@skyhook-io/radar-app 1.13.5 → 1.14.0

package/src/api/workloadMetrics.ts

@@ -0,0 +1,68 @@
+import { useQuery } from "@tanstack/react-query";
+import type { TimeSeries } from "@skyhook-io/k8s-ui/components/charts";
+import { ApiError, fetchJSON, useClusterInfo, type PrometheusTimeRange } from "./client";
+import { getApiBase } from "./config";
+
+export type WorkloadMetricState =
+  "available" | "partial" | "stale" | "unavailable" | "error" | "detecting";
+export type WorkloadRequestSource = "beyla" | "istio";
+
+export interface WorkloadMetricPanel {
+  state: WorkloadMetricState;
+  reason?: string;
+  unit: string;
+  series: TimeSeries[];
+}
+
+export interface WorkloadMetrics {
+	 history: Partial<Record<"cpu" | "memory" | "throttling" | "requests", { mode: "workload-history" | "current-pods" | "unavailable"; reason?: string }>>;
+	 comparison: Partial<Record<"cpu" | "memory" | "throttling", WorkloadMetricPanel>>;
+  scopeNotice?: string;
+  attribution?: Record<string, string>;
+  state: WorkloadMetricState;
+  reason?: string;
+  source?: WorkloadRequestSource;
+  sources: {
+    id: WorkloadRequestSource;
+    label: string;
+    state: WorkloadMetricState;
+  }[];
+  pods: number;
+  podsTotal: number;
+  end: number;
+  start: number;
+  stepSeconds: number;
+  rateWindowSeconds: number;
+  panels: Partial<
+    Record<
+      "requests" | "errors" | "p50" | "p95" | "throttling" | "cpu" | "memory" | "observedPods",
+      WorkloadMetricPanel
+    >
+  >;
+}
+
+export function useWorkloadMetrics(
+  kind: string,
+  namespace: string,
+  name: string,
+  range: PrometheusTimeRange,
+  source: WorkloadRequestSource | "",
+  enabled: boolean,
+) {
+  const { data: cluster } = useClusterInfo();
+  const identity = ["workload-metrics", getApiBase(), cluster?.context, kind, namespace, name, range];
+  return useQuery<WorkloadMetrics>({
+    queryKey: [...identity, source],
+    placeholderData: (previous, previousQuery) =>
+      identity.every((value, index) => previousQuery?.queryKey[index] === value) ? previous : undefined,
+    queryFn: ({ signal }) =>
+      fetchJSON<WorkloadMetrics>(
+        `/prometheus/workload/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}?${new URLSearchParams({ range, source })}`,
+        signal,
+      ),
+    enabled,
+    staleTime: 30_000,
+    refetchInterval: (query) => query.state.data?.state === "detecting" || Object.values(query.state.data?.comparison ?? {}).some((panel) => panel.state === "detecting") ? 3_000 : 30_000,
+    retry: (failureCount, error) => failureCount < 1 && error instanceof ApiError && error.status === 409,
+  });
+}

package/src/components/CloudConnectFlow.tsx

@@ -1,6 +1,7 @@
-import { useRef, useState } from 'react'
+import { type ReactNode, useRef, useState } from 'react'
 import { useMutation } from '@tanstack/react-query'
 import { AlertTriangle, ArrowUpRight, Check, ExternalLink, GitBranch, Info, Loader2, ShieldAlert, X } from 'lucide-react'
+import type { BlockedExit } from './cloudConnectHandoff'
 import { Collapse, CollapseChevron } from '@skyhook-io/k8s-ui/components/ui/Collapse'
 import {
   ApiError,
@@ -19,20 +20,20 @@ import { showApiError } from './ui/Toast'
 export function CloudConnectFlow({
   status,
   blocked,
-  signupUrl,
+  exit,
   onStatus,
   onExit,
 }: {
   status: CloudInstallStatus
   blocked: CloudInstallBlocked | null
-  signupUrl: string
+  exit: BlockedExit
   // Push a mutation's status response into the shared query state.
   onStatus: (st: CloudInstallStatus) => void
   // Leave the flow view (back to the pitch, or close after dismiss).
   onExit: () => void
 }) {
   if (blocked) {
-    return <BlockedView blocked={blocked} signupUrl={signupUrl} onExit={onExit} />
+    return <BlockedView blocked={blocked} exit={exit} onExit={onExit} />
   }
 
