@skyhook-io/radar-app 1.14.4 → 1.14.6

package/src/components/diagnose/InvestigationEvidencePane.tsx

@@ -71,6 +71,7 @@ export function InvestigationEvidencePane({
   afterEvidence,
   recordNotes,
   storyShell = false,
+  summarizedLimits = [],
   revealRequest,
   onRevealReady,
 }: {
@@ -85,7 +86,11 @@ export function InvestigationEvidencePane({
    * `evidence` array. Absent on backends and runs without the story contract,
    * which keep the previous layout.
    */
-  story?: { report: string; evidence?: DiagnosisEvidenceItem[] };
+  story?: {
+    summary?: string;
+    report: string;
+    evidence?: DiagnosisEvidenceItem[];
+  };
   /** Open the story fully instead of the bounded preview — when the layout has room for it. */
   collecting: boolean;
   animateGroupIds: ReadonlySet<string>;
@@ -105,6 +110,8 @@ export function InvestigationEvidencePane({
   recordNotes?: ReactNode;
   /** No verdict yet, but the story shape is coming: keep its cards in place. */
   storyShell?: boolean;
+  /** Coverage lines already visible in the current assessment's Still open list. */
+  summarizedLimits?: readonly string[];
   /** Explicit Activity → Findings navigation, including repeat clicks. */
   revealRequest?: { sourceId: string; requestId: number };
   onRevealReady?: (sourceId: string) => void;
@@ -279,6 +286,12 @@ export function InvestigationEvidencePane({
   const limitationSummary = coverageGroups
     .map((group) => `${group.label}: ${group.summary}`)
     .join(" · ");
+  const additionalLimitations = coverageGroups
+    .map((group) => `${group.label}: ${group.summary}`)
+    .filter(
+      (line) => !story?.summary?.trim() || !summarizedLimits.includes(line),
+    )
+    .join(" · ");
   // Resolves a story placement to the agent item it names, or says why it
   // cannot: an index Radar does not know, an item the server could not bind,
   // or a bound item that matches no single observation. Only the last two
@@ -657,7 +670,7 @@ export function InvestigationEvidencePane({
                 <CoverageStrip
                   groups={coverageGroups}
                   visibleGroupIds={new Set(partition.collectionByGroup.keys())}
-                  summary={limitationSummary}
+                  summary={additionalLimitations}
                   onViewSource={onViewSource}
                   open={coverageOpen}
                   onOpenChange={setCoverageOpen}

package/src/components/diagnose/InvestigationEvidenceSections.tsx

@@ -318,7 +318,7 @@ export function CoverageStrip({
               ? "Change history is limited"
               : "Evidence coverage is incomplete"}
           </span>
-          {!historyOnly && !open ? (
+          {!historyOnly && !open && summary ? (
             <span className="line-clamp-2 text-xs text-theme-text-tertiary [overflow-wrap:anywhere]">
               {summary}
             </span>

package/src/components/diagnose/InvestigationView.tsx

@@ -788,7 +788,8 @@ export function InvestigationView({
     assessment: Turn,
   ): AssessmentExplanation | undefined => {
     const sequence = assessment.resultSequence;
-    if (!sequence || !assessment.diagnosis?.rootCause) return undefined;
+    if (!sequence || !investigationIsAssessmentTurn(assessment))
+      return undefined;
     const saved = investigationExplanation(turns, sequence);
     if ((readOnly || !explanationEnabled) && saved.status === "idle")
       return undefined;
@@ -2361,12 +2362,14 @@ export function InvestigationView({
                     story={
                       storyShape && currentAssessment?.diagnosis
                         ? {
+                            summary: currentAssessment.diagnosis.summary,
                             report: currentAssessment.diagnosis.report,
                             evidence: currentAssessment.diagnosis.evidence,
                           }
                         : undefined
                     }
                     storyShell={storyShell}
+                    summarizedLimits={storyShape ? assessmentLimits : undefined}
                     collecting={
                       explanationRequest?.status !== "running" &&
                       (requestPending ||

