@skyhook-io/radar-app 1.16.1 → 1.16.3

package/src/components/diagnose/launch.ts

@@ -43,12 +43,12 @@ export function buildLaunchCommand(
 ): string | null {
   if (!run.sessionId || run.status === "stale") return null;
 
-  // OpenCode terminal handoff needs a persistent MCP configuration outside the run workspace.
+  // OpenCode terminal handoff needs a persistent MCP configuration outside the run's working directory.
   if (run.agent === "opencode") return null;
 
   if (run.agent === "cursor-agent") {
     // Cursor's --resume is workspace-scoped, and Radar runs each investigation in a
-    // throwaway per-run workspace the user doesn't have — no command can reattach
+    // throwaway per-run working directory the user doesn't have — no command can reattach
     // both that session and Radar's MCP in the user's own terminal. So there's no
     // hand-off for Cursor; the in-panel investigation is self-contained.
     return null;

package/src/components/diagnose/useDisclosureReveal.ts

@@ -84,7 +84,7 @@ export function useDisclosureReveal<T extends HTMLElement>() {
       );
       // This component lives in a bounded Diagnose surface. Never fall back to
       // scrolling the document (or an overflow-hidden ancestor), which can move
-      // the entire workspace and expose blank space below it.
+      // the entire investigation surface and expose blank space below it.
       if (!scroller) return;
       // Expansion is delayed until Collapse has settled. If the reader scrolls
       // during that interval, their newer intent wins over the automatic reveal.

package/src/components/dock/BottomDock.tsx

@@ -53,7 +53,7 @@ function renderTabContent(tab: DockTab, isActive: boolean) {
 
   if (tab.type === 'local-terminal') {
     return (
-      <LocalTerminalTab isActive={isActive} initialCommand={tab.initialCommand} />
+      <LocalTerminalTab tabId={tab.id} title={tab.title} intendedContext={tab.localTerminalContext} isActive={isActive} initialCommand={tab.initialCommand} />
     )
   }
 

package/src/components/dock/DockContext.tsx

@@ -1,4 +1,8 @@
-// Re-exported from @skyhook-io/k8s-ui — source of truth is radar/packages/k8s-ui/src/components/dock/DockContext.tsx
+import { useCallback, useLayoutEffect, useRef } from 'react'
+import { useDock } from '@skyhook-io/k8s-ui'
+import { useConnection } from '../../context/ConnectionContext'
+import { useToast } from '../ui/Toast'
+
 export {
   DockProvider,
   useDock,
@@ -7,6 +11,27 @@ export {
   useOpenLogs,
   useOpenWorkloadLogs,
   useOpenNodeTerminal,
-  useOpenLocalTerminal,
 } from '@skyhook-io/k8s-ui'
 export type { DockTab, DockTabType, DockContextValue } from '@skyhook-io/k8s-ui'
+
+export function useOpenLocalTerminal() {
+  const { addTab } = useDock()
+  const { connection } = useConnection()
+  const { showToast } = useToast()
+  const contextRef = useRef({ context: connection.context, state: connection.state })
+  useLayoutEffect(() => { contextRef.current = { context: connection.context, state: connection.state } }, [connection.context, connection.state])
+
+  return useCallback((opts?: { initialCommand?: string; title?: string }) => {
+    const { context, state } = contextRef.current
+    if (!context && state !== 'disconnected') {
+      showToast('Waiting for a context. Try opening the terminal again.', { type: 'info' })
+      return
+    }
+    addTab({
+      type: 'local-terminal',
+      title: opts?.title || 'Terminal',
+      initialCommand: opts?.initialCommand,
+      localTerminalContext: context,
+    })
+  }, [addTab, showToast])
+}

