@skyhook-io/radar-app 1.13.1 → 1.13.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.13.1",
+  "version": "1.13.3",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -41,7 +41,7 @@
     "yaml": "^2.9.0"
   },
   "peerDependencies": {
-    "@skyhook-io/k8s-ui": ">=1.13.4",
+    "@skyhook-io/k8s-ui": ">=1.14.2",
     "@tanstack/react-query": ">=5",
     "@xyflow/react": ">=12.0.0",
     "clsx": ">=2",

package/src/App.tsx

@@ -2464,7 +2464,25 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           below the header and right of the nav rail, sharing the frame with the
           drawers above. Docked = right slot (pushes content via contentGutter);
           maximized = fills the frame. */}
-      {diagnoseOpen && <DiagnoseSurface topInset={chromeless ? 0 : APP_HEADER_HEIGHT} />}
+      {diagnoseOpen && (
+        <DiagnoseSurface
+          topInset={chromeless ? 0 : APP_HEADER_HEIGHT}
+          onOpenResource={(ref) => {
+            const resource: SelectedResource = {
+              kind: ref.kind,
+              namespace: ref.namespace ?? '',
+              name: ref.name,
+              group: ref.group,
+            }
+            const path = relatedResourcePath(resource)
+            if (path.startsWith('/workload/')) {
+              navigate(path)
+              return
+            }
+            navigateFromIssue(resource)
+          }}
+        />
+      )}
 
       {/* Port Forward floating panel (indicator lives in header) */}
       <PortForwardPanel />

package/src/RadarApp.tsx

@@ -106,10 +106,10 @@ export interface RadarAppProps {
    */
   documentTitleSuffix?: string;
   /**
-   * Injects a resource-level "Diagnose" action (e.g. a "Diagnose with AI"
+   * Injects a resource-level "Investigate" action (e.g. an "Investigate with AI"
    * button) into every resource detail action bar's right-aligned universal
    * actions. The host returns the node to render given the resource context.
-   * Standalone Radar omits this and renders no Diagnose button — OSS stays
+   * Standalone Radar omits this and renders no Investigate button — OSS stays
    * agent-free. See ./context/DiagnoseCustomization for the render-prop shape.
    */
   renderDiagnoseAction?: RenderDiagnoseAction;

