@skyhook-io/radar-app 1.15.0 → 1.16.1

package/src/api/radarFeatures.render.test.tsx

@@ -0,0 +1,223 @@
+// @vitest-environment jsdom
+import { act, useEffect } from 'react'
+import { createRoot } from 'react-dom/client'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getRadarUpgradeRequirement } from '@skyhook-io/k8s-ui'
+import { ApiError, isNotFoundError, useApplications, useCapacityPoolDetail, useDrainPlan, usePodEnvironment, useWorkloadHistory } from './client'
+import { getApiBase } from './config'
+import { usePolicyResource } from './policy'
+import { isRadarFeatureUnsupported } from './radarFeatures'
+
+// By default the host knows the agent as v1.7.2 before /capabilities,
+// /version-check and /api-resources answer; the tests settle those by seeding
+// the cache.
+const host = vi.hoisted(() => ({ radarVersion: 'v1.7.2' as string | undefined }))
+vi.mock('../context/RadarUpgradeHost', () => ({ useRadarUpgradeHost: () => host }))
+
+const CHI_404 = () => new Response('404 page not found\n', { status: 404, headers: { 'Content-Type': 'text/plain; charset=utf-8' } })
+let chiRoutes: string[] = []
+
+vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+const requested: string[] = []
+let element: HTMLDivElement
+let root: ReturnType<typeof createRoot>
+let client: QueryClient
+
+beforeEach(() => {
+  requested.length = 0
+  host.radarVersion = 'v1.7.2'
+  chiRoutes = []
+  vi.stubGlobal('fetch', vi.fn((input: RequestInfo | URL) => {
+    const url = String(input)
+    requested.push(url)
+    if (chiRoutes.some((route) => url.includes(route))) return Promise.resolve(CHI_404())
+    if (url.includes('/capacity/pools/')) return Promise.resolve(Response.json({ pool: { name: 'default' } }))
+    if (url.endsWith('/environment')) return Promise.resolve(Response.json({ containers: [], coverage: {} }))
+    if (url.includes('/policy/resource/')) return Promise.resolve(Response.json({ evaluated: true, status: 'ready' }))
+    return new Promise<Response>(() => {})
+  }))
+  element = document.createElement('div')
+  root = createRoot(element)
+  client = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  client.clear()
+  vi.unstubAllGlobals()
+  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+})
+
+async function render(node: React.ReactNode) {
+  await act(async () => { root.render(<QueryClientProvider client={client}>{node}</QueryClientProvider>) })
+  await settle()
+}
+
+// Lets queries started by the last render run to completion.
+async function settle() {
+  await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)) })
+}
+
+const asked = (suffix: string) => requested.some((url) => url.includes(suffix))
+
+function Environment() {
+  const { data, error } = usePodEnvironment('shop', 'web')
+  return <span>{data ? 'data' : getRadarUpgradeRequirement(error) ? 'upgrade' : 'pending'}</span>
+}
+
+function Policy() {
+  const { data, error, isLoading, isError } = usePolicyResource('pods', 'shop', 'web')
+  if (isLoading) return <span>loading</span>
+  if (data && isError) return <span>inconsistent</span>
+  return <span>{data?.status ?? (getRadarUpgradeRequirement(error) ? 'upgrade' : 'pending')}</span>
+}
+
+it('fetches for real once the agent turns out to advertise the feature', async () => {
+  await render(<Environment />)
+  expect(element.textContent).toBe('upgrade')
+  expect(asked('/environment')).toBe(false)
+
+  await act(async () => { client.setQueryData(['capabilities'], { features: { podEnvironment: true } }) })
+  await settle()
+  await settle()
+  expect(asked('/environment')).toBe(true)
+  expect(element.textContent).toBe('data')
+})
+
+it('turns an unsupported policy answer into not installed once discovery shows no policy engine', async () => {
+  await render(<Policy />)
+  // No upgrade note yet: discovery may still withdraw it.
+  expect(element.textContent).toBe('loading')
+
+  await act(async () => { client.setQueryData(['api-resources'], [{ group: '', name: 'pods' }]) })
+  await settle()
+  expect(element.textContent).toBe('not_installed')
+  expect(asked('/policy/resource/')).toBe(false)
+})
+
+it('keeps the upgrade note when discovery shows an OpenReports policy engine', async () => {
+  client.setQueryData(['api-resources'], [{ group: 'openreports.io', name: 'reports' }])
+  await render(<Policy />)
+  expect(element.textContent).toBe('upgrade')
+})
+
+it('shows the upgrade note when discovery fails', async () => {
+  const answer = vi.mocked(fetch).getMockImplementation()!
+  vi.mocked(fetch).mockImplementation((input, init) =>
+    String(input).endsWith('/api-resources')
+      ? Promise.resolve(Response.json({ error: 'discovery down' }, { status: 500 }))
