@skyhook-io/radar-app 1.12.2 → 1.12.3

package/src/components/workload/WorkloadView.tsx

@@ -23,11 +23,17 @@ import {
   getGitOpsResourceStatus,
   isDiagnoseKind,
   isRolloutKind,
+  canSetWorkloadImages,
+  isCoreBatchJob,
+  type ManagedImageSource,
+  type WorkloadImageTarget,
 } from '@skyhook-io/k8s-ui'
 import type { ServicePortRenderProps } from '@skyhook-io/k8s-ui/components/resources/renderers/ServiceRenderer'
-import type { SelectedResource, ResourceRef, Relationships } from '../../types'
+import type { SelectedResource, ResourceRef, Relationships, ResourceWithRelationships } from '../../types'
 import {
   kindToPlural,
+  kindToPluralWithGroup,
+  apiVersionToGroup,
   pluralToKind,
   relatedResourcePath,
   buildWorkloadPath,
@@ -45,6 +51,9 @@ import {
   useSuspendCronJob,
   useResumeCronJob,
   useRestartWorkload,
+  fetchWorkloadImages,
+  fetchResourceWithRelationships,
+  useSetWorkloadImages,
   useWorkloadRevisions,
   useRollbackWorkload,
   useRolloutAction,
@@ -131,7 +140,6 @@ import { cleanYamlForDuplicate } from '../../utils/skeleton-yaml'
 import { useDesktopDownload } from '../../hooks/useDesktopDownload'
 import { useCompareLauncher } from '../compare/useCompareLauncher'
 import { useDiagnoseCustomization } from '../../context/DiagnoseCustomization'
-import { apiVersionToGroup } from '../../utils/navigation'
 
 type TabType = WorkloadTabType
 const BATCH_EXECUTION_KINDS = new Set([
@@ -277,6 +285,17 @@ interface WorkloadViewProps {
   pushTabHistory?: boolean
 }
 
+interface ImageTargetOwnershipContext {
+  root: {
+    resource: string
+    namespace: string
+    name: string
+  }
+  target: WorkloadImageTarget
+  response: ResourceWithRelationships<Record<string, unknown>>
+  inheritedResponse?: ResourceWithRelationships<Record<string, unknown>>
+}
+
 function useActionsBarProps(
   kind: string,
   namespace: string,
@@ -285,11 +304,13 @@ function useActionsBarProps(
   cascadeEnabled: boolean,
 ) {
   const { showCopied } = useToast()
+  const { features } = useCapabilitiesContext()
   const openTerminal = useOpenTerminal()
   const openLogs = useOpenLogs()
   const openWorkloadLogs = useOpenWorkloadLogs()
   const openNodeTerminal = useOpenNodeTerminal()
-  const { canExec, canViewLogs, canPortForward } = useNamespacedCapabilities(namespace)
+  const { canExec, canViewLogs, canPortForward, workloadWrites, workloadWritesPending } = useNamespacedCapabilities(namespace)
+  const queryClient = useQueryClient()
   // Live forward when local+RBAC; otherwise (in-cluster/Cloud) still surface the
   // copy-paste kubectl command. The button picks live vs. copy by deployment mode.
   const isLocal = useIsLocalDeployment()
@@ -297,20 +318,37 @@ function useActionsBarProps(
 
   const deleteMutation = useDeleteResource()
   const restartWorkloadMutation = useRestartWorkload()
+  const setWorkloadImagesMutation = useSetWorkloadImages()
   const rollbackMutation = useRollbackWorkload()
-  const rolloutActionMutation = useRolloutAction()
+  // Only the revision dialog drives this one, and it explains a failed promote in place
+  // with the retry — the generic action toast would be a second, vaguer voice.
+  const rolloutDialogPromote = useRolloutAction({ reportErrors: false })
   const triggerCronJobMutation = useTriggerCronJob()
   const suspendCronJobMutation = useSuspendCronJob()
   const resumeCronJobMutation = useResumeCronJob()
 
