@skyhook-io/radar-app 1.13.5 → 1.14.0

package/src/components/SyncProgressPanel.tsx

@@ -0,0 +1,73 @@
+import { useMemo } from 'react'
+import { Loader2, ArrowRight } from 'lucide-react'
+import { StatusDot } from '@skyhook-io/k8s-ui'
+import type { SyncStatusSnapshot } from '../api/client'
+
+// Shown in place of views that need the full cluster dataset while the
+// initial informer sync is still running. Resource views for already-synced
+// kinds work during this window — the per-kind list doubles as the map of
+// what's usable right now.
+export function SyncProgressPanel({
+  syncStatus,
+  onNavigateToKind,
+}: {
+  syncStatus: SyncStatusSnapshot
+  onNavigateToKind: (key: string) => void
+}) {
+  const total = syncStatus.criticalTotal + syncStatus.deferredTotal
+  const synced = syncStatus.criticalSynced + syncStatus.deferredSynced
+  const kinds = useMemo(
+    () => [...syncStatus.kinds].sort((a, b) => {
+      // Ready first, failed last, both alphabetical within their group.
+      const rank = (k: typeof a) => (k.synced ? 0 : k.failed ? 2 : 1)
+      if (rank(a) !== rank(b)) return rank(a) - rank(b)
+      return a.kind.localeCompare(b.kind)
+    }),
+    [syncStatus.kinds],
+  )
+  const failedCount = useMemo(
+    () => syncStatus.kinds.filter((k) => k.failed).length,
+    [syncStatus.kinds],
+  )
+
+  return (
+    <div className="flex-1 flex items-center justify-center overflow-y-auto bg-theme-base">
+      <div className="max-w-xl w-full px-8 py-10">
+        <div className="flex items-center gap-3 mb-1">
+          <Loader2 className="w-5 h-5 animate-spin text-theme-text-tertiary" />
+          <h2 className="text-lg font-semibold text-theme-text-primary">Loading cluster data</h2>
+        </div>
+        <p className="text-sm text-theme-text-secondary mb-6">
+          {synced} of {total} resource types ready — views open as their data finishes loading.
+          This view needs the full dataset and will appear automatically.
+          {failedCount > 0 && (
+            <span className="block mt-1 text-red-400">
+              {failedCount} resource {failedCount === 1 ? 'type' : 'types'} failed to load within the
+              sync deadline — affected views will show an error. Retry the connection to try again.
+            </span>
+          )}
+        </p>
+        <div className="card-inner grid grid-cols-2 gap-x-6 gap-y-1.5 max-h-80 overflow-y-auto">
+          {kinds.map((k) => (
+            <div key={k.key} className="flex items-center gap-2 min-w-0 text-sm">
+              <StatusDot tone={k.synced ? 'healthy' : k.failed ? 'unhealthy' : 'neutral'} size="sm" className="shrink-0" />
+              {k.synced ? (
+                <button
+                  onClick={() => onNavigateToKind(k.key)}
+                  className="group flex items-center gap-1 min-w-0 text-theme-text-primary hover:text-theme-brand transition-colors"
+                >
+                  <span className="truncate">{k.kind}</span>
+                  <ArrowRight className="w-3 h-3 opacity-0 group-hover:opacity-100 transition-opacity shrink-0" />
+                </button>
+              ) : k.failed ? (
+                <span className="truncate text-red-400">{k.kind} — failed</span>
+              ) : (
+                <span className="truncate text-theme-text-tertiary animate-pulse">{k.kind}</span>
+              )}
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  )
+}

package/src/components/audit/AuditView.tsx

@@ -124,6 +124,8 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
         checks={data.groupedChecks ?? []}
         catalog={data.checks ?? {}}
         anyData
+        evaluated={data.summary.passing + data.summary.warning + data.summary.danger}
+        missingInputs={data.missingInputs}
         onResourceClick={onResourceClick}
         onHideCheck={canEdit ? hideCheck : undefined}
         onHideCategory={canEdit ? hideCategory : undefined}