+      : answer(input, init),
+  )
+  await render(<Policy />)
+  await settle()
+  expect(element.textContent).toBe('upgrade')
+})
+
+function PoolDetail() {
+  const { data, error } = useCapacityPoolDetail('default')
+  if (data) return <span>data</span>
+  if (isNotFoundError(error)) return <span>pool not found</span>
+  return <span>{getRadarUpgradeRequirement(error) ? 'upgrade' : 'pending'}</span>
+}
+
+it('never asks an old Radar for a capacity deep link, and does not call the pool missing', async () => {
+  await render(<PoolDetail />)
+  expect(element.textContent).toBe('upgrade')
+  expect(asked('/capacity/')).toBe(false)
+})
+
+it("reads the router's 404 on a capacity deep link as unsupported when the version is unknown", async () => {
+  host.radarVersion = undefined
+  chiRoutes = ['/capacity/pools/']
+  await render(<PoolDetail />)
+  expect(element.textContent).toBe('upgrade')
+  expect(requested.filter((url) => url.includes('/capacity/pools/'))).toHaveLength(1)
+})
+
+it("prefers the agent's own version over a stale host version", async () => {
+  await render(<PoolDetail />)
+  expect(element.textContent).toBe('upgrade')
+
+  await act(async () => { client.setQueryData(['version-check', getApiBase()], { currentVersion: 'v1.12.0' }) })
+  await settle()
+  await settle()
+  expect(asked('/capacity/pools/default')).toBe(true)
+  expect(element.textContent).toBe('data')
+})
+
+const probe: { drainPlan?: ReturnType<typeof useDrainPlan> } = {}
+function DrainPlanProbe() {
+  const drainPlan = useDrainPlan()
+  useEffect(() => { probe.drainPlan = drainPlan })
+  return null
+}
+
+it('never asks a Radar older than v1.14 for a drain plan', async () => {
+  host.radarVersion = 'v1.13.1'
+  await render(<DrainPlanProbe />)
+  const error = await probe.drainPlan!.mutateAsync({ name: 'worker-1', options: { deleteEmptyDirData: false, force: false } })
+    .catch((e: unknown) => e)
+  expect(isRadarFeatureUnsupported(error, 'drainPlan')).toBe(true)
+  expect(asked('/drain-plan')).toBe(false)
+})
+
+it("reads the router's 404 on a drain plan as unsupported, and a handler 404 as an error", async () => {
+  host.radarVersion = undefined
+  chiRoutes = ['/nodes/worker-1/drain-plan']
+  await render(<DrainPlanProbe />)
+  const options = { deleteEmptyDirData: false, force: false }
+  const unsupported = await probe.drainPlan!.mutateAsync({ name: 'worker-1', options }).catch((e: unknown) => e)
+  expect(isRadarFeatureUnsupported(unsupported, 'drainPlan')).toBe(true)
+
+  vi.mocked(fetch).mockImplementationOnce(() =>
+    Promise.resolve(Response.json({ error: 'nodes "worker-2" not found' }, { status: 404 })),
+  )
+  const missing = await probe.drainPlan!.mutateAsync({ name: 'worker-2', options }).catch((e: unknown) => e)
+  expect(missing).toBeInstanceOf(ApiError)
+  expect(isRadarFeatureUnsupported(missing)).toBe(false)
+})
+
+function Applications() {
+  const { data, error } = useApplications([])
+  return <span>{data ? 'data' : getRadarUpgradeRequirement(error) ? 'upgrade' : 'pending'}</span>
+}
+
+it('never asks a Radar older than v1.8 for applications', async () => {
+  await render(<Applications />)
+  expect(element.textContent).toBe('upgrade')
+  expect(asked('/applications')).toBe(false)
+})
+
+function History() {
+  const { data, error } = useWorkloadHistory('deployments', 'shop', 'web', 'apps')
+  return <span>{data ? 'data' : isRadarFeatureUnsupported(error, 'workloadHistory') ? 'fallback' : 'pending'}</span>
+}
+
+it('never asks a Radar whose capabilities omit workload history', async () => {
+  client.setQueryData(['capabilities'], { features: { policyResource: true } })
+  await render(<History />)
+  expect(element.textContent).toBe('fallback')
+  expect(asked('/history')).toBe(false)
+})
+
+it("reads the router's 404 on workload history as unsupported before capabilities answer", async () => {
+  host.radarVersion = undefined
+  chiRoutes = ['/workloads/deployments/shop/web/history']
+  await render(<History />)
+  expect(element.textContent).toBe('fallback')
+  expect(requested.filter((url) => url.includes('/history'))).toHaveLength(1)
+})
+
+it('asks again once capabilities confirm workload history after a probe hit an older Radar', async () => {
+  host.radarVersion = undefined
+  chiRoutes = ['/workloads/deployments/shop/web/history']
+  await render(<History />)
+  expect(element.textContent).toBe('fallback')
+
+  chiRoutes = []
+  await act(async () => { client.setQueryData(['capabilities'], { features: { workloadHistory: true } }) })
+  await settle()
+  await settle()
+  expect(requested.filter((url) => url.includes('/history'))).toHaveLength(2)
+})

