@skyhook-io/radar-app 1.14.5 → 1.15.0

package/src/components/SelfManagedStart.tsx

@@ -0,0 +1,96 @@
+import { ArrowLeft, ArrowUpRight } from 'lucide-react'
+import { SELF_HOSTED_DOCS_URL, signupUrlFor } from './cloudConnectHandoff'
+
+// What the Cloud dialog shows after "Run Radar Cloud yourself…". Running your
+// own control plane starts with a Radar Cloud account, because the Hub signs
+// the Self-Managed license, so this view names that as step 1 of 3 before the
+// click instead of letting a sign-up page surprise someone who came to host
+// it themselves. The link carries intent=self-hosting: the Hub's sign-in page
+// repeats the steps and, after sign-up or sign-in, continues on its
+// Self-hosting page, where the trial, the license and the install command are.
+export function SelfManagedStart({ appUrl, onBack }: { appUrl: string; onBack: () => void }) {
+  const signupUrl = `${signupUrlFor(appUrl, 'self-managed-signup')}&intent=self-hosting`
+  const steps = [
+    {
+      title: 'Create your Radar Cloud account',
+      body: 'Your license is issued from it. An existing account works too.',
+    },
+    {
+      title: 'Generate your install command',
+      body: 'Self-Managed is part of Enterprise, with a 14-day free trial.',
+    },
+    {
+      title: 'Install the control plane, then connect each cluster',
+      body: 'One Helm command installs it. Then one command per cluster to connect it.',
+    },
+  ]
+  return (
+    <>
+      <div className="min-h-0 overflow-y-auto">
+        <div className="px-8 pb-5">
+          <h3 className="text-[20px] font-semibold leading-tight tracking-tight text-theme-text-primary mb-1.5">
+            Run Radar Cloud yourself
+          </h3>
+          <p className="text-[13px] leading-relaxed text-theme-text-secondary mb-5">
+            Run the Radar Cloud control plane in your own infrastructure: the same fleet view, alerts, history
+            and team access, and your cluster data never leaves your network.
+          </p>
+          <ol className="space-y-3.5">
+            {steps.map((step, i) => (
+              <li key={step.title} className="flex gap-3">
+                <span
+                  className={`flex h-5 w-5 shrink-0 items-center justify-center rounded-full text-[10.5px] font-semibold ${
+                    i === 0 ? 'bg-emerald-500 text-emerald-950' : 'border border-theme-border text-theme-text-tertiary'
+                  }`}
+                >
+                  {i + 1}
+                </span>
+                <div className="min-w-0">
+                  <p className={`text-[13px] font-medium ${i === 0 ? 'text-theme-text-primary' : 'text-theme-text-secondary'}`}>
+                    {step.title}
+                  </p>
+                  <p className="text-[12px] leading-relaxed text-theme-text-tertiary">{step.body}</p>
+                </div>
+              </li>
+            ))}
+          </ol>
+          {/* What a platform engineer has to bring, split by stage: a trial
+              needs only an address clusters can reach (a cloud load balancer
+              is the install page's default; Postgres and a built-in admin come
+              bundled); production adds their own Postgres and IdP. */}
+          <div className="mt-5 space-y-1 text-[12px] leading-relaxed text-theme-text-tertiary">
+            <p>
+              <b className="font-medium text-theme-text-secondary">For a trial</b>, you just need a hostname your
+              clusters can reach the hub on.
+            </p>
+            <p>
+              <b className="font-medium text-theme-text-secondary">For production</b>, connect your own Postgres and
+              your IdP to manage users.
+            </p>
+            <a href={SELF_HOSTED_DOCS_URL} target="_blank" rel="noopener noreferrer" className="inline-block underline underline-offset-2 hover:text-theme-text-primary">
+              Read the Self-Managed guide →
+            </a>
+          </div>
+        </div>
+      </div>
+      <div className="shrink-0 px-8 py-4 bg-theme-base border-t border-theme-border flex flex-wrap items-center gap-x-3 gap-y-2.5">
+        <button
+          onClick={onBack}
+          className="inline-flex items-center gap-1.5 whitespace-nowrap text-[12.5px] text-theme-text-secondary hover:text-theme-text-primary transition-colors"
+        >
+          <ArrowLeft className="w-3.5 h-3.5" />
+          Back to Radar Cloud
+        </button>
+        <a
+          href={signupUrl}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="ml-auto inline-flex items-center gap-1.5 whitespace-nowrap px-5 py-2 rounded-[10px] bg-emerald-500 hover:bg-emerald-400 text-emerald-950 text-[13.5px] font-bold shadow-[0_0_22px_rgba(16,185,129,0.35)] hover:shadow-[0_0_30px_rgba(16,185,129,0.5)] transition-all"
+        >
+          Create your Radar Cloud account
+          <ArrowUpRight className="w-4 h-4" />
+        </a>
+      </div>
+    </>
+  )
+}

