@skyhook-io/radar-app 1.13.4 → 1.14.0

package/src/components/cloudConnectHandoff.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, it } from 'vitest'
+import { ApiError, type CloudInstallAttempted } from '../api/client'
+import { exitFor, handoffForBlocked, handoffForPrepareError, isHandoffOutcome, signupUrlFor } from './cloudConnectHandoff'
+
+const APP = 'https://app.test.example'
+const UTM = 'utm_source=radar-oss&utm_medium=app&utm_campaign=cloud-modal'
+const CARD = 'driver-blocked-card-browser-link'
+
+const attempted = (over: Partial<CloudInstallAttempted>): CloudInstallAttempted => ({
+  mode: 'fresh',
+  namespace: 'radar',
+  release: 'radar',
+  stage: 'preflight',
+  ...over,
+})
+
+describe('signupUrlFor', () => {
+  it('tags the link and omits the outcome when there was no attempt', () => {
+    expect(signupUrlFor(APP, 'driver-footer-browser-link')).toBe(`${APP}/signup?${UTM}&utm_content=driver-footer-browser-link`)
+    expect(signupUrlFor(APP, 'driver-footer-browser-link', null)).not.toContain('radar_outcome')
+  })
+
+  it('appends a well-formed outcome after an attempt', () => {
+    expect(signupUrlFor(APP, 'driver-footer-browser-link', { outcome: 'hub_connect_request_failed', retryable: true })).toMatch(
+      /utm_content=driver-footer-browser-link&radar_outcome=hub_connect_request_failed$/,
+    )
+  })
+
+  it('never forwards an outcome outside the vocabulary shape', () => {
+    // A server message or a cluster name must not ride along in the link.
+    for (const bad of ['connect failed: dial tcp 10.0.0.1', 'Prod-East', '', 'a'.repeat(41), 'x&y=1']) {
+      expect(signupUrlFor(APP, 'driver-footer-browser-link', { outcome: bad, retryable: true })).not.toContain('radar_outcome')
+    }
+  })
+})
+
+describe('exitFor — every blocked card has one exit, chosen by what Radar established', () => {
+  it('adopts a release Radar found, pinned to the Helm tab', () => {
+    const h = handoffForBlocked('preflight', attempted({ mode: 'adopt', namespace: 'monitoring', release: 'radar-prod', stage: 'inspect' }))
+    const exit = exitFor(APP, CARD, h)
+    expect(exit).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(exit.href).toBe(
+      `${APP}/install?existing=1&ns=monitoring&release=radar-prod&method=helm&${UTM}&utm_content=${CARD}&radar_outcome=blocked_preflight_checks_failed`,
+    )
+  })
+
+  it('offers a fresh install only from a complete plan whose discovery saw the whole cluster', () => {
+    const fresh = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({})))
+    expect(fresh).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(fresh.href).toContain('/install?method=helm&')
+    expect(fresh.href).not.toContain('existing')
+
+    // A partial scan may have missed a Radar elsewhere; guessing fresh would
+    // reset its values, so the exit is Radar Cloud itself.
+    const partial = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({ partialScan: true })))
+    expect(partial).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(partial.href).toContain('/signup?')
+    expect(partial.href).toContain('radar_outcome=blocked_preflight_checks_failed')
+  })
+
+  it('offers a fresh install when nothing is running and only the release records were unread', () => {
+    const exit = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({ stage: 'inspect', releaseUnread: true })))
+    expect(exit).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(exit.href).toContain('/install?method=helm&')
+  })
+
+  it('sends an unknown target to Radar Cloud, never to a guessed install', () => {
+    const exit = exitFor(APP, CARD, handoffForBlocked('preflight'))
+    expect(exit).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(exit.href).toContain('/signup?')
