@skyhook-io/radar-app 1.16.1 → 1.16.3

package/src/components/whats-new/WhatsNewDialog.test.tsx

@@ -7,7 +7,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { Megaphone } from 'lucide-react'
 import type { WhatsNewState } from '../../api/client'
 import { openWhatsNew, useWhatsNewStatus, WhatsNew } from './WhatsNew'
-import { RELEASE_NOTES } from './releaseNotes'
+import { RELEASE_NOTES, type ReleaseNotes } from './releaseNotes'
 
 Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
 
@@ -37,13 +37,28 @@ function StatusProbe() {
   return null
 }
 
+const SHIPPED = [...RELEASE_NOTES]
+
+const card = (id: string, title: string, importance: number) => ({ id, icon: Megaphone, title, description: 'd', importance })
+
+// A release worth opening the dialog for, and a quiet one that isn't.
+const HEADLINE: ReleaseNotes = {
+  version: 'v1.15.0',
+  highlights: [{ ...card('capacity', 'Capacity views', 9), leadDescription: 'Capacity lead copy' }, card('diff', 'Manifest diffs', 9), card('rollouts', 'Rollout traffic', 9)],
+  improvements: ['Sort memory'],
+}
+const QUIET: ReleaseNotes = {
+  version: 'v1.16.0',
+  highlights: [card('timeline', 'Workload Timeline', 4), card('logs', 'Log levels', 4)],
+  improvements: ['Traffic fixes'],
+}
+
+function setCatalog(...entries: ReleaseNotes[]) {
+  RELEASE_NOTES.splice(0, RELEASE_NOTES.length, ...entries)
+}
+
 beforeEach(() => {
-  RELEASE_NOTES.push({
-    version: 'v1.15.0',
-    releaseUrl: 'https://github.com/skyhook-io/radar/releases',
-    highlights: [{ id: 'x', icon: Megaphone, title: 'Capacity views', description: 'd' }],
-    improvements: [],
-  })
+  setCatalog(HEADLINE)
   seenPosts.length = 0
   failSeenPosts = 0
   pendingRead = null
@@ -80,7 +95,7 @@ beforeEach(() => {
 
 afterEach(async () => {
   await act(async () => root.unmount())
-  RELEASE_NOTES.length = 0
+  setCatalog(...SHIPPED)
   client.clear()
   document.body.replaceChildren()
   vi.unstubAllGlobals()
@@ -155,7 +170,7 @@ describe('WhatsNew', () => {
 
   it('records nothing when previewing another release', async () => {
     serverState = { currentVersion: 'v1.15.2', storage: 'server', seenVersion: 'v1.15.2', priorInstall: true }
-    RELEASE_NOTES.push({ ...RELEASE_NOTES[0], version: 'v1.14.0' })
+    setCatalog(HEADLINE, { ...HEADLINE, version: 'v1.14.0' })
     serverState.seenVersion = 'v1.14.1'
     await render('/resources/pods?whats-new=v1.14.0')
     expect(dialog()?.textContent).toContain("What's new in Radar v1.14")
@@ -214,7 +229,7 @@ describe('WhatsNew', () => {
 
