@skyhook-io/radar-app 1.13.2 → 1.13.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.13.2",
+  "version": "1.13.4",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "diff": "^9.0.0",
     "monaco-editor": "0.55.1",
     "react-markdown": "^10.1.0",
-    "react-virtuoso": "^4.18.12",
+    "react-virtuoso": "^4.18.13",
     "remark-gfm": "^4.0.1",
     "shiki": "^4.4.2",
     "yaml": "^2.9.0"
@@ -58,7 +58,7 @@
     "@skyhook-io/k8s-ui": "*",
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query": "^5.101.4",
+    "@tanstack/react-query": "^5.102.8",
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.3",
@@ -66,16 +66,16 @@
     "@xyflow/react": "^12.11.2",
     "clsx": "^2.1.1",
     "elkjs": "^0.11.1",
-    "eslint": "^10.8.0",
+    "eslint": "^10.10.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^17.11.0",
     "lucide-react": "^1.37.0",
-    "postcss": "^8.5.26",
+    "postcss": "^8.5.28",
     "prettier": "^3.9.5",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "react-router-dom": "^7.18.2",
+    "react-router-dom": "^7.18.3",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.2",

package/src/App.tsx

@@ -7,7 +7,7 @@ import { useNavigate, useLocation, useSearchParams, useNavigationType, Navigatio
 import { HomeView } from './components/home/HomeView'
 import { DebugOverlay } from './components/DebugOverlay'
 import { GlobalDiagnoseButton } from './components/diagnose/LocalDiagnoseAction'
-import { useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
+import { investigationWorkspaceSearch, isInvestigationWorkspacePath, useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
 import { DiagnoseSurface } from './components/diagnose/DiagnoseSurface'
 import { TopologyGraph, TopologySearch, TopologyBreadcrumb, TopologyFilterSidebar, TopologyControls, FreshnessControl, gitOpsRouteForKind, gitOpsRouteForResource, ScopePill, PaneLoader, assetUrl } from '@skyhook-io/k8s-ui'
 import { initNavigationMap } from '@skyhook-io/k8s-ui/utils/navigation'
@@ -120,7 +120,7 @@ const FLEET_MODE_KINDS = new Set<NodeKind>([
 
 // Convert API resource name back to topology node ID prefix
 // Extended MainView type that includes traffic and cost
-type ExtendedMainView = MainView | 'traffic' | 'cost' | 'capacity' | 'workload' | 'checks' | 'gitops' | 'compare' | 'helmCompare' | 'issues' | 'applications'
+type ExtendedMainView = MainView | 'traffic' | 'cost' | 'capacity' | 'workload' | 'checks' | 'gitops' | 'compare' | 'helmCompare' | 'issues' | 'applications' | 'investigations'
 
 // Extract view from URL path
 function getViewFromPath(pathname: string): ExtendedMainView {
@@ -140,6 +140,7 @@ function getViewFromPath(pathname: string): ExtendedMainView {
   if (path === 'applications') return 'applications'
   if (path === 'compare') return 'compare'
   if (path === 'issues') return 'issues'
+  if (path === 'investigations') return 'investigations'
   return 'home'
 }
 
@@ -325,7 +326,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // static. contentGutter is the docked panel width (0 when closed/overlay/maximized).
   const {
     open: diagnoseOpen,
-    close: closeDiagnose,
+    dismissForNavigation: dismissDiagnoseForNavigation,
     contentGutter,
     maximized: diagnoseMaximized,
   } = useDiagnoseLayout()
@@ -475,10 +476,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     const path = view === 'home' ? '/' : `/${view}`
 