package/src/components/dock/LocalTerminalContext.test.tsx

@@ -0,0 +1,210 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { createRequire } from 'node:module'
+import { resolve } from 'node:path'
+import { createRoot, type Root } from 'react-dom/client'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { DockProvider, useDock, useOpenLocalTerminal as useSharedOpenLocalTerminal } from '../../../../packages/k8s-ui/src/components/dock/DockContext'
+import { useOpenLocalTerminal } from './DockContext'
+import { LocalTerminalTab } from './LocalTerminalTab'
+import { ToastProvider } from '../../../../packages/k8s-ui/src/components/ui/Toast'
+
+const state = vi.hoisted(() => ({ context: 'A', status: 'connected', mountTabs: true, open: null as null | (() => void) }))
+vi.mock('../../context/ConnectionContext', () => ({
+  useConnection: () => ({ connection: { context: state.context, state: state.status } }),
+}))
+vi.mock('@skyhook-io/k8s-ui', async () => ({
+  ...await import('../../../../packages/k8s-ui/src/components/dock/DockContext'),
+  ...await import('../../../../packages/k8s-ui/src/components/dock/LocalTerminalTab'),
+  ...await import('../../../../packages/k8s-ui/src/components/ui/ClusterName'),
+  ...await import('../../../../packages/k8s-ui/src/components/ui/Tooltip'),
+  ...await import('../../../../packages/k8s-ui/src/components/ui/Toast'),
+  ...await import('../../../../packages/k8s-ui/src/utils/context-name'),
+}))
+vi.mock('../../../../packages/k8s-ui/src/components/dock/terminalClipboard', () => ({ setupTerminalClipboard: () => () => {}, copyTerminalSelection: vi.fn() }))
+vi.mock('../../../../packages/k8s-ui/src/components/dock/TerminalClipboardToolbar', () => ({ TerminalClipboardToolbar: () => null }))
+vi.mock('../../../../packages/k8s-ui/src/components/dock/useMultilinePasteConfirm', () => ({ useMultilinePasteConfirm: () => ({ confirmPaste: vi.fn(), pasteDialog: null }) }))
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+const { Terminal } = createRequire(resolve(__dirname, '../../../../packages/k8s-ui/package.json'))('@xterm/xterm')
+
+class Socket {
+  static OPEN = 1
+  static instances: Socket[] = []
+  readyState = 0
+  onopen?: () => void
+  onclose?: () => void
+  onerror?: () => void
+  onmessage?: (event: { data: string }) => void
+  send = vi.fn()
+  constructor(public url: string) { Socket.instances.push(this) }
+  open() { this.readyState = 1; this.onopen?.() }
+  close() { this.readyState = 3; this.onclose?.() }
+  session(context: string) {
+    this.onmessage?.({ data: JSON.stringify({ type: 'session', context, kubeconfigIsolated: true }) })
+  }
+}
+let root: Root
+let element: HTMLDivElement
+let client: QueryClient
+function Harness() {
+  const { tabs } = useDock()
+  const open = useOpenLocalTerminal()
+  const sharedOpen = useSharedOpenLocalTerminal()
+  state.open ??= () => open({ title: 'Auth', initialCommand: 'auth-marker' })
+  return <>
+    <button onClick={() => open({ title: 'Auth', initialCommand: 'auth-marker' })}>Open</button>
+    <button onClick={() => sharedOpen()}>Open shared</button>
+    {state.mountTabs && tabs.map(tab => <section key={tab.id}>
+      <h2>{tab.title}</h2>
+      <LocalTerminalTab tabId={tab.id} title={tab.title} intendedContext={tab.localTerminalContext} initialCommand={tab.initialCommand} />
+    </section>)}
+  </>
+}
+async function render() {
+  await act(async () => root.render(<QueryClientProvider client={client}><ToastProvider><DockProvider><Harness /></DockProvider></ToastProvider></QueryClientProvider>))
+}
+async function click(text: string, section: ParentNode = element) {