+  })
+
+  it('hands a GitOps-managed release to its verified controller’s tab', () => {
+    for (const [method, label] of [
+      ['argocd', 'Get the Argo CD values patch'],
+      ['flux', 'Get the Flux values patch'],
+    ] as const) {
+      const exit = exitFor(APP, CARD, handoffForBlocked('gitops', attempted({ mode: 'gitops', namespace: 'radar', release: 'radar', stage: 'inspect', method })))
+      expect(exit).toMatchObject({ install: true, label })
+      expect(exit.href).toContain(`/install?existing=1&ns=radar&release=radar&method=${method}&`)
+    }
+    // An unverified or unrecognized owner gets no patch for the wrong tool.
+    const unknownOwner = exitFor(APP, CARD, handoffForBlocked('gitops', attempted({ mode: 'gitops', stage: 'inspect', method: '' })))
+    expect(unknownOwner).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+  })
+
+  it('never turns an unsupported refusal into an install, even with a known release', () => {
+    // Preparation can refuse after inspection found a release (incompatible
+    // settings, a token Secret already present); the card still keeps that
+    // as evidence, but the exit is Radar Cloud, not an install over it.
+    const exit = exitFor(APP, CARD, handoffForBlocked('unsupported', attempted({ mode: 'adopt', stage: 'prepare' })))
+    expect(exit).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(exit.href).toContain('radar_outcome=blocked_unsupported_install')
+    expect(exitFor(APP, CARD, handoffForBlocked('unsupported'))).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+  })
+})
+
+describe('handoffForPrepareError', () => {
+  it('separates no cluster, inspection failed, Radar unreachable, and an unusable response', () => {
+    expect(handoffForPrepareError(new ApiError('down', 503)).outcome).toBe('radar_not_connected_to_cluster')
+    expect(handoffForPrepareError(new ApiError('nope', 500)).outcome).toBe('cluster_inspect_failed')
+    expect(handoffForPrepareError(new TypeError('Failed to fetch')).outcome).toBe('radar_server_unreachable')
+    expect(handoffForPrepareError(new SyntaxError('Unexpected token <')).outcome).toBe('cluster_inspect_request_error')
+  })
+
+  it('is worth trying again and keeps the message for the pitch', () => {
+    const h = handoffForPrepareError(new ApiError('Not connected to cluster', 503))
+    expect(h.retryable).toBe(true)
+    expect(h.detail).toBe('Not connected to cluster')
+  })
+})
+
+describe('handoffForBlocked', () => {
+  it('names the refusal, does not offer a retry, and keeps what Radar attempted', () => {
+    expect(handoffForBlocked('gitops')).toEqual({ outcome: 'blocked_gitops_managed_install', retryable: false, target: null })
+    expect(handoffForBlocked('preflight')).toEqual({ outcome: 'blocked_preflight_checks_failed', retryable: false, target: null })
+    expect(handoffForBlocked('unsupported')).toEqual({ outcome: 'blocked_unsupported_install', retryable: false, target: null })
+    const a = attempted({ mode: 'adopt', partialScan: false })
+    expect(handoffForBlocked('preflight', a).target).toBe(a)
+  })
+})
+
+describe('isHandoffOutcome', () => {
+  it('accepts the server failure kinds verbatim', () => {
+    for (const kind of [
+      'hub_connect_request_failed',
+      'hub_approval_poll_failed',
+      'approval_rejected_in_browser',
+      'approval_window_expired',
+      'approved_but_credential_pickup_expired',
+      'approval_outcome_unknown',
+      'canceled_before_approval_page',
+      'canceled_after_approval',
+      'helm_provision_failed',
+      'installed_but_tunnel_not_confirmed',
+    ]) {
+      expect(isHandoffOutcome(kind)).toBe(true)
+    }
+  })
+})

