@skyhook-io/radar-app 1.13.5 → 1.14.1

package/src/api/client.ts

@@ -227,6 +227,64 @@ export function shouldRetryCapacityQuery(
   return failureCount < 3;
 }
 
+// isKindSyncPending matches the 503 the resource read handlers return while a
+// kind's informer is still completing its initial sync — the caller should
+// keep polling, not surface an error.
+export function isKindSyncPending(error: unknown): boolean {
+  return (
+    error instanceof ApiError &&
+    error.status === 503 &&
+    error.data?.error_code === "kind_sync_pending"
+  );
+}
+
+// isClusterConnecting matches the 503 the server returns while the whole
+// connection is still being established (no cache handle for this surface
+// yet) — like kind_sync_pending, a keep-polling signal, not an error.
+export function isClusterConnecting(error: unknown): boolean {
+  return (
+    error instanceof ApiError &&
+    error.status === 503 &&
+    error.data?.error_code === "cluster_connecting"
+  );
+}
+
+// isStillLoadingError groups the two retryable "the cluster is warming up"
+// signals every resource surface should sit out in a loading state.
+export function isStillLoadingError(error: unknown): boolean {
+  return isKindSyncPending(error) || isClusterConnecting(error);
+}
+
+// isKindSyncFailed matches the terminal variant: the kind never synced within
+// the deadline for this connection. Retrying won't help — show the error.
+export function isKindSyncFailed(error: unknown): boolean {
+  return (
+    error instanceof ApiError &&
+    error.status === 503 &&
+    error.data?.error_code === "kind_sync_failed"
+  );
+}
+
+// SyncKindState / SyncStatusSnapshot mirror k8score's SyncSnapshot — attached
+// to the connection-status payload while the initial informer sync is running.
+export interface SyncKindState {
+  kind: string;
+  key: string;
+  synced: boolean;
+  deferred: boolean;
+  // Terminal: the kind's sync deadline fired without completing.
+  failed?: boolean;
+}
+
+export interface SyncStatusSnapshot {
+  phase: string;
+  criticalTotal: number;
+  criticalSynced: number;
+  deferredTotal: number;
+  deferredSynced: number;
+  kinds: SyncKindState[];
+}
+
 const METRICS_API_GROUP_TOKENS = ["metrics", "k8s", "io"] as const;
 
 function mentionsMetricsAPIGroup(message: string): boolean {
@@ -435,6 +493,7 @@ export type DashboardAudit = AuditCardData;
 export type { AuditFinding, ResourceGroup, CheckMeta, Check };
 
 export interface AuditResponse {
+  missingInputs?: string[];
   summary: DashboardAudit;
   findings: AuditFinding[];
   groups: ResourceGroup[];
@@ -700,7 +759,7 @@ export function useResourceIssues(
   });
 }
 
-import type { Trace as NetworkTrace, InClusterCapability } from '@skyhook-io/k8s-ui'
+import type { Trace as NetworkTrace, InClusterCapability, DrainPlan, DrainPlanPod } from '@skyhook-io/k8s-ui'
 
 // useTrace polls the static path-shaped diagnosis for one network entry
 // kind. 5s refetch + 15s staleTime keeps the drawer feeling live without
@@ -1834,8 +1893,34 @@ export interface CloudInstallFailure {
   retrySafe: boolean
 }
 
+// What Radar did before it stopped: the operation it planned, how far it got,
+// and what it could establish about the cluster. Evidence for the card, and
+// the input to the exit it offers — the two are decided separately.
+export interface CloudInstallAttempted {
+  mode: 'fresh' | 'adopt' | 'gitops'
+  namespace: string
+  release: string
+  stage: 'inspect' | 'prepare' | 'preflight'
+  // Discovery saw only the default namespace; a fresh plan is not proof that
+  // no Radar exists elsewhere.
+  partialScan?: boolean
+  // A complete scan found no Radar running, but Helm's release records could
+  // not be read, so a leftover release cannot be ruled out.
+  releaseUnread?: boolean
+  // GitOps only: the Hub install-page tab of the verified owning controller.
+  method?: 'argocd' | 'flux' | ''
+}
+
 export interface CloudInstallBlocked {
   reason: 'gitops' | 'preflight' | 'unsupported'
+  // The Kubernetes user the attempt acted as; absent when the API server
+  // would not say.
+  identity?: string
+  // Preflight only: what would unblock it, and the Helm operation that was
+  // dry-run — the plan card never renders when preflight blocks, so the
+  // blocked card states what Radar tried itself.
+  cause?: 'permissions' | 'cluster' | 'verification'
+  attempted?: CloudInstallAttempted
   message: string
   blocking?: string[]
 }
@@ -1890,13 +1975,23 @@ export interface CloudConnectInfo {
   freeTier?: string
 }
 
