@skyhook-io/radar-app 1.8.1 → 1.8.3

package/src/components/helm/ValuesViewer.tsx

@@ -1,4 +1,4 @@
-import { useState, useCallback } from 'react'
+import { useState, useCallback, useEffect } from 'react'
 import { Copy, Check, Settings, Pencil, X, Eye, Play, Loader2 } from 'lucide-react'
 import { PaneLoader } from '@skyhook-io/k8s-ui'
 import { clsx } from 'clsx'
@@ -21,6 +21,8 @@ interface ValuesViewerProps {
   // Required for editing
   namespace?: string
   name?: string
+  revision?: number
+  currentRevision?: number
   onApplySuccess?: () => void
 }
 
@@ -33,6 +35,8 @@ export function ValuesViewer({
   copied,
   namespace,
   name,
+  revision,
+  currentRevision,
   onApplySuccess,
 }: ValuesViewerProps) {
   const [isEditing, setIsEditing] = useState(false)
@@ -44,8 +48,9 @@ export function ValuesViewer({
   const previewMutation = useHelmPreviewValues()
   const applyMutation = useHelmApplyValues()
   const { allowed: canHelmWrite, reason: helmActReason } = useCanHelmAct()
+  const isHistoricalRevision = typeof revision === 'number' && typeof currentRevision === 'number' && revision !== currentRevision
 
-  const canEdit = Boolean(namespace && name) && canHelmWrite
+  const canEdit = Boolean(namespace && name) && canHelmWrite && !isHistoricalRevision
 
   const displayValues = showAllValues && values?.computed ? values.computed : values?.userSupplied
   const isEmpty = !displayValues || Object.keys(displayValues).length === 0
@@ -72,6 +77,12 @@ export function ValuesViewer({
     setShowPreview(false)
   }, [])
 
+  useEffect(() => {
+    if (isHistoricalRevision && isEditing) {
+      handleCancelEdit()
+    }
+  }, [isHistoricalRevision, isEditing, handleCancelEdit])
+
   // Parse YAML and validate
   const parseYaml = useCallback((yamlStr: string): Record<string, unknown> | null => {
     try {
@@ -86,7 +97,7 @@ export function ValuesViewer({
 
   // Preview changes
   const handlePreview = useCallback(async () => {
-    if (!namespace || !name) return
+    if (!namespace || !name || isHistoricalRevision) return
     const parsed = parseYaml(editedYaml)
     if (!parsed) return
 
@@ -101,11 +112,11 @@ export function ValuesViewer({
     } catch {
       // Error is handled by mutation
     }
-  }, [namespace, name, editedYaml, parseYaml, previewMutation])
+  }, [namespace, name, isHistoricalRevision, editedYaml, parseYaml, previewMutation])
 
   // Apply changes
   const handleApply = useCallback(async () => {
-    if (!namespace || !name) return
+    if (!namespace || !name || isHistoricalRevision) return
     const parsed = parseYaml(editedYaml)
     if (!parsed) return
 
@@ -120,11 +131,11 @@ export function ValuesViewer({
     } catch {
       // Error is handled by mutation
     }
-  }, [namespace, name, editedYaml, parseYaml, applyMutation, handleCancelEdit, onApplySuccess])
+  }, [namespace, name, isHistoricalRevision, editedYaml, parseYaml, applyMutation, handleCancelEdit, onApplySuccess])
 
