@skyhook-io/radar-app 1.13.1 → 1.13.2

package/src/components/diagnose/investigationEvidencePresentation.test.ts

@@ -0,0 +1,447 @@
+import { describe, expect, it } from "vitest";
+import {
+  evidenceDisplaySnapshot,
+  groupEvidenceCoverage,
+} from "./investigationEvidencePresentation";
+import {
+  evidenceSemanticSnapshot,
+  type InvestigationEvidenceData,
+  type InvestigationEvidenceLimitation,
+} from "./investigationEvidence";
+
+function observation(data: InvestigationEvidenceData) {
+  return {
+    data,
+    title: "Evidence",
+    tone: "warning" as const,
+    summary: "Finding",
+  };
+}
+
+const resource = {
+  apiVersion: "apps/v1",
+  kind: "Deployment",
+  metadata: {
+    name: "api",
+    namespace: "dev",
+    uid: "same-object",
+    resourceVersion: "1",
+  },
+  spec: { replicas: 1 },
+  status: {
+    readyReplicas: 0,
+    conditions: [
+      {
+        type: "Available",
+        status: "False",
+        reason: "MinimumReplicasUnavailable",
+        lastTransitionTime: "2026-09-07T08:00:00Z",
+      },
+    ],
+  },
+};
+const resourceData = (value = resource): InvestigationEvidenceData => ({
+  type: "resource",
+  resource: value,
+  warnings: [],
+});
+const crash = {
+  pods: ["api-123"],
+  container: "api",
+  state: "down",
+  reason: "Error",
+  exitCode: 1,
+  logLine: "2026-09-07T08:00:00.000000000Z Authentication failed",
+  logSource: "previous",
+  logLineSelection: "fatal_pattern",
+};
+const event = {
+  type: "Warning",
+  reason: "BackOff",
+  message: "Back-off restarting failed container",
+  count: 1071,
+  lastTimestamp: "2026-09-07T08:00:00Z",
+};
+
+describe("evidence display significance (not record identity)", () => {
+  it("retains context-only status and issue changes", () => {
+    const first = observation({
+      type: "resource",
+      resource,
+      warnings: [],
+      resourceContext: {
+        tier: "basic",
+        statusSummary: { phase: "Pending" },
+        issueSummary: { count: 1, topReason: "MissingSecret" },
+      },
+    });
+    for (const patch of [
+      { statusSummary: { phase: "Running" } },
+      { issueSummary: { count: 1, topReason: "ImagePullBackOff" } },
+    ]) {
+      if (first.data.type !== "resource") throw new Error("Expected resource");
+      const next = observation({
+        ...first.data,
+        resourceContext: { ...first.data.resourceContext!, ...patch },
+      });
+      expect(evidenceDisplaySnapshot(first)).not.toBe(
+        evidenceDisplaySnapshot(next),
+      );
+    }
+  });
+  it("ignores elapsed days in condition warnings", () => {
+    const snapshot = (duration: string, age: string) =>
+      evidenceDisplaySnapshot(
+        observation({
+          type: "resource",
+          resource,
+          warnings: [
+            `Condition ` +
+              "`Available=False`" +
+              ` for ~${duration} (resource age: ${age}).`,
+          ],
+        }),
+      );
+    expect(snapshot("1d", "45d")).toBe(snapshot("2d", "46d"));
+  });
+  it("retains context-only readiness and GitOps changes when the raw object is unchanged", () => {
+    const first = observation({
+      type: "resource",
+      resource,
+      warnings: [],
+      resourceContext: {
+        tier: "basic",
+        workloadSummary: { replicas: { desired: 1, ready: 0 } },
+      },
+    });
+    const next = observation({
+      type: "resource",
+      resource,
+      warnings: [],
+      resourceContext: {
+        tier: "basic",
+        workloadSummary: { replicas: { desired: 1, ready: 1 } },
+      },
+    });
+    expect(evidenceDisplaySnapshot(first)).not.toBe(
+      evidenceDisplaySnapshot(next),
+    );
+    const synced = observation({
+      type: "resource",
+      resource,
+      warnings: [],
+      gitOpsDiagnosis: { tool: "argocd", sync: "Synced" },
+    });
+    const outOfSync = observation({
+      type: "resource",
