@skyhook-io/radar-app 1.13.0 → 1.13.2

package/src/components/diagnose/target.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+
+import { formatInvestigationTarget, runTargetKey } from "./target";
+
+describe("investigation target identity", () => {
+  it("uses one running key for singular Kinds and plural resource names", () => {
+    expect(runTargetKey("Deployment", "prod", "api", "apps")).toBe(
+      runTargetKey("deployments", "prod", "api", "apps"),
+    );
+  });
+
+  it("keeps same-named resources in different API groups distinct", () => {
+    expect(runTargetKey("Service", "prod", "api", "")).not.toBe(
+      runTargetKey("services", "prod", "api", "serving.knative.dev"),
+    );
+  });
+
+  it("formats a non-core target with its Kubernetes-qualified Kind", () => {
+    expect(
+      formatInvestigationTarget({
+        kind: "Rollout",
+        group: "argoproj.io",
+        namespace: "prod",
+        name: "checkout",
+      }),
+    ).toBe("Rollout.argoproj.io prod/checkout");
+  });
+
+  it("keeps the core target label compact", () => {
+    expect(
+      formatInvestigationTarget({
+        kind: "Service",
+        group: "",
+        namespace: "prod",
+        name: "api",
+      }),
+    ).toBe("Service prod/api");
+  });
+});

package/src/components/diagnose/target.ts

@@ -0,0 +1,36 @@
+import { resourceKey } from "@skyhook-io/k8s-ui";
+
+import { kindToPluralWithGroup } from "../../utils/navigation";
+
+export interface InvestigationTargetIdentity {
+  kind: string;
+  /** Kubernetes API group; empty means core. */
+  group: string;
+  namespace: string;
+  name: string;
+}
+
+// Normalize the Kind/resource-name boundary before comparing a run returned by
+// the API (singular Kind) with a UI action (often a plural resource name).
+export function runTargetKey(
+  kind: string,
+  namespace: string,
+  name: string,
+  group: string,
+): string {
+  return resourceKey(
+    group,
+    kindToPluralWithGroup(kind, group),
+    namespace,
+    name,
+  );
+}
+
+// Keep the UI aligned with the CLI and the prompts: a non-core target is shown
+// as Kind.api.group, which is the Kubernetes-qualified identity users can copy.
+export function formatInvestigationTarget(
+  target: InvestigationTargetIdentity,
+): string {
+  const kind = target.group ? `${target.kind}.${target.group}` : target.kind;
+  return `${kind} ${target.namespace ? `${target.namespace}/` : ""}${target.name}`;
+}