package/src/api/radarFeatures.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it, vi } from 'vitest'
+import { getRadarUpgradeRequirement } from '@skyhook-io/k8s-ui'
+import { ApiError } from './client'
+import {
+  RADAR_FEATURES,
+  RadarFeatureUnsupportedError,
+  guardRadarFeature,
+  isRadarFeatureUnsupported,
+  radarFeatureSupport,
+  radarSpecSupport,
+  type RadarFeatureSpec,
+  shouldRetryRadarQuery,
+} from './radarFeatures'
+
+describe('radarFeatureSupport', () => {
+  it('trusts the advertised flag over the version', () => {
+    expect(radarFeatureSupport('policyResource', { features: { policyResource: true } }, 'v1.7.2')).toBe('supported')
+    expect(radarFeatureSupport('policyResource', { features: { policyResource: true } }, undefined)).toBe('supported')
+  })
+
+  it('gates a legacy agent that predates the flag by its release version', () => {
+    expect(radarFeatureSupport('resourceIssues', undefined, 'v1.7.2')).toBe('unsupported')
+    expect(radarFeatureSupport('resourceIssues', undefined, 'v1.8.0')).toBe('supported')
+    expect(radarFeatureSupport('podEnvironment', { features: {} }, '1.8.7')).toBe('unsupported')
+    expect(radarFeatureSupport('podEnvironment', { features: {} }, '1.9.0')).toBe('supported')
+    // v1.10 advertised a features block, just not this flag.
+    expect(radarFeatureSupport('policyResource', { features: { yamlReview: true } }, 'v1.9.2')).toBe('unsupported')
+    expect(radarFeatureSupport('policyResource', { features: { yamlReview: true } }, 'v1.12.0')).toBe('supported')
+  })
+
+  it('never gates on a version it cannot place', () => {
+    for (const version of [undefined, '', 'dev', 'unknown', 'v1.7.2-dirty', 'v1.7.2-3-gdeadbee', 'v1.10.0-rc.1', 'v1.7']) {
+      expect(radarFeatureSupport('policyResource', undefined, version)).toBe('unknown')
+    }
+  })
+
+  it('gates features without a flag on version alone', () => {
+    expect(radarFeatureSupport('drainPlan', { features: { yamlReview: true } }, 'v1.13.1')).toBe('unsupported')
+    expect(radarFeatureSupport('drainPlan', undefined, 'v1.14.0')).toBe('supported')
+    expect(radarFeatureSupport('capacity', undefined, 'dev')).toBe('unknown')
+    expect(radarFeatureSupport('applications', undefined, 'v1.7.6')).toBe('unsupported')
+    expect(radarFeatureSupport('applications', undefined, 'v1.7.7')).toBe('supported')
+  })
+
+  it('keeps the unflagged entries to those that predate the first flag', () => {
+    // radarSpecSupport treats them as served by any Radar advertising
+    // resourceIssues; a new entry must ship its own flag instead.
+    const unflagged = Object.entries(RADAR_FEATURES).filter(([, spec]) => !('flag' in spec)).map(([name]) => name)
+    expect(unflagged.sort()).toEqual(['applications', 'capacity', 'drainPlan', 'upgradeReadiness'])
+  })
+
+  it('lifts a stale host version for unflagged features once any table flag is advertised', () => {
+    expect(radarFeatureSupport('drainPlan', { features: { resourceIssues: true } }, 'v1.7.2')).toBe('supported')
+    expect(radarFeatureSupport('capacity', { features: { resourceIssues: true } }, 'v1.7.2')).toBe('supported')
+    expect(radarFeatureSupport('upgradeReadiness', { features: { resourceIssues: true } }, undefined)).toBe('supported')
+  })
+})
+
+describe('workload history, whose flag shipped with its endpoint', () => {
+  it('trusts a loaded capabilities answer, and probes before it arrives', () => {
+    expect(radarFeatureSupport('workloadHistory', { features: { workloadHistory: true } }, undefined)).toBe('supported')
+    expect(radarFeatureSupport('workloadHistory', { features: { policyResource: true } }, 'v1.15.0')).toBe('unsupported')
+    expect(radarFeatureSupport('workloadHistory', { features: {} }, 'dev')).toBe('unsupported')
