@skyhook-io/radar-app 1.16.0 → 1.16.2

package/src/components/dock/LocalTerminalTab.tsx

@@ -1,22 +1,97 @@
-import { LocalTerminalTab as SharedLocalTerminalTab } from '@skyhook-io/k8s-ui'
+import { useCallback, useRef, useState } from 'react'
+import { AlertTriangle } from 'lucide-react'
+import { useQueryClient } from '@tanstack/react-query'
+import { ClusterName, LocalTerminalTab as SharedLocalTerminalTab, Tooltip, parseContextName, useDock, type LocalTerminalSessionInfo } from '@skyhook-io/k8s-ui'
 import { getWsUrl } from '../../api/config'
+import { useConnection } from '../../context/ConnectionContext'
+import { useOpenLocalTerminal } from './DockContext'
 
 interface LocalTerminalTabProps {
+  tabId: string
+  title: string
+  intendedContext?: string
   isActive?: boolean
   initialCommand?: string
 }
 
-export function LocalTerminalTab({ isActive, initialCommand }: LocalTerminalTabProps) {
-  const createSession = () =>
-    Promise.resolve({
-      wsUrl: getWsUrl('/local-terminal'),
-    })
+export function LocalTerminalTab({ tabId, title, intendedContext, isActive, initialCommand }: LocalTerminalTabProps) {
+  const { connection } = useConnection()
+  const queryClient = useQueryClient()
+  const { setTabTitle } = useDock()
+  const openLocalTerminal = useOpenLocalTerminal()
+  const baseTitle = useRef(title)
+  const [sessionInfo, setSessionInfo] = useState<LocalTerminalSessionInfo | null>(null)
+  const handleSessionInfo = useCallback((info: LocalTerminalSessionInfo | null) => {
+    if (!info) return
+    setSessionInfo(info)
+    const suffix = info.kubeconfigIsolated ? parseContextName(info.context).clusterName : 'context not confirmed'
+    setTabTitle(tabId, `${baseTitle.current} · ${suffix}`, info.kubeconfigIsolated ? info.context : undefined)
+  }, [tabId, setTabTitle])
+  const unconfirmed = sessionInfo !== null && !sessionInfo.kubeconfigIsolated
+  const contextNotice = unconfirmed
+    ? `Requested for ${intendedContext || 'no active context'}; kubeconfig not confirmed.`
+    : `This terminal is for ${intendedContext || 'no active context'}.`
+  const context = sessionInfo?.kubeconfigIsolated ? sessionInfo.context : null
+  const mismatched = intendedContext !== undefined && !!connection.context && intendedContext !== connection.context
+  const createSession = async () => {
+    if (intendedContext === undefined) throw new Error('No context selected. Open a new terminal for the selected context.')
+    return { wsUrl: getWsUrl(`/local-terminal?expectedContext=${encodeURIComponent(intendedContext)}`) }
+  }
 