package/src/components/diagnose/useDisclosureReveal.ts

@@ -0,0 +1,117 @@
+import { useCallback, useLayoutEffect, useRef } from "react";
+
+// Shared Collapse uses a 200 ms grid-row transition. Keep a small paint margin
+// before moving focus so the destination is stationary. Reduced-motion users get
+// an immediate disclosure and focus hand-off because Collapse disables motion.
+export const INVESTIGATION_DISCLOSURE_SETTLE_MS = 220;
+export function prefersReducedMotion(): boolean {
+  return (
+    typeof window !== "undefined" &&
+    typeof window.matchMedia === "function" &&
+    window.matchMedia("(prefers-reduced-motion: reduce)").matches
+  );
+}
+
+export function investigationDisclosureSettleDelay(
+  reducedMotion: boolean,
+): number {
+  return reducedMotion ? 0 : INVESTIGATION_DISCLOSURE_SETTLE_MS;
+}
+
+export function investigationDisclosureScrollTop({
+  scrollTop,
+  viewportTop,
+  viewportBottom,
+  disclosureTop,
+  disclosureBottom,
+  inset = 8,
+}: {
+  scrollTop: number;
+  viewportTop: number;
+  viewportBottom: number;
+  disclosureTop: number;
+  disclosureBottom: number;
+  inset?: number;
+}): number | undefined {
+  const visibleTop = viewportTop + inset;
+  const visibleBottom = viewportBottom - inset;
+  if (disclosureTop >= visibleTop && disclosureBottom <= visibleBottom) {
+    return undefined;
+  }
+  if (disclosureTop < visibleTop) {
+    return Math.max(0, scrollTop + disclosureTop - visibleTop);
+  }
+  const viewportHeight = visibleBottom - visibleTop;
+  const disclosureHeight = disclosureBottom - disclosureTop;
+  if (disclosureHeight <= viewportHeight) {
+    return Math.max(0, scrollTop + disclosureBottom - visibleBottom);
+  }
+  return Math.max(0, scrollTop + disclosureTop - visibleTop);
+}
+
+export function useDisclosureReveal<T extends HTMLElement>() {
+  const elementRef = useRef<T>(null);
+  const timerRef = useRef<number | undefined>(undefined);
+  useLayoutEffect(
+    () => () => {
+      if (timerRef.current !== undefined) {
+        window.clearTimeout(timerRef.current);
+      }
+    },
+    [],
+  );
+
+  const revealAfterToggle = useCallback((opening: boolean) => {
+    if (timerRef.current !== undefined) {
+      window.clearTimeout(timerRef.current);
+      timerRef.current = undefined;
+    }
+    if (!opening) return;
+    const settleDelay = investigationDisclosureSettleDelay(
+      prefersReducedMotion(),
+    );
+    const initialScroller = elementRef.current?.closest<HTMLElement>(
+      "[data-investigation-findings-scroll], [data-investigation-activity-scroll]",
+    );
+    const initialScrollTop = initialScroller?.scrollTop;
+    // Even reduced-motion disclosures need one task boundary so React can
+    // commit the open layout before it is measured.
+    timerRef.current = window.setTimeout(() => {
+      timerRef.current = undefined;
+      const element = elementRef.current;
+      if (!element) return;
+      const scroller = element.closest<HTMLElement>(
+        "[data-investigation-findings-scroll], [data-investigation-activity-scroll]",
+      );
+      // This component lives in a bounded Diagnose surface. Never fall back to
+      // scrolling the document (or an overflow-hidden ancestor), which can move
+      // the entire workspace and expose blank space below it.
+      if (!scroller) return;
+      // Expansion is delayed until Collapse has settled. If the reader scrolls
+      // during that interval, their newer intent wins over the automatic reveal.
+      if (
+        scroller === initialScroller &&
+        initialScrollTop !== undefined &&
+        Math.abs(scroller.scrollTop - initialScrollTop) > 2
+      ) {
+        return;
+      }
+      const viewport = scroller.getBoundingClientRect();
+      const disclosure = element.getBoundingClientRect();
+      const top = investigationDisclosureScrollTop({
+        scrollTop: scroller.scrollTop,
+        viewportTop: viewport.top,
+        viewportBottom: viewport.bottom,
+        disclosureTop: disclosure.top,
+        disclosureBottom: disclosure.bottom,
+      });
+      if (top === undefined) return;
+      scroller.scrollTo({
+        top,
+        behavior: settleDelay === 0 ? "auto" : "smooth",
+      });
+    }, settleDelay);
+  }, []);
+
+  return { elementRef, revealAfterToggle };
+}

package/src/components/execution/BatchExecutionView.render.test.tsx

@@ -0,0 +1,35 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import { BatchExecutionFullscreen } from './BatchExecutionView'
+
+vi.mock('../../api/client', () => ({
+  useResource: () => ({}),
+  useWorkloadPods: () => ({}),
+  useWorkloadRuns: () => ({ data: { runs: [] } }),
+}))
+
+describe.each(['Job', 'CronJob', 'ScaledJob'])('%s cleanup retention display', (kind) => {
+  function render(ttlSecondsAfterFinished?: number) {
+    const jobSpec = { ttlSecondsAfterFinished, activeDeadlineSeconds: 60 }
+    const spec = kind === 'CronJob'
+      ? { jobTemplate: { spec: jobSpec } }
+      : kind === 'ScaledJob'
+        ? { jobTargetRef: jobSpec }
+        : jobSpec
+    return renderToStaticMarkup(
+      <BatchExecutionFullscreen kind={kind} apiKind={`${kind.toLowerCase()}s`} namespace="default" name="example" resource={{ spec }} />,
+    )
+  }
+
+  it.each([0, 300])('shows a configured TTL of %i seconds exactly once alongside the definition', (ttl) => {
+    const html = render(ttl)
+    expect(html.match(/TTL after finish/g)).toHaveLength(1)
+    expect(html).toContain(`>${ttl}s<`)
+    expect(html).toContain('>Deadline<')
+    expect(html).toContain('>60s<')
+  })
+
+  it('omits TTL when cleanup retention is unconfigured', () => {
+    expect(render()).not.toContain('TTL after finish')
+  })
+})