+    expect(radarFeatureSupport('workloadHistory', undefined, 'v1.15.0')).toBe('unknown')
+  })
+})
+
+describe('radarSpecSupport for a feature whose flag shipped with its endpoint', () => {
+  const driftAlerts: RadarFeatureSpec = { label: 'Drift alerts', flag: 'resourceIssues', flagShippedWithEndpoint: true }
+
+  it('reads a loaded answer without the flag as too old, whatever the version', () => {
+    expect(radarSpecSupport(driftAlerts, { features: {} }, 'dev')).toBe('unsupported')
+    expect(radarSpecSupport(driftAlerts, {}, 'v1.7.2')).toBe('unsupported')
+    expect(radarSpecSupport(driftAlerts, { features: { resourceIssues: true } }, 'v1.7.2')).toBe('supported')
+  })
+
+  it('waits for /api/capabilities before deciding, and never version-gates without a first release', () => {
+    expect(radarSpecSupport(driftAlerts, undefined, 'v1.7.2')).toBe('unknown')
+  })
+})
+
+describe('guardRadarFeature', () => {
+  const versions = { currentVersion: 'v1.7.2', latestVersion: 'v1.15.0' }
+
+  it('never asks a Radar known to be too old', async () => {
+    const request = vi.fn(() => Promise.resolve('data'))
+    await expect(guardRadarFeature('policyResource', 'unsupported', versions, request))
+      .rejects.toBeInstanceOf(RadarFeatureUnsupportedError)
+    expect(request).not.toHaveBeenCalled()
+  })
+
+  it("reads the router's unknown-route 404 as unsupported", async () => {
+    const error = await guardRadarFeature('policyResource', 'unknown', versions, () =>
+      Promise.reject(new ApiError('HTTP 404 (Not Found)', 404, {}, { unknownRoute: true })),
+    ).catch((e: unknown) => e)
+    expect(isRadarFeatureUnsupported(error, 'policyResource')).toBe(true)
+    expect(getRadarUpgradeRequirement(error)).toEqual({
+      feature: 'Policy results',
+      minimumVersion: 'v1.10.0',
+      currentVersion: 'v1.7.2',
+      latestVersion: 'v1.15.0',
+    })
+  })
+
+  it('passes every other failure through untouched', async () => {
+    const handler404 = new ApiError('pods "web" not found', 404, { error: 'pods "web" not found' })
+    await expect(guardRadarFeature('policyResource', 'unknown', versions, () => Promise.reject(handler404)))
+      .rejects.toBe(handler404)
+    const hubNotFound = new ApiError('HTTP 404 (Not Found)', 404)
+    await expect(guardRadarFeature('policyResource', 'supported', versions, () => Promise.reject(hubNotFound)))
+      .rejects.toBe(hubNotFound)
+    expect(getRadarUpgradeRequirement(hubNotFound)).toBeNull()
+  })
+
+  it("keeps the router's 404 an error on a Radar known to serve the feature", async () => {
+    const routing = new ApiError('HTTP 404 (Not Found)', 404, {}, { unknownRoute: true })
+    const error = await guardRadarFeature('policyResource', 'supported', versions, () => Promise.reject(routing))
+      .catch((e: unknown) => e)
+    expect(error).toBe(routing)
+    expect(getRadarUpgradeRequirement(error)).toBeNull()
+  })
+
+  it('returns the data when the request succeeds', async () => {
+    await expect(guardRadarFeature('policyResource', 'unknown', {}, () => Promise.resolve(42))).resolves.toBe(42)
+  })
+})
+
+describe('shouldRetryRadarQuery', () => {
+  it('does not retry an unsupported feature or a settled client error', () => {
+    expect(shouldRetryRadarQuery(0, new RadarFeatureUnsupportedError('resourceIssues', {}))).toBe(false)
+    for (const status of [400, 401, 403, 404, 409]) {
+      expect(shouldRetryRadarQuery(0, new ApiError('x', status))).toBe(false)
+    }
+  })
+
+  it('retries timeouts, rate limits, server errors and network failures once', () => {
+    for (const error of [new ApiError('x', 408), new ApiError('x', 429), new ApiError('x', 503), new TypeError('Failed to fetch')]) {
+      expect(shouldRetryRadarQuery(0, error)).toBe(true)
+      expect(shouldRetryRadarQuery(1, error)).toBe(false)
+    }
+  })
+})