     // Start fresh — keep only cross-view params, discard view-specific ones.
-    // Read the live location because Diagnose owns `ai-run` through the History
-    // API; React Router's searchParams snapshot does not update for that write.
+    // React Router owns navigation state. In embedded MemoryRouter mode the
+    // browser URL intentionally does not change, so window.location is stale.
     const newParams = new URLSearchParams()
-    const currentParams = new URLSearchParams(window.location.search)
+    const currentParams = new URLSearchParams(location.search)
     const globalNamespaces = currentParams.get('namespaces')
     if (globalNamespaces) {
       newParams.set('namespaces', globalNamespaces)
@@ -496,7 +497,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     }
 
     navigate({ pathname: path, search: newParams.toString() })
-  }, [navigate, takeover, goHost])
+  }, [location.search, navigate, takeover, goHost])
 
   // The standalone rail expresses intent to leave the full-width investigation
   // workspace. Close it before routing so the destination is immediately visible;
@@ -504,10 +505,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   const handlePrimaryNavigate = useCallback((view: ExtendedMainView) => {
     navigateFromPrimaryRail(
       diagnoseOpen && diagnoseMaximized,
-      closeDiagnose,
+      dismissDiagnoseForNavigation,
       () => setMainView(view),
     )
-  }, [diagnoseOpen, diagnoseMaximized, closeDiagnose, setMainView])
+  }, [diagnoseOpen, diagnoseMaximized, dismissDiagnoseForNavigation, setMainView])
 
   // Cloud (embedded) takes over the "fleet-shaped" per-cluster views with its
   // own fleet pages scoped to this cluster — owned by the host's left rail — so
@@ -730,7 +731,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // duplicated verbatim at each render site. Encodes the opened resource in the
   // URL (?resource=ns/name) — the same deep-link shape the resources view
   // round-trips — so refresh/share keeps the drawer open instead of dropping it.
-  const navigateToResourceList = useCallback((resource: SelectedResource) => {
+  const navigateToResourceList = useCallback((resource: SelectedResource, investigationRunID?: string | null) => {
     const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? '')
     setSelectedResource({ ...resource, kind: pluralKind })
     const newParams = new URLSearchParams(searchParams)
@@ -748,10 +749,12 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     } else {
       newParams.delete('apiGroup')
     }
+    if (investigationRunID === null) newParams.delete('ai-run')
+    else if (investigationRunID) newParams.set('ai-run', investigationRunID)
     navigate({ pathname: `/resources/${pluralKind}`, search: newParams.toString() })
   }, [searchParams, navigate])
 
-  const navigateToHelmRelease = useCallback((namespace: string, name: string, storageNamespace?: string) => {
+  const navigateToHelmRelease = useCallback((namespace: string, name: string, storageNamespace?: string, investigationRunID?: string | null) => {
     const newParams = new URLSearchParams()
     const globalNamespaces = searchParams.get('namespaces')
     if (globalNamespaces) {
@@ -761,6 +764,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     if (storageNamespace) {
       newParams.set('releaseStorage', storageNamespace)
     }
+    if (investigationRunID) newParams.set('ai-run', investigationRunID)
     setSelectedHelmRelease({ namespace, name, storageNamespace })
     if (mainView === 'helm') {
       setSearchParams(newParams, { replace: true })
@@ -772,9 +776,9 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // From the Issues queue: special controller/manager subjects route to their
   // rich detail pages, not the generic resource drawer that's a dead-end for
   // them. Member resources (Pods, Services, …) fall through to resources.
-  const navigateFromIssue = useCallback((resource: SelectedResource) => {
+  const navigateFromIssue = useCallback((resource: SelectedResource, investigationRunID?: string | null) => {
     if (resource.kind === 'HelmRelease' && resource.group === 'helm.sh' && resource.namespace) {
-      navigateToHelmRelease(resource.namespace, resource.name)
+      navigateToHelmRelease(resource.namespace, resource.name, undefined, investigationRunID)
       return
     }
     const gitOpsPath = gitOpsRouteForResource({
@@ -783,10 +787,12 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       metadata: { namespace: resource.namespace ?? '', name: resource.name },
     })
     if (gitOpsPath) {
-      navigate(gitOpsPath)
+      const destination = new URL(gitOpsPath, window.location.origin)
+      if (investigationRunID) destination.searchParams.set('ai-run', investigationRunID)
+      navigate(`${destination.pathname}${destination.search}${destination.hash}`)
       return
     }
-    navigateToResourceList(resource)
+    navigateToResourceList(resource, investigationRunID)
   }, [navigate, navigateToHelmRelease, navigateToResourceList])
 
