@skyhook-io/radar-app 1.14.5 → 1.14.6

package/src/components/audit/AuditSettingsDialog.tsx

@@ -1,7 +1,8 @@
 import { useState, useEffect, useMemo } from 'react'
 import { X, Plus, Trash2, Lock } from 'lucide-react'
 import { clsx } from 'clsx'
-import { useAuditSettings, useUpdateAuditSettings, useAudit, useCloudRole } from '../../api/client'
+import { useAuditSettings, useUpdateAuditSettings, useAudit, useCloudRole, useCapabilities } from '../../api/client'
+import { OperatorManagedNotice } from '../settings/OperatorManagedNotice'
 import type { CheckMeta } from '@skyhook-io/k8s-ui'
 import { validateRFC1123Label, type ValidationResult } from '@skyhook-io/k8s-ui/utils/validators'
 import { Tooltip } from '../ui/Tooltip'
@@ -20,7 +21,9 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
   // server-side too). Non-owners get a read-only view. Non-Cloud callers
   // have no role and pass.
   const { canAtLeast } = useCloudRole()
-  const canEdit = canAtLeast('owner')
+  const { data: capabilities } = useCapabilities()
+  const operatorManaged = capabilities?.configManagement === 'operator'
+  const canEdit = capabilities != null && !operatorManaged && canAtLeast('owner')
   const [ignoredNs, setIgnoredNs] = useState<string[]>([])
   const [disabledChecks, setDisabledChecks] = useState<string[]>([])
   const [newNs, setNewNs] = useState('')
@@ -82,7 +85,8 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
         </div>
 
         <div className="px-5 py-4 overflow-y-auto flex-1">
-          {!canEdit && (
+          {operatorManaged && <div className="mb-4"><OperatorManagedNotice helmValue="audit" /></div>}
+          {capabilities && !operatorManaged && !canEdit && (
             <div className="mb-4 rounded-lg border border-theme-border bg-theme-elevated/50 p-3 flex items-start gap-2.5">
               <Lock className="w-3.5 h-3.5 mt-0.5 shrink-0 text-theme-text-tertiary" />
               <p className="text-xs text-theme-text-tertiary">
@@ -104,13 +108,13 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               {ignoredNs.map(ns => (
                 <div key={ns} className="flex items-center justify-between px-3 py-1.5 bg-theme-elevated rounded-lg">
                   <span className="text-sm text-theme-text-primary">{ns}</span>
-                  <button
+                  {!operatorManaged && <button
                     onClick={() => setIgnoredNs(ignoredNs.filter(n => n !== ns))}
                     disabled={!canEdit}
                     className="p-1 rounded hover:bg-theme-hover text-theme-text-tertiary hover:text-red-400 transition-colors disabled:opacity-40 disabled:cursor-not-allowed disabled:hover:text-theme-text-tertiary"
                   >
                     <Trash2 className="w-3.5 h-3.5" />
-                  </button>
+                  </button>}
                 </div>
               ))}
               {ignoredNs.length === 0 && (
@@ -118,7 +122,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               )}
             </div>
 
-            <div className="flex gap-2">
+            {!operatorManaged && <div className="flex gap-2">
               <Input
                 value={newNs}
                 onChange={e => setNewNs(e.target.value)}
@@ -141,7 +145,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               >
                 <Plus className="w-4 h-4" />
               </button>
-            </div>
+            </div>}
             {(newNsError || newNsDuplicate) && (
               <p id="new-ns-help" className="mt-1.5 text-xs text-red-400">
                 {newNsDuplicate
@@ -157,7 +161,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               Enabled Checks
             </label>
             <p className="text-xs text-theme-text-tertiary mt-1 mb-3">
-              Uncheck to disable specific checks globally across all views.
+              {operatorManaged ? 'Checks enabled by the installation’s audit policy.' : 'Uncheck to disable specific checks globally across all views.'}
             </p>
 
             <div className="flex flex-col gap-0.5">
@@ -191,9 +195,9 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
             onClick={onClose}
             className="px-4 py-1.5 text-sm text-theme-text-secondary hover:text-theme-text-primary bg-theme-elevated hover:bg-theme-hover border border-theme-border rounded-lg transition-colors"
           >
-            Cancel
+            {operatorManaged ? 'Close' : 'Cancel'}
           </button>
-          <Tooltip
+          {!operatorManaged && <Tooltip
             content={
               !canEdit
                 ? 'Audit settings can only be changed by owners'
@@ -216,7 +220,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
           >
             {updateSettings.isPending ? 'Saving...' : 'Save'}
           </button>
-          </Tooltip>
+          </Tooltip>}
         </div>
       </div>
     </div>

package/src/components/diagnose/AgentControls.tsx

@@ -9,6 +9,9 @@ import { useAnimatedUnmount } from "../../hooks/useAnimatedUnmount";
 import type { DiagnoseConsentCopy } from "../../context/DiagnoseCustomization";
 import type { AgentInfo, ExecutionProfile } from "../../api/diagnose";
 