package/src/api/radarFeatures.ts

@@ -0,0 +1,148 @@
+import type { FeatureCapabilities, RadarUpgradeRequirement } from '@skyhook-io/k8s-ui'
+import { compareVersions } from '../utils/version'
+
+// Radar Hub embeds the newest @skyhook-io/radar-app against whatever Radar is
+// installed in each cluster, so these endpoints can be missing on a connected
+// Radar. A Radar that advertises the feature's `features` flag is always
+// trusted; otherwise the release that first served the endpoint decides.
+//
+// Adding an optional endpoint: advertise a flag for it in
+// FeatureCapabilities (internal/k8s/capabilities.go) in the same change, add
+// an entry here with that flag and `flagShippedWithEndpoint: true`, and guard
+// its hook with useRadarFeature. TestFeatureFlagsHaveFrontendGates keeps the
+// two lists in step. `minimumVersion` can wait for the release to be cut:
+// until then the note asks for the latest Radar.
+export interface RadarFeatureSpec {
+  /** Plural noun phrase; the upgrade note reads "<label> need Radar vX or newer." */
+  label: string
+  /** First release that served the endpoint, once known. */
+  minimumVersion?: string
+  flag?: keyof FeatureCapabilities
+  /**
+   * The flag shipped in the same release as the endpoint, so a Radar whose
+   * capabilities omit it is too old regardless of its version. False for the
+   * entries below, whose flags were added after their endpoints.
+   */
+  flagShippedWithEndpoint?: boolean
+}
+
+export const RADAR_FEATURES = {
+  resourceIssues: { label: 'Operational issues', minimumVersion: 'v1.8.0', flag: 'resourceIssues' },
+  podEnvironment: { label: 'Values from ConfigMaps and Secrets', minimumVersion: 'v1.9.0', flag: 'podEnvironment' },
+  policyResource: { label: 'Policy results', minimumVersion: 'v1.10.0', flag: 'policyResource' },
+  capacity: { label: 'Capacity views', minimumVersion: 'v1.9.0' },
+  upgradeReadiness: { label: 'Upgrade impact reports', minimumVersion: 'v1.9.0' },
+  drainPlan: { label: 'Drain plans', minimumVersion: 'v1.14.0' },
+  applications: { label: 'Applications', minimumVersion: 'v1.7.7' },
+  workloadHistory: { label: 'Workload history', flag: 'workloadHistory', flagShippedWithEndpoint: true },
+} as const satisfies Record<string, RadarFeatureSpec>
+
+export type RadarFeature = keyof typeof RADAR_FEATURES
+
+export type RadarFeatureSupport = 'supported' | 'unsupported' | 'unknown'
+
+export interface RadarVersions {
+  currentVersion?: string
+  latestVersion?: string
+}
+
+// Only a plain release can be placed against a minimum. Dev, dirty and
+// pre-release builds stay unknown so a custom build is never wrongly gated.
+const RELEASE_VERSION = /^v?\d+\.\d+\.\d+$/
+
+/**
+ * `capabilities` is the /api/capabilities answer, or undefined while it is
+ * still loading; only a loaded answer can prove a flag is absent.
+ */
+export function radarSpecSupport(
+  spec: RadarFeatureSpec,
+  capabilities: { features?: FeatureCapabilities } | undefined,
+  currentVersion: string | undefined,
+): RadarFeatureSupport {
+  if (spec.flag && capabilities?.features?.[spec.flag] === true) return 'supported'
+  // Unflagged entries all predate the first flag added for this table, so a
+  // Radar that advertises it serves them, whatever version the host reported.
+  if (!spec.flag && capabilities?.features?.resourceIssues === true) return 'supported'
