@skyhook-io/radar-app 1.16.2 → 1.17.0

package/src/api/client.ts

@@ -2,6 +2,7 @@ import { canonicalResourceGroup } from '@skyhook-io/k8s-ui/utils/api-resources'
 import { knownKindForPluralWithGroup, pluralToKind } from '@skyhook-io/k8s-ui/utils/navigation'
 import { useEffect, useRef } from 'react'
 import type { KueueAdmissionResponse } from '@skyhook-io/k8s-ui/types/scheduling'
+import type { GitOpsWriteEvidence } from '@skyhook-io/k8s-ui/utils/gitops-write-guard'
 import type {
   AppHistory,
   AppRow,
@@ -22,7 +23,7 @@ import type {
 } from '@skyhook-io/k8s-ui'
 import { useQuery, useMutation, useQueryClient, skipToken } from '@tanstack/react-query'
 import { showApiError, showApiSuccess } from '../components/ui/Toast'
-import { useCanHelmWrite } from '../contexts/CapabilitiesContext'
+import { useIsAuthEnabled, useNamespacedCapabilities } from '../contexts/CapabilitiesContext'
 import type {
   Topology,
   ClusterInfo,
@@ -439,7 +440,7 @@ export interface DashboardResourceCounts {
   ingresses: number;
   gateways?: number;
   routes?: number;
-  nodes: { total: number; ready: number; notReady: number; cordoned: number };
+  nodes: { total: number; ready: number; notReady: number; cordoned: number; removing?: number; removingUnhealthy?: number };
   namespaces: number;
   jobs: { total: number; active: number; succeeded: number; failed: number };
   cronJobs: { total: number; active: number; suspended: number };
@@ -2256,6 +2257,9 @@ export interface AuthMe {
    *  When false, logout clears Radar's cookie but the proxy may re-auth
    *  the same user on the next request. */
   proxyLogoutConfigured?: boolean;
+  /** Connected and the user's access is known: true when their RBAC allows
+   *  reading no namespace at all. Absent when access couldn't be determined. */
+  noNamespaceAccess?: boolean;
 }
 
 export function useAuthMe() {
@@ -2266,6 +2270,24 @@ export function useAuthMe() {
   });
 }
 
+/**
+ * useNamespaceAccess asks the server to run namespace discovery for the caller,
+ * so the answer never depends on whether the permission cache happens to hold
+ * an entry. A user with no access is waiting on an admin; re-check every
+ * minute so the banner clears once a binding lands.
+ */
+export function useNamespaceAccess(enabled: boolean) {
+  return useQuery<AuthMe>({
+    queryKey: ["namespace-access"],
+    queryFn: () => fetchJSON("/auth/me?check=namespaces"),
+    enabled,
+    staleTime: 60000,
+    // Stop only on an explicit false: an absent field means discovery couldn't
+    // answer this time, which says nothing about the user's access.
+    refetchInterval: (query) => (query.state.data?.noNamespaceAccess === false ? false : 60000),
+  });
+}
+
 // Tier ordering for Cloud-role gates. Mirrors radar OSS pkg/auth
 // CloudRole.AtLeast — the frontend must agree with the backend on what
 // "member-or-higher" means; otherwise we'd hide a button the
@@ -2282,16 +2304,12 @@ const CLOUD_ROLE_RANK: Record<string, number> = {
  * present (OSS, OIDC, no role group, OR auth/me is still loading),
  * `canAtLeast` returns true — the gate is strictly additive for
  * Cloud-attributed users, mirroring the backend's `requireCloudRole`
- * semantics. Use for passive content gating (panels, sections); use
- * `useCanHelmAct` (or similar) for *click-prone* surfaces where you
- * need fail-closed behavior during the auth/me round-trip to prevent
- * a viewer from clicking through during the loading window.
+ * semantics. It gates Radar's own features (settings, integrations), never
+ * operations that run as the user, which Kubernetes RBAC decides.
  *
- * Why optimistic during load: the gated empty state ("Your role can't
- * view…") rendered briefly to OSS / kubectl-plugin users before
- * auth/me resolves is a worse regression than a Cloud viewer seeing
- * a content tab populate for a tick before being gated out. Click-
- * prevention belongs in the action-button hook, not here.
+ * Why optimistic during load: a gated empty state rendered briefly to
+ * OSS / kubectl-plugin users before auth/me resolves is a worse regression
+ * than a Cloud viewer seeing content for a tick before being gated out.
  */
 export function useCloudRole() {
   const { data, isLoading } = useAuthMe();
@@ -2308,42 +2326,35 @@ export function useCloudRole() {
 }
 