-  const isRollbackKind = ['deployments', 'statefulsets', 'daemonsets', 'rollouts'].includes(kind.toLowerCase())
-  const isRollout = isRolloutKind(kind)
-  const { data: rolloutCapabilities } = useRolloutCapabilities(namespace, name, isRollout)
+  const isRolloutShape = isRolloutKind(kind)
+  const isRollout = isRolloutShape && group === 'argoproj.io'
+  const isRollbackKind = ['deployments', 'statefulsets', 'daemonsets'].includes(kind.toLowerCase()) || isRollout
+  const { data: rolloutCapabilities, isPending: rolloutCapabilitiesPending } = useRolloutCapabilities(namespace, name, isRollout)
   // Restart and Rollback are the generic workload buttons, so a Rollout has to
   // withhold the callback the way promote-full does. Permissive until the probe
   // answers — withholding while it loads would flicker the shared buttons.
   const rolloutAllows = (verb: 'restart' | 'rollback') =>
     !isRollout || !rolloutCapabilities || rolloutCapabilities[verb]
+  const imageUpdatesSupported = features?.workloadImages === true
+  const canSetImages = isRolloutShape
+    ? imageUpdatesSupported && isRollout && !rolloutCapabilitiesPending && rolloutCapabilities?.setImage === true
+    : !workloadWritesPending && canSetWorkloadImages({ name: kind, group }, workloadWrites, imageUpdatesSupported)
+  const loadImages = useCallback(
+    (params: { kind: string; namespace: string; name: string }) =>
+      queryClient.fetchQuery({
+        queryKey: ['workload-images', params.kind, params.namespace, params.name],
+        queryFn: () => fetchWorkloadImages(params.kind, params.namespace, params.name),
+        staleTime: 0,
+      }),
+    [queryClient],
+  )
   const {
     data: revisionsList,
     isLoading: revisionsLoading,
@@ -381,6 +419,12 @@ function useActionsBarProps(
           restartWorkloadMutation.mutate(params)
       : undefined,
     isRestarting: restartWorkloadMutation.isPending,
+    onLoadImages: canSetImages ? loadImages : undefined,
+    onSetImages: canSetImages
+      ? (params: Parameters<typeof setWorkloadImagesMutation.mutateAsync>[0]) =>
+          setWorkloadImagesMutation.mutateAsync(params)
+      : undefined,
+    isSettingImages: setWorkloadImagesMutation.isPending,
     revisions: revisionsList,
     revisionsLoading,
     revisionsError: revisionsError ?? null,
@@ -396,7 +440,7 @@ function useActionsBarProps(
     // mutateAsync, not mutate: the revision dialog awaits this before closing.
     onRolloutPromoteFull: rolloutCapabilities?.promoteFull
       ? (params: { namespace: string; name: string }) =>
-          rolloutActionMutation.mutateAsync({ action: 'promote-full', ...params })
+          rolloutDialogPromote.mutateAsync({ action: 'promote-full', ...params })
       : undefined,
     onTriggerCronJob: (params: Parameters<typeof triggerCronJobMutation.mutate>[0]) =>
       triggerCronJobMutation.mutate(params),
@@ -453,8 +497,11 @@ export function WorkloadView({
   ...rest
 }: WorkloadViewProps) {
   const [searchParams, setSearchParams] = useSearchParams()
-  const apiKind = kindToPlural(kindProp)
+  const apiKind = kindToPluralWithGroup(kindProp, rest.group ?? '')
   const queryClient = useQueryClient()
+  const [imageTargetOwnership, setImageTargetOwnership] =
+    useState<ImageTargetOwnershipContext | null>(null)
+  const imageOwnershipRequestRef = useRef(0)
 