   it('never records a development build', async () => {
     serverState = { currentVersion: 'dev', storage: 'server', priorInstall: false }
-    RELEASE_NOTES.push({ ...RELEASE_NOTES[0], version: 'v0.0.0' })
+    setCatalog(HEADLINE, { ...HEADLINE, version: 'v0.0.0' })
     await act(async () => {
       root.render(
         <QueryClientProvider client={client}>
@@ -226,4 +241,111 @@ describe('WhatsNew', () => {
     expect(dialog()).toBeNull()
     expect(seenPosts).toEqual([])
   })
+  it('leaves a quiet release behind the unread dot, and records it once opened', async () => {
+    setCatalog(HEADLINE, QUIET)
+    serverState = { currentVersion: 'v1.16.0', storage: 'server', seenVersion: 'v1.15.0', priorInstall: true }
+    await render('/')
+    expect(dialog()).toBeNull()
+    expect(status.current.unread).toBe(true)
+    expect(seenPosts).toEqual([])
+    await act(async () => { openWhatsNew() })
+    expect(dialog()?.textContent).toContain("What's new in Radar v1.16")
+    expect(dialog()?.textContent).not.toContain('Capacity views')
+    await clickGotIt()
+    expect(seenPosts).toEqual(['v1.16.0'])
+    expect(status.current.unread).toBe(false)
+  })
+
+  it('does not record a quiet upgrade without a seen record as read', async () => {
+    setCatalog(QUIET)
+    serverState = { currentVersion: 'v1.16.0', storage: 'server', priorInstall: true }
+    await render('/')
+    expect(dialog()).toBeNull()
+    expect(seenPosts).toEqual([])
+    expect(status.current.unread).toBe(true)
+  })
+
+  it('composes the releases a user skipped, leading with the strongest', async () => {
+    setCatalog(HEADLINE, QUIET)
+    serverState = { currentVersion: 'v1.16.0', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await render('/')
+    const text = dialog()?.textContent ?? ''
+    expect(text).toContain("What's new since Radar v1.14")
+    expect(text).toContain('Also new')
+    expect(dialog()?.querySelector('li')?.textContent).toContain('Capacity views')
+    expect(dialog()?.querySelector('li')?.textContent).toContain('v1.15')
+    const tiles = Array.from(dialog()!.querySelectorAll('ul > li span.w-8')).map(t => t.className)
+    expect(tiles).toHaveLength(4)
+    expect(new Set(tiles).size).toBe(4)
+    await clickGotIt()
+    expect(seenPosts).toEqual(['v1.16.0'])
+  })
+
+  it('previews an upgrade from another version without recording anything', async () => {
+    setCatalog(HEADLINE, QUIET)
+    serverState = { currentVersion: 'v1.16.0', storage: 'server', seenVersion: 'v1.16.0', priorInstall: true }
+    await render('/?whats-new=v1.16.0&whats-new-from=v1.14.0')
+    expect(dialog()?.textContent).toContain("What's new since Radar v1.14")
+    await clickGotIt()
+    expect(seenPosts).toEqual([])
+  })
+
+  it('records nothing when previewing the running release', async () => {
+    serverState = { currentVersion: 'v1.15.0', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await render('/resources/pods?whats-new')
+    expect(dialog()).not.toBeNull()
+    await clickGotIt()
+    expect(seenPosts).toEqual([])
+    expect(status.current.unread).toBe(true)
+  })
+
+  it('does not name a seen record that is not a version', async () => {
+    serverState = { currentVersion: 'v1.15.2', storage: 'browser' }
+    localStorage.setItem('radar-whats-new-seen', 'vdev')
+    await render('/')
+    expect(dialog()?.textContent).toContain("What's new in Radar v1.15")
+    expect(dialog()?.textContent).not.toContain('vdev')
+  })
+
+  it('links to the public changelog', async () => {
+    serverState = { currentVersion: 'v1.15.2', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await render('/')
+    const link = Array.from(dialog()!.querySelectorAll('a')).find(a => a.textContent?.includes('Full changelog'))
+    expect(link?.getAttribute('href')).toBe('https://radarhq.io/changelog')
+  })
+  it('records the version it was opened for, even if the server is upgraded while it is open', async () => {
+    setCatalog(HEADLINE, QUIET)
+    serverState = { currentVersion: 'v1.15.2', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await render('/')
+    expect(dialog()).not.toBeNull()
+    serverState = { ...serverState, currentVersion: 'v1.16.0' }
+    await act(async () => { await client.refetchQueries({ queryKey: ['whats-new'] }) })
+    await clickGotIt()
+    expect(seenPosts).toEqual(['v1.15.2'])
+  })
+
+  it('names the previewed release as the destination of a previewed upgrade', async () => {
+    setCatalog(HEADLINE, QUIET)
+    serverState = { currentVersion: 'v1.15.2', storage: 'server', seenVersion: 'v1.15.2', priorInstall: true }
+    await render('/?whats-new=v1.16.0&whats-new-from=v1.14.0')
+    const text = dialog()?.textContent ?? ''
+    expect(text).toContain('v1.16.0')
+    expect(text).not.toContain('v1.15.2')
+  })
+  it('uses the lead copy only while a highlight leads the dialog', async () => {
+    serverState = { currentVersion: 'v1.15.2', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await render('/')
+    expect(dialog()?.textContent).toContain('Capacity lead copy')
+    await clickGotIt()
+    const stronger: ReleaseNotes = { version: 'v1.16.0', highlights: [card('big', 'Bigger thing', 10), card('big2', 'Second thing', 10)], improvements: [] }
+    setCatalog(HEADLINE, stronger)
+    serverState = { currentVersion: 'v1.16.0', storage: 'server', seenVersion: 'v1.14.1', priorInstall: true }
+    await act(async () => root.unmount())
+    root = createRoot(document.body.appendChild(document.createElement('div')))
+    client.clear()
+    await render('/')
+    const text = dialog()?.textContent ?? ''
+    expect(text).toContain('Capacity views')
+    expect(text).not.toContain('Capacity lead copy')
+  })
 })