   return (
     <SharedLocalTerminalTab
       isActive={isActive}
       createSession={createSession}
       initialCommand={initialCommand}
+      canConnect={() => intendedContext !== undefined && connection.context === intendedContext && (!!intendedContext || connection.state === 'disconnected')}
+      onConnectionError={() => { void queryClient.invalidateQueries({ queryKey: ['connection-status'] }) }}
+      onSessionInfo={handleSessionInfo}
+      toolbarExtra={
+        <div className="flex items-center gap-2 min-w-0">
+          {context ? (
+            <Tooltip content={<>Radar supplied a temporary kubeconfig for <strong>{context}</strong>. Shell settings and commands can override it.</>} wrapperClassName="min-w-0">
+              <span className="flex items-center gap-1 min-w-0 text-xs text-theme-text-secondary">
+                <span className="shrink-0">Opened for:</span>
+                <ClusterName name={context} noBadge noTooltip />
+              </span>
+            </Tooltip>
+          ) : !sessionInfo && intendedContext ? (
+            <Tooltip content={<>A new shell has been requested for <strong>{intendedContext}</strong>.</>} wrapperClassName="min-w-0">
+              <span className="flex items-center gap-1 min-w-0 text-xs text-theme-text-secondary">
+                <span className="shrink-0">Requested:</span>
+                <ClusterName name={intendedContext} noBadge noTooltip />
+              </span>
+            </Tooltip>
+          ) : intendedContext === undefined ? (
+            <span className="text-xs text-warning-text whitespace-nowrap">No context selected</span>
+          ) : (
+            <Tooltip content={sessionInfo
+              ? 'Radar could not create a temporary kubeconfig. This shell uses the original or inherited kubeconfig.'
+              : 'The server has not reported this terminal’s kubeconfig.'}>
+              <span className="text-xs text-warning-text">Context not confirmed</span>
+            </Tooltip>
+          )}
+          {mismatched && (
+            <Tooltip content={<>Radar is showing <strong>{connection.context}</strong>. {contextNotice} Switch back to reconnect, or open a new terminal.</>} wrapperClassName="shrink-0">
+              <span
+                role="status"
+                aria-label={`Radar is showing ${connection.context}. ${contextNotice}`}
+                className="flex items-center gap-1 text-xs text-warning-text whitespace-nowrap"
+              >
+                <AlertTriangle className="w-3 h-3" />
+                {unconfirmed ? 'Requested context differs' : 'Different context'}
+              </span>
+            </Tooltip>
+          )}
+          {connection.context && (mismatched || intendedContext === undefined) && (
+            <Tooltip content={<>Open a new terminal for <strong>{connection.context}</strong>.</>} wrapperClassName="shrink-0">
+              <button className="btn-brand px-2 py-0.5 text-xs whitespace-nowrap" aria-label={`New terminal for ${connection.context}`} onClick={() => openLocalTerminal()}>
+                New terminal
+              </button>
+            </Tooltip>
+          )}
+        </div>
+      }
     />
   )
 }

package/src/components/logs/LogsViewer.tsx

@@ -43,7 +43,10 @@ export function LogsViewer({ namespace, podName, containers, initialContainer, a
       fetchLogs={fetchLogs}
       createStream={makeStream}
       overrideDownload={desktopDownload}
+      // Light logs on a dark app are never wanted: dark theme pins the palette,
+      // light theme only sets where it starts and leaves the toggle available.
       forceDark={theme === 'dark' ? true : undefined}
+      defaultDark={false}
       autoStream={autoStream}
     />
   )

package/src/components/logs/WorkloadLogsViewer.tsx

@@ -42,7 +42,10 @@ export function WorkloadLogsViewer({ kind, namespace, name, autoStream = true, s
       fetchAll={fetchAll}
       createStream={snapshotOnly ? undefined : makeStream}
       overrideDownload={desktopDownload}
+      // Light logs on a dark app are never wanted: dark theme pins the palette,
+      // light theme only sets where it starts and leaves the toggle available.
       forceDark={theme === 'dark' ? true : undefined}
+      defaultDark={false}
       autoStream={autoStream}
     />
   )

package/src/components/settings/LocalConfigurationDetails.tsx

@@ -73,6 +73,13 @@ export function PreviousIntegrationSettingsNotice({ profiles, onNavigate, onDism
 
 export const integrationSettingsByClusterId = 'integration-settings-by-cluster'
 