   // Apply from preview modal
   const handleApplyFromPreview = useCallback(async () => {
-    if (!previewData || !namespace || !name) return
+    if (!previewData || !namespace || !name || isHistoricalRevision) return
     try {
       await applyMutation.mutateAsync({
         namespace,
@@ -137,7 +148,7 @@ export function ValuesViewer({
     } catch {
       // Error is handled by mutation
     }
-  }, [previewData, namespace, name, applyMutation, handleCancelEdit, onApplySuccess])
+  }, [previewData, namespace, name, isHistoricalRevision, applyMutation, handleCancelEdit, onApplySuccess])
 
   if (isLoading) {
     return <PaneLoader label="Loading values…" className="h-32" />
@@ -147,7 +158,12 @@ export function ValuesViewer({
     return (
       <div className="p-4">
         <div className="flex items-center justify-between mb-3">
-          <span className="text-sm font-medium text-theme-text-secondary">Values</span>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-theme-text-secondary">Values</span>
+            {isHistoricalRevision && (
+              <span className="badge-sm bg-theme-hover/50 text-theme-text-secondary">revision {revision}</span>
+            )}
+          </div>
           <div className="flex items-center gap-2">
             <ToggleButton showAll={showAllValues} onToggle={onToggleAllValues} disabled={isEditing} />
             {canEdit && (
@@ -161,6 +177,11 @@ export function ValuesViewer({
             )}
           </div>
         </div>
+        {isHistoricalRevision && (
+          <div className="mb-3 rounded border border-theme-border bg-theme-elevated/40 px-3 py-2 text-xs text-theme-text-secondary">
+            Viewing historical values. Switch back to the latest revision before editing or applying changes.
+          </div>
+        )}
         <div className="flex flex-col items-center justify-center h-32 text-theme-text-tertiary gap-2">
           <Settings className="w-8 h-8 text-theme-text-disabled" />
           <span>{showAllValues ? 'No computed values' : 'No user-supplied values'}</span>
@@ -179,6 +200,9 @@ export function ValuesViewer({
           <span className="text-sm font-medium text-theme-text-secondary">
             {isEditing ? 'Editing Values' : showAllValues ? 'All Values (Computed)' : 'User-Supplied Values'}
           </span>
+          {isHistoricalRevision && !isEditing && (
+            <span className="badge-sm bg-theme-hover/50 text-theme-text-secondary">revision {revision}</span>
+          )}
           {isEditing && (
             <span className="badge-sm bg-amber-500/20 text-amber-400 border-amber-500/30">
               unsaved
@@ -218,7 +242,7 @@ export function ValuesViewer({
               </button>
               <button
                 onClick={handlePreview}
-                disabled={!!yamlError || previewMutation.isPending}
+                disabled={!!yamlError || previewMutation.isPending || isHistoricalRevision}
                 className="flex items-center gap-1 px-2 py-1 text-xs text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded border border-theme-border disabled:opacity-50 disabled:cursor-not-allowed"
               >
                 {previewMutation.isPending ? (
@@ -231,7 +255,7 @@ export function ValuesViewer({
               <Tooltip content={!canHelmWrite ? helmActReason : ''}>
               <button
                 onClick={handleApply}
-                disabled={!!yamlError || applyMutation.isPending || !canHelmWrite}
+                disabled={!!yamlError || applyMutation.isPending || !canHelmWrite || isHistoricalRevision}
                 className="flex items-center gap-1 px-2.5 py-1 text-xs btn-brand rounded disabled:cursor-not-allowed disabled:pointer-events-none"
               >
                 {applyMutation.isPending ? (
@@ -247,6 +271,12 @@ export function ValuesViewer({
         </div>
       </div>
 
+      {isHistoricalRevision && (
+        <div className="mb-3 rounded border border-theme-border bg-theme-elevated/40 px-3 py-2 text-xs text-theme-text-secondary">
+          Viewing historical values. Switch back to the latest revision before editing or applying changes.
+        </div>
+      )}
+
       {/* Error message */}
       {yamlError && (
         <div className="mb-3 px-3 py-2 text-xs text-red-400 bg-red-500/10 border border-red-500/30 rounded">

package/src/components/home/TrafficSummary.tsx

@@ -100,7 +100,7 @@ export function TrafficSummary({ data, onNavigate }: TrafficSummaryProps) {
       <div className="flex items-center justify-between px-5 py-3 border-b border-theme-border/50">
         <div className="flex items-center gap-2">
           <Activity className="w-4 h-4 text-theme-text-tertiary" />
-          <span className="text-xs font-semibold uppercase tracking-wider text-theme-text-secondary">Traffic</span>
+          <span className="text-xs font-semibold uppercase tracking-wider text-theme-text-secondary">Live Traffic</span>
         </div>
         {hasFlows && (
           <span className="text-[11px] text-theme-text-tertiary">
@@ -145,7 +145,7 @@ export function TrafficSummary({ data, onNavigate }: TrafficSummaryProps) {
       </div>
 