+  await act(async () => [...section.querySelectorAll<HTMLButtonElement>('button')].find(button => button.textContent?.trim() === text)!.click())
+}
+beforeEach(() => {
+  vi.spyOn(Terminal.prototype, 'open').mockImplementation(() => {})
+  state.context = 'A'
+  state.status = 'connected'
+  state.mountTabs = true
+  state.open = null
+  Socket.instances = []
+  vi.useFakeTimers()
+  vi.stubGlobal('WebSocket', Socket)
+  vi.stubGlobal('ResizeObserver', class { observe() {} disconnect() {} })
+  vi.stubGlobal('requestAnimationFrame', () => 0)
+  client = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  element = document.createElement('div')
+  document.body.appendChild(element)
+  root = createRoot(element)
+})
+afterEach(async () => {
+  await act(async () => root.unmount())
+  client.clear()
+  element.remove()
+  vi.unstubAllGlobals()
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+it('captures A at the action before mounting, and keeps first delivery pending while B is selected', async () => {
+  state.mountTabs = false
+  await render()
+  await click('Open')
+  state.context = 'B'
+  state.mountTabs = true
+  await render()
+  expect(Socket.instances).toHaveLength(0)
+  expect(element.textContent).toContain('Requested:A')
+  expect(element.querySelector('button[aria-label="New terminal for B"]')).not.toBeNull()
+  expect([...element.querySelectorAll('button')].find(b => b.textContent?.trim() === 'Reconnect')?.disabled).toBe(true)
+  expect(element.textContent).toContain('Different context')
+  state.context = 'A'
+  await render()
+  await click('Reconnect')
+  expect(new URL(Socket.instances[0].url).searchParams.get('expectedContext')).toBe('A')
+  await act(async () => { Socket.instances[0].open(); Socket.instances[0].session('A'); vi.advanceTimersByTime(300) })
+  expect(Socket.instances[0].send.mock.calls.filter(([data]) => JSON.parse(data).type === 'input')).toEqual([[JSON.stringify({ type: 'input', data: 'auth-marker\n' })]])
+})
+
+it('preserves A through a refused reconnect, creates B independently, and reconnects A without replay', async () => {
+  await render()
+  await click('Open')
+  await act(async () => { Socket.instances[0].open(); Socket.instances[0].session('A'); vi.advanceTimersByTime(300) })
+  state.context = 'B'
+  await render()
+  expect(Socket.instances[0].readyState).toBe(1)
+  await act(async () => Socket.instances[0].close())
+  await click('Reconnect')
+  expect(Socket.instances).toHaveLength(1)
+  expect(element.querySelector('h2')?.textContent).toBe('Auth · A')
+  await click('New terminal')
+  expect(new URL(Socket.instances[1].url).searchParams.get('expectedContext')).toBe('B')
+  await act(async () => { Socket.instances[1].open(); Socket.instances[1].session('B') })
+  expect([...element.querySelectorAll('h2')].map(e => e.textContent)).toEqual(['Auth · A', 'Terminal · B'])
+  state.context = 'A'
+  await render()
+  await click('Reconnect', element.querySelector('section')!)
+  await act(async () => { Socket.instances[2].open(); Socket.instances[2].session('A'); vi.advanceTimersByTime(300) })
+  expect(new URL(Socket.instances[2].url).searchParams.get('expectedContext')).toBe('A')
+  expect(Socket.instances.flatMap(s => s.send.mock.calls).filter(([data]) => JSON.parse(data).type === 'input')).toHaveLength(1)
+})
+
+it('refreshes connection state after handshake failure and can retry without consuming the command', async () => {
+  const refresh = vi.spyOn(client, 'invalidateQueries')
+  await render()
+  await click('Open')
+  await act(async () => { Socket.instances[0].onerror?.(); Socket.instances[0].close() })