 /**
- * useCanHelmAct combines the K8s capability gate (rbac.helm=true) and
- * the Cloud role gate (member+) into a single answer for any Helm
- * write or sensitive-read button. Returns { allowed, reason } so the
- * tooltip can explain which gate failed.
- *
- * Cloud role check runs FIRST so the message is actionable for Cloud
- * users — telling them "Helm write permissions required" is wrong if
- * the chart is fine and the actual gate is their viewer role.
+ * useCanHelmAct answers whether Helm write buttons are usable for a release in
+ * `namespace`. With auth on, Helm runs as the signed-in user, so the check is
+ * the user's own Kubernetes RBAC in that namespace (Helm writes each release as
+ * a Secret there); the Cloud role says nothing about cluster access when IdP
+ * groups grant it. Without auth, Helm runs as Radar's ServiceAccount, which
+ * needs the chart's rbac.helm=true.
  */
-export function useCanHelmAct(): { allowed: boolean; reason?: string } {
-  const helmWrite = useCanHelmWrite();
-  const { role, canAtLeast, isLoading } = useCloudRole();
-  // Fail-closed for action buttons during the auth/me round-trip:
-  // a Cloud viewer who clicks during loading would otherwise fire a
-  // real request that gets 403'd. For OSS / kubectl-plugin the
-  // round-trip is sub-ms so this is imperceptible; for Cloud it
-  // prevents the click-through window. Distinct from useCloudRole's
-  // canAtLeast (which is optimistic during loading) because passive
-  // content gates don't have a click-handler to misfire.
-  if (isLoading) {
-    return { allowed: false, reason: "Loading permissions…" };
+export function useCanHelmAct(namespace?: string): { allowed: boolean; reason?: string } {
+  const { canHelmWrite, helmWriteUnknown } = useNamespacedCapabilities(namespace);
+  const authEnabled = useIsAuthEnabled();
+  // Without a namespace answer (still loading, or the check failed) the global
+  // value only says the user can create Secrets somewhere, which would enable
+  // actions the server then refuses.
+  if (authEnabled && helmWriteUnknown) {
+    return { allowed: false, reason: `Couldn't confirm your permissions in ${namespace} yet.` };
   }
-  if (!canAtLeast("member")) {
+  if (canHelmWrite) return { allowed: true };
+  if (authEnabled) {
     return {
       allowed: false,
-      reason: `Your Radar Cloud role (${role ?? "unknown"}) cannot run Helm operations. Ask a member or owner.`,
+      reason: namespace
+        ? `Your Kubernetes permissions don't allow managing Helm releases in ${namespace} (creating Secrets there).`
+        : "Your Kubernetes permissions don't allow managing Helm releases.",
     };
   }
-  if (!helmWrite) {
-    return {
-      allowed: false,
-      reason:
-        "Helm write permissions required. Set rbac.helm=true in the Radar Helm chart values.",
-    };
-  }
-  return { allowed: true };
+  return {
+    allowed: false,
+    reason: "Helm write permissions required. Set rbac.helm=true in the Radar Helm chart values.",
+  };
 }
 
 // Namespaces
@@ -2498,6 +2509,24 @@ export function useGitOpsInsights(
   });
 }
 
+// Field-level evidence behind the GitOps write guard: whether each path is in
+// the object's last client-side apply or owned by its GitOps controller, plus
+// the owner's sync policy. Read server-side because Radar's caches strip both.
+export function fetchGitOpsWriteEvidence(body: {
+  kind: string;
+  group: string;
+  namespace: string;
+  name: string;
+  paths: string[];
+  owner?: { kind: string; group: string; namespace: string; name: string };
+}): Promise<GitOpsWriteEvidence> {
+  return fetchJSON<GitOpsWriteEvidence>("/gitops/write-evidence", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
 // Full Git-rendered desired-vs-live diff for one Argo CD managed resource.
 // ns/name identify the Application; the ref identifies the managed resource.
 // Fetched on demand — the caller mounts this only when the user opens "Full
@@ -2587,18 +2616,55 @@ export function fetchResourceWithRelationships<T>(
   );
 }
 