       <div className="px-4 py-1.5 border-t border-theme-border/50 flex items-center justify-end gap-1.5 text-[10px] font-semibold uppercase tracking-wider text-theme-text-secondary group-hover:text-theme-text-primary transition-colors">
-        Open Traffic
+        Open Live Traffic
         <ArrowRight className="w-3.5 h-3.5 transition-transform group-hover:translate-x-0.5" />
       </div>
       </div>

package/src/components/home/mcpToolCatalog.ts

@@ -109,9 +109,9 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'diagnose',
-    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers get status summary + parsed related issues.',
+    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues.',
     params: [
-      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, or helmrelease' },
+      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, or Flux HelmRelease' },
       { arg: 'namespace', required: true, desc: 'resource namespace' },
       { arg: 'name', required: true, desc: 'resource name' },
       { arg: 'container', desc: 'specific container (defaults to all)' },
@@ -126,7 +126,7 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_changes',
-    desc: 'Recent resource creates, updates, and deletes from the cluster timeline. Use to investigate what changed before an incident.',
+    desc: 'Recent meaningful changes from the Kubernetes timeline plus native Helm deployment history (source=helm). Includes failed upgrades, rollbacks, and current Helm revisions; sourcesErrored marks partial source failures.',
     params: [
       { arg: 'namespace', desc: 'filter to a specific namespace' },
       { arg: 'kind', desc: 'filter to a resource kind (e.g. Deployment)' },
@@ -147,18 +147,18 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'list_helm_releases',
-    desc: 'All Helm releases in the cluster with status and resource health — name, namespace, chart, version.',
+    desc: 'All Helm releases with status, resource health, storage namespace, Flux ownership, current lastOperation, and capped operation trails for failed upgrades, rollbacks, or stuck pending operations.',
     params: [{ arg: 'namespace', desc: 'filter to a specific namespace' }],
   },
   {
     name: 'get_helm_release',
-    desc: 'Detailed Helm release info with owned resources and their status. Optionally include values, revision history, or a manifest diff between revisions.',
+    desc: 'Detailed Helm release info with owned resources, health, Flux ownership, current lastOperation, hooks, and failed/running hook diagnostics with live Job/Pod/Event/redacted-log evidence when available.',
     params: [
-      { arg: 'namespace', required: true, desc: 'release namespace' },
+      { arg: 'namespace', required: true, desc: 'Helm storage namespace; use storageNamespace from list_helm_releases when present' },
       { arg: 'name', required: true, desc: 'release name' },
-      { arg: 'include', desc: 'values, history, diff' },
-      { arg: 'diff_revision_1', desc: 'first revision for diff' },
-      { arg: 'diff_revision_2', desc: 'second revision for diff (defaults to current)' },
+      { arg: 'include', desc: 'values, history, operations, diff, values_diff, notes_diff, resource_diff' },
+      { arg: 'diff_revision_1', desc: 'first revision for any diff include' },
+      { arg: 'diff_revision_2', desc: 'second revision for any diff include (defaults to current)' },
     ],
   },
   {
@@ -172,7 +172,7 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'issues',
-    desc: 'Ranked list of what is broken right now — failing workloads, dangling references, scheduling blockers, and false CRD conditions. Live operational state (distinct from get_cluster_audit posture).',
+    desc: 'Ranked list of what is broken right now — failing workloads, active native Helm release failures or stuck pending operations, dangling references, scheduling blockers, and false CRD conditions. Native Helm rows use group=helm.sh.',
     params: [
       { arg: 'namespace', desc: 'filter to one namespace' },
       { arg: 'severity', desc: 'comma-separated: critical, warning' },