+  expect(refresh).toHaveBeenCalledWith({ queryKey: ['connection-status'] })
+  state.context = 'B'
+  await render()
+  expect([...element.querySelectorAll('button')].find(b => b.textContent?.trim() === 'Retry')?.disabled).toBe(true)
+  await click('Retry')
+  expect(Socket.instances).toHaveLength(1)
+  state.context = 'A'
+  await render()
+  await click('Retry')
+  await act(async () => { Socket.instances[1].open(); Socket.instances[1].session('A'); vi.advanceTimersByTime(300) })
+  expect(Socket.instances[1].send.mock.calls.filter(([data]) => JSON.parse(data).type === 'input')).toHaveLength(1)
+})
+
+it('explains unknown-context refusal and lets an earlier callback read the latest committed context', async () => {
+  state.context = ''
+  state.status = 'connecting'
+  await render()
+  await click('Open')
+  expect(element.querySelector('section')).toBeNull()
+  expect(element.textContent).toContain('Waiting for a context. Try opening the terminal again.')
+  expect(Socket.instances).toHaveLength(0)
+  state.context = 'A & B/qualified'
+  await render()
+  expect(Socket.instances).toHaveLength(0)
+  await act(async () => state.open!())
+  expect(new URL(Socket.instances[0].url).searchParams.get('expectedContext')).toBe('A & B/qualified')
+})
+
+it('gives a shared-hook tab without an intent an explicit state and a fresh context-aware action', async () => {
+  await render()
+  await click('Open shared')
+  expect(element.textContent).toContain('No context selected')
+  expect(Socket.instances).toHaveLength(0)
+  expect([...element.querySelectorAll('button')].find(b => b.textContent?.trim() === 'Reconnect')?.disabled).toBe(true)
+  await click('New terminal')
+  expect(new URL(Socket.instances[0].url).searchParams.get('expectedContext')).toBe('A')
+})
+
+it('preserves the no-kubeconfig recovery shell with an explicit empty intent, then blocks reconnect under A', async () => {
+  state.context = ''
+  state.status = 'disconnected'
+  await render()
+  await click('Open')
+  const query = new URL(Socket.instances[0].url).searchParams
+  expect(query.has('expectedContext')).toBe(true)
+  expect(query.get('expectedContext')).toBe('')
+  await act(async () => { Socket.instances[0].open(); Socket.instances[0].onmessage?.({ data: JSON.stringify({ type: 'session', context: '', kubeconfigIsolated: false }) }); vi.advanceTimersByTime(300) })
+  expect(element.textContent).toContain('Context not confirmed')
+  expect(Socket.instances[0].send.mock.calls.filter(([data]) => JSON.parse(data).type === 'input')).toHaveLength(1)
+  state.context = 'A'
+  state.status = 'connected'
+  await render()
+  expect(Socket.instances[0].readyState).toBe(1)
+  await act(async () => Socket.instances[0].close())
+  expect([...element.querySelectorAll('button')].find(b => b.textContent?.trim() === 'Reconnect')?.disabled).toBe(true)
+  await click('New terminal')
+  expect(new URL(Socket.instances[1].url).searchParams.get('expectedContext')).toBe('A')
+})
+
+it('opens a recovery shell for the known context when startup reports a config error', async () => {
+  state.context = 'production@secondary'
+  state.status = 'disconnected'
+  await render()
+  await click('Open')
+  expect(new URL(Socket.instances[0].url).searchParams.get('expectedContext')).toBe('production@secondary')
+  await act(async () => { Socket.instances[0].open(); Socket.instances[0].session('production@secondary'); vi.advanceTimersByTime(300) })
+  expect(Socket.instances[0].send.mock.calls.filter(([data]) => JSON.parse(data).type === 'input')).toHaveLength(1)
+})