   switch (status.state) {
@@ -66,13 +67,14 @@ export function CloudConnectFlow({
 
 function BlockedView({
   blocked,
-  signupUrl,
+  exit,
   onExit,
 }: {
   blocked: CloudInstallBlocked
-  signupUrl: string
+  exit: BlockedExit
   onExit: () => void
 }) {
+  const copy = blockedCopy(blocked, exit)
   const icon =
     blocked.reason === 'gitops' ? (
       <GitBranch className="w-4 h-4 shrink-0 mt-0.5 text-emerald-600 dark:text-emerald-400" />
@@ -81,48 +83,33 @@ function BlockedView({
     ) : (
       <AlertTriangle className="w-4 h-4 shrink-0 mt-0.5 text-amber-500" />
     )
-  const title =
-    blocked.reason === 'gitops'
-      ? 'This install is managed by GitOps'
-      : blocked.reason === 'preflight'
-        ? 'Your Kubernetes identity can’t install this'
-        : 'This cluster can’t be connected from here'
   return (
     <div className="px-8 pt-6 pb-5">
       <div className="card-inner-lg flex gap-2.5">
         {icon}
-        <div className="min-w-0">
-          <div className="text-[13px] font-semibold text-theme-text-primary">{title}</div>
-          <p className="mt-1 text-[12px] leading-relaxed text-theme-text-secondary">{blocked.message}</p>
-          {blocked.blocking && blocked.blocking.length > 0 && (
-            <ul className="mt-2 space-y-1 text-[11.5px] text-theme-text-tertiary">
-              {blocked.blocking.map((line) => (
-                <li key={line} className="flex items-start gap-1.5">
-                  <span className="mt-[6px] w-1 h-1 rounded-full bg-amber-500 shrink-0" />
-                  {line}
-                </li>
-              ))}
-            </ul>
-          )}
+        <div className="min-w-0 space-y-3">
+          <div className="text-[13px] font-semibold text-theme-text-primary">{copy.title}</div>
+          <BlockedSection label="What Radar tried">{copy.tried}</BlockedSection>
+          <BlockedSection label="Why it stopped">
+            {copy.why}
+            {blocked.blocking && blocked.blocking.length > 0 && <BlockingLines lines={blocked.blocking} />}
+          </BlockedSection>
+          <BlockedSection label="What to do">{copy.next}</BlockedSection>
         </div>
       </div>
       <div className="mt-4 flex items-center gap-4">
-        {/* Only a preflight denial has a legitimate browser alternative —
-            someone with more Kubernetes permission can run the wizard. GitOps
-            and unsupported refusals named a specific reason and target that a
-            generic signup link cannot carry, so offering it would contradict
-            the message directly above. */}
-        {blocked.reason === 'preflight' && (
-          <a
-            href={signupUrl}
-            target="_blank"
-            rel="noopener noreferrer"
-            className="text-[12.5px] font-semibold text-emerald-600 dark:text-emerald-400 hover:underline underline-offset-2"
-          >
-            Connect through the browser wizard instead →
-          </a>
-        )}
-        <button onClick={onExit} className="text-[12.5px] text-theme-text-tertiary hover:text-theme-text-primary transition-colors">
+        <a
+          href={exit.href}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="px-5 py-2 rounded-[10px] bg-emerald-500 hover:bg-emerald-400 text-emerald-950 text-[13.5px] font-bold shadow-[0_0_22px_rgba(16,185,129,0.35)] hover:shadow-[0_0_30px_rgba(16,185,129,0.5)] hover:-translate-y-px transition-all"
+        >
+          {exit.label}
+        </a>
+        <button
+          onClick={onExit}
+          className="ml-auto text-[12.5px] text-theme-text-tertiary hover:text-theme-text-primary transition-colors"
+        >
           Back
         </button>
       </div>
@@ -130,6 +117,156 @@ function BlockedView({
   )
 }
 