+  if (spec.flag && spec.flagShippedWithEndpoint && capabilities) return 'unsupported'
+  const version = currentVersion?.trim()
+  if (!spec.minimumVersion || !version || !RELEASE_VERSION.test(version)) return 'unknown'
+  const order = compareVersions(version, spec.minimumVersion)
+  if (order === null) return 'unknown'
+  return order < 0 ? 'unsupported' : 'supported'
+}
+
+export function radarFeatureSupport(
+  feature: RadarFeature,
+  capabilities: { features?: FeatureCapabilities } | undefined,
+  currentVersion: string | undefined,
+): RadarFeatureSupport {
+  return radarSpecSupport(RADAR_FEATURES[feature], capabilities, currentVersion)
+}
+
+export function radarUpgradeRequirement(feature: RadarFeature, versions: RadarVersions): RadarUpgradeRequirement {
+  const spec: RadarFeatureSpec = RADAR_FEATURES[feature]
+  return {
+    feature: spec.label,
+    ...(spec.minimumVersion ? { minimumVersion: spec.minimumVersion } : {}),
+    ...(versions.currentVersion ? { currentVersion: versions.currentVersion } : {}),
+    ...(versions.latestVersion ? { latestVersion: versions.latestVersion } : {}),
+  }
+}
+
+/**
+ * The connected Radar predates `feature`. Carries `radarUpgrade` so k8s-ui
+ * components can render the upgrade note without importing this class.
+ */
+export class RadarFeatureUnsupportedError extends Error {
+  readonly feature: RadarFeature
+  readonly radarUpgrade: RadarUpgradeRequirement
+
+  constructor(feature: RadarFeature, versions: RadarVersions) {
+    const requirement = radarUpgradeRequirement(feature, versions)
+    super(`${requirement.feature} need a newer Radar`)
+    this.name = 'RadarFeatureUnsupportedError'
+    this.feature = feature
+    this.radarUpgrade = requirement
+  }
+}
+
+export function isRadarFeatureUnsupported(error: unknown, feature?: RadarFeature): boolean {
+  return error instanceof RadarFeatureUnsupportedError && (feature === undefined || error.feature === feature)
+}
+
+/**
+ * Runs `request` unless the connected Radar is known to predate `feature`.
+ * When its version is unknown, chi's unknown-route 404 (ApiError.unknownRoute)
+ * is read as the same answer; on a Radar known to serve the feature that 404
+ * is a routing failure and stays an error.
+ */
+export async function guardRadarFeature<T>(
+  feature: RadarFeature,
+  support: RadarFeatureSupport,
+  versions: RadarVersions,
+  request: () => Promise<T>,
+): Promise<T> {
+  if (support === 'unsupported') throw new RadarFeatureUnsupportedError(feature, versions)
+  try {
+    return await request()
+  } catch (error) {
+    if (support === 'unknown' && (error as { unknownRoute?: unknown } | null)?.unknownRoute === true) {
+      throw new RadarFeatureUnsupportedError(feature, versions)
+    }
+    throw error
+  }
+}
+
+/**
+ * Query retry policy: an unsupported feature or a client error (other than a
+ * timeout or rate limit) gives the same answer on every attempt, so retrying
+ * only repeats the request against the cluster.
+ */
+export function shouldRetryRadarQuery(failureCount: number, error: unknown): boolean {
+  if (error instanceof RadarFeatureUnsupportedError) return false
+  const status = (error as { status?: unknown } | null)?.status
+  if (typeof status === 'number' && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+    return false
+  }
+  return failureCount < 1
+}