+const OPENCODE_FULL_LOCAL_WARNING =
+  "Radar runs OpenCode with --auto, which automatically approves actions that your configuration would normally ask about, including built-in tools and configured MCP servers. Explicit denials still apply. Radar does not enforce a CLI sandbox.";
+
 const CURSOR_FULL_LOCAL_WARNING =
   "Radar passes Cursor --force, which auto-approves its built-in tools and every MCP server it loads, including your global servers. Cursor’s sandbox does not reliably confine those tools to Radar’s temporary workspace.";
 
@@ -245,6 +248,7 @@ export function AgentControls({
   const isCodex = selectedAgent === "codex";
   const isClaude = selectedAgent === "claude";
   const isCursor = selectedAgent === "cursor-agent";
+  const isOpenCode = selectedAgent === "opencode";
   const selectedAgentInfo = agents.find((a) => a.name === selectedAgent);
   const selectedAgentLabel =
     selectedAgentInfo?.label || selectedAgent || "agent";
@@ -302,7 +306,9 @@ export function AgentControls({
                       ? CURSOR_FULL_LOCAL_WARNING
                       : isClaude
                         ? "Claude uses the permissions from your setup; Radar does not override them."
-                        : "Radar still enables the agent CLI’s own sandbox, but that sandbox does not constrain external MCP servers."}{" "}
+                        : isOpenCode
+                          ? OPENCODE_FULL_LOCAL_WARNING
+                          : "Radar still enables the agent CLI’s own sandbox, but that sandbox does not constrain external MCP servers."}{" "}
                     Choose this only when you need that setup.
                   </span>
                 </div>
@@ -330,6 +336,13 @@ export function AgentControls({
                 cluster.{" "}
                 {isCursor ? (
                   CURSOR_FULL_LOCAL_WARNING
+                ) : isClaude ? (
+                  <>
+                    Claude uses the permissions from your setup; Radar does not
+                    override them.
+                  </>
+                ) : isOpenCode ? (
+                  OPENCODE_FULL_LOCAL_WARNING
                 ) : (
                   <>
                     Radar still enables the agent CLI&apos;s own sandbox, but
@@ -371,9 +384,17 @@ export function AgentControls({
         <TextField
           label="Model"
           value={model}
-          placeholder="Default"
+          placeholder={
+            selectedAgent === "opencode"
+              ? "Default (provider/model)"
+              : "Default"
+          }
           onChange={onSetModel}
-          hint="Leave empty for the agent's default, or enter a model identifier it supports."
+          hint={
+            selectedAgent === "opencode"
+              ? "Leave empty for OpenCode's default, or enter a provider/model from opencode models."
+              : "Leave empty for the agent's default, or enter a model identifier it supports."
+          }
         />
       )}
       {isCodex && (
@@ -590,6 +611,8 @@ export function ConsentCard({
                   Claude uses the permissions from your setup; Radar does not
                   override them.
                 </>
+              ) : agent === "opencode" ? (
+                OPENCODE_FULL_LOCAL_WARNING
               ) : (
                 <>
                   Radar still enables the agent CLI&apos;s own sandbox, but that

package/src/components/diagnose/DiagnoseContext.tsx

@@ -179,6 +179,7 @@ const AGENT_LABELS: Record<string, string> = {
   codex: "Codex",
   gemini: "Gemini CLI",
   "cursor-agent": "Cursor Agent",
+  opencode: "OpenCode",
 };
 
 export function agentLabelFor(name: string, fallbackLabel?: string): string {

package/src/components/diagnose/agentCatalog.ts

@@ -27,4 +27,10 @@ export const SUPPORTED_AGENTS: AgentInstall[] = [
     install: "curl https://cursor.com/install -fsS | bash",
     docs: "https://docs.cursor.com/en/cli/overview",
   },
+  {
+    name: "opencode",
+    label: "OpenCode",
+    install: "npm install -g opencode-ai",
+    docs: "https://opencode.ai/docs/",
+  },
 ];