package/src/components/nav/PrimaryNavRail.tsx

@@ -45,7 +45,7 @@ const NAV_ITEMS: NavItemDef[] = [
   { view: 'topology', icon: Network, label: 'Topology' },
   { view: 'applications', icon: Boxes, label: 'Applications' },
   { view: 'timeline', icon: Clock, label: 'Timeline' },
-  { view: 'traffic', icon: Activity, label: 'Traffic' },
+  { view: 'traffic', icon: Activity, label: 'Live Traffic' },
   { view: 'helm', icon: Package, label: 'Helm' },
   { view: 'gitops', icon: GitBranch, label: 'GitOps' },
   { view: 'checks', icon: ShieldCheck, label: 'Checks' },

package/src/components/portforward/PortForwardButton.tsx

@@ -1,8 +1,10 @@
 import { useState, useRef, useEffect } from 'react'
+import { createPortal } from 'react-dom'
 import { Plug, ChevronDown, Loader2, Globe, Monitor, Copy, Check, X, Terminal } from 'lucide-react'
 import { clsx } from 'clsx'
-import { useAvailablePorts, useClusterInfo, AvailablePort } from '../../api/client'
+import { useAvailablePorts, AvailablePort } from '../../api/client'
 import { useStartPortForward } from './PortForwardManager'
+import { useIsLocalDeployment } from '../../contexts/CapabilitiesContext'
 import { validatePort } from '@skyhook-io/k8s-ui/utils/validators'
 import { Tooltip } from '../ui/Tooltip'
 
@@ -22,6 +24,13 @@ interface KubectlDialogInfo {
   port: number
 }
 
+// kubectl port-forward (and the live forward, which uses the same transport) is
+// TCP-only — UDP/SCTP can't be forwarded (kubernetes/kubernetes#47862). Treat an
+// unset protocol as TCP.
+export function isPortForwardable(protocol?: string): boolean {
+  return (protocol || 'TCP').toUpperCase() === 'TCP'
+}
+
 function buildKubectlCommand(type: 'pod' | 'service', namespace: string, name: string, localPort: number, remotePort: number) {
   const resource = type === 'pod' ? `pod/${name}` : `svc/${name}`
   const portArg = localPort === remotePort ? `${remotePort}` : `${localPort}:${remotePort}`
@@ -70,17 +79,23 @@ function KubectlCommandDialog({
 
   useEffect(() => {
     const handleKeyDown = (e: KeyboardEvent) => {
-      if (e.key === 'Escape') onClose()
+      if (e.key !== 'Escape') return
+      // Capture + stopPropagation so Escape closes only this dialog, not the
+      // drawer behind it (whose Escape shortcut listens in the bubble phase).
+      e.stopPropagation()
+      onClose()
     }
-    document.addEventListener('keydown', handleKeyDown)
-    return () => document.removeEventListener('keydown', handleKeyDown)
+    document.addEventListener('keydown', handleKeyDown, true)
+    return () => document.removeEventListener('keydown', handleKeyDown, true)
   }, [onClose])
 
   useEffect(() => {
     dialogRef.current?.focus()
   }, [])
 
-  return (
+  // Portal to <body>: the drawer is a transformed ancestor that would otherwise
+  // trap this position:fixed dialog inside the drawer instead of centering it.
+  return createPortal(
     <div className="fixed inset-0 z-50 flex items-center justify-center">
       <div className="absolute inset-0 bg-black/60 backdrop-blur-sm" onClick={onClose} />
       <div
@@ -103,7 +118,7 @@ function KubectlCommandDialog({
 