package/src/components/execution/BatchExecutionView.tsx

@@ -475,9 +475,7 @@ function sourceFacts(kind: string, resource: any, runs: WorkloadRun[]) {
       progress: latest?.progress,
       duration: latest ? formatRunDuration(latest) : '',
       work: latest ? workCount(latest) : '',
-      facts: [
-        ['TTL after finish', spec.ttlSecondsAfterFinished != null ? `${spec.ttlSecondsAfterFinished}s` : 'None'],
-      ],
+      facts: [],
       definition,
     }
   }
@@ -544,6 +542,7 @@ function ExecutionDefinitionDetails({ summary, namespace, compact = false }: { s
             <DefinitionFact label="Service account" value={summary.serviceAccount} mono />
             {summary.configMaps.length > 0 && <DefinitionFact label="ConfigMaps" value={summary.configMaps.join(', ')} mono />}
             {summary.secrets.length > 0 && <DefinitionFact label="Secrets" value={summary.secrets.join(', ')} mono />}
+            {summary.ttlAfterFinished && <DefinitionFact label="TTL after finish" value={summary.ttlAfterFinished} />}
           </>
         )}
       </div>

package/src/components/execution/execution-definition.test.ts

@@ -48,6 +48,25 @@ describe('executionDefinitionSummary', () => {
     })
   })
 
+  describe.each(['Job', 'CronJob', 'ScaledJob'])('%s retention', (kind) => {
+    function resource(jobSpec: Record<string, unknown>) {
+      if (kind === 'CronJob') return { spec: { jobTemplate: { spec: jobSpec } } }
+      if (kind === 'ScaledJob') return { spec: { jobTargetRef: jobSpec } }
+      return { spec: jobSpec }
+    }
+
+    it.each([0, 300])('keeps a configured TTL of %i seconds separate from the execution deadline', (ttl) => {
+      expect(executionDefinitionSummary(kind, resource({
+        ttlSecondsAfterFinished: ttl,
+        activeDeadlineSeconds: 60,
+      }))).toMatchObject({ ttlAfterFinished: `${ttl}s`, deadline: '60s' })
+    })
+
+    it('does not invent a TTL when cleanup retention is unconfigured', () => {
+      expect(executionDefinitionSummary(kind, resource({}))).not.toHaveProperty('ttlAfterFinished')
+    })
+  })
+
   it('explains Argo DAG shape, executable templates, policy, and dependencies', () => {
     const summary = executionDefinitionSummary('WorkflowTemplate', {
       spec: {

package/src/components/execution/execution-definition.ts

@@ -19,6 +19,7 @@ export interface ExecutionDefinitionSummary {
   serviceAccount: string
   retry: string
   deadline?: string
+  ttlAfterFinished?: string
   parallelism?: string
 }
 
@@ -79,6 +80,7 @@ function kubernetesJobSummary(jobSpec: any): ExecutionDefinitionSummary {
     serviceAccount: podSpec.serviceAccountName || 'default',
     retry: `Backoff limit ${jobSpec.backoffLimit ?? 6} · restart ${podSpec.restartPolicy || 'Never'}`,
     ...(jobSpec.activeDeadlineSeconds != null ? { deadline: `${jobSpec.activeDeadlineSeconds}s` } : {}),
+    ...(jobSpec.ttlSecondsAfterFinished != null ? { ttlAfterFinished: `${jobSpec.ttlSecondsAfterFinished}s` } : {}),
     parallelism: `${parallelism} parallel · ${completions} ${completions === 1 ? 'completion' : 'completions'} · ${completionMode}`,
   }
 }