package/src/components/dock/LocalTerminalTab.test.tsx

@@ -0,0 +1,122 @@
+// @vitest-environment jsdom
+import { act, useEffect } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { DockProvider, useDock } from '../../../../packages/k8s-ui/src/components/dock/DockContext'
+import type { LocalTerminalTabProps } from '../../../../packages/k8s-ui/src/components/dock/LocalTerminalTab'
+import { LocalTerminalTab } from './LocalTerminalTab'
+import { ToastProvider } from '../../../../packages/k8s-ui/src/components/ui/Toast'
+
+const state = vi.hoisted(() => ({
+  context: 'staging',
+  firstContext: 'production',
+  props: new Map<string, LocalTerminalTabProps>(),
+}))
+vi.mock('../../context/ConnectionContext', () => ({
+  useConnection: () => ({ connection: { context: state.context } }),
+}))
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+}))
+vi.mock('@skyhook-io/k8s-ui', async () => {
+  const dock = await import('../../../../packages/k8s-ui/src/components/dock/DockContext')
+  const { ClusterName } = await import('../../../../packages/k8s-ui/src/components/ui/ClusterName')
+  const { Tooltip } = await import('../../../../packages/k8s-ui/src/components/ui/Tooltip')
+  const { parseContextName } = await import('../../../../packages/k8s-ui/src/utils/context-name')
+  const { useToast } = await import('../../../../packages/k8s-ui/src/components/ui/Toast')
+  return {
+    ...dock, ClusterName, Tooltip, parseContextName, useToast,
+    LocalTerminalTab: (props: LocalTerminalTabProps) => {
+      state.props.set(props.initialCommand!, props)
+      return <div data-testid="terminal-toolbar">{props.toolbarExtra}</div>
+    },
+  }
+})
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+let root: Root
+let element: HTMLDivElement
+function Harness() {
+  const { tabs, addTab } = useDock()
+  useEffect(() => {
+    addTab({ type: 'local-terminal', title: 'Terminal', initialCommand: 'first', localTerminalContext: state.firstContext })
+    addTab({ type: 'local-terminal', title: 'Auth', initialCommand: 'second', localTerminalContext: 'staging' })
+  }, [addTab])
+  return <>{tabs.map(tab => (
+    <section key={tab.id}>
+      <h2 data-tooltip={tab.titleTooltip}>{tab.title}</h2>
+      <LocalTerminalTab tabId={tab.id} title={tab.title} intendedContext={tab.localTerminalContext!} initialCommand={tab.initialCommand} />
+    </section>
+  ))}</>
+}
+async function render() {
+  await act(async () => root.render(<ToastProvider><DockProvider><Harness /></DockProvider></ToastProvider>))
+}
+beforeEach(() => {
+  state.context = 'staging'
+  state.firstContext = 'production'
+  state.props.clear()
+  element = document.createElement('div')
+  document.body.appendChild(element)
+  root = createRoot(element)
+  vi.stubGlobal('ResizeObserver', class { observe() {} disconnect() {} })
+})
+afterEach(async () => {
+  await act(async () => root.unmount())
+  element.remove()
+  vi.unstubAllGlobals()
+})
+
+it('waits for server metadata, labels each tab independently, and notices a UI switch', async () => {
+  await render()
+  expect(element.textContent).toContain('Requested:production')
+  await act(async () => {
+    state.props.get('first')!.onSessionInfo!({ context: 'production', kubeconfigIsolated: true })
+    state.props.get('second')!.onSessionInfo!({ context: 'staging', kubeconfigIsolated: true })
+  })
+  expect([...element.querySelectorAll('h2')].map(el => el.textContent)).toEqual(['Terminal · production', 'Auth · staging'])
+  expect(element.querySelector('[role="status"]')?.getAttribute('aria-label')).toContain('This terminal is for production')
+  expect(element.querySelector('[role="status"]')?.closest('[data-testid="terminal-toolbar"]')).not.toBeNull()
+  state.context = 'production'
+  await render()
+  const sections = element.querySelectorAll('section')
+  expect(sections[0].querySelector('[role="status"]')).toBeNull()
+  expect(sections[0].textContent).toContain('Opened for:production')
+  expect(sections[1].querySelector('[role="status"]')?.getAttribute('aria-label')).toContain('This terminal is for staging')
+  await act(async () => sections[1].querySelector<HTMLButtonElement>('button')!.click())
+  expect([...element.querySelectorAll('h2')].map(el => el.textContent)).toEqual(['Terminal · production', 'Auth · staging', 'Terminal'])
+})
+
+it('marks fallback sessions unconfirmed and replaces labels for a newly connected shell', async () => {
+  await render()
+  await act(async () => state.props.get('second')!.onSessionInfo!({ context: 'staging', kubeconfigIsolated: true }))
+  await act(async () => state.props.get('second')!.onSessionInfo!({ context: '', kubeconfigIsolated: false }))
+  const section = element.querySelectorAll('section')[1]
+  expect(section.textContent).toContain('Auth · context not confirmed')
+  expect(section.textContent).toContain('Context not confirmed')
+  expect(section.querySelector('[role="status"]')).toBeNull()
+  state.context = 'production'
+  await render()
+  expect(section.querySelector('[role="status"]')?.textContent).toContain('Requested context differs')
+  expect(section.querySelector('[role="status"]')?.getAttribute('aria-label')).toContain('Requested for staging; kubeconfig not confirmed')
+  expect(section.querySelector('[role="status"]')?.getAttribute('aria-label')).not.toContain('This terminal is for staging')
+  await act(async () => state.props.get('second')!.onSessionInfo!(null))
+  expect(section.querySelector('h2')?.textContent).toBe('Auth · context not confirmed')
+  await act(async () => state.props.get('second')!.onSessionInfo!({ context: 'staging', kubeconfigIsolated: true }))
+  expect(section.querySelector('h2')?.textContent).toBe('Auth · staging')
+})
+
+it('compares full contexts even when both have the same short cluster name', async () => {
+  state.context = 'gke_project-b_us-east1_production'
+  state.firstContext = 'gke_project-a_us-east1_production'
+  await render()
+  await act(async () => state.props.get('first')!.onSessionInfo!({ context: 'gke_project-a_us-east1_production', kubeconfigIsolated: true }))
+  expect(element.querySelector('h2')?.textContent).toBe('Terminal · production')
+  expect(element.querySelector('h2')?.getAttribute('data-tooltip')).toBe('gke_project-a_us-east1_production')
+  const message = element.querySelector('[role="status"]')?.getAttribute('aria-label')
+  expect(message).toContain('gke_project-a_us-east1_production')
+  expect(message).toContain('gke_project-b_us-east1_production')
+  state.context = ''
+  await render()
+  expect(element.querySelector('[role="status"]')).toBeNull()
+})