         <div className="p-4 space-y-3">
           <p className="text-sm text-theme-text-secondary">
-            Radar is running in-cluster, so port forwarding must be run from your local terminal.
+            Forward this port to your own machine — run it from your terminal:
           </p>
           <div className="flex flex-col gap-1">
             <div className="flex items-center gap-2 text-sm text-theme-text-secondary">
@@ -147,12 +162,13 @@ function KubectlCommandDialog({
               {copied ? 'Copied' : copyFallback ? 'Press Ctrl+C' : 'Copy'}
             </button>
           </div>
-          <p className="text-xs text-theme-text-secondary">
-            Requires kubectl and authentication to this cluster.
+          <p className="text-xs text-theme-text-tertiary">
+            You&apos;ll need <code className="inline-code">kubectl</code> and access to this cluster.
           </p>
         </div>
       </div>
-    </div>
+    </div>,
+    document.body,
   )
 }
 
@@ -168,12 +184,16 @@ export function PortForwardButton({
   const [listenAddress, setListenAddress] = useState<'127.0.0.1' | '0.0.0.0'>('127.0.0.1')
   const dropdownRef = useRef<HTMLDivElement>(null)
 
-  const { data: clusterInfo } = useClusterInfo()
+  const isLocal = useIsLocalDeployment()
   const { data, isLoading } = useAvailablePorts(type, namespace, name)
   const startPortForward = useStartPortForward()
 
   const ports = data?.ports || []
-  const inCluster = clusterInfo?.inCluster ?? false
+  // Decide copy-command vs live forward from the SAME deployment signal that
+  // gates whether the button shows at all — so the two can't disagree (and we
+  // don't race a separate /cluster-info fetch that defaults to "not in-cluster").
+  // Cloud runs in-cluster too, so anything not-local uses the copy command.
+  const inCluster = !isLocal
   const isPending = !inCluster && startPortForward.isPending
   const resourceName = type === 'service' ? (serviceName || name) : name
 
@@ -204,10 +224,15 @@ export function PortForwardButton({
   }
 
   function renderButton() {
-    // If no ports available, show disabled button
-    if (!isLoading && ports.length === 0) {
+    // kubectl port-forward is TCP-only — never offer UDP/SCTP ports as targets.
+    const forwardable = ports.filter((p) => isPortForwardable(p.protocol))
+
+    // No forwardable ports: disabled button. Distinguish "no ports at all" from
+    // "ports exist but are all UDP" so the operator isn't left guessing.
+    if (!isLoading && forwardable.length === 0) {
+      const udpOnly = ports.length > 0
       return (
-        <Tooltip content="No ports available">
+        <Tooltip content={udpOnly ? "kubectl port-forward doesn't support UDP" : 'No ports available'}>
         <button
           disabled
           className={clsx(
@@ -216,18 +241,18 @@ export function PortForwardButton({
           )}
         >
           <Plug className="w-4 h-4" />
-          No Ports
+          {udpOnly ? 'No TCP Ports' : 'No Ports'}
         </button>
         </Tooltip>
       )
     }
 
-    // If only one port, forward directly on click (most common case)
-    if (ports.length === 1) {
+    // If only one forwardable port, forward directly on click (most common case)
+    if (forwardable.length === 1) {
       return (
-        <Tooltip content={`Port forward to ${ports[0].port}`}>
+        <Tooltip content={`Port forward to ${forwardable[0].port}`}>
         <button
-          onClick={() => handlePortSelect(ports[0])}
+          onClick={() => handlePortSelect(forwardable[0])}
           disabled={isPending}
           className={clsx(
             'flex items-center gap-2 px-3 py-2 bg-theme-elevated text-theme-text-primary text-sm rounded-lg hover:bg-theme-hover transition-colors disabled:opacity-50 disabled:pointer-events-none',
@@ -239,7 +264,7 @@ export function PortForwardButton({
           ) : (
             <Plug className="w-4 h-4" />
           )}
-          Forward :{ports[0].port}
+          Forward :{forwardable[0].port}
         </button>
         </Tooltip>
       )
@@ -306,7 +331,7 @@ export function PortForwardButton({
             <div className="px-2 py-1.5 text-xs text-theme-text-disabled border-b border-theme-border">
               Select port to forward
             </div>
-            {ports.map((port, i) => (
+            {forwardable.map((port, i) => (
               <button
                 key={i}
                 onClick={() => handlePortSelect(port)}
@@ -355,11 +380,15 @@ export function PortForwardInlineButton({
   protocol = 'TCP',
   disabled = false,
 }: PortForwardInlineButtonProps) {
-  const { data: clusterInfo } = useClusterInfo()
+  const isLocal = useIsLocalDeployment()
   const startPortForward = useStartPortForward()
   const [dialogInfo, setDialogInfo] = useState<KubectlDialogInfo | null>(null)
 