package/src/api/diagnose.test.ts

@@ -0,0 +1,268 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createRun, subscribeRun, type DiagnoseStreamEvent } from "./diagnose";
+
+type SSEListener = (event: { data: string; lastEventId: string }) => void;
+
+class FakeEventSource {
+  static CLOSED = 2;
+  static instances: FakeEventSource[] = [];
+
+  readyState = 1;
+  onopen: (() => void) | null = null;
+  onerror: (() => void) | null = null;
+  closed = false;
+  private listeners = new Map<string, SSEListener>();
+
+  constructor(
+    readonly url: string,
+    readonly options?: EventSourceInit,
+  ) {
+    FakeEventSource.instances.push(this);
+  }
+
+  addEventListener(type: string, listener: SSEListener) {
+    this.listeners.set(type, listener);
+  }
+
+  emit(type: string, event: DiagnoseStreamEvent, lastEventId = "") {
+    this.listeners.get(type)?.({ data: JSON.stringify(event), lastEventId });
+  }
+
+  close() {
+    this.closed = true;
+  }
+}
+
+describe("createRun", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it.each(["argoproj.io", ""])(
+    "sends the target API group %j in the request body",
+    async (group) => {
+      const fetchMock = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          id: "run-1",
+          kind: "Rollout",
+          group,
+          namespace: "prod",
+          name: "checkout",
+        }),
+      });
+      vi.stubGlobal("fetch", fetchMock);
+
+      await createRun(
+        {
+          kind: "Rollout",
+          group,
+          namespace: "prod",
+          name: "checkout",
+        },
+        { agent: "codex" },
+      );
+
+      const init = fetchMock.mock.calls[0]?.[1] as RequestInit;
+      expect(JSON.parse(String(init.body))).toEqual({
+        kind: "Rollout",
+        group,
+        namespace: "prod",
+        name: "checkout",
+        agent: "codex",
+      });
+    },
+  );
+});
+
+it("passes durable SSE sequence IDs and explanation origin through replay", () => {
+  vi.stubGlobal("EventSource", FakeEventSource);
+  const onEvent = vi.fn();
+  const close = subscribeRun("sequence-test", { onEvent });
+  const source = FakeEventSource.instances.at(-1)!;
+  source.emit("done", { type: "done" }, "42");
+  source.emit("turn", { type: "turn", explainAssessment: 42 }, "43");
+  expect(onEvent).toHaveBeenNthCalledWith(1, { type: "done" }, 42);
+  expect(onEvent).toHaveBeenNthCalledWith(
+    2,
+    { type: "turn", explainAssessment: 42 },
+    43,
+  );
+  close();
+  vi.unstubAllGlobals();
+});
+
+describe("subscribeRun replay boundaries", () => {
+  beforeEach(() => {
+    FakeEventSource.instances = [];
+    vi.stubGlobal("EventSource", FakeEventSource);
+  });
+
+  afterEach(() => vi.unstubAllGlobals());
+
+  it("brackets every connection replay and forwards the completion marker", () => {
+    const starts = vi.fn();
+    const events: DiagnoseStreamEvent[] = [];
+    const cancel = subscribeRun("run-1", {
+      onReplayStart: starts,
+      onEvent: (event) => events.push(event),
+    });
+    const source = FakeEventSource.instances[0]!;
+
+    source.onopen?.();
+    source.emit("turn", { type: "turn" });
+    source.emit("replay_complete", { type: "replay_complete" });
+    source.onopen?.(); // EventSource reconnects through the same instance.
+
+    expect(starts).toHaveBeenCalledTimes(2);
+    expect(events.map((event) => event.type)).toEqual([
+      "turn",
+      "replay_complete",
+    ]);
+    cancel();
+    expect(source.closed).toBe(true);
+  });
+
+  it("distinguishes a durable closed sentinel from an unavailable stream", () => {
+    const durableClose = vi.fn();
+    subscribeRun("run-1", {
+      onEvent: vi.fn(),
+      onClosed: durableClose,
+    });
+    const closedSource = FakeEventSource.instances[0]!;
+    closedSource.emit("closed", { type: "closed" });
+    closedSource.readyState = FakeEventSource.CLOSED;
+    closedSource.onerror?.();
+    expect(durableClose).toHaveBeenCalledWith("run_closed");
+    expect(durableClose).toHaveBeenCalledTimes(1);
+
+    const unavailable = vi.fn();
+    subscribeRun("run-2", {
