@skyhook-io/radar-app 1.12.2 → 1.13.0

package/src/components/ConnectionErrorView.test.tsx

@@ -1,6 +1,6 @@
 import { renderToStaticMarkup } from 'react-dom/server'
 import type { ReactNode } from 'react'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ContextInfo } from '../types'
 
 vi.stubGlobal('window', { location: { host: 'localhost:9280' } })
@@ -8,6 +8,7 @@ vi.stubGlobal('window', { location: { host: 'localhost:9280' } })
 const useContextsMock = vi.hoisted(() => vi.fn(
   (): { data: ContextInfo[] | undefined } => ({ data: undefined }),
 ))
+const capabilitiesMock = vi.hoisted(() => ({ localTerminal: true }))
 
 vi.mock('@skyhook-io/k8s-ui', () => ({
   ClusterName: ({ name }: { name: string }) => <span>{name}</span>,
@@ -17,6 +18,9 @@ vi.mock('../api/client', () => ({
   useAuthMe: () => ({ data: { authEnabled: false } }),
   useContexts: useContextsMock,
 }))
+vi.mock('../contexts/CapabilitiesContext', () => ({
+  useCapabilitiesContext: () => capabilitiesMock,
+}))
 vi.mock('./ContextSwitcher', () => ({
   ContextSwitcher: () => <button>Switch context</button>,
 }))
@@ -41,6 +45,10 @@ function renderError(errorType: string, context: string): string {
   )
 }
 
+beforeEach(() => {
+  capabilitiesMock.localTerminal = true
+})
+
 describe('ConnectionErrorView authentication guidance', () => {
   it('builds an honest EKS diagnostic without presenting it as authentication', () => {
     const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
@@ -119,6 +127,18 @@ describe('ConnectionErrorView authentication guidance', () => {
 
     expect(markup).not.toContain('aria-label="Run command in terminal"')
   })
+
+  it('keeps recovery commands copyable without offering an unavailable local terminal', () => {
+    capabilitiesMock.localTerminal = false
+
+    const markup = renderError('auth', 'gke_project_us-east1_prod')
+
+    expect(markup).toContain('Refresh Google Cloud credentials')
+    expect(markup).toContain('>gcloud</span>')
+    expect(markup).toContain('aria-label="Copy command to clipboard"')
+    expect(markup).not.toContain('aria-label="Run command in terminal"')
+    expect(markup).not.toContain('Authenticate in terminal')
+  })
 })
 
 describe('ConnectionErrorView kubeconfig guidance', () => {

package/src/components/ConnectionErrorView.tsx

@@ -8,6 +8,7 @@ import { useAuthMe, useContexts } from '../api/client'
 import { Tooltip } from './ui/Tooltip'
 import { allShellSafe } from '../utils/shell-safe'
 import { apiUrl } from '../api/config'
+import { useCapabilitiesContext } from '../contexts/CapabilitiesContext'
 
 interface ConnectionErrorViewProps {
   connection: ConnectionState
@@ -349,6 +350,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
   const errorInfo = commandInfo || errorHints[connection.errorType || 'unknown'] || errorHints.unknown
   const openLocalTerminal = useOpenLocalTerminal()
   const { data: authMe } = useAuthMe()
+  const { localTerminal } = useCapabilitiesContext()
   const rawErrorDefaultOpen = !connection.errorType || connection.errorType === 'unknown'
   const [showRawError, setShowRawError] = useState(rawErrorDefaultOpen)
 
@@ -356,11 +358,8 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
     setShowRawError(rawErrorDefaultOpen)
   }, [connection.error, rawErrorDefaultOpen])
 
-  // Auto-retry after successful auth. The terminal shell runs on the server
-  // host, so the auth command itself fixes the server's credentials in every
-  // mode — but the chained retry curl carries no session cookie, so it 401s
-  // once /api/connection is auth-gated. Only chain it when auth is *known*
-  // disabled (authMe still loading → don't chain a doomed call).
+  // The local terminal is only available in unauthenticated local mode, but
+  // authMe may still be loading when the capability response arrives.
   const retryCmd = `curl -s -X POST http://${window.location.host}${apiUrl('/connection/retry')} > /dev/null`
 
