@skyhook-io/radar-app 1.16.3 → 1.17.1

package/src/components/diagnose/ApplyDialog.test.tsx

@@ -3,6 +3,29 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 import { ApplyDialog } from "./parts";
 import { AgentSetupNotice } from "./AgentSetupNotice";
+import { evaluateGitOpsWriteGuard } from "@skyhook-io/k8s-ui/utils/gitops-write-guard";
+
+const target = { kind: "Deployment", group: "apps", namespace: "dev", name: "api" };
+const APPLY_WRITES = [{ scope: "spec" as const }];
+const unmanaged = evaluateGitOpsWriteGuard({ target, owner: null, writes: APPLY_WRITES });
+const argoManaged = evaluateGitOpsWriteGuard({
+  target,
+  owner: { tool: "argocd", kind: "applications", namespace: "argocd", name: "api" },
+  writes: APPLY_WRITES,
+  evidence: {
+    uid: "u",
+    resourceVersion: "1",
+    owner: null,
+    policy: { tool: "argocd", auto: true, selfHeal: true, prune: false, suspended: null },
+    paths: [],
+  },
+});
+
+function applyButton(html: string) {
+  return html
+    .match(/<button\b[^>]*>[\s\S]*?<\/button>/g)
+    ?.find((button) => button.includes("Apply fix"));
+}
 
 vi.mock("@skyhook-io/k8s-ui/components/ui/DialogPortal", () => ({
   DialogPortal: ({ open, children }: { open: boolean; children: ReactNode }) =>
@@ -25,6 +48,7 @@ describe("Apply confirmation context", () => {
           resourceLabel="Deployment dev/api"
           context={context}
           fix="Only after verifying credentials, update the Secret reference."
+          gitOpsGuard={unmanaged}
         />,
       );
       expect(html).toContain("Cluster:");
@@ -48,23 +72,52 @@ describe("Apply confirmation context", () => {
         resourceLabel="Deployment dev/api"
         context="kind-dev"
         fix="Update its configuration"
-        managedBy="Argo CD"
+        gitOpsGuard={argoManaged}
         confidence={0.3}
       />,
     );
+    expect(html).toContain("Argo CD Application argocd/api may revert this change.");
     expect(html).toContain("I understand Argo CD may revert this");
-    const applyButton = html
-      .match(/<button\b[^>]*>[\s\S]*?<\/button>/g)
-      ?.find((button) => button.includes("Apply fix"));
-    expect(applyButton).toContain('disabled=""');
+    expect(applyButton(html)).toContain('disabled=""');
     expect(html).toContain("low confidence");
     expect(html.match(/kubeconfig/g)).toHaveLength(1);
   });
 });
 
+describe("Apply GitOps gate", () => {
+  const props = {
+    open: true,
+    onClose: () => {},
+    onConfirm: () => {},
+    agentLabel: "Local agent",
+    resourceLabel: "Deployment dev/api",
+    context: "kind-dev",
+  };
+
+  it("enables Apply for an unmanaged target without acknowledgement", () => {
+    const html = renderToStaticMarkup(<ApplyDialog {...props} gitOpsGuard={unmanaged} />);
+    expect(applyButton(html)).not.toContain('disabled=""');
+    expect(html).not.toContain('type="checkbox"');
+  });
+
+  it("blocks Apply while ownership is being checked or unknown", () => {
+    const pending = evaluateGitOpsWriteGuard({ target, owner: null, ownerPending: true, writes: APPLY_WRITES });
+    const checking = renderToStaticMarkup(<ApplyDialog {...props} gitOpsGuard={pending} />);
+    expect(checking).toContain("Checking GitOps ownership");
+    expect(applyButton(checking)).toContain('disabled=""');
+    expect(applyButton(renderToStaticMarkup(<ApplyDialog {...props} />))).toContain('disabled=""');
+  });
+});
+
 it("distinguishes local execution from sending resource data to the model provider", () => {
   const html = renderToStaticMarkup(
-    <AgentSetupNotice setupState="needs-install" />,
+    <AgentSetupNotice
+      setupState="needs-install"
+      cliOverride={false}
+      checkingAgents={false}
+      agentsCheckFailed={false}
+      recheckAgents={async () => {}}
+    />,
   );
   expect(html).toContain("Your agent runs locally");
   expect(html).toContain("model provider under your account, not to Radar");

