@skyhook-io/radar-app 1.13.5 → 1.14.0

package/src/components/diagnose/investigationEvidence/adapters/events.ts

@@ -0,0 +1,96 @@
+import {
+  ProjectionBuilder,
+  addEvents,
+  addNarrowHint,
+  invalidPayload,
+  scopeFromArgs,
+  sourceArgsRelevance,
+} from "../observations";
+import { event, nonEmptyString, record, stringArray } from "../parse";
+import {
+  type InvestigationEventEvidence,
+  type InvestigationEvidenceSource,
+} from "../types";
+
+export function adaptEvents(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  // The producer serializes an empty result as a nil slice, which is null.
+  const eventsRaw = value?.events === null ? [] : value?.events;
+  if (!value || !Array.isArray(eventsRaw)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const events = eventsRaw
+    .map(event)
+    .filter((item): item is InvestigationEventEvidence => Boolean(item));
+  if (events.length !== eventsRaw.length) {
+    invalidPayload(builder, source);
+    return;
+  }
+  addNarrowHint(builder, source, value);
+  // The producer answers a namespace the caller cannot read with an empty
+  // list and marks it. Only that case is a coverage gap. Any other complete,
+  // successful empty read answers the question it asked and is filed as a
+  // checked receipt; a gap there would contradict an events card from another
+  // call in the same turn. The receipt names the one remaining ambiguity for
+  // producers that predate the marker.
+  if (value.accessDenied === true) {
+    builder.limit(
+      source,
+      "Events",
+      `Events in ${scopeFromArgs(source)} are not readable with your permissions.`,
+      "error",
+    );
+    return;
+  }
+  // A cluster-wide read the producer narrowed to the caller's namespaces
+  // answers for those alone, so neither its empty receipt nor its card may
+  // stand for the cluster.
+  const narrowedTo = narrowedEventScope(value);
+  if (narrowedTo && events.length > 0) {
+    builder.limit(
+      source,
+      "Events",
+      `This cluster-wide events read covered only the namespaces you can read (${narrowedTo}).`,
+      "unknown",
+    );
+  }
+  addEvents(
+    builder,
+    source,
+    events,
+    `events:${source.args ?? scopeFromArgs(source)}`,
+    !nonEmptyString(value.narrowHint),
+    true,
+    sourceArgsRelevance(builder, source),
+    narrowedTo
+      ? {
+          title: "No events in the namespaces you can read",
+          message: `Read ${narrowedTo}. Namespaces outside your permissions were not read, so this does not clear the cluster.`,
+        }
+      : {
+          title: "No events in this window",
+          message:
+            "Events outside this window or its filters are not covered, and a namespace you cannot read also returns nothing.",
+        },
+  );
+}
+/**
+ * Names the namespaces a cluster-wide events read was actually narrowed to,
+ * or undefined when the read covered everything the query asked for.
+ */
+function narrowedEventScope(
+  value: Record<string, unknown>,
+): string | undefined {
+  if (value.partialScope !== true) return undefined;
+  const namespaces = (stringArray(value.scopeNamespaces) ?? []).filter(
+    nonEmptyString,
+  );
+  return namespaces.length > 0
+    ? namespaces.join(", ")
+    : "the namespaces you can read";
+}

package/src/components/diagnose/investigationEvidence/adapters/helm.test.ts

@@ -0,0 +1,242 @@
+import { describe, expect, it } from "vitest";
+import { investigationEvidenceSubjectRef } from "../index";
+import { groupsOf, project, tool } from "../evidenceFixtures";
+
+const helmRelease = {
+  name: "shop",
+  namespace: "shop",
+  chart: "shop",
+  chartVersion: "1.4.2",
+  appVersion: "2.0.0",
+  status: "deployed",
+  revision: 7,
+  updated: "2026-09-07T07:00:00Z",
+  description: "Upgrade complete",
+  resources: [
+    {
+      kind: "Deployment",
+      apiVersion: "apps/v1",
+      name: "api",
+      namespace: "shop",
+      status: "Running",
+      ready: "0/1",
+    },
+    {
+      kind: "Service",
+      apiVersion: "v1",
+      name: "api",
+      namespace: "shop",
+      status: "Active",
+    },
+  ],
+};
+
+describe("helm release adapter", () => {
+  it("relates a release through the resources it manages", () => {
+    const projection = project([
+      tool("helm", "get_helm_release", helmRelease, {
+        summary: JSON.stringify({ namespace: "shop", name: "shop" }),
+      }),
+      tool(
+        "helm-other",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "ingress",
+          resources: [
+            {
+              kind: "Deployment",
+              apiVersion: "apps/v1",