package/src/components/whats-new/releaseNotes.ts

@@ -1,53 +1,111 @@
 import type { LucideIcon } from 'lucide-react'
-import { Bot, GitCompareArrows, Layers, Network, Scale } from 'lucide-react'
+import { Bot, GitCompareArrows, Layers, Network, RefreshCcw, Scale, ScrollText, SlidersHorizontal } from 'lucide-react'
 import { compareVersions } from '../../utils/version'
 
 export interface ReleaseHighlight {
   id: string
   icon: LucideIcon
   title: string
+  /**
+   * Shown on a grid card, so at most 150 characters. Read next to other
+   * releases' highlights, so it must stand on its own.
+   */
   description: string
+  /**
+   * Fuller copy for when this highlight leads the dialog. Only a release's
+   * top highlight can ever lead (every other one scores at or below it), so
+   * only that one may set it.
+   */
+  leadDescription?: string
+  /**
+   * 1-10, comparable across releases: it decides which highlights a user who
+   * skipped releases sees, and whether the dialog opens by itself.
+   *   9-10  a new capability that defines the release
+   *   7-8   a solid feature a typical user would go try now
+   *   4-6   a useful improvement
+   *   1-3   polish
+   * Most highlights are not 9s. When every card is a 7, every release
+   * interrupts the user, which is what the score exists to prevent.
+   */
+  importance: number
   /** In-app route the highlight's call to action opens. */
   path?: string
   cta?: string
-  /** Icon tile color, so the cards read apart at a glance. The lead card always uses the accent. */
-  tone?: HighlightTone
 }
 
-export type HighlightTone = 'violet' | 'teal' | 'emerald' | 'indigo'
-
 export interface ReleaseNotes {
   version: string
-  /** The first highlight leads the dialog at full width. */
   highlights: ReleaseHighlight[]
   improvements: string[]
-  releaseUrl: string
 }
 
