@skyhook-io/radar-app 1.13.2 → 1.13.4

package/src/components/diagnose/investigationExplanation.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, it } from "vitest";
-import { investigationExplanation } from "./investigationExplanation";
+import {
+  investigationExplanation,
+  supportsAssessmentExplanation,
+} from "./investigationExplanation";
+import type { AgentInfo } from "../../api/diagnose";
 import type { Turn } from "./parts";
 
 const turn = (overrides: Partial<Turn> = {}): Turn => ({
@@ -10,6 +14,31 @@ const turn = (overrides: Partial<Turn> = {}): Turn => ({
   ...overrides,
 });
 describe("assessment-local explanation", () => {
+  it("requires explicit hosted support without enabling mutations or changing local support", () => {
+    const agent: AgentInfo = {
+      name: "hub",
+      label: "Managed agent",
+      path: "",
+      version: "",
+      supported: true,
+      present: true,
+      hosted: true,
+    };
+    expect(supportsAssessmentExplanation(undefined)).toBe(false);
+    expect(supportsAssessmentExplanation(agent)).toBe(false);
+    expect(
+      supportsAssessmentExplanation({
+        ...agent,
+        assessmentExplanations: false,
+      }),
+    ).toBe(false);
+    expect(
+      supportsAssessmentExplanation({ ...agent, assessmentExplanations: true }),
+    ).toBe(true);
+    expect(supportsAssessmentExplanation({ ...agent, hosted: false })).toBe(
+      true,
+    );
+  });
   it("does not mistake an ordinary answer for an explanation", () => {
     expect(
       investigationExplanation([turn({ question: "Explain simply" })], 2),

package/src/components/diagnose/investigationExplanation.ts

@@ -1,4 +1,11 @@
 import type { AssessmentExplanation, Turn } from "./parts";
+import type { AgentInfo } from "../../api/diagnose";
+
+export function supportsAssessmentExplanation(
+  agent: AgentInfo | undefined,
+): boolean {
+  return !!agent && (!agent.hosted || agent.assessmentExplanations === true);
+}
 
 export function investigationExplanation(
   turns: readonly Turn[],

package/src/components/diagnose/investigationSourceFocus.ts

@@ -29,6 +29,10 @@ export function evidenceSourceExcerpt(
         ? keys[0]
         : undefined;
     }
+    case "helm":
+      return data.release.healthIssue;
+    case "permissions":
+      return data.accessCheck?.reason;
     default:
       return undefined;
   }

package/src/components/diagnose/parts.test.tsx

@@ -8,6 +8,7 @@ import {
   Timeline,
   TurnView,
   appendThinking,
+  remediationCommands,
   upsertTool,
   type TimelineItem,
   type Turn,
@@ -40,7 +41,9 @@ it("keeps earlier remediation copyable without suggesting it is executable", ()
     />,
   );
   expect(html).toContain("Restore the required Secret");
-  expect(html).toContain("Copy remediation step 1");
+  // Prose has nothing worth copying; only a command gets a copy button.
+  expect(html).not.toContain("Copy remediation step");
+  expect(html).not.toContain("Copy command");
   expect(html).toContain("Reassess before applying");
   expect(html).not.toContain("Apply…");
   expect(html).not.toContain("ask the agent to continue");
@@ -49,6 +52,48 @@ it("keeps earlier remediation copyable without suggesting it is executable", ()
   );
 });
 