package/src/components/cloudConnectHandoff.ts

@@ -0,0 +1,124 @@
+import { ApiError, type CloudInstallAttempted, type CloudInstallBlocked } from '../api/client'
+
+// The Cloud dialog's links into the Hub. utm_content names the link that was
+// clicked. After an in-app connect attempt that did not end connected, the
+// link also carries radar_outcome, a short phrase for what happened, so the
+// wizard opens knowing what the person is coming from. The person sees both
+// in the address bar, so every value reads as plain words about the flow —
+// never an error message, never a cluster name. Anything that is not a short
+// snake_case phrase is dropped here and again on the Hub.
+export const SIGNUP_QUERY = '?utm_source=radar-oss&utm_medium=app&utm_campaign=cloud-modal'
+
+// What the person is coming from, whether the pitch should offer "Try
+// again" (a failure can be retried; a refusal or the person's own cancel
+// cannot be "tried again" without misreading it as something going wrong),
+// and, for a blocked plan, the release Radar found so the card's install
+// link adopts it instead of opening a fresh install over it.
+export interface Handoff {
+  outcome: string
+  retryable: boolean
+  // What Radar attempted, when it got that far — the blocked card's evidence
+  // and the input to the exit it offers.
+  target?: CloudInstallAttempted | null
+  // A prepare error's message, shown on the pitch so the reason outlives the
+  // toast that first carried it.
+  detail?: string
+}
+
+// Closed shape, not a closed list: flow failure kinds come from the server
+// (hub_connect_request_failed, approval_window_expired, helm_provision_failed,
+// …) and this frontend must not need a release to forward a new one.
+const OUTCOME_SHAPE = /^[a-z][a-z_]{0,39}$/
+
+export function isHandoffOutcome(value: unknown): value is string {
+  return typeof value === 'string' && OUTCOME_SHAPE.test(value)
+}
+
+// The prepare POST failed before any flow existed, so there is no failure
+// kind to forward; classify by HTTP class. Prepare never contacts the Hub: a
+// 503 is Radar without a cluster (disconnected or still connecting), any other
+// status is Radar itself declining or failing the inspection, a TypeError is
+// fetch failing to reach Radar's own server, and anything else is a response
+// that could not be used. All of them are worth trying again.
+export function handoffForPrepareError(err: unknown): Handoff {
+  let outcome = 'cluster_inspect_request_error'
+  if (err instanceof ApiError) {
+    outcome = err.status === 503 ? 'radar_not_connected_to_cluster' : 'cluster_inspect_failed'
+  } else if (err instanceof TypeError) {
+    outcome = 'radar_server_unreachable'
+  }
+  return { outcome, retryable: true, detail: err instanceof Error ? err.message : undefined }
+}
+
+// A blocked plan was refused for a stated reason and trying again reproduces
+// it; the wizard is the next step, not a retry.
+const BLOCKED_OUTCOMES: Record<CloudInstallBlocked['reason'], string> = {
+  gitops: 'blocked_gitops_managed_install',
+  preflight: 'blocked_preflight_checks_failed',
+  unsupported: 'blocked_unsupported_install',
+}
+
+export function handoffForBlocked(reason: CloudInstallBlocked['reason'], target?: CloudInstallAttempted | null): Handoff {
+  return { outcome: BLOCKED_OUTCOMES[reason], retryable: false, target: target ?? null }
+}
+
+export function signupUrlFor(appUrl: string, content: string, handoff?: Handoff | null): string {
+  const url = `${appUrl}/signup${SIGNUP_QUERY}&utm_content=${content}`
+  return handoff && isHandoffOutcome(handoff.outcome) ? `${url}&radar_outcome=${handoff.outcome}` : url
+}
+
+// The one exit every blocked card offers. An install-page deep link is
+// justified only where Radar established both the target and the operation:
+// a release it found (adopt, or its GitOps owner's values patch), or a fresh
+// install from a complete plan whose discovery saw the whole cluster. The
+// Hub's fresh command would reset an existing release's values and its script
+// writes the token Secret before Helm runs, so a guessed target is never
+// linked. Everywhere else the exit is Radar Cloud itself — the same
+// signup/login entry as the pitch — and the copy hands the work to an admin.
+// Signed out, the Hub stashes an /install link across sign-in only when it
+// carries a target or a method, so every install link carries one.
+export interface BlockedExit {
+  href: string
+  label: string
+  // True when href is the install page for an established target.
+  install: boolean
+}
+
+export function exitFor(appUrl: string, content: string, handoff: Handoff | null | undefined): BlockedExit {
+  const generic = { href: signupUrlFor(appUrl, content, handoff), label: 'Open Radar Cloud', install: false }
+  const t = handoff?.target
+  if (!t) return generic
+  // An unsupported refusal names its own remedy (several Radars to pick from,
+  // a pairing to recover, ownership Radar will not guess at); a release it
+  // happens to know is not an invitation to install over it.
+  if (handoff?.outcome === BLOCKED_OUTCOMES.unsupported) return generic
+  const params = new URLSearchParams()
+  switch (t.mode) {
+    case 'adopt':
+      params.set('existing', '1')
+      params.set('ns', t.namespace)
+      params.set('release', t.release)
+      params.set('method', 'helm')
+      return { href: installHref(appUrl, content, handoff, params), label: 'Get the install command', install: true }
+    case 'gitops':
+      if (t.method !== 'argocd' && t.method !== 'flux') return generic
+      params.set('existing', '1')
+      params.set('ns', t.namespace)
+      params.set('release', t.release)
+      params.set('method', t.method)
+      return {
+        href: installHref(appUrl, content, handoff, params),
+        label: `Get the ${t.method === 'argocd' ? 'Argo CD' : 'Flux'} values patch`,
+        install: true,
+      }
+    default:
+      if (t.partialScan) return generic
+      params.set('method', 'helm')
+      return { href: installHref(appUrl, content, handoff, params), label: 'Get the install command', install: true }
+  }
+}
+
+function installHref(appUrl: string, content: string, handoff: Handoff | null | undefined, params: URLSearchParams): string {
+  const url = `${appUrl}/install?${params.toString()}&${SIGNUP_QUERY.slice(1)}&utm_content=${content}`
+  return handoff && isHandoffOutcome(handoff.outcome) ? `${url}&radar_outcome=${handoff.outcome}` : url
+}