-// Deliberately a bare cross-origin GET: no credentials, no identifiers, no
-// params. The Hub learns only what any HTTP request reveals.
-export function useCloudConnectInfo(apiUrl: string | undefined, enabled: boolean) {
+// Deliberately a bare cross-origin GET: no credentials, no identifiers. The
+// Hub learns what any HTTP request reveals plus `about`, below: the lane the
+// footer renders and this deployment's mode, both closed enums, so nothing
+// about the cluster or the person rides along. Part of the query key so a
+// lane change (a driver install that just became tunneled, say) refetches
+// instead of reusing the other lane's copy.
+export function useCloudConnectInfo(
+  apiUrl: string | undefined,
+  enabled: boolean,
+  about: { lane: "driver" | "wizard"; mode?: DeploymentMode },
+) {
+  const params = new URLSearchParams({ lane: about.lane });
+  if (about.mode) params.set("mode", about.mode);
   return useQuery<CloudConnectInfo>({
-    queryKey: ["cloud-connect-info", apiUrl],
+    queryKey: ["cloud-connect-info", apiUrl, about.lane, about.mode],
     queryFn: async () => {
-      const res = await fetch(`${apiUrl}/api/connect/info`, {
+      const res = await fetch(`${apiUrl}/api/connect/info?${params}`, {
         credentials: "omit",
         signal: AbortSignal.timeout(4000),
       });
@@ -2352,6 +2447,15 @@ export function useResource<T>(
     queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
     refetchInterval: options?.refetchInterval,
+    // Kind still completing its initial sync: stay in loading and poll until
+    // it becomes readable instead of erroring out (deep links during startup).
+    retry: (failureCount, error) => {
+      if (isStillLoadingError(error)) return true;
+      if (isKindSyncFailed(error)) return false;
+      return failureCount < 1; // matches the QueryClient default (retry: 1)
+    },
+    retryDelay: (failureCount, error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   });
 
   // Extract resource and relationships from the response
@@ -2375,6 +2479,15 @@ export function useResourceWithRelationships<T>(
     queryKey: ["resource", kind, namespace, name, group],
     queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: Boolean(kind && name),
+    // Deep-linked detail views can mount while the kind's informer is still
+    // completing its initial sync: keep polling instead of erroring out.
+    retry: (failureCount, error) => {
+      if (isStillLoadingError(error)) return true;
+      if (isKindSyncFailed(error)) return false;
+      return failureCount < 1; // matches the QueryClient default (retry: 1)
+    },
+    retryDelay: (failureCount, error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   });
 }
 
@@ -2397,6 +2510,16 @@ export function useResources<T>(
     enabled: (options?.enabled ?? true) && Boolean(kind),
     staleTime: 30000, // 30 seconds - matches refetchInterval in ResourcesView
     refetchInterval: options?.refetchInterval,
+    // Kind still completing its initial sync (progressive shell, or a
+    // deferred kind shortly after connect): keep polling instead of
+    // surfacing an error.
+    retry: (failureCount, error) => {
+      if (isStillLoadingError(error)) return true;
+      if (isKindSyncFailed(error)) return false;
+      return failureCount < 1; // matches the QueryClient default (retry: 1)
+    },
+    retryDelay: (failureCount, error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   });
 }
 
