@skyhook-io/radar-app 1.13.5 → 1.14.0

package/src/components/resources/ResourcesView.tsx

@@ -1,7 +1,7 @@
 import { useState, useMemo, useCallback, useEffect } from 'react'
 import { useLocation, useNavigate } from 'react-router-dom'
 import { useQuery } from '@tanstack/react-query'
-import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useResources, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
+import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, isKindSyncFailed, isStillLoadingError, useCapabilities, useNamespaceCapabilities, useResources, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
 import { isBadgeWorthy } from '../../utils/auditBadges'
 import type { AuditBadgeMessage } from '@skyhook-io/k8s-ui'
 import { apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from '../../api/config'
@@ -143,7 +143,18 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       }
     },
     staleTime: 10000,
-    refetchInterval: 60000, // Safety net — SSE k8s_event drives near-real-time invalidation
+    // SSE invalidation isn't running while connecting, and mid-sync counts
+    // are what unlatch guarded kinds as their informers finish — poll fast
+    // during the shell, settle to the safety net once connected.
+    refetchInterval: connection.state === 'connecting' ? 3000 : 60000,
+    // During the first seconds of the progressive shell the endpoint 503s
+    // (cluster_connecting) until the mid-sync cache handle exists; keep the
+    // query pending rather than parking it in error state, which would
+    // unlatch the large-list guard at the connected flip.
+    retry: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? true : failureCount < 3,
+    retryDelay: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   })
 
   // Determine if selected kind is a CRD (only CRDs should send ?group= to backend)
@@ -200,8 +211,29 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   const isSelectedKindGuarded = selectedCountKey !== '' && LARGE_RESOURCE_LIST_GUARD_KEYS.has(selectedCountKey)
   const selectedKindSummaryServed = SUMMARY_LIST_KINDS.has(selectedCountKey)
   const selectedKindRowLimit = selectedKindSummaryServed ? SUMMARY_LIST_LIMIT : LARGE_RESOURCE_LIST_LIMIT
-  const waitingForGuardCount = isSelectedKindGuarded && !countsData && !countsIsError
-  const largeListBlocked = isSelectedKindGuarded && countsData != null && (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > selectedKindRowLimit))
+  // While still 'connecting', /resource-counts is unavailable — its error
+  // must NOT unlatch the large-list guard, or a huge Pods list could fetch
+  // unguarded on exactly the clusters the guard protects. Counts arrive
+  // right after 'connected' and settle the guard then.
+  const syncShellActive = connection.state === 'connecting'
+  // A kind whose sync deadline fired is unavailable-with-a-reason: hand it to
+  // the list endpoint, whose 503 kind_sync_failed renders the honest error —
+  // the guard would otherwise trap it on "count unavailable" forever. Safe to
+  // unblock: the server serves no rows for a failed kind.
+  const selectedCountFailedSync =
+    selectedCountUnavailable && countsData?.reasons?.[selectedCountKey] === 'kind_sync_failed'
+  // A guarded kind whose informer hasn't finished reports unavailable with a
+  // kind_sync_pending reason — "count not known YET", so keep the loading
+  // state. Keyed on the reason, not on connection.state: deferred kinds sync
+  // after connect. Reasonless unavailable stays a real verification failure
+  // and blocks the view as before.
+  const selectedCountPendingSync =
+    (selectedCountUnavailable && countsData?.reasons?.[selectedCountKey] === 'kind_sync_pending') ||
+    (syncShellActive && selectedCountUnavailable && !selectedCountFailedSync)
+  const waitingForGuardCount = isSelectedKindGuarded &&
+    ((!countsData && (!countsIsError || syncShellActive)) || selectedCountPendingSync)
+  const largeListBlocked = isSelectedKindGuarded && countsData != null && !selectedCountPendingSync && !selectedCountFailedSync &&
+    (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > selectedKindRowLimit))
   const selectedKindQueryBlocked = waitingForGuardCount || largeListBlocked
   const podCount = countsData?.counts.Pod
   const podCountKnown = hasResourceCount(countsData?.counts, 'Pod')
@@ -285,9 +317,15 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
     staleTime: 30000,
     refetchInterval: 120000, // Safety net — SSE k8s_event drives near-real-time invalidation
     retry: (failureCount: number, error: Error) => {
-      if (isForbiddenError(error)) return false
+      if (isForbiddenError(error) || isKindSyncFailed(error)) return false
+      // Cluster still connecting, or this kind's informer still completing
+      // its initial sync: keep the query in its loading state and retry —
+      // the header's sync-progress label explains the wait.
+      if (isStillLoadingError(error)) return true
       return failureCount < 3
     },
+    retryDelay: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   })
 