   // Tab state from URL query param — migrate legacy tab names
   const rawTab = searchParams.get('tab')
@@ -492,7 +539,8 @@ export function WorkloadView({
   )
 
   const batchKind = pluralToKind(apiKind)
-  const batchExecution = BATCH_EXECUTION_KINDS.has(batchKind)
+  const batchExecution = BATCH_EXECUTION_KINDS.has(batchKind) &&
+    (batchKind !== 'Job' || isCoreBatchJob(apiKind, rest.group))
   const batchRunsQuery = useWorkloadRuns(apiKind, namespace, name, expanded && batchExecution, {
     refetchActive: true,
     clusterScoped: batchKind === 'ClusterWorkflowTemplate',
@@ -535,6 +583,9 @@ export function WorkloadView({
       queryClient.refetchQueries({
         queryKey: ['workload-runs', apiKind, namespace, name],
       }),
+      queryClient.refetchQueries({
+        queryKey: ['workload-pods', apiKind, namespace, name],
+      }),
     ])
   }, [apiKind, name, namespace, queryClient, refetchResource])
   const podWorkloadOwner = useMemo(
@@ -551,6 +602,16 @@ export function WorkloadView({
   )
   const certificateInfo = resourceResponse?.certificateInfo
   const hpaDiagnosis = resourceResponse?.hpaDiagnosis
+  const activeImageTargetOwnership = useMemo(
+    () =>
+      imageTargetOwnership &&
+      imageTargetOwnership.root.resource.toLowerCase() === apiKind.toLowerCase() &&
+      imageTargetOwnership.root.namespace === namespace &&
+      imageTargetOwnership.root.name === name
+        ? imageTargetOwnership
+        : null,
+    [apiKind, imageTargetOwnership, name, namespace],
+  )
   const relationshipGitopsOwner = useMemo(
     () => gitOpsOwnerFromRelationships(relationships),
     [relationships],
@@ -566,7 +627,7 @@ export function WorkloadView({
     [relationships, relationshipGitopsOwner, apiKind, namespace, name, rest.group],
   )
   const inheritedGitOpsResponse = useResourceWithRelationships<any>(
-    inheritedGitOpsLookupRef ? kindToPlural(inheritedGitOpsLookupRef.kind) : '',
+    inheritedGitOpsLookupRef ? kindToPluralWithGroup(inheritedGitOpsLookupRef.kind, inheritedGitOpsLookupRef.group ?? '') : '',
     inheritedGitOpsLookupRef?.namespace ?? '',
     inheritedGitOpsLookupRef?.name ?? '',
     inheritedGitOpsLookupRef?.group,
@@ -600,7 +661,30 @@ export function WorkloadView({
   const helmSourceResource = relationshipHelmOwner
     ? resource
     : inheritedGitOpsResponse.data?.resource
-  const shouldResolveArgoOwner = rawGitopsOwner?.tool === 'argocd' && !rawGitopsOwner.namespace
+  const targetRelationshipGitopsOwner = useMemo(
+    () => gitOpsOwnerFromRelationships(activeImageTargetOwnership?.response.relationships),
+    [activeImageTargetOwnership?.response.relationships],
+  )
+  const targetInheritedGitopsOwner = useMemo(
+    () =>
+      gitOpsOwnerFromRelationships(
+        activeImageTargetOwnership?.inheritedResponse?.relationships,
+      ),
+    [activeImageTargetOwnership?.inheritedResponse?.relationships],
+  )
+  const targetRawGitopsOwner = targetRelationshipGitopsOwner ?? targetInheritedGitopsOwner
+  const targetRelationshipHelmOwner = nativeHelmOwnerFromRelationships(
+    activeImageTargetOwnership?.response.relationships,
+    activeImageTargetOwnership?.target.namespace ?? namespace,
+  )
+  const targetInheritedHelmOwner = nativeHelmOwnerFromRelationships(
+    activeImageTargetOwnership?.inheritedResponse?.relationships,
+    activeImageTargetOwnership?.target.namespace ?? namespace,
+  )