package/src/components/applications/ApplicationsView.identity.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+
+import type { AppWorkload, Issue } from '@skyhook-io/k8s-ui'
+import { appIssuesForWorkloads } from './ApplicationsView'
+
+function workload(group: string): AppWorkload {
+  return { kind: 'Job', group, namespace: 'ml', name: 'train', health: 'healthy', ready: 1, desired: 1, restarts: 0 }
+}
+
+function issue(id: string, group?: string): Issue {
+  return {
+    id,
+    severity: 'warning',
+    source: 'condition',
+    category: 'job_failed',
+    category_group: 'runtime',
+    grouping_scope: 'workload',
+    kind: 'Job',
+    group,
+    namespace: 'ml',
+    name: 'train',
+    reason: id,
+    message: id,
+  }
+}
+
+describe('appIssuesForWorkloads identity', () => {
+  it('does not share an issue between same-named core and Volcano Jobs', () => {
+    const issues = [issue('core', 'batch'), issue('volcano', 'batch.volcano.sh')]
+
+    expect(appIssuesForWorkloads(issues, [workload('batch')]).map(item => item.id)).toEqual(['core'])
+    expect(appIssuesForWorkloads(issues, [workload('batch.volcano.sh')]).map(item => item.id)).toEqual(['volcano'])
+  })
+
+  it('treats an omitted built-in group as the canonical built-in identity', () => {
+    expect(appIssuesForWorkloads([issue('legacy')], [workload('batch')]).map(item => item.id)).toEqual(['legacy'])
+    expect(appIssuesForWorkloads([issue('legacy')], [workload('batch.volcano.sh')])).toEqual([])
+  })
+})

package/src/components/applications/ApplicationsView.tsx

@@ -23,6 +23,7 @@ import {
   memberRef,
   subjectRef,
   compareIssueSortAnchors,
+  canonicalResourceGroup,
   type AppRow,
   type AppWorkload,
   type AppIdentityInstance,
@@ -490,6 +491,7 @@ function AppDetailRoute({
           source.kind,
           source.namespace,
           source.name,
+          source.group,
         );
         if (path) navigate(path);
         return;
@@ -899,7 +901,7 @@ function compareAppOverviewIssues(a: Issue, b: Issue): number {
   return a.id.localeCompare(b.id);
 }
 
-function appIssuesForWorkloads(
+export function appIssuesForWorkloads(
   issues: Issue[],
   workloads: AppWorkload[],
 ): Issue[] {
@@ -918,11 +920,11 @@ function appIssuesForWorkloads(
 }
 
 function workloadIssueKey(workload: AppWorkload): string {
-  return `${workload.kind.toLowerCase()}|${workload.namespace}|${workload.name}`;
+  return `${canonicalResourceGroup(workload.kind, workload.group) ?? "?"}|${workload.kind.toLowerCase()}|${workload.namespace}|${workload.name}`;
 }
 
 function issueRefKey(ref: IssueResourceRef): string {
-  return `${ref.kind.toLowerCase()}|${ref.namespace ?? ""}|${ref.name}`;
+  return `${canonicalResourceGroup(ref.kind, ref.group) ?? "?"}|${ref.kind.toLowerCase()}|${ref.namespace ?? ""}|${ref.name}`;
 }
 