+/**
+ * How often an open detail view re-checks a resource the server said is gone.
+ * Watch events stop refetching it (see refetchOnResourceEvents), so this is
+ * what finds one recreated under the same name when no event names it, such
+ * as a ConfigMap: the server streams adds only for pods.
+ */
+const GONE_RECHECK_MS = 60_000;
+
+export function goneRecheckInterval(
+  query: { state: { error: unknown } },
+  otherwise: number | false | undefined,
+): number | false | undefined {
+  return isNotFoundError(query.state.error) ? GONE_RECHECK_MS : otherwise;
+}
+
+export function resourceEventKey(kind: string, namespace: string, name: string): string {
+  return `${kind}/${namespace}/${name}`;
+}
+
+/**
+ * Whether a batch of watch events for `kind` refetches this ['resource', kind,
+ * namespace, name, group] query. One the server answered 404 for is refetched
+ * only when an event in the batch names its object; otherwise every change to
+ * the kind would ask again for something that is gone.
+ */
+export function refetchOnResourceEvents(
+  query: { queryKey: readonly unknown[]; state: { error: unknown } },
+  kind: string,
+  namedObjects: ReadonlySet<string>,
+): boolean {
+  if (!isNotFoundError(query.state.error)) return true;
+  const [, , namespace, name] = query.queryKey;
+  return namedObjects.has(resourceEventKey(kind, String(namespace ?? ""), String(name ?? "")));
+}
+
+// `cacheScope` keeps a caller's copy apart from the shared one, for hosts
+// that point one QueryClient at several clusters (see useGitOpsWriteGuard).
 export function useResource<T>(
   kind: string,
   namespace: string,
   name: string,
   group?: string,
-  options?: { enabled?: boolean; refetchInterval?: number | false },
+  options?: { enabled?: boolean; refetchInterval?: number | false; cacheScope?: string },
 ) {
   const query = useQuery<ResourceWithRelationships<T>>({
-    queryKey: ["resource", kind, namespace, name, group],
+    queryKey: ["resource", kind, namespace, name, group, ...(options?.cacheScope ? [options.cacheScope] : [])],
     queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
-    refetchInterval: options?.refetchInterval,
+    refetchInterval: (query) => goneRecheckInterval(query, options?.refetchInterval),
     // Kind still completing its initial sync: stay in loading and poll until
     // it becomes readable instead of erroring out (deep links during startup).
     retry: (failureCount, error) => {
@@ -2626,11 +2692,13 @@ export function useResourceWithRelationships<T>(
   namespace: string,
   name: string,
   group?: string,
+  options?: { cacheScope?: string },
 ) {
   return useQuery<ResourceWithRelationships<T>>({
-    queryKey: ["resource", kind, namespace, name, group],
+    queryKey: ["resource", kind, namespace, name, group, ...(options?.cacheScope ? [options.cacheScope] : [])],
     queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: Boolean(kind && name),
+    refetchInterval: (query) => goneRecheckInterval(query, undefined),
     // Deep-linked detail views can mount while the kind's informer is still
     // completing its initial sync: keep polling instead of erroring out.
     retry: (failureCount, error) => {
@@ -2648,7 +2716,7 @@ export function useResources<T>(
   kind: string,
   namespace?: string,
   group?: string,
-  options?: { enabled?: boolean; refetchInterval?: number | false },
+  options?: { enabled?: boolean; refetchInterval?: number | false; cacheScope?: string },
 ) {
   const params = new URLSearchParams();
   if (namespace) params.set("namespace", namespace);
@@ -2656,7 +2724,7 @@ export function useResources<T>(
   const queryString = params.toString();
 
   return useQuery<T[]>({
-    queryKey: ["resources", kind, group, namespace],
+    queryKey: ["resources", kind, group, namespace, ...(options?.cacheScope ? [options.cacheScope] : [])],
     queryFn: () =>
       fetchJSON(`/resources/${kind}${queryString ? `?${queryString}` : ""}`),
     enabled: (options?.enabled ?? true) && Boolean(kind),
@@ -2971,6 +3039,38 @@ export function useWorkloadHistory(kind: string, namespace: string, name: string
   return query;
 }
 