-// One entry per release that has something to announce. A version without its
-// own entry shows the newest entry at or below it, so a patch upgrade (or one
-// that skips the release with notes) still gets them. Every minor and major
-// release must have its own entry: scripts/check-whats-new.sh refuses to
+export const CHANGELOG_URL = 'https://radarhq.io/changelog'
+
+// One entry per release that has something to announce. A user sees the
+// entries for the releases they haven't seen yet, composed into one dialog, so
+// a patch upgrade, or one that skips releases, still gets them. Every minor and
+// major release must have its own entry: scripts/check-whats-new.sh refuses to
 // release one without it.
 export const RELEASE_NOTES: ReleaseNotes[] = [
+  {
+    version: 'v1.16.0',
+    highlights: [
+      {
+        id: 'restart-loop-issues',
+        icon: RefreshCcw,
+        title: 'One steady issue per crash loop',
+        description: 'A crash-looping container stays one issue until it recovers, with probe failures and exits as evidence. No more repeat alerts.',
+        leadDescription: 'A restarting container is one issue until it recovers, instead of a new one on every check, so no more repeat alerts and investigations. Probe failures, the last exit and how many replicas are affected sit on it as evidence, and severity follows impact.',
+        importance: 6,
+        path: '/issues',
+        cta: 'Open Issues',
+      },
+      {
+        id: 'log-viewer',
+        icon: ScrollText,
+        title: 'Log viewer enhancements',
+        description: 'Levels from the logger itself, stack traces kept with their errors, Hide matching, and a chip for lines without a level.',
+        importance: 5,
+      },
+      {
+        id: 'per-cluster-settings',
+        icon: SlidersHorizontal,
+        title: 'Separate settings for each cluster',
+        description: 'Running Radar locally, each kubeconfig context keeps its own Metrics, Argo CD and Cost connections.',
+        importance: 4,
+      },
+    ],
+    improvements: [
+      // The grid fills row by row: pair lines of similar length.
+      "A workload's Timeline shows only its own history",
+      "Timeline's Problems filter no longer hides crash loops",
+      'Live Traffic figures corrected for Cilium and Istio',
+      'Saved namespace picks survive a failing namespace list',
+      'Terminal tabs show and keep the context they opened for',
+      'YAML review flags a resource that changed after review',
+      'Helm chart meets the Pod Security restricted profile',
+      'Helm chart extraArgs passes through any Radar flag',
+    ],
+  },
   {
     version: 'v1.15.0',
-    releaseUrl: 'https://github.com/skyhook-io/radar/releases/tag/v1.15.0',
     highlights: [
       {
         id: 'ai-investigations',
         icon: Bot,
         title: 'AI investigations that show their work',
-        // No link: the investigations workspace redirects home when this run
+        // No link: the investigations page redirects home when this run
         // mode can't host local agents.
-        description: 'A clear verdict and the story of what broke, with the charts, logs and config behind it placed where the agent cites them. Now also runs on OpenCode, including AWS Bedrock.',
+        description: 'A clear verdict and the story of what broke, with the evidence placed where the agent cites it. Runs on OpenCode too.',
+        leadDescription: 'A clear verdict and the story of what broke, with the charts, logs and config behind it placed where the agent cites them. Runs on OpenCode too, including AWS Bedrock.',
+        importance: 9,
       },
       {
         id: 'gitops-manifest-diff',
         icon: GitCompareArrows,
         title: 'Full manifest diffs for Argo CD resources',
         description: 'Compare the Git-rendered and live manifest of a drifted Argo CD resource, side by side or unified.',
-        tone: 'violet',
+        importance: 8,
         path: '/gitops',
         cta: 'Open GitOps',
       },
@@ -56,7 +114,7 @@ export const RELEASE_NOTES: ReleaseNotes[] = [
         icon: Scale,
         title: 'Rightsizing and cost data in MCP',
         description: 'Agents get new optimized tools. Risks (OOM, limit conflicts and throttling) lead before cost-saving, in the UI as well.',
-        tone: 'emerald',
+        importance: 7,
         path: '/cost/rightsizing',
         cta: 'Open Rightsizing',
       },
@@ -65,14 +123,14 @@ export const RELEASE_NOTES: ReleaseNotes[] = [
         icon: Layers,
         title: 'Deeper batch + AI/ML workloads support',
         description: 'Dedicated pages for Kueue, JobSet and Ray resources, and Job and JobSet details now show why a queued job has no Pods.',
-        tone: 'teal',
+        importance: 7,
       },
       {
         id: 'rollout-traffic-topology',
         icon: Network,
         title: 'Canary and blue-green in Topology',
         description: 'See canary and stable Pods, which Services route to each side, and the canary traffic weight.',
-        tone: 'indigo',
+        importance: 7,
         path: '/topology',
         cta: 'Open Topology',
       },
@@ -105,17 +163,90 @@ export function releaseLine(version: string): string {
   return version.replace(/^(v\d+\.\d+)\.\d+$/, '$1')
 }
 