package/src/components/diagnose/launch.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import type { RunSummary } from "../../api/diagnose";
+import { buildLaunchCommand, launchAgentLabel } from "./launch";
+
+describe("OpenCode terminal handoff", () => {
+  it("uses the correct label without launching a different agent", () => {
+    const run: RunSummary = {
+      id: "run-test",
+      kind: "Deployment",
+      group: "apps",
+      namespace: "default",
+      name: "demo",
+      context: "test",
+      agent: "opencode",
+      status: "done",
+      sessionId: "ses_opencode",
+      createdAt: "2026-09-21T00:00:00Z",
+      updatedAt: "2026-09-21T00:00:00Z",
+    };
+    expect(launchAgentLabel(run)).toBe("OpenCode");
+    expect(buildLaunchCommand(run, "http://localhost:9280/mcp")).toBeNull();
+  });
+});

package/src/components/diagnose/launch.ts

@@ -15,6 +15,7 @@ function sq(s: string): string {
 
 export function launchAgentLabel(run: RunSummary): string {
   if (run.agent === "codex") return "Codex";
+  if (run.agent === "opencode") return "OpenCode";
   if (run.agent === "cursor-agent") return "Cursor";
   return "Claude Code";
 }
@@ -42,6 +43,9 @@ export function buildLaunchCommand(
 ): string | null {
   if (!run.sessionId || run.status === "stale") return null;
 
+  // OpenCode terminal handoff needs a persistent MCP configuration outside the run workspace.
+  if (run.agent === "opencode") return null;
+
   if (run.agent === "cursor-agent") {
     // Cursor's --resume is workspace-scoped, and Radar runs each investigation in a
     // throwaway per-run workspace the user doesn't have — no command can reattach

package/src/components/diagnose/parts.test.tsx

@@ -1031,6 +1031,24 @@ describe("ConsentCard execution profile treatment", () => {
     expect(html).toContain("Radar does not override them");
     expect(html).not.toContain("Radar still enables the agent CLI");
   });
+
+  it("does not claim Radar enables a sandbox for OpenCode's normal setup", () => {
+    const html = renderToStaticMarkup(
+      <ConsentCard
+        agentName="OpenCode"
+        agent="opencode"
+        profile="full-local"
+        onApprove={noop}
+        onCancel={noop}
+      />,
+    );
+    expect(html).toContain("Radar runs OpenCode with --auto");
+    expect(html).toContain("automatically approves actions");
+    expect(html).toContain("built-in tools and configured MCP servers");
+    expect(html).toContain("Explicit denials still apply");
+    expect(html).toContain("Radar does not enforce a CLI sandbox");
+    expect(html).not.toContain("Radar still enables the agent CLI");
+  });
 });
 
 // The consent card's error box is the ONLY place a refused approval is

package/src/components/dock/NodeTerminalTab.test.tsx

@@ -0,0 +1,34 @@
+import { renderToString } from 'react-dom/server'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { NodeTerminalTabProps } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab } from './NodeTerminalTab'
+
+const captured = vi.hoisted(() => ({ props: null as NodeTerminalTabProps | null }))
+vi.mock('@skyhook-io/k8s-ui', () => ({
+  NodeTerminalTab: (props: NodeTerminalTabProps) => { captured.props = props; return null },
+}))
+vi.mock('../../api/config', () => ({
+  apiUrl: (path: string) => `/api${path}`,
+  getWsUrl: (path: string) => path,
+  getAuthHeaders: () => ({ Authorization: 'Bearer test' }),
+  getCredentialsMode: () => 'include',
+}))
+afterEach(() => vi.unstubAllGlobals())
+
+it('passes the created UID to exact-pod cleanup query parameters with keepalive', async () => {
+  const pod = { namespace: 'default', podName: 'debug-a', uid: 'uid/a+b', containerName: 'debug' }
+  const fetch = vi.fn().mockResolvedValueOnce(new Response(JSON.stringify(pod)))
+    .mockResolvedValueOnce(new Response('{}'))
+  vi.stubGlobal('fetch', fetch)
+  renderToString(<NodeTerminalTab nodeName="node/a" />)
+  const props = captured.props!
+  const result = await props.createNodeDebugPod('node/a')
+  expect(result).toEqual(pod)
+  await props.cleanupNodeDebugPod('node/a', result)
+  const [url, options] = fetch.mock.calls[1]
+  const parsed = new URL(url, 'http://localhost')
+  expect(parsed.pathname).toBe('/api/nodes/node%2Fa/debug')
+  expect(Object.fromEntries(parsed.searchParams)).toEqual({ namespace: 'default', podName: 'debug-a', uid: 'uid/a+b' })
+  expect(options).toMatchObject({ method: 'DELETE', keepalive: true, credentials: 'include', headers: { Authorization: 'Bearer test' } })
+  expect(options).not.toHaveProperty('body')
+})