package/src/components/gitops/GitOpsView.tsx

@@ -25,6 +25,7 @@ import {
   initNavigationMap,
   kindToPluralWithGroup,
   normalizeArgoApplication,
+  normalizeArgoApplicationSet,
   normalizeFluxHelmRelease,
   normalizeFluxKustomization,
   parseArgoRollbackID,
@@ -159,6 +160,7 @@ function GitOpsTableView({ namespaces, onClearNamespaces }: { namespaces: string
 
   const hasGitOpsRowResource = useMemo(() => (
     hasAPIResource(apiResources, 'applications', 'argoproj.io') ||
+    hasAPIResource(apiResources, 'applicationsets', 'argoproj.io') ||
     hasAPIResource(apiResources, 'kustomizations', 'kustomize.toolkit.fluxcd.io') ||
     hasAPIResource(apiResources, 'helmreleases', 'helm.toolkit.fluxcd.io')
   ), [apiResources])
@@ -186,6 +188,7 @@ function GitOpsTableView({ namespaces, onClearNamespaces }: { namespaces: string
     queryKey: ['gitops-rows-main', namespaces, apiResources?.length ?? 0],
     queryFn: async () => {
       const hasApplications = hasAPIResource(apiResources, 'applications', 'argoproj.io')
+      const hasApplicationSets = hasAPIResource(apiResources, 'applicationsets', 'argoproj.io')
       const hasKustomizations = hasAPIResource(apiResources, 'kustomizations', 'kustomize.toolkit.fluxcd.io')
       const hasHelmReleases = hasAPIResource(apiResources, 'helmreleases', 'helm.toolkit.fluxcd.io')
       const hasFluxSources = hasKustomizations || hasHelmReleases
@@ -193,8 +196,9 @@ function GitOpsTableView({ namespaces, onClearNamespaces }: { namespaces: string
       const hasHelmRepos = hasFluxSources && hasAPIResource(apiResources, 'helmrepositories', 'source.toolkit.fluxcd.io')
       const hasOCIRepos = hasFluxSources && hasAPIResource(apiResources, 'ocirepositories', 'source.toolkit.fluxcd.io')
       const hasBuckets = hasFluxSources && hasAPIResource(apiResources, 'buckets', 'source.toolkit.fluxcd.io')
-      const [applications, kustomizations, helmReleases, gitRepos, helmRepos, ociRepos, buckets] = await Promise.all([
+      const [applications, applicationSets, kustomizations, helmReleases, gitRepos, helmRepos, ociRepos, buckets] = await Promise.all([
         hasApplications ? fetchResourceList('applications', 'argoproj.io', namespacesParam) : Promise.resolve([]),
+        hasApplicationSets ? fetchResourceList('applicationsets', 'argoproj.io', namespacesParam) : Promise.resolve([]),
         hasKustomizations ? fetchResourceList('kustomizations', 'kustomize.toolkit.fluxcd.io', namespacesParam) : Promise.resolve([]),
         hasHelmReleases ? fetchResourceList('helmreleases', 'helm.toolkit.fluxcd.io', namespacesParam) : Promise.resolve([]),
         hasGitRepos ? fetchResourceList('gitrepositories', 'source.toolkit.fluxcd.io', '') : Promise.resolve([]),
@@ -205,6 +209,7 @@ function GitOpsTableView({ namespaces, onClearNamespaces }: { namespaces: string
       const fluxSourceUrls = buildFluxSourceUrlMap([...gitRepos, ...helmRepos, ...ociRepos, ...buckets])
       return [
         ...applications.map((r) => normalizeArgoApplication(r)),
+        ...applicationSets.map((r) => normalizeArgoApplicationSet(r)),
         ...kustomizations.map((r) => normalizeFluxKustomization(r, fluxSourceUrls)),
         ...helmReleases.map((r) => normalizeFluxHelmRelease(r, fluxSourceUrls)),
       ]
@@ -462,8 +467,17 @@ function GitOpsDetailView({ namespaces, onOpenResource, onOpenSettings }: GitOps
       // The tree's root node is this page's own subject — clicking it must not
       // open a nested copy of the same detail page (which stacks an identical
       // "GitOps / X / X" breadcrumb, and again, ad infinitum). A self-reference
-      // is a no-op; the header already represents this resource.
+      // opens the standard resource drawer instead, matching how every other
+      // resource in Radar responds to a click — the header already represents
+      // this resource, so a full navigation would be redundant, but a raw
+      // metadata/YAML drawer is not.
       if (detailKind === kind && (ref.namespace || '') === (namespace || '') && ref.name === name) {
+        onOpenResource({
+          kind: kindToPluralWithGroup(ref.kind, ref.group ?? ''),
+          namespace: ref.namespace || '',
+          name: ref.name,
+          group: ref.group,
+        })
         return
       }
       const params = new URLSearchParams()
@@ -555,12 +569,19 @@ function GitOpsDetailView({ namespaces, onOpenResource, onOpenSettings }: GitOps
   // The bulk of the JSX is now in <GitOpsDetailLayout>; this wrapper does
   // the OSS-specific things the layout can't (call OSS-side data hooks,
   // open OSS dialogs, talk to OSS Toast, hit OSS keyboard registry).
+  const isApplicationSet = kind === 'applicationsets'
   const detail: GitOpsDetailMetadata = {
     project: detailRow?.project,
     repository: detailRow?.repository ? formatGitOpsSourceUrl(detailRow.repository) : undefined,
     path: detailRow?.path || undefined,
     chart: detailRow?.chart || undefined,
-    destination: formatGitOpsDestination(detailRow?.destination, detailRow?.destinationNamespace),
+    // An empty destination means "in-cluster" for an Application - that is
+    // Argo's default when the field is unset. For an ApplicationSet it means
+    // the template's destination was a generator placeholder, which is not the
+    // same claim, so the server half is dropped rather than asserted.
+    destination: isApplicationSet && !detailRow?.destination
+      ? (detailRow?.destinationNamespace ? `Namespace: ${detailRow.destinationNamespace}` : '')
+      : formatGitOpsDestination(detailRow?.destination, detailRow?.destinationNamespace),
     autoSyncMode: insightsQ.data?.summary?.autoSyncMode,
   }
 