-/** The newest notes for a release at or below `version` — what that version's user has access to. */
+/** The entries at or below `version`, newest first: what that version's user has access to. */
+function releasesUpTo(version: string, catalog: ReleaseNotes[]): ReleaseNotes[] {
+  return catalog
+    .filter(notes => (compareVersions(notes.version, version) ?? 1) <= 0)
+    .sort((a, b) => compareVersions(b.version, a.version) ?? 0)
+}
+
+/** The newest notes for a release at or below `version`. */
 export function latestReleaseNotesFor(
   version: string | undefined,
   catalog: ReleaseNotes[] = RELEASE_NOTES,
 ): ReleaseNotes | undefined {
   if (!version) return undefined
-  let latest: ReleaseNotes | undefined
-  for (const notes of catalog) {
-    const atOrBelow = compareVersions(notes.version, version)
-    if (atOrBelow === null || atOrBelow > 0) continue
-    if (!latest || (compareVersions(notes.version, latest.version) ?? 0) > 0) latest = notes
+  return releasesUpTo(version, catalog)[0]
+}
+
+/**
+ * The entries a user hasn't seen, newest first: those after `lastSeen`, up to
+ * the running version. A fresh install has nothing to compare against and gets
+ * none; an install that predates the seen record, or whose record isn't a
+ * version, gets them all.
+ */
+export function unreadReleases(
+  currentVersion: string,
+  lastSeen: string | null,
+  priorInstall: boolean,
+  catalog: ReleaseNotes[] = RELEASE_NOTES,
+): ReleaseNotes[] {
+  const available = releasesUpTo(currentVersion, catalog)
+  if (lastSeen === null) return priorInstall ? available : []
+  return available.filter(notes => (compareVersions(notes.version, lastSeen) ?? 1) > 0)
+}
+
+// How much a highlight counts by how far back its release is. A user who
+// skipped releases sees the best of them, weighted toward the newest; older
+// releases than this list covers are left to the changelog.
+export const RELEASE_WEIGHTS = [1, 0.75, 0.5]
+export const MAX_CARDS = 5
+export const MAX_LINES = 8
+// The dialog opens by itself only when the cards it shows add up to this.
+// A release of mostly 4-6s stays behind the unread dot; one with a few solid
+// features, or a skipped release with them, opens it.
+export const AUTO_OPEN_SCORE = 25
+
+export interface ComposedHighlight extends ReleaseHighlight {
+  version: string
+  score: number
+}
+
+export interface ComposedLine {
+  version: string
+  text: string
+}
+
+export interface ComposedNotes {
+  /** The releases shown, newest first. */
+  versions: string[]
+  /** The first one leads the dialog at full width. */
+  highlights: ComposedHighlight[]
+  lines: ComposedLine[]
+  /** Sum of the shown highlights' scores. */
+  score: number
+  /** False when older unseen releases were left out. */
+  complete: boolean
+}
+
+/** One dialog from releases ordered newest first. */
+export function composeReleaseNotes(releases: ReleaseNotes[]): ComposedNotes {
+  const shown = releases.slice(0, RELEASE_WEIGHTS.length)
+  // Built newest release first, in authored order, so the stable sort breaks
+  // ties the same way.
+  const ranked = shown
+    .flatMap((notes, i) => notes.highlights.map(h => ({ ...h, version: notes.version, score: h.importance * RELEASE_WEIGHTS[i] })))
+    .sort((a, b) => b.score - a.score)
+  const highlights = ranked.slice(0, MAX_CARDS)
+  const lines: ComposedLine[] = [
+    ...ranked.slice(MAX_CARDS).map(h => ({ version: h.version, text: h.title })),
+    ...shown.flatMap(notes => notes.improvements.map(text => ({ version: notes.version, text }))),
+  ].slice(0, MAX_LINES)
+  return {
+    versions: shown.map(notes => notes.version),
+    highlights,
+    lines,
+    score: highlights.reduce((sum, h) => sum + h.score, 0),
+    complete: shown.length === releases.length,
   }
-  return latest
 }