@@ -3067,6 +3190,8 @@ export function useTopNodeMetrics(options?: { enabled?: boolean }) {
 export interface PrometheusStatus {
   available: boolean;
   connected: boolean;
+  /** A discovery run is in flight for the current configuration. Never true alongside connected. */
+  discovering?: boolean;
   address?: string;
   service?: {
     namespace: string;
@@ -3173,6 +3298,8 @@ export interface RightsizingRow {
   currentPodOOM?: boolean;
   windowOomEvidence?: boolean;
   oomEvidenceAvailable: boolean;
+  /** The cluster cache would not list the workload's pods, so currentPodOOM is unknown rather than false. */
+  liveInventoryUnavailable?: boolean;
   limitConflict?: boolean;
   queryError?: string;
 }
@@ -3222,13 +3349,32 @@ export interface RightsizingScanResponse {
   reason?: string;
 }
 
+// Poll quickly while a discovery run is in flight so the flip to connected
+// (or to a failure message) lands promptly; otherwise the slow cadence. A
+// status that is neither connected nor carrying an outcome was read before
+// the server's run started (boot, context switch) — every run ends in one or
+// the other, so that state is transient and gets the fast cadence too.
+export const PROM_STATUS_POLL_DISCOVERING_MS = 2000;
+export const PROM_STATUS_POLL_IDLE_MS = 60000;
+
+export function prometheusStatusRefetchInterval(
+  status: PrometheusStatus | undefined,
+): number {
+  if (!status) return PROM_STATUS_POLL_IDLE_MS;
+  const settled = status.connected || !!status.error;
+  return status.discovering || !settled
+    ? PROM_STATUS_POLL_DISCOVERING_MS
+    : PROM_STATUS_POLL_IDLE_MS;
+}
+
 // Check Prometheus availability
 export function usePrometheusStatus() {
   return useQuery<PrometheusStatus>({
     queryKey: ["prometheus-status"],
     queryFn: () => fetchJSON("/prometheus/status"),
     staleTime: 30000,
-    refetchInterval: 60000,
+    refetchInterval: (query) =>
+      prometheusStatusRefetchInterval(query.state.data),
   });
 }
 
@@ -3237,6 +3383,9 @@ export interface ArgoStatus {
   // client is live. The two differ right after a restart (configured, reconnecting).
   configured: boolean;
   connected: boolean;
+  // Connected without a token: the install serves reads to everyone, so
+  // there is nothing to add in Settings.
+  anonymous?: boolean;
   address?: string;
   reason?: string;
 }
@@ -3343,6 +3492,12 @@ export function useAutoPromConnect(): void {
     // initial UI render isn't competing with the cluster network call.
     const delay = cached === "1" ? 0 : PROM_FIRSTLAUNCH_PROBE_DELAY_MS;
     const timeout = window.setTimeout(() => {
+      // The server only reports discovering once the run has started; mark it
+      // here first so the view shows progress instead of the manual CTA for the
+      // whole duration of this request.
+      queryClient.setQueryData<PrometheusStatus>(["prometheus-status"], (prev) =>
+        prev ? { ...prev, discovering: true } : prev,
+      );
       // Direct apiFetch (not via the usePrometheusConnect mutation) so the
       // meta-driven toast handler stays silent — the user didn't click anything.
       apiFetch(`${getApiBase()}/prometheus/connect?optional=true`, {
@@ -3357,6 +3512,14 @@ export function useAutoPromConnect(): void {
           queryClient.invalidateQueries({ queryKey: ["prometheus-status"] });
         })
         .catch(() => {
+          // Undo the optimistic flag, then ask the server: if it's reachable
+          // the authoritative status (possibly a still-running discovery)
+          // replaces this within one fetch; if it isn't, the CTA is right.
+          queryClient.setQueryData<PrometheusStatus>(
+            ["prometheus-status"],
+            (prev) => (prev?.discovering ? { ...prev, discovering: false } : prev),
+          );
+          queryClient.invalidateQueries({ queryKey: ["prometheus-status"] });
           try {
             window.localStorage.removeItem(promAutoConnectKey(context));
           } catch {
@@ -4734,6 +4897,31 @@ export function useRolloutCapabilities(
   });
 }
 