+// Switching to auto-discovery keeps an empty record, so a record alone doesn't
+// mean anything is saved. An invalid record disables the integration instead.
+function integrationStatus(use: StoredConnection) {
+  if (use.error || use.mode !== 'auto' || use.url || use.secretSet || use.clusterId) return 'saved'
+  return use.integration === 'cost' ? 'Automatic' : 'auto-discovery'
+}
+
 export function LocalConfigurationDetails({ onNavigate }: { onNavigate: (section: SettingsSectionId) => void }) {
   return (
     <div className="mt-5 border-t border-theme-border pt-4">
@@ -168,7 +175,7 @@ export function SavedClusterConnections({
       .then(async (response) => {
         const data = (await response.json().catch(() => ({}))) as ConnectionResponse
         if (!response.ok)
-          throw new Error(data.error || 'Could not load saved connections.')
+          throw new Error(data.error || 'Could not load integration settings.')
         if (controller.signal.aborted || getApiBase() !== base) return
         setUses(data.connections)
       })
@@ -215,10 +222,10 @@ export function SavedClusterConnections({
       const data = (await response.json().catch(() => ({}))) as ConnectionResponse
       if (controller.signal.aborted || getApiBase() !== base) return
       if (!response.ok)
-        throw new Error(data.error || 'Could not remove the saved connection.')
+        throw new Error(data.error || 'Could not remove the saved settings.')
       setUses(data.connections)
       setMessage(
-        `Removed the saved ${integrationNames[selected.integration]} connection for ${selected.context}.`,
+        `Removed the saved ${integrationNames[selected.integration]} settings for ${selected.context}.`,
       )
       focusSummary.current = true
       setSelected(null)
@@ -261,12 +268,12 @@ export function SavedClusterConnections({
         </p>
         {loading && (
           <p role="status" className="text-xs text-theme-text-tertiary">
-            Loading saved connections…
+            Loading integration settings…
           </p>
         )}
         {!loading && !error && clusters.size === 0 && (
           <p className="text-xs text-theme-text-tertiary">
-            No saved connections yet.
+            No integration settings saved yet.
           </p>
         )}
         {!loading &&
@@ -300,17 +307,16 @@ export function SavedClusterConnections({
                 </p>
                 {!current && entry.availability === 'removed' && (
                   <p className="text-theme-text-secondary">
-                    This kubeconfig entry is gone, but its connections are still
-                    saved. To reuse one, select the new context and choose “Copy
+                    This kubeconfig entry is gone, but its integration settings
+                    are still saved. To reuse one, select the new context and choose “Copy
                     settings from…” in that integration’s settings.
                   </p>
                 )}
                 {(current ||
                   entries.every((use) => use.availability === 'available')) && (
                   <p className="text-theme-text-secondary">
-                    Saved:{' '}
                     {entries
-                      .map((use) => integrationNames[use.integration])
+                      .map((use) => `${integrationNames[use.integration]}: ${integrationStatus(use)}`)
                       .join(' · ')}
                   </p>
                 )}
@@ -325,7 +331,7 @@ export function SavedClusterConnections({
                           type="button"
                           disabled={busy}
                           className="text-accent-text hover:underline disabled:opacity-50"
-                          aria-label={`Remove saved ${integrationNames[use.integration]} connection for ${use.context}`}
+                          aria-label={`Remove saved ${integrationNames[use.integration]} settings for ${use.context}`}
                           onClick={() => {
                             setSelected(use)
                             setError('')
@@ -353,7 +359,7 @@ export function SavedClusterConnections({
               className="underline"
               onClick={() => setVersion((value) => value + 1)}
             >
-              Reload saved connections
+              Reload integration settings
             </button>
           </p>
         )}
@@ -362,13 +368,13 @@ export function SavedClusterConnections({
         open={!!selected}
         onClose={() => setSelected(null)}
         onConfirm={() => void remove()}
-        title="Remove saved connection?"
+        title="Remove saved settings?"
         message={
           selected
-            ? `Remove the saved ${integrationNames[selected.integration]} connection and credentials for ${selected.context}? Other saved connections are unchanged. Nothing is deleted from Kubernetes or the backend.${selected.availability === 'unavailable' ? ' This entry may still exist in another kubeconfig; removal also affects any CLI or Desktop using that entry.' : ''}`
+            ? `Remove the saved ${integrationNames[selected.integration]} settings and credentials for ${selected.context}? Other saved settings are unchanged. Nothing is deleted from Kubernetes or the backend.${selected.availability === 'unavailable' ? ' This entry may still exist in another kubeconfig; removal also affects any CLI or Desktop using that entry.' : ''}`
             : ''
         }
-        confirmLabel="Remove connection"
+        confirmLabel="Remove settings"
         isLoading={busy}
         confirmDisabled={!!error}
         showWarning={false}
@@ -380,7 +386,7 @@ export function SavedClusterConnections({
             role="alert"
             className="text-sm text-warning-text"
           >
-            {error} Cancel and reload saved connections before trying again.
+            {error} Cancel and reload integration settings before trying again.
           </p>
         )}
       </ConfirmDialog>