+  const targetHelmOwner = targetRelationshipHelmOwner ?? targetInheritedHelmOwner
+  const shouldResolveArgoOwner =
+    (rawGitopsOwner?.tool === 'argocd' && !rawGitopsOwner.namespace) ||
+    (targetRawGitopsOwner?.tool === 'argocd' && !targetRawGitopsOwner.namespace)
   const { data: argoApplications } = useResources<any>('applications', undefined, 'argoproj.io', {
     enabled: shouldResolveArgoOwner,
   })
@@ -608,6 +692,10 @@ export function WorkloadView({
     () => resolveGitOpsOwner(rawGitopsOwner, argoApplications),
     [rawGitopsOwner, argoApplications],
   )
+  const targetGitopsOwner = useMemo(
+    () => resolveGitOpsOwner(targetRawGitopsOwner, argoApplications),
+    [argoApplications, targetRawGitopsOwner],
+  )
   const gitopsOwnerGroup = gitopsOwner ? gitOpsOwnerGroup(gitopsOwner) : ''
   const shouldFetchGitOpsOwner = Boolean(gitopsOwner?.namespace)
   const gitopsOwnerQuery = useResource<any>(
@@ -616,6 +704,17 @@ export function WorkloadView({
     gitopsOwner?.name ?? '',
     gitopsOwnerGroup,
   )
+  const targetGitopsOwnerGroup = targetGitopsOwner ? gitOpsOwnerGroup(targetGitopsOwner) : ''
+  const shouldFetchTargetGitOpsOwner = Boolean(
+    activeImageTargetOwnership && targetGitopsOwner?.namespace,
+  )
+  const targetGitopsOwnerQuery = useResource<Record<string, unknown>>(
+    shouldFetchTargetGitOpsOwner ? targetGitopsOwner!.kind : '',
+    targetGitopsOwner?.namespace ?? '',
+    targetGitopsOwner?.name ?? '',
+    targetGitopsOwnerGroup,
+    { enabled: shouldFetchTargetGitOpsOwner },
+  )
   const gitOpsOwnerStatus = useMemo(
     () => deriveGitOpsOwnerStatus(gitopsOwner, gitopsOwnerQuery.data),
     [gitopsOwner, gitopsOwnerQuery.data],
@@ -768,11 +867,6 @@ export function WorkloadView({
     // pass one.
     group: effectiveGroup,
   })
-  const actionsBarProps = useMemo(
-    () => ({ ...baseActionsBarProps, onCompareTo, onCompareAcrossClusters }),
-    [baseActionsBarProps, onCompareTo, onCompareAcrossClusters],
-  )
-
   const handleUpdateResource = useCallback(
     async (params: Parameters<typeof updateResource.mutateAsync>[0]) => {
       await updateResource.mutateAsync(params)
@@ -823,6 +917,136 @@ export function WorkloadView({
     },
     [navigateRouter, searchParams],
   )
+  const loadImagesWithTargetOwnership = useCallback(
+    async (params: { kind: string; namespace: string; name: string }) => {
+      const request = ++imageOwnershipRequestRef.current
+      const inventory = await baseActionsBarProps.onLoadImages!(params)
+      const targetDiffers =
+        inventory.target.resource.toLowerCase() !== params.kind.toLowerCase() ||
+        inventory.target.namespace !== params.namespace ||
+        inventory.target.name !== params.name
+      if (!targetDiffers) {
+        if (request === imageOwnershipRequestRef.current) {
+          setImageTargetOwnership(null)
+        }
+        return inventory
+      }
+
+      const fetchRelationships = (
+        resource: string,
+        targetNamespace: string,
+        targetName: string,
+        group?: string,
+      ) =>
+        queryClient.fetchQuery({
+          queryKey: ['resource', resource, targetNamespace, targetName, group],
+          queryFn: () =>
+            fetchResourceWithRelationships<Record<string, unknown>>(
+              resource,
+              targetNamespace,
+              targetName,
+              group,
+            ),
+          staleTime: 0,
+        })
