@skyhook-io/radar-app 1.16.3 → 1.17.0

package/src/components/workload/WorkloadView.tsx

@@ -19,26 +19,32 @@ import {
   type WorkloadExtraTab,
   type RendererOverrides,
   type GitOpsOwnerRef,
-  type GitOpsStatus,
   type HelmOwnerRef,
   type AppRow,
   type ResourceOwnershipContext,
   type ServingResourceDetail,
   type AuditFinding,
+  dedupeResourceRefs,
   gitOpsRouteForOwner,
   gitOpsOwnerFromRelationships,
-  getGitOpsResourceStatus,
   isDiagnoseKind,
   isRolloutKind,
   canSetWorkloadImages,
   isCoreBatchJob,
-  type ManagedImageSource,
+  type SetImageOwnership,
+  SET_IMAGE_WRITES,
+  setImageWrites,
+  setImageSelectionKey,
+  gitOpsWriteEvidencePaths,
+  type SetImageSelection,
   type WorkloadImageTarget,
 } from '@skyhook-io/k8s-ui'
 import type { ServicePortRenderProps } from '@skyhook-io/k8s-ui/components/resources/renderers/ServiceRenderer'
 import { isJobSetV1Alpha2 } from '@skyhook-io/k8s-ui/components/resources/resource-utils-jobset-lws'
 import type { SelectedResource, ResourceRef, Relationships, ResourceWithRelationships } from '../../types'
 import { useHistoryPaging } from './historyPaging'
+import { findInheritedGitOpsLookupRef, useResolvedGitOpsOwner } from '../../hooks/useResolvedGitOpsOwner'
+import { useGitOpsWriteGuard } from '../../hooks/useGitOpsWriteGuard'
 import {
   kindToPlural,
   kindToPluralWithGroup,
@@ -97,6 +103,7 @@ import { RightsizingPanel } from '../resource/RightsizingStrip'
 import { WorkloadCostTab } from '../cost/WorkloadCostTab'
 import { isOpenCostWorkloadKind } from '../cost/kinds'
 import { isRadarFeatureUnsupported } from '../../api/radarFeatures'
+import { useTrafficAvailable } from '../../api/traffic'
 import { useResourceAudit, useResourceIssues, useResources, useTrace, fetchTraceWithProbes, fetchInClusterCapability, runInClusterMerged } from '../../api/client'
 import { AuditAlerts, getRadarUpgradeRequirement, ResourceIssuesSection, ReachabilityView, TraceSummary, InClusterConsentDialog, traceFingerprint, staticPollUnreliable, summarizeInClusterTests, type Trace as NetworkTrace, type InClusterCapability, inClusterConsentGiven, consentRequestRows } from '@skyhook-io/k8s-ui'
 import { WorkloadLogsViewer } from '../logs/WorkloadLogsViewer'
@@ -305,6 +312,10 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
   )
 }
 
+// The kinds the traffic map draws as a node of their own: those that own
+// pods, which it groups under them.
+const TRAFFIC_WORKLOAD_PLURALS = new Set(['deployments', 'statefulsets', 'daemonsets', 'rollouts', 'cronjobs', 'jobs'])
+
 // ============================================================================
 // WORKLOAD VIEW WRAPPER — injects data fetching hooks
 // ============================================================================
@@ -340,7 +351,6 @@ interface ImageTargetOwnershipContext {
   }
   target: WorkloadImageTarget
   response: ResourceWithRelationships<Record<string, unknown>>
-  inheritedResponse?: ResourceWithRelationships<Record<string, unknown>>
 }
 
 function useActionsBarProps(
@@ -560,6 +570,8 @@ export function WorkloadView({
   const [imageTargetOwnership, setImageTargetOwnership] =
     useState<ImageTargetOwnershipContext | null>(null)
   const imageOwnershipRequestRef = useRef(0)
+  // The image guard's evidence is read only once the user opens the dialog.