+export interface ServiceEndpointSlicesResult {
+  items: any[];
+  /** More slices are labeled for the Service than the server returns in one page. */
+  truncated: boolean;
+}
+
+// The EndpointSlices published for one Service, selected server-side by the
+// kubernetes.io/service-name label. A Radar that predates the endpoint settles
+// as unsupported; ServiceRenderer then falls back to the namespace list.
+export function useServiceEndpointSlices(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey, support } = useRadarFeature("serviceEndpointSlices");
+  const query = useQuery<ServiceEndpointSlicesResult>({
+    queryKey: ["service-endpointslices", namespace, name, ...gatedKey],
+    queryFn: ({ signal }) =>
+      guard(() =>
+        fetchJSON<ServiceEndpointSlicesResult>(
+          `/services/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/endpointslices`,
+          signal,
+        ),
+      ),
+    retry: shouldRetryRadarQuery,
+    refetchInterval: (query) =>
+      query.state.error instanceof RadarFeatureUnsupportedError ? false : 30000,
+    enabled,
+  });
+  const { error, refetch } = query;
+  useEffect(() => {
+    if (support === "supported" && error instanceof RadarFeatureUnsupportedError) void refetch();
+  }, [support, error, refetch]);
+  return query;
+}
+
 export function fetchWorkloadHistoryPage(kind: string, namespace: string, name: string, group: string | undefined, beforeSeq: number): Promise<WorkloadHistoryPage> {
   return fetchJSON(workloadHistoryPath(kind, namespace, name, group, beforeSeq));
 }
@@ -4092,7 +4192,7 @@ export function useUpdateResource() {
       });
       if (!response.ok) {
         const error = await readErrorBody(response);
-        const failure = new Error(error.error || `HTTP ${response.status}`);
+        const failure = new ApiError(error.error || `HTTP ${response.status}`, response.status, error);
         // A reviewed apply's failure is shown in the review itself (the
         // changed-after-review notice, or the error), so it gets no toast.
         if (reviewedResourceVersion !== undefined || reviewedContext !== undefined) {
@@ -5322,6 +5422,23 @@ export function useDrainPlan() {
   });
 }
 
+export function useNodeRemovalPlan(name: string | undefined, enabled: boolean) {
+  const { guard, gatedKey } = useRadarFeature('drainPlan')
+  return useQuery<DrainPlan>({
+    queryKey: ['resources', 'node-removal-plan', name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<DrainPlan>(drainPlanPath(name!), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: drainPlanBody({ force: true, deleteEmptyDirData: true }),
+      signal,
+    })),
+    enabled: enabled && Boolean(name),
+    staleTime: ISSUES_REFRESH_INTERVAL_MS,
+    refetchInterval: (query) => query.state.error instanceof RadarFeatureUnsupportedError ? false : ISSUES_REFRESH_INTERVAL_MS,
+    retry: shouldRetryRadarQuery,
+  })
+}
+
 export function useDrainNode() {
   const queryClient = useQueryClient();
 
@@ -5457,14 +5574,10 @@ export function useHelmRelease(
 }
 
 // Get manifest for a Helm release (optionally at a specific revision).
-// `enabled` lets callers skip the query when the user's Cloud role
-// would 403 the read — saves a round-trip and avoids a transient
-// "error" state that the role-gated empty panel doesn't need.
 export function useHelmManifest(
   namespace: string,
   name: string,
   revision?: number,
-  enabled = true,
 ) {
   const params = revision ? `?revision=${revision}` : "";
   return useQuery<string>({
@@ -5479,12 +5592,12 @@ export function useHelmManifest(
       }
       return response.text();
     },
-    enabled: Boolean(namespace && name && enabled),
+    enabled: Boolean(namespace && name),
     staleTime: 60000, // 1 minute
   });
 }
 
-// Get values for a Helm release. `enabled` see useHelmManifest.
+// Get values for a Helm release.
 export function useHelmValues(
   namespace: string,
   name: string,
@@ -5505,7 +5618,7 @@ export function useHelmValues(
   });
 }
 