 function issueRefs(issue: Issue): IssueResourceRef[] {

package/src/components/audit/AuditSettingsDialog.tsx

@@ -1,7 +1,8 @@
 import { useState, useEffect, useMemo } from 'react'
 import { X, Plus, Trash2, Lock } from 'lucide-react'
 import { clsx } from 'clsx'
-import { useAuditSettings, useUpdateAuditSettings, useAudit, useCloudRole } from '../../api/client'
+import { useAuditSettings, useUpdateAuditSettings, useAudit, useCloudRole, useCapabilities } from '../../api/client'
+import { OperatorManagedNotice } from '../settings/OperatorManagedNotice'
 import type { CheckMeta } from '@skyhook-io/k8s-ui'
 import { validateRFC1123Label, type ValidationResult } from '@skyhook-io/k8s-ui/utils/validators'
 import { Tooltip } from '../ui/Tooltip'
@@ -20,7 +21,9 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
   // server-side too). Non-owners get a read-only view. Non-Cloud callers
   // have no role and pass.
   const { canAtLeast } = useCloudRole()
-  const canEdit = canAtLeast('owner')
+  const { data: capabilities } = useCapabilities()
+  const operatorManaged = capabilities?.configManagement === 'operator'
+  const canEdit = capabilities != null && !operatorManaged && canAtLeast('owner')
   const [ignoredNs, setIgnoredNs] = useState<string[]>([])
   const [disabledChecks, setDisabledChecks] = useState<string[]>([])
   const [newNs, setNewNs] = useState('')
@@ -82,7 +85,8 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
         </div>
 
         <div className="px-5 py-4 overflow-y-auto flex-1">
-          {!canEdit && (
+          {operatorManaged && <div className="mb-4"><OperatorManagedNotice helmValue="audit" /></div>}
+          {capabilities && !operatorManaged && !canEdit && (
             <div className="mb-4 rounded-lg border border-theme-border bg-theme-elevated/50 p-3 flex items-start gap-2.5">
               <Lock className="w-3.5 h-3.5 mt-0.5 shrink-0 text-theme-text-tertiary" />
               <p className="text-xs text-theme-text-tertiary">
@@ -104,13 +108,13 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               {ignoredNs.map(ns => (
                 <div key={ns} className="flex items-center justify-between px-3 py-1.5 bg-theme-elevated rounded-lg">
                   <span className="text-sm text-theme-text-primary">{ns}</span>
-                  <button
+                  {!operatorManaged && <button
                     onClick={() => setIgnoredNs(ignoredNs.filter(n => n !== ns))}
                     disabled={!canEdit}
                     className="p-1 rounded hover:bg-theme-hover text-theme-text-tertiary hover:text-red-400 transition-colors disabled:opacity-40 disabled:cursor-not-allowed disabled:hover:text-theme-text-tertiary"
                   >
                     <Trash2 className="w-3.5 h-3.5" />
-                  </button>
+                  </button>}
                 </div>
               ))}
               {ignoredNs.length === 0 && (
@@ -118,7 +122,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               )}
             </div>
 
-            <div className="flex gap-2">
+            {!operatorManaged && <div className="flex gap-2">
               <Input
                 value={newNs}
                 onChange={e => setNewNs(e.target.value)}
@@ -141,7 +145,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               >
                 <Plus className="w-4 h-4" />
               </button>
-            </div>
+            </div>}
             {(newNsError || newNsDuplicate) && (
               <p id="new-ns-help" className="mt-1.5 text-xs text-red-400">
                 {newNsDuplicate
@@ -157,7 +161,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
               Enabled Checks
             </label>
             <p className="text-xs text-theme-text-tertiary mt-1 mb-3">
-              Uncheck to disable specific checks globally across all views.
+              {operatorManaged ? 'Checks enabled by the installation’s audit policy.' : 'Uncheck to disable specific checks globally across all views.'}
             </p>
 
             <div className="flex flex-col gap-0.5">
@@ -191,9 +195,9 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
             onClick={onClose}
             className="px-4 py-1.5 text-sm text-theme-text-secondary hover:text-theme-text-primary bg-theme-elevated hover:bg-theme-hover border border-theme-border rounded-lg transition-colors"
           >
-            Cancel
+            {operatorManaged ? 'Close' : 'Cancel'}
           </button>
-          <Tooltip
+          {!operatorManaged && <Tooltip
             content={
               !canEdit
                 ? 'Audit settings can only be changed by owners'
@@ -216,7 +220,7 @@ export function AuditSettingsDialog({ namespaces, onClose }: AuditSettingsDialog
           >
             {updateSettings.isPending ? 'Saving...' : 'Save'}
           </button>
-          </Tooltip>
+          </Tooltip>}
         </div>
       </div>
     </div>