   // Map to ResourceQueryResult shape
@@ -398,7 +436,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       resourceUnavailable={countsData?.unavailable}
       selectedKindQuery={selectedKindQueryResult}
       printerTable={selectedKindQueryBlocked ? null : selectedKindQuery.data?.printerTable ?? null}
-      connectionState={connection.state}
+      connectionState={connection.state === 'connecting' && connection.syncStatus ? 'syncing' : connection.state}
       largeListGuard={largeListGuard}
       onSelectedKindChange={setSelectedKind}
       topPodMetrics={topPodMetrics}

package/src/components/resources/renderers/NamespaceRenderer.tsx

@@ -1,7 +1,7 @@
 import { NamespaceRenderer as BaseNamespaceRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/NamespaceRenderer'
 import type { ResourceRef } from '@skyhook-io/k8s-ui'
 import { useRBACNamespace } from '../../../api/rbac'
-import { useNamespaceQuotas } from '../../../api/quotas'
+import { useNamespaceLimitRanges, useNamespaceQuotas } from '../../../api/quotas'
 import { isForbiddenError } from '../../../api/client'
 
 interface NamespaceRendererProps {
@@ -17,6 +17,9 @@ export function NamespaceRenderer({ data, onNavigate }: NamespaceRendererProps)
   // RBAC sections). Surface other errors (500/503) so a quota-constrained
   // namespace doesn't silently render as quota-free.
   const quotaErr = quotaError && !isForbiddenError(quotaError) ? (quotaError as Error) : null
+  // LimitRanges keep their 403: the section states the denial rather than
+  // hiding, because "no rules apply here" is the wrong thing to imply.
+  const { data: limitRangeData, isLoading: limitRangeLoading, error: limitRangeError } = useNamespaceLimitRanges(name, !!name)
   return (
     <BaseNamespaceRenderer
       data={data}
@@ -25,6 +28,9 @@ export function NamespaceRenderer({ data, onNavigate }: NamespaceRendererProps)
       rbacError={error as Error | null}
       quotaData={quotaData}
       quotaError={quotaErr}
+      limitRangeData={limitRangeData}
+      limitRangeLoading={limitRangeLoading}
+      limitRangeError={limitRangeError}
       onNavigate={onNavigate}
     />
   )

package/src/components/resources/renderers/PodRenderer.tsx

@@ -7,6 +7,7 @@ import { useCapabilitiesContext, useNamespacedCapabilities, useIsLocalDeployment
 import { getVisibleLiveMetrics, isLiveMetricsUnavailable, shouldFetchLiveMetrics, usePodEnvironment, usePodMetrics, usePodMetricsHistory, usePrometheusResourceMetrics, usePrometheusStatus, useRevealPodEnvironment } from '../../../api/client'
 import { useRBACSubject } from '../../../api/rbac'
 import { usePolicyResource } from '../../../api/policy'
+import { podLimitRangeNames, useNamespaceLimitRanges } from '../../../api/quotas'
 import { podAwaitsScheduling } from '../../capacity/podDemandGate'
 import { PortForwardInlineButton } from '../../portforward/PortForwardButton'
 import { ImageFilesystemModal } from '../ImageFilesystemModal'
@@ -79,6 +80,8 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
     'pods', namespace ?? '', podName, !!namespace && !!podName,
   )
 
+  const { data: limitRanges, isSuccess: limitRangesReady } = useNamespaceLimitRanges(namespace ?? '', !!namespace)
+
   return (
     <BasePodRenderer
       data={data}
@@ -110,6 +113,7 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
       policyData={policyData ?? null}
       policyLoading={policyLoading}
       policyError={policyError as Error | null}
+      namespaceLimitRangeNames={limitRangesReady ? podLimitRangeNames(limitRanges) : undefined}
       canExec={canExec}
       canViewLogs={canViewLogs}
       canPortForward={showPortForward}