package/src/components/cloudConnectHandoff.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, it } from 'vitest'
+import { ApiError, type CloudInstallAttempted } from '../api/client'
+import { exitFor, handoffForBlocked, handoffForPrepareError, isHandoffOutcome, signupUrlFor } from './cloudConnectHandoff'
+
+const APP = 'https://app.test.example'
+const UTM = 'utm_source=radar-oss&utm_medium=app&utm_campaign=cloud-modal'
+const CARD = 'driver-blocked-card-browser-link'
+
+const attempted = (over: Partial<CloudInstallAttempted>): CloudInstallAttempted => ({
+  mode: 'fresh',
+  namespace: 'radar',
+  release: 'radar',
+  stage: 'preflight',
+  ...over,
+})
+
+describe('signupUrlFor', () => {
+  it('tags the link and omits the outcome when there was no attempt', () => {
+    expect(signupUrlFor(APP, 'driver-footer-browser-link')).toBe(`${APP}/signup?${UTM}&utm_content=driver-footer-browser-link`)
+    expect(signupUrlFor(APP, 'driver-footer-browser-link', null)).not.toContain('radar_outcome')
+  })
+
+  it('appends a well-formed outcome after an attempt', () => {
+    expect(signupUrlFor(APP, 'driver-footer-browser-link', { outcome: 'hub_connect_request_failed', retryable: true })).toMatch(
+      /utm_content=driver-footer-browser-link&radar_outcome=hub_connect_request_failed$/,
+    )
+  })
+
+  it('never forwards an outcome outside the vocabulary shape', () => {
+    // A server message or a cluster name must not ride along in the link.
+    for (const bad of ['connect failed: dial tcp 10.0.0.1', 'Prod-East', '', 'a'.repeat(41), 'x&y=1']) {
+      expect(signupUrlFor(APP, 'driver-footer-browser-link', { outcome: bad, retryable: true })).not.toContain('radar_outcome')
+    }
+  })
+})
+
+describe('exitFor — every blocked card has one exit, chosen by what Radar established', () => {
+  it('adopts a release Radar found, pinned to the Helm tab', () => {
+    const h = handoffForBlocked('preflight', attempted({ mode: 'adopt', namespace: 'monitoring', release: 'radar-prod', stage: 'inspect' }))
+    const exit = exitFor(APP, CARD, h)
+    expect(exit).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(exit.href).toBe(
+      `${APP}/install?existing=1&ns=monitoring&release=radar-prod&method=helm&${UTM}&utm_content=${CARD}&radar_outcome=blocked_preflight_checks_failed`,
+    )
+  })
+
+  it('offers a fresh install only from a complete plan whose discovery saw the whole cluster', () => {
+    const fresh = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({})))
+    expect(fresh).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(fresh.href).toContain('/install?method=helm&')
+    expect(fresh.href).not.toContain('existing')
+
+    // A partial scan may have missed a Radar elsewhere; guessing fresh would
+    // reset its values, so the exit is Radar Cloud itself.
+    const partial = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({ partialScan: true })))
+    expect(partial).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(partial.href).toContain('/signup?')
+    expect(partial.href).toContain('radar_outcome=blocked_preflight_checks_failed')
+  })
+
+  it('offers a fresh install when nothing is running and only the release records were unread', () => {
+    const exit = exitFor(APP, CARD, handoffForBlocked('preflight', attempted({ stage: 'inspect', releaseUnread: true })))
+    expect(exit).toMatchObject({ install: true, label: 'Get the install command' })
+    expect(exit.href).toContain('/install?method=helm&')
+  })
+
+  it('sends an unknown target to Radar Cloud, never to a guessed install', () => {
+    const exit = exitFor(APP, CARD, handoffForBlocked('preflight'))
+    expect(exit).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(exit.href).toContain('/signup?')
