@skyhook-io/radar-app 1.14.2 → 1.14.3

package/src/components/diagnose/investigationEvidence/adapters/{helm.test.ts → helm.test.tsx}

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
 import { investigationEvidenceSubjectRef } from "../index";
 import { groupsOf, project, tool } from "../evidenceFixtures";
+import { renderToStaticMarkup } from "react-dom/server";
+import { HelmBody } from "../bodies/platform";
 
 const helmRelease = {
   name: "shop",
@@ -240,3 +242,64 @@ describe("helm release adapter", () => {
     ).toEqual(["Helm release", "Helm resources", "Helm operation"]);
   });
 });
+
+describe("helm release card detail", () => {
+  it("keeps hooks, the newest ten revisions and the user's values, and renders them", () => {
+    const projection = project([
+      tool("helm", "get_helm_release", {
+        ...helmRelease,
+        history: [
+          {
+            revision: 5,
+            status: "superseded",
+            chart: "shop-1.4.0",
+            updated: "2026-09-01T07:00:00Z",
+          },
+          {
+            revision: 7,
+            status: "deployed",
+            chart: "shop-1.4.2",
+            updated: "2026-09-07T07:00:00Z",
+            description: "Upgrade complete",
+          },
+          {
+            revision: 6,
+            status: "failed",
+            chart: "shop-1.4.1",
+            updated: "2026-09-03T07:00:00Z",
+            description: "pre-upgrade hooks failed",
+          },
+        ],
+        hooks: [
+          {
+            name: "shop-test-connection",
+            kind: "Pod",
+            events: ["test"],
+            weight: 0,
+            status: "Succeeded",
+            completedAt: "2026-09-07T07:01:00Z",
+          },
+        ],
+        values: {
+          replicaCount: 2,
+          ui: { color: "#34577c", message: "hi" },
+          tags: ["a", "b"],
+        },
+      }),
+    ]);
+    const [group] = groupsOf(projection.groups, "helm");
+    const data = group.latest.data;
+    if (data.type !== "helm") throw new Error("expected a helm card");
+    expect(data.release.history?.map((rev) => rev.revision)).toEqual([7, 6, 5]);
+    expect(data.release.hooks?.[0].name).toBe("shop-test-connection");
+    const html = renderToStaticMarkup(<HelmBody data={data} />);
+    expect(html).toContain('data-helm-revision="6"');
+    expect(html).toContain("pre-upgrade hooks failed");
+    expect(html).toContain("data-helm-hook");
+    expect(html).toContain("shop-test-connection");
+    expect(html).toContain("Values set by the user");
+    expect(html).toContain("replicaCount");
+    expect(html).toContain("{ color, message }");
+    expect(html).toContain("[2 items]");
+  });
+});

package/src/components/diagnose/investigationEvidence/adapters/helm.ts

@@ -5,13 +5,15 @@ import {
   invalidPayload,
   resourceMatchesTarget,
 } from "../observations";
-import { nonEmptyString, record } from "../parse";
+import { nonEmptyString, record, stringArray } from "../parse";
 import {
   type InvestigationEvidenceRelevance,
   type InvestigationEvidenceSource,
   type InvestigationHelmOperation,
   type InvestigationHelmOwnedResource,
   type InvestigationHelmRelease,
+  InvestigationHelmRevision,
+  InvestigationHelmHook,
 } from "../types";
 