@@ -920,6 +941,7 @@ function tryParseYaml(value: string): unknown {
 
 function normalizeDetailResource(kind: string, group: string, resource: any): GitOpsRow | null {
   if (kind === 'applications') return normalizeArgoApplication(resource)
+  if (kind === 'applicationsets') return normalizeArgoApplicationSet(resource)
   if (kind === 'kustomizations') return normalizeFluxKustomization(resource)
   if (kind === 'helmreleases') return normalizeFluxHelmRelease(resource)
   const status = getGitOpsResourceStatus(kind, resource)

package/src/components/home/MCPSetupDialog.tsx

@@ -204,14 +204,14 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
               <a href="https://modelcontextprotocol.io" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">
                 Model Context Protocol
               </a>{' '}
-              (MCP) server that lets AI agents inspect, diagnose, and operate your cluster through Radar.
+              (MCP) server that lets AI agents inspect, investigate, and operate your cluster through Radar.
               Unlike raw kubectl access, Radar gives your AI pre-processed, enriched data —
               topology graphs, health assessments, deduplicated events, filtered logs — so it
               can understand your cluster state quickly without burning through context on
               verbose YAML output.
             </p>
             <p className="text-sm text-theme-text-secondary leading-relaxed">
-              Most read tools do not change cluster state. Live route diagnosis can create up
+              Most read tools do not change cluster state. An in-cluster route probe can create up
               to five self-deleting probe pods when explicitly requested. Write tools (restart,
               scale, sync, apply, node drain) are annotated as destructive so your AI client
               can flag them and prompt before running.