+      resource,
+      warnings: [],
+      gitOpsDiagnosis: { tool: "argocd", sync: "OutOfSync" },
+    });
+    expect(evidenceDisplaySnapshot(synced)).not.toBe(
+      evidenceDisplaySnapshot(outOfSync),
+    );
+    const healthy = observation({
+      type: "resource",
+      resource: { ...resource, summaryContext: { health: "Healthy" } },
+      warnings: [],
+    });
+    const degraded = observation({
+      type: "resource",
+      resource: { ...resource, summaryContext: { health: "Degraded" } },
+      warnings: [],
+    });
+    expect(evidenceDisplaySnapshot(healthy)).not.toBe(
+      evidenceDisplaySnapshot(degraded),
+    );
+  });
+  it("ignores only elapsed time in the producer's condition warning", () => {
+    const first = observation({
+      type: "resource",
+      resource,
+      warnings: ["Condition `Available=False` for ~1m6s (resource age: 46d)."],
+    });
+    const later = observation({
+      type: "resource",
+      resource,
+      warnings: ["Condition `Available=False` for ~1m7s (resource age: 46d)."],
+    });
+    const different = observation({
+      type: "resource",
+      resource,
+      warnings: ["A required Secret is missing."],
+    });
+    expect(evidenceDisplaySnapshot(first)).toBe(evidenceDisplaySnapshot(later));
+    expect(evidenceDisplaySnapshot(first)).not.toBe(
+      evidenceDisplaySnapshot(different),
+    );
+  });
+  it("tolerates unstructured conditions without deleting their contents", () => {
+    const value = {
+      ...resource,
+      status: { conditions: [null, "unrecognized", { status: "False" }] },
+    };
+    const snapshot = evidenceDisplaySnapshot(
+      observation({ type: "resource", resource: value, warnings: [] }),
+    );
+    expect(snapshot).toContain('null,"unrecognized"');
+  });
+  it("ignores bookkeeping and elapsed summaries without changing exact snapshots", () => {
+    const first = observation(resourceData());
+    const next = observation(
+      resourceData({
+        ...resource,
+        metadata: { ...resource.metadata, resourceVersion: "2" },
+      }),
+    );
+    next.summary = "Unavailable for 1m7s instead of 1m6s";
+    expect(evidenceDisplaySnapshot(first)).toBe(evidenceDisplaySnapshot(next));
+    expect(evidenceSemanticSnapshot(first)).not.toBe(
+      evidenceSemanticSnapshot(next),
+    );
+    expect(resource.metadata.resourceVersion).toBe("1");
+  });
+  it("ignores condition collection times, not condition state", () => {
+    const first = observation(resourceData());
+    const nextResource = {
+      ...resource,
+      status: {
+        ...resource.status,
+        conditions: [
+          {
+            ...resource.status.conditions[0],
+            lastTransitionTime: "2026-09-07T08:01:00Z",
+            lastUpdateTime: "2026-09-07T08:01:00Z",
+          },
+        ],
+      },
+    };
+    expect(evidenceDisplaySnapshot(first)).toBe(
+      evidenceDisplaySnapshot(observation(resourceData(nextResource))),
+    );
+    nextResource.status.conditions[0].status = "True";
+    expect(evidenceDisplaySnapshot(first)).not.toBe(
+      evidenceDisplaySnapshot(observation(resourceData(nextResource))),
+    );
+  });
+  it("retains readiness, configuration, object identity and failure-detail changes", () => {
+    for (const next of [
+      { ...resource, status: { ...resource.status, readyReplicas: 1 } },
+      { ...resource, spec: { replicas: 2 } },
+      { ...resource, metadata: { ...resource.metadata, uid: "replacement" } },
+      {
+        ...resource,
+        status: {
+          ...resource.status,
+          conditions: [
+            { ...resource.status.conditions[0], reason: "DifferentFailure" },
+          ],
+        },
+      },
+    ])
+      expect(evidenceDisplaySnapshot(observation(resourceData()))).not.toBe(
+        evidenceDisplaySnapshot(observation(resourceData(next))),
+      );
+  });