package/src/components/resources/renderers/RolloutRenderer.tsx

@@ -1,5 +1,12 @@
 import { RolloutRenderer as BaseRolloutRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/RolloutRenderer'
-import { useRolloutAction, useRolloutCapabilities, type RolloutAction } from '../../../api/client'
+import {
+  useRolloutAction,
+  useRolloutAnalysisRuns,
+  useRolloutCapabilities,
+  useWorkloadRevisions,
+  useWorkloadPods,
+  type RolloutAction,
+} from '../../../api/client'
 
 interface RolloutRendererProps {
   data: any
@@ -11,6 +18,9 @@ export function RolloutRenderer({ data, onNavigate }: RolloutRendererProps) {
   const name = data?.metadata?.name ?? ''
   const { data: capabilities } = useRolloutCapabilities(namespace, name)
   const action = useRolloutAction()
+  const { data: analysisRunsResponse, error: analysisRunsError } = useRolloutAnalysisRuns(namespace, name)
+  const { data: revisions } = useWorkloadRevisions('rollouts', namespace, name)
+  const { data: podsResponse } = useWorkloadPods('rollouts', namespace, name)
 
   return (
     <BaseRolloutRenderer
@@ -19,6 +29,10 @@ export function RolloutRenderer({ data, onNavigate }: RolloutRendererProps) {
       capabilities={capabilities}
       onAction={(next: RolloutAction) => action.mutate({ action: next, namespace, name })}
       pendingAction={action.isPending ? action.variables?.action ?? null : null}
+      analysisRunHistory={analysisRunsResponse?.items}
+      analysisRunHistoryError={analysisRunsError}
+      revisions={revisions}
+      pods={podsResponse?.pods}
     />
   )
 }

package/src/components/resources/renderers/WorkloadRenderer.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from 'react-router-dom'
 import { useScaleWorkload, fetchJSON } from '../../../api/client'
 import { useRBACSubject } from '../../../api/rbac'
 import { usePolicyResource } from '../../../api/policy'
+import { podLimitRangeNames, useNamespaceLimitRanges } from '../../../api/quotas'
 import { useQueries, useQueryClient } from '@tanstack/react-query'
 import { kindToPlural, kindToPluralWithGroup } from '@skyhook-io/k8s-ui/utils/navigation'
 import type { Relationships, ResourceRef, ResourceWithRelationships, WorkloadPodInfo } from '../../../types'
@@ -49,6 +50,7 @@ export function WorkloadRenderer({ kind, data, onNavigate, scaleBlockedBy, workl
   const { data: policyData, isLoading: policyLoading, error: policyError } = usePolicyResource(
     kindToPlural(kind), namespace, metadata.name || '', !!namespace && !!metadata.name,
   )
+  const { data: limitRanges, isSuccess: limitRangesReady } = useNamespaceLimitRanges(namespace, !!namespace)
   const hpaRefs = (scaleBlockedBy ?? []).filter(ref => {
     const refKind = ref.kind.toLowerCase()
     return refKind === 'horizontalpodautoscaler' || refKind === 'hpa'
@@ -96,6 +98,7 @@ export function WorkloadRenderer({ kind, data, onNavigate, scaleBlockedBy, workl
       policyData={policyData ?? null}
       policyLoading={policyLoading}
       policyError={policyError as Error | null}
+      namespaceLimitRangeNames={limitRangesReady ? podLimitRangeNames(limitRanges) : undefined}
       scaleBlockedBy={scaleBlockedBy}
       workloadPods={workloadPods}
       scalerDiagnostics={scalerDiagnostics}

package/src/components/rightsizing/RightsizingScanView.tsx

@@ -799,6 +799,27 @@ function FitWhy({ label, row }: { label: string; row?: RightsizingRow }) {
 }
 
 function EvidenceNote({ row }: { row: RightsizingRow }) {
+  const primary = primaryEvidenceNote(row)
+  // A denied pod read qualifies whichever reason applies rather than standing in
+  // for it: a row can both be unable to check its pods and have a limit conflict,
+  // and hiding either one behind the other loses something the reader needs.
+  const inventory =
+    row.liveInventoryUnavailable && row.resource === 'memory' ? (
+      <p className="mt-1 text-xs text-theme-text-tertiary">
+        Radar could not read this workload&apos;s pods, so it could not check them for
+        out-of-memory restarts.
+      </p>
+    ) : null
+  if (!primary && !inventory) return null
+  return (
+    <>
+      {primary}
+      {inventory}
+    </>
+  )
+}
+
+function primaryEvidenceNote(row: RightsizingRow) {
   if (row.hpaManaged)
     return (
       <p className="mt-1 text-xs text-theme-text-tertiary">