+describe("remediation commands", () => {
+  it("extracts shell commands from inline code and fenced blocks, not identifiers", () => {
+    expect(
+      remediationCommands(
+        "Run `kubectl rollout undo deployment/api -n dev --to-revision=7` to revert; the `MONGO_PASSWORD` key in `Secret/api` stays.",
+      ),
+    ).toEqual(["kubectl rollout undo deployment/api -n dev --to-revision=7"]);
+    expect(
+      remediationCommands(
+        "Then:\n```bash\nhelm rollback prometheus 1 -n opencost\nkubectl -n opencost get pods\n```\nand check `mongosh --host nonprod-boxer.ax6bh.mongodb.net`.",
+      ),
+    ).toEqual([
+      "helm rollback prometheus 1 -n opencost\nkubectl -n opencost get pods",
+      "mongosh --host nonprod-boxer.ax6bh.mongodb.net",
+    ]);
+    expect(
+      remediationCommands("Pin the image to a digest instead of `latest`."),
+    ).toEqual([]);
+  });
+
+  it("offers one copy button per command in a step", () => {
+    const html = renderToStaticMarkup(
+      <ResultCard
+        diagnosis={
+          {
+            rootCause: "Stale credential",
+            report: "Assessment",
+            remediation: [
+              "Roll back with `kubectl rollout undo deployment/api -n dev` and then verify with `kubectl -n dev get pods`.",
+            ],
+          } as Diagnosis
+        }
+        section="actions"
+        compactActions
+      />,
+    );
+    expect(html).toContain("Copy command 1 of step 1");
+    expect(html).toContain("Copy command 2 of step 1");
+    expect(html).not.toContain("Copy remediation step");
+  });
+});
+
 describe("explanation placement", () => {
   it("gives analysis and explanation separate animated disclosure regions", () => {
     const html = renderToStaticMarkup(
@@ -581,6 +626,15 @@ describe("ResultCard conclusion states", () => {
     expect(html).not.toContain("border-emerald-500/30");
   });
 
+  it("lists a step's commands in reading order across inline and fenced code", () => {
+    const step =
+      "Roll it with `kubectl -n dev rollout restart deploy/api`, then verify:\n```bash\nkubectl -n dev rollout status deploy/api\n```";
+    expect(remediationCommands(step)).toEqual([
+      "kubectl -n dev rollout restart deploy/api",
+      "kubectl -n dev rollout status deploy/api",
+    ]);
+  });
+
   it("keeps a follow-up framed as an answer rather than a new conclusion", () => {
     const html = renderToStaticMarkup(
       <ResultCard

package/src/components/diagnose/parts.tsx

@@ -2045,7 +2045,17 @@ function DiagnosisResult({
                 Apply…
               </button>
             )}
-            <CopyButton text={r} label={`Copy remediation step ${i + 1}`} />
+            {remediationCommands(r).map((command, c, all) => (
+              <CopyButton
+                key={c}
+                text={command}
+                label={
+                  all.length > 1
+                    ? `Copy command ${c + 1} of step ${i + 1}`
+                    : `Copy command from step ${i + 1}`
+                }
+              />
+            ))}
           </div>
         </div>
       </div>
@@ -2603,6 +2613,63 @@ function ApplyOutcomeCard({
   );
 }
 
+const COMMAND_BINARIES = new Set([
+  "kubectl",
+  "helm",
+  "argocd",
+  "flux",
+  "kustomize",
+  "docker",
+  "gcloud",
+  "aws",
+  "az",
+  "mongosh",
+  "psql",
+  "redis-cli",
+  "curl",
+  "git",
+  "istioctl",
+  "velero",
+  "cilium",
+  "calicoctl",
+  "terraform",
+  "kn",
+  "oc",
+  "k9s",
+  "skyhook",
+]);
+
+/**
+ * The commands inside a remediation step, in order: every fenced block and
+ * every inline code span that reads as a shell invocation. A step's prose is
+ * never worth copying; a command is. The prompt asks the agent to wrap
+ * commands in backticks, so this is the seam to read them from.
+ */
+export function remediationCommands(step: string): string[] {
+  const commands: string[] = [];
+  // One pass in reading order, so button N is the Nth command in the text.
+  const code = /```[a-zA-Z]*\n([\s\S]*?)```|`([^`\n]+)`/g;
+  let match: RegExpExecArray | null;
+  while ((match = code.exec(step))) {
+    if (match[1] !== undefined) {
+      const body = match[1].trim();
+      if (body) commands.push(body);
+      continue;
+    }
+    const span = match[2].trim();
+    if (looksLikeCommand(span)) commands.push(span);
+  }
+  return commands;
+}
+
+function looksLikeCommand(span: string): boolean {
+  if (!/\s/.test(span)) return false;
+  const first = span.split(/\s+/)[0];
+  if (COMMAND_BINARIES.has(first)) return true;
+  // An unknown binary still reads as a command when it takes flags.
+  return /^[a-z][a-z0-9._-]*$/.test(first) && /(^|\s)--?[a-zA-Z]/.test(span);
+}
+
 function CopyButton({ text, label }: { text: string; label: string }) {
   const [copied, setCopied] = useState(false);
   return (