package/src/components/workload/WorkloadView.tsx

@@ -3,18 +3,20 @@ import { JobRenderer, JobSetRenderer } from '../resources/renderers/JobAdmission
 import { RayClusterRenderer } from '../resources/renderers/RayClusterRenderer'
 import { RayServiceRenderer } from '../resources/renderers/RayServiceRenderer'
 import { KueueWorkloadRenderer } from '../resources/renderers/KueueWorkloadRenderer'
-import { useMemo, useEffect, useCallback, useRef, useState } from 'react'
+import { useMemo, useEffect, useCallback, useRef, useState, type ReactNode } from 'react'
 import { useQueries, useQueryClient } from '@tanstack/react-query'
-import { useNavigate, useLocation, useSearchParams } from 'react-router-dom'
+import { Navigate, useNavigate, useLocation, useSearchParams } from 'react-router-dom'
 import { workloadPodAwaitsScheduling } from '../capacity/podDemandGate'
 import { clsx } from 'clsx'
 import { Terminal, Stethoscope } from 'lucide-react'
 import {
   WorkloadView as BaseWorkloadView,
+  isApiGroup,
   EditableYamlView,
   FetchResult,
   Section,
   type WorkloadTabType,
+  type WorkloadExtraTab,
   type RendererOverrides,
   type GitOpsOwnerRef,
   type GitOpsStatus,
@@ -148,6 +150,9 @@ import {
   CNPGSubscriptionRenderer,
 } from '../resources/renderers/CNPGDeclarativeRenderer'
 import { CreateResourceDialog } from '../shared/CreateResourceDialog'
+import { renderCNPGSummary } from '../cnpg/CNPGSummaryHost'
+import { CNPGClusterLogs } from '../cnpg/CNPGClusterLogs'
+import { cnpgDetailKindFor, cnpgDetailPath } from '../cnpg/routes'
 import { cleanYamlForDuplicate } from '../../utils/skeleton-yaml'
 import { useDesktopDownload } from '../../hooks/useDesktopDownload'
 import { useCompareLauncher } from '../compare/useCompareLauncher'
@@ -277,6 +282,17 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
     )
   }
 
+  const cnpgPlural = cnpgDetailKindFor(kind, group)
+  if (cnpgPlural) {
+    const params = new URLSearchParams(searchParams)
+    params.delete('apiGroup')
+    const tab = params.get('tab')
+    if (cnpgPlural === 'clusters' && (tab === 'timeline' || tab === 'events')) params.set('tab', 'activity')
+    const base = cnpgDetailPath({ plural: cnpgPlural, namespace, name })
+    const qs = params.toString()
+    return <Navigate replace to={qs ? `${base}?${qs}` : base} state={location.state} />
+  }
+
   return (
     <WorkloadView
       kind={kind}
@@ -312,6 +328,8 @@ interface WorkloadViewProps {
   initialTab?: 'detail' | 'yaml'
   group?: string
   pushTabHistory?: boolean
+  breadcrumb?: ReactNode
+  extraTabs?: WorkloadExtraTab[]
 }
 
 interface ImageTargetOwnershipContext {
@@ -536,6 +554,7 @@ export function WorkloadView({
   ...rest
 }: WorkloadViewProps) {
   const [searchParams, setSearchParams] = useSearchParams()
+  const location = useLocation()
   const apiKind = kindToPluralWithGroup(kindProp, rest.group ?? '')
   const queryClient = useQueryClient()
   const [imageTargetOwnership, setImageTargetOwnership] =
@@ -561,9 +580,9 @@ export function WorkloadView({
       } else {
         params.set('tab', tab)
       }
-      setSearchParams(params, { replace: opts?.replace ?? !pushTabHistory })
+      setSearchParams(params, { replace: opts?.replace ?? !pushTabHistory, state: location.state })
     },
-    [pushTabHistory, searchParams, setSearchParams],
+    [pushTabHistory, searchParams, setSearchParams, location.state],
   )
 