+  })
+
+  it('hands a GitOps-managed release to its verified controller’s tab', () => {
+    for (const [method, label] of [
+      ['argocd', 'Get the Argo CD values patch'],
+      ['flux', 'Get the Flux values patch'],
+    ] as const) {
+      const exit = exitFor(APP, CARD, handoffForBlocked('gitops', attempted({ mode: 'gitops', namespace: 'radar', release: 'radar', stage: 'inspect', method })))
+      expect(exit).toMatchObject({ install: true, label })
+      expect(exit.href).toContain(`/install?existing=1&ns=radar&release=radar&method=${method}&`)
+    }
+    // An unverified or unrecognized owner gets no patch for the wrong tool.
+    const unknownOwner = exitFor(APP, CARD, handoffForBlocked('gitops', attempted({ mode: 'gitops', stage: 'inspect', method: '' })))
+    expect(unknownOwner).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+  })
+
+  it('never turns an unsupported refusal into an install, even with a known release', () => {
+    // Preparation can refuse after inspection found a release (incompatible
+    // settings, a token Secret already present); the card still keeps that
+    // as evidence, but the exit is Radar Cloud, not an install over it.
+    const exit = exitFor(APP, CARD, handoffForBlocked('unsupported', attempted({ mode: 'adopt', stage: 'prepare' })))
+    expect(exit).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+    expect(exit.href).toContain('radar_outcome=blocked_unsupported_install')
+    expect(exitFor(APP, CARD, handoffForBlocked('unsupported'))).toMatchObject({ install: false, label: 'Open Radar Cloud' })
+  })
+})
+
+describe('handoffForPrepareError', () => {
+  it('separates no cluster, inspection failed, Radar unreachable, and an unusable response', () => {
+    expect(handoffForPrepareError(new ApiError('down', 503)).outcome).toBe('radar_not_connected_to_cluster')
+    expect(handoffForPrepareError(new ApiError('nope', 500)).outcome).toBe('cluster_inspect_failed')
+    expect(handoffForPrepareError(new TypeError('Failed to fetch')).outcome).toBe('radar_server_unreachable')
+    expect(handoffForPrepareError(new SyntaxError('Unexpected token <')).outcome).toBe('cluster_inspect_request_error')
+  })
+
+  it('is worth trying again and keeps the message for the pitch', () => {
+    const h = handoffForPrepareError(new ApiError('Not connected to cluster', 503))
+    expect(h.retryable).toBe(true)
+    expect(h.detail).toBe('Not connected to cluster')
+  })
+})
+
+describe('handoffForBlocked', () => {
+  it('names the refusal, does not offer a retry, and keeps what Radar attempted', () => {
+    expect(handoffForBlocked('gitops')).toEqual({ outcome: 'blocked_gitops_managed_install', retryable: false, target: null })
+    expect(handoffForBlocked('preflight')).toEqual({ outcome: 'blocked_preflight_checks_failed', retryable: false, target: null })
+    expect(handoffForBlocked('unsupported')).toEqual({ outcome: 'blocked_unsupported_install', retryable: false, target: null })
+    const a = attempted({ mode: 'adopt', partialScan: false })
+    expect(handoffForBlocked('preflight', a).target).toBe(a)
+  })
+})
+
+describe('isHandoffOutcome', () => {
+  it('accepts the server failure kinds verbatim', () => {
+    for (const kind of [
+      'hub_connect_request_failed',
+      'hub_approval_poll_failed',
+      'approval_rejected_in_browser',
+      'approval_window_expired',
+      'approved_but_credential_pickup_expired',
+      'approval_outcome_unknown',
+      'canceled_before_approval_page',
+      'canceled_after_approval',
+      'helm_provision_failed',
+      'installed_but_tunnel_not_confirmed',
+    ]) {
+      expect(isHandoffOutcome(kind)).toBe(true)
+    }
+  })
+})