   const handleAuthInTerminal = () => {
@@ -421,8 +420,8 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.authCommand && (
               <div className="mt-3">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.authCommand.label}</p>
-                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={commandInfo.authCommand.runnable === false ? undefined : handleRunInTerminal} />
-                {isAuthError && !commandInfo?.hideAuthButton && commandInfo.authCommand.runnable !== false && (
+                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={!localTerminal || commandInfo.authCommand.runnable === false ? undefined : handleRunInTerminal} />
+                {localTerminal && isAuthError && !commandInfo?.hideAuthButton && commandInfo.authCommand.runnable !== false && (
                   <button
                     onClick={handleAuthInTerminal}
                     className="mt-3 w-full inline-flex items-center justify-center gap-2 px-3 py-2 text-xs font-medium btn-brand rounded-md"
@@ -436,7 +435,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.fallbackCommand && (
               <div className="mt-4 pt-3 border-t border-theme-border/50">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.fallbackCommand.label}</p>
-                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={commandInfo.fallbackCommand.runnable === false ? undefined : handleRunInTerminal} />
+                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={!localTerminal || commandInfo.fallbackCommand.runnable === false ? undefined : handleRunInTerminal} />
               </div>
             )}
             {connection.error && (

package/src/components/applications/ApplicationsView.tsx

@@ -22,6 +22,7 @@ import {
   eventsForApplication,
   memberRef,
   subjectRef,
+  compareIssueSortAnchors,
   type AppRow,
   type AppWorkload,
   type AppIdentityInstance,
@@ -46,7 +47,7 @@ import {
 } from "../../api/client";
 import { useConnection } from "../../context/ConnectionContext";
 import { useTimelineSource } from "../../context/TimelineSource";
-import { buildWorkloadPath, kindToPlural } from "../../utils/navigation";
+import { apiVersionToGroup, buildWorkloadPath, kindToPluralWithGroup } from "../../utils/navigation";
 import { WorkloadView } from "../workload/WorkloadView";
 import { ApplicationCostTab } from "../cost/ApplicationCostTab";
 import { isOpenCostWorkloadKind } from "../cost/kinds";
@@ -457,7 +458,7 @@ function AppDetailRoute({
       params.set("workload", workloadKey(workload));
       params.set(
         "run",
-        `${kindToPlural(run.kind)}/${runNamespace}/${run.name}`,
+        `${kindToPluralWithGroup(run.kind, apiVersionToGroup(run.data?.apiVersion as string | undefined))}/${runNamespace}/${run.name}`,
       );
       setSearchParams(params);
     },
@@ -465,14 +466,15 @@ function AppDetailRoute({
   );
   const openWorkloadResource = useCallback(
     (resource: SelectedResource) => {
-      if (kindToPlural(resource.kind).toLowerCase() !== "pods") {
+      const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? "")
+      if (pluralKind.toLowerCase() !== "pods") {
         onOpenResource(resource);
         return;
       }
 
       const [pathname, rawSearch = ""] = buildWorkloadPath({
         ...resource,
-        kind: kindToPlural(resource.kind),
+        kind: pluralKind,
       }).split("?");
       const params = new URLSearchParams(rawSearch);
       const activeNamespaces = searchParams.get("namespaces");
@@ -682,7 +684,7 @@ function AppDetailRoute({
         renderWorkload={(workload: SelectedAppWorkload) => (
           <div className="h-full overflow-hidden">
             <WorkloadView
-              kind={kindToPlural(workload.kind)}
+              kind={kindToPluralWithGroup(workload.kind, workload.group ?? "")}
               group={workload.group}
               namespace={workload.namespace}
               name={workload.name}
@@ -837,7 +839,7 @@ function AppOverviewIssueRows({
 }) {
   const navigate = (ref: IssueResourceRef) => {
     onOpenResource({
-      kind: kindToPlural(ref.kind),
+      kind: kindToPluralWithGroup(ref.kind, ref.group ?? ""),
       namespace: ref.namespace ?? "",
       name: ref.name,
       group: ref.group ?? "",
@@ -888,9 +890,8 @@ function compareAppOverviewIssues(a: Issue, b: Issue): number {
   const severity =
     ISSUE_SEVERITY_RANK[b.severity] - ISSUE_SEVERITY_RANK[a.severity];
   if (severity !== 0) return severity;
-  const fa = a.first_seen ?? "";
-  const fb = b.first_seen ?? "";
-  if (fa !== fb) return fb.localeCompare(fa);
+  const onset = compareIssueSortAnchors(a, b);
+  if (onset !== 0) return onset;
   const ns = (a.namespace ?? "").localeCompare(b.namespace ?? "");
   if (ns !== 0) return ns;
   const name = a.name.localeCompare(b.name);

package/src/components/audit/AuditView.tsx

@@ -88,9 +88,14 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
 
   return (
     <div className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      {/* Tabs above the header: the header describes best practices only, so
+          tabs rendered below it read as part of that page rather than as the
+          switch between the two Checks surfaces. */}
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldCheck}
-        title="Checks"
+        title="Best practices"
         description="Security, reliability, and efficiency best practices (NSA/CISA, CIS, Polaris, Kubescape), grouped into a remediation queue."
         actions={
           <>
@@ -115,8 +120,6 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
         }
       />
 
