrough={cluster.upgradeReviewedThrough}
+                  onNavigate={onNavigateToUpgradeImpact}
+                />
               )}
+              {radarVersion}
               <span><span className="font-mono">{counts.namespaces}</span> namespaces</span>
               {/* Show raw kubeconfig context as muted metadata only when
                   it differs from the headline AND we're in local mode
@@ -519,6 +530,54 @@ export function ClusterHealthCard({
   )
 }
 
+// How many minors the running version trails the newest one the upgrade-impact
+// catalog covers. Cross-major comparisons return 0 — better a missing hint than
+// a wrong count on an exotic version string.
+export function minorsBehind(current: string, reviewedThrough?: string): number {
+  const cur = parseMajorMinor(current)
+  const latest = reviewedThrough ? parseMajorMinor(reviewedThrough) : null
+  if (!cur || !latest || latest.major !== cur.major) return 0
+  return Math.max(0, latest.minor - cur.minor)
+}
+
+function KubernetesVersionLine({
+  version,
+  reviewedThrough,
+  onNavigate,
+}: {
+  version: string
+  reviewedThrough?: string
+  onNavigate?: () => void
+}) {
+  if (!onNavigate) {
+    return <span>Kubernetes {version}</span>
+  }
+
+  const behind = minorsBehind(version, reviewedThrough)
+
+  return (
+    <Tooltip
+      content={
+        behind > 0
+          ? `Radar's upgrade checks cover Kubernetes through ${reviewedThrough}. Click to assess the next minor upgrade.`
+          : 'Assess the next minor Kubernetes upgrade.'
+      }
+      wrapperClassName="w-fit"
+    >
+      <button
+        onClick={onNavigate}
+        className="group flex items-center gap-1 hover:text-theme-text-secondary transition-colors"
+      >
+        <span>Kubernetes {version}</span>
+        {behind > 0 && (
+          <span>· Upgrade impact</span>
+        )}
+        <ArrowRight className="w-3 h-3 opacity-0 group-hover:opacity-100 transition-opacity" />
+      </button>
+    </Tooltip>
+  )
+}
+
 function RestrictedRing({ label }: { label: string }) {
   const radius = 36
   const circumference = 2 * Math.PI * radius

package/src/components/home/HomeView.tsx

@@ -1,5 +1,5 @@
 import { useMemo, type ReactNode } from 'react'
-import { useDashboard, useDashboardCRDs, useDashboardHelm, useIssues, type IssuesResponse } from '../../api/client'
+import { useCloudConnectSelf, useDashboard, useDashboardCRDs, useDashboardHelm, useIssues, useVersionCheck, type IssuesResponse } from '../../api/client'
 import { useConnection } from '../../context/ConnectionContext'
 import type { ClusterLoadState } from '../../types/clusterLoadState'
 import type { ExtendedMainView, Topology, SelectedResource } from '../../types'
@@ -22,7 +22,8 @@ import {
   StatusDot,
   categoryLabel,
   groupLabel,
-  issueTiming,
+  issueFirstSeenTitle,
+  issueTimingForDisplay,
   subjectRef,
   type Issue,
 } from '@skyhook-io/k8s-ui'
@@ -30,6 +31,8 @@ import { formatCompactAge } from '@skyhook-io/k8s-ui/utils/format'
 import { ClusterHealthCard } from './ClusterHealthCard'
 import { AlertTriangle, CheckCircle, Loader2, Shield } from 'lucide-react'
 import { clsx } from 'clsx'
+import { getVersionUpdateStatus } from '../../utils/version'
+import { RadarVersionLine } from './RadarVersionLine'
 
 interface HomeViewProps {
   namespaces: string[]
@@ -45,14 +48,19 @@ interface HomeViewProps {
    * standalone OSS → the card drills into secrets as before.
    */
   onNavigateToCerts?: () => void
+  // Omitted when an embedded host owns /checks, leaving the version as plain text.
+  onNavigateToUpgradeImpact?: () => void
+  onNavigateToHelmRelease?: (namespace: string, release: string) => void
+  onNavigateToManagerPath?: (path: string) => void
 }
 
-export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNavigateToView, onNavigateToResourceKind, onNavigateToResource, onNavigateToCerts }: HomeViewProps) {
+export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNavigateToView, onNavigateToResourceKind, onNavigateToResource, onNavigateToCerts, onNavigateToUpgradeImpact, onNavigateToHelmRelease, onNavigateToManagerPath }: HomeViewProps) {
   // The card itself decides whether the cluster has a capacity story
   // (available, softened-denied, or karpenterless-with-managers/groups) and
   // returns null otherwise — the outer gate only excludes states with nothing
   // to fetch against.
-  const karpenterState = useCapabilitiesContext().karpenter?.state
+  const capabilities = useCapabilitiesContext()
+  const karpenterState = capabilities.karpenter?.state
   const capacityCardPossible =
     karpenterState === 'available' || karpenterState === 'denied' || karpenterState === 'not_detected'
   const { data, isLoading, error, dataUpdatedAt, refetch } = useDashboard(namespaces)
@@ -61,6 +69,12 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
   const issues = issuesData?.issues ?? []
   const issueCount = issuesData?.total_matched ?? issuesData?.total ?? issues.length
   const hasCriticalIssues = issues.some((issue) => issue.severity === 'critical')
+  const deploymentMode = capabilities.deployment?.mode ?? 'local'
+  const { data: versionInfo } = useVersionCheck()
+  const showHomeUpgrade = deploymentMode === 'in-cluster'
+    && !!versionInfo?.updateAvailable
+    && getVersionUpdateStatus(versionInfo.currentVersion, versionInfo.latestVersion).tier !== 'none'
+  const { data: installationManager, isLoading: installationManagerLoading } = useCloudConnectSelf(showHomeUpgrade)
 