package/src/components/diagnose/AgentCase.tsx

@@ -0,0 +1,131 @@
+import { clsx } from "clsx";
+import { Sparkles } from "lucide-react";
+import { Badge } from "@skyhook-io/k8s-ui";
+
+import type { DiagnosisEvidenceRole } from "../../api/diagnose";
+import { Tooltip } from "../ui/Tooltip";
+
+export const AGENT_ROLE_LABELS: Readonly<
+  Record<DiagnosisEvidenceRole, string>
+> = {
+  cause: "Cause",
+  symptom: "Symptom",
+  context: "Context",
+  benign: "Not a problem",
+  demoted: "Less relevant",
+  rules_out: "Rules out",
+};
+
+/**
+ * The agent's framing of a Radar fact. Always the agent tone, never a
+ * severity tone: a chip must not read as a Radar finding.
+ */
+export function AgentRoleChip({ role }: { role: DiagnosisEvidenceRole }) {
+  return (
+    <Tooltip
+      content={`The agent labelled this evidence "${AGENT_ROLE_LABELS[role]}". Radar recorded the fact; the label is the agent's reading of it.`}
+      // The label has to share the sentence's baseline. Centring the badge box
+      // drops it ~1px (padding and border make the box taller than the line),
+      // and the badge's own baseline comes from the sparkle, landing 1px high.
+      wrapperClassName="shrink-0 align-[-1px]"
+    >
+      <Badge tone="agent" size="sm">
+        <Sparkles className="h-2.5 w-2.5 shrink-0" aria-hidden />
+        {AGENT_ROLE_LABELS[role]}
+      </Badge>
+    </Tooltip>
+  );
+}
+
+/**
+ * One sentence from the agent about a Radar fact. Everything the agent
+ * contributed to a card lives in this one row — the sparkle, the role, and the
+ * sentence — so the register is unmistakable: the fact above is Radar's, this
+ * line is the agent's reading of it. The role travelled with the card title
+ * once, where it sat in the same slot as Radar's own badges and could be read
+ * as Radar having established it.
+ *
+ * A `rules_out` note carries the hypothesis it excludes, as text beside the
+ * chip rather than inside it: "Rules out" alone forces the reader to find the
+ * hypothesis in a block further down and match it back, and a hypothesis long
+ * enough to be useful makes a badge that swallows the row.
+ */
+export function AgentClaimNote({
+  claim,
+  role,
+  excludes,
+  subject,
+  className,
+}: {
+  claim: string;
+  role?: DiagnosisEvidenceRole;
+  /**
+   * The hypothesis this item excludes. Rendered only for `rules_out`, where
+   * the chip frames it as rejected: a hypothesis is a claim the agent
+   * DISPROVED, so on any other card it would read as a statement of fact.
+   */
+  excludes?: string;
+  /** The observation the note was bound to, when it is not on that card. */
+  subject?: string;
+  className?: string;
+}) {
+  if (!claim && !role) return null;
+  return (
+    <p
+      data-agent-claim
+      className={clsx(
+        "flex min-w-0 items-start gap-2 border-t border-dashed border-theme-border/70 text-xs leading-relaxed text-theme-text-secondary",
+        className,
+      )}
+    >
+      <span className="min-w-0 flex-1 [overflow-wrap:anywhere]">
+        {/* The chip and its sparkle carry this visually; the word is what
+            survives when colour and iconography do not. "Agent" rather than
+            "Agent's note" because a role can arrive with no sentence. */}
+        <span className="sr-only">Agent: </span>
+        {role ? (
+          <>
+            <AgentRoleChip role={role} />{" "}
+          </>
+        ) : null}
+        {excludes && role === "rules_out" ? (
+          <>
+            <span className="italic text-theme-text-tertiary">{excludes}</span>
+            {" — "}
+          </>
+        ) : null}
+        {claim ? (
+          <>
+            {subject ? (
+              <span className="text-theme-text-tertiary">{subject} · </span>
+            ) : null}
+            {renderClaim(claim)}
+          </>
+        ) : null}
+      </span>
+    </p>
+  );
+}
+
+/**
+ * Claims are one sentence of prose in which the agent marks identifiers with
+ * backticks. Only that inline-code span is honoured: a full Markdown render
+ * would wrap the sentence in a block and break the shared baseline with the
+ * role chip and the lead-in.
+ */
+function renderClaim(claim: string) {
+  const parts = claim.split("`");
+  if (parts.length < 3) return claim;
+  return parts.map((part, i) =>
+    i % 2 === 1 && i < parts.length - 1 ? (
+      <code
+        key={i}
+        className="inline-code rounded border border-theme-border/60 bg-theme-base px-1 py-px font-mono text-[11px] font-normal text-theme-text-primary"
+      >
+        {part}
+      </code>
+    ) : (
+      part
+    ),
+  );
+}