-      <ChecksViewTabs />
-
       <ChecksView
         checks={data.groupedChecks ?? []}
         catalog={data.checks ?? {}}

package/src/components/audit/UpgradeReadinessView.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { ApiError } from '../../api/client'
-import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary } from './UpgradeReadinessView'
+import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary, upgradeEvidenceCoverageLabel, upgradeUnavailableKindsMessage } from './UpgradeReadinessView'
 
 describe('UpgradeReadinessError', () => {
   it('maps an unmatched endpoint 404 to the v1.9 upgrade message', () => {
@@ -40,7 +40,7 @@ describe('upgradeEvaluationSummary', () => {
       unknown: 1,
       notApplicable: 2,
       findings: 1,
-    })).toBe('18 evaluated · 16 applicable · 1 with partial evidence · 2 not applicable')
+    })).toBe('18 evaluated · 16 applicable · 1 with incomplete evidence · 2 not applicable')
   })
 
   it('does not imply incomplete coverage when every applicable check completed', () => {
@@ -68,6 +68,30 @@ describe('upgradeEvaluationSummary', () => {
   })
 })
 
+describe('upgradeUnavailableKindsMessage', () => {
+  it('does not guess why webhook evidence is unavailable', () => {
+    const message = upgradeUnavailableKindsMessage(['mutatingwebhookconfigurations', 'validatingwebhookconfigurations'])
+
+    expect(message).toContain('Affected checks are marked incomplete')
+    expect(message).not.toContain('rbac.viewWebhooks')
+    expect(message).not.toContain('grant')
+  })
+
+  it('does not suggest webhook access for unrelated evidence gaps', () => {
+    expect(upgradeUnavailableKindsMessage(['apiservices'])).not.toContain('rbac.viewWebhooks')
+  })
+})
+
+describe('upgradeEvidenceCoverageLabel', () => {
+  it('distinguishes absent evidence from partial evidence', () => {
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 0, caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 1, caveat: 'one object malformed' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'blocked', inspected: 1, caveat: 'some nodes unavailable' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'passed', inspected: 1 })).toBe('')
+  })
+})
+
 describe('groupFindings', () => {
   it('groups repeated remediation inside a check without merging distinct action levels', () => {
     const base = {

package/src/components/audit/UpgradeReadinessView.tsx

@@ -127,6 +127,8 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
 
   return (
     <div aria-busy={isFetching} className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldAlert}
         title="Upgrade impact"
@@ -162,8 +164,6 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         }
       />
 
-      <ChecksViewTabs />
-
       {showingPreviousTarget && (
         <CoverageNotice
           headline={`Analyzing Kubernetes ${requestedTarget}`}
@@ -202,7 +202,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
       {data.coverage.state !== 'no_access' && (data.coverage.unavailableKinds?.length ?? 0) > 0 && (
         <CoverageNotice
           headline="Some live resources were unavailable"
-          body={`Radar could not inspect: ${(data.coverage.unavailableKinds ?? []).join(', ')}. Affected checks are marked incomplete.`}
+          body={upgradeUnavailableKindsMessage(data.coverage.unavailableKinds ?? [])}
         />
       )}
       {data.coverage.state !== 'no_access' && scopedKinds.length > 0 && (
@@ -212,7 +212,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         />
       )}
       {data.coverage.state === 'partial' && !data.coverage.scopedNamespaces?.length && !data.coverage.unavailableKinds?.length && scopedKinds.length === 0 && (
-        <CoverageNotice headline="Some evidence is incomplete" body="Rows marked Partial evidence explain what Radar could not verify." />
+        <CoverageNotice headline="Some evidence is incomplete" body="Evidence labels on affected rows explain what Radar could not verify." />
       )}
       {data.coverage.state === 'no_access' ? (
         <section className="shrink-0">
@@ -291,8 +291,17 @@ export function incompleteUpgradeCheckCount(checks: Pick<UpgradeReadinessCheck,
 