package/src/components/diagnose/agentCatalog.ts

@@ -27,4 +27,10 @@ export const SUPPORTED_AGENTS: AgentInstall[] = [
     install: "curl https://cursor.com/install -fsS | bash",
     docs: "https://docs.cursor.com/en/cli/overview",
   },
+  {
+    name: "opencode",
+    label: "OpenCode",
+    install: "npm install -g opencode-ai",
+    docs: "https://opencode.ai/docs/",
+  },
 ];

package/src/components/diagnose/investigationCase.test.tsx

@@ -21,6 +21,7 @@ import {
 } from "./investigationCase";
 import { AssessmentSources, ResultCard, assessmentSourceRows } from "./parts";
 import { namedInventoryRows } from "./investigationEvidence/bodies/inventory";
+import { LogsBody } from "./investigationEvidence/bodies/streams";
 import type { Diagnosis, DiagnosisEvidenceItem } from "../../api/diagnose";
 
 const onViewSource = vi.fn();
@@ -1214,6 +1215,61 @@ describe("agent case placement (D-1, D-1b)", () => {
     ]);
   });
 
+  it.each([
+    ["resolved", "app", "app", "card"],
+    ["wrong container", "proxy", "app", "source"],
+    ["unknown container", undefined, "app", "source"],
+  ] as const)(
+    "places a named log claim only against its %s stream",
+    (_name, container, claimedContainer, placement) => {
+      const ref = evidenceRef("a", "b");
+      const projection = project(
+        tool(
+          "logs",
+          "get_pod_logs",
+          {
+            container,
+            lines: ["ERROR missing configuration"],
+            totalLines: 1,
+            matchedLines: 1,
+            fallback: false,
+          },
+          {
+            summary: JSON.stringify({ namespace: "shop", name: "api-abc" }),
+            evidenceRef: ref,
+          },
+        ),
+      );
+      const resolved = resolveInvestigationCase(
+        projection,
+        {
+          evidence: [
+            linked(ref, "cause", "The application is missing configuration.", {
+              kind: "Pod",
+              namespace: "shop",
+              name: "api-abc",
+              container: claimedContainer,
+              observation: "logs",
+            }),
+          ],
+        },
+        0,
+      );
+      expect(resolved.items[0].placement).toBe(placement);
+      if (placement === "card") {
+        expect(resolved.items[0].groupId).toBe(projection.groups[0].id);
+      }
+      if (container === undefined) {
+        const data = projection.groups[0].latest.data;
+        expect(data.type).toBe("logs");
+        if (data.type !== "logs") throw new Error("expected log evidence");
+        const html = renderToStaticMarkup(<LogsBody data={data} />);
+        expect(html).toContain("container unknown");
+        expect(html).not.toContain("default container");
+      }
+    },
+  );
+
   it("binds to the exact earlier read and renders on its revision row, not the card head", () => {
     const first = evidenceRef("a", "c");
     const second = evidenceRef("a", "d");

package/src/components/diagnose/investigationEvidence/adapters/logs.test.ts

@@ -13,6 +13,66 @@ import {
   workloadLogsPayload,
 } from "../evidenceFixtures";
 
+describe("pod logs container identity", () => {
+  const payload = {
+    lines: ["ERROR missing configuration"],
+    totalLines: 1,
+    matchedLines: 1,
+    fallback: false,
+  };
+
+  it.each([
+    ["resolved identity", { ...payload, container: "app" }, {}, "app"],
+    [
+      "producer identity wins",
+      { ...payload, container: "app" },
+      { container: "proxy" },
+      "app",
+    ],
+    ["saved explicit request", payload, { container: "app" }, "app"],
+    ["saved unspecified request", payload, {}, undefined],
+  ])("uses %s", (_name, result, args, expected) => {
+    const projection = project([
+      tool("logs", "get_pod_logs", result, {
+        summary: JSON.stringify({ namespace: "shop", name: "api", ...args }),
+      }),
+    ]);
+    const observation = groupsOf(projection.groups, "logs")[0].latest;
+    expect(observation.data).toMatchObject({
+      type: "logs",
+      container: expected,
+    });
+    expect(observation.title).toContain(expected ?? "container unknown");
+  });
+
+  it("does not merge separate unknown streams or current and previous instances", () => {
+    const projection = project([
+      tool("unknown-1", "get_pod_logs", payload),
+      tool("unknown-2", "get_pod_logs", payload),
+      tool("current", "get_pod_logs", { ...payload, container: "app" }),
+      tool(
+        "previous",
+        "get_pod_logs",
+        { ...payload, container: "app" },
+        {
+          summary: JSON.stringify({
+            namespace: "shop",
+            name: "api",
+            previous: true,
+          }),
+        },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "logs");
+    expect(groups).toHaveLength(4);
+    expect(new Set(groups.map((group) => group.identity)).size).toBe(4);
+    expect(groups.slice(2).map((group) => group.identity)).toEqual([
+      "logs:current:api:app",
+      "logs:previous:api:app",
+    ]);
+  });
+});
+
 // The get_workload_logs response shape, with the stream rows fetchPodLogs
 // emits per pod and container.
 