package/src/components/cloudConnectHandoff.test.ts

@@ -171,7 +171,7 @@ describe('composeAdminNote — an ask, then the link, then the evidence', () =>
     expect(note).toContain('Please confirm nothing is already installed before a fresh install.')
     // The object of the request and the answer to "no SaaS", before the evidence.
     expect(note.indexOf('What it is: Radar, the open-source Kubernetes tool')).toBeLessThan(note.indexOf('Details:'))
-    expect(note).toContain(`can be self-hosted in-house: ${SELF_HOSTED_DOCS_URL}`)
+    expect(note).toContain(`can run in-house as Radar Cloud Self-Managed: ${SELF_HOSTED_DOCS_URL}`)
     // Never the card's second person.
     expect(note).not.toMatch(/\byour\b/i)
   })

package/src/components/cloudConnectHandoff.ts

@@ -144,7 +144,7 @@ export interface AdminNoteContext {
 export const SELF_HOSTED_DOCS_URL = 'https://radarhq.io/docs/cloud/self-hosted/'
 const WHAT_IT_IS = [
   'What it is: Radar, the open-source Kubernetes tool, installed in the cluster as a Helm chart. It opens an outbound connection to a hosted control plane (nothing listens inbound); Radar Cloud users reach this Radar only through that connection, with the permissions of the ServiceAccount it runs as.',
-  `If a hosted service is not an option, the same control plane can be self-hosted in-house: ${SELF_HOSTED_DOCS_URL}`,
+  `If a hosted service is not an option, the same control plane can run in-house as Radar Cloud Self-Managed: ${SELF_HOSTED_DOCS_URL}`,
 ].join(' ')
 
 export function composeAdminNote(blocked: CloudInstallBlocked, exit: BlockedExit, where: AdminNoteContext = {}): string {

package/src/components/diagnose/ActivityTurn.tsx

@@ -1099,6 +1099,7 @@ function ToolResultDialog({
   text: string;
   truncated?: boolean;
 }) {
+  const titleId = useId();
   const { theme } = useTheme();
   const [fmt, setFmt] = useState<"yaml" | "json">("yaml");
   const parsed = useMemo<{ ok: boolean; value?: unknown }>(() => {
@@ -1136,10 +1137,10 @@ function ToolResultDialog({
     };
   }, [open, display, language, theme]);
   return (
-    <DialogPortal open={open} onClose={onClose} className="w-[min(90vw,820px)]">
+    <DialogPortal ariaLabelledBy={titleId} open={open} onClose={onClose} className="w-[min(90vw,820px)]">
       <div className="flex items-center justify-between gap-3 border-b border-theme-border p-3">
         <div className="min-w-0">
-          <div className="truncate font-mono text-sm text-theme-text-primary">
+          <div id={titleId} className="truncate font-mono text-sm text-theme-text-primary">
             {title}
           </div>
           {truncated && (

package/src/components/diagnose/AgentControls.tsx

@@ -9,6 +9,9 @@ import { useAnimatedUnmount } from "../../hooks/useAnimatedUnmount";
 import type { DiagnoseConsentCopy } from "../../context/DiagnoseCustomization";
 import type { AgentInfo, ExecutionProfile } from "../../api/diagnose";
 
+const OPENCODE_FULL_LOCAL_WARNING =
+  "Radar runs OpenCode with --auto, which automatically approves actions that your configuration would normally ask about, including built-in tools and configured MCP servers. Explicit denials still apply. Radar does not enforce a CLI sandbox.";
+
 const CURSOR_FULL_LOCAL_WARNING =
   "Radar passes Cursor --force, which auto-approves its built-in tools and every MCP server it loads, including your global servers. Cursor’s sandbox does not reliably confine those tools to Radar’s temporary workspace.";
 