package/src/components/resource/HPACharts.render.test.tsx

@@ -0,0 +1,77 @@
+import { describe, expect, it, vi } from 'vitest'
+import { renderToString } from 'react-dom/server'
+
+// The access state is what is under test, so the fetch is stubbed rather than
+// run. isForbiddenError is deliberately NOT stubbed: a looser stand-in would
+// pass while the real predicate sent a denial down the silent-hide path, which
+// is the failure this component exists to prevent.
+import { ApiError } from '../../api/client'
+
+const forbidden = new ApiError('forbidden', 403)
+let metricsResult: { data?: unknown; error?: unknown } = {}
+let connected = true
+
+vi.mock('../../api/client', async (importActual) => ({
+  ...(await importActual<typeof import('../../api/client')>()),
+  usePrometheusHPAMetrics: () => metricsResult,
+  usePrometheusStatus: () => ({ data: { connected } }),
+  useAutoPromConnect: () => undefined,
+}))
+
+const { HPACharts } = await import('./HPACharts')
+
+const hpa = {
+  kind: 'HorizontalPodAutoscaler',
+  metadata: { namespace: 'shop', name: 'web' },
+  spec: { minReplicas: 2, maxReplicas: 10 },
+}
+
+const series = (values: number[]) => ({
+  resultType: 'matrix',
+  series: [{ labels: {}, dataPoints: values.map((value, i) => ({ timestamp: 1700000000 + i * 60, value })) }],
+})
+
+/**
+ * A denied chart must not look like an HPA that never scaled: an empty
+ * "no history" and "you may not see the history" are different facts.
+ */
+describe('HPACharts — access state', () => {
+  it('says the caller has no access when the curated endpoint returns 403', () => {
+    connected = true
+    metricsResult = { error: forbidden }
+    const html = renderToString(<HPACharts data={hpa} />)
+    expect(html).toContain('have access to metrics for this resource')
+    expect(html).toContain('Activity (last 1h)')
+    expect(html).not.toContain('Replicas')
+  })
+
+  it('plots the replica history when the endpoint answers', () => {
+    connected = true
+    metricsResult = { data: { current: series([2, 3, 4]), desired: series([4, 4, 4]) } }
+    const html = renderToString(<HPACharts data={hpa} />)
+    expect(html).toContain('Replicas')
+    expect(html).toContain('min 2')
+    expect(html).toContain('max 10')
+    expect(html).not.toContain('access to metrics')
+  })
+
+  it('stays hidden when KSM reports nothing for the HPA', () => {
+    connected = true
+    metricsResult = { data: { current: { resultType: 'matrix', series: [] }, desired: { resultType: 'matrix', series: [] } } }
+    expect(renderToString(<HPACharts data={hpa} />)).toBe('')
+  })
+
+  // A fault is not a denial: the chart keeps its silent-hide behaviour and
+  // leaves the breadcrumb to the console.
+  it('stays hidden on a non-authorization failure', () => {
+    connected = true
+    metricsResult = { error: new Error('Prometheus query failed') }
+    expect(renderToString(<HPACharts data={hpa} />)).toBe('')
+  })
+
+  it('stays hidden when Prometheus is not connected, even on a denial', () => {
+    connected = false
+    metricsResult = { error: forbidden }
+    expect(renderToString(<HPACharts data={hpa} />)).toBe('')
+  })
+})

package/src/components/resource/HPACharts.tsx

@@ -1,12 +1,15 @@
 import { useEffect, useMemo } from 'react'
-import { LineChart } from 'lucide-react'
-import { usePromQLRange, usePrometheusStatus, useAutoPromConnect, type PrometheusSeries } from '../../api/client'
+import { LineChart, Lock } from 'lucide-react'
+import { AlertBanner } from '@skyhook-io/k8s-ui'
+import { usePrometheusHPAMetrics, usePrometheusStatus, useAutoPromConnect, isForbiddenError, type PrometheusSeries } from '../../api/client'
 