+              name: "api",
+              namespace: "ingress",
+            },
+          ],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "ingress" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(releases.map((group) => group.latest.relevance)).toEqual([
+      "producer-related",
+      "broader",
+    ]);
+    expect(releases[0].latest).toMatchObject({
+      tier: "context",
+      tone: "info",
+      title: "Helm release shop/shop",
+      summary: "shop 1.4.2 · deployed · revision 7",
+    });
+    expect(investigationEvidenceSubjectRef(releases[0].latest.data)).toEqual({
+      kind: "HelmRelease",
+      group: "helm.sh",
+      namespace: "shop",
+      name: "shop",
+    });
+  });
+
+  it("never fills a missing owned-resource API version from the target", () => {
+    const projection = project([
+      tool(
+        "helm-no-version",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          resources: [{ kind: "Deployment", name: "api", namespace: "shop" }],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-other-group",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-x",
+          resources: [
+            {
+              kind: "Deployment",
+              apiVersion: "example.io/v1",
+              name: "api",
+              namespace: "shop",
+            },
+          ],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-x" }) },
+      ),
+    ]);
+    expect(
+      groupsOf(projection.groups, "helm").map(
+        (group) => group.latest.relevance,
+      ),
+    ).toEqual(["broader", "broader"]);
+  });
+
+  it("keys a release by its storage namespace and withholds a link it cannot express", () => {
+    const projection = project([
+      tool(
+        "helm-a",
+        "get_helm_release",
+        { ...helmRelease, storageNamespace: "flux-a" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-b",
+        "get_helm_release",
+        { ...helmRelease, storageNamespace: "flux-b", revision: 9 },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(releases.map((group) => group.identity)).toEqual([
+      "helm:flux-a:shop:shop",
+      "helm:flux-b:shop:shop",
+    ]);
+    expect(releases[0].latest.data).toMatchObject({
+      release: { storageNamespace: "flux-a" },
+    });
+    expect(investigationEvidenceSubjectRef(releases[0].latest.data)).toBe(
+      undefined,
+    );
+  });
+
+  it("treats a non-deployed status, a health issue, or a failed operation as adverse", () => {
+    const projection = project([
+      tool(
+        "helm-failed",
+        "get_helm_release",
+        { ...helmRelease, status: "failed", description: "Upgrade failed" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-issue",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-cache",
+          resourceHealth: "unhealthy",
+          healthIssue: "Deployment shop/cache has 0/1 ready replicas",
+          healthSummary: "1 of 2 resources unhealthy",
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-cache" }) },
+      ),
+      tool(
+        "helm-stuck",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-jobs",
+          status: "pending-upgrade",
+          lastOperation: {
+            kind: "pending",
+            status: "stuck_pending",
+            source: "helm_status",
+            confidence: "high",
+            message: "Revision 8 has been pending-upgrade for 42m",
+            revision: 8,
+          },
+          valuesError:
+            'Radar Cloud role "viewer" cannot view Helm release values (requires member or higher)',
+          diffError:
+            'Radar Cloud role "viewer" cannot view Helm release diffs (requires member or higher)',
+          valuesDiffError: "values diff failed",
+          notesDiffError: "notes diff failed",
+          resourceDiffError: "resource diff failed",
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-jobs" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(
+      releases.map((group) => [group.latest.tier, group.latest.tone]),
+    ).toEqual([
+      ["supporting", "error"],
+      ["supporting", "warning"],
+      ["supporting", "warning"],
+    ]);
+    expect(releases[1].latest.summary).toBe(
+      "deployed · Deployment shop/cache has 0/1 ready replicas",
+    );
+    expect(releases[2].latest.data).toMatchObject({
+      type: "helm",
+      release: {
+        lastOperation: { kind: "pending", status: "stuck_pending" },
+      },
+    });
+    // Every comparison the producer could not finish has to reach the reader:
+    // three of these are role denials, and a release card that omits a withheld
+    // diff without saying so reads as a complete one.