package/src/components/dock/LocalTerminalTab.tsx

@@ -1,22 +1,97 @@
-import { LocalTerminalTab as SharedLocalTerminalTab } from '@skyhook-io/k8s-ui'
+import { useCallback, useRef, useState } from 'react'
+import { AlertTriangle } from 'lucide-react'
+import { useQueryClient } from '@tanstack/react-query'
+import { ClusterName, LocalTerminalTab as SharedLocalTerminalTab, Tooltip, parseContextName, useDock, type LocalTerminalSessionInfo } from '@skyhook-io/k8s-ui'
 import { getWsUrl } from '../../api/config'
+import { useConnection } from '../../context/ConnectionContext'
+import { useOpenLocalTerminal } from './DockContext'
 
 interface LocalTerminalTabProps {
+  tabId: string
+  title: string
+  intendedContext?: string
   isActive?: boolean
   initialCommand?: string
 }
 
-export function LocalTerminalTab({ isActive, initialCommand }: LocalTerminalTabProps) {
-  const createSession = () =>
-    Promise.resolve({
-      wsUrl: getWsUrl('/local-terminal'),
-    })
+export function LocalTerminalTab({ tabId, title, intendedContext, isActive, initialCommand }: LocalTerminalTabProps) {
+  const { connection } = useConnection()
+  const queryClient = useQueryClient()
+  const { setTabTitle } = useDock()
+  const openLocalTerminal = useOpenLocalTerminal()
+  const baseTitle = useRef(title)
+  const [sessionInfo, setSessionInfo] = useState<LocalTerminalSessionInfo | null>(null)
+  const handleSessionInfo = useCallback((info: LocalTerminalSessionInfo | null) => {
+    if (!info) return
+    setSessionInfo(info)
+    const suffix = info.kubeconfigIsolated ? parseContextName(info.context).clusterName : 'context not confirmed'
+    setTabTitle(tabId, `${baseTitle.current} · ${suffix}`, info.kubeconfigIsolated ? info.context : undefined)
+  }, [tabId, setTabTitle])
+  const unconfirmed = sessionInfo !== null && !sessionInfo.kubeconfigIsolated
+  const contextNotice = unconfirmed
+    ? `Requested for ${intendedContext || 'no active context'}; kubeconfig not confirmed.`
+    : `This terminal is for ${intendedContext || 'no active context'}.`
+  const context = sessionInfo?.kubeconfigIsolated ? sessionInfo.context : null
+  const mismatched = intendedContext !== undefined && !!connection.context && intendedContext !== connection.context
+  const createSession = async () => {
+    if (intendedContext === undefined) throw new Error('No context selected. Open a new terminal for the selected context.')
+    return { wsUrl: getWsUrl(`/local-terminal?expectedContext=${encodeURIComponent(intendedContext)}`) }
+  }
 