package/src/api/timelineSource.test.ts

@@ -457,11 +457,7 @@ describe('retained ring fetch (the OSS-identical accumulate model)', () => {
     const flags = new Set<string>()
     const cached = ring([ev({ id: 'e-stale' })])
     mockApiFetch
-      .mockResolvedValueOnce({
-        ok: false,
-        status: 400,
-        json: () => Promise.resolve({ error: 'invalid since cursor' }),
-      } as unknown as Response)
+      .mockResolvedValueOnce(Response.json({ error: 'invalid since cursor' }, { status: 400 }))
       .mockResolvedValueOnce(streamResponse([line(ev({ id: 'e-fresh' })), end({ cursor: '300' })]))
     const out = await runRetainedRingFetch({ ringKey: 'k', cached, forceResync: flags, capMs: CAP, now: NOW })
     expect(out.events.map((e) => e.id)).toEqual(['e-fresh'])
@@ -647,11 +643,7 @@ describe('retained ring fetch (the OSS-identical accumulate model)', () => {
   it('a non-400 delta failure propagates and keeps the cursor for the next poll', async () => {
     const flags = new Set<string>()
     const cached = ring([ev({ id: 'e1' })])
-    mockApiFetch.mockResolvedValueOnce({
-      ok: false,
-      json: () => Promise.resolve({ error: 'boom' }),
-      status: 503,
-    } as unknown as Response)
+    mockApiFetch.mockResolvedValueOnce(Response.json({ error: 'boom' }, { status: 503 }))
     await expect(
       runRetainedRingFetch({ ringKey: 'k', cached, forceResync: flags, capMs: CAP, now: NOW }),
     ).rejects.toBeInstanceOf(ApiError)

package/src/api/timelineSource.ts

@@ -17,6 +17,7 @@ import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { LIVE_TICK_MS } from '@skyhook-io/k8s-ui'
 import { apiFetch, mergeDeltaEvents, ApiError, type UseChangesOptions } from './client'
 import { apiUrl, getApiBase } from './config'
+import { readErrorBody } from './httpErrors'
 import type { TimelineEvent, TimeRange } from '../types'
 
 // The query the wrappers pass. Superset of the local store's params so most
@@ -321,7 +322,7 @@ function dedupeById(events: TimelineEvent[]): TimelineEvent[] {
 async function fetchRetainedStream(path: string, signal?: AbortSignal): Promise<RetainedWindowResult> {
   const res = await apiFetch(apiUrl(path), signal ? { signal } : undefined)
   if (!res.ok) {
-    const errorData = await res.json().catch(() => ({ error: `HTTP ${res.status}` }))
+    const errorData = await readErrorBody(res)
     throw new ApiError(errorData.error || `HTTP ${res.status}`, res.status, errorData)
   }
   if (!res.body) {
@@ -871,7 +872,7 @@ function normalizeCoverage(
 async function fetchRetainedOverview(range: TimelineRange): Promise<TimelineOverviewResult> {
   const res = await apiFetch(apiUrl(`/timeline/overview?from=${Math.round(range.from)}&to=${Math.round(range.to)}`))
   if (!res.ok) {
-    const errorData = await res.json().catch(() => ({ error: `HTTP ${res.status}` }))
+    const errorData = await readErrorBody(res)
     throw new ApiError(errorData.error || `HTTP ${res.status}`, res.status, errorData)
   }
   const body: unknown = await res.json()

package/src/api/traffic.ts

@@ -1,6 +1,7 @@
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
 import type { TrafficSourcesResponse, TrafficFlowsResponse } from '../types'
 import { apiUrl, getAuthHeaders, getCredentialsMode } from './config'
+import { readErrorBody } from './httpErrors'
 
 async function fetchJSON<T>(path: string): Promise<T> {
   const response = await fetch(apiUrl(path), {
@@ -8,7 +9,7 @@ async function fetchJSON<T>(path: string): Promise<T> {
     headers: getAuthHeaders(),
   })
   if (!response.ok) {
-    const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+    const error = await readErrorBody(response)
     throw new Error(error.error || `HTTP ${response.status}`)
   }
   return response.json()
@@ -82,7 +83,7 @@ export function useSetTrafficSource() {
         body: JSON.stringify({ source }),
       })
       if (!response.ok) {
-        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+        const error = await readErrorBody(response)
         throw new Error(error.error || `HTTP ${response.status}`)
       }
       return response.json()
@@ -125,7 +126,7 @@ export function useTrafficConnect() {
         headers: { 'Content-Type': 'application/json', ...getAuthHeaders() },
       })
       if (!response.ok) {
-        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+        const error = await readErrorBody(response)
         throw new Error(error.error || `HTTP ${response.status}`)
       }
       return response.json()