package/src/components/diagnose/ApplyDialog.tsx

@@ -8,6 +8,12 @@ import {
   RefreshCw,
 } from "lucide-react";
 import { DialogPortal } from "@skyhook-io/k8s-ui/components/ui/DialogPortal";
+import { GitOpsWriteWarning } from "@skyhook-io/k8s-ui";
+import {
+  canConfirmGitOpsWrite,
+  gitOpsWriteGuardKey,
+  type GitOpsWriteGuard,
+} from "@skyhook-io/k8s-ui/utils/gitops-write-guard";
 import { parseContextName } from "../../utils/context-name";
 import type { Diagnosis, ApplyMutationOutcome } from "../../api/diagnose";
 import { AIMarkdown, CopyButton } from "./AIMarkdown";
@@ -24,7 +30,8 @@ export function ApplyDialog({
   fix,
   reason,
   precondition,
-  managedBy,
+  gitOpsGuard,
+  onOpenGitOpsOwner,
   confidence,
 }: {
   open: boolean;
@@ -38,7 +45,9 @@ export function ApplyDialog({
   reason?: string;
   /** The condition the agent attached to this step; shown before the operator confirms. */
   precondition?: string;
-  managedBy?: string; // GitOps/Helm owner of the resource, if any
+  /** GitOps/Helm write guard for the target; undefined blocks Apply. */
+  gitOpsGuard?: GitOpsWriteGuard;
+  onOpenGitOpsOwner?: () => void;
   confidence?: number;
 }) {
   const titleId = useId();
@@ -47,14 +56,19 @@ export function ApplyDialog({
   // A GitOps/Helm-managed resource needs an explicit acknowledgment before applying
   // a direct change — it's the canonical footgun (the controller reverts it). Gating
   // (not just warning) makes the user opt into "yes, I know this may be undone."
+  // Apply also waits until ownership has been checked.
   // TODO(SKY-1075): once Radar can connect the user's SCM (GitHub/GitLab/…), replace
   //   direct apply on managed resources with "open a PR against the Git source"
   //   instead — the durable fix. See Linear SKY-1075.
-  const [acked, setAcked] = useState(false);
+  // The guard key the acknowledgment was given for: a different verdict (the
+  // owner resolved, the policy changed) asks again.
+  const guardKey = gitOpsWriteGuardKey(gitOpsGuard);
+  const [ackedKey, setAckedKey] = useState("");
   useEffect(() => {
-    if (open) setAcked(false);
+    if (open) setAckedKey("");
   }, [open]);
-  const applyBlocked = !!managedBy && !acked;
+  const acked = Boolean(guardKey) && ackedKey === guardKey;
+  const applyBlocked = !canConfirmGitOpsWrite(gitOpsGuard, acked);
   return (
     <DialogPortal
       ariaLabelledBy={titleId}
@@ -130,29 +144,13 @@ export function ApplyDialog({
         )}
       </div>
       <div className="shrink-0 space-y-2 p-4">
-        {/* The star warning: when we KNOW a controller owns this resource, a live
-            change reverts on the next reconcile — say so authoritatively. */}
-        {managedBy && (
-          <div className="space-y-2 rounded border border-amber-500/40 bg-amber-500/10 p-3 text-sm text-theme-text-primary">
-            <div className="flex items-start gap-2">
-              <RefreshCw className="mt-0.5 h-4 w-4 shrink-0 text-amber-500" />
-              <span>
-                <span className="font-medium">Managed by {managedBy}.</span>{" "}
-                Unless you turn off auto-sync, a direct change here will be
-                undone within minutes when {managedBy} re-syncs from Git — the
-                durable fix is to change it in Git (the {managedBy} source).
-              </span>
-            </div>
-            <label className="flex cursor-pointer items-center gap-2 pl-6 text-xs text-theme-text-secondary">
-              <input
-                type="checkbox"
-                checked={acked}
-                onChange={(e) => setAcked(e.target.checked)}
-                className="h-3.5 w-3.5 accent-amber-500"
-              />
-              I understand {managedBy} may revert this — apply anyway.
-            </label>
-          </div>
+        {gitOpsGuard && (
+          <GitOpsWriteWarning
+            guard={gitOpsGuard}
+            acknowledged={acked}
+            onAcknowledgedChange={(value) => setAckedKey(value ? guardKey : "")}
+            onOpenOwner={onOpenGitOpsOwner}
+          />
         )}
         {lowConfidence && (
           <div className="flex items-start gap-2 rounded border border-theme-border bg-theme-elevated p-3 text-sm text-theme-text-secondary">