+  const [imageGuardRequested, setImageGuardRequested] = useState(false)
 
   // Tab state from URL query param — migrate legacy tab names
   const rawTab = searchParams.get('tab')
@@ -674,125 +686,33 @@ export function WorkloadView({
         : null,
     [apiKind, imageTargetOwnership, name, namespace],
   )
-  const relationshipGitopsOwner = useMemo(
-    () => gitOpsOwnerFromRelationships(relationships),
-    [relationships],
-  )
-  const inheritedGitOpsLookupRef = useMemo(
-    () =>
-      findInheritedGitOpsLookupRef(relationships, relationshipGitopsOwner, {
-        kind: apiKind,
-        namespace,
-        name,
-        group: rest.group,
-      }),
-    [relationships, relationshipGitopsOwner, apiKind, namespace, name, rest.group],
-  )
-  const inheritedGitOpsResponse = useResourceWithRelationships<any>(
-    inheritedGitOpsLookupRef ? kindToPluralWithGroup(inheritedGitOpsLookupRef.kind, inheritedGitOpsLookupRef.group ?? '') : '',
-    inheritedGitOpsLookupRef?.namespace ?? '',
-    inheritedGitOpsLookupRef?.name ?? '',
-    inheritedGitOpsLookupRef?.group,
-  )
-  const inheritedGitopsOwner = useMemo(
-    () => gitOpsOwnerFromRelationships(inheritedGitOpsResponse.data?.relationships),
-    [inheritedGitOpsResponse.data?.relationships],
-  )
-  const relationshipHelmOwner = useMemo(
-    () =>
-      nativeHelmOwnerFromRelationships(relationships, resource?.metadata?.namespace ?? namespace),
-    [relationships, resource?.metadata?.namespace, namespace],
-  )
-  const inheritedHelmOwner = useMemo(
-    () =>
-      nativeHelmOwnerFromRelationships(
-        inheritedGitOpsResponse.data?.relationships,
-        inheritedGitOpsResponse.data?.resource?.metadata?.namespace ?? namespace,
-      ),
-    [
-      inheritedGitOpsResponse.data?.relationships,
-      inheritedGitOpsResponse.data?.resource?.metadata?.namespace,
-      namespace,
-    ],
-  )
-  const rawGitopsOwner = relationshipGitopsOwner ?? inheritedGitopsOwner
-  const gitOpsSourceResource = relationshipGitopsOwner
-    ? resource
-    : inheritedGitOpsResponse.data?.resource
-  const helmOwner = relationshipHelmOwner ?? inheritedHelmOwner
-  const helmSourceResource = relationshipHelmOwner
-    ? resource
-    : inheritedGitOpsResponse.data?.resource
-  const targetRelationshipGitopsOwner = useMemo(
-    () => gitOpsOwnerFromRelationships(activeImageTargetOwnership?.response.relationships),
-    [activeImageTargetOwnership?.response.relationships],
-  )
-  const targetInheritedGitopsOwner = useMemo(
-    () =>
-      gitOpsOwnerFromRelationships(
-        activeImageTargetOwnership?.inheritedResponse?.relationships,
-      ),
-    [activeImageTargetOwnership?.inheritedResponse?.relationships],
-  )
-  const targetRawGitopsOwner = targetRelationshipGitopsOwner ?? targetInheritedGitopsOwner
-  const targetRelationshipHelmOwner = nativeHelmOwnerFromRelationships(
-    activeImageTargetOwnership?.response.relationships,
-    activeImageTargetOwnership?.target.namespace ?? namespace,
-  )
-  const targetInheritedHelmOwner = nativeHelmOwnerFromRelationships(
-    activeImageTargetOwnership?.inheritedResponse?.relationships,
-    activeImageTargetOwnership?.target.namespace ?? namespace,
-  )
-  const targetHelmOwner = targetRelationshipHelmOwner ?? targetInheritedHelmOwner
-  const shouldResolveArgoOwner =
-    (rawGitopsOwner?.tool === 'argocd' && !rawGitopsOwner.namespace) ||
-    (targetRawGitopsOwner?.tool === 'argocd' && !targetRawGitopsOwner.namespace)