package/src/components/home/mcpToolCatalog.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { MCP_TOOL_CATALOG } from './mcpToolCatalog'
+
+describe('diagnose catalog copy', () => {
+  const description = MCP_TOOL_CATALOG.find((tool) => tool.name === 'diagnose')?.desc
+
+  it('describes a bounded evidence bundle without promising complete sources or a verdict', () => {
+    expect(description).toContain('Bounded, point-in-time evidence bundle')
+    expect(description).toContain('not an agent run')
+    expect(description).toContain('not an authoritative root-cause verdict')
+    expect(description).toContain('attempts selected, capped current and previous logs where available')
+    expect(description).toContain('a capped warning-event sample')
+    expect(description).toContain('only when the evidence establishes one')
+    expect(description).not.toContain('One-call root-cause bundle')
+  })
+
+  it('documents group-qualified Argo Rollout evidence', () => {
+    const diagnose = MCP_TOOL_CATALOG.find((tool) => tool.name === 'diagnose')
+    expect(diagnose?.desc).toContain('Argo Rollout')
+    expect(diagnose?.params.find((param) => param.arg === 'group')?.desc).toContain('argoproj.io')
+  })
+})

package/src/components/home/mcpToolCatalog.ts

@@ -109,9 +109,10 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'diagnose',
-    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues; network entry kinds (Service / Ingress / HTTPRoute / GRPCRoute / Gateway) get a path-shaped trace naming the first broken hop, with an optional one-shot reachability test.',
+    desc: 'Bounded, point-in-time evidence bundle for one narrowed target — not an agent run and not an authoritative root-cause verdict. For workloads, including Argo Rollout, Radar attempts selected, capped current and previous logs where available, alongside resource context, a capped warning-event sample, and startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues; network entry kinds (Service / Ingress / HTTPRoute / GRPCRoute / Gateway) get a coverage-honest path trace that identifies a broken hop only when the evidence establishes one, with an optional one-shot reachability test.',
     params: [
-      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, Flux HelmRelease, service, ingress, httproute, grpcroute, or gateway' },
+      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, Argo Rollout, application, kustomization, Flux HelmRelease, service, ingress, httproute, grpcroute, or gateway' },
+      { arg: 'group', desc: 'API group for CRDs or kind collisions (for example argoproj.io for Rollout); built-ins are inferred' },
       { arg: 'namespace', required: true, desc: 'resource namespace' },
       { arg: 'name', required: true, desc: 'resource name' },
       { arg: 'probe', desc: 'network kinds only: add active DNS/TCP/TLS/HTTP probes against the declared path (0-3s wall time)' },

package/src/components/issues/IssuesPane.tsx

@@ -1,7 +1,10 @@
 import { useMemo, useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { useIssues } from "../../api/client";
-import { useAPIResources, karpenterCapacityAvailable } from "../../api/apiResources";
+import {
+  useAPIResources,
+  karpenterCapacityAvailable,
+} from "../../api/apiResources";
 import { useCapabilitiesContext } from "../../contexts/CapabilitiesContext";
 import { useConnection } from "../../context/ConnectionContext";
 import type { SelectedResource } from "../../types";
@@ -242,6 +245,7 @@ export function IssuesPane({
                 )}
                 <IssueDiagnoseButton
                   kind={issue.kind}
+                  group={issue.group}
                   namespace={issue.namespace ?? ""}
                   name={issue.name}
                 />

package/src/components/nav/navigation.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it, vi } from 'vitest'
+import { navigateFromPrimaryRail } from './navigation'
+
+describe('navigateFromPrimaryRail', () => {
+  it('closes an expanded investigation before showing the selected destination', () => {
+    const calls: string[] = []
+
+    navigateFromPrimaryRail(
+      true,
+      () => calls.push('close'),
+      () => calls.push('navigate'),
+    )
+
+    expect(calls).toEqual(['close', 'navigate'])
+  })
+
+  it('keeps a docked investigation open across sidebar navigation', () => {
+    const close = vi.fn()
+    const navigate = vi.fn()
+
+    navigateFromPrimaryRail(false, close, navigate)
+
+    expect(close).not.toHaveBeenCalled()
+    expect(navigate).toHaveBeenCalledOnce()
+  })
+})

package/src/components/nav/navigation.ts

@@ -0,0 +1,10 @@
+// Sidebar navigation means “show me that destination.” An expanded investigation
+// obscures it, while a docked investigation intentionally stays alongside it.
+export function navigateFromPrimaryRail(
+  expandedInvestigationOpen: boolean,
+  closeDiagnose: () => void,
+  navigate: () => void,
+) {
+  if (expandedInvestigationOpen) closeDiagnose()
+  navigate()
+}