-// Get diff between two revisions. `enabled` see useHelmManifest.
+// Get diff between two revisions.
 export function useHelmManifestDiff(
   namespace: string,
   name: string,

package/src/api/cnpg.ts

@@ -0,0 +1,95 @@
+import { useQuery } from '@tanstack/react-query'
+import type { CNPGWorkspaceResponse, TimelineEvent } from '@skyhook-io/k8s-ui'
+import { fetchJSON } from './client'
+
+// /api/cnpg/workspace
+//
+// Every CloudNativePG object the caller may read, with per-kind coverage, the
+// CNPG issues on them and the no-schedule audit finding. One query feeds the
+// workspace screens, the Resources sidebar counts and the composed summaries,
+// so they can never disagree about what they count.
+export function useCNPGWorkspace(namespaces: string[], options?: { enabled?: boolean }) {
+  const ns = [...namespaces].sort().join(',')
+  return useQuery<CNPGWorkspaceResponse>({
+    queryKey: ['cnpg', 'workspace', ns],
+    queryFn: ({ signal }) => fetchJSON<CNPGWorkspaceResponse>(`/cnpg/workspace${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal),
+    enabled: options?.enabled ?? true,
+    staleTime: 10_000,
+    refetchInterval: 30_000,
+    placeholderData: (prev) => prev,
+  })
+}
+
+export interface CNPGOperatorCoverage {
+  state: 'full' | 'partial' | 'denied' | 'syncing' | 'error'
+  deniedNamespaces?: string[]
+}
+
+export interface CNPGOperatorComponent {
+  role: 'operator' | 'plugin'
+  pluginName?: string
+  namespace: string
+  deployment: string
+  image?: string
+  version?: string
+  readyReplicas: number | null
+  replicas: number | null
+}
+
+export interface CNPGOperatorConfig {
+  kind: 'ConfigMap' | 'Secret'
+  namespace: string
+  name: string
+  purpose: 'operator' | 'monitoring'
+  exists?: boolean | null
+  readable?: boolean
+  reason?: string
+  data?: Record<string, string>
+}
+
+export interface CNPGOperatorResponse {
+  coverage: { deployments: CNPGOperatorCoverage; services: CNPGOperatorCoverage }
+  components: CNPGOperatorComponent[]
+  config: CNPGOperatorConfig[]
+}
+
+// /api/cnpg/operator
+//
+// Operator and plugin workloads plus where the operator's configuration lives.
+// Deliberately not filtered by the namespace view filter: the operator runs in
+// its own namespace, which users rarely have selected.
+export function useCNPGOperator(options?: { enabled?: boolean }) {
+  return useQuery<CNPGOperatorResponse>({
+    queryKey: ['cnpg', 'operator'],
+    queryFn: ({ signal }) => fetchJSON<CNPGOperatorResponse>('/cnpg/operator', signal),
+    enabled: options?.enabled ?? true,
+    staleTime: 30_000,
+    refetchInterval: 60_000,
+  })
+}
+
+export interface CNPGClusterActivityResponse {
+  events: TimelineEvent[]
+  oldest: string | null
+  attributionSince: string | null
+  truncated: boolean
+}
+
+// /api/cnpg/clusters/{ns}/{name}/activity
+//
+// The Cluster's history together with its instance Pods and every CNPG object
+// attributed to it, including ones since deleted.
+export function useCNPGClusterActivity(namespace: string, name: string, sinceHours = 24) {
+  return useQuery<CNPGClusterActivityResponse>({
+    queryKey: ['cnpg', 'activity', namespace, name, sinceHours],
+    queryFn: ({ signal }) => {
+      const since = new Date(Date.now() - sinceHours * 3600_000).toISOString()
+      return fetchJSON<CNPGClusterActivityResponse>(
+        `/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/activity?since=${encodeURIComponent(since)}&limit=500`,
+        signal,
+      )
+    },
+    staleTime: 10_000,
+    refetchInterval: 30_000,
+  })
+}