+      onEvent: vi.fn(),
+      onClosed: unavailable,
+    });
+    const source = FakeEventSource.instances[1]!;
+    source.readyState = FakeEventSource.CLOSED;
+    source.onerror?.();
+    expect(unavailable).toHaveBeenCalledWith("unavailable");
+  });
+
+  it("forwards hydration failures while preserving only retryable reconnects", () => {
+    const retryEvents: DiagnoseStreamEvent[] = [];
+    subscribeRun("run-retry", {
+      onEvent: (event) => retryEvents.push(event),
+    });
+    const retrySource = FakeEventSource.instances[0]!;
+    retrySource.emit("history_unavailable", {
+      type: "history_unavailable",
+      error: "history store is busy",
+      retryable: true,
+    });
+    expect(retryEvents).toEqual([
+      {
+        type: "history_unavailable",
+        error: "history store is busy",
+        retryable: true,
+      },
+    ]);
+    expect(retrySource.closed).toBe(false);
+
+    const permanentEvents: DiagnoseStreamEvent[] = [];
+    subscribeRun("run-permanent", {
+      onEvent: (event) => permanentEvents.push(event),
+    });
+    const permanentSource = FakeEventSource.instances[1]!;
+    permanentSource.emit("history_unavailable", {
+      type: "history_unavailable",
+      error: "history cannot be decoded",
+      retryable: false,
+    });
+    expect(permanentEvents.map((event) => event.type)).toEqual([
+      "history_unavailable",
+    ]);
+    expect(permanentSource.closed).toBe(true);
+  });
+
+  it("ignores a trailing closed frame after a permanent history failure", () => {
+    const events: DiagnoseStreamEvent[] = [];
+    const onClosed = vi.fn();
+    subscribeRun("run-corrupt-history", {
+      onEvent: (event) => events.push(event),
+      onClosed,
+    });
+    const source = FakeEventSource.instances[0]!;
+
+    source.emit("history_unavailable", {
+      type: "history_unavailable",
+      error: "history cannot be decoded",
+      retryable: false,
+    });
+    // This frame can already be queued when history_unavailable closes the
+    // EventSource. It must not relabel the run as evicted in InvestigationView.
+    source.emit("closed", { type: "closed" });
+
+    expect(events).toEqual([
+      {
+        type: "history_unavailable",
+        error: "history cannot be decoded",
+        retryable: false,
+      },
+    ]);
+    expect(onClosed).not.toHaveBeenCalled();
+  });
+
+  it("forwards evidence-backed apply outcomes on terminal events", () => {
+    const events: DiagnoseStreamEvent[] = [];
+    subscribeRun("run-apply", {
+      onEvent: (event) => events.push(event),
+    });
+    const source = FakeEventSource.instances[0]!;
+    source.emit("done", {
+      type: "done",
+      applyOutcome: "confirmed",
+      diagnosis: {
+        rootCause: "",
+        report: "Deployment updated.",
+        remediation: [],
+      },
+    });
+    source.emit("error", {
+      type: "error",
+      applyOutcome: "unknown",
+      error: "The write result was incomplete.",
+    });
+
+    expect(events).toEqual([
+      expect.objectContaining({ type: "done", applyOutcome: "confirmed" }),
+      expect.objectContaining({ type: "error", applyOutcome: "unknown" }),
+    ]);
+  });
+});
+
+describe("investigation start requests", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  const target = {
+    kind: "Deployment",
+    group: "apps",
+    namespace: "prod",
+    name: "payments",
+    issueId: "issue-1",
+  };
+
+  it.each([
+    ["investigate further", target],
+    ["start fresh", { ...target, fresh: true }],
+  ])("preserves the %s intent on the wire", async (_name, request) => {
+    const fetch = vi
+      .fn()
+      .mockResolvedValue(new Response(JSON.stringify({ id: "new-run" })));
+    vi.stubGlobal("fetch", fetch);
+    await createRun(request, { agent: "hub" });
+    const init = fetch.mock.calls[0][1] as RequestInit;
+    expect(init.method).toBe("POST");
+    expect(JSON.parse(init.body as string)).toEqual({
+      ...request,
+      agent: "hub",
+    });
+    expect(JSON.parse(init.body as string).issueId).toBe("issue-1");
+  });
+});