package/src/components/diagnose/investigationEvidence/adapters/logs.ts

@@ -39,9 +39,13 @@ export function adaptPodLogs(
   const warnings = stringArray(value?.warnings) ?? [];
   const args = record(source.args ? parseJSON(source.args) : undefined);
   const pod = nonEmptyString(args?.name) ? args.name : "Pod";
-  const container = nonEmptyString(args?.container)
-    ? args.container
-    : "default container";
+  // Saved results may omit container identity while their arguments explicitly
+  // name the requested container. Otherwise its identity is unknown.
+  const container = nonEmptyString(value?.container)
+    ? value.container
+    : nonEmptyString(args?.container)
+      ? args.container
+      : undefined;
   addLogs(
     builder,
     source,

package/src/components/diagnose/investigationEvidence/bodies/streams.tsx

@@ -33,7 +33,7 @@ export function LogsBody({
         {condensed ? null : (
           <>
             <Badge tone="structural" size="sm">
-              {data.pod} / {data.container}
+              {data.pod} / {data.container ?? "container unknown"}
             </Badge>
             <Badge severity="neutral" size="sm">
               {data.previous ? "previous instance" : "current instance"}

package/src/components/diagnose/investigationEvidence/observations.ts

@@ -912,19 +912,20 @@ export function changesSubjectFromArgs(
 export function addLogs(
   builder: ProjectionBuilder,
   source: InvestigationEvidenceSource,
-  value: DiagnosisPodLogEntry,
+  value: Omit<DiagnosisPodLogEntry, "container"> & { container?: string },
   previous: boolean,
   warnings: string[] = [],
   relevance: InvestigationEvidenceRelevance = "broader",
   namespace?: string,
 ): void {
   const lines = (value.logs?.lines ?? []).map((line) => stripAnsi(line));
+  const containerLabel = value.container ?? "container unknown";
   const normalizedWarnings = warnings.map((warning) => stripAnsi(warning));
   const normalizedError = value.error ? stripAnsi(value.error) : undefined;
   if (lines.length === 0) {
     builder.limit(
       source,
-      `${value.pod} / ${value.container}`,
+      `${value.pod} / ${containerLabel}`,
       value.error ||
         "No log lines were available. This does not mean the container is healthy.",
       value.error ? "error" : "unknown",
@@ -941,7 +942,9 @@ export function addLogs(
     ),
   );
   const selectedEvidence = value.logs?.fallback !== true && diagnosticSignal;
-  const identity = `logs:${previous ? "previous" : "current"}:${value.pod}:${value.container}`;
+  // Unknown streams from separate reads need not belong to the same container.
+  const streamIdentity = value.container ?? `unknown:${source.id}`;
+  const identity = `logs:${previous ? "previous" : "current"}:${value.pod}:${streamIdentity}`;
   builder.observe(identity, "logs", source, {
     // FilterLogs' raw-tail fallback is useful provenance, but the producer did
     // not select it as diagnostic signal. Keep it in Context; only filtered
@@ -952,7 +955,7 @@ export function addLogs(
     ),
     relevance,
     tone: selectedEvidence || normalizedError ? "warning" : "neutral",
-    title: `${previous ? "Previous" : "Current"} logs · ${value.pod} / ${value.container}`,
+    title: `${previous ? "Previous" : "Current"} logs · ${value.pod} / ${containerLabel}`,
     summary:
       lines.length > 0
         ? `${lines.length} selected line${lines.length === 1 ? "" : "s"}`
@@ -971,7 +974,7 @@ export function addLogs(
   if (normalizedError) {
     builder.limit(
       source,
-      `${value.pod} / ${value.container}`,
+      `${value.pod} / ${containerLabel}`,
       normalizedError,
       "error",
     );