-  const { data: argoApplications } = useResources<any>('applications', undefined, 'argoproj.io', {
-    enabled: shouldResolveArgoOwner,
+  const workloadOwnership = useResolvedGitOpsOwner({
+    kind: apiKind,
+    group: rest.group,
+    namespace,
+    name,
+    relationships,
+    resource,
+  })
+  const {
+    owner: gitopsOwner,
+    ownerObject: gitopsOwnerObject,
+    ownerVerified: gitOpsOwnerVerified,
+    ownerPending: gitOpsOwnerPending,
+    ownerSource: gitOpsOwnerSource,
+    ownerStatus: gitOpsOwnerStatus,
+    helmOwner,
+    helmSource: helmOwnerSource,
+  } = workloadOwnership
+  const imageTargetOwnershipResolution = useResolvedGitOpsOwner({
+    kind: activeImageTargetOwnership?.target.resource ?? '',
+    group: activeImageTargetOwnership?.target.group,
+    namespace: activeImageTargetOwnership?.target.namespace ?? '',
+    name: activeImageTargetOwnership?.target.name ?? '',
+    relationships: activeImageTargetOwnership?.response.relationships,
+    resource: activeImageTargetOwnership?.response.resource,
+    enabled: Boolean(activeImageTargetOwnership),
   })
-  const gitopsOwner = useMemo(
-    () => resolveGitOpsOwner(rawGitopsOwner, argoApplications),
-    [rawGitopsOwner, argoApplications],
-  )
-  const targetGitopsOwner = useMemo(
-    () => resolveGitOpsOwner(targetRawGitopsOwner, argoApplications),
-    [argoApplications, targetRawGitopsOwner],
-  )
-  const gitopsOwnerGroup = gitopsOwner ? gitOpsOwnerGroup(gitopsOwner) : ''
-  const shouldFetchGitOpsOwner = Boolean(gitopsOwner?.namespace)
-  const gitopsOwnerQuery = useResource<any>(
-    shouldFetchGitOpsOwner ? gitopsOwner!.kind : '',
-    gitopsOwner?.namespace ?? '',
-    gitopsOwner?.name ?? '',
-    gitopsOwnerGroup,
-  )
-  const targetGitopsOwnerGroup = targetGitopsOwner ? gitOpsOwnerGroup(targetGitopsOwner) : ''
-  const shouldFetchTargetGitOpsOwner = Boolean(
-    activeImageTargetOwnership && targetGitopsOwner?.namespace,
-  )
-  const targetGitopsOwnerQuery = useResource<Record<string, unknown>>(
-    shouldFetchTargetGitOpsOwner ? targetGitopsOwner!.kind : '',
-    targetGitopsOwner?.namespace ?? '',
-    targetGitopsOwner?.name ?? '',
-    targetGitopsOwnerGroup,
-    { enabled: shouldFetchTargetGitOpsOwner },
-  )
-  const gitOpsOwnerStatus = useMemo(
-    () => deriveGitOpsOwnerStatus(gitopsOwner, gitopsOwnerQuery.data),
-    [gitopsOwner, gitopsOwnerQuery.data],
-  )
-  const gitOpsOwnerVerified = Boolean(gitopsOwner?.namespace && gitopsOwnerQuery.data)
-  const gitOpsOwnerPending = Boolean(
-    gitopsOwner?.namespace && gitopsOwnerQuery.isLoading && !gitopsOwnerQuery.data,
-  )
-  const gitOpsOwnerSource = useMemo(
-    () => describeGitOpsOwnerSource(rawGitopsOwner, gitOpsSourceResource),
-    [rawGitopsOwner, gitOpsSourceResource],
-  )
-  const helmOwnerSource = useMemo(
-    () => describeHelmOwnerSource(helmOwner, helmSourceResource),
-    [helmOwner, helmSourceResource],
-  )
 
   // Fetch topology for hierarchy building (only when expanded). Polled like
   // useTrace's "drawer feeling live" pattern — without this, a resource
@@ -989,6 +909,23 @@ export function WorkloadView({
     (path: string) => navigateRouter(path),
     [navigateRouter],
   )
+  // Offered for the kinds the traffic map draws as one node, and only once a
+  // traffic source is known to be available on this cluster. A Job something
+  // controls (a CronJob, a JobSet) is not one: the map groups its pods under
+  // that owner, so it is offered only once the Job is known to have none.