package/src/components/diagnose/DiagnoseContext.test.ts

@@ -8,6 +8,7 @@ import {
   isInvestigationWorkspacePath,
   shouldExitUnavailableWorkspace,
   workspaceRunIDFromPath,
+  resolveSetupState,
 } from "./DiagnoseContext";
 
 describe("investigation workspace routes", () => {
@@ -103,3 +104,45 @@ describe("investigationPanelFillsViewport", () => {
     expect(investigationPanelFillsViewport(1200, 1000)).toBe(true);
   });
 });
+
+describe("resolveSetupState", () => {
+  const base = {
+    available: false,
+    eligibilityResolved: true,
+    eligible: true,
+    supportedAgentCount: 0,
+  };
+
+  it("does not call an unanswered probe a deployment restriction", () => {
+    // eligible starts false and the probe's catch leaves it false, so both the
+    // in-flight and the failed request land here.
+    expect(
+      resolveSetupState({
+        ...base,
+        eligibilityResolved: false,
+        eligible: false,
+      }),
+    ).toBe("unknown");
+  });
+
+  it("reports off only once the probe said eligible: false", () => {
+    expect(resolveSetupState({ ...base, eligible: false })).toBe("off");
+  });
+
+  it("separates a CLI that appeared after boot from none at all", () => {
+    expect(resolveSetupState({ ...base, supportedAgentCount: 1 })).toBe(
+      "needs-restart",
+    );
+    expect(resolveSetupState(base)).toBe("needs-install");
+  });
+
+  it("lets a working engine win over an unresolved probe", () => {
+    expect(
+      resolveSetupState({
+        ...base,
+        available: true,
+        eligibilityResolved: false,
+      }),
+    ).toBe("ready");
+  });
+});

package/src/components/diagnose/DiagnoseContext.tsx

@@ -60,15 +60,31 @@ export type DiagnoseView = "home" | "investigation";
 // Setup readiness of local AI investigations, derived from the agents API:
 //  - "ready":         an agent is installed and the engine is running (available)
 //  - "needs-install": the feature is supported here but no agent CLI is installed
-//  - "needs-restart": a supported agent is now on PATH but Radar booted before it
-//                     existed (the engine is decided once, at startup)
+//  - "needs-restart": a supported agent is installed but investigations are
+//                     still off. The server picks up new installs whenever the
+//                     agent list is fetched, so locally this means RADAR_AI_CLI_BIN
+//                     pins the engine to a file Radar can't run (cliOverride); an
+//                     embedding host may report it when its own runner is down
 //  - "off":           not available in this deployment (proxy/OIDC auth, --no-mcp,
 //                     or an embed host) — no install nudge would help
-export type DiagnoseSetup = "ready" | "needs-install" | "needs-restart" | "off";
+//  - "unknown":       the agents probe hasn't answered (in flight, or it failed
+//                     and was swallowed). Nothing about the machine or the
+//                     deployment is established yet, so say nothing about either
+export type DiagnoseSetup =
+  "ready" | "needs-install" | "needs-restart" | "off" | "unknown";
 