+function BlockedSection({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <div>
+      <div className="text-[10.5px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{label}</div>
+      <div className="mt-0.5 text-[12px] leading-relaxed text-theme-text-secondary">{children}</div>
+    </div>
+  )
+}
+
+function BlockingLines({ lines }: { lines: string[] }) {
+  return (
+    <ul className="mt-1.5 space-y-1 text-[11.5px] text-theme-text-tertiary">
+      {lines.map((line) => (
+        <li key={line} className="flex items-start gap-1.5">
+          <span className="mt-[6px] w-1 h-1 rounded-full bg-amber-500 shrink-0" />
+          {line}
+        </li>
+      ))}
+    </ul>
+  )
+}
+
+// The blocked card stands in for the plan card the person never saw, so it
+// carries what Radar did first, then why it stopped, then the way forward.
+// Three short labeled parts, not one paragraph. Every card ends the same way
+// — an admin with cluster access, in Radar Cloud — and the exit says whether
+// that is a deep-linked install command or Radar Cloud itself.
+function blockedCopy(blocked: CloudInstallBlocked, exit: BlockedExit): { title: string; tried: ReactNode; why: ReactNode; next: ReactNode } {
+  const a = blocked.attempted
+  const release = a && (
+    <>
+      release <code className="font-mono text-[11px] text-theme-text-primary">{a.release}</code> in namespace{' '}
+      <code className="font-mono text-[11px] text-theme-text-primary">{a.namespace}</code>
+    </>
+  )
+  const operation = a?.mode === 'adopt' ? 'a Helm upgrade of your existing' : 'a fresh Helm install of'
+  // What Radar did is told by the stage it reached, not by the plan it had:
+  // a target can be known from discovery before any chart was rendered or
+  // dry-run, and the card must not claim work that did not happen.
+  const tried =
+    !a ? (
+      <>Radar was looking for an existing Radar install in this cluster, as your kubeconfig identity. Nothing was changed.</>
+    ) : a.mode === 'gitops' ? (
+      <>Radar found {release} and traced how it is managed before planning anything. Nothing was changed.</>
+    ) : a.stage === 'inspect' ? (
+      a.mode === 'adopt' ? (
+        <>
+          Radar found {release} and was reading its Helm state, as your kubeconfig identity, before planning anything.
+          Nothing was changed.
+        </>
+      ) : (
+        <>
+          Radar found no Radar running anywhere in this cluster and was checking Helm’s release records in namespace{' '}
+          <code className="font-mono text-[11px] text-theme-text-primary">{a.namespace}</code>, as your kubeconfig
+          identity, before planning anything. Nothing was changed.
+        </>
+      )
+    ) : a.stage === 'prepare' ? (
+      <>
+        Radar planned {operation} {release} with the Cloud connection enabled and was preparing the chart, as your
+        kubeconfig identity. Nothing was changed.
+      </>
+    ) : (
+      <>
+        Radar prepared {operation} {release} with the Cloud connection enabled, and dry-ran it against the cluster as
+        your kubeconfig identity. Nothing was changed.
+      </>
+    )
+
+  // Where the exit is an install command, Radar Cloud asks for a cluster name
+  // first, then shows the instructions — say so, rather than promising a
+  // command on the next screen.
+  const installNext = (
+    <>
+      Have an admin with cluster access get the install command from Radar Cloud: it asks for a cluster name, then
+      shows the Helm, Argo CD or Flux instructions to review before running.
+    </>
+  )
+  const genericNext = (
+    <>
+      Have an admin with cluster access resolve the issue above, then connect — or recover — this cluster from Radar
+      Cloud.
+    </>
+  )
+  const unknownNext = (
+    <>
+      Have an admin with cluster access connect it from Radar Cloud.{' '}
+      {a?.partialScan ? (
+        <>
+          Radar could only check namespace{' '}
+          <code className="font-mono text-[11px] text-theme-text-primary">{a.namespace}</code> for an existing install,
+          so they should check the rest of the cluster first.
+        </>
+      ) : (
+        <>Radar couldn’t tell whether it is already installed here, so they should check first.</>
+      )}
+    </>
+  )
+
+  if (blocked.reason === 'gitops') {
+    return {
+      title: 'This install is managed by GitOps',
+      tried,
+      why: blocked.message,
+      next: exit.install ? (
+        <>
+          Have an admin with repo access get the values patch from Radar Cloud: it asks for a cluster name, then shows
+          the patch for your controller and the one command that creates the token Secret.
+        </>
+      ) : (
+        genericNext
+      ),
+    }
+  }
+  if (blocked.reason === 'unsupported') {
+    return { title: 'Radar can’t connect this cluster from here', tried, why: blocked.message, next: genericNext }
+  }
+  // Fresh offered on "nothing running" alone: say what was not confirmed.
+  const unconfirmedNext = (
+    <>
+      Radar found no Radar running in this cluster but couldn’t read Helm’s release records, so an admin with cluster
+      access should confirm nothing is installed before running a fresh install. {installNext}
+    </>
+  )
+  const next = exit.install ? (a?.releaseUnread ? unconfirmedNext : installNext) : unknownNext
+  switch (blocked.cause) {
+    case 'permissions':
+      return {
+        title: 'Your Kubernetes identity can’t do this install',
+        tried,
+        why: 'Your credentials lack permissions this needs (below). Anyone with them can complete this exact install.',
+        next,
+      }
+    case 'verification':
+      return {
+        title: 'This version of Radar can’t install this chart version from here',
+        tried,
+        why: 'The chart renders something this Radar build can’t check before applying, so it won’t install it unseen. A limitation of this Radar, not of your cluster or your access.',
+        next,
+      }
+    default:
+      return {
+        title: 'The cluster blocked part of this install',
+        tried,
+        why: 'The cluster refused: something already there conflicts with the install, or a policy rejects it. More permission wouldn’t change that.',
+        next: exit.install ? <>After the refusals above are resolved: {installNext}</> : next,
+      }
+  }
+}
+
 function PlanCard({
   status,
   onStatus,
@@ -348,7 +485,7 @@ function ConsentRow({
   checked: boolean
   onChange: (v: boolean) => void
   tone: 'emerald' | 'amber'
-  children: React.ReactNode
+  children: ReactNode
 }) {
   return (
     <label className="mt-3 flex items-start gap-2 cursor-pointer">