+      const response = await fetchRelationships(
+        inventory.target.resource,
+        inventory.target.namespace,
+        inventory.target.name,
+        inventory.target.group,
+      )
+      const inheritedRef = findInheritedGitOpsLookupRef(
+        response.relationships,
+        gitOpsOwnerFromRelationships(response.relationships),
+        {
+          kind: inventory.target.kind,
+          namespace: inventory.target.namespace,
+          name: inventory.target.name,
+          group: inventory.target.group,
+        },
+      )
+      const inheritedResponse = inheritedRef
+        ? await fetchRelationships(
+            kindToPluralWithGroup(inheritedRef.kind, inheritedRef.group ?? ''),
+            inheritedRef.namespace,
+            inheritedRef.name,
+            inheritedRef.group,
+          )
+        : undefined
+      if (request === imageOwnershipRequestRef.current) {
+        setImageTargetOwnership({
+          root: {
+            resource: params.kind,
+            namespace: params.namespace,
+            name: params.name,
+          },
+          target: inventory.target,
+          response,
+          inheritedResponse,
+        })
+      }
+      return inventory
+    },
+    [baseActionsBarProps.onLoadImages, queryClient, setImageTargetOwnership],
+  )
+  const imageGitopsOwner = activeImageTargetOwnership ? targetGitopsOwner : gitopsOwner
+  const imageHelmOwner = activeImageTargetOwnership ? targetHelmOwner : helmOwner
+  const imageGitopsOwnerData = activeImageTargetOwnership
+    ? targetGitopsOwnerQuery.data
+    : gitopsOwnerQuery.data
+  const managedImageSources = useMemo<ManagedImageSource[] | undefined>(() => {
+    if (!activeImageTargetOwnership && inheritedGitOpsLookupRef && (inheritedGitOpsResponse.isPending || inheritedGitOpsResponse.isError)) {
+      return undefined
+    }
+    const sources: ManagedImageSource[] = []
+    if (imageGitopsOwner) {
+      sources.push({
+        type: 'GitOps',
+        label: imageGitopsOwner.namespace
+          ? `${imageGitopsOwner.namespace}/${imageGitopsOwner.name}`
+          : imageGitopsOwner.name,
+        onOpen: imageGitopsOwnerData
+          ? () => handleOpenGitOpsResource(imageGitopsOwner)
+          : undefined,
+      })
+    }
+    if (imageHelmOwner) {
+      sources.push({
+        type: 'Helm',
+        label: `${imageHelmOwner.namespace}/${imageHelmOwner.name}`,
+        onOpen: () => handleOpenHelmRelease(imageHelmOwner),
+      })
+    }
+    return sources
+  }, [
+    handleOpenGitOpsResource,
+    handleOpenHelmRelease,
+    activeImageTargetOwnership,
+    imageGitopsOwner,
+    imageGitopsOwnerData,
+    imageHelmOwner,
+    inheritedGitOpsLookupRef,
+    inheritedGitOpsResponse.isError,
+    inheritedGitOpsResponse.isPending,
+  ])
+  const actionsBarProps = useMemo(
+    () => ({
+      ...baseActionsBarProps,
+      onLoadImages: baseActionsBarProps.onLoadImages
+        ? loadImagesWithTargetOwnership
+        : undefined,
+      onCompareTo,
+      onCompareAcrossClusters,
+      managedImageSources,
+    }),
+    [
+      baseActionsBarProps,
+      loadImagesWithTargetOwnership,
+      managedImageSources,
+      onCompareTo,
+      onCompareAcrossClusters,
+    ],
+  )
   const handleOpenApplication = useCallback(
     (appKey: string) => {
       const params = new URLSearchParams()
@@ -854,7 +1078,7 @@ export function WorkloadView({
     [],
   )
 