package/src/components/CloudFunnelButton.tsx

@@ -291,7 +291,7 @@ export function CloudFunnelButton() {
         content={
           <>
             <span className="block font-semibold">Meet Radar Cloud</span>
-            See all your clusters in one place, share with your team, and get alerts and automatic AI investigations in Slack.
+            See all your clusters in one place, share with your team, and get alerts and automatic AI investigations.
           </>
         }
         delay={100}
@@ -665,7 +665,7 @@ function PitchBody({ lane, freeTier }: { lane: 'driver' | 'wizard'; freeTier?: s
   // skimmable. Alerts and investigations lead: they are the two things the
   // OSS binary cannot do at all. Team, fleet and history follow.
   const highlights = [
-    { icon: Bell, lead: 'Alerts', rest: ' in Slack when something breaks. Once, not for every crash-looping pod.' },
+    { icon: Bell, lead: 'Alerts', rest: ' to Slack or any webhook. One per failure, not per crash-looping pod.' },
     { icon: Sparkles, lead: 'AI investigations', rest: ': root cause with evidence, automatic on alerts or on demand' },
     { icon: Users, lead: 'Your team', rest: ': share any view with just a link, scoped by your existing RBAC' },
     { icon: Globe, lead: 'Every cluster', rest: ': the whole fleet in one view and one MCP endpoint' },
@@ -678,7 +678,7 @@ function PitchBody({ lane, freeTier }: { lane: 'driver' | 'wizard'; freeTier?: s
         Close the laptop. Radar keeps watching.
       </h3>
       <p className="text-[14px] leading-relaxed text-theme-text-secondary mb-1.5">
-        Radar Cloud is the hosted side of Radar: Slack alerts, AI root cause and every cluster in one place, for
+        Radar Cloud is the hosted side of Radar: alerts, AI root cause and every cluster in one place, for
         you and your team.
       </p>
       <p className="text-[14px] leading-relaxed text-theme-text-secondary mb-6">
@@ -724,9 +724,10 @@ function PitchBody({ lane, freeTier }: { lane: 'driver' | 'wizard'; freeTier?: s
           <section>
             <h4 className="text-[12.5px] font-semibold text-theme-text-primary mb-0.5">Investigations</h4>
             <p className="text-[12px] leading-relaxed text-theme-text-secondary">
-              In our public benchmark, Radar's agent found the root cause 3× faster than the same model on plain
-              kubectl, and 2× faster than the other AI SRE tools we tested. Run it automatically on every alert, or
-              on demand from any issue, with no CLI or API key.{' '}
+              In our public benchmark, the same agent diagnosed faults 3× faster on average with Radar than with
+              plain kubectl, and Radar answered 1.6–3.6× faster on average than the other AI SRE tools we tested.
+              Run it automatically on the alert rules you choose, or on demand from any issue, with no CLI or API
+              key.{' '}
               <a href={BENCHMARK_URL} target="_blank" rel="noopener noreferrer" className="whitespace-nowrap text-theme-text-secondary underline underline-offset-2 hover:text-theme-text-primary">
                 See the benchmarks →
               </a>
@@ -735,9 +736,8 @@ function PitchBody({ lane, freeTier }: { lane: 'driver' | 'wizard'; freeTier?: s
           <section>
             <h4 className="text-[12.5px] font-semibold text-theme-text-primary mb-0.5">What it costs</h4>
             <p className="text-[12px] leading-relaxed text-theme-text-secondary">
-              Radar Cloud is {freeLine}, with 100 investigations a month included, then $1 per investigation.
-              Paid plans add more clusters, more included investigations, and enterprise features like SSO, SCIM
-              and audit logs.{' '}
+              Radar Cloud is {freeLine}, including 100 investigations a month. Paid plans add investigations for
+              every cluster, with optional $1 overage, plus enterprise features like SSO, SCIM and audit logs.{' '}
               <a href={PRICING_URL} target="_blank" rel="noopener noreferrer" className="whitespace-nowrap text-theme-text-secondary underline underline-offset-2 hover:text-theme-text-primary">
                 See pricing →
               </a>