+export interface AnalysisRunSummary {
+  name: string;
+  phase: string;
+  message?: string;
+  trigger?: string;
+  stepIndex?: number;
+  createdAt: string;
+  metricsTotal: number;
+  metricsPassing: number;
+  metricsNotPassing: number;
+}
+
+export function useRolloutAnalysisRuns(
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
+  return useQuery<{ items: AnalysisRunSummary[] }>({
+    queryKey: ["rollout-analysisruns", namespace, name],
+    queryFn: () => fetchJSON(`/rollouts/${namespace}/${name}/analysisruns`),
+    enabled: Boolean(namespace && name && enabled),
+    staleTime: 10000,
+  });
+}
+
 // Fallbacks only. The server reports what it actually did — including when it found
 // nothing to do — so its message is preferred over anything asserted here.
 const ROLLOUT_ACTION_MESSAGES: Record<
@@ -4898,6 +5086,75 @@ export interface DrainNodeOptions {
   force?: boolean;
 }
 
+export interface DrainPlanRequestOptions {
+  deleteEmptyDirData: boolean;
+  force: boolean;
+}
+
+/** Path of the read-only plan endpoint; distinct from the drain so a preview can never drain. */
+export function drainPlanPath(name: string): string {
+  return `/nodes/${encodeURIComponent(name)}/drain-plan`;
+}
+
+/** Body for the plan request: both options are always explicit, the server echoes them back. */
+export function drainPlanBody(options: DrainPlanRequestOptions): string {
+  return JSON.stringify({
+    deleteEmptyDirData: options.deleteEmptyDirData,
+    force: options.force,
+  });
+}
+
+/**
+ * The connected radar predates the drain-plan endpoint. Distinguished from a
+ * node-not-found 404 by the body: handlers answer with a JSON error envelope,
+ * while an unknown route gets the router's plain-text 404. Hosts serving a newer
+ * frontend against an older radar (Radar Hub) use this to fall back to the
+ * plan-less drain dialog instead of leaving Drain permanently disabled.
+ */
+export class DrainPlanUnsupportedError extends Error {
+  constructor() {
+    super("This radar does not support drain plans");
+    this.name = "DrainPlanUnsupportedError";
+  }
+}
+
+export function drainPlanFetchError(
+  status: number,
+  body: { error?: string } | null,
+): Error {
+  if (status === 404 && body === null) {
+    return new DrainPlanUnsupportedError();
+  }
+  return new Error(body?.error || `HTTP ${status}`);
+}
+
+// Read-only drain plan: what a drain with these options would do to each pod on the node.
+// Modelled as a mutation because it is a POST with a body and is fetched on demand
+// while the drain dialog is open; it performs no cluster mutation.
+export function useDrainPlan() {
+  return useMutation<
+    DrainPlan,
+    Error,
+    { name: string; options: DrainPlanRequestOptions }
+  >({
+    mutationFn: async ({ name, options }) => {
+      const response = await apiFetch(apiUrl(drainPlanPath(name)), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: drainPlanBody(options),
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => null);
+        throw drainPlanFetchError(response.status, body);
+      }
+      return response.json();
+    },
+    // Deliberately no meta toast keys: the plan is fetched only from the drain dialog, which
+    // renders a failure inline and keeps Drain disabled while it shows; a global toast would
+    // report the same failure twice.
+  });
+}
+
 export function useDrainNode() {
   const queryClient = useQueryClient();
 
@@ -4927,7 +5184,11 @@ export function useDrainNode() {
       // No static successMessage — handled in onSuccess to distinguish partial failures
     },
     onSuccess: (
-      data: { evictedPods?: string[]; errors?: string[] },
+      data: {
+        evictedPods?: string[];
+        skippedPods?: DrainPlanPod[];
+        errors?: string[];
+      },
       variables,
     ) => {
       queryClient.invalidateQueries({ queryKey: ["resources", "nodes"] });
@@ -4936,20 +5197,67 @@ export function useDrainNode() {
       });
       queryClient.invalidateQueries({ queryKey: ["topology"] });
 