package/src/components/dock/NodeTerminalTab.tsx

@@ -1,4 +1,4 @@
-import { NodeTerminalTab as SharedNodeTerminalTab } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab as SharedNodeTerminalTab, type NodeTerminalTabProps as SharedNodeTerminalTabProps } from '@skyhook-io/k8s-ui'
 import { apiUrl, getWsUrl, getAuthHeaders, getCredentialsMode } from '../../api/config'
 
 interface NodeTerminalTabProps {
@@ -21,14 +21,16 @@ export function NodeTerminalTab({ nodeName, isActive }: NodeTerminalTabProps) {
     return response.json()
   }
 
-  const cleanupNodeDebugPod = async (name: string) => {
+  const cleanupNodeDebugPod: SharedNodeTerminalTabProps['cleanupNodeDebugPod'] = async (name, pod) => {
+    const query = new URLSearchParams({ namespace: pod.namespace, podName: pod.podName, uid: pod.uid })
     try {
-      await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug`), {
+      const response = await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug?${query}`), {
         method: 'DELETE',
         credentials: getCredentialsMode(),
         headers: getAuthHeaders(),
         keepalive: true,
       })
+      if (!response.ok) throw new Error(`HTTP ${response.status}`)
     } catch (err) {
       console.warn(`[NodeTerminal] Failed to cleanup debug pod for node ${name}:`, err)
     }

package/src/components/dock/WorkloadLogsTab.test.tsx

@@ -0,0 +1,66 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { WorkloadLogsTab } from './WorkloadLogsTab'
+
+const state = vi.hoisted(() => ({ targets: [] as Array<{ kind: string; name: string; role?: string; snapshotOnly?: boolean }> }))
+vi.mock('../../api/client', () => ({
+  useResource: (_kind: string, _namespace: string, name: string) => ({
+    data: { metadata: { uid: name }, spec: { replicatedJobs: [{ name: name === 'first' ? 'workers' : 'leader' }] } },
+  }),
+  useWorkloadRuns: (_kind: string, namespace: string, name: string) => ({
+    data: { collection: 'members', runs: [{ group: 'batch', kind: 'jobs', namespace, name: `${name}-0`, phase: 'Running', active: true }], total: 1 },
+  }),
+}))
+vi.mock('../logs/WorkloadLogsViewer', () => ({
+  WorkloadLogsViewer: (props: { kind: string; name: string; role?: string; snapshotOnly?: boolean }) => {
+    state.targets.push(props)
+    return <div data-log-target={`${props.kind}/${props.name}`} />
+  },
+}))
+
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+let root: Root
+let element: HTMLDivElement
+beforeEach(() => {
+  state.targets = []
+  element = document.createElement('div')
+  document.body.appendChild(element)
+  root = createRoot(element)
+})
+afterEach(async () => {
+  await act(async () => root.unmount())
+  element.remove()
+})
+async function render(name: string, kind = 'JobSet') {
+  await act(async () => root.render(<WorkloadLogsTab namespace="training" workloadKind={kind} workloadName={name} />))
+}
+
+describe('dock JobSet logs', () => {
+  it.each(['JobSet', 'jobsets'])('routes %s to selected member logs and supports role snapshots', async kind => {
+    await render('first', kind)
+    expect(element.querySelector('[data-log-target="jobs/first-0"]')).not.toBeNull()
+    const scope = element.querySelector<HTMLSelectElement>('#jobset-log-scope')!
+    await act(async () => {
+      scope.value = 'role'
+      scope.dispatchEvent(new Event('change', { bubbles: true }))
+    })
+    expect(state.targets.at(-1)).toMatchObject({ kind: 'jobsets', name: 'first', role: 'workers', snapshotOnly: true })
+  })
+
+  it('resets aggregate scope and role before rendering another JobSet log source', async () => {
+    await render('first')
+    const scope = element.querySelector<HTMLSelectElement>('#jobset-log-scope')!
+    await act(async () => {
+      scope.value = 'role'
+      scope.dispatchEvent(new Event('change', { bubbles: true }))
+    })
+    state.targets = []
+    await render('second')
+    expect(element.querySelector<HTMLSelectElement>('#jobset-log-scope')?.value).toBe('selected')
+    expect(element.textContent).not.toContain('workers')
+    expect(state.targets.every(target => target.name === 'second-0' && target.role === undefined)).toBe(true)
+    expect(element.querySelector('[data-log-target="jobs/second-0"]')).not.toBeNull()
+  })
+})