+  it("does not strip timestamp-shaped configuration keys", () => {
+    const first = observation({
+      type: "resource",
+      warnings: [],
+      resource: {
+        ...resource,
+        kind: "ConfigMap",
+        data: { lastTransitionTime: "before" },
+      },
+    });
+    const next = observation({
+      type: "resource",
+      warnings: [],
+      resource: {
+        ...resource,
+        kind: "ConfigMap",
+        data: { lastTransitionTime: "after" },
+      },
+    });
+    expect(evidenceDisplaySnapshot(first)).not.toBe(
+      evidenceDisplaySnapshot(next),
+    );
+  });
+  it("folds recurring crash text across timestamps/instances but preserves raw provenance", () => {
+    const first = observation({ type: "crash", namespace: "dev", crash });
+    const next = observation({
+      type: "crash",
+      namespace: "dev",
+      crash: {
+        ...crash,
+        logLine: "2026-09-07T08:06:00.000000000Z Authentication failed",
+        logSource: "current",
+      },
+    });
+    expect(evidenceDisplaySnapshot(first)).toBe(evidenceDisplaySnapshot(next));
+    expect(evidenceSemanticSnapshot(first)).not.toBe(
+      evidenceSemanticSnapshot(next),
+    );
+    expect(crash.logSource).toBe("previous");
+  });
+  it("retains a new crash error, exit code, or affected pod", () => {
+    const first = observation({ type: "crash", namespace: "dev", crash });
+    for (const patch of [
+      { logLine: "Connection refused" },
+      { exitCode: 137 },
+      { pods: ["api-456"] },
+    ]) {
+      expect(evidenceDisplaySnapshot(first)).not.toBe(
+        evidenceDisplaySnapshot(
+          observation({
+            type: "crash",
+            namespace: "dev",
+            crash: { ...crash, ...patch },
+          }),
+        ),
+      );
+    }
+  });
+  it("folds event repetition counts, timestamps and ordering", () => {
+    const second = { ...event, reason: "Pulling", message: "Pulling image" };
+    const first = observation({
+      type: "events",
+      scope: "dev/api",
+      events: [event, second],
+    });
+    const next = observation({
+      type: "events",
+      scope: "dev/api",
+      events: [
+        second,
+        { ...event, count: 1074, lastTimestamp: "2026-09-07T08:06:00Z" },
+      ],
+    });
+    expect(evidenceDisplaySnapshot(first)).toBe(evidenceDisplaySnapshot(next));
+    expect(evidenceSemanticSnapshot(first)).not.toBe(
+      evidenceSemanticSnapshot(next),
+    );
+  });
+  it("retains new event reasons, details, scope and severity", () => {
+    const first = observation({
+      type: "events",
+      scope: "dev/api",
+      events: [event],
+    });
+    for (const patch of [
+      { reason: "FailedMount" },
+      { message: "New failure detail" },
+      { type: "Normal" },
+    ]) {
+      expect(evidenceDisplaySnapshot(first)).not.toBe(
+        evidenceDisplaySnapshot(
+          observation({
+            type: "events",
+            scope: "dev/api",
+            events: [{ ...event, ...patch }],
+          }),
+        ),
+      );
+    }
+    expect(evidenceDisplaySnapshot(first)).not.toBe(
+      evidenceDisplaySnapshot(
+        observation({ type: "events", scope: "prod/api", events: [event] }),
+      ),
+    );
+  });
+});
+
+function limitation(
+  source: string,
+  message: string,
+  kind: InvestigationEvidenceLimitation["kind"],
+  history = false,
+): InvestigationEvidenceLimitation {
+  return {
+    source,
+    message,
+    kind,
+    ...(history ? { presentation: "history" as const } : {}),
+    firstOrder: 0,
+    sources: [],
+  };
+}
+describe("coverage presentation", () => {
+  it.each(["Recent changes", "Container logs", "Issue change correlation"])(
+    "does not disguise unsummarizable %s as ordinary sampling",
+    (label) => {
+      const message =
+        "Radar couldn't summarize this investigation step. Review it in Activity.";