   // Collapse the over-list fullscreen back to the drawer = drop ?full=1 (and the
@@ -842,7 +848,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     gitops: 'g o', checks: 'g u', cost: 'g c', capacity: 'g p',
     // Non-rail views (reachable via deep links / actions, not the rail) get no
     // dedicated mnemonic — listed for exhaustiveness so the type stays total.
-    workload: '', compare: '', helmCompare: '',
+    workload: '', compare: '', helmCompare: '', investigations: '',
   }
   const views = Object.keys(VIEW_SHORTCUT_KEYS).filter(
     (v): v is ExtendedMainView => VIEW_SHORTCUT_KEYS[v as ExtendedMainView] !== '',
@@ -1162,10 +1168,23 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       // Reset resource-specific params while retaining the durable investigation
       // focus. Diagnose resolves runs by id and owns whether the focused run is
       // still readable after the context switch.
-      const nextParams = new URLSearchParams()
-      const diagnoseRun = new URLSearchParams(window.location.search).get('ai-run')
-      if (diagnoseRun) nextParams.set('ai-run', diagnoseRun)
-      navigate({ pathname: location.pathname, search: nextParams.toString() }, { replace: true })
+      if (isInvestigationWorkspacePath(location.pathname)) {
+        navigate(
+          {
+            pathname: location.pathname,
+            search: investigationWorkspaceSearch(location.search),
+          },
+          { replace: true, state: location.state },
+        )
+      } else {
+        const nextParams = new URLSearchParams()
+        const diagnoseRun = new URLSearchParams(location.search).get('ai-run')
+        if (diagnoseRun) nextParams.set('ai-run', diagnoseRun)
+        navigate(
+          { pathname: location.pathname, search: nextParams.toString() },
+          { replace: true, state: location.state },
+        )
+      }
 
       // Auto-unpause so the new cluster's topology loads immediately
       setTopologyPaused(false)
@@ -2467,7 +2486,8 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       {diagnoseOpen && (
         <DiagnoseSurface
           topInset={chromeless ? 0 : APP_HEADER_HEIGHT}
-          onOpenResource={(ref) => {
+          onBrowseIssues={() => setMainView('issues')}
+          onOpenResource={(ref, investigationRunID) => {
             const resource: SelectedResource = {
               kind: ref.kind,
               namespace: ref.namespace ?? '',
@@ -2476,10 +2496,35 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
             }
             const path = relatedResourcePath(resource)
             if (path.startsWith('/workload/')) {
-              navigate(path)
+              const destination = new URL(path, window.location.origin)
+              if (investigationRunID) destination.searchParams.set('ai-run', investigationRunID)
+              navigate(`${destination.pathname}${destination.search}${destination.hash}`)
               return
             }
-            navigateFromIssue(resource)
+            navigateFromIssue(resource, investigationRunID)
+          }}
+          onOpenTimeline={({ namespace, name }) => {
+            // Scope state and URL move together, as the Timeline's own
+            // namespace prompt does: the URL-write effect would otherwise
+            // restore the previous scope over the destination's `namespaces`
+            // while the URL-read effect applies it, and the two would alternate.
+            const params = new URLSearchParams({ q: name })
+            if (namespace) {
+              params.set('namespaces', namespace)
+              setNamespaces([namespace])
+              setActiveNamespace.mutate({ namespaces: [namespace] })
+            } else {
+              // A cluster-scoped subject changes nothing about scope, so the
+              // destination keeps the current one. That means a namespace
+              // filter can hide the very change that was clicked, because the
+              // Timeline drops events whose namespace is outside it. Widening
+              // instead has to move scope, URL and the server pick together —
+              // three coupled effects with their own ordering rules — so it is
+              // a change to make against that machinery, not here.
+              const globalNamespaces = searchParams.get('namespaces')
+              if (globalNamespaces) params.set('namespaces', globalNamespaces)
+            }
+            navigate({ pathname: '/timeline', search: params.toString() })
           }}
         />
       )}