+    expect(projection.limitations).toEqual([
+      expect.objectContaining({ source: "Helm values", kind: "error" }),
+      expect.objectContaining({ source: "Helm values diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm manifest diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm notes diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm resource diff", kind: "error" }),
+    ]);
+  });
+
+  it("rejects malformed release payloads", () => {
+    const projection = project([
+      tool(
+        "helm-bad",
+        "get_helm_release",
+        { ...helmRelease, revision: "7" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-bad-resource",
+        "get_helm_release",
+        { ...helmRelease, resources: [{ kind: "Deployment" }] },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-bad-operation",
+        "get_helm_release",
+        { ...helmRelease, lastOperation: { kind: "rollback" } },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+    ]);
+    expect(projection.groups).toHaveLength(0);
+    expect(
+      projection.limitations.map((limitation) => limitation.source),
+    ).toEqual(["Helm release", "Helm resources", "Helm operation"]);
+  });
+});

package/src/components/diagnose/investigationEvidence/adapters/helm.ts

@@ -0,0 +1,208 @@
+import { apiVersionToGroup } from "../../../../utils/navigation";
+import {
+  ProjectionBuilder,
+  evidenceTierForRelevance,
+  invalidPayload,
+  resourceMatchesTarget,
+} from "../observations";
+import { nonEmptyString, record } from "../parse";
+import {
+  type InvestigationEvidenceRelevance,
+  type InvestigationEvidenceSource,
+  type InvestigationHelmOperation,
+  type InvestigationHelmOwnedResource,
+  type InvestigationHelmRelease,
+} from "../types";
+
+function helmOwnedResource(
+  value: unknown,
+): InvestigationHelmOwnedResource | undefined {
+  const candidate = record(value);
+  if (
+    !candidate ||
+    !nonEmptyString(candidate.kind) ||
+    !nonEmptyString(candidate.name) ||
+    typeof candidate.namespace !== "string"
+  ) {
+    return undefined;
+  }
+  for (const field of [
+    "apiVersion",
+    "status",
+    "ready",
+    "message",
+    "summary",
+    "issue",
+  ] as const) {
+    if (candidate[field] !== undefined && typeof candidate[field] !== "string")
+      return undefined;
+  }
+  return candidate as unknown as InvestigationHelmOwnedResource;
+}
+function helmOperation(value: unknown): InvestigationHelmOperation | undefined {
+  const candidate = record(value);
+  if (
+    !candidate ||
+    !nonEmptyString(candidate.kind) ||
+    !nonEmptyString(candidate.status) ||
+    typeof candidate.message !== "string"
+  ) {
+    return undefined;
+  }
+  for (const field of [
+    "revision",
+    "failedRevision",
+    "rollbackRevision",
+  ] as const) {
+    if (candidate[field] !== undefined && typeof candidate[field] !== "number")
+      return undefined;
+  }
+  if (candidate.updated !== undefined && typeof candidate.updated !== "string")
+    return undefined;
+  return candidate as unknown as InvestigationHelmOperation;
+}
+export function adaptHelmRelease(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  if (
+    !value ||
+    !nonEmptyString(value.name) ||
+    !nonEmptyString(value.namespace) ||
+    typeof value.chart !== "string" ||
+    typeof value.chartVersion !== "string" ||
+    !nonEmptyString(value.status) ||
+    typeof value.revision !== "number" ||
+    typeof value.updated !== "string"
+  ) {
+    invalidPayload(builder, source);
+    return;
+  }
+  for (const field of [
+    "appVersion",
+    "description",
+    "storageNamespace",
+    "resourceHealth",
+    "healthIssue",
+    "healthSummary",
+    "managedByFluxHelmRelease",
+  ] as const) {
+    if (value[field] !== undefined && typeof value[field] !== "string") {
+      invalidPayload(builder, source);
+      return;
+    }
+  }
+  const resourcesRaw =
+    value.resources === undefined || value.resources === null
+      ? []
+      : value.resources;
+  if (!Array.isArray(resourcesRaw)) {
+    invalidPayload(builder, source, "Helm resources");
+    return;
+  }