-  const inCluster = clusterInfo?.inCluster ?? false
+  // Decide copy-command vs live forward from the SAME deployment signal that
+  // gates whether the button shows at all — so the two can't disagree (and we
+  // don't race a separate /cluster-info fetch that defaults to "not in-cluster").
+  // Cloud runs in-cluster too, so anything not-local uses the copy command.
+  const inCluster = !isLocal
   const isPending = !inCluster && startPortForward.isPending
 
   const handleClick = (e: React.MouseEvent) => {
@@ -378,15 +407,30 @@ export function PortForwardInlineButton({
     }
   }
 
+  // UDP/SCTP can't be port-forwarded — show a muted, non-interactive hint that
+  // explains why rather than a button that would copy a command that can't work.
+  if (!isPortForwardable(protocol)) {
+    return (
+      <Tooltip content="kubectl port-forward doesn't support UDP">
+        <span className="inline-flex items-center gap-1 px-1.5 py-0.5 bg-theme-elevated rounded text-xs text-theme-text-tertiary opacity-60 cursor-default">
+          {port}/{protocol}
+          <Plug className="w-3 h-3" />
+        </span>
+      </Tooltip>
+    )
+  }
+
   return (
     <>
-      <Tooltip content={`Port forward ${port}`}>
+      <Tooltip content={inCluster ? 'Copy a kubectl port-forward command' : `Port forward ${port}`}>
       <button
         onClick={handleClick}
         disabled={disabled || isPending}
         className="inline-flex items-center gap-1 px-1.5 py-0.5 bg-theme-elevated hover:bg-accent-muted rounded text-xs transition-colors disabled:opacity-50 disabled:hover:bg-theme-elevated disabled:pointer-events-none"
       >
-        {port}/{protocol}
+        {/* In-cluster this opens a copy-command dialog rather than forwarding now;
+            the trailing "…" signals "opens a dialog" (it doesn't fire immediately). */}
+        {port}/{protocol}{inCluster ? '…' : ''}
         {isPending ? (
           <Loader2 className="w-3 h-3 animate-spin" />
         ) : (

package/src/components/portforward/PortForwardManager.tsx

@@ -31,7 +31,7 @@ import { Tooltip } from '../ui/Tooltip'
 import { useToast } from '../ui/Toast'
 import { openExternal } from '../../utils/navigation'
 import { apiUrl } from '../../api/config'
-import { apiFetch } from '../../api/client'
+import { apiFetch, useCapabilities } from '../../api/client'
 import { pluralize } from '@skyhook-io/k8s-ui'
 
 // --- Types -------------------------------------------------------------------
@@ -84,7 +84,7 @@ function buildRecreateBody(session: PortForwardSession, overrides: { localPort:
 