package/src/api/diagnose.test.ts

@@ -3,6 +3,7 @@ import {
   addTurn,
   createRun,
   DiagnoseError,
+  fetchAgents,
   subscribeRun,
   type DiagnoseStreamEvent,
 } from "./diagnose";
@@ -367,3 +368,42 @@ describe("refused requests", () => {
     expect((await startError()).message).toBe(message);
   });
 });
+
+describe("fetchAgents agents normalisation", () => {
+  const withFetch = async (body: unknown) => {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify(body), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      })) as typeof fetch;
+    try {
+      return await fetchAgents();
+    } finally {
+      globalThis.fetch = original;
+    }
+  };
+
+  it("turns the server's null agent list into an empty array", async () => {
+    // Older servers send null for a machine with no CLI installed, the case
+    // callers most need to survive.
+    const r = await withFetch({
+      agents: null,
+      enabled: false,
+      eligible: true,
+      consented: {},
+    });
+    expect(r.agents).toEqual([]);
+    expect(r.eligible).toBe(true);
+  });
+
+  it("leaves a populated list alone", async () => {
+    const r = await withFetch({
+      agents: [{ name: "claude", label: "Claude Code", supported: true }],
+      enabled: true,
+      eligible: true,
+      consented: {},
+    });
+    expect(r.agents.map((a) => a.name)).toEqual(["claude"]);
+  });
+});

package/src/api/diagnose.ts

@@ -29,6 +29,10 @@ export interface AgentsResponse {
   // "install an agent to enable this" (eligible && !enabled) apart from "not
   // available here" (auth/cloud/--no-mcp). Absent on older servers / embed hosts.
   eligible?: boolean;
+  // cliOverride: RADAR_AI_CLI_BIN is set, pinning the engine to one CLI. With
+  // CLIs detected and investigations still off, that variable is what's broken.
+  // Absent on older servers and embed hosts.
+  cliOverride?: boolean;
   // Machine-scoped consent per disclosure surface, recorded server-side
   // (~/.radar) — one acknowledgment covers the web panel and the CLI.
   consented?: Record<string, boolean>;
@@ -257,7 +261,14 @@ export async function fetchAgents(
     signal,
   });
   if (!res.ok) throw new Error(`agents: ${res.status}`);
-  return res.json();
+  const body = (await res.json()) as AgentsResponse & {
+    agents: AgentInfo[] | null;
+  };
+  // Older Radar servers send "no agent found" as JSON null, not []. This client
+  // also runs against servers of other versions, and that is the single most
+  // common response on a machine with no CLI, so normalise here rather than in
+  // every caller that reaches for .filter.
+  return { ...body, agents: body.agents ?? [] };
 }
 
 /**

package/src/api/radarFeatures.render.test.tsx

@@ -4,7 +4,7 @@ import { createRoot } from 'react-dom/client'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { getRadarUpgradeRequirement } from '@skyhook-io/k8s-ui'
-import { ApiError, isNotFoundError, useApplications, useCapacityPoolDetail, useDrainPlan, usePodEnvironment, useWorkloadHistory } from './client'
+import { ApiError, isNotFoundError, useApplications, useCapacityPoolDetail, useDrainPlan, useNodeRemovalPlan, usePodEnvironment, useWorkloadHistory } from './client'
 import { getApiBase } from './config'
 import { usePolicyResource } from './policy'
 import { isRadarFeatureUnsupported } from './radarFeatures'
@@ -153,6 +153,24 @@ function DrainPlanProbe() {
   return null
 }
 
+function RemovalPlanProbe() {
+  const { error } = useNodeRemovalPlan('worker-1', true)
+  return <span>{getRadarUpgradeRequirement(error) ? 'upgrade' : 'pending'}</span>
+}
+
+it('does not poll an old Radar for removal details', async () => {
+  host.radarVersion = 'v1.13.1'
+  await render(<RemovalPlanProbe />)
+  expect(element.textContent).toBe('upgrade')
+  expect(asked('/drain-plan')).toBe(false)
+})
+
+it('requests removal details once the drain-plan feature is supported', async () => {
+  client.setQueryData(['capabilities'], { features: { resourceIssues: true } })
+  await render(<RemovalPlanProbe />)
+  expect(asked('/drain-plan')).toBe(true)
+})
+
 it('never asks a Radar older than v1.14 for a drain plan', async () => {
   host.radarVersion = 'v1.13.1'
   await render(<DrainPlanProbe />)