package/src/components/settings/SettingsDialog.tsx

@@ -628,6 +628,7 @@ export function SettingsDialog({
               locked={!canEditConfig}
             >
               <PrometheusConfigField
+                local={deploymentMode === 'local'}
                 value={editedConfig.prometheusUrl ?? ''}
                 configuredHeaderKeys={configData?.prometheusHeaderKeys ?? []}
                 onChange={(v) => updateConfigField('prometheusUrl', v || undefined)}
@@ -698,6 +699,9 @@ export function SettingsDialog({
                 envManaged={configData?.argoCdEnvManaged ?? false}
                 envError={configData?.argoCdEnvError}
                 cliSession={configData?.argoCdCliSession}
+                anonymous={argoSectionStatus?.connected && argoSectionStatus.anonymous}
+                connectedAddress={argoSectionStatus?.connected && !argoSectionStatus.anonymous ? argoSectionStatus.address : undefined}
+                active={section === 'argocd'}
                 statusReason={
                   argoSectionStatus?.configured && !argoSectionStatus.connected
                     ? argoSectionStatus.reason
@@ -716,6 +720,12 @@ export function SettingsDialog({
                       : prev
                   )
                   void refetchArgoSectionStatus()
+                  // The GitOps detail page the user came from doesn't poll
+                  // when idle; without this the notice that sent them here
+                  // would still be up when they get back.
+                  void queryClient.invalidateQueries({
+                    predicate: (query) => typeof query.queryKey[0] === 'string' && query.queryKey[0].startsWith('gitops-'),
+                  })
                 }}
               />
             </SectionPane>
@@ -1105,9 +1115,9 @@ function OverviewPanel({ active, onNavigate }: { active: boolean; onNavigate: (s
     },
     {
       id: 'prometheus', icon: Activity, label: 'Metrics',
-      tone: prom?.connected ? 'ok' : prom?.available ? 'warn' : 'off',
-      value: prom?.connected ? 'Connected' : prom?.available ? 'Not reachable' : 'Not configured',
-      detail: prom?.connected ? prom.address : undefined,
+      tone: prom?.connected ? 'ok' : prom?.discovering ? 'unknown' : prom?.error ? 'warn' : 'off',
+      value: prom?.connected ? 'Connected' : prom?.discovering ? 'Discovering…' : prom?.error ? 'Not connected' : 'Not configured',
+      detail: prom?.connected ? prom.address : prom?.discovering ? undefined : prom?.error,
     },
     {
       id: costConfigurationAction(cost?.reason).section, icon: Coins, label: 'Cost',
@@ -1127,7 +1137,7 @@ function OverviewPanel({ active, onNavigate }: { active: boolean; onNavigate: (s
       // Configured-but-not-connected is often a permanently rejected/expired
       // token, not a transient reconnect — "Not reachable" matches Prometheus and
       // doesn't imply it will recover on its own.
-      value: argo?.connected ? 'Connected' : argo?.configured ? 'Not reachable' : 'Not connected',
+      value: argo?.connected ? (argo.anonymous ? 'Connected · no token needed' : 'Connected') : argo?.configured ? 'Not reachable' : 'Not connected',
       detail: argo?.connected ? argo.address : argo?.reason,
     },
     {
@@ -1899,11 +1909,13 @@ type CurrencySaveState =
 type HeaderRow = { key: string; value: string }
 