+      for (const notes of [
+        [limitation(label, message, "unknown")],
+        [
+          limitation(label, "Result limit reached", "truncated"),
+          limitation(label, message, "unknown"),
+        ],
+      ])
+        expect(groupEvidenceCoverage(notes)[0].summary).toContain(message);
+    },
+  );
+  it("turns the six overlapping notes into three impact groups, preserving every detail", () => {
+    const notes = [
+      limitation("Recent changes", "Result limit reached", "truncated"),
+      limitation("Recent changes", "Query narrowed", "truncated"),
+      limitation(
+        "Recent changes",
+        "Secret namespace history incomplete",
+        "unknown",
+        true,
+      ),
+      limitation(
+        "Issue change correlation",
+        "Not evaluated for every issue",
+        "truncated",
+      ),
+      limitation(
+        "Recent changes",
+        "Secret object history incomplete",
+        "unknown",
+        true,
+      ),
+      limitation("Container logs", "Log query narrowed", "truncated"),
+    ];
+    const groups = groupEvidenceCoverage(notes);
+    expect(groups.map((g) => [g.label, g.summary])).toEqual([
+      [
+        "Recent changes",
+        "Some changes may be missing; change history is incomplete.",
+      ],
+      [
+        "Issue change correlation",
+        "Not all issues were checked against recent changes.",
+      ],
+      ["Container logs", "Only part of the logs was checked."],
+    ]);
+    expect(groups.flatMap((g) => g.limitations)).toHaveLength(6);
+    expect(groups[0].limitations[0]).toBe(notes[0]);
+  });
+  it("keeps failed reads explicit and orders them ahead of ordinary limits", () => {
+    const groups = groupEvidenceCoverage([
+      limitation("Recent changes", "Query narrowed", "truncated"),
+      limitation("Container logs", "Logs sampled", "truncated"),
+      limitation("Container logs", "Forbidden: cannot read pod logs", "error"),
+      limitation("Container logs", "Connection timed out", "error"),
+    ]);
+    expect(groups[0].hasError).toBe(true);
+    expect(groups[0].summary).toContain("Forbidden");
+    expect(groups[0].summary).toContain("Connection timed out");
+    expect(groups[0].limitations).toHaveLength(3);
+  });
+  it("keeps history-only neutral and unknown limitations verbatim", () => {
+    expect(
+      groupEvidenceCoverage([
+        limitation("Recent changes", "No durable history", "unknown", true),
+      ])[0].historyOnly,
+    ).toBe(true);
+    expect(
+      groupEvidenceCoverage([
+        limitation("New producer", "No reliable coverage", "unknown"),
+      ])[0].summary,
+    ).toBe("No reliable coverage");
+    expect(groupEvidenceCoverage([])).toEqual([]);
+  });
+});

package/src/components/diagnose/investigationEvidencePresentation.ts

@@ -0,0 +1,167 @@
+import { parseLogLine } from "../../utils/log-format";
+import {
+  evidenceSemanticSnapshot,
+  type InvestigationEvidenceObservation,
+  type InvestigationEvidenceLimitation,
+} from "./investigationEvidence";
+
+/** Display significance only. Never use this to discard records or bind citations. */
+export function evidenceDisplaySnapshot(
+  observation: Pick<
+    InvestigationEvidenceObservation,
+    "data" | "tone" | "title" | "summary"
+  >,
+): string {
+  const data = observation.data;
+  switch (data.type) {
+    case "resource": {
+      const { metadata, ...resource } = data.resource;
+      const identity = { ...metadata };
+      delete identity.resourceVersion;
+      delete identity.managedFields;
+      const context = data.resourceContext;
+      return JSON.stringify({
+        type: data.type,
+        resource: {
+          ...resource,
+          metadata: identity,
+          status: statusWithoutObservationTimes(resource.status),
+        },
+        // These summaries can carry live state even when the raw object is cached.