package/src/components/dock/WorkloadLogsTab.tsx

@@ -17,7 +17,8 @@ export function WorkloadLogsTab({
     normalizedKind === 'cronworkflow' || normalizedKind === 'cronworkflows' ||
     normalizedKind === 'workflowtemplate' || normalizedKind === 'workflowtemplates' ||
     normalizedKind === 'clusterworkflowtemplate' || normalizedKind === 'clusterworkflowtemplates' ||
-    normalizedKind === 'scaledjob' || normalizedKind === 'scaledjobs'
+    normalizedKind === 'scaledjob' || normalizedKind === 'scaledjobs' ||
+    normalizedKind === 'jobset' || normalizedKind === 'jobsets'
 
   return (
     <div className="h-full">

package/src/components/execution/BatchExecutionView.render.test.tsx

@@ -5,7 +5,8 @@ import { BatchExecutionFullscreen } from './BatchExecutionView'
 vi.mock('../../api/client', () => ({
   useResource: () => ({}),
   useWorkloadPods: () => ({}),
-  useWorkloadRuns: () => ({ data: { runs: [] } }),
+  useJobSetResources: () => ({ data: undefined, isLoading: false }),
+  useWorkloadRuns: () => ({ data: { collection: 'runs', runs: [], total: 0, truncated: false } }),
 }))
 
 describe.each(['Job', 'CronJob', 'ScaledJob'])('%s cleanup retention display', (kind) => {

package/src/components/execution/BatchExecutionView.test.ts

@@ -1,6 +1,18 @@
 import { describe, expect, it } from 'vitest'
 import type { WorkflowExecutionActivity } from '@skyhook-io/k8s-ui/utils/workflow-execution'
-import { activityPreviewItems, effectiveDefinitionResource, isDirectRunKind, retentionHistoryCopy, runMessageNeedsDisclosure, workflowDefinitionParameters, workflowDefinitionTarget, workflowRunArguments } from './BatchExecutionView'
+import {
+  activityPreviewItems,
+  selectedRunMissing,
+  effectiveDefinitionResource,
+  isDirectRunKind,
+  resourceTargetForRun,
+  retentionHistoryCopy,
+  runMessageNeedsDisclosure,
+  workflowDefinitionParameters,
+  workflowDefinitionTarget,
+  workflowRunArguments,
+  workloadRunKey,
+} from './BatchExecutionView'
 
 function activity(id: string, tone: WorkflowExecutionActivity['tone'] = 'success'): WorkflowExecutionActivity {
   return { id, at: '2026-01-01T00:00:00Z', label: id, tone }
@@ -168,3 +180,42 @@ describe('direct run identity', () => {
     expect(isDirectRunKind('WorkflowTemplate', 'workflows')).toBe(false)
   })
 })
+
+describe('JobSet member presentation', () => {
+  it('keeps the selected Job as the core Kubernetes intermediate', () => {
+    expect(resourceTargetForRun({
+      kind: 'jobs',
+      group: 'batch',
+      namespace: 'training',
+      name: 'distributed-workers-2',
+      phase: 'Running',
+      active: true,
+    })).toEqual({
+      kind: 'jobs',
+      group: 'batch',
+      namespace: 'training',
+      name: 'distributed-workers-2',
+    })
+  })
+})
+
+describe('selection across a member refresh', () => {
+  it('preserves a selected Job that has fallen outside the shown window', () => {
+    const shown = [{ kind: 'jobs', group: 'batch', namespace: 'training', name: 'current', phase: 'Running', active: true }]
+    expect(selectedRunMissing(shown, 'jobs/training/earlier')).toBe(true)
+    expect(selectedRunMissing(shown, 'jobs/training/current')).toBe(false)
+    expect(selectedRunMissing([], 'jobs/training/earlier')).toBe(true)
+    expect(selectedRunMissing(shown, '')).toBe(false)
+  })
+})
+
+
+describe('run navigation identity', () => {
+  it('uses the reported group and preserves the released selection address', () => {
+    const run = { group: 'batch', kind: 'jobs', namespace: 'training', name: 'worker', phase: 'Running', active: true }
+    expect(workloadRunKey(run)).toBe('jobs/training/worker')
+    expect(resourceTargetForRun(run).group).toBe('batch')
+    expect(resourceTargetForRun({ ...run, group: 'batch.volcano.sh' }).group).toBe('batch.volcano.sh')
+    expect(resourceTargetForRun({ ...run, group: 'argoproj.io', kind: 'workflows' }).group).toBe('argoproj.io')
+  })
+})