package/src/RadarApp.tsx

@@ -135,6 +135,12 @@ export interface RadarAppProps {
    * Radar runs with `navSlots.chrome: 'none'`.
    */
   onClusterLoadStateChange?: (state: ClusterLoadState) => void;
+  /**
+   * Called after a focused investigation has been resolved by the server.
+   * Embedders whose chrome lives outside RadarApp's router can use this as a
+   * navigation hint without treating an unverified URL id as durable state.
+   */
+  onInvestigationFocus?: (runID: string) => void;
   /**
    * Selects the store backing the event timeline. Omit for the local event
    * store the Radar binary keeps (default, standalone behavior). Set
@@ -199,6 +205,7 @@ export function RadarApp({
   diagnoseConsent,
   initialPath,
   onClusterLoadStateChange,
+  onInvestigationFocus,
   timelineSource,
 }: RadarAppProps): React.ReactElement {
   // Apply runtime config during render so module-level singletons are set
@@ -228,7 +235,11 @@ export function RadarApp({
                   value={renderDiagnoseAction ?? defaultDiagnoseAction}
                   consentCopy={diagnoseConsent}
                 >
-                  <DiagnoseProvider browserURLState={router !== "memory"}>
+                  <DiagnoseProvider
+                    browserURLState={router !== "memory"}
+                    forceRouterURLState={router === "memory"}
+                    onFocusedRun={onInvestigationFocus}
+                  >
                     <App
                       manageDocumentTitle={manageDocumentTitle}
                       documentTitleSuffix={documentTitleSuffix}

package/src/api/client.ts

@@ -3516,21 +3516,35 @@ export function useRightsizingScan(namespaces: string[], context = "") {
   };
 }
 
-// Raw PromQL query (range). Used by HPA charts for status_current_replicas etc.
-export function usePromQLRange(
-  query: string,
+// An HPA's replica history: the count it currently observes and the count it
+// has decided on. Curated server-side so reading the HPA is the only grant
+// the chart needs; raw PromQL requires cluster-wide access.
+export interface PrometheusHPAMetrics {
+  namespace: string;
+  name: string;
+  range: string;
+  current: PrometheusQueryResult;
+  desired: PrometheusQueryResult;
+}
+
+export function usePrometheusHPAMetrics(
+  namespace: string,
+  name: string,
   range: PrometheusTimeRange = "1h",
   enabled = true,
 ) {
-  return useQuery<PrometheusQueryResult>({
-    queryKey: ["promql-range", query, range],
+  return useQuery<PrometheusHPAMetrics>({
+    queryKey: ["prometheus-hpa-metrics", namespace, name, range],
     queryFn: () =>
-      fetchJSON(
-        `/prometheus/query?query=${encodeURIComponent(query)}&range=${range}`,
-      ),
-    enabled: enabled && Boolean(query),
+      fetchJSON(`/prometheus/hpa/${namespace}/${name}?range=${range}`),
+    enabled: enabled && Boolean(namespace && name),
     staleTime: 30000,
-    refetchInterval: 60000,
+    // A denial is a standing RBAC fact, not a blip: show the access state at
+    // once and stop polling for it.
+    refetchInterval: (query) =>
+      isForbiddenError(query.state.error) ? false : 60000,
+    retry: (failureCount, error) =>
+      !isForbiddenError(error) && failureCount < 1,
   });
 }
 

package/src/api/diagnose.ts

@@ -13,6 +13,8 @@ export interface AgentInfo {
   profiles?: ExecutionProfile[];
   consentSurfaces?: Partial<Record<ExecutionProfile, string>>;
   hosted?: boolean;
+  /** Hosted backends opt in only when they implement assessment-bound, tool-free explanations. */
+  assessmentExplanations?: boolean;
 }
 