package/src/api/diagnose.ts

@@ -1,4 +1,4 @@
-// Client for the local AI-diagnose engine (OSS BYO-agent). The agent CLI runs
+// Client for local AI investigations (OSS BYO-agent). The agent CLI runs
 // on the user's own machine/subscription against Radar's MCP; this just starts
 // the investigation and consumes its SSE event stream.
 import { getApiBase, getAuthHeaders, getCredentialsMode } from "./config";
@@ -13,12 +13,14 @@ export interface AgentInfo {
   profiles?: ExecutionProfile[];
   consentSurfaces?: Partial<Record<ExecutionProfile, string>>;
   hosted?: boolean;
+  /** Hosted backends opt in only when they implement assessment-bound, tool-free explanations. */
+  assessmentExplanations?: boolean;
 }
 
 export interface AgentsResponse {
   agents: AgentInfo[];
   enabled: boolean;
-  // eligible: this run mode supports local BYO-agent diagnosis (no proxy/OIDC
+  // eligible: this run mode supports local BYO-agent investigations (no proxy/OIDC
   // auth, /mcp mounted) — true even when no agent is installed. Lets the UI tell
   // "install an agent to enable this" (eligible && !enabled) apart from "not
   // available here" (auth/cloud/--no-mcp). Absent on older servers / embed hosts.
@@ -37,13 +39,24 @@ export interface DiagnoseStep {
   ms?: number;
   summary?: string; // input args (on running)
   result?: string; // result text (on done), capped
+  evidenceRef?: string; // server-issued reference used to bind a root cause to this exact result
+  // Server validated Radar's uncapped producer result and this retained result
+  // as its exact capped derivative.
+  radarEvidence?: boolean;
+  isError?: boolean; // authoritative agent-host result; absent means unknown
   truncated?: boolean; // result was capped — payload shown/copied is partial
 }
 
+export interface RootCauseEvidence {
+  status: "linked" | "missing" | "invalid";
+  refs?: string[];
+}
+
 export interface Diagnosis {
   healthy?: boolean;
   inconclusive?: boolean; // investigated but couldn't determine — distinct from healthy
   rootCause: string;
+  rootCauseEvidence?: RootCauseEvidence;
   report: string;
   remediation: string[];
   recommendedIndex?: number; // 1-based index into remediation of the step Apply performs
@@ -72,8 +85,19 @@ export interface ResourceHealthSignal {
   auditFindings?: HealthLine[];
 }
 
+export type ApplyMutationOutcome = "confirmed" | "failed" | "unknown";
+
 export interface DiagnoseStreamEvent {
-  type: "turn" | "phase" | "step" | "thinking" | "done" | "error" | "closed";
+  type:
+    | "turn"
+    | "phase"
+    | "step"
+    | "thinking"
+    | "done"
+    | "error"
+    | "closed"
+    | "history_unavailable"
+    | "replay_complete";
   phase?: string;
   step?: DiagnoseStep;
   token?: string;
@@ -81,6 +105,16 @@ export interface DiagnoseStreamEvent {
   error?: string;
   question?: string; // on "turn"
   apply?: boolean; // on "turn"
+  verify?: boolean; // on "turn": explicit post-change re-check
+  explainAssessment?: number; // on "turn": originating assessment done-event sequence
+  // Evidence-backed mutation truth on an apply turn's terminal event. Only
+  // "confirmed" means a Radar write tool authoritatively reported success.
+  applyOutcome?: ApplyMutationOutcome;
+  // On an apply terminal event, the server durably queued the adjacent
+  // read-only verification turn. This prevents an idle control flash between
+  // the two SSE events without inferring lifecycle from copy.
+  verificationScheduled?: boolean;
+  retryable?: boolean; // on "history_unavailable": keep native EventSource reconnect alive
   actor?: string; // human author on shared hosted transcripts
 }
 
@@ -90,6 +124,8 @@ export interface DiagnoseStreamEvent {
 export interface RunSummary {
   id: string;
   kind: string;
+  /** Kubernetes API group; empty means the core API group. */
+  group: string;
   namespace: string;
   name: string;
   /** The issue this session is for, on hosts that key sessions by issue. Always
@@ -153,6 +189,8 @@ const RUNS = () => `${getApiBase()}/diagnose/runs`;
 export async function createRun(
   target: {
     kind: string;
+    /** Kubernetes API group; empty means the core API group. */
+    group: string;
     namespace: string;
     name: string;
     // Associates the session with the issue it was started from, for hosts that
@@ -256,7 +294,13 @@ export async function clearHistory(): Promise<void> {
 // addTurn appends a follow-up (question) or an apply turn (apply + confirmed fix).
 export async function addTurn(
   id: string,
-  body: { question?: string; apply?: boolean; fix?: string },
+  body: {
+    question?: string;
+    apply?: boolean;
+    fix?: string;
+    verify?: boolean;
+    explainAssessment?: number;
+  },
 ): Promise<void> {
   const res = await fetch(`${RUNS()}/${id}/turns`, {
     method: "POST",
@@ -277,8 +321,11 @@ export async function stopRun(id: string): Promise<void> {
 }
 