 function helmOwnedResource(
@@ -39,6 +41,67 @@ function helmOwnedResource(
   }
   return candidate as unknown as InvestigationHelmOwnedResource;
 }
+// Revisions are stored oldest first; the card reads newest first and keeps
+// the ten that matter for a rollback decision.
+function helmHistory(value: unknown): InvestigationHelmRevision[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const revisions = value.flatMap((entry) => {
+    const item = record(entry);
+    if (
+      !item ||
+      typeof item.revision !== "number" ||
+      !nonEmptyString(item.status) ||
+      typeof item.chart !== "string" ||
+      typeof item.updated !== "string"
+    )
+      return [];
+    return [
+      {
+        revision: item.revision,
+        status: item.status,
+        chart: item.chart,
+        ...(nonEmptyString(item.appVersion)
+          ? { appVersion: item.appVersion }
+          : {}),
+        ...(nonEmptyString(item.description)
+          ? { description: item.description }
+          : {}),
+        updated: item.updated,
+      },
+    ];
+  });
+  if (revisions.length === 0) return undefined;
+  return revisions.sort((a, b) => b.revision - a.revision).slice(0, 10);
+}
+
+function helmHooks(value: unknown): InvestigationHelmHook[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const hooks = value.flatMap((entry) => {
+    const item = record(entry);
+    if (!item || !nonEmptyString(item.name) || !nonEmptyString(item.kind))
+      return [];
+    return [
+      {
+        name: item.name,
+        kind: item.kind,
+        ...(nonEmptyString(item.namespace)
+          ? { namespace: item.namespace }
+          : {}),
+        events: stringArray(item.events) ?? [],
+        weight: typeof item.weight === "number" ? item.weight : 0,
+        ...(nonEmptyString(item.status) ? { status: item.status } : {}),
+        ...(nonEmptyString(item.startedAt)
+          ? { startedAt: item.startedAt }
+          : {}),
+        ...(nonEmptyString(item.completedAt)
+          ? { completedAt: item.completedAt }
+          : {}),
+      },
+    ];
+  });
+  return hooks.length > 0 ? hooks : undefined;
+}
+
 function helmOperation(value: unknown): InvestigationHelmOperation | undefined {
   const candidate = record(value);
   if (
@@ -109,6 +172,9 @@ export function adaptHelmRelease(
     invalidPayload(builder, source, "Helm resources");
     return;
   }
+  const history = helmHistory(value.history);
+  const hooks = helmHooks(value.hooks);
+  const values = record(value.values) ?? undefined;
   const lastOperation =
     value.lastOperation === undefined
       ? undefined
@@ -137,6 +203,9 @@ export function adaptHelmRelease(
       string | undefined,
     lastOperation,
     resources,
+    ...(history ? { history } : {}),
+    ...(hooks ? { hooks } : {}),
+    ...(values ? { values } : {}),
   };
   // The release manages the target when the target is among the resources
   // Helm rendered for it; a release is never the investigated object itself.

package/src/components/diagnose/investigationEvidence/adapters/listings.ts

@@ -0,0 +1,134 @@
+import { adaptListResources } from "./resource";
+import { nonEmptyString, parseJSON, record, stringArray } from "../parse";
+import { invalidPayload, type ProjectionBuilder } from "../observations";
+import type { InvestigationEvidenceSource } from "../types";
+
+// Helm releases, installed packages and search hits are inventories: rows
+// with a kind, a name and a namespace, one line of status, and for a hit
+// the text that matched. They render on the inventory card so a citation
+// can name a row the way it names a resource in a listing.
+
+export function adaptListHelmReleases(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  if (!Array.isArray(payload)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const args = record(parseJSON(source.args ?? ""));
+  const namespace = nonEmptyString(args?.namespace)
+    ? args.namespace
+    : undefined;
+  adaptListResources(
+    builder,
+    source,
+    payload.map((entry) => {
+      const item = record(entry);
+      if (!item) return entry;
+      const chart = [item.chart, item.chartVersion]
+        .filter((part) => nonEmptyString(part))
+        .join(" ");
+      return {
+        kind: "HelmRelease",
+        name: item.name,
+        namespace: item.namespace,
+        status: [item.status, chart ? chart : undefined]
+          .filter(Boolean)
+          .join(" · "),
+        ...(nonEmptyString(item.healthIssue)
+          ? { issue: item.healthIssue }
+          : {}),
+      };
+    }),
+    { title: namespace ? `Helm releases in ${namespace}` : "Helm releases" },
+  );
+}
+
+export function adaptListPackages(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  const rows = value?.packages;
+  if (!value || !Array.isArray(rows)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const legend = record(value.sourceLegend) ?? {};
+  const args = record(parseJSON(source.args ?? ""));
+  const namespace = nonEmptyString(args?.namespace)
+    ? args.namespace
+    : undefined;
+  adaptListResources(
+    builder,
+    source,
+    rows.map((entry) => {
+      const item = record(entry);
+      if (!item) return entry;
+      const sources = (stringArray(item.sources) ?? []).map((code) =>
+        nonEmptyString(legend[code]) ? legend[code] : code,
+      );
+      const health = nonEmptyString(item.health)
+        ? item.health.toLowerCase()
+        : undefined;
+      const status = [
+        nonEmptyString(item.version) ? item.version : undefined,
+        sources.length > 0 ? sources.join(", ") : undefined,
+      ]
+        .filter(Boolean)
+        .join(" · ");
+      return {
+        kind: "Package",
+        name: nonEmptyString(item.releaseName) ? item.releaseName : item.chart,
+        namespace: item.namespace,
+        status,
+        ...(health === "degraded" || health === "unhealthy"
+          ? { issue: health }
+          : {}),
+      };
+    }),
+    { title: namespace ? `Packages in ${namespace}` : "Installed packages" },
+  );
+}
+
+export function adaptSearch(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  const hits = value?.hits;
+  if (!value || !Array.isArray(hits)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const args = record(parseJSON(source.args ?? ""));
+  const query = nonEmptyString(args?.query) ? args.query : undefined;
+  adaptListResources(
+    builder,
+    source,
+    hits.map((entry) => {
+      const item = record(entry);
+      if (!item) return entry;
+      const snippets = Array.isArray(item.snippets) ? item.snippets : [];
+      const matched = Array.isArray(item.matched) ? item.matched : [];
+      const first = record(snippets[0]);
+      const site = record(matched[0]);
+      const match = first
+        ? `${nonEmptyString(first.path) ? `${first.path}: ` : ""}${nonEmptyString(first.snippet) ? first.snippet : ""}`
+        : site && nonEmptyString(site.site)
+          ? `matched ${site.site}`
+          : undefined;
+      return {
+        kind: item.kind,
+        name: item.name,
+        namespace: item.namespace,
+        ...(match ? { match } : {}),
+      };
+    }),
+    { title: query ? `Search results for “${query}”` : "Search results" },
+  );
+}