package/src/components/CloudFunnelButton.tsx

@@ -5,6 +5,14 @@ import { Collapse, CollapseChevron } from '@skyhook-io/k8s-ui/components/ui/Coll
 import { DialogPortal } from '@skyhook-io/k8s-ui/components/ui/DialogPortal'
 import { Tooltip } from './ui/Tooltip'
 import { CloudConnectFlow } from './CloudConnectFlow'
+import {
+  type Handoff,
+  exitFor,
+  handoffForBlocked,
+  handoffForPrepareError,
+  isHandoffOutcome,
+  signupUrlFor as buildSignupUrl,
+} from './cloudConnectHandoff'
 import { showApiError } from './ui/Toast'
 import {
   ApiError,
@@ -27,8 +35,10 @@ import {
 //
 // The only outbound call is the Hub's own copy, fetched when the dialog opens
 // (never on a poll or a timer) and falling back per-field to the constants
-// below. Conversion is otherwise measured on the receiving end: utm_content
-// distinguishes which lane sent the user.
+// below. The request names the lane the footer renders and where this Radar
+// runs, both closed enums. The links into the Hub carry utm_content naming
+// the link that was clicked and, after an in-app attempt that did not connect,
+// radar_outcome saying what happened; see cloudConnectHandoff.ts.
 const FALLBACK_APP_URL = 'https://app.radarhq.io'
 