package/src/components/settings/LocalConnectionSettings.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useRef, useState, type ReactNode } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useRef, useState, type ReactNode } from 'react'
 import { Badge, Collapse, ConfirmDialog, SelectMenu } from '@skyhook-io/k8s-ui'
 import { ArrowLeft, Info } from 'lucide-react'
 import { Tooltip } from '../ui/Tooltip'
@@ -47,11 +47,13 @@ export interface StoredConnection {
   source: string
   inFileName: string
   availability: 'available' | 'removed' | 'unavailable'
+  mode: string
   url: string
   headerKeys: string[]
   envHeaderKeys: string[]
   secretSet: boolean
   insecureTls: boolean
+  clusterId: string
   error?: string
 }
 export interface IntegrationProfile {
@@ -126,6 +128,11 @@ const automaticAction: Record<IntegrationKind, string> = {
   argocd: 'Use auto-discovery',
   cost: 'Reset to Automatic'
 }
+function sameIdentity(a?: TargetIdentity, b?: TargetIdentity) {
+  return !!a && !!b && a.server === b.server && a.user === b.user &&
+    a.tlsName === b.tlsName && a.trust === b.trust && a.proxy === b.proxy &&
+    !!a.insecureTls === !!b.insecureTls
+}
 const names: Record<IntegrationKind, string> = {
   metrics: 'Metrics',
   argocd: 'Argo CD',
@@ -180,9 +187,18 @@ export function LocalConnectionSettings({
   const confirmationCopy = useRef({ title: '', message: '', label: '' })
   const [confirmBack, setConfirmBack] = useState(false)
   const [accepted, setAccepted] = useState<IntegrationKind[]>([])
-  const acceptedChanges = accepted.filter(
+  // The review page compares against one previous identity, so it can only
+  // approve integrations that were paused from that same identity.
+  const pausedKinds = (Object.keys(snapshot) as IntegrationKind[]).filter(
     (k) => snapshot[k].state === 'target_changed'
   )
+  const reviewKinds = pausedKinds.filter(
+    (k) => k === kind || sameIdentity(snapshot[k].previousIdentity, profile.previousIdentity)
+  )
+  const separateReviewKinds = pausedKinds.filter((k) => !reviewKinds.includes(k))
+  const separateIdentityKnown = !!profile.previousIdentity &&
+    separateReviewKinds.every((k) => !!snapshot[k].previousIdentity)
+  const acceptedChanges = accepted.filter((k) => reviewKinds.includes(k))
   const request = useRef<AbortController | null>(null)
   const catalogRequest = useRef<AbortController | null>(null)
   const heading = useRef<HTMLHeadingElement>(null)
@@ -191,6 +207,14 @@ export function LocalConnectionSettings({
   const editorRegion = useRef<HTMLFieldSetElement>(null)
   const trigger = useRef<HTMLElement | null>(null)
   const mounted = useRef(true)
+  // Focus moves in the commit that mounts a new draft form. Deferring it to a
+  // later frame lets keystrokes typed in between land in a different field.
+  const focusAfterDraft = useRef<(() => void) | null>(null)
+  useLayoutEffect(() => {
+    const focus = focusAfterDraft.current
+    focusAfterDraft.current = null
+    focus?.()
+  })
   const copySources = catalog.filter(c => c.integration === kind && !c.error && c.url && c.binding !== profile.target.binding)
   const removalContext = profile.target.context
   const dirty =
@@ -220,7 +244,7 @@ export function LocalConnectionSettings({
       .then(async (response) => {
         const data = (await response.json().catch(() => ({}))) as ConnectionResponse
         if (!response.ok)
-          throw new Error(data.error || 'Could not load saved connections.')
+          throw new Error(data.error || 'Could not load other clusters’ settings.')
         if (!controller.signal.aborted && getApiBase() === base) {
           setCatalog(data.connections)