   const selectedRunKey = searchParams.get('run') ?? ''
@@ -1264,6 +1283,9 @@ export function WorkloadView({
             onSelectRun={handleSelectedRunChange}
           />
         )}
+        renderSummary={({ apiKind: ak, namespace: ns, name: n, resource: res, context, onNavigate }) =>
+          renderCNPGSummary({ apiKind: ak, namespace: ns, name: n, group: effectiveGroup, resource: res, context, onNavigate })
+        }
         renderExpandedOverview={({ kind: k, apiKind, namespace: ns, name: n, resource: res }) =>
           supportsBatchExecution(k, apiKind, effectiveGroup, res?.apiVersion) &&
           res ? (
@@ -1672,6 +1694,10 @@ function LogsTabContent({
     )
   }
 
+  if (kind === 'Cluster' && isApiGroup(resource?.apiVersion, 'postgresql.cnpg.io')) {
+    return <CNPGClusterLogs namespace={namespace} name={name} />
+  }
+
   // Workload kinds with stable pod selectors use the aggregated workload logs viewer
   if (WORKLOAD_LOG_KINDS.has(kind) && (kind !== 'Job' || isCoreBatchJob(apiKind, group))) {
     return (

package/src/context/DiagnoseCustomization.tsx

@@ -11,7 +11,7 @@
 // agent-free.
 import { createContext, useContext, useMemo } from "react";
 import type { ReactNode } from "react";
-import type { RunSummary } from "../api/diagnose";
+import type { InvestigationRefusal, RunSummary } from "../api/diagnose";
 
 /** Optional host controls beside shared run actions. Return a component element
  * if hooks are needed: this callback is invoked conditionally. Call onRunUpdated
@@ -21,6 +21,13 @@ export type RenderInvestigationRunActions = (props: {
   onRunUpdated: (run: RunSummary) => void;
 }) => ReactNode;
 
+/** Host action beside a refused start or follow-up, e.g. Radar Cloud's
+ * "Upgrade" when an organization has used its investigations. Called only for
+ * refusals that carry a code, reason or action; return null to show none. */
+export type RenderInvestigationRefusalAction = (
+  refusal: InvestigationRefusal,
+) => ReactNode;
+
 /** Render prop for the resource-level Investigate action. */
 export type RenderDiagnoseAction = (ctx: {
   /** Kubernetes Kind when loaded or discovered; otherwise its API resource name. */
@@ -63,6 +70,7 @@ export type DiagnoseConsentCopy = {
 export interface DiagnoseCustomization {
   renderAction: RenderDiagnoseAction | undefined;
   renderRunActions?: RenderInvestigationRunActions;
+  renderRefusalAction?: RenderInvestigationRefusalAction;
   consentCopy: DiagnoseConsentCopy | undefined;
   // undefined = default (CustomEvent → Radar's own Settings dialog);
   // null = hide the settings affordances.
@@ -82,20 +90,22 @@ export function DiagnoseCustomizationProvider({
   value,
   consentCopy,
   renderRunActions,
+  renderRefusalAction,
   onOpenSettings,
   children,
 }: {
   value: RenderDiagnoseAction | undefined;
   consentCopy?: DiagnoseConsentCopy;
   renderRunActions?: RenderInvestigationRunActions;
+  renderRefusalAction?: RenderInvestigationRefusalAction;
   /** Where "AI settings" affordances lead. Omit for Radar's own Settings
    *  dialog; pass `null` to hide them. */
   onOpenSettings?: (() => void) | null;
   children: ReactNode;
 }) {
   const ctx = useMemo(
-    () => ({ renderAction: value, consentCopy, onOpenSettings, renderRunActions }),
-    [value, consentCopy, onOpenSettings, renderRunActions],
+    () => ({ renderAction: value, consentCopy, onOpenSettings, renderRunActions, renderRefusalAction }),
+    [value, consentCopy, onOpenSettings, renderRunActions, renderRefusalAction],
   );
   return (
     <DiagnoseCustomizationContext.Provider value={ctx}>