package/src/api/radarFeatures.ts

@@ -35,6 +35,9 @@ export const RADAR_FEATURES = {
   drainPlan: { label: 'Drain plans', minimumVersion: 'v1.14.0' },
   applications: { label: 'Applications', minimumVersion: 'v1.7.7' },
   workloadHistory: { label: 'Workload history', flag: 'workloadHistory', flagShippedWithEndpoint: true },
+  serviceEndpointSlices: { label: 'Service EndpointSlice inventories', flag: 'serviceEndpointSlices', flagShippedWithEndpoint: true },
+  trafficRecords: { label: 'Flow records for a graph selection', flag: 'trafficRecords', flagShippedWithEndpoint: true },
+  gitopsWriteEvidence: { label: 'GitOps revert warnings', flag: 'gitopsWriteEvidence', flagShippedWithEndpoint: true },
 } as const satisfies Record<string, RadarFeatureSpec>
 
 export type RadarFeature = keyof typeof RADAR_FEATURES

package/src/api/timelineSource.ts

@@ -423,7 +423,7 @@ export async function fetchRetainedDelta(
 // Mirrors the Go store's TimelineEvent.IsManaged (pkg/timeline/types.go):
 // a resource managed by another — owned, or one of the churn kinds. Keep the
 // two predicates in lockstep.
-function isManagedTimelineEvent(e: TimelineEvent): boolean {
+export function isManagedTimelineEvent(e: TimelineEvent): boolean {
   return e.owner != null || e.kind === 'ReplicaSet' || e.kind === 'Pod' || e.kind === 'Event'
 }
 

package/src/api/traffic.sources.test.ts

@@ -0,0 +1,55 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { QueryClient } from '@tanstack/react-query'
+import { detectTrafficSourcesAgain, fetchTrafficSources } from './traffic'
+
+const found = { detected: [{ name: 'hubble', status: 'available' }], notDetected: [] }
+const none = { detected: [], notDetected: [{ name: 'hubble', status: 'not_found' }] }
+
+function serve(responses: Record<string, unknown>, delays: Record<string, number> = {}) {
+  const calls: string[] = []
+  vi.stubGlobal('fetch', vi.fn(async (url: string, init?: RequestInit) => {
+    const path = url.slice(url.indexOf('/traffic/'))
+    calls.push(path)
+    if (delays[path]) {
+      await new Promise((resolve, reject) => {
+        const timer = setTimeout(resolve, delays[path])
+        init?.signal?.addEventListener('abort', () => { clearTimeout(timer); reject(new DOMException('aborted', 'AbortError')) })
+      })
+    }
+    return new Response(JSON.stringify(responses[path]), { status: 200 })
+  }))
+  return calls
+}
+
+afterEach(() => vi.unstubAllGlobals())
+
+describe('fetchTrafficSources', () => {
+  it('reuses a recent detection that found a source', async () => {
+    const calls = serve({ '/traffic/sources?recent=1': found })
+    const sources = await fetchTrafficSources(new QueryClient(), false)
+    expect(sources).toEqual(found)
+    expect(calls).toEqual(['/traffic/sources?recent=1'])
+  })
+
+  it('detects afresh before showing a recent detection that found none', async () => {
+    const calls = serve({ '/traffic/sources?recent=1': none, '/traffic/sources': found })
+    const sources = await fetchTrafficSources(new QueryClient(), false)
+    expect(sources).toEqual(found)
+    expect(calls).toEqual(['/traffic/sources?recent=1', '/traffic/sources'])
+  })
+})
+
+describe('detectTrafficSourcesAgain', () => {
+  it('detects afresh even while a recent detection is being fetched', async () => {
+    const calls = serve({ '/traffic/sources?recent=1': found, '/traffic/sources': none }, { '/traffic/sources?recent=1': 50 })
+    const client = new QueryClient()
+    void client.fetchQuery({ queryKey: ['traffic-sources'], queryFn: ({ signal }) => fetchTrafficSources(client, false, signal) }).catch(() => {})
+    const sources = await detectTrafficSourcesAgain(client)
+    expect(sources).toEqual(none)
+    expect(calls).toContain('/traffic/sources')
+    // The abandoned recent detection must not land afterwards.
+    await new Promise(resolve => setTimeout(resolve, 80))
+    expect(client.getQueryData(['traffic-sources'])).toEqual(none)
+    expect(client.getQueryData(['traffic-sources', 'recent'])).toEqual(none)
+  })
+})