-  const supportsWorkloadPods = ['deployments', 'statefulsets', 'daemonsets'].includes(apiKind)
+  const supportsWorkloadPods = ['deployments', 'statefulsets', 'daemonsets', 'rollouts'].includes(apiKind)
   const workloadPodsQuery = useWorkloadPods(supportsWorkloadPods ? apiKind : '', namespace, name)
   const workloadAwaitsCapacity =
     karpenter?.state === 'available' &&
@@ -862,7 +1086,7 @@ export function WorkloadView({
   const servingRefs = useMemo(() => collectServingRefs(relationships), [relationships])
   const servingQueries = useQueries({
     queries: servingRefs.map((ref) => {
-      const pluralKind = kindToPlural(ref.kind)
+      const pluralKind = kindToPluralWithGroup(ref.kind, ref.group ?? '')
       const ns = ref.namespace || '_'
       const params = new URLSearchParams()
       if (ref.group) params.set('group', ref.group)
@@ -953,12 +1177,15 @@ export function WorkloadView({
         renderLogsTab={(props) => (
           <LogsTabContent
             {...props}
+            group={effectiveGroup}
             selectedRunKey={selectedRunKey}
             onSelectRun={handleSelectedRunChange}
           />
         )}
         renderExpandedOverview={({ kind: k, apiKind, namespace: ns, name: n, resource: res }) =>
-          BATCH_EXECUTION_KINDS.has(k) && res ? (
+          BATCH_EXECUTION_KINDS.has(k) &&
+          (k !== 'Job' || isCoreBatchJob(apiKind, effectiveGroup)) &&
+          res ? (
             <BatchExecutionFullscreen
               kind={k}
               apiKind={apiKind}
@@ -1054,7 +1281,7 @@ export function WorkloadView({
               rest.onNavigateToResource
                 ? (ref) =>
                     rest.onNavigateToResource?.({
-                      kind: kindToPlural(ref.kind),
+                      kind: kindToPluralWithGroup(ref.kind, ref.group ?? ''),
                       namespace: ref.namespace ?? '',
                       name: ref.name,
                       group: ref.group ?? '',
@@ -1082,11 +1309,12 @@ export function WorkloadView({
         initialYaml={duplicateYaml}
         title="Duplicate Resource"
         onCreated={(result) => {
+          const group = apiVersionToGroup(result.apiVersion)
           rest.onNavigateToResource?.({
-            kind: kindToPlural(result.kind),
+            kind: kindToPluralWithGroup(result.kind, group),
             namespace: result.namespace,
             name: result.name,
-            group: '',
+            group,
           })
         }}
       />
@@ -1126,7 +1354,7 @@ function resolveGitOpsOwner(
   return namespace ? { ...owner, namespace } : owner
 }
 