package/src/components/diagnose/investigationEvidence/adapters/{permissions.test.ts → permissions.test.tsx}

@@ -4,6 +4,8 @@ import {
   projectInvestigationEvidence,
 } from "../index";
 import { deployment, groupsOf, project, tool } from "../evidenceFixtures";
+import { renderToStaticMarkup } from "react-dom/server";
+import { PermissionsBody } from "../bodies/platform";
 
 const deploymentWithServiceAccount = {
   ...deployment,
@@ -526,3 +528,51 @@ describe("subject permissions adapter", () => {
     expect(projection.limitations[0].sources).toHaveLength(3);
   });
 });
+
+describe("subject permissions card detail", () => {
+  it("keeps the effective rules and renders them", () => {
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: deploymentWithServiceAccount,
+        resourceContext: { tier: "basic" },
+      }),
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
+          bindings: [],
+          flatRules: [
+            {
+              verbs: ["get", "list"],
+              apiGroups: [""],
+              resources: ["pods", "pods/log"],
+            },
+            {
+              verbs: ["get"],
+              apiGroups: [""],
+              resources: ["secrets"],
+              resourceNames: ["db-creds"],
+            },
+          ],
+          truncated: false,
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "permissions");
+    const data = group.latest.data;
+    if (data.type !== "permissions")
+      throw new Error("expected a permissions card");
+    expect(data.rules?.length).toBe(2);
+    const html = renderToStaticMarkup(<PermissionsBody data={data} />);
+    expect(html).toContain("Effective rules");
+    expect(html).toContain("get, list");
+    expect(html).toContain("pods, pods/log");
+    expect(html).toContain("[db-creds]");
+  });
+});

package/src/components/diagnose/investigationEvidence/adapters/permissions.ts

@@ -18,6 +18,7 @@ import {
   type InvestigationEvidenceSource,
   type InvestigationKubernetesResource,
   type InvestigationPermissionBinding,
+  InvestigationPermissionRule,
   type InvestigationPermissionSubject,
 } from "../types";
 
@@ -248,6 +249,22 @@ export function adaptSubjectPermissions(
   }
   const truncated = value.truncated === true;
   const flatRulesCount = value.flatRules.length;
+  const rules: InvestigationPermissionRule[] = value.flatRules
+    .slice(0, 200)
+    .map((entry) => {
+      const rule = record(entry)!;
+      return {
+        verbs: stringArray(rule.verbs) ?? [],
+        apiGroups: stringArray(rule.apiGroups) ?? [],
+        resources: stringArray(rule.resources) ?? [],
+        ...(stringArray(rule.resourceNames)?.length
+          ? { resourceNames: stringArray(rule.resourceNames) }
+          : {}),
+        ...(stringArray(rule.nonResourceURLs)?.length
+          ? { nonResourceURLs: stringArray(rule.nonResourceURLs) }
+          : {}),
+      };
+    });
   const usedByPods = stringArray(value.usedByPods) ?? [];
   builder.observe(`permissions:subject:${subjectKey}`, "permissions", source, {
     tier: evidenceTierForRelevance("context", relevance),
@@ -260,6 +277,7 @@ export function adaptSubjectPermissions(
       subject,
       bindings,
       flatRulesCount,
+      rules,
       truncated,
       usedByPods,
       podsTotal: value.podsTotal as number | undefined,