package/src/contexts/CapabilitiesContext.tsx

@@ -114,6 +114,10 @@ export function useCanHelmWrite(): boolean {
   return useContext(CapabilitiesContext).helmWrite
 }
 
+export function useIsAuthEnabled(): boolean {
+  return useContext(CapabilitiesContext).authEnabled === true
+}
+
 export function useCanNodeWrite(): boolean {
   return useContext(CapabilitiesContext).nodeWrite
 }
@@ -158,7 +162,11 @@ export function useNamespacedCapabilities(namespace: string | undefined) {
     canExec: nsCaps?.exec ?? globalCaps.exec,
     canViewLogs: nsCaps?.logs ?? globalCaps.logs,
     canPortForward: nsCaps?.portForward ?? globalCaps.portForward,
+    canHelmWrite: nsCaps?.helmWrite ?? globalCaps.helmWrite,
     workloadWrites: nsCaps?.workloadWrites ?? globalCaps.workloadWrites,
     workloadWritesPending: Boolean(namespace && isPending),
-  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.workloadWrites, isPending, namespace, nsCaps])
+    // A failed refetch keeps the last successful namespace answer; with none,
+    // the global value is not an answer for this namespace.
+    helmWriteUnknown: Boolean(namespace && !nsCaps && (isPending || error)),
+  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.helmWrite, globalCaps.workloadWrites, error, isPending, namespace, nsCaps])
 }

package/src/hooks/useResourceCounts.ts

@@ -0,0 +1,49 @@
+import { useQuery } from '@tanstack/react-query'
+import { debugNamespaceLog, fetchJSON, isStillLoadingError } from '../api/client'
+import { useConnection } from '../context/ConnectionContext'
+
+export interface ResourceCountsResponse {
+  counts: Record<string, number>
+  forbidden?: string[]
+  reasons?: Record<string, string>
+  unavailable?: string[]
+}
+
+// Lightweight per-kind counts for the Resources sidebar badges. Shared by the
+// Resources view and any surface that renders the same sidebar standalone, so
+// both read one cache entry.
+export function useResourceCounts(namespaces: string[]) {
+  const { connection } = useConnection()
+  const namespacesParam = namespaces.join(',')
+  return useQuery({
+    queryKey: ['resource-counts', namespacesParam],
+    queryFn: async () => {
+      const params = new URLSearchParams()
+      if (namespaces.length > 0) params.set('namespaces', namespacesParam)
+      const startedAt = performance.now()
+      debugNamespaceLog('resources:counts-fetch-start', { namespaces, params: params.toString() })
+      try {
+        return await fetchJSON<ResourceCountsResponse>(`/resource-counts?${params}`)
+      } finally {
+        debugNamespaceLog('resources:counts-fetch-end', {
+          namespaces,
+          params: params.toString(),
+          durationMs: Math.round(performance.now() - startedAt),
+        })
+      }
+    },
+    staleTime: 10000,
+    // SSE invalidation isn't running while connecting, and mid-sync counts
+    // are what unlatch guarded kinds as their informers finish — poll fast
+    // during the shell, settle to the safety net once connected.
+    refetchInterval: connection.state === 'connecting' ? 3000 : 60000,
+    // During the first seconds of the progressive shell the endpoint 503s
+    // (cluster_connecting) until the mid-sync cache handle exists; keep the
+    // query pending rather than parking it in error state, which would
+    // unlatch the large-list guard at the connected flip.
+    retry: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? true : failureCount < 3,
+    retryDelay: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
+  })
+}