package/src/components/diagnose/investigationEvidence/types.ts

@@ -407,7 +407,7 @@ export type InvestigationEvidenceData =
   | {
       type: "logs";
       pod: string;
-      container: string;
+      container?: string;
       /** Namespace the producing call actually read; absent when unstated. */
       namespace?: string;
       previous: boolean;

package/src/components/diagnose/launch.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import type { RunSummary } from "../../api/diagnose";
+import { buildLaunchCommand, launchAgentLabel } from "./launch";
+
+describe("OpenCode terminal handoff", () => {
+  it("uses the correct label without launching a different agent", () => {
+    const run: RunSummary = {
+      id: "run-test",
+      kind: "Deployment",
+      group: "apps",
+      namespace: "default",
+      name: "demo",
+      context: "test",
+      agent: "opencode",
+      status: "done",
+      sessionId: "ses_opencode",
+      createdAt: "2026-09-21T00:00:00Z",
+      updatedAt: "2026-09-21T00:00:00Z",
+    };
+    expect(launchAgentLabel(run)).toBe("OpenCode");
+    expect(buildLaunchCommand(run, "http://localhost:9280/mcp")).toBeNull();
+  });
+});

package/src/components/diagnose/launch.ts

@@ -15,6 +15,7 @@ function sq(s: string): string {
 
 export function launchAgentLabel(run: RunSummary): string {
   if (run.agent === "codex") return "Codex";
+  if (run.agent === "opencode") return "OpenCode";
   if (run.agent === "cursor-agent") return "Cursor";
   return "Claude Code";
 }
@@ -42,6 +43,9 @@ export function buildLaunchCommand(
 ): string | null {
   if (!run.sessionId || run.status === "stale") return null;
 
+  // OpenCode terminal handoff needs a persistent MCP configuration outside the run workspace.
+  if (run.agent === "opencode") return null;
+
   if (run.agent === "cursor-agent") {
     // Cursor's --resume is workspace-scoped, and Radar runs each investigation in a
     // throwaway per-run workspace the user doesn't have — no command can reattach

package/src/components/diagnose/parts.test.tsx

@@ -31,6 +31,82 @@ import { ThemeProvider } from "../../context/ThemeContext";
 
 const noop = vi.fn();
 