 // Rendered until (or unless) the Hub states its own. Keeping the compiled-in
@@ -47,7 +57,15 @@ const DEFAULT_ASSURANCES = [
   'SOC 2 Type II',
   '3 clusters free, no card required',
 ]
-const SIGNUP_QUERY = '?utm_source=radar-oss&utm_medium=app&utm_campaign=cloud-modal'
+// Other OSS surfaces (a GitOps app that deploys to another cluster, say)
+// point at Radar Cloud by asking this button to open its dialog, so there
+// is one pitch and one flow. The button is mounted whenever Radar runs
+// standalone; embedded hosts never mount it and never dispatch this.
+const OPEN_EVENT = 'radar:open-cloud-funnel'
+
+export function openCloudFunnel() {
+  window.dispatchEvent(new Event(OPEN_EVENT))
+}
 const ABOUT_URL = 'https://radarhq.io/about'
 const PRICING_URL = 'https://radarhq.io/pricing'
 const SELF_HOSTED_DOCS_URL = 'https://radarhq.io/docs/cloud/self-hosted/'
@@ -79,25 +97,33 @@ export function CloudFunnelButton() {
   const [seen, setSeen] = useState(readSeen)
   const [inFlowView, setInFlowView] = useState(false)
   const [blocked, setBlocked] = useState<CloudInstallBlocked | null>(null)
-  // Set once an in-app attempt has actually failed, so the CTA reads "Try
-  // again" instead of implying a first attempt. Survives closing the modal
-  // (the failure belongs to the cluster, not the dialog session) but not a
-  // reload, and is reset below when the kubeconfig context changes — it must
-  // never describe a cluster the user has switched away from.
-  const [prepareFailed, setPrepareFailed] = useState(false)
+  // Set once an in-app attempt has ended without connecting, naming what
+  // happened (a flow failure kind, a blocked plan, a canceled plan, or the
+  // prepare call itself failing) and whether it is worth trying again. It
+  // relabels the CTA "Try again" for a retryable failure and lets the browser
+  // link say what the person is coming from. Survives closing the modal (the
+  // outcome belongs to the cluster, not the dialog session) but not a reload,
+  // and is reset below when the kubeconfig context changes — it must never
+  // describe a cluster the user has switched away from.
+  const [handoff, setHandoff] = useState<Handoff | null>(null)
+  const prepareFailed = handoff?.retryable ?? false
 
   const capabilities = useCapabilities()
   const lane = capabilities.data?.cloudConnect?.lane ?? 'wizard'
   const appUrl = capabilities.data?.cloudConnect?.appUrl || FALLBACK_APP_URL
-  // utm_content distinguishes the lane that opened the Hub — measured Hub-side
-  // only when the user actually navigates there; Radar transmits nothing.
-  const signupUrlFor = (content: string) => `${appUrl}/signup${SIGNUP_QUERY}&utm_content=${content}`
-  const signupUrl = signupUrlFor('funnel-cta')
+  // utm_content names the link that was clicked. It travels only in the link
+  // the user opens; Radar sends nothing on its own. Only the blocked card may
+  // deep-link the install page (see exitFor); the pitch buttons and the
+  // footer link go to signup.
+  const signupUrl = buildSignupUrl(appUrl, 'wizard-signup-button')
 
   // Only while the dialog is open — never on the capabilities poll. The Hub
   // learns that someone opened it, which is congruent with what the dialog is
   // for; it must not learn that Radar is merely running.
-  const connectInfo = useCloudConnectInfo(capabilities.data?.cloudConnect?.apiUrl, open)
+  const connectInfo = useCloudConnectInfo(capabilities.data?.cloudConnect?.apiUrl, open, {
+    lane,
+    mode: capabilities.data?.deployment?.mode,
+  })
 