package/src/components/diagnose/investigationEvidence/adapters/posture.ts

@@ -0,0 +1,272 @@
+import { nonEmptyString, record, stringArray } from "../parse";
+import {
+  invalidPayload,
+  evidenceTierForRelevance,
+  relevanceForResource,
+  scopeFromArgs,
+  type ProjectionBuilder,
+} from "../observations";
+import type {
+  InvestigationEvidenceSource,
+  InvestigationPostureFinding,
+} from "../types";
+
+// Posture findings are configuration checks. Only the ones about the
+// investigated resource are evidence here; the rest of a cluster-wide scan
+// stays in Activity, counted on the receipt.
+function keep(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  origin: "audit" | "upgrade",
+  findings: InvestigationPostureFinding[],
+  relevances: string[],
+  missing: string[],
+  label: string,
+): void {
+  const kept = findings.filter((_, index) => relevances[index] !== "broader");
+  const scope = scopeFromArgs(source);
+  if (missing.length > 0) {
+    builder.limit(
+      source,
+      label,
+      `Inputs missing from the scan: ${missing.join(", ")}.`,
+      "unknown",
+    );
+  }
+  if (kept.length === 0) {
+    if (!source.confirmedSuccess) return;
+    builder.observe(
+      `posture:${origin}:receipt:${source.args ?? scope}`,
+      "receipt",
+      source,
+      {
+        tier: evidenceTierForRelevance("checked", "producer-related"),
+        relevance: "producer-related",
+        tone: "neutral",
+        title: `No ${label.toLowerCase()} on this resource`,
+        summary: scope,
+        data: {
+          type: "receipt",
+          checked: "posture",
+          scope,
+          message:
+            [
+              findings.length > 0
+                ? `${findings.length} finding${findings.length === 1 ? "" : "s"} elsewhere in the scan.`
+                : undefined,
+              missing.length > 0
+                ? `Not every check ran: inputs missing for ${missing.join(", ")}.`
+                : undefined,
+            ]
+              .filter(Boolean)
+              .join(" ") || undefined,
+        },
+      },
+    );
+    return;
+  }
+  const onTarget = kept.filter((finding) => finding.target).length;
+  const relevance = onTarget > 0 ? "target" : "producer-related";
+  // Two expansions of one scan differ in what they asked for (an upgrade
+  // check id, an audit category), which the scope alone does not carry.
+  builder.observe(
+    `posture:${origin}:${source.args ?? scope}`,
+    "posture",
+    source,
+    {
+      tier: evidenceTierForRelevance("context", relevance),
+      relevance,
+      tone: "neutral",
+      title: label,
+      summary: `${kept.length} finding${kept.length === 1 ? "" : "s"}${onTarget > 0 ? ` · ${onTarget} on this resource` : ""} · ${scope}`,
+      data: { type: "posture", source: origin, findings: kept, scope },
+    },
+  );
+}
+
+function relevanceOf(
+  builder: ProjectionBuilder,
+  ref: { kind: string; group?: string; namespace?: string; name: string },
+): string {
+  // An audit names its resource as Kind/namespace/name with no API group; the
+  // investigation target's group stands in, as it does for events and changes.
+  return relevanceForResource(builder, {
+    kind: ref.kind,
+    group: ref.group ?? builder.target.group,
+    namespace: ref.namespace,
+    name: ref.name,
+  });
+}
+
+export function adaptClusterAudit(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  if (!value || !Array.isArray(value.findings)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const findings: InvestigationPostureFinding[] = [];
+  const relevances: string[] = [];
+  for (const entry of value.findings) {
+    const item = record(entry);
+    if (!item || !nonEmptyString(item.resource) || !nonEmptyString(item.check))
+      continue;
+    // "Deployment/default/web" or "Node//worker-1" for a cluster-scoped kind.
+    const [kind, namespace, name] = item.resource.split("/");
+    if (!kind || name === undefined) continue;
+    const ref = { kind, namespace: namespace || undefined, name };
+    const relevance = relevanceOf(builder, ref);
+    findings.push({
+      ...ref,
+      check: item.check,
+      severity: nonEmptyString(item.severity) ? item.severity : "medium",
+      ...(nonEmptyString(item.category) ? { category: item.category } : {}),
+      message: nonEmptyString(item.message) ? item.message : item.check,
+      ...(nonEmptyString(item.remediation)