           setCatalogError(false)
@@ -519,7 +543,7 @@ export function LocalConnectionSettings({
           setDraftGeneration((generation) => generation + 1)
           setError('')
           // Cost's first control is its source picker, a listbox trigger.
-          requestAnimationFrame(() => region.current?.querySelector<HTMLElement>('input:not(:disabled), button[aria-haspopup="listbox"]:not(:disabled)')?.focus())
+          focusAfterDraft.current = () => region.current?.querySelector<HTMLElement>('input:not(:disabled), button[aria-haspopup="listbox"]:not(:disabled)')?.focus()
         }}
         className="text-xs text-accent-text hover:underline disabled:opacity-50 shrink-0"
       >
@@ -539,7 +563,7 @@ export function LocalConnectionSettings({
     setDraftGeneration(generation => generation + 1)
     setMessage('')
     setError('')
-    requestAnimationFrame(() => editorRegion.current?.querySelector<HTMLInputElement>('input:not(:disabled)')?.focus())
+    focusAfterDraft.current = () => editorRegion.current?.querySelector<HTMLInputElement>('input:not(:disabled)')?.focus()
   }
   const copySource = (source: StoredConnection) => {
     setSelected(source)
@@ -555,7 +579,7 @@ export function LocalConnectionSettings({
     setDraftGeneration(generation => generation + 1)
     setMessage('')
     setError('')
-    requestAnimationFrame(() => editorRegion.current?.querySelector<HTMLInputElement>('input:not(:disabled)')?.focus())
+    focusAfterDraft.current = () => editorRegion.current?.querySelector<HTMLInputElement>('input:not(:disabled)')?.focus()
   }
   const reuseOptions = task === 'main' && profile.state !== 'launch' ? [
     ...(previous ? [{
@@ -836,7 +860,7 @@ export function LocalConnectionSettings({
           ) : null}
         </>
       )}
-      <fieldset ref={editorRegion} className="min-w-0">
+      <fieldset ref={editorRegion} className="min-w-0 empty:hidden">
         {editor &&
           (kind === 'metrics' ? (
             <PrometheusConnectionForm
@@ -904,7 +928,7 @@ export function LocalConnectionSettings({
             />
           ))}
       </fieldset>
-      {!editor && <Collapse open={showFeedback} className="!mt-0">
+      {!editor && task === 'main' && <Collapse open={showFeedback} className="!mt-0">
         <p role="status" className={`pt-2 text-xs ${messageWarning ? 'text-warning-text' : 'text-theme-text-secondary'}`}>{feedback?.message}</p>
       </Collapse>}
       <ConfirmDialog
@@ -968,8 +992,7 @@ export function LocalConnectionSettings({
                   : 'Unchanged'}
             </dd>
           </dl>
-          {(Object.keys(snapshot) as IntegrationKind[])
-            .filter((k) => snapshot[k].state === 'target_changed')
+          {reviewKinds
             .map((k) => (
               <label key={k} className="flex items-center gap-2 text-sm">
                 <input
@@ -996,6 +1019,14 @@ export function LocalConnectionSettings({
           >
             Keep selected settings for this cluster
           </button>
+          {separateReviewKinds.length > 0 && (
+            <p className="text-xs text-theme-text-secondary">
+              {separateReviewKinds.map((k) => names[k]).join(' and ')}{' '}
+              {separateIdentityKnown
+                ? `${separateReviewKinds.length > 1 ? 'were' : 'was'} saved for a different previous cluster, so ${separateReviewKinds.length > 1 ? 'review them in their own tabs' : 'review it in its own tab'}.`
+                : `${separateReviewKinds.length > 1 ? 'need separate reviews in their own tabs' : 'needs a separate review in its own tab'}.`}
+            </p>
+          )}
         </div>
       )}
       {error && !pending && (