   // SSE is cluster-wide on small/medium clusters; the picker only narrows the
   // dashboard summary, so re-apply the filter here or the legend disagrees.
@@ -124,6 +138,15 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
         )}
         {/* Row 1: Cluster Health Card (combined health + resource counts) */}
         <ClusterHealthCard
+          radarVersion={deploymentMode === 'in-cluster' && versionInfo ? (
+            <RadarVersionLine
+              version={versionInfo}
+              manager={installationManager}
+              managerLoading={installationManagerLoading}
+              onNavigateToHelmRelease={onNavigateToHelmRelease}
+              onNavigateToGitOps={onNavigateToManagerPath}
+            />
+          ) : undefined}
           freshness={
             <FreshnessControl
               mode="auto"
@@ -143,6 +166,7 @@ export function HomeView({ namespaces, topology, fallbackClusterLoadState, onNav
           nodeVersionSkew={data.nodeVersionSkew}
           onNavigateToKind={onNavigateToResourceKind}
           onNavigateToView={() => onNavigateToView('resources')}
+          onNavigateToUpgradeImpact={onNavigateToUpgradeImpact}
           onWarningEventsClick={() => onNavigateToView('timeline', { view: 'list', filter: 'warnings', time: 'all' })}
           onIssuesClick={() => onNavigateToView('issues')}
         />
@@ -383,8 +407,10 @@ function ProblemsPanel({
               <div className="divide-y divide-theme-border">
                 {issues.map((issue) => {
                   const ref = subjectRef(issue)
-                  const age = issue.first_seen ? formatCompactAge(issue.first_seen) : ''
-                  const timing = issueTiming(issue)
+                  const partialUnknown = issue.onset_coverage?.unknown ?? 0
+                  const partialOnset = Boolean(issue.first_seen && partialUnknown > 0)
+                  const age = issue.first_seen ? `${partialOnset ? '≥' : ''}${formatCompactAge(issue.first_seen)}` : ''
+                  const timing = issueTimingForDisplay(issue)
 
                   return (
                     <button
@@ -402,12 +428,11 @@ function ProblemsPanel({
                         <div className="flex items-center gap-1.5">
                           <span className="text-[10px] text-theme-text-tertiary bg-theme-elevated px-1 py-0.5 rounded">{issue.kind}</span>
                           <span className="text-xs text-theme-text-primary truncate font-medium">{issue.name}</span>
-                          {(age || timing || issue.onset_unknown) && (
+                          {(age || timing) && (
                             <span className="ml-auto flex shrink-0 items-center gap-1">
-                              {age && <span className="text-[10px] text-theme-text-tertiary tabular-nums">{age}</span>}
-                              {issue.onset_unknown && (
-                                <Tooltip content="Radar can confirm this issue is active, but current Kubernetes state does not reveal when it began." delay={100}>
-                                  <span className="text-[10px] text-theme-text-tertiary">Onset unknown</span>
+                              {age && (
+                                <Tooltip content={issueFirstSeenTitle(issue)} delay={100}>
+                                  <span className="text-[10px] text-theme-text-tertiary tabular-nums">{age}</span>
                                 </Tooltip>
                               )}
                               {timing && (

package/src/components/home/MCPSetupDialog.tsx

@@ -204,16 +204,17 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
               <a href="https://modelcontextprotocol.io" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">
                 Model Context Protocol
               </a>{' '}
-              (MCP) server that lets AI agents query your cluster through Radar.
+              (MCP) server that lets AI agents inspect, diagnose, and operate your cluster through Radar.
               Unlike raw kubectl access, Radar gives your AI pre-processed, enriched data —
               topology graphs, health assessments, deduplicated events, filtered logs — so it
               can understand your cluster state quickly without burning through context on
               verbose YAML output.
             </p>
             <p className="text-sm text-theme-text-secondary leading-relaxed">
-              Read tools are strictly read-only. Write tools (restart, scale, sync, apply,
-              node drain) are annotated as destructive so your AI client can flag them and
-              prompt before running.
+              Most read tools do not change cluster state. Live route diagnosis can create up
+              to five self-deleting probe pods when explicitly requested. Write tools (restart,
+              scale, sync, apply, node drain) are annotated as destructive so your AI client
+              can flag them and prompt before running.
             </p>
           </div>