-      const evicted = data?.evictedPods?.length ?? 0;
-      const errors = data?.errors?.length ?? 0;
-      if (errors > 0) {
-        showApiError(
-          `Drain completed with ${errors} error(s)`,
-          `${evicted} pods evicted. Errors: ${data.errors!.join("; ")}`,
-        );
+      const { title, detail, failed } = describeDrainResult(data);
+      if (failed) {
+        showApiError(title, detail);
       } else {
-        showApiSuccess(`Node drained: ${evicted} pods evicted`);
+        showApiSuccess(title, detail);
       }
     },
   });
 }
 
+const DRAIN_RESULT_MAX_LISTED = 5;
+
+function listWithOverflow(items: string[]): string {
+  const shown = items.slice(0, DRAIN_RESULT_MAX_LISTED);
+  const rest = items.length - shown.length;
+  return rest > 0 ? `${shown.join("; ")}; +${rest} more` : shown.join("; ");
+}
+
+/**
+ * Turns the drain response into a legible summary: evicted, skipped (with reasons),
+ * failed. Lists are capped so the toast stays readable on nodes with many pods.
+ */
+export function describeDrainResult(data: {
+  evictedPods?: string[];
+  skippedPods?: DrainPlanPod[];
+  errors?: string[];
+}): { title: string; detail: string; failed: boolean } {
+  const evicted = data?.evictedPods?.length ?? 0;
+  const skipped = data?.skippedPods ?? [];
+  const errors = data?.errors ?? [];
+  const parts: string[] = [];
+  if (skipped.length > 0) {
+    parts.push(
+      `Skipped ${skipped.length}: ${listWithOverflow(
+        skipped.map((p) => `${p.namespace}/${p.name} (${p.reason})`),
+      )}`,
+    );
+  }
+  if (errors.length > 0) {
+    parts.push(`Failed ${errors.length}: ${listWithOverflow(errors)}`);
+  }
+  parts.push(
+    evicted > 0
+      ? "Evictions were accepted; those pods may still be terminating. The node remains cordoned."
+      : "The node remains cordoned.",
+  );
+  const detail = parts.join("\n");
+  if (errors.length > 0) {
+    return {
+      title: `Drain finished with ${errors.length} failed eviction(s): ${evicted} evicted, ${skipped.length} skipped`,
+      detail,
+      failed: true,
+    };
+  }
+  return {
+    title: `Node drained: ${evicted} evicted, ${skipped.length} skipped`,
+    detail,
+    failed: false,
+  };
+}
+
 // ============================================================================
 // Helm API hooks
 // ============================================================================

package/src/api/diagnose.ts

@@ -72,7 +72,8 @@ export interface DiagnosisEvidenceSubject {
   group?: string;
   kind: string;
   namespace?: string;
-  name: string;
+  /** Absent when the subject is a listing cited for what it does not contain. */
+  name?: string;
   container?: string;
   stream?: "current" | "previous";
   /** Evidence kind (resource, logs, events, changes, metrics, …). */
@@ -85,6 +86,8 @@ export interface DiagnosisEvidenceItem {
   ref?: string;
   role?: DiagnosisEvidenceRole;
   claim?: string;
+  /** The agent's own statement of what this result does not cover. */
+  gap?: string;
   subject?: DiagnosisEvidenceSubject;
 }
 
@@ -94,10 +97,35 @@ export interface DiagnosisRuledOut {
   evidenceIndex: number;
 }
 