 interface DiagnoseCtx {
   available: boolean; // an agent CLI is present (button/entry gate)
   setupState: DiagnoseSetup; // readiness for the setup nudge (see DiagnoseSetup)
+  // Re-reads the agent list; the server turns investigations on if a CLI was
+  // installed since the last check. Resolves once the new state is applied.
+  recheckAgents: () => Promise<void>;
+  checkingAgents: boolean;
+  // The latest agent check failed to reach the server, so nothing about the
+  // machine is known from it.
+  agentsCheckFailed: boolean;
+  // RADAR_AI_CLI_BIN is set; with "needs-restart" it is what's broken.
+  cliOverride: boolean;
   agentLabel: string; // label of the selected agent, e.g. "Claude Code"
   hosted: boolean; // selected agent runs on the host's backend, not this machine
   agents: AgentInfo[]; // supported agents detected on PATH (for the picker)
@@ -172,6 +188,31 @@ const MIN_APP_LEFT_OF_PANEL = 900;
 // area instead. Radar's own minimum width is about 856px, so this is the
 // drawer's floor: below it the investigation is the screen.
 const MIN_APP_PEEK_BESIDE_OVERLAY = 320;
+// resolveSetupState is the ONE mapping from the agents probe to what every
+// surface renders. Exported so it can be pinned by test, since each state drives
+// a different user-facing claim.
+//
+// "unknown" is not the same as "off". `eligible` starts false and the probe's
+// catch leaves it that way, so without a separate state a pending or failed
+// request reads as a confirmed deployment restriction. A non-empty agent list
+// while the engine is off means a drivable CLI appeared after Radar booted.
+export function resolveSetupState({
+  available,
+  eligibilityResolved,
+  eligible,
+  supportedAgentCount,
+}: {
+  available: boolean;
+  eligibilityResolved: boolean;
+  eligible: boolean;
+  supportedAgentCount: number;
+}): DiagnoseSetup {
+  if (available) return "ready";
+  if (!eligibilityResolved) return "unknown";
+  if (!eligible) return "off";
+  return supportedAgentCount > 0 ? "needs-restart" : "needs-install";
+}
+
 export function investigationPanelFillsViewport(
   viewportWidth: number,
   panelWidth: number,
@@ -452,52 +493,79 @@ function RoutedDiagnoseProvider({
   const narrow = viewportW - width < MIN_APP_LEFT_OF_PANEL;
   const fullWidthForced = investigationPanelFillsViewport(viewportW, width);
 
+  const mountedRef = useRef(true);
   useEffect(() => {
-    let live = true;
-    fetchAgents()
-      .then((r) => {
-        if (!live) return;
-        setConsented(r.consented ?? {});
-        setEligible(!!r.eligible);
-        const supported = r.agents.filter(
-          (a) =>
-            a.supported &&
-            (a.hosted ||
-              (!!a.profiles?.length &&
-                a.profiles.every((p) => !!a.consentSurfaces?.[p]))),
-        );
-        setAvailable(r.enabled && supported.length > 0);
-        setAgents(supported);
-        // Keep the stored pick only if it's still installed; else default to the
-        // first supported agent (matches the server's default selection).
-        const stored = readStored(AGENT_KEY) || "";
-        const next =
-          stored && supported.some((a) => a.name === stored)
-            ? stored
-            : (supported[0]?.name ?? "");
-        setSelectedAgentState(next);
-        const profiles = supported.find((a) => a.name === next)?.profiles ?? [];
-        const storedProfile =
-          (readStored(PROFILE_KEY) as ExecutionProfile) || "safeguarded";
-        if (!profiles.includes(storedProfile) && profiles[0]) {
-          setProfileState(profiles[0]);
-          writeStored(PROFILE_KEY, profiles[0]);
-        }
-        // Model/effort are agent-specific; if the stored agent is gone, its values
-        // don't apply to the fallback agent (e.g. a Codex slug under Claude) — drop them.
-        if (next !== stored) {
-          setModelState("");
-          writeStored(MODEL_KEY, "");
-          setEffortState("");
-          writeStored(EFFORT_KEY, "");
-        }
-        setAgentEligibilityResolved(true);
-      })
-      .catch(() => {});
+    mountedRef.current = true;
     return () => {
-      live = false;
+      mountedRef.current = false;
     };
   }, []);
+  const [checkingAgents, setCheckingAgents] = useState(false);
+  const [agentsCheckFailed, setAgentsCheckFailed] = useState(false);
+  const [cliOverride, setCliOverride] = useState(false);
+  // A click and a window-focus re-check can overlap; only the newest one may
+  // apply its answer, or a stale "nothing installed" could land last.
+  const agentCheckSeq = useRef(0);
+  // The agent in use now, picked by hand or by default. A check compares
+  // against it, not just the stored pick, so seeing the same agent again
+  // keeps the model and effort set for it.
+  const agentInUseRef = useRef(selectedAgent);
+  const recheckAgents = useCallback(async () => {
+    const seq = ++agentCheckSeq.current;
+    const latest = () => mountedRef.current && seq === agentCheckSeq.current;
+    setCheckingAgents(true);
+    try {
+      const r = await fetchAgents();
+      if (!latest()) return;
+      setAgentsCheckFailed(false);
+      setCliOverride(!!r.cliOverride);
+      setConsented(r.consented ?? {});
+      setEligible(!!r.eligible);
+      const supported = r.agents.filter(
+        (a) =>
+          a.supported &&
+          (a.hosted ||
+            (!!a.profiles?.length &&
+              a.profiles.every((p) => !!a.consentSurfaces?.[p]))),
+      );
+      setAvailable(r.enabled && supported.length > 0);
+      setAgents(supported);
+      // Keep the stored pick only if it's still installed; else default to the
+      // first supported agent. Runs always name it, so the server's own default
+      // doesn't apply.
+      const stored = readStored(AGENT_KEY) || "";
+      const next =
+        stored && supported.some((a) => a.name === stored)
+          ? stored
+          : (supported[0]?.name ?? "");
+      setSelectedAgentState(next);
+      const profiles = supported.find((a) => a.name === next)?.profiles ?? [];
+      const storedProfile =
+        (readStored(PROFILE_KEY) as ExecutionProfile) || "safeguarded";
+      if (!profiles.includes(storedProfile) && profiles[0]) {
+        setProfileState(profiles[0]);
+        writeStored(PROFILE_KEY, profiles[0]);
+      }
+      // Model/effort are agent-specific; if the agent changed, its values
+      // don't apply to the new one (e.g. a Codex slug under Claude), so drop them.
+      if (next !== agentInUseRef.current) {
+        setModelState("");
+        writeStored(MODEL_KEY, "");
+        setEffortState("");
+        writeStored(EFFORT_KEY, "");
+      }
+      agentInUseRef.current = next;
+      setAgentEligibilityResolved(true);
+    } catch {
+      // Leaves the previous state in place; "unknown" until a probe answers.
+      if (latest()) setAgentsCheckFailed(true);
+    } finally {
+      if (latest()) setCheckingAgents(false);
+    }
+  }, []);
+  useEffect(() => {
+    void recheckAgents();
+  }, [recheckAgents]);
 