 export interface SubscribeHandlers {
-  onEvent: (ev: DiagnoseStreamEvent) => void;
-  onClosed?: () => void; // the run can no longer produce events (stale/evicted)
+  onEvent: (ev: DiagnoseStreamEvent, sequence?: number) => void;
+  // EventSource fires open before each initial/reconnect replay. Together with
+  // replay_complete this brackets history so consumers can rebuild silently.
+  onReplayStart?: () => void;
+  onClosed?: (reason: "run_closed" | "unavailable") => void;
 }
 
 /**
@@ -302,6 +349,11 @@ export function subscribeRun(
     es.close();
   };
   const dispatch = (e: MessageEvent) => {
+    // close() can run while an earlier SSE callback is being dispatched. Ignore
+    // any already-queued trailing frame (notably the server's `closed` sentinel
+    // after a permanent history_unavailable) so it cannot replace the specific
+    // failure explanation with a generic eviction state.
+    if (closed) return;
     let ev: DiagnoseStreamEvent;
     try {
       ev = JSON.parse(e.data);
@@ -310,11 +362,21 @@ export function subscribeRun(
     }
     if (ev.type === "closed") {
       close();
-      handlers.onClosed?.();
+      handlers.onClosed?.("run_closed");
       return;
     }
-    handlers.onEvent(ev);
+    const sequence = Number(e.lastEventId);
+    handlers.onEvent(
+      ev,
+      Number.isSafeInteger(sequence) && sequence > 0 ? sequence : undefined,
+    );
+    // Hydration failures stay inside the SSE protocol. Retryable failures end
+    // this response and let native EventSource reconnect without advancing its
+    // cursor; a permanent failure must stop that reconnect loop after the UI
+    // receives the explanatory event.
+    if (ev.type === "history_unavailable" && ev.retryable !== true) close();
   };
+  es.onopen = () => handlers.onReplayStart?.();
   for (const t of [
     "turn",
     "phase",
@@ -323,10 +385,13 @@ export function subscribeRun(
     "done",
     "error",
     "closed",
+    "history_unavailable",
+    "replay_complete",
   ] as const) {
     es.addEventListener(t, dispatch);
   }
   es.onerror = () => {
+    if (closed) return;
     // A permanent failure (readyState CLOSED) means the run is gone — a 404 because
     // it was evicted (retention cap) or lost on a server restart. Surface it as
     // closed so the view shows a "no longer available" state instead of a silent
@@ -334,7 +399,7 @@ export function subscribeRun(
     // replays only what we missed), so leave those to EventSource.
     if (es.readyState === EventSource.CLOSED) {
       close();
-      handlers.onClosed?.();
+      handlers.onClosed?.("unavailable");
     }
   };
   return close;

package/src/components/diagnose/AISettings.tsx

@@ -1,5 +1,5 @@
 // The agent/model/effort controls + a clear-history action for the Settings
-// "AI diagnose" tab. Controlled by the dialog: it edits a STAGED draft committed
+// "AI investigations" tab. Controlled by the dialog: it edits a STAGED draft committed
 // on Save (like the rest of Settings), not on every keystroke. The heading,
 // description, and Save button live in the dialog so this tab matches the other
 // Settings tabs' layout — this renders only the controls (no card, no heading).

package/src/components/diagnose/AgentSetupNotice.tsx

@@ -52,7 +52,7 @@ function AgentRow({ agent }: { agent: AgentInstall }) {
   );
 }
 