@@ -245,6 +248,7 @@ export function AgentControls({
   const isCodex = selectedAgent === "codex";
   const isClaude = selectedAgent === "claude";
   const isCursor = selectedAgent === "cursor-agent";
+  const isOpenCode = selectedAgent === "opencode";
   const selectedAgentInfo = agents.find((a) => a.name === selectedAgent);
   const selectedAgentLabel =
     selectedAgentInfo?.label || selectedAgent || "agent";
@@ -302,7 +306,9 @@ export function AgentControls({
                       ? CURSOR_FULL_LOCAL_WARNING
                       : isClaude
                         ? "Claude uses the permissions from your setup; Radar does not override them."
-                        : "Radar still enables the agent CLI’s own sandbox, but that sandbox does not constrain external MCP servers."}{" "}
+                        : isOpenCode
+                          ? OPENCODE_FULL_LOCAL_WARNING
+                          : "Radar still enables the agent CLI’s own sandbox, but that sandbox does not constrain external MCP servers."}{" "}
                     Choose this only when you need that setup.
                   </span>
                 </div>
@@ -330,6 +336,13 @@ export function AgentControls({
                 cluster.{" "}
                 {isCursor ? (
                   CURSOR_FULL_LOCAL_WARNING
+                ) : isClaude ? (
+                  <>
+                    Claude uses the permissions from your setup; Radar does not
+                    override them.
+                  </>
+                ) : isOpenCode ? (
+                  OPENCODE_FULL_LOCAL_WARNING
                 ) : (
                   <>
                     Radar still enables the agent CLI&apos;s own sandbox, but
@@ -371,9 +384,17 @@ export function AgentControls({
         <TextField
           label="Model"
           value={model}
-          placeholder="Default"
+          placeholder={
+            selectedAgent === "opencode"
+              ? "Default (provider/model)"
+              : "Default"
+          }
           onChange={onSetModel}
-          hint="Leave empty for the agent's default, or enter a model identifier it supports."
+          hint={
+            selectedAgent === "opencode"
+              ? "Leave empty for OpenCode's default, or enter a provider/model from opencode models."
+              : "Leave empty for the agent's default, or enter a model identifier it supports."
+          }
         />
       )}
       {isCodex && (
@@ -590,6 +611,8 @@ export function ConsentCard({
                   Claude uses the permissions from your setup; Radar does not
                   override them.
                 </>
+              ) : agent === "opencode" ? (
+                OPENCODE_FULL_LOCAL_WARNING
               ) : (
                 <>
                   Radar still enables the agent CLI&apos;s own sandbox, but that

package/src/components/diagnose/ApplyDialog.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from "react";
+import { useEffect, useState, useId } from "react";
 import {
   CheckCircle2,
   AlertTriangle,
@@ -41,6 +41,7 @@ export function ApplyDialog({
   managedBy?: string; // GitOps/Helm owner of the resource, if any
   confidence?: number;
 }) {
+  const titleId = useId();
   const fixText = fix?.trim();
   const lowConfidence = confidence != null && confidence < 0.5;
   // A GitOps/Helm-managed resource needs an explicit acknowledgment before applying
@@ -56,6 +57,7 @@ export function ApplyDialog({
   const applyBlocked = !!managedBy && !acked;
   return (
     <DialogPortal
+      ariaLabelledBy={titleId}
       open={open}
       onClose={onClose}
       className="flex max-h-[calc(100dvh-2rem)] w-full max-w-2xl flex-col overflow-hidden"
@@ -65,7 +67,7 @@ export function ApplyDialog({
           <AlertTriangle className="h-5 w-5 text-amber-500" />
         </div>
         <div className="min-w-0 flex-1">
-          <h3 className="text-lg font-semibold text-theme-text-primary">
+          <h3 id={titleId} className="text-lg font-semibold text-theme-text-primary">
             Apply this fix?
           </h3>
           <p className="mt-1 text-sm text-theme-text-secondary">

package/src/components/diagnose/DiagnoseContext.tsx

@@ -179,6 +179,7 @@ const AGENT_LABELS: Record<string, string> = {
   codex: "Codex",
   gemini: "Gemini CLI",
   "cursor-agent": "Cursor Agent",
+  opencode: "OpenCode",
 };
 
 export function agentLabelFor(name: string, fallbackLabel?: string): string {

package/src/components/diagnose/agentCatalog.ts

@@ -27,4 +27,10 @@ export const SUPPORTED_AGENTS: AgentInstall[] = [
     install: "curl https://cursor.com/install -fsS | bash",
     docs: "https://docs.cursor.com/en/cli/overview",
   },
+  {
+    name: "opencode",
+    label: "OpenCode",
+    install: "npm install -g opencode-ai",
+    docs: "https://opencode.ai/docs/",
+  },
 ];

package/src/components/diagnose/launch.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import type { RunSummary } from "../../api/diagnose";
+import { buildLaunchCommand, launchAgentLabel } from "./launch";
+
+describe("OpenCode terminal handoff", () => {
+  it("uses the correct label without launching a different agent", () => {
+    const run: RunSummary = {
+      id: "run-test",
+      kind: "Deployment",
+      group: "apps",
+      namespace: "default",
+      name: "demo",
+      context: "test",
+      agent: "opencode",
+      status: "done",
+      sessionId: "ses_opencode",
+      createdAt: "2026-09-21T00:00:00Z",
+      updatedAt: "2026-09-21T00:00:00Z",
+    };
+    expect(launchAgentLabel(run)).toBe("OpenCode");
+    expect(buildLaunchCommand(run, "http://localhost:9280/mcp")).toBeNull();
+  });
+});