   // In-cluster Radar can't install its own connection, but it knows exactly
   // which install it is — so the wizard link can carry the real target, and a
@@ -135,7 +161,7 @@ export function CloudFunnelButton() {
       // Anything else failed before a flow existed. Return to the pitch rather
       // than leaving the flow view armed, where a later status change would
       // pull the user into a screen they did not ask for.
-      exitFlow(true)
+      exitFlow(handoffForPrepareError(err))
       showApiError('Could not inspect this cluster for Cloud connect', err instanceof Error ? err.message : undefined)
     },
     // No meta.errorMessage: the global handler cannot tell a single-flight 409
@@ -153,33 +179,65 @@ export function CloudFunnelButton() {
 
   const startConnect = () => {
     setBlocked(null)
-    setPrepareFailed(false)
+    setHandoff(null)
     setInFlowView(true)
     prepare.mutate()
   }
 
-  // A flow that ended in failure returns to a pitch whose CTA must not read
-  // like a first attempt. The caller passes the outcome because dismissing
-  // already overwrote the status by this point.
-  const exitFlow = (failed = false) => {
-    if (failed) setPrepareFailed(true)
+  // A flow that ended without connecting returns to a pitch whose CTA must
+  // not read like a first attempt, and whose browser link knows what happened.
+  // The caller passes the outcome because dismissing already overwrote the
+  // status by this point. Every exit sets it, null included, so a connected
+  // flow clears what an earlier attempt left behind.
+  const exitFlow = (outcome: Handoff | null = null) => {
+    setHandoff(outcome)
     setInFlowView(false)
     setBlocked(null)
   }
 
+  // What the person is coming from. A blocked plan is read from local state,
+  // not the status: the status query keeps serving its last polled value
+  // (idle, usually) while the blocked view is up. A blocked plan counts as an
+  // attempt: the user tried the in-app path and was refused, and the wizard
+  // is the right next step for a GitOps-owned install. A failed flow carries
+  // the server's kind and its own verdict on retrying — the failed card
+  // already honors retrySafe, and the pitch must not contradict it two clicks
+  // later. Leaving a live plan is the user canceling it, not a failure. Only
+  // a connected flow, or no flow at all, leaves nothing to carry.
+  const outcomeOf = (st: CloudInstallStatus): Handoff | null => {
+    if (blocked) return handoffForBlocked(blocked.reason, blocked.attempted)
+    if (st.state === 'failed') {
+      return {
+        outcome: isHandoffOutcome(st.failure?.kind) ? st.failure.kind : 'failure_kind_unknown',
+        retryable: st.failure?.retrySafe ?? false,
+      }
+    }
+    if (st.state === 'blocked' && st.blocked) return handoffForBlocked(st.blocked.reason, st.blocked.attempted)
+    if (st.state === 'connected' || st.state === 'idle') return null
+    return { outcome: 'install_plan_canceled', retryable: false }
+  }
+
+  useEffect(() => {
+    window.addEventListener(OPEN_EVENT, openModal)
+    return () => window.removeEventListener(OPEN_EVENT, openModal)
+  })
+
   // Re-attach to a server-owned flow whenever one is observed while the modal
   // is open — the status query may resolve after openModal ran.
   useEffect(() => {
     if (open && lane === 'driver' && flowLive) setInFlowView(true)
   }, [open, lane, flowLive])
 
-  // prepareFailed outlives the dialog but must not outlive the cluster it
-  // describes: a context switch swaps every query cache, yet this component
-  // stays mounted, so without the reset cluster A's failure would relabel the
-  // CTA for cluster B.
+  // handoff and a blocked plan outlive the dialog but must not outlive the
+  // cluster they describe: a context switch swaps every query cache, yet this
+  // component stays mounted, so without the reset cluster A's outcome would
+  // relabel the CTA (and the link) for cluster B, and a blocked view left
+  // armed would reopen on B with A's refusal, feeding it back into the
+  // outcome on Back.
   const contextName = useClusterInfo().data?.context
   useEffect(() => {
-    setPrepareFailed(false)
+    setHandoff(null)
+    setBlocked(null)
   }, [contextName])
 