 export interface AgentsResponse {

package/src/components/diagnose/DiagnoseContext.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from "vitest";
+import {
+  investigationWorkspaceNavigationState,
+  investigationWorkspacePath,
+  investigationWorkspaceRestorePath,
+  investigationWorkspaceSearch,
+  isInvestigationWorkspacePath,
+  shouldExitUnavailableWorkspace,
+  workspaceRunIDFromPath,
+} from "./DiagnoseContext";
+
+describe("investigation workspace routes", () => {
+  it("recognizes the base workspace and selected-run routes", () => {
+    expect(isInvestigationWorkspacePath("/investigations")).toBe(true);
+    expect(isInvestigationWorkspacePath("/investigations/run_123")).toBe(true);
+    expect(workspaceRunIDFromPath("/investigations/run_123")).toBe("run_123");
+    expect(workspaceRunIDFromPath("/investigations/run%20one")).toBe("run one");
+  });
+
+  it("keeps only cross-view scope in workspace URLs", () => {
+    expect(
+      investigationWorkspaceSearch(
+        "?org=o1&namespaces=prod%2Cstage&ai-run=r1&resource=pod",
+      ),
+    ).toBe("?org=o1&namespaces=prod%2Cstage");
+  });
+
+  it("uses Home for global entry and an explicit route for drawer expansion", () => {
+    expect(investigationWorkspacePath(null)).toBe("/investigations");
+    expect(investigationWorkspacePath("run 123")).toBe(
+      "/investigations/run%20123",
+    );
+  });
+
+  it("builds opaque navigation state for a synthetic drawer return", () => {
+    expect(
+      investigationWorkspaceNavigationState({
+        returnPath: "/?ai-run=r1",
+        drawerOrigin: true,
+        closeHistorySteps: 2,
+      }),
+    ).toEqual({
+      investigationWorkspaceReturn: "/?ai-run=r1",
+      investigationReturnHistorySteps: "2",
+    });
+  });
+
+  it("restores the currently focused run into the original dock location", () => {
+    expect(
+      investigationWorkspaceRestorePath(
+        { investigationWorkspaceReturn: "/resources?kind=pods&ai-run=old#row" },
+        "new run",
+        "https://radar.local",
+      ),
+    ).toBe("/resources?kind=pods&ai-run=new+run#row");
+  });
+
+  it("falls back safely when a malformed return path normalizes cross-origin", () => {
+    expect(
+      investigationWorkspaceRestorePath(
+        { investigationWorkspaceReturn: "/\\\\evil.example" },
+        "run-1",
+        "https://radar.local",
+      ),
+    ).toBeNull();
+  });
+
+  it("exits only resolved AI-off workspace routes", () => {
+    expect(
+      shouldExitUnavailableWorkspace("/investigations/run-1", true, false),
+    ).toBe(true);
+    expect(
+      shouldExitUnavailableWorkspace("/investigations/run-1", false, false),
+    ).toBe(false);
+    expect(shouldExitUnavailableWorkspace("/?ai-run=run-1", true, false)).toBe(
+      false,
+    );
+  });
+
+  it("builds history-only return state for cross-tree workspace entry", () => {
+    expect(
+      investigationWorkspaceNavigationState({ closeHistorySteps: 1 }),
+    ).toEqual({ investigationReturnHistorySteps: "1" });
+  });
+
+  it("does not claim unrelated paths and rejects malformed run ids", () => {
+    expect(isInvestigationWorkspacePath("/resources/pods")).toBe(false);
+    expect(isInvestigationWorkspacePath("/investigations/run/extra")).toBe(
+      true,
+    );
+    expect(workspaceRunIDFromPath("/investigations")).toBeNull();
+    expect(workspaceRunIDFromPath("/investigations/%2Fbad")).toBeNull();
+    expect(workspaceRunIDFromPath("/investigations/%ZZ")).toBeNull();
+  });
+});