   const setModel = useCallback((v: string) => {
     setModelState(v);
@@ -511,6 +579,7 @@ function RoutedDiagnoseProvider({
     (name: string) => {
       setSelectedAgentState(name);
       writeStored(AGENT_KEY, name);
+      agentInUseRef.current = name;
       const nextProfile = agents.find((agent) => agent.name === name)
         ?.profiles?.[0];
       if (nextProfile) {
@@ -541,15 +610,21 @@ function RoutedDiagnoseProvider({
     ? "standard"
     : (selectedAgentInfo?.consentSurfaces?.[effectiveProfile] ?? "");
 
-  // `agents` holds only supported CLIs (filtered on fetch), so a non-empty list
-  // while the engine is off means a drivable agent appeared on PATH after boot.
-  const setupState: DiagnoseSetup = available
-    ? "ready"
-    : !eligible
-      ? "off"
-      : agents.length > 0
-        ? "needs-restart"
-        : "needs-install";
+  const setupState = resolveSetupState({
+    available,
+    eligibilityResolved: agentEligibilityResolved,
+    eligible,
+    supportedAgentCount: agents.length,
+  });
+
+  // Coming back from a terminal after installing a CLI is when to look again,
+  // so the setup notice clears without the user hunting for a button.
+  useEffect(() => {
+    if (setupState === "ready" || setupState === "off") return;
+    const onFocus = () => void recheckAgents();
+    window.addEventListener("focus", onFocus);
+    return () => window.removeEventListener("focus", onFocus);
+  }, [setupState, recheckAgents]);
 
   useEffect(() => {
     const onResize = () => setViewportW(window.innerWidth);
@@ -701,6 +776,9 @@ function RoutedDiagnoseProvider({
         writeFocusedRunID(run.id, true);
       })
       .catch((e) => {
+        // The picked agent may have been uninstalled since the list was
+        // fetched; refresh it so the picker shows what's installed now.
+        void recheckAgents();
         if (seq !== startSeqRef.current) return;
         setStartFailure({
           message:
@@ -1021,6 +1099,10 @@ function RoutedDiagnoseProvider({
   const value: DiagnoseCtx = {
     available,
     setupState,
+    recheckAgents,
+    checkingAgents,
+    agentsCheckFailed,
+    cliOverride,
     agentLabel,
     hosted,
     agents,

package/src/components/diagnose/DiagnoseSurface.tsx

@@ -502,7 +502,8 @@ export function DiagnoseSurface({
   };
 
   // Feature is eligible here but not runnable yet (no agent installed, or one
-  // appeared after boot) — Home leads with the setup notice instead of an empty list.
+  // found that investigations couldn't start with): Home leads with the setup
+  // notice instead of an empty list.
   const setupPending =
     d.setupState === "needs-install" || d.setupState === "needs-restart";
 