package/src/components/whats-new/releaseNotes.ts

@@ -38,7 +38,7 @@ export const RELEASE_NOTES: ReleaseNotes[] = [
         id: 'ai-investigations',
         icon: Bot,
         title: 'AI investigations that show their work',
-        // No link: the investigations workspace redirects home when this run
+        // No link: the investigations page redirects home when this run
         // mode can't host local agents.
         description: 'A clear verdict and the story of what broke, with the charts, logs and config behind it placed where the agent cites them. Now also runs on OpenCode, including AWS Bedrock.',
       },

package/src/components/workload/WorkloadView.tsx

@@ -49,6 +49,7 @@ import {
 import {
   useWorkloadHistory,
   fetchWorkloadHistoryPage,
+  useChanges,
   useResourceWithRelationships,
   usePodLogs,
   useTopology,
@@ -803,18 +804,32 @@ export function WorkloadView({
   // colliding kind) under the wrong group and refetch once it settles.
   const historyGroupSettled = Boolean(rest.group) || resource !== undefined || resourceError != null
   const historyQuery = useWorkloadHistory(apiKind, namespace, name, effectiveGroup, expanded && historyGroupSettled)
+  // A Radar without the scoped history endpoint gets the namespace's newest
+  // changes instead, which the timeline filters to this workload.
+  const historyFallback = isRadarFeatureUnsupported(historyQuery.error, 'workloadHistory')
+  const namespaceChanges = useChanges({
+    namespaces: [namespace],
+    timeRange: 'all',
+    includeK8sEvents: true,
+    includeManaged: true,
+    limit: 10000,
+    enabled: expanded && historyFallback,
+  })
   const {
-    events: allEvents,
+    events: scopedEvents,
     truncated: historyTruncated,
     loadOlder: loadOlderHistory,
     loadingOlder: loadingOlderHistory,
     olderError: olderHistoryError,
   } = useHistoryPaging(
     `${effectiveGroup ?? ''}/${apiKind}/${namespace}/${name}`,
-    historyQuery.data,
+    historyFallback ? undefined : historyQuery.data,
     (beforeSeq) => fetchWorkloadHistoryPage(apiKind, namespace, name, effectiveGroup, beforeSeq),
   )
-  const eventsLoading = historyQuery.isLoading || (expanded && !historyGroupSettled)
+  const allEvents = historyFallback ? namespaceChanges.data : scopedEvents
+  const eventsLoading = historyFallback
+    ? namespaceChanges.isLoading
+    : historyQuery.isLoading || (expanded && !historyGroupSettled)
 
   // RBAC
   const canUpdateSecrets = useCanUpdateSecrets()
@@ -1211,14 +1226,14 @@ export function WorkloadView({
         refetch={refetchResourceAndRuns}
         // Timeline
         allEvents={allEvents}
-        historyTruncated={historyTruncated}
-        onLoadOlderHistory={loadOlderHistory}
-        loadingOlderHistory={loadingOlderHistory}
-        olderHistoryError={olderHistoryError}
-        historyScoped
-        historyIncomplete={Boolean(historyQuery.data?.incomplete)}
-        historyError={historyQuery.error as Error | null}
-        onRetryHistory={() => void historyQuery.refetch()}
+        historyTruncated={!historyFallback && historyTruncated}
+        onLoadOlderHistory={historyFallback ? undefined : loadOlderHistory}
+        loadingOlderHistory={!historyFallback && loadingOlderHistory}
+        olderHistoryError={historyFallback ? null : olderHistoryError}
+        historyScoped={!historyFallback}
+        historyIncomplete={!historyFallback && Boolean(historyQuery.data?.incomplete)}
+        historyError={(historyFallback ? namespaceChanges.error : historyQuery.error) as Error | null}
+        onRetryHistory={() => void (historyFallback ? namespaceChanges.refetch() : historyQuery.refetch())}
         relatedTimelineEvents={relatedTimelineEvents}
         eventsLoading={eventsLoading || (batchExecution && batchKind !== 'JobSet' && batchRunsQuery.isLoading)}
         topology={topology}

package/src/context/DiagnoseCustomization.tsx

@@ -11,7 +11,7 @@
 // agent-free.
 import { createContext, useContext, useMemo } from "react";
 import type { ReactNode } from "react";
-import type { RunSummary } from "../api/diagnose";
+import type { InvestigationRefusal, RunSummary } from "../api/diagnose";
 