+  const isJob = apiKind.toLowerCase() === 'jobs'
+  const controlledJob = isJob && (!resource ||
+    (resource.metadata?.ownerReferences ?? []).some((ref: { controller?: boolean }) => ref.controller))
+  const trafficKind = !!namespace && TRAFFIC_WORKLOAD_PLURALS.has(apiKind.toLowerCase()) && !controlledJob
+  const trafficAvailable = useTrafficAvailable(trafficKind)
+  const openLiveTraffic = useCallback(() => {
+    const params = new URLSearchParams()
+    const namespaces = searchParams.get('namespaces')
+    if (namespaces) params.set('namespaces', namespaces)
+    params.set('focus', `${namespace}/${name}`)
+    navigateRouter({ pathname: '/traffic', search: params.toString() })
+  }, [navigateRouter, searchParams, namespace, name])
+  const offerLiveTraffic = trafficKind && trafficAvailable
   // Drawer TraceSummary CTA → open the full resource view ON the Reachability tab.
   // The generic onExpand navigates to the workload path but drops the query, so we
   // navigate directly to that path WITH ?tab=reachability - the deeplink the
@@ -1013,6 +950,10 @@ export function WorkloadView({
   const loadImagesWithTargetOwnership = useCallback(
     async (params: { kind: string; namespace: string; name: string }) => {
       const request = ++imageOwnershipRequestRef.current
+      setImageGuardRequested(true)
+      // Each open and refresh re-reads the evidence: the owner's sync policy
+      // or ignore rules may have changed since the dialog last opened.
+      void queryClient.invalidateQueries({ queryKey: ['gitops-write-evidence'] })
       const inventory = await baseActionsBarProps.onLoadImages!(params)
       const targetDiffers =
         inventory.target.resource.toLowerCase() !== params.kind.toLowerCase() ||
@@ -1058,14 +999,17 @@ export function WorkloadView({
           group: inventory.target.group,
         },
       )
-      const inheritedResponse = inheritedRef
-        ? await fetchRelationships(
-            kindToPluralWithGroup(inheritedRef.kind, inheritedRef.group ?? ''),
-            inheritedRef.namespace,
-            inheritedRef.name,
-            inheritedRef.group,
-          )
-        : undefined
+      // Warm the cache the target's ownership resolution reads, so the
+      // dialog doesn't open on a still-pending inherited lookup. A failed
+      // read surfaces there as unknown ownership, not as a failed load.
+      if (inheritedRef) {
+        await fetchRelationships(
+          kindToPluralWithGroup(inheritedRef.kind, inheritedRef.group ?? ''),
+          inheritedRef.namespace,
+          inheritedRef.name,
+          inheritedRef.group,
+        ).catch(() => undefined)
+      }
       if (request === imageOwnershipRequestRef.current) {
         setImageTargetOwnership({
           root: {
@@ -1075,52 +1019,74 @@ export function WorkloadView({
           },
           target: inventory.target,
           response,
-          inheritedResponse,
         })
       }
       return inventory
     },
     [baseActionsBarProps.onLoadImages, queryClient, setImageTargetOwnership],
   )
-  const imageGitopsOwner = activeImageTargetOwnership ? targetGitopsOwner : gitopsOwner
-  const imageHelmOwner = activeImageTargetOwnership ? targetHelmOwner : helmOwner
-  const imageGitopsOwnerData = activeImageTargetOwnership
-    ? targetGitopsOwnerQuery.data
-    : gitopsOwnerQuery.data
-  const managedImageSources = useMemo<ManagedImageSource[] | undefined>(() => {
-    if (!activeImageTargetOwnership && inheritedGitOpsLookupRef && (inheritedGitOpsResponse.isPending || inheritedGitOpsResponse.isError)) {
-      return undefined
-    }
-    const sources: ManagedImageSource[] = []
-    if (imageGitopsOwner) {
-      sources.push({
-        type: 'GitOps',
-        label: imageGitopsOwner.namespace
-          ? `${imageGitopsOwner.namespace}/${imageGitopsOwner.name}`
-          : imageGitopsOwner.name,
-        onOpen: imageGitopsOwnerData
-          ? () => handleOpenGitOpsResource(imageGitopsOwner)
+  const imageOwnershipSource = activeImageTargetOwnership ? imageTargetOwnershipResolution : workloadOwnership
+  const imageGuardTarget = activeImageTargetOwnership
+    ? {
+        kind: activeImageTargetOwnership.target.kind,
+        group: activeImageTargetOwnership.target.group,
+        namespace: activeImageTargetOwnership.target.namespace,
+        name: activeImageTargetOwnership.target.name,
+      }
+    : { kind: resource?.kind ?? pluralToKind(apiKind), group: effectiveGroup ?? '', namespace, name }
+  // Once the dialog lists the containers, ask about each by name (so the
+  // evidence can't predate the list) and judge the ones being changed.