+export type DiagnosisCertainty = "established" | "likely" | "suspected";
+export type DiagnosisStepKind = "mitigate" | "verify" | "investigate";
+
+/** One typed next step; `remediation` mirrors `steps[].text` when steps are present. */
+export interface DiagnosisStep {
+  text: string;
+  kind: DiagnosisStepKind;
+  /** The condition under which this step is the right one, when the agent named one. */
+  precondition?: string;
+}
+
 export interface Diagnosis {
   healthy?: boolean;
   inconclusive?: boolean; // investigated but couldn't determine — distinct from healthy
   rootCause: string;
+  /**
+   * The plain-language headline; `rootCause` stays the technical one-liner.
+   * Present only on turns from a backend that emits the story contract; its
+   * absence selects the previous rendering.
+   */
+  summary?: string;
+  /** The agent's own word for how sure it is; rendered in the agent tone, never as a Radar mark. */
+  certainty?: DiagnosisCertainty;
+  /** What would change the answer or could not be verified. Rendered above the story fold. */
+  unresolved?: string[];
+  /** A follow-up answer that replaces the assessment on screen (server-validated as a complete verdict). */
+  revisesAssessment?: boolean;
+  /** Typed next steps; absent on older runs, where `remediation` is the only list. */
+  steps?: DiagnosisStep[];
   rootCauseEvidence?: RootCauseEvidence;
   /** The agent's case over Radar's evidence; absent from hosted backends and older runs. */
   evidence?: DiagnosisEvidenceItem[];
@@ -107,6 +135,8 @@ export interface Diagnosis {
   evidenceMalformed?: boolean;
   ruledOut?: DiagnosisRuledOut[];
   report: string;
+  /** The agent's evidence ledger, written before its verdict block; shown in Activity, never in Findings. */
+  notes?: string;
   remediation: string[];
   recommendedIndex?: number; // 1-based index into remediation of the step Apply performs
   recommendedReason?: string; // why the recommended step is the safe pick
@@ -183,6 +213,7 @@ export interface DiagnoseStreamEvent {
 // server runs.
 export interface RunSummary {
   id: string;
+  /** Stored target Kind; existing hosted runs may contain a plural API resource name. */
   kind: string;
   /** Kubernetes API group; empty means the core API group. */
   group: string;

package/src/api/drain-plan.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, it } from "vitest";
+import {
+  describeDrainResult,
+  DrainPlanUnsupportedError,
+  drainPlanBody,
+  drainPlanFetchError,
+  drainPlanPath,
+} from "./client";
+
+describe("drain plan request", () => {
+  it("targets the read-only plan endpoint, never the drain", () => {
+    expect(drainPlanPath("worker-1")).toBe("/nodes/worker-1/drain-plan");
+    expect(drainPlanPath("worker-1")).not.toContain("/drain\"");
+    expect(drainPlanPath("odd node")).toBe("/nodes/odd%20node/drain-plan");
+  });
+
+  it("always sends both options explicitly so no server default applies", () => {
+    expect(JSON.parse(drainPlanBody({ deleteEmptyDirData: false, force: false }))).toEqual({
+      deleteEmptyDirData: false,
+      force: false,
+    });
+    expect(JSON.parse(drainPlanBody({ deleteEmptyDirData: true, force: true }))).toEqual({
+      deleteEmptyDirData: true,
+      force: true,
+    });
+  });
+
+  it("reads a plain-text 404 as an unsupported endpoint, not as a missing node", () => {
+    expect(drainPlanFetchError(404, null)).toBeInstanceOf(DrainPlanUnsupportedError);
+    const nodeGone = drainPlanFetchError(404, { error: 'nodes "worker-1" not found' });
+    expect(nodeGone).not.toBeInstanceOf(DrainPlanUnsupportedError);
+    expect(nodeGone.message).toBe('nodes "worker-1" not found');
+    expect(drainPlanFetchError(503, null).message).toBe("HTTP 503");
+  });
+});
+
+describe("describeDrainResult", () => {
+  it("lists evictions, skips with reasons, and individual failures", () => {
+    const r = describeDrainResult({
+      evictedPods: ["shop/cache"],
+      skippedPods: [
+        { namespace: "shop", name: "agent", outcome: "skip", reason: "managed by a DaemonSet", emptyDir: false, pdbChecked: false },
+      ],
+      errors: ["shop/web-1: timed out waiting for PDB to allow eviction"],
+    });
+    expect(r.failed).toBe(true);
+    expect(r.title).toBe("Drain finished with 1 failed eviction(s): 1 evicted, 1 skipped");
+    expect(r.detail).toContain("shop/agent (managed by a DaemonSet)");
+    expect(r.detail).toContain("shop/web-1: timed out");
+  });
+
+  it("caps long lists so the toast stays readable", () => {
+    const skippedPods = Array.from({ length: 8 }, (_, i) => ({
+      namespace: "ns", name: `p${i}`, outcome: "skip" as const, reason: "r", emptyDir: false, pdbChecked: false,
+    }));
+    const r = describeDrainResult({ evictedPods: [], skippedPods });
+    expect(r.detail).toContain("Skipped 8:");
+    expect(r.detail).toContain("ns/p4 (r); +3 more");
+    expect(r.detail).not.toContain("ns/p5");
+  });
+
+  it("reports a clean drain as success and says what success means", () => {
+    const r = describeDrainResult({ evictedPods: ["a", "b"] });
+    expect(r.failed).toBe(false);
+    expect(r.title).toBe("Node drained: 2 evicted, 0 skipped");
+    expect(r.detail).toContain("those pods may still be terminating");
+    expect(r.detail).toContain("node remains cordoned");
+  });
+
+  it("never claims evictions were accepted when nothing was evicted", () => {
+    const allFailed = describeDrainResult({
+      evictedPods: [],
+      errors: ["shop/web-1: timed out waiting for PDB to allow eviction"],
+    });
+    expect(allFailed.detail).not.toContain("accepted");
+    expect(allFailed.detail).toContain("node remains cordoned");
+
+    const skipOnly = describeDrainResult({
+      evictedPods: [],
+      skippedPods: [
+        { namespace: "shop", name: "agent", outcome: "skip", reason: "managed by a DaemonSet", emptyDir: false, pdbChecked: false },
+      ],
+    });
+    expect(skipOnly.detail).not.toContain("accepted");
+  });
+});