 function PrometheusConfigField({
+  local,
   value,
   onChange,
   configuredHeaderKeys,
   onApplied,
 }: {
+  local: boolean
   value: string
   onChange: (value: string) => void
   configuredHeaderKeys: string[]
@@ -1981,14 +1993,14 @@ function PrometheusConfigField({
   return (
     <div>
       <p className="text-xs text-theme-text-tertiary mb-3">
-        Powers the CPU / memory graphs, usage history, and rightsizing hints on workload and node pages.
+        Connect existing Prometheus-compatible data for resource usage, workload HTTP metrics and rightsizing. Available charts depend on collected metrics.
       </p>
       <label className="block text-sm font-medium text-theme-text-primary mb-1">
-        Server URL
+        Metrics backend URL
       </label>
       <p className="text-xs text-theme-text-tertiary mb-1">
-        Manual PromQL-compatible query URL — works with Prometheus, VictoriaMetrics, Thanos, and
-        Mimir. Set this to skip auto-discovery.
+        Base URL reachable from Radar, not your browser — Prometheus, VictoriaMetrics, Thanos or
+        Mimir. Include any backend path prefix, but not /api/v1/query. Leave empty for cluster discovery; headers require a URL.
       </p>
       <div className="flex items-center gap-2">
         <Input
@@ -1997,7 +2009,7 @@ function PrometheusConfigField({
           placeholder="http://prometheus-server.monitoring:9090"
           className="flex-1 min-w-0 px-3 py-1.5 text-sm bg-theme-elevated border border-theme-border rounded-md text-theme-text-primary placeholder:text-theme-text-tertiary focus:outline-none focus:border-skyhook-500"
         />
-        <Tooltip content="Apply this URL to the running server now — no restart" wrapperClassName="shrink-0">
+        <Tooltip content="Apply the connection now — no restart. Changing the URL or headers clears any workload scope override and resumes automatic identity matching." wrapperClassName="shrink-0">
           <button
             onClick={handleApply}
             disabled={apply.status === 'applying'}
@@ -2028,6 +2040,12 @@ function PrometheusConfigField({
           Applies immediately — no restart needed.
         </p>
       )}
+      <p className="mt-2 text-xs text-theme-text-tertiary">
+        {local
+          ? 'Saved URL and headers apply across all local cluster contexts.'
+          : 'Changes affect this Radar installation. Use deployment settings for configuration that survives Pod replacement.'}
+        {' URL changes do not clear headers. Replace or clear credentials before switching backends.'}
+      </p>
 
       {/* Auth headers — for token / multi-tenant backends (Bearer, X-Scope-OrgID). */}
       <div className="mt-3">
@@ -2095,7 +2113,8 @@ function PrometheusConfigField({
             <p className="text-xs text-theme-text-tertiary">
               Saved when you click Apply now. Entered headers replace all stored
               ones — values are hidden, so re-enter any you want to keep. Leave
-              blank to keep existing headers unchanged.
+              all rows blank to keep existing headers unchanged. To clear all saved
+              headers, remove every row and click Apply now.
             </p>
           </div>
         )}
@@ -2128,6 +2147,9 @@ function ArgoCDConfigField({
   envError,
   cliSession,
   statusReason,
+  anonymous,
+  connectedAddress,
+  active,
   onChangeUrl,
   onChangeInsecureTls,
   onApplied,
@@ -2139,12 +2161,15 @@ function ArgoCDConfigField({
   envError?: string
   cliSession?: { server: string; user: string; insecure?: boolean }
   statusReason?: string
+  anonymous?: boolean
+  connectedAddress?: string
+  active?: boolean
   onChangeUrl: (value: string) => void
   onChangeInsecureTls: (value: boolean) => void
   onApplied?: (v: { url: string; insecureTls: boolean; tokenSet: boolean }) => void
 }) {
   if (envManaged) {
-    return <ArgoCDEnvManagedField url={url} insecureTls={insecureTls} envError={envError} />
+    return <ArgoCDEnvManagedField url={url} insecureTls={insecureTls} envError={envError} connectedAddress={connectedAddress} statusReason={statusReason} />
   }
   return (
     <ArgoCDEditableField
@@ -2153,6 +2178,9 @@ function ArgoCDConfigField({
       tokenSet={tokenSet}
       cliSession={cliSession}
       statusReason={statusReason}
+      anonymous={anonymous}
+      connectedAddress={connectedAddress}
+      active={active}
       onChangeUrl={onChangeUrl}
       onChangeInsecureTls={onChangeInsecureTls}
       onApplied={onApplied}
@@ -2168,10 +2196,17 @@ function ArgoCDEnvManagedField({
   url,
   insecureTls,
   envError,
+  connectedAddress,
+  statusReason,
 }: {
   url: string
   insecureTls: boolean
   envError?: string
+  // Live connection, from the status endpoint: the address when the
+  // token-backed session is up, else why it isn't. The card is read-only,
+  // so this is the one thing on it that can change after deploy.
+  connectedAddress?: string
+  statusReason?: string
 }) {
   if (envError) {
     return (
@@ -2224,6 +2259,21 @@ function ArgoCDEnvManagedField({
             <dt className="w-24 shrink-0 text-theme-text-tertiary">Token</dt>
             <dd className="text-theme-text-secondary">provided via environment</dd>
           </div>
+          <div className="flex gap-2">
+            <dt className="w-24 shrink-0 text-theme-text-tertiary">Status</dt>
+            <dd className="min-w-0 truncate text-theme-text-secondary">
+              {connectedAddress ? (
+                <span className="inline-flex items-center gap-1">
+                  <Check className="w-3 h-3 shrink-0 text-green-600 dark:text-green-400/80" />
+                  Connected at {connectedAddress}
+                </span>
+              ) : statusReason ? (
+                <span className="text-warning-text">Not reachable — {statusReason}</span>
+              ) : (
+                'Not connected'
+              )}
+            </dd>
+          </div>
           {insecureTls && (
             <div className="flex gap-2">
               <dt className="w-24 shrink-0 text-theme-text-tertiary">TLS</dt>
@@ -2246,6 +2296,9 @@ function ArgoCDEditableField({
   tokenSet,
   cliSession,
   statusReason,
+  anonymous,
+  connectedAddress,
+  active,
   onChangeUrl,
   onChangeInsecureTls,
   onApplied,
@@ -2255,6 +2308,9 @@ function ArgoCDEditableField({
   tokenSet: boolean
   cliSession?: { server: string; user: string; insecure?: boolean }
   statusReason?: string
+  anonymous?: boolean
+  connectedAddress?: string
+  active?: boolean
   onChangeUrl: (value: string) => void
   onChangeInsecureTls: (value: boolean) => void
   onApplied?: (v: { url: string; insecureTls: boolean; tokenSet: boolean }) => void
@@ -2348,20 +2404,43 @@ function ArgoCDEditableField({
 