+describe("explanations without a root cause", () => {
+  it("keeps inconclusive explanation, sources and action in one control row", () => {
+    const html = renderToStaticMarkup(
+      <ResultCard
+        diagnosis={
+          {
+            inconclusive: true,
+            summary: "Not enough evidence",
+            report: "Logs unavailable",
+            rootCause: "",
+            remediation: [],
+          } as Diagnosis
+        }
+        explanation={{ status: "idle", onGenerate: noop }}
+        assessmentSources={<span>Saved sources</span>}
+        assessmentAction={<button>Next steps</button>}
+      />,
+    );
+    expect(html.match(/data-assessment-actions/g)).toHaveLength(1);
+    const row = html.slice(
+      html.indexOf("data-assessment-actions"),
+      html.indexOf("data-assessment-actions") + 6000,
+    );
+    expect(row).toContain("Assessment details");
+    expect(row).toContain("Explain simply");
+    expect(row).toContain("Next steps");
+  });
+  it.each(["healthy", "inconclusive"] as const)(
+    "offers Explain for a %s assessment",
+    (state) => {
+      const diagnosis = {
+        [state]: true,
+        summary: "Saved assessment",
+        report: "Saved analysis",
+        rootCause: "",
+        remediation: [],
+      } as Diagnosis;
+      const html = renderToStaticMarkup(
+        <ResultCard
+          diagnosis={diagnosis}
+          explanation={{ status: "idle", onGenerate: noop }}
+          section="conclusion"
+        />,
+      );
+      expect(html.match(/Explain simply/g)).toHaveLength(1);
+      expect(html).not.toContain('disabled=""');
+      const running = renderToStaticMarkup(
+        <ResultCard
+          diagnosis={diagnosis}
+          explanation={{ status: "running" }}
+          section="conclusion"
+        />,
+      );
+      expect(running).toContain("Explaining this assessment");
+      expect(
+        renderToStaticMarkup(
+          <ResultCard
+            diagnosis={diagnosis}
+            explanation={{ status: "idle", onGenerate: noop }}
+            section="actions"
+          />,
+        ),
+      ).not.toContain("Explain simply");
+      expect(
+        renderToStaticMarkup(
+          <ResultCard
+            diagnosis={diagnosis}
+            explanation={{ status: "idle", onGenerate: noop }}
+            followup
+          />,
+        ),
+      ).not.toContain("Explain simply");
+    },
+  );
+});
+
 it("keeps earlier remediation copyable without suggesting it is executable", () => {
   const html = renderToStaticMarkup(
     <ResultCard
@@ -95,10 +171,73 @@ describe("remediation commands", () => {
         compactActions
       />,
     );
-    expect(html).toContain("Copy command 1 of step 1");
-    expect(html).toContain("Copy command 2 of step 1");
+    expect(html.match(/aria-label="Copy command from step 1"/g)).toHaveLength(
+      2,
+    );
     expect(html).not.toContain("Copy remediation step");
+    expect(
+      html.indexOf("kubectl rollout undo deployment/api -n dev</code>"),
+    ).toBeLessThan(html.indexOf("Copy command from step 1"));
+    expect(html.indexOf("Copy command from step 1")).toBeLessThan(
+      html.indexOf("kubectl -n dev get pods</code>"),
+    );
   });
+
+  it.each(["bash", ""])(
+    "places each copy button inside its own %s fenced command box",
+    (language) => {
+      const html = renderToStaticMarkup(
+        <ResultCard
+          diagnosis={
+            {
+              rootCause: "Image pull failure",
+              report: "Assessment",
+              remediation: [
+                `Roll back:\n\`\`\`${language}\nkubectl rollout undo deployment/api -n dev\n\`\`\`\nThen watch:\n\`\`\`${language}\nkubectl rollout status deployment/api -n dev\n\`\`\``,
+              ],
+              recommendedIndex: 1,
+            } as Diagnosis
+          }
+          section="actions"
+          compactActions
+          onApply={noop}
+        />,
+      );
+      const blocks = [...html.matchAll(/<pre\b[^>]*>([\s\S]*?)<\/pre>/g)].map(
+        (match) => match[1],
+      );
+      expect(blocks).toHaveLength(2);
+      expect(blocks[0]).toContain("kubectl rollout undo");
+      expect(blocks[0]).toContain("Copy command from step 1");
+      expect(blocks[1]).toContain("kubectl rollout status");
+      expect(blocks[1]).toContain("Copy command from step 1");
+      expect(html.match(/aria-label="Copy command/g)).toHaveLength(2);
+      expect(html.indexOf("Apply…")).toBeLessThan(html.indexOf("<pre"));
+    },
+  );
+});
+
+it("keeps repeated and normalized commands copyable at their rendered locations", () => {
+  const step =
+    "Run `kubectl get pods -n dev`, then run this: ```bash kubectl get pods -n dev ```";
+  expect(remediationCommands(step)).toEqual([
+    "kubectl get pods -n dev",
+    "kubectl get pods -n dev",
+  ]);
+  const html = renderToStaticMarkup(
+    <ResultCard
+      diagnosis={
+        { rootCause: "Check", report: "", remediation: [step] } as Diagnosis
+      }
+      section="actions"
+      compactActions
+    />,
+  );
+  expect(html.match(/aria-label="Copy command from step 1"/g)).toHaveLength(2);
+  expect(html).toMatch(
+    /<pre\b[^>]*>[\s\S]*kubectl get pods -n dev[\s\S]*Copy command from step 1[\s\S]*<\/pre>/,
+  );
+  expect(html).not.toContain("bash kubectl");
 });
 