package/src/components/cloudConnectHandoff.ts

@@ -0,0 +1,124 @@
+import { ApiError, type CloudInstallAttempted, type CloudInstallBlocked } from '../api/client'
+
+// The Cloud dialog's links into the Hub. utm_content names the link that was
+// clicked. After an in-app connect attempt that did not end connected, the
+// link also carries radar_outcome, a short phrase for what happened, so the
+// wizard opens knowing what the person is coming from. The person sees both
+// in the address bar, so every value reads as plain words about the flow —
+// never an error message, never a cluster name. Anything that is not a short
+// snake_case phrase is dropped here and again on the Hub.
+export const SIGNUP_QUERY = '?utm_source=radar-oss&utm_medium=app&utm_campaign=cloud-modal'
+
+// What the person is coming from, whether the pitch should offer "Try
+// again" (a failure can be retried; a refusal or the person's own cancel
+// cannot be "tried again" without misreading it as something going wrong),
+// and, for a blocked plan, the release Radar found so the card's install
+// link adopts it instead of opening a fresh install over it.
+export interface Handoff {
+  outcome: string
+  retryable: boolean
+  // What Radar attempted, when it got that far — the blocked card's evidence
+  // and the input to the exit it offers.
+  target?: CloudInstallAttempted | null
+  // A prepare error's message, shown on the pitch so the reason outlives the
+  // toast that first carried it.
+  detail?: string
+}
+
+// Closed shape, not a closed list: flow failure kinds come from the server
+// (hub_connect_request_failed, approval_window_expired, helm_provision_failed,
+// …) and this frontend must not need a release to forward a new one.
+const OUTCOME_SHAPE = /^[a-z][a-z_]{0,39}$/
+
+export function isHandoffOutcome(value: unknown): value is string {
+  return typeof value === 'string' && OUTCOME_SHAPE.test(value)
+}
+
+// The prepare POST failed before any flow existed, so there is no failure
+// kind to forward; classify by HTTP class. Prepare never contacts the Hub: a
+// 503 is Radar without a cluster (disconnected or still connecting), any other
+// status is Radar itself declining or failing the inspection, a TypeError is
+// fetch failing to reach Radar's own server, and anything else is a response
+// that could not be used. All of them are worth trying again.
+export function handoffForPrepareError(err: unknown): Handoff {
+  let outcome = 'cluster_inspect_request_error'
+  if (err instanceof ApiError) {
+    outcome = err.status === 503 ? 'radar_not_connected_to_cluster' : 'cluster_inspect_failed'
+  } else if (err instanceof TypeError) {
+    outcome = 'radar_server_unreachable'
+  }
+  return { outcome, retryable: true, detail: err instanceof Error ? err.message : undefined }
+}
+
+// A blocked plan was refused for a stated reason and trying again reproduces
+// it; the wizard is the next step, not a retry.
+const BLOCKED_OUTCOMES: Record<CloudInstallBlocked['reason'], string> = {
+  gitops: 'blocked_gitops_managed_install',
+  preflight: 'blocked_preflight_checks_failed',
+  unsupported: 'blocked_unsupported_install',
+}
+
+export function handoffForBlocked(reason: CloudInstallBlocked['reason'], target?: CloudInstallAttempted | null): Handoff {
+  return { outcome: BLOCKED_OUTCOMES[reason], retryable: false, target: target ?? null }
+}
+
+export function signupUrlFor(appUrl: string, content: string, handoff?: Handoff | null): string {
+  const url = `${appUrl}/signup${SIGNUP_QUERY}&utm_content=${content}`
+  return handoff && isHandoffOutcome(handoff.outcome) ? `${url}&radar_outcome=${handoff.outcome}` : url
+}
+
+// The one exit every blocked card offers. An install-page deep link is
+// justified only where Radar established both the target and the operation:
+// a release it found (adopt, or its GitOps owner's values patch), or a fresh
+// install from a complete plan whose discovery saw the whole cluster. The
+// Hub's fresh command would reset an existing release's values and its script
+// writes the token Secret before Helm runs, so a guessed target is never
+// linked. Everywhere else the exit is Radar Cloud itself — the same
+// signup/login entry as the pitch — and the copy hands the work to an admin.
+// Signed out, the Hub stashes an /install link across sign-in only when it
+// carries a target or a method, so every install link carries one.
+export interface BlockedExit {
+  href: string
+  label: string
+  // True when href is the install page for an established target.
+  install: boolean
+}
+
+export function exitFor(appUrl: string, content: string, handoff: Handoff | null | undefined): BlockedExit {
+  const generic = { href: signupUrlFor(appUrl, content, handoff), label: 'Open Radar Cloud', install: false }
+  const t = handoff?.target
+  if (!t) return generic
+  // An unsupported refusal names its own remedy (several Radars to pick from,
+  // a pairing to recover, ownership Radar will not guess at); a release it
+  // happens to know is not an invitation to install over it.
+  if (handoff?.outcome === BLOCKED_OUTCOMES.unsupported) return generic
+  const params = new URLSearchParams()
+  switch (t.mode) {
+    case 'adopt':
+      params.set('existing', '1')
+      params.set('ns', t.namespace)
+      params.set('release', t.release)
+      params.set('method', 'helm')
+      return { href: installHref(appUrl, content, handoff, params), label: 'Get the install command', install: true }
+    case 'gitops':
+      if (t.method !== 'argocd' && t.method !== 'flux') return generic
+      params.set('existing', '1')
+      params.set('ns', t.namespace)
+      params.set('release', t.release)
+      params.set('method', t.method)
+      return {
+        href: installHref(appUrl, content, handoff, params),
+        label: `Get the ${t.method === 'argocd' ? 'Argo CD' : 'Flux'} values patch`,
+        install: true,
+      }
+    default:
+      if (t.partialScan) return generic
+      params.set('method', 'helm')
+      return { href: installHref(appUrl, content, handoff, params), label: 'Get the install command', install: true }
+  }
+}
+
+function installHref(appUrl: string, content: string, handoff: Handoff | null | undefined, params: URLSearchParams): string {
+  const url = `${appUrl}/install?${params.toString()}&${SIGNUP_QUERY.slice(1)}&utm_content=${content}`
+  return handoff && isHandoffOutcome(handoff.outcome) ? `${url}&radar_outcome=${handoff.outcome}` : url
+}