+        status: statusWithoutObservationTimes(context?.statusSummary),
+        workload: context?.workloadSummary,
+        issues: context?.issueSummary,
+        gitOps: data.gitOpsDiagnosis,
+        warnings: data.warnings.map(warningWithoutElapsedTime),
+      });
+    }
+    case "crash": {
+      const { logLine, ...crash } = data.crash;
+      return JSON.stringify({
+        type: data.type,
+        namespace: data.namespace,
+        crash: {
+          ...crash,
+          logSource: undefined,
+          logLine: parseLogLine(logLine).content,
+        },
+      });
+    }
+    case "events":
+      return JSON.stringify({
+        type: data.type,
+        scope: data.scope,
+        // Repetitions and collection time do not constitute a new finding.
+        events: data.events
+          .map(({ reason, message, type }) =>
+            JSON.stringify({ reason, message, type }),
+          )
+          .sort(),
+      });
+    default:
+      // Unknown evidence types keep their existing conservative comparison.
+      return evidenceSemanticSnapshot(observation);
+  }
+}
+
+// Only condition bookkeeping is normalized; similarly named configuration keys
+// and arbitrary status fields retain their exact values.
+function statusWithoutObservationTimes(status: unknown): unknown {
+  if (!status || typeof status !== "object" || Array.isArray(status))
+    return status;
+  const state = status as Record<string, unknown>;
+  if (!Array.isArray(state.conditions)) return status;
+  return {
+    ...state,
+    conditions: state.conditions.map((condition: unknown) => {
+      if (
+        !condition ||
+        typeof condition !== "object" ||
+        Array.isArray(condition)
+      )
+        return condition;
+      const finding = { ...(condition as Record<string, unknown>) };
+      delete finding.lastTransitionTime;
+      delete finding.lastUpdateTime;
+      delete finding.lastProbeTime;
+      delete finding.lastHeartbeatTime;
+      return finding;
+    }),
+  };
+}
+
+function warningWithoutElapsedTime(warning: string): string {
+  // Exact warning format from pkg/k8score/object_warnings.go. Preserve the
+  // distinction between a recent failure and one present since creation.
+  return warning
+    .replace(/^(Condition `[^`]+` for ~)[\d.dhms]+/, "$1<elapsed>")
+    .replace(/\(resource age: [\d.dhms]+\)\.$/, "(resource age: <elapsed>).");
+}
+
+export interface EvidenceCoverageGroup {
+  label: string;
+  summary: string;
+  limitations: InvestigationEvidenceLimitation[];
+  hasError: boolean;
+  historyOnly: boolean;
+}
+
+/** Group the presentation, not the underlying limitations or health qualification. */
+export function groupEvidenceCoverage(
+  limitations: InvestigationEvidenceLimitation[],
+): EvidenceCoverageGroup[] {
+  const byLabel = new Map<string, InvestigationEvidenceLimitation[]>();
+  for (const limitation of limitations) {
+    const entries = byLabel.get(limitation.source) ?? [];
+    entries.push(limitation);
+    byLabel.set(limitation.source, entries);
+  }
+  return [...byLabel]
+    .map(([label, entries]) => {
+      const errors = entries.filter((entry) => entry.kind === "error");
+      const historyOnly = entries.every(
+        (entry) => entry.kind === "unknown" && entry.presentation === "history",
+      );
+      const truncated = entries.some((entry) => entry.kind === "truncated");
+      const ordinaryLimits = entries.every(
+        (entry) =>
+          entry.kind === "truncated" ||
+          (entry.kind === "unknown" && entry.presentation === "history"),
+      );
+      let summary: string;
+      if (errors.length) {
+        // Never replace permission/transport failures with a benign sampling note.