 /** Optional host controls beside shared run actions. Return a component element
  * if hooks are needed: this callback is invoked conditionally. Call onRunUpdated
@@ -21,6 +21,13 @@ export type RenderInvestigationRunActions = (props: {
   onRunUpdated: (run: RunSummary) => void;
 }) => ReactNode;
 
+/** Host action beside a refused start or follow-up, e.g. Radar Cloud's
+ * "Upgrade" when an organization has used its investigations. Called only for
+ * refusals that carry a code, reason or action; return null to show none. */
+export type RenderInvestigationRefusalAction = (
+  refusal: InvestigationRefusal,
+) => ReactNode;
+
 /** Render prop for the resource-level Investigate action. */
 export type RenderDiagnoseAction = (ctx: {
   /** Kubernetes Kind when loaded or discovered; otherwise its API resource name. */
@@ -63,6 +70,7 @@ export type DiagnoseConsentCopy = {
 export interface DiagnoseCustomization {
   renderAction: RenderDiagnoseAction | undefined;
   renderRunActions?: RenderInvestigationRunActions;
+  renderRefusalAction?: RenderInvestigationRefusalAction;
   consentCopy: DiagnoseConsentCopy | undefined;
   // undefined = default (CustomEvent → Radar's own Settings dialog);
   // null = hide the settings affordances.
@@ -82,20 +90,22 @@ export function DiagnoseCustomizationProvider({
   value,
   consentCopy,
   renderRunActions,
+  renderRefusalAction,
   onOpenSettings,
   children,
 }: {
   value: RenderDiagnoseAction | undefined;
   consentCopy?: DiagnoseConsentCopy;
   renderRunActions?: RenderInvestigationRunActions;
+  renderRefusalAction?: RenderInvestigationRefusalAction;
   /** Where "AI settings" affordances lead. Omit for Radar's own Settings
    *  dialog; pass `null` to hide them. */
   onOpenSettings?: (() => void) | null;
   children: ReactNode;
 }) {
   const ctx = useMemo(
-    () => ({ renderAction: value, consentCopy, onOpenSettings, renderRunActions }),
-    [value, consentCopy, onOpenSettings, renderRunActions],
+    () => ({ renderAction: value, consentCopy, onOpenSettings, renderRunActions, renderRefusalAction }),
+    [value, consentCopy, onOpenSettings, renderRunActions, renderRefusalAction],
   );
   return (
     <DiagnoseCustomizationContext.Provider value={ctx}>

package/src/index.ts

@@ -30,12 +30,14 @@ export type {
 export type {
   RenderDiagnoseAction,
   RenderInvestigationRunActions,
+  RenderInvestigationRefusalAction,
   DiagnoseConsentCopy,
 } from './context/DiagnoseCustomization';
+export type { InvestigationRefusal } from './api/diagnose';
 
 // Standalone AI investigation surface — mount the investigation panel outside a
-// full <RadarApp>. It uses the nearest React Router for durable drawer/workspace
-// URLs, or supplies one when mounted standalone. The backend set via setApiBase()
+// full <RadarApp>. It uses the nearest React Router for durable drawer and
+// investigations-page URLs, or supplies one when mounted standalone. The backend set via setApiBase()
 // picks the cluster, so hosts remount <DiagnoseProvider key={cluster}> to switch.
 // Mount order: ThemeProvider > DiagnoseCustomizationProvider > DiagnoseProvider
 // > DiagnoseSurface, under a @tanstack/react-query QueryClientProvider.