 export function upgradeEvaluationSummary(total: number, summary: UpgradeReadinessResponse['summary'], incomplete = summary.unknown) {
   const applicable = Math.max(0, total - summary.notApplicable)
-  const partialEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with partial evidence` : ''
-  return `${total} evaluated · ${applicable} applicable${partialEvidenceLabel} · ${summary.notApplicable} not applicable`
+  const incompleteEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with incomplete evidence` : ''
+  return `${total} evaluated · ${applicable} applicable${incompleteEvidenceLabel} · ${summary.notApplicable} not applicable`
+}
+
+export function upgradeUnavailableKindsMessage(unavailableKinds: string[]) {
+  return `Radar could not inspect: ${unavailableKinds.join(', ')}. Affected checks are marked incomplete.`
+}
+
+export function upgradeEvidenceCoverageLabel(check: Pick<UpgradeReadinessCheck, 'status' | 'inspected' | 'caveat'>) {
+  if (!check.caveat) return ''
+  return check.status === 'unknown' && (check.inspected ?? 0) === 0 ? 'No evidence' : 'Partial evidence'
 }
 
 function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
@@ -323,7 +332,7 @@ function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
           </p>
           <p>
             Results use live cluster resources and the row-specific evidence scope shown below. {unavailable.length > 0
-              ? `Radar could not inspect ${unavailable.join(', ')}; affected checks are marked incomplete.`
+              ? upgradeUnavailableKindsMessage(unavailable)
               : scopedKinds.length > 0
                 ? `Cached evidence has per-kind namespace ceilings for ${formatScopedKinds(scopedKinds)}.`
               : data.coverage.state === 'complete'
@@ -433,6 +442,7 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
   const detailID = `upgrade-check-${check.id}`
   const findingGroups = groupFindings(check.findings)
   const label = evidenceLabel(check)
+  const coverageLabel = upgradeEvidenceCoverageLabel(check)
   const checkReferences = check.references ?? []
   return (
     <div>
@@ -456,10 +466,10 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
           <div className="min-w-0">
             <Badge severity={meta.badgeSeverity}>{meta.label}</Badge>
             {label && <div className="mt-1 text-[11px] text-theme-text-tertiary">{label}</div>}
-            {check.caveat && (
+            {coverageLabel && (
               <div className="mt-1 inline-flex items-center gap-1 text-[11px] font-medium text-amber-700 dark:text-amber-300">
                 <AlertTriangle className="h-3 w-3 shrink-0" />
-                Partial evidence
+                {coverageLabel}
               </div>
             )}
           </div>

package/src/components/cost/ApplicationCostTab.test.ts

@@ -53,6 +53,48 @@ describe('getApplicationCostState', () => {
     ).toBe('partial_missing_history')
   })
 
+  it('keeps Kubecost application totals visible when history is unsupported', () => {
+    const current: OpenCostApplicationCostResponse = {
+      available: true,
+      source: 'kubecost',
+      currency: 'USD',
+      totals: {
+        hourlyCost: 0.4, cpuCost: 0.25, memoryCost: 0.15, replicas: 3,
+        cpuUsageAvailable: true, memoryUsageAvailable: true,
+        cpuAllocationUse: 40, memoryAllocationUse: 60,
+      },
+      coverage: { total: 1, included: 1 },
+      workloads: [],
+    }
+    const trend: OpenCostApplicationCostTrendResponse = {
+      available: false,
+      source: 'kubecost',
+      reason: 'history_unsupported',
+      currency: 'USD',
+      range: '24h',
+      coverage: { total: 1, included: 0 },
+    }
+
+    expect(getApplicationCostState(current, trend, {})).toBe('partial_missing_history')
+  })
+
+  it('does not let unsupported history mask current loading or errors', () => {
+    const trend: OpenCostApplicationCostTrendResponse = {
+      available: false,
+      source: 'kubecost',
+      reason: 'history_unsupported',
+      currency: 'USD',
+      range: '24h',
+      coverage: { total: 1, included: 0 },
+    }
+
+    expect(getApplicationCostState(undefined, trend, { currentLoading: true })).toBe('loading')
+    expect(getApplicationCostState(undefined, trend, { currentError: true })).toBe('load_error')
+    expect(
+      getApplicationCostState(undefined, trend, { currentError: new ApiError('denied', 403) }),
+    ).toBe('access_denied')
+  })
+
   it('uses historical data when current app metrics are absent but history exists', () => {
     const current: OpenCostApplicationCostResponse = {
       available: false,
@@ -206,5 +248,8 @@ describe('getApplicationCostState', () => {
       }),
     ).toBe('access_denied')
     expect(getApplicationCostState(current, undefined, { trendError: true })).toBe('access_denied')
+
+    current.reason = 'configuration_mismatch'
+    expect(getApplicationCostState(current, undefined, {})).toBe('configuration_mismatch')
   })
 })