+        summary = [...new Set(errors.map((entry) => entry.message))].join(
+          " · ",
+        );
+      } else if (ordinaryLimits && label === "Recent changes") {
+        summary = truncated
+          ? "Some changes may be missing; change history is incomplete."
+          : "Change history is incomplete.";
+      } else if (ordinaryLimits && label === "Container logs" && truncated) {
+        summary = "Only part of the logs was checked.";
+      } else if (
+        ordinaryLimits &&
+        label === "Issue change correlation" &&
+        truncated
+      ) {
+        summary = "Not all issues were checked against recent changes.";
+      } else {
+        summary = [...new Set(entries.map((entry) => entry.message))].join(
+          " · ",
+        );
+      }
+      return {
+        label,
+        summary,
+        limitations: entries,
+        hasError: errors.length > 0,
+        historyOnly,
+      };
+    })
+    .sort(
+      (a, b) =>
+        Number(b.hasError) - Number(a.hasError) ||
+        Number(a.historyOnly) - Number(b.historyOnly),
+    );
+}

package/src/components/diagnose/investigationExplanation.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { investigationExplanation } from "./investigationExplanation";
+import type { Turn } from "./parts";
+
+const turn = (overrides: Partial<Turn> = {}): Turn => ({
+  timeline: [],
+  diagnosis: null,
+  error: null,
+  status: "done",
+  ...overrides,
+});
+describe("assessment-local explanation", () => {
+  it("does not mistake an ordinary answer for an explanation", () => {
+    expect(
+      investigationExplanation([turn({ question: "Explain simply" })], 2),
+    ).toEqual({ status: "idle" });
+  });
+  it("restores the answer for its originating assessment without using newer answers", () => {
+    const answer = turn({
+      explainAssessment: 2,
+      diagnosis: { report: "Saved explanation" } as Turn["diagnosis"],
+    });
+    expect(
+      investigationExplanation(
+        [answer, turn({ explainAssessment: 8, status: "running" })],
+        2,
+      ),
+    ).toEqual({ status: "done", text: "Saved explanation" });
+  });
+  it("restores pending progress and lets the latest retry supersede a failure", () => {
+    const failed = turn({
+      explainAssessment: 2,
+      status: "error",
+      error: "Stopped",
+    });
+    expect(investigationExplanation([failed], 2)).toEqual({
+      status: "error",
+      error: "Stopped",
+    });
+    expect(
+      investigationExplanation(
+        [failed, turn({ explainAssessment: 2, status: "running" })],
+        2,
+      ),
+    ).toEqual({ status: "running" });
+  });
+  it("never displays thinking as an answer when the agent returns nothing", () => {
+    expect(
+      investigationExplanation(
+        [
+          turn({
+            explainAssessment: 2,
+            timeline: [{ kind: "thinking", text: "Let me think" }],
+          }),
+        ],
+        2,
+      ),
+    ).toEqual({
+      status: "error",
+      error: "The agent did not return an explanation.",
+    });
+  });
+});

package/src/components/diagnose/investigationExplanation.ts

@@ -0,0 +1,22 @@
+import type { AssessmentExplanation, Turn } from "./parts";
+
+export function investigationExplanation(
+  turns: readonly Turn[],
+  assessmentSequence: number,
+): AssessmentExplanation {
+  const turn = [...turns]
+    .reverse()
+    .find((turn) => turn.explainAssessment === assessmentSequence);
+  if (!turn) return { status: "idle" };
+  if (turn.status === "running") return { status: "running" };
+  if (turn.status === "error")
+    return {
+      status: "error",
+      error: turn.error || "The explanation could not be completed.",
+    };
+  const text =
+    turn.diagnosis?.report?.trim() || turn.diagnosis?.rootCause?.trim();
+  return text
+    ? { status: "done", text }
+    : { status: "error", error: "The agent did not return an explanation." };
+}