-// Shown in the AI surface's Home when diagnosis is eligible in this deployment
+// Shown in the AI surface's Home when investigations are eligible in this deployment
 // but not runnable yet — either no agent CLI is installed ("needs-install") or a
 // supported one appeared after Radar booted ("needs-restart"). Radar decides the
 // engine once at startup, so a fresh install needs a restart to take effect.
@@ -69,8 +69,8 @@ export function AgentSetupNotice({
       </div>
       <h3 className="text-base font-semibold text-theme-text-primary">
         {needsRestart
-          ? "Restart Radar to enable AI diagnosis"
-          : "Set up AI diagnosis"}
+          ? "Restart Radar to enable AI investigations"
+          : "Set up AI investigations"}
       </h3>
       <p className="mt-1 text-sm text-theme-text-secondary">
         {needsRestart ? (
@@ -109,8 +109,8 @@ export function AgentSetupNotice({
       </button>
 
       <p className="mt-4 text-xs text-theme-text-tertiary">
-        The agent reads this cluster through Radar and finds the root cause. It
-        never leaves your machine.
+        Your agent runs locally. Resource details and logs are sent to its model
+        provider under your account, not to Radar.
       </p>
     </div>
   );

package/src/components/diagnose/ApplyDialog.test.tsx

@@ -0,0 +1,72 @@
+import type { ReactNode } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+import { ApplyDialog } from "./parts";
+import { AgentSetupNotice } from "./AgentSetupNotice";
+
+vi.mock("@skyhook-io/k8s-ui/components/ui/DialogPortal", () => ({
+  DialogPortal: ({ open, children }: { open: boolean; children: ReactNode }) =>
+    open ? children : null,
+}));
+
+describe("Apply confirmation context", () => {
+  it.each([
+    "gke_project-a_us-east1-b_nonprod",
+    "gke_project-b_us-east1-b_nonprod",
+  ])(
+    "identifies the exact destination %s even when display names collide",
+    (context) => {
+      const html = renderToStaticMarkup(
+        <ApplyDialog
+          open
+          onClose={() => {}}
+          onConfirm={() => {}}
+          agentLabel="Local agent"
+          resourceLabel="Deployment dev/api"
+          context={context}
+          fix="Only after verifying credentials, update the Secret reference."
+        />,
+      );
+      expect(html).toContain("Cluster:");
+      expect(html).toContain("nonprod");
+      expect(html).toContain(context);
+      expect(html).toContain("Deployment dev/api");
+      expect(html).toContain("Proposed change");
+      expect(html).not.toContain("What will happen");
+      expect(html).not.toContain("max-h-48");
+      expect(html).toContain("Only after verifying credentials");
+    },
+  );
+
+  it("keeps managed-resource acknowledgement and low-confidence warning", () => {
+    const html = renderToStaticMarkup(
+      <ApplyDialog
+        open
+        onClose={() => {}}
+        onConfirm={() => {}}
+        agentLabel="Local agent"
+        resourceLabel="Deployment dev/api"
+        context="kind-dev"
+        fix="Update its configuration"
+        managedBy="Argo CD"
+        confidence={0.3}
+      />,
+    );
+    expect(html).toContain("I understand Argo CD may revert this");
+    const applyButton = html
+      .match(/<button\b[^>]*>[\s\S]*?<\/button>/g)
+      ?.find((button) => button.includes("Apply fix"));
+    expect(applyButton).toContain('disabled=""');
+    expect(html).toContain("low confidence");
+    expect(html.match(/kubeconfig/g)).toHaveLength(1);
+  });
+});
+
+it("distinguishes local execution from sending resource data to the model provider", () => {
+  const html = renderToStaticMarkup(
+    <AgentSetupNotice setupState="needs-install" />,
+  );
+  expect(html).toContain("Your agent runs locally");
+  expect(html).toContain("model provider under your account, not to Radar");
+  expect(html).not.toContain("never leaves your machine");
+});