+  const [imageSelection, setImageSelection] = useState<SetImageSelection | null>(null)
+  const imageWrites = useMemo(
+    () =>
+      imageSelection
+        ? setImageWrites(imageSelection.changed.length ? imageSelection.changed : imageSelection.containers)
+        : SET_IMAGE_WRITES,
+    [imageSelection],
+  )
+  const imageEvidencePaths = useMemo(
+    () => (imageSelection ? gitOpsWriteEvidencePaths(setImageWrites(imageSelection.containers)) : undefined),
+    [imageSelection],
+  )
+  const { guard: imageGuard, ownership: imageGuardOwnership } = useGitOpsWriteGuard({
+    target: imageGuardTarget,
+    writes: imageWrites,
+    evidencePaths: imageEvidencePaths,
+    ownership: imageOwnershipSource,
+    relationshipsUnavailable: activeImageTargetOwnership
+      ? !activeImageTargetOwnership.response.relationships
+      : Boolean(resource) && !relationships,
+    enabled: imageGuardRequested,
+  })
+  const {
+    owner: imageOwner,
+    helmOwner: imageHelmOwner,
+    ownerVerified: imageOwnerVerified,
+  } = imageGuardOwnership
+  const imageOwnership = useMemo<SetImageOwnership | undefined>(() => {
+    if (!imageGuard) return undefined
+    const owner = imageOwner
+    const helmOwner = imageHelmOwner
+    return {
+      guard: imageGuard,
+      onSelectionChange: setImageSelection,
+      selectionKey: setImageSelectionKey(imageSelection),
+      onOpenOwner: owner
+        ? imageOwnerVerified
+          ? () => handleOpenGitOpsResource(owner)
+          : undefined
+        : helmOwner
+          ? () => handleOpenHelmRelease(helmOwner)
           : undefined,
-      })
-    }
-    if (imageHelmOwner) {
-      sources.push({
-        type: 'Helm',
-        label: `${imageHelmOwner.namespace}/${imageHelmOwner.name}`,
-        onOpen: () => handleOpenHelmRelease(imageHelmOwner),
-      })
     }
-    return sources
   }, [
     handleOpenGitOpsResource,
     handleOpenHelmRelease,
-    activeImageTargetOwnership,
-    imageGitopsOwner,
-    imageGitopsOwnerData,
+    imageGuard,
+    imageOwner,
     imageHelmOwner,
-    inheritedGitOpsLookupRef,
-    inheritedGitOpsResponse.isError,
-    inheritedGitOpsResponse.isPending,
+    imageOwnerVerified,
+    imageSelection,
   ])
   const actionsBarProps = useMemo(
     () => ({
@@ -1130,12 +1096,12 @@ export function WorkloadView({
         : undefined,
       onCompareTo,
       onCompareAcrossClusters,
-      managedImageSources,
+      imageOwnership,
     }),
     [
       baseActionsBarProps,
       loadImagesWithTargetOwnership,
-      managedImageSources,
+      imageOwnership,
       onCompareTo,
       onCompareAcrossClusters,
     ],
@@ -1395,7 +1361,7 @@ export function WorkloadView({
         )}
         hasOperationalIssues={hasOperationalIssues}
         operationalIssuesPending={issuesPending}
-        onOpenGitOpsResource={gitopsOwnerQuery.data ? handleOpenGitOpsResource : undefined}
+        onOpenGitOpsResource={gitopsOwnerObject ? handleOpenGitOpsResource : undefined}
         resolvedGitOpsOwner={gitopsOwner}
         gitOpsOwnerVerified={gitOpsOwnerVerified}
         gitOpsOwnerPending={gitOpsOwnerPending}
@@ -1405,6 +1371,7 @@ export function WorkloadView({