   const showConfiguredPlaceholder = effectiveTokenSet && !tokenTouched && !tokenCleared
   const connecting = state.status === 'connecting'
+  // Opening this section with nothing set up (typically from the GitOps
+  // page's "connect Radar to your Argo CD server") starts the user at the
+  // token — unless a CLI session offers a one-click connect, or reads
+  // already work anonymously.
+  const tokenInputRef = useRef<HTMLInputElement>(null)
+  useEffect(() => {
+    if (active && !effectiveTokenSet && !cliSession && !anonymous) tokenInputRef.current?.focus()
+  }, [active, effectiveTokenSet, cliSession, anonymous])
 
   return (
     <div>
       <p className="text-xs text-theme-text-tertiary mb-3">
         Connect your Argo CD server for the full Git-rendered desired-vs-live diff on GitOps
-        Application pages — what Git declares vs what's actually running. Without it, Radar falls
-        back to a lighter annotation-based drift that can miss fields.
+        Application pages — what Git declares vs what's actually running — and, on Argo CD 3, for
+        Argo's own health verdict on each resource. Without it, Radar falls back to a lighter
+        annotation-based drift that can miss fields, and to its own read of each resource.
       </p>
 
+      {state.status !== 'connected' && (anonymous || connectedAddress) && (
+        <p className="mb-3 flex items-center gap-1.5 text-xs text-theme-text-secondary">
+          <Check className="w-3.5 h-3.5 shrink-0 text-green-600 dark:text-green-400/80" />
+          {anonymous ? (
+            <>
+              Your Argo CD server lets Radar read without a token, so it's already connected. Add a token only
+              if anonymous access gets restricted, or a URL to point Radar at a specific server.
+            </>
+          ) : (
+            <>Connected to Argo CD at {connectedAddress}.</>
+          )}
+        </p>
+      )}
+
       {statusReason && state.status !== 'connected' && (
         <div className="mb-3 rounded-md border border-theme-border bg-theme-elevated p-3">
           <p className="flex items-center gap-1.5 text-sm font-medium text-warning-text">
             <AlertTriangle className="w-3.5 h-3.5 shrink-0" />
-            Argo CD token needs attention
+            Argo CD connection needs attention
           </p>
           <p className="mt-1 text-xs text-theme-text-secondary">{statusReason}</p>
         </div>
@@ -2419,6 +2498,7 @@ function ArgoCDEditableField({
       </p>
       <div className="flex items-center gap-2">
         <input
+          ref={tokenInputRef}
           type="password"
           value={showConfiguredPlaceholder ? '' : token}
           onChange={(e) => { setToken(e.target.value); setTokenTouched(true); setTokenCleared(false); clearStatus() }}