@@ -617,7 +618,13 @@ export function DiagnoseSurface({
     </div>
   ) : setupPending ? (
     <div className="flex-1 overflow-y-auto">
-      <AgentSetupNotice setupState={d.setupState} />
+      <AgentSetupNotice
+        setupState={d.setupState}
+        cliOverride={d.cliOverride}
+        checkingAgents={d.checkingAgents}
+        agentsCheckFailed={d.agentsCheckFailed}
+        recheckAgents={d.recheckAgents}
+      />
     </div>
   ) : (
     <div className="flex flex-1 items-center justify-center px-6 text-center text-sm text-theme-text-tertiary">
@@ -639,7 +646,13 @@ export function DiagnoseSurface({
     </div>
   ) : setupPending ? (
     <div className="mx-auto w-full max-w-3xl px-4 py-8 sm:px-6">
-      <AgentSetupNotice setupState={d.setupState} />
+      <AgentSetupNotice
+        setupState={d.setupState}
+        cliOverride={d.cliOverride}
+        checkingAgents={d.checkingAgents}
+        agentsCheckFailed={d.agentsCheckFailed}
+        recheckAgents={d.recheckAgents}
+      />
     </div>
   ) : (
     <InvestigationHome

package/src/components/diagnose/InvestigationView.tsx

@@ -58,7 +58,9 @@ import {
   type KeyboardEvent,
 } from "react";
 import { useQueryClient } from "@tanstack/react-query";
-import { Badge } from "@skyhook-io/k8s-ui";
+import { useNavigate } from "react-router-dom";
+import { Badge, gitOpsRouteForOwner, type GitOpsWrite } from "@skyhook-io/k8s-ui";
+import { useGitOpsWriteGuard } from "../../hooks/useGitOpsWriteGuard";
 import {
   Send,
   AlertTriangle,
@@ -264,6 +266,8 @@ function captureEvidenceCardLayout(container: HTMLElement) {
   );
 }
 
+const APPLY_WRITES: GitOpsWrite[] = [{ scope: "spec", description: "The proposed change" }];
+
 export function InvestigationView({
   run,
   agentLabel,
@@ -949,6 +953,38 @@ export function InvestigationView({
   // Apply: a user-confirmed remediation turn. Any step is applyable; the chosen
   // step's text is sent so the server binds the apply to it.
   const [confirmApply, setConfirmApply] = useState(false);
+  // The agent's change can touch any field of the target, so the guard
+  // classifies an unknown spec write.
+  const { guard: applyGitOpsGuard, ownership: applyOwnership } =
+    useGitOpsWriteGuard({
+      target: { kind, group: run.group, namespace, name },
+      writes: APPLY_WRITES,
+      declaredManager: run.managedBy,
+      enabled: confirmApply,
+    });
+  const navigateRouter = useNavigate();
+  const {
+    owner: applyOwner,
+    ownerVerified: applyOwnerVerified,
+    helmOwner: applyHelmOwner,
+  } = applyOwnership;
+  const openApplyOwner = useMemo(() => {
+    // A host without resource navigation (Radar Hub's fleet Diagnose panel)
+    // has no route for the owner either.
+    if (!onOpenResource) return undefined;
+    const owner = applyOwner;
+    const helmOwner = applyHelmOwner;
+    if (owner && applyOwnerVerified) {
+      return () => navigateRouter(gitOpsRouteForOwner(owner));
+    }
+    if (helmOwner) {
+      return () =>
+        navigateRouter(
+          `/helm?release=${encodeURIComponent(`${helmOwner.namespace}/${helmOwner.name}`)}`,
+        );
+    }
+    return undefined;
+  }, [applyOwner, applyOwnerVerified, applyHelmOwner, navigateRouter, onOpenResource]);
   const [pendingFix, setPendingFix] = useState("");
   const requestApply = (fix: string) => {
     if (interactionsBlocked) return;
@@ -2546,7 +2582,8 @@ export function InvestigationView({
               ]?.precondition
             : undefined
         }
-        managedBy={run.managedBy}
+        gitOpsGuard={applyGitOpsGuard}
+        onOpenGitOpsOwner={openApplyOwner}
         confidence={turns[lastRemediationIdx]?.diagnosis?.confidence}
       />
     </div>