         helmOwnerSource={helmOwnerSource}
         onOpenHelmRelease={handleOpenHelmRelease}
         onNavigateGitOpsPath={handleNavigateGitOpsPath}
+        onOpenLiveTraffic={offerLiveTraffic ? openLiveTraffic : undefined}
       />
       <CreateResourceDialog
         open={duplicateDialogOpen}
@@ -1428,7 +1395,7 @@ export function WorkloadView({
 
 function collectServingRefs(relationships: Relationships | undefined): ResourceRef[] {
   if (!relationships) return []
-  return dedupeRefs([
+  return dedupeResourceRefs([
     ...(relationships.services ?? []),
     ...(relationships.ingresses ?? []),
     ...(relationships.gateways ?? []),
@@ -1436,45 +1403,6 @@ function collectServingRefs(relationships: Relationships | undefined): ResourceR
   ])
 }
 
-function dedupeRefs(refs: ResourceRef[]): ResourceRef[] {
-  const seen = new Set<string>()
-  return refs.filter((ref) => {
-    const key = `${ref.kind}/${ref.namespace}/${ref.name}/${ref.group ?? ''}`
-    if (seen.has(key)) return false
-    seen.add(key)
-    return true
-  })
-}
-
-function resolveGitOpsOwner(
-  owner: GitOpsOwnerRef | null,
-  argoApplications: any[] | undefined,
-): GitOpsOwnerRef | null {
-  if (!owner || owner.namespace || owner.tool !== 'argocd') return owner
-  const matches = (argoApplications ?? []).filter((app) => app?.metadata?.name === owner.name)
-  if (matches.length !== 1) return owner
-  const namespace = matches[0]?.metadata?.namespace
-  return namespace ? { ...owner, namespace } : owner
-}
-
-export function findInheritedGitOpsLookupRef(
-  relationships: Relationships | undefined,
-  directOwner: GitOpsOwnerRef | null,
-  current: ResourceRef,
-): ResourceRef | null {
-  if (directOwner) return null
-  const inheritedManagerRefs = (relationships?.managedBy ?? []).filter(
-    (ref) => !gitOpsOwnerFromRelationships({ managedBy: [ref] }) && !isNativeHelmManager(ref),
-  )
-  const candidates = [
-    relationships?.deployment,
-    ...inheritedManagerRefs,
-    relationships?.owner,
-  ].filter(Boolean) as ResourceRef[]
-
-  return candidates.find((ref) => !isCurrentResource(ref, current)) ?? null
-}
-
 const POD_OWNERSHIP_WORKLOAD_KINDS = new Set([
   'deployments',
   'statefulsets',
@@ -1554,89 +1482,6 @@ function sameWorkload(
   )
 }
 
-function nativeHelmOwnerFromRelationships(
-  relationships: Relationships | undefined,
-  fallbackNamespace: string,
-): HelmOwnerRef | null {
-  const ref = relationships?.managedBy?.[0]
-  if (!ref || !isNativeHelmManager(ref)) return null
-  return {
-    namespace: ref.namespace || fallbackNamespace,
-    name: ref.name,
-  }
-}
-
-function isCurrentResource(ref: ResourceRef, current: ResourceRef): boolean {
-  return (
-    kindToPluralWithGroup(ref.kind, ref.group ?? '') ===
-      kindToPluralWithGroup(current.kind, current.group ?? '') &&
-    ref.namespace === current.namespace &&
-    ref.name === current.name &&
-    (ref.group ?? '') === (current.group ?? '')
-  )
-}
-
-function isNativeHelmManager(ref: ResourceRef): boolean {
-  return ref.kind === 'HelmRelease' && ref.group !== 'helm.toolkit.fluxcd.io'
-}
-
-function describeGitOpsOwnerSource(owner: GitOpsOwnerRef | null, resource: any): string | null {