   // The server owns the "nothing to pitch" decision: an already-tunneled
@@ -248,9 +306,9 @@ export function CloudFunnelButton() {
             <CloudConnectFlow
               status={flowForView}
               blocked={blocked}
-              signupUrl={signupUrlFor('flow-escape')}
+              exit={exitFor(appUrl, 'driver-blocked-card-browser-link', outcomeOf(flowForView))}
               onStatus={applyStatus}
-              onExit={() => exitFlow(flowForView.state === 'failed')}
+              onExit={() => exitFlow(outcomeOf(flowForView))}
             />
           </div>
         ) : (
@@ -261,10 +319,12 @@ export function CloudFunnelButton() {
             <ModalFooter
               lane={lane}
               signupUrl={signupUrl}
-              // driver-escape after a failed attempt, driver-alt before one, so
-              // the Hub can tell "prefers the browser" from "app path broke".
-              driverEscapeUrl={signupUrlFor(prepareFailed ? 'driver-escape' : 'driver-alt')}
+              // One link name whether or not an attempt preceded the click; the
+              // outcome, when present, is what says an attempt happened.
+              driverBrowserUrl={buildSignupUrl(appUrl, 'driver-footer-browser-link', handoff)}
               prepareFailed={prepareFailed}
+              // A prepare error's reason, kept on the pitch after its toast is gone.
+              prepareError={handoff?.detail}
               assurances={connectInfo.data?.assurances}
               notice={connectInfo.data?.notice}
               self={inCluster ? self.data : undefined}
@@ -316,8 +376,9 @@ function Eyebrow() {
 function ModalFooter({
   lane,
   signupUrl,
-  driverEscapeUrl,
+  driverBrowserUrl,
   prepareFailed,
+  prepareError,
   assurances,
   notice,
   self,
@@ -327,10 +388,11 @@ function ModalFooter({
 }: {
   lane: 'driver' | 'wizard'
   signupUrl: string
-  // Same destination as signupUrl, distinct utm_content: the caller encodes
-  // whether this render follows a failed in-app attempt.
-  driverEscapeUrl: string
+  // Same destination as signupUrl, distinct utm_content, and the outcome of
+  // an in-app attempt when one preceded this render.
+  driverBrowserUrl: string
   prepareFailed: boolean
+  prepareError?: string
   // Live copy from the Hub; undefined until (or unless) it arrives.
   assurances?: string[]
   notice?: string
@@ -409,7 +471,7 @@ function ModalFooter({
                 a recovery path — install-averse operators need the door before
                 anything fails, or they close the modal instead. */}
             <a
-              href={driverEscapeUrl}
+              href={driverBrowserUrl}
               target="_blank"
               rel="noopener noreferrer"
               className="whitespace-nowrap text-[12.5px] text-theme-text-secondary hover:text-theme-text-primary hover:underline underline-offset-2 transition-colors"
@@ -433,6 +495,15 @@ function ModalFooter({
           Maybe later
         </button>
       </div>
+      {/* The last attempt's stop, when Radar could not even inspect the
+          cluster: the toast that first said so is gone in seconds, and "Try
+          again" alone does not say what to try again for. The footer link
+          above is the way around it. */}
+      {lane === 'driver' && prepareError && (
+        <p className="mt-2.5 text-[11.5px] leading-relaxed text-amber-600 dark:text-amber-400">
+          Radar couldn’t inspect this cluster: {prepareError}
+        </p>
+      )}
       {/* Mechanics, not marketing: a falsifiable claim the plan card then
           fulfills. Sits next to the button whose click it de-risks. */}
       {lane === 'driver' && (