   return (
     <SharedLocalTerminalTab
       isActive={isActive}
       createSession={createSession}
       initialCommand={initialCommand}
+      canConnect={() => intendedContext !== undefined && connection.context === intendedContext && (!!intendedContext || connection.state === 'disconnected')}
+      onConnectionError={() => { void queryClient.invalidateQueries({ queryKey: ['connection-status'] }) }}
+      onSessionInfo={handleSessionInfo}
+      toolbarExtra={
+        <div className="flex items-center gap-2 min-w-0">
+          {context ? (
+            <Tooltip content={<>Radar supplied a temporary kubeconfig for <strong>{context}</strong>. Shell settings and commands can override it.</>} wrapperClassName="min-w-0">
+              <span className="flex items-center gap-1 min-w-0 text-xs text-theme-text-secondary">
+                <span className="shrink-0">Opened for:</span>
+                <ClusterName name={context} noBadge noTooltip />
+              </span>
+            </Tooltip>
+          ) : !sessionInfo && intendedContext ? (
+            <Tooltip content={<>A new shell has been requested for <strong>{intendedContext}</strong>.</>} wrapperClassName="min-w-0">
+              <span className="flex items-center gap-1 min-w-0 text-xs text-theme-text-secondary">
+                <span className="shrink-0">Requested:</span>
+                <ClusterName name={intendedContext} noBadge noTooltip />
+              </span>
+            </Tooltip>
+          ) : intendedContext === undefined ? (
+            <span className="text-xs text-warning-text whitespace-nowrap">No context selected</span>
+          ) : (
+            <Tooltip content={sessionInfo
+              ? 'Radar could not create a temporary kubeconfig. This shell uses the original or inherited kubeconfig.'
+              : 'The server has not reported this terminal’s kubeconfig.'}>
+              <span className="text-xs text-warning-text">Context not confirmed</span>
+            </Tooltip>
+          )}
+          {mismatched && (
+            <Tooltip content={<>Radar is showing <strong>{connection.context}</strong>. {contextNotice} Switch back to reconnect, or open a new terminal.</>} wrapperClassName="shrink-0">
+              <span
+                role="status"
+                aria-label={`Radar is showing ${connection.context}. ${contextNotice}`}
+                className="flex items-center gap-1 text-xs text-warning-text whitespace-nowrap"
+              >
+                <AlertTriangle className="w-3 h-3" />
+                {unconfirmed ? 'Requested context differs' : 'Different context'}
+              </span>
+            </Tooltip>
+          )}
+          {connection.context && (mismatched || intendedContext === undefined) && (
+            <Tooltip content={<>Open a new terminal for <strong>{connection.context}</strong>.</>} wrapperClassName="shrink-0">
+              <button className="btn-brand px-2 py-0.5 text-xs whitespace-nowrap" aria-label={`New terminal for ${connection.context}`} onClick={() => openLocalTerminal()}>
+                New terminal
+              </button>
+            </Tooltip>
+          )}
+        </div>
+      }
     />
   )
 }

package/src/components/helm/ChartBrowser.tsx

@@ -3,7 +3,7 @@ import { Search, RefreshCw, Package, Database, AlertCircle, ExternalLink, Chevro
 import { PaneLoader, Input } from '@skyhook-io/k8s-ui'
 import { clsx } from 'clsx'
 import { useHelmRepositories, useSearchCharts, useUpdateRepository, useUpdateRepositorySilent, useArtifactHubSearch, type ArtifactHubSortOption } from '../../api/client'
-import { useCanHelmWrite } from '../../contexts/CapabilitiesContext'
+import { useCanHelmWrite, useIsAuthEnabled } from '../../contexts/CapabilitiesContext'
 import type { ChartInfo, HelmRepository, ArtifactHubChart, ChartSource } from '../../types'
 import { formatAge } from './helm-utils'
 import { SEVERITY_BADGE } from '../../utils/badge-colors'
@@ -25,12 +25,11 @@ export function ChartBrowser({ onChartSelect }: ChartBrowserProps) {
   const [showVerifiedOnly, setShowVerifiedOnly] = useState(false)
   const [artifactHubSort, setArtifactHubSort] = useState<ArtifactHubSortOption>('relevance')
 
-  // Repo refresh is gated only by `requireHelmWrite` on the backend
-  // (handleUpdateRepository deliberately skips requireCloudRole — it
-  // mutates pod-local chart cache, not cluster state). So the frontend gate
-  // here must NOT include the Cloud role check, or Cloud viewers with
-  // rbac.helm=true would be blocked from a refresh the backend allows.
-  const canHelmWrite = useCanHelmWrite()
+  // Refreshing repositories only touches Radar's own chart cache. With auth on,
+  // any signed-in user may do it; without auth it follows rbac.helm.
+  const helmWrite = useCanHelmWrite()
+  const authEnabled = useIsAuthEnabled()
+  const canHelmWrite = helmWrite || authEnabled
   const helmWriteReason = canHelmWrite ? '' : 'Helm write permissions required. Set rbac.helm=true in the Radar Helm chart values.'
 
   // Local repo hooks