-  if (!owner || !resource) return null
-  const labels = resource.metadata?.labels ?? {}
-  const annotations = resource.metadata?.annotations ?? {}
-
-  if (owner.tool === 'fluxcd') {
-    const nameKey =
-      owner.kind === 'helmreleases'
-        ? 'helm.toolkit.fluxcd.io/name'
-        : 'kustomize.toolkit.fluxcd.io/name'
-    const nsKey =
-      owner.kind === 'helmreleases'
-        ? 'helm.toolkit.fluxcd.io/namespace'
-        : 'kustomize.toolkit.fluxcd.io/namespace'
-    if (labels[nameKey] || labels[nsKey]) {
-      return `${nameKey}=${labels[nameKey] ?? ''}, ${nsKey}=${labels[nsKey] ?? ''}`
-    }
-  }
-
-  const trackingID = annotations['argocd.argoproj.io/tracking-id']
-  if (trackingID) return `argocd.argoproj.io/tracking-id=${trackingID}`
-  const argoInstance = labels['argocd.argoproj.io/instance']
-  if (argoInstance) return `argocd.argoproj.io/instance=${argoInstance}`
-  return null
-}
-
-function describeHelmOwnerSource(owner: HelmOwnerRef | null, resource: any): string | null {
-  if (!owner || !resource) return null
-  const annotations = resource.metadata?.annotations ?? {}
-  const releaseName = annotations['meta.helm.sh/release-name']
-  const releaseNamespace = annotations['meta.helm.sh/release-namespace']
-  if (releaseName || releaseNamespace) {
-    return `meta.helm.sh/release-name=${releaseName ?? ''}, meta.helm.sh/release-namespace=${releaseNamespace ?? ''}`
-  }
-  return null
-}
-
-function gitOpsOwnerGroup(owner: GitOpsOwnerRef): string {
-  if (owner.tool === 'argocd') return 'argoproj.io'
-  if (owner.kind === 'kustomizations') return 'kustomize.toolkit.fluxcd.io'
-  return 'helm.toolkit.fluxcd.io'
-}
-
-function deriveGitOpsOwnerStatus(owner: GitOpsOwnerRef | null, resource: any): GitOpsStatus | null {
-  if (!owner || !resource || !hasGitOpsStatusPayload(owner, resource)) return null
-  return getGitOpsResourceStatus(owner.kind, resource)
-}
-
-function hasGitOpsStatusPayload(owner: GitOpsOwnerRef, resource: any): boolean {
-  if (owner.kind === 'applications') {
-    const status = resource.status ?? {}
-    return Boolean(status.sync?.status || status.health?.status || status.operationState?.phase)
-  }
-  if (resource.spec?.suspend === true) return true
-  return Array.isArray(resource.status?.conditions) && resource.status.conditions.length > 0
-}
-
 // ============================================================================
 // LOGS TAB — platform-specific (uses data-fetching hooks)
 // ============================================================================

package/src/context/TimelineCustomization.tsx

@@ -0,0 +1,15 @@
+import { createContext, useContext } from 'react'
+import type { ReactNode } from 'react'
+
+/**
+ * A note from the host about how far back the timeline goes. The host owns
+ * the wording and decides when there is one. Standalone Radar serves
+ * everything it holds and never sets it.
+ */
+const TimelineRetentionNoteContext = createContext<ReactNode>(undefined)
+
+export const TimelineRetentionNoteProvider = TimelineRetentionNoteContext.Provider
+
+export function useTimelineRetentionNote(): ReactNode {
+  return useContext(TimelineRetentionNoteContext)
+}