-function findInheritedGitOpsLookupRef(
+export function findInheritedGitOpsLookupRef(
   relationships: Relationships | undefined,
   directOwner: GitOpsOwnerRef | null,
   current: ResourceRef,
@@ -1237,7 +1465,8 @@ function nativeHelmOwnerFromRelationships(
 
 function isCurrentResource(ref: ResourceRef, current: ResourceRef): boolean {
   return (
-    kindToPlural(ref.kind) === kindToPlural(current.kind) &&
+    kindToPluralWithGroup(ref.kind, ref.group ?? '') ===
+      kindToPluralWithGroup(current.kind, current.group ?? '') &&
     ref.namespace === current.namespace &&
     ref.name === current.name &&
     (ref.group ?? '') === (current.group ?? '')
@@ -1321,6 +1550,7 @@ const SCHEDULED_LOG_KINDS = new Set([
 function LogsTabContent({
   kind,
   apiKind,
+  group,
   namespace,
   name,
   resource,
@@ -1334,6 +1564,7 @@ function LogsTabContent({
 }: {
   kind: string
   apiKind: string
+  group?: string
   namespace: string
   name: string
   resource: any
@@ -1360,7 +1591,7 @@ function LogsTabContent({
   }
 
   // Workload kinds with stable pod selectors use the aggregated workload logs viewer
-  if (WORKLOAD_LOG_KINDS.has(kind)) {
+  if (WORKLOAD_LOG_KINDS.has(kind) && (kind !== 'Job' || isCoreBatchJob(apiKind, group))) {
     return (
       <div className="h-full">
         <WorkloadLogsViewer
@@ -1986,7 +2217,17 @@ function DiagnoseTabContent({
         runNonce={runNonce}
         testedAt={testedAt}
         clusterChangedSinceTest={clusterChanged}
-        onNavigateToResource={onNavigate ? (ref) => onNavigate({ kind: kindToPlural(ref.kind), namespace: ref.namespace ?? '', name: ref.name, group: ref.group ?? '' }) : undefined}
+        onNavigateToResource={
+          onNavigate
+            ? (ref) =>
+                onNavigate({
+                  kind: kindToPluralWithGroup(ref.kind, ref.group ?? ''),
+                  namespace: ref.namespace ?? '',
+                  name: ref.name,
+                  group: ref.group ?? '',
+                })
+            : undefined
+        }
       />
       <InClusterConsentDialog
         open={pendingRunPath !== null}
@@ -2248,7 +2489,7 @@ function RelatedResourceYaml({
   target: { kind: string; namespace: string; name: string; group?: string }
 }) {
   const { data, isLoading, error } = useResource<any>(
-    kindToPlural(target.kind),
+    kindToPluralWithGroup(target.kind, target.group ?? ''),
     target.namespace,
     target.name,
     target.group,
@@ -2264,7 +2505,7 @@ function RelatedResourceYaml({
   return (
     <EditableYamlView
       resource={{
-        kind: kindToPlural(target.kind),
+        kind: kindToPluralWithGroup(target.kind, target.group ?? ''),
         namespace: target.namespace,
         name: target.name,
         group: target.group,

package/src/contexts/CapabilitiesContext.test.tsx

@@ -0,0 +1,29 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('../api/client', () => ({
+  useCapabilities: () => ({ data: undefined, error: null }),
+  useNamespaceCapabilities: vi.fn(),
+}))
+
+import { CapabilitiesProvider, useCapabilitiesContext } from './CapabilitiesContext'
+
+function LocalTerminalCapability() {
+  return <span>{String(useCapabilitiesContext().localTerminal)}</span>
+}
+
+describe('CapabilitiesContext local terminal defaults', () => {
+  it('fails closed when a standalone surface has no provider', () => {
+    expect(renderToStaticMarkup(<LocalTerminalCapability />)).toBe('<span>false</span>')
+  })
+
+  it('preserves the local loading default inside CapabilitiesProvider', () => {
+    const markup = renderToStaticMarkup(
+      <CapabilitiesProvider>
+        <LocalTerminalCapability />
+      </CapabilitiesProvider>,
+    )
+
+    expect(markup).toBe('<span>true</span>')
+  })
+})

package/src/contexts/CapabilitiesContext.tsx

@@ -46,7 +46,10 @@ const restrictedCapabilities: Capabilities = {
   deployment: { mode: 'local' },
 }
 
-const CapabilitiesContext = createContext<Capabilities>(defaultCapabilities)
+const CapabilitiesContext = createContext<Capabilities>({
+  ...defaultCapabilities,
+  localTerminal: false,
+})
 
 export function CapabilitiesProvider({ children }: { children: ReactNode }) {
   const { data: capabilities, error } = useCapabilities()
@@ -145,7 +148,7 @@ export function useHasLimitedAccess(): boolean {
 // capability check; callers use global capability values until it resolves.
 export function useNamespacedCapabilities(namespace: string | undefined) {
   const globalCaps = useContext(CapabilitiesContext)
-  const { data: nsCaps, error } = useNamespaceCapabilities(namespace, globalCaps)
+  const { data: nsCaps, error, isPending } = useNamespaceCapabilities(namespace, globalCaps)
 
   if (error) {
     console.warn(`Failed to fetch namespace capabilities for ${namespace}, using global:`, error)
@@ -156,5 +159,6 @@ export function useNamespacedCapabilities(namespace: string | undefined) {
     canViewLogs: nsCaps?.logs ?? globalCaps.logs,
     canPortForward: nsCaps?.portForward ?? globalCaps.portForward,
     workloadWrites: nsCaps?.workloadWrites ?? globalCaps.workloadWrites,
-  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.workloadWrites, nsCaps])
+    workloadWritesPending: Boolean(namespace && isPending),
+  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.workloadWrites, isPending, namespace, nsCaps])
 }