package/src/components/diagnose/DiagnoseContext.tsx

@@ -36,6 +36,7 @@ import {
   type ExecutionProfile,
 } from "../../api/diagnose";
 import { runTargetKey } from "./target";
+import { knownKindForPluralWithGroup } from "../../utils/navigation";
 
 export interface Target {
   kind: string;
@@ -660,7 +661,7 @@ function RoutedDiagnoseProvider({
   const startRunRef = useRef<(t: Target) => void>(() => {});
   startRunRef.current = (t: Target) => {
     const seq = ++startSeqRef.current;
-    createRun(t, {
+    createRun({ ...t, kind: knownKindForPluralWithGroup(t.kind, t.group) ?? t.kind }, {
       agent: selectedAgent || undefined,
       profile: hosted ? undefined : effectiveProfile,
       model: model || undefined,

package/src/components/diagnose/DiagnoseSurface.test.tsx

@@ -4,7 +4,6 @@ import {
   INVESTIGATION_HISTORY_MIN_WIDTH,
   MAXIMIZED_RUN_META_VISIBILITY_CLASS,
   canRerunInvestigation,
-  canCopyRunLink,
   investigationHistoryIsPersistent,
   investigationHeaderPresentation,
   openInvestigationEvidenceResource,
@@ -337,25 +336,6 @@ describe("canContinueInvestigation", () => {
   });
 });
 
-describe("canCopyRunLink", () => {
-  it("does not expose collaboration UI for an OSS run", () => {
-    expect(canCopyRunLink(run("done"))).toBe(false);
-  });
-
-  it("exposes the copy action only for a canonical hosted URL", () => {
-    expect(
-      canCopyRunLink({
-        ...run("done"),
-        radarUrl: "/c/cluster-1?org=org-1&ai-run=r1",
-      }),
-    ).toBe(true);
-  });
-
-  it("treats an empty hosted URL as unavailable", () => {
-    expect(canCopyRunLink({ ...run("done"), radarUrl: "" })).toBe(false);
-  });
-});
-
 describe("canInvestigateFurther", () => {
   it("offers a context-preserving next step on a completed automatic investigation", () => {
     expect(