package/src/api/quotas.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { podLimitRangeNames } from './quotas'
+
+describe('Pod-relevant LimitRanges', () => {
+  it('excludes PVC-only rules and retains Pod, Container and mixed rules', () => {
+    const rules = [
+      { metadata: { name: 'storage-only' }, spec: { limits: [{ type: 'PersistentVolumeClaim' }] } },
+      { metadata: { name: 'container-defaults' }, spec: { limits: [{ type: 'Container' }] } },
+      { metadata: { name: 'pod-total' }, spec: { limits: [{ type: 'Pod' }] } },
+      { metadata: { name: 'mixed' }, spec: { limits: [{ type: 'PersistentVolumeClaim' }, { type: 'Container' }] } },
+    ]
+    expect(podLimitRangeNames(rules)).toEqual(['container-defaults', 'pod-total', 'mixed'])
+  })
+
+  it('ignores LimitRanges with no declared entries', () => {
+    expect(podLimitRangeNames([
+      { metadata: { name: 'null-entries' }, spec: { limits: null } },
+      { metadata: { name: 'empty-entries' }, spec: { limits: [] } },
+    ])).toEqual([])
+  })
+
+  it('has no contextual links before data is available or for an empty namespace', () => {
+    expect(podLimitRangeNames(undefined)).toEqual([])
+    expect(podLimitRangeNames([])).toEqual([])
+  })
+})

package/src/api/quotas.ts

@@ -14,3 +14,23 @@ export function useNamespaceQuotas(namespace: string, enabled = true) {
     staleTime: 15000,
   })
 }
+
+// useNamespaceLimitRanges fetches a namespace's LimitRange objects via
+// /api/resources/limitranges?namespace=<ns> (a bare array). Backs the
+// NamespaceRenderer rules section and the contextual link on Pod/workload
+// details — the defaults and constraints applied at admission are otherwise
+// only visible by reading the object.
+export function useNamespaceLimitRanges(namespace: string, enabled = true) {
+  return useQuery<any[]>({
+    queryKey: ['limitranges', namespace],
+    queryFn: () => fetchJSON<any[]>(`/resources/limitranges?namespace=${encodeURIComponent(namespace)}`),
+    enabled: enabled && !!namespace,
+    staleTime: 15000,
+  })
+}
+
+export function podLimitRangeNames(limitRanges: any[] | undefined): string[] {
+  return (limitRanges ?? [])
+    .filter(lr => lr.spec.limits?.some((entry: { type: string }) => entry.type === 'Container' || entry.type === 'Pod'))
+    .map(lr => lr.metadata.name)
+}