 /**
  * HPACharts — replicas-over-time chart for an HPA.
  *
- * Sources from KSM `kube_horizontalpodautoscaler_status_{current,desired}_replicas`.
- * Hidden silently when Prom isn't connected or KSM isn't reporting the series.
+ * Sources from KSM `kube_horizontalpodautoscaler_status_{current,desired}_replicas`
+ * through the curated HPA metrics endpoint, which is gated on reading the HPA
+ * itself. Hidden silently when Prom isn't connected or KSM isn't reporting the
+ * series; a denial is shown, because an empty chart would read as "no history".
  *
  * Only the replicas series is plotted — KSM doesn't expose the observed metric
  * the HPA target compares against, so an "observed vs target" chart would need
@@ -25,35 +28,43 @@ export function HPACharts({ data }: { data: any }) {
   const min = spec.minReplicas ?? 1
   const max = spec.maxReplicas
 
-  const currentQuery = useMemo(
-    () => `kube_horizontalpodautoscaler_status_current_replicas{namespace="${escapeLabel(namespace)}",horizontalpodautoscaler="${escapeLabel(name)}"}`,
-    [namespace, name],
-  )
-  const desiredQuery = useMemo(
-    () => `kube_horizontalpodautoscaler_status_desired_replicas{namespace="${escapeLabel(namespace)}",horizontalpodautoscaler="${escapeLabel(name)}"}`,
-    [namespace, name],
-  )
-
   const enabled = isConnected && Boolean(namespace && name)
-  const { data: currentRes, error: currentErr } = usePromQLRange(currentQuery, '1h', enabled)
-  const { data: desiredRes, error: desiredErr } = usePromQLRange(desiredQuery, '1h', enabled)
+  const { data: metrics, error } = usePrometheusHPAMetrics(namespace, name, '1h', enabled)
 
   const replicasPoints = useMemo(() => combineSeries({
-    current: currentRes?.series,
-    desired: desiredRes?.series,
-  }), [currentRes, desiredRes])
+    current: metrics?.current?.series,
+    desired: metrics?.desired?.series,
+  }), [metrics])
 
   // Surface Prom-side failures in the console so an operator debugging a
   // missing HPA chart has a breadcrumb; the chart still hides silently when
   // KSM isn't reporting (the common no-data case). Effect-gated so we log
   // once per error change, not on every re-render.
   useEffect(() => {
-    if (currentErr || desiredErr) {
-      console.warn('[HPACharts] PromQL query failed', { currentErr, desiredErr })
+    if (error && !isForbiddenError(error)) {
+      console.warn('[HPACharts] HPA metrics query failed', { error })
     }
-  }, [currentErr, desiredErr])
+  }, [error])
 
   if (!isConnected) return null
+
+  if (isForbiddenError(error)) {
+    return (
+      <section className="mt-4 rounded-lg border border-theme-border bg-theme-surface/30 p-3">
+        <div className="flex items-center gap-2 mb-2 text-sm font-medium text-theme-text-secondary">
+          <LineChart className="w-4 h-4 text-theme-text-tertiary" />
+          Activity (last 1h)
+        </div>
+        <AlertBanner
+          variant="info"
+          icon={Lock}
+          title="You don't have access to metrics for this resource"
+          message="Replica history is available to users who can read this HorizontalPodAutoscaler."
+        />
+      </section>
+    )
+  }
+
   if (!replicasPoints) return null
 
   return (
@@ -111,10 +122,6 @@ function combineSeries(args: { current?: PrometheusSeries[]; desired?: Prometheu
   }
 }
 