package/src/components/settings/SettingsDialog.tsx

@@ -107,7 +107,7 @@ interface SettingsDialogProps {
 //     the owner-gated footer and applied after restart.
 //   • Live integrations (Prometheus, cost source, Argo CD) — their own Apply/Connect endpoints
 //     re-point the running server; effect immediately, NOT part of footer dirty.
-//   • Self-saving preferences (cost currency, AI diagnose) — applied immediately.
+//   • Self-saving preferences (cost currency, AI investigations) — applied immediately.
 // Integration fields (prometheusUrl, argoCdUrl, argoCdInsecureTls) apply through
 // their own controls and are excluded here. Every field is normalized so
 // unset≡default doesn't read as a change.
@@ -139,7 +139,7 @@ export function SettingsDialog({
   const { data: versionInfo } = useVersionCheck()
   // Radar configuration (kubeconfig, port, integrations…) is host-level and
   // affects every user of this instance, so it's gated to owners. Personal
-  // sections (My permissions, AI diagnose) stay usable by everyone. Non-Cloud
+  // sections (My permissions, AI investigations) stay usable by everyone. Non-Cloud
   // callers (OSS, OIDC, kubectl plugin) have no role and pass — single-user
   // laptops are never locked out of their own config. Backend enforces this too.
   const { canAtLeast } = useCloudRole()
@@ -163,9 +163,7 @@ export function SettingsDialog({
     open && section === 'argocd'
   )
 
-  // AI Diagnosis prefs are client-side (localStorage) and now SELF-SAVING: the
-  // section has its own Save that commits the draft to DiagnoseContext, so it's
-  // independent of the owner-gated footer. The draft is snapshotted on open.
+  // Local AI preferences save independently of the owner-gated server settings.
   const diag = useDiagnose()
   const aiAvailable = diag.available && diag.agents.length > 0
   const [aiDraft, setAiDraft] = useState<AIDraft>({
@@ -443,7 +441,7 @@ export function SettingsDialog({
   // Flat, un-grouped nav ordered as a narrative — at-a-glance, then you, then how
   // Radar connects, then data integrations, then AI, then advanced. The
   // per-section captions carry the restart-vs-live semantics, so group labels
-  // would only add visual weight. AI diagnose is always shown (the section
+  // would only add visual weight. AI investigations is always shown (the section
   // explains how to enable it when no agent CLI is installed).
   const navItems: NavItemDef[] = [
     { id: 'overview', label: 'Overview', icon: LayoutDashboard, ownerOnly: false, dirty: false },
@@ -452,7 +450,7 @@ export function SettingsDialog({
     { id: 'prometheus', label: 'Metrics', icon: Activity, ownerOnly: true, dirty: false },
     { id: 'cost', label: 'Cost', icon: Coins, ownerOnly: true, dirty: costIntegrationDirty },
     { id: 'argocd', label: 'Argo CD', icon: GitBranch, ownerOnly: true, dirty: false },
-    { id: 'ai', label: 'AI diagnose', icon: Sparkles, ownerOnly: false, dirty: aiDirty },
+    { id: 'ai', label: 'AI investigations', icon: Sparkles, ownerOnly: false, dirty: aiDirty },
     { id: 'advanced', label: 'Advanced', icon: SlidersHorizontal, ownerOnly: true, dirty: advancedDirty },
   ]
 
@@ -722,16 +720,16 @@ export function SettingsDialog({
               />
             </SectionPane>
 