+  const resources = resourcesRaw
+    .map(helmOwnedResource)
+    .filter((item): item is InvestigationHelmOwnedResource => Boolean(item));
+  if (resources.length !== resourcesRaw.length) {
+    invalidPayload(builder, source, "Helm resources");
+    return;
+  }
+  const lastOperation =
+    value.lastOperation === undefined
+      ? undefined
+      : helmOperation(value.lastOperation);
+  if (value.lastOperation !== undefined && !lastOperation) {
+    invalidPayload(builder, source, "Helm operation");
+    return;
+  }
+  const release: InvestigationHelmRelease = {
+    name: value.name,
+    namespace: value.namespace,
+    chart: value.chart,
+    chartVersion: value.chartVersion,
+    appVersion: value.appVersion as string | undefined,
+    status: value.status,
+    revision: value.revision,
+    updated: value.updated,
+    description: value.description as string | undefined,
+    ...(nonEmptyString(value.storageNamespace)
+      ? { storageNamespace: value.storageNamespace }
+      : {}),
+    resourceHealth: value.resourceHealth as string | undefined,
+    healthIssue: value.healthIssue as string | undefined,
+    healthSummary: value.healthSummary as string | undefined,
+    managedByFluxHelmRelease: value.managedByFluxHelmRelease as
+      string | undefined,
+    lastOperation,
+    resources,
+  };
+  // The release manages the target when the target is among the resources
+  // Helm rendered for it; a release is never the investigated object itself.
+  // Without an API version the owned row cannot tell colliding kinds apart
+  // (CNPG vs CAPI Cluster), so it establishes nothing.
+  const relevance: InvestigationEvidenceRelevance = resources.some(
+    (owned) =>
+      owned.apiVersion !== undefined &&
+      resourceMatchesTarget(builder.target, {
+        kind: owned.kind,
+        group: apiVersionToGroup(owned.apiVersion),
+        namespace: owned.namespace || undefined,
+        name: owned.name,
+      }),
+  )
+    ? "producer-related"
+    : "broader";
+  const status = release.status.toLowerCase();
+  const operationFailed =
+    lastOperation?.status === "failed" ||
+    lastOperation?.status === "stuck_pending";
+  const adverse =
+    status !== "deployed" || Boolean(release.healthIssue) || operationFailed;
+  const chartLabel = `${release.chart}${release.chartVersion ? ` ${release.chartVersion}` : ""}`;
+  // Helm keys a release by where its metadata is stored; two releases with
+  // one name and namespace can live in different storage namespaces.
+  const storage = release.storageNamespace ?? release.namespace;
+  builder.observe(
+    `helm:${storage}:${release.namespace}:${release.name}`,
+    "helm",
+    source,
+    {
+      tier: evidenceTierForRelevance(
+        adverse ? "supporting" : "context",
+        relevance,
+      ),
+      relevance,
+      tone:
+        status.includes("failed") || lastOperation?.status === "failed"
+          ? "error"
+          : adverse
+            ? "warning"
+            : "info",
+      title: `Helm release ${release.namespace}/${release.name}`,
+      summary: release.healthIssue
+        ? `${release.status} · ${release.healthIssue}`
+        : `${chartLabel} · ${release.status} · revision ${release.revision}`,
+      data: { type: "helm", release },
+    },
+  );
+  // Every comparison the producer attempted and could not finish, not just the
+  // values read. Four of these are Cloud-role denials, so dropping any of them
+  // lets a reader see a release card whose comparison was withheld and take it
+  // for complete. The labels follow the producer's own fields: `diff` is the
+  // manifest, `valuesDiff` the values — naming one for the other sends a reader
+  // to the wrong thing.
+  for (const [field, label] of [
+    ["valuesError", "Helm values"],
+    ["valuesDiffError", "Helm values diff"],
+    ["diffError", "Helm manifest diff"],
+    ["notesDiffError", "Helm notes diff"],
+    ["resourceDiffError", "Helm resource diff"],
+  ] as const) {
+    const message = value[field];
+    if (nonEmptyString(message)) {
+      builder.limit(source, label, message, "error");
+    }
+  }
+}