-function escapeLabel(s: string): string {
-  return s.replace(/[\\"]/g, '\\$&')
-}
-
 // ============================================================================
 // DualLineChart — minimal two-line chart for HPA-style time series.
 // Deliberately separate from PrometheusCharts.AreaChart: the chart shapes are

package/src/components/resources/ResourcesView.tsx

@@ -1,13 +1,13 @@
 import { useState, useMemo, useCallback, useEffect } from 'react'
 import { useLocation, useNavigate } from 'react-router-dom'
 import { useQuery } from '@tanstack/react-query'
-import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
+import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useResources, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
 import { isBadgeWorthy } from '../../utils/auditBadges'
 import type { AuditBadgeMessage } from '@skyhook-io/k8s-ui'
 import { apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from '../../api/config'
 import { useAPIResources } from '../../api/apiResources'
 import { useConnection } from '../../context/ConnectionContext'
-import { initNavigationMap } from '@skyhook-io/k8s-ui'
+import { initNavigationMap, getSecretStoreProviderType } from '@skyhook-io/k8s-ui'
 import { usePinnedKinds } from '../../hooks/useFavorites'
 import { useOpenLogs, useOpenWorkloadLogs } from '../dock'
 import {
@@ -311,6 +311,30 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   // Certificate expiry
   const { data: certExpiry, isError: certExpiryError } = useSecretCertExpiry()
 
+  // An ExternalSecret names a store; only the store says which backend it reads
+  // from. Two list calls per page beat one lookup per row, and the column shows
+  // nothing rather than guessing when a store is unreadable or absent.
+  const viewingExternalSecrets = selectedKind?.name === 'externalsecrets'
+  const { data: secretStores, isPending: secretStoresPending } = useResources<any>('secretstores', undefined, undefined, { enabled: viewingExternalSecrets })
+  const { data: clusterSecretStores, isPending: clusterSecretStoresPending } = useResources<any>('clustersecretstores', undefined, undefined, { enabled: viewingExternalSecrets })
+  const storeProviders = useMemo(() => {
+    // Undefined until both lists have settled. An empty map would be
+    // indistinguishable from "every store is unreadable", and the column says
+    // that out loud.
+    if (!viewingExternalSecrets || secretStoresPending || clusterSecretStoresPending) return undefined
+    const map: Record<string, string> = {}
+    for (const store of secretStores ?? []) {
+      const ns = store?.metadata?.namespace
+      const name = store?.metadata?.name
+      if (ns && name) map[`${ns}/${name}`] = getSecretStoreProviderType(store)
+    }
+    for (const store of clusterSecretStores ?? []) {
+      const name = store?.metadata?.name
+      if (name) map[name] = getSecretStoreProviderType(store)
+    }
+    return map
+  }, [viewingExternalSecrets, secretStoresPending, clusterSecretStoresPending, secretStores, clusterSecretStores])
+
   // Pinned kinds
   const { pinned, togglePin, isPinned } = usePinnedKinds()
 
@@ -380,6 +404,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       topPodMetrics={topPodMetrics}
       topNodeMetrics={topNodeMetrics}
       certExpiry={certExpiry}
+      storeProviders={storeProviders}
       certExpiryError={certExpiryError}
       auditBadges={auditBadges}
       // Pinned kinds

package/src/index.ts

@@ -32,13 +32,15 @@ export type {
 } from './context/DiagnoseCustomization';
 
 // Standalone AI investigation surface — mount the investigation panel outside a
-// full <RadarApp>. No router dependency, no client-side cluster state: the
-// backend set via setApiBase() picks the cluster, so hosts remount
-// <DiagnoseProvider key={cluster}> to switch. Mount order: ThemeProvider >
-// DiagnoseCustomizationProvider > DiagnoseProvider > DiagnoseSurface, under a
-// @tanstack/react-query QueryClientProvider.
+// full <RadarApp>. It uses the nearest React Router for durable drawer/workspace
+// URLs, or supplies one when mounted standalone. The backend set via setApiBase()
+// picks the cluster, so hosts remount <DiagnoseProvider key={cluster}> to switch.
+// Mount order: ThemeProvider > DiagnoseCustomizationProvider > DiagnoseProvider
+// > DiagnoseSurface, under a @tanstack/react-query QueryClientProvider.
 export {
   DiagnoseProvider,
+  investigationWorkspaceNavigationState,
+  investigationWorkspaceSearch,
   useDiagnose,
   useDiagnoseLayout,
 } from './components/diagnose/DiagnoseContext';