package/src/components/diagnose/DiagnoseContext.tsx

@@ -36,6 +36,7 @@ import {
   type ExecutionProfile,
 } from "../../api/diagnose";
 import { runTargetKey } from "./target";
+import { knownKindForPluralWithGroup } from "../../utils/navigation";
 
 export interface Target {
   kind: string;
@@ -660,7 +661,7 @@ function RoutedDiagnoseProvider({
   const startRunRef = useRef<(t: Target) => void>(() => {});
   startRunRef.current = (t: Target) => {
     const seq = ++startSeqRef.current;
-    createRun(t, {
+    createRun({ ...t, kind: knownKindForPluralWithGroup(t.kind, t.group) ?? t.kind }, {
       agent: selectedAgent || undefined,
       profile: hosted ? undefined : effectiveProfile,
       model: model || undefined,

package/src/components/diagnose/investigationEvidence/adapters/changes.ts

@@ -0,0 +1,60 @@
+import { type IssueRecentChange } from "@skyhook-io/k8s-ui";
+import {
+  ProjectionBuilder,
+  addChanges,
+  addNarrowHint,
+  changesSubjectFromArgs,
+  invalidPayload,
+  scopeFromArgs,
+  sourceArgsRelevance,
+} from "../observations";
+import { nonEmptyString, parseJSON, recentChange, record } from "../parse";
+import { type InvestigationEvidenceSource } from "../types";
+
+export function adaptChanges(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  // The producer serializes an empty result as a nil slice, which is null.
+  const changesRaw = value?.changes === null ? [] : value?.changes;
+  if (!value || !Array.isArray(changesRaw)) {
+    invalidPayload(builder, source, "Recent changes");
+    return;
+  }
+  const changes = changesRaw
+    .map(recentChange)
+    .filter((item): item is IssueRecentChange => Boolean(item));
+  if (changes.length !== changesRaw.length) {
+    invalidPayload(builder, source, "Recent changes");
+    return;
+  }
+  addNarrowHint(builder, source, value);
+  let sourceErrors = 0;
+  if (Array.isArray(value.sourcesErrored)) {
+    for (const sourceError of value.sourcesErrored) {
+      if (nonEmptyString(sourceError)) {
+        sourceErrors += 1;
+        builder.limit(source, "Recent changes", sourceError, "error");
+      }
+    }
+  } else if (value.sourcesErrored !== undefined) {
+    invalidPayload(builder, source, "Recent changes source coverage");
+  }
+  // Reads of one resource's history are revisions of one card however the
+  // window or cap differs; the window is stated in the title instead.
+  const args = record(source.args ? parseJSON(source.args) : undefined);
+  addChanges(
+    builder,
+    source,
+    changes,
+    `changes:${scopeFromArgs(source)}`,
+    undefined,
+    !nonEmptyString(value.narrowHint) && sourceErrors === 0,
+    false,
+    sourceArgsRelevance(builder, source),
+    changesSubjectFromArgs(source),
+    nonEmptyString(args?.since) ? args.since : undefined,
+  );
+}