-            {/* AI diagnose — self-saving, usable by everyone. Same heading block
+            {/* AI investigations — self-saving, usable by everyone. Same heading block
                 as every other tab; the body is the agent controls (when a CLI is
                 installed) or an enable explainer (when not). */}
             <div className={clsx(section !== 'ai' && 'hidden')} role="tabpanel" inert={section !== 'ai' || undefined}>
               <div className="mb-4">
-                <h3 className="text-base font-semibold text-theme-text-primary">AI diagnose</h3>
+                <h3 className="text-base font-semibold text-theme-text-primary">AI investigations</h3>
                 <p className="mt-0.5 text-xs text-theme-text-tertiary">
                   {diag.hosted
-                    ? `Investigate incidents with ${diag.agentLabel} — reading logs, events, and topology to explain what's wrong.`
-                    : "Investigate incidents with an AI agent that runs on your own machine — reading logs, events, and topology to explain what's wrong. No Radar cloud, no API key."}
+                    ? `Investigate incidents with ${diag.agentLabel} — reading logs, events, and topology to understand what's happening.`
+                    : "Investigate incidents with an AI agent that runs on your own machine — reading logs, events, and topology to understand what's happening. No Radar cloud, no API key."}
                 </p>
               </div>
               {aiAvailable ? (
@@ -1140,7 +1138,7 @@ function OverviewPanel({ active, onNavigate }: { active: boolean; onNavigate: (s
       copyable: mcpOn,
     },
     {
-      id: 'ai', icon: Sparkles, label: 'AI diagnose',
+      id: 'ai', icon: Sparkles, label: 'AI investigations',
       tone: aiAvailable ? 'ok' : 'off',
       value: aiAvailable ? 'Ready' : 'No agent CLI',
       detail: aiAvailable ? agentLabel : undefined,
@@ -1220,7 +1218,7 @@ function OverviewStatus({ tone }: { tone: OverviewTone }) {
   return <span className={clsx('w-2 h-2 rounded-full shrink-0', cls)} />
 }
 
-// AIUnavailableNotice is the body of the AI diagnose tab when no supported agent
+// AIUnavailableNotice is the body of the AI investigations tab when no supported agent
 // CLI is installed — the heading/description are provided by the tab itself, so
 // this is just the enable explainer (keeping the feature discoverable to whoever
 // would set it up).

package/src/components/workload/WorkloadView.tsx

@@ -1795,7 +1795,7 @@ function DiagnoseFromWorkloadHint({
 }) {
   if (services.length === 0) return null
   return (
-    <Section title="Diagnose network path">
+    <Section title="Trace network path">
       <div className="flex items-start gap-2 text-xs text-theme-text-secondary">
         <Stethoscope className="w-4 h-4 mt-0.5 shrink-0 text-theme-text-tertiary" aria-hidden />
         <div className="flex-1 min-w-0">

package/src/context/DiagnoseCustomization.tsx

@@ -1,24 +1,26 @@
-// Slot-based injection of a resource-level "Diagnose" action, and of the
+// Slot-based injection of a resource-level "Investigate" action, and of the
 // consent card's trust copy.
 //
-// Lets an embedding host (e.g. Radar Hub) inject a "Diagnose with AI" button
+// Lets an embedding host (e.g. Radar Hub) inject an "Investigate with AI" button
 // into every resource detail action bar — without forking WorkloadView or the
 // shared ResourceActionsBar. The host returns whatever node should render in
 // the action bar's right-aligned universal-actions area, given the resource
 // context.
 //
-// Default (no provider): Radar renders no Diagnose button — OSS stays
+// Default (no provider): Radar renders no Investigate button — OSS stays
 // agent-free.
-import { createContext, useContext, useMemo } from 'react';
-import type { ReactNode } from 'react';
+import { createContext, useContext, useMemo } from "react";
+import type { ReactNode } from "react";
 
-/** Render prop for the resource-level Diagnose action. */
+/** Render prop for the resource-level Investigate action. */
 export type RenderDiagnoseAction = (ctx: {
   kind: string;
+  /** Kubernetes API group; empty means core. */
+  group?: string;
   namespace: string;
   name: string;
   /** Coarse health of the resource (from its status badge), so the entry point can
-   *  adapt: an urgent "Diagnose" on a problem vs. a quiet "ask AI" when fine/unknown. */
+   *  adapt: an urgent "Investigate" on a problem vs. a quiet "ask AI" when fine/unknown. */
   health?: "problem" | "healthy" | "unknown";
 }) => ReactNode;
 
@@ -62,7 +64,8 @@ const DEFAULTS: DiagnoseCustomization = {
   onOpenSettings: undefined,
 };
 
-const DiagnoseCustomizationContext = createContext<DiagnoseCustomization>(DEFAULTS);
+const DiagnoseCustomizationContext =
+  createContext<DiagnoseCustomization>(DEFAULTS);
 
 export function DiagnoseCustomizationProvider({
   value,