 describe("explanation placement", () => {
@@ -892,6 +1031,24 @@ describe("ConsentCard execution profile treatment", () => {
     expect(html).toContain("Radar does not override them");
     expect(html).not.toContain("Radar still enables the agent CLI");
   });
+
+  it("does not claim Radar enables a sandbox for OpenCode's normal setup", () => {
+    const html = renderToStaticMarkup(
+      <ConsentCard
+        agentName="OpenCode"
+        agent="opencode"
+        profile="full-local"
+        onApprove={noop}
+        onCancel={noop}
+      />,
+    );
+    expect(html).toContain("Radar runs OpenCode with --auto");
+    expect(html).toContain("automatically approves actions");
+    expect(html).toContain("built-in tools and configured MCP servers");
+    expect(html).toContain("Explicit denials still apply");
+    expect(html).toContain("Radar does not enforce a CLI sandbox");
+    expect(html).not.toContain("Radar still enables the agent CLI");
+  });
 });
 
 // The consent card's error box is the ONLY place a refused approval is

package/src/components/dock/NodeTerminalTab.test.tsx

@@ -0,0 +1,34 @@
+import { renderToString } from 'react-dom/server'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { NodeTerminalTabProps } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab } from './NodeTerminalTab'
+
+const captured = vi.hoisted(() => ({ props: null as NodeTerminalTabProps | null }))
+vi.mock('@skyhook-io/k8s-ui', () => ({
+  NodeTerminalTab: (props: NodeTerminalTabProps) => { captured.props = props; return null },
+}))
+vi.mock('../../api/config', () => ({
+  apiUrl: (path: string) => `/api${path}`,
+  getWsUrl: (path: string) => path,
+  getAuthHeaders: () => ({ Authorization: 'Bearer test' }),
+  getCredentialsMode: () => 'include',
+}))
+afterEach(() => vi.unstubAllGlobals())
+
+it('passes the created UID to exact-pod cleanup query parameters with keepalive', async () => {
+  const pod = { namespace: 'default', podName: 'debug-a', uid: 'uid/a+b', containerName: 'debug' }
+  const fetch = vi.fn().mockResolvedValueOnce(new Response(JSON.stringify(pod)))
+    .mockResolvedValueOnce(new Response('{}'))
+  vi.stubGlobal('fetch', fetch)
+  renderToString(<NodeTerminalTab nodeName="node/a" />)
+  const props = captured.props!
+  const result = await props.createNodeDebugPod('node/a')
+  expect(result).toEqual(pod)
+  await props.cleanupNodeDebugPod('node/a', result)
+  const [url, options] = fetch.mock.calls[1]
+  const parsed = new URL(url, 'http://localhost')
+  expect(parsed.pathname).toBe('/api/nodes/node%2Fa/debug')
+  expect(Object.fromEntries(parsed.searchParams)).toEqual({ namespace: 'default', podName: 'debug-a', uid: 'uid/a+b' })
+  expect(options).toMatchObject({ method: 'DELETE', keepalive: true, credentials: 'include', headers: { Authorization: 'Bearer test' } })
+  expect(options).not.toHaveProperty('body')
+})

package/src/components/dock/NodeTerminalTab.tsx

@@ -1,4 +1,4 @@
-import { NodeTerminalTab as SharedNodeTerminalTab } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab as SharedNodeTerminalTab, type NodeTerminalTabProps as SharedNodeTerminalTabProps } from '@skyhook-io/k8s-ui'
 import { apiUrl, getWsUrl, getAuthHeaders, getCredentialsMode } from '../../api/config'
 
 interface NodeTerminalTabProps {
@@ -21,14 +21,16 @@ export function NodeTerminalTab({ nodeName, isActive }: NodeTerminalTabProps) {
     return response.json()
   }
 
-  const cleanupNodeDebugPod = async (name: string) => {
+  const cleanupNodeDebugPod: SharedNodeTerminalTabProps['cleanupNodeDebugPod'] = async (name, pod) => {
+    const query = new URLSearchParams({ namespace: pod.namespace, podName: pod.podName, uid: pod.uid })
     try {
-      await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug`), {
+      const response = await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug?${query}`), {
         method: 'DELETE',
         credentials: getCredentialsMode(),
         headers: getAuthHeaders(),
         keepalive: true,
       })
+      if (!response.ok) throw new Error(`HTTP ${response.status}`)
     } catch (err) {
       console.warn(`[NodeTerminal] Failed to cleanup debug pod for node ${name}:`, err)
     }