+        ? { remediation: item.remediation }
+        : {}),
+      target: relevance === "target",
+    });
+    relevances.push(relevance);
+  }
+  if (value.truncated === true) {
+    builder.limit(
+      source,
+      "Posture findings",
+      "The scan hit its cap; findings past it were not returned. A namespace-scoped scan shows the rest.",
+      "unknown",
+    );
+  }
+  keep(
+    builder,
+    source,
+    "audit",
+    findings,
+    relevances,
+    stringArray(value.missingInputs) ?? [],
+    "Posture findings",
+  );
+}
+
+export function adaptUpgradeReadiness(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  if (!value) {
+    invalidPayload(builder, source);
+    return;
+  }
+  // The tier-1 result lists checks without findings; a check=<id> call
+  // carries the findings under "check".
+  const check = record(value.check);
+  const rawFindings =
+    check && Array.isArray(check.findings) ? check.findings : [];
+  const target = nonEmptyString(value.targetVersion)
+    ? value.targetVersion
+    : undefined;
+  const label = target ? `Upgrade findings for ${target}` : "Upgrade findings";
+  if (!check) {
+    if (!source.confirmedSuccess) return;
+    const verdict = nonEmptyString(value.verdict)
+      ? value.verdict.replaceAll("_", " ")
+      : undefined;
+    builder.observe(
+      `posture:upgrade:verdict:${scopeFromArgs(source)}`,
+      "receipt",
+      source,
+      {
+        tier: evidenceTierForRelevance("checked", "broader"),
+        relevance: "broader",
+        tone: "neutral",
+        title: label,
+        summary: verdict ? `verdict ${verdict}` : scopeFromArgs(source),
+        data: {
+          type: "receipt",
+          checked: "posture",
+          scope: scopeFromArgs(source),
+          message: nonEmptyString(value.verdictCaveat)
+            ? value.verdictCaveat
+            : undefined,
+        },
+      },
+    );
+    return;
+  }
+  const findings: InvestigationPostureFinding[] = [];
+  const relevances: string[] = [];
+  for (const entry of rawFindings) {
+    const item = record(entry);
+    const resource = record(item?.resource);
+    const managedBy = record(item?.managedBy);
+    const named = resource ?? managedBy;
+    if (
+      !item ||
+      !named ||
+      !nonEmptyString(named.kind) ||
+      !nonEmptyString(named.name)
+    )
+      continue;
+    const refOf = (value: Record<string, unknown>) => ({
+      kind: String(value.kind),
+      group: nonEmptyString(value.group) ? value.group : undefined,
+      namespace: nonEmptyString(value.namespace) ? value.namespace : undefined,
+      name: String(value.name),
+    });
+    const ref = refOf(named);
+    // A finding on an object the workload owns (its HPA, its Ingress) is a
+    // finding about the workload, and the workload's name reaches it.
+    const owner =
+      resource &&
+      managedBy &&
+      nonEmptyString(managedBy.kind) &&
+      nonEmptyString(managedBy.name)
+        ? refOf(managedBy)
+        : undefined;
+    let relevance = relevanceOf(builder, ref);
+    if (relevance === "broader" && owner) {
+      relevance = relevanceOf(builder, owner);
+    }
+    const evidence = record(item.evidence);
+    findings.push({
+      ...ref,
+      check: nonEmptyString(item.title)
+        ? item.title
+        : nonEmptyString(check.title)
+          ? check.title
+          : "Upgrade check",
+      severity: nonEmptyString(item.level) ? item.level : "review",
+      category: nonEmptyString(check.category) ? check.category : undefined,
+      message: [
+        nonEmptyString(item.impact) ? item.impact : undefined,
+        evidence && nonEmptyString(evidence.detail)
+          ? evidence.detail
+          : undefined,
+      ]
+        .filter(Boolean)
+        .join(" "),
+      ...(nonEmptyString(item.remediation)
+        ? { remediation: item.remediation }
+        : {}),
+      target: relevance === "target",
+      ...(owner ? { managedBy: owner } : {}),
+    });
+    relevances.push(relevance);
+  }
+  if (
+    typeof check.findingsTruncated === "number" &&
+    check.findingsTruncated > 0
+  ) {
+    builder.limit(
+      source,
+      label,
+      `${check.findingsTruncated} more finding${check.findingsTruncated === 1 ? "" : "s"} past this page were not returned; the next page has them.`,
+      "unknown",
+    );
+  }
+  keep(builder, source, "upgrade", findings, relevances, [], label);
+}