package/src/components/diagnose/launch.ts

@@ -15,6 +15,7 @@ function sq(s: string): string {
 
 export function launchAgentLabel(run: RunSummary): string {
   if (run.agent === "codex") return "Codex";
+  if (run.agent === "opencode") return "OpenCode";
   if (run.agent === "cursor-agent") return "Cursor";
   return "Claude Code";
 }
@@ -42,6 +43,9 @@ export function buildLaunchCommand(
 ): string | null {
   if (!run.sessionId || run.status === "stale") return null;
 
+  // OpenCode terminal handoff needs a persistent MCP configuration outside the run workspace.
+  if (run.agent === "opencode") return null;
+
   if (run.agent === "cursor-agent") {
     // Cursor's --resume is workspace-scoped, and Radar runs each investigation in a
     // throwaway per-run workspace the user doesn't have — no command can reattach

package/src/components/diagnose/parts.test.tsx

@@ -1031,6 +1031,24 @@ describe("ConsentCard execution profile treatment", () => {
     expect(html).toContain("Radar does not override them");
     expect(html).not.toContain("Radar still enables the agent CLI");
   });
+
+  it("does not claim Radar enables a sandbox for OpenCode's normal setup", () => {
+    const html = renderToStaticMarkup(
+      <ConsentCard
+        agentName="OpenCode"
+        agent="opencode"
+        profile="full-local"
+        onApprove={noop}
+        onCancel={noop}
+      />,
+    );
+    expect(html).toContain("Radar runs OpenCode with --auto");
+    expect(html).toContain("automatically approves actions");
+    expect(html).toContain("built-in tools and configured MCP servers");
+    expect(html).toContain("Explicit denials still apply");
+    expect(html).toContain("Radar does not enforce a CLI sandbox");
+    expect(html).not.toContain("Radar still enables the agent CLI");
+  });
 });
 
 // The consent card's error box is the ONLY place a refused approval is

package/src/components/dialog-names.test.ts

@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+// Screen readers announce a dialog by its name; an unnamed one is read as just
+// "dialog". Every DialogPortal must pass ariaLabelledBy (its visible title) or
+// ariaLabel.
+const repoRoot = join(__dirname, '..', '..', '..')
+const roots = ['web/src', 'packages/k8s-ui/src'].map(r => join(repoRoot, r))
+
+function sourceFiles(dir: string): string[] {
+  return readdirSync(dir).flatMap(name => {
+    const path = join(dir, name)
+    if (statSync(path).isDirectory()) return name === 'node_modules' ? [] : sourceFiles(path)
+    return /\.tsx$/.test(name) && !/\.test\.tsx$/.test(name) ? [path] : []
+  })
+}
+
+// The opening tag ends at the first '>' outside a {…} expression or a string.
+function openingTags(source: string, component: string): string[] {
+  const tags: string[] = []
+  let from = 0
+  for (;;) {
+    const start = source.indexOf(`<${component}`, from)
+    if (start < 0) return tags
+    let depth = 0
+    let i = start + component.length + 1
+    for (; i < source.length; i++) {
+      const c = source[i]
+      if (c === '"' || c === "'" || c === '`') {
+        i++
+        while (i < source.length && source[i] !== c) i += source[i] === '\\' ? 2 : 1
+      } else if (c === '{') depth++
+      else if (c === '}') depth--
+      else if (c === '>' && depth === 0) break
+    }
+    tags.push(source.slice(start, i + 1))
+    from = i
+  }
+}
+
+function isNamed(tag: string): boolean {
+  const withoutStrings = tag.replace(/(["'`])(?:\\.|(?!\1)[^\\])*\1/gs, '""')
+  return /\saria(Label|LabelledBy)\s*=/.test(withoutStrings)
+}
+
+describe('dialogs', () => {
+  it('every DialogPortal has an accessible name', () => {
+    const unnamed = roots.flatMap(sourceFiles).flatMap(file => {
+      if (file.endsWith('DialogPortal.tsx')) return []
+      return openingTags(readFileSync(file, 'utf8'), 'DialogPortal')
+        .filter(tag => /^<DialogPortal[\s>]/.test(tag) && !isNamed(tag))
+        .map(() => relative(repoRoot, file))
+    })
+    expect(unnamed).toEqual([])
+  })
+
+  it('reads attributes, not text that looks like them', () => {
+    const [unnamed, spaced, braceInString] = openingTags(
+      `<DialogPortal onClose={() => log("ariaLabel=unused")}>` +
+      `<DialogPortal ariaLabel = "Named">` +
+      `<DialogPortal title={"}"} open>`,
+      'DialogPortal',
+    )
+    expect(isNamed(unnamed)).toBe(false)
+    expect(isNamed(spaced)).toBe(true)
+    expect(braceInString).toBe('<DialogPortal title={"}"} open>')
+  })
+})