package/src/utils/navigation.test.ts

@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  initNavigationMap,
+  resetNavigationMap,
+} from '@skyhook-io/k8s-ui/utils/navigation'
+import { relatedResourcePath, resourcePath } from './navigation'
+
+afterEach(resetNavigationMap)
+
+describe('resource navigation paths', () => {
+  it('routes the native PodGroup by its scheduling API group', () => {
+    initNavigationMap([
+      {
+        group: 'scheduling.k8s.io',
+        version: 'v1beta1',
+        kind: 'PodGroup',
+        name: 'podgroups',
+        namespaced: true,
+        isCrd: false,
+        verbs: ['get', 'list'],
+      },
+    ])
+
+    expect(
+      resourcePath({
+        kind: 'PodGroup',
+        group: 'scheduling.k8s.io',
+        namespace: 'default',
+        name: 'batch',
+      }),
+    ).toBe(
+      '/resources/podgroups?resource=default%2Fbatch&apiGroup=scheduling.k8s.io',
+    )
+  })
+
+  it('preserves Radar virtual PodGroup navigation without an API group', () => {
+    expect(
+      relatedResourcePath({
+        kind: 'PodGroup',
+        namespace: 'default',
+        name: 'batch',
+      }),
+    ).toBe('/workload/pods/default/batch')
+  })
+})

package/src/utils/navigation.ts

@@ -1,5 +1,5 @@
 import { apiUrl, getAuthHeaders, getCredentialsMode } from '../api/config'
-import { apiVersionToGroup, kindToPlural } from '@skyhook-io/k8s-ui/utils/navigation'
+import { apiVersionToGroup, kindToPluralWithGroup } from '@skyhook-io/k8s-ui/utils/navigation'
 import type { SelectedResource, Topology } from '@skyhook-io/k8s-ui/types/core'
 import type { SearchHit } from '../api/client'
 
@@ -14,7 +14,7 @@ export function searchHitToSelectedResource(hit: SearchHit): SelectedResource {
 }
 
 // Re-export shared navigation utilities from @skyhook-io/k8s-ui.
-export { kindToPlural, pluralToKind, refToSelectedResource, apiVersionToGroup } from '@skyhook-io/k8s-ui/utils/navigation'
+export { kindToPlural, kindToPluralWithGroup, pluralToKind, refToSelectedResource, apiVersionToGroup } from '@skyhook-io/k8s-ui/utils/navigation'
 export type { NavigateToResource } from '@skyhook-io/k8s-ui/utils/navigation'
 
 const NETWORK_POLICY_TOPOLOGY_KINDS = new Set([
@@ -48,7 +48,7 @@ export function getNetworkPolicyResourceTarget(topology: Topology | null): { kin
 
     const group = networkPolicyGroup(node)
     const target = {
-      kind: kindToPlural(node.kind),
+      kind: kindToPluralWithGroup(node.kind, group ?? ''),
       ...(group ? { group } : {}),
     }
     targets.set(`${target.kind}\u0000${target.group ?? ''}`, target)
@@ -96,13 +96,13 @@ export function resourcePath(resource: SelectedResource): string {
   }
   if (resource.group) params.set('apiGroup', resource.group)
   const query = params.toString()
-  return `/resources/${kindToPlural(resource.kind)}${query ? `?${query}` : ''}`
+  return `/resources/${kindToPluralWithGroup(resource.kind, resource.group ?? '')}${query ? `?${query}` : ''}`
 }
 
 const FULLSCREEN_RESOURCE_KINDS = new Set(['pods', 'deployments', 'statefulsets', 'daemonsets', 'jobs', 'cronjobs', 'nodes'])
 
 export function relatedResourcePath(resource: SelectedResource): string {
-  const apiKind = kindToPlural(resource.kind).toLowerCase()
+  const apiKind = kindToPluralWithGroup(resource.kind, resource.group ?? '').toLowerCase()
   if (FULLSCREEN_RESOURCE_KINDS.has(apiKind)) {
     return buildWorkloadPath({ ...resource, kind: apiKind })
   }