package/src/components/dock/NodeTerminalTab.test.tsx

@@ -0,0 +1,34 @@
+import { renderToString } from 'react-dom/server'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { NodeTerminalTabProps } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab } from './NodeTerminalTab'
+
+const captured = vi.hoisted(() => ({ props: null as NodeTerminalTabProps | null }))
+vi.mock('@skyhook-io/k8s-ui', () => ({
+  NodeTerminalTab: (props: NodeTerminalTabProps) => { captured.props = props; return null },
+}))
+vi.mock('../../api/config', () => ({
+  apiUrl: (path: string) => `/api${path}`,
+  getWsUrl: (path: string) => path,
+  getAuthHeaders: () => ({ Authorization: 'Bearer test' }),
+  getCredentialsMode: () => 'include',
+}))
+afterEach(() => vi.unstubAllGlobals())
+
+it('passes the created UID to exact-pod cleanup query parameters with keepalive', async () => {
+  const pod = { namespace: 'default', podName: 'debug-a', uid: 'uid/a+b', containerName: 'debug' }
+  const fetch = vi.fn().mockResolvedValueOnce(new Response(JSON.stringify(pod)))
+    .mockResolvedValueOnce(new Response('{}'))
+  vi.stubGlobal('fetch', fetch)
+  renderToString(<NodeTerminalTab nodeName="node/a" />)
+  const props = captured.props!
+  const result = await props.createNodeDebugPod('node/a')
+  expect(result).toEqual(pod)
+  await props.cleanupNodeDebugPod('node/a', result)
+  const [url, options] = fetch.mock.calls[1]
+  const parsed = new URL(url, 'http://localhost')
+  expect(parsed.pathname).toBe('/api/nodes/node%2Fa/debug')
+  expect(Object.fromEntries(parsed.searchParams)).toEqual({ namespace: 'default', podName: 'debug-a', uid: 'uid/a+b' })
+  expect(options).toMatchObject({ method: 'DELETE', keepalive: true, credentials: 'include', headers: { Authorization: 'Bearer test' } })
+  expect(options).not.toHaveProperty('body')
+})

package/src/components/dock/NodeTerminalTab.tsx

@@ -1,4 +1,4 @@
-import { NodeTerminalTab as SharedNodeTerminalTab } from '@skyhook-io/k8s-ui'
+import { NodeTerminalTab as SharedNodeTerminalTab, type NodeTerminalTabProps as SharedNodeTerminalTabProps } from '@skyhook-io/k8s-ui'
 import { apiUrl, getWsUrl, getAuthHeaders, getCredentialsMode } from '../../api/config'
 
 interface NodeTerminalTabProps {
@@ -21,14 +21,16 @@ export function NodeTerminalTab({ nodeName, isActive }: NodeTerminalTabProps) {
     return response.json()
   }
 
-  const cleanupNodeDebugPod = async (name: string) => {
+  const cleanupNodeDebugPod: SharedNodeTerminalTabProps['cleanupNodeDebugPod'] = async (name, pod) => {
+    const query = new URLSearchParams({ namespace: pod.namespace, podName: pod.podName, uid: pod.uid })
     try {
-      await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug`), {
+      const response = await fetch(apiUrl(`/nodes/${encodeURIComponent(name)}/debug?${query}`), {
         method: 'DELETE',
         credentials: getCredentialsMode(),
         headers: getAuthHeaders(),
         keepalive: true,
       })
+      if (!response.ok) throw new Error(`HTTP ${response.status}`)
     } catch (err) {
       console.warn(`[NodeTerminal] Failed to cleanup debug pod for node ${name}:`, err)
     }