 // --- Shared query ------------------------------------------------------------
 
-function usePortForwardQuery() {
+function usePortForwardQuery(enabled: boolean) {
   return useQuery<PortForwardSession[]>({
     queryKey: ['portforwards'],
     queryFn: async () => {
@@ -92,6 +92,10 @@ function usePortForwardQuery() {
       if (!res.ok) throw new Error('Failed to fetch port forwards')
       return res.json()
     },
+    // Port-forward is a local-binary feature; in-cluster (Radar Cloud) the
+    // capability is false, so don't poll an endpoint that can never return a
+    // usable session. Also covers RBAC-denied users.
+    enabled,
     // 30s fallback poll — user mutations invalidate immediately, but out-of-band
     // session death (pod restart, OOM kill, server-side cleanup) only surfaces on
     // the next tick.
@@ -144,12 +148,21 @@ interface PortForwardContextValue {
 const PortForwardContext = createContext<PortForwardContextValue | null>(null)
 
 export function PortForwardProvider({ children }: { children: ReactNode }) {
+  // Gate the session-list poll on runtime mode, not the RBAC capability: port-forward
+  // only works when radar runs as a local binary, so in-cluster (Radar Cloud) we never
+  // poll /portforwards. We deliberately do NOT gate on `portForward` (RBAC) — a local
+  // user with portforward rights in only some namespaces must still see/stop the
+  // sessions they start (the start buttons gate per-namespace separately). Using the
+  // resolved value (undefined while capabilities load → no poll) keeps Cloud silent on
+  // first paint.
+  const { data: caps } = useCapabilities()
+  const canPortForward = caps?.deployment?.mode === 'local'
   const {
     data: sessions = [],
     isLoading,
     isError: isQueryError,
     error: queryError,
-  } = usePortForwardQuery()
+  } = usePortForwardQuery(canPortForward)
   const activeSessions = sessions.filter((s) => s.status !== 'stopped')
   const errorSessions = sessions.filter((s) => s.status === 'error')
   const count = activeSessions.length
@@ -970,6 +983,7 @@ export function useStartPortForward() {
 
 // Backwards-compat: existing consumers that just want a count number.
 export function usePortForwardCount() {
-  const { data: sessions = [] } = usePortForwardQuery()
+  const { data: caps } = useCapabilities()
+  const { data: sessions = [] } = usePortForwardQuery(caps?.deployment?.mode === 'local')
   return sessions.filter((s) => s.status !== 'stopped').length
 }

package/src/components/resources/ResourcesView.tsx

@@ -1,7 +1,9 @@
 import { useState, useMemo, useCallback, useEffect } from 'react'
 import { useLocation, useNavigate } from 'react-router-dom'
 import { useQuery } from '@tanstack/react-query'
-import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads } from '../../api/client'
+import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
+import { isBadgeWorthy } from '../../utils/auditBadges'
+import type { AuditBadgeMessage } from '@skyhook-io/k8s-ui'
 import { apiUrl, getAuthHeaders, getCredentialsMode, getBasename } from '../../api/config'
 import { useAPIResources } from '../../api/apiResources'
 import { initNavigationMap } from '@skyhook-io/k8s-ui'
@@ -137,6 +139,44 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
     return match?.isCrd ?? (!!selectedKind.group) // default: has group = likely CRD
   }, [selectedKind, apiResources])
 
+  // The canonical Kind for the selected resource. selectedKind.kind is the plural
+  // URL segment for CRDs/grouped kinds (e.g. "ingressroutes", "ingresses") — only
+  // core no-group kinds resolve to the real Kind there — so resolve it via
+  // discovery to match audit findings, which key by the real Kind ("IngressRoute").
+  const selectedKindCanonical = useMemo(() => {
+    if (!selectedKind) return undefined
+    const match = apiResources?.find(r => r.name === selectedKind.name && r.group === selectedKind.group)
+      ?? CORE_RESOURCES.find(r => r.name === selectedKind.name && r.group === selectedKind.group)
+    return match?.kind ?? selectedKind.kind
+  }, [selectedKind, apiResources])
+
+  // Cluster Audit findings for the selected kind, keyed by "namespace/name" for
+  // the resource list. The list shows ONE kind at a time, so ns/name is enough;
+  // we still match the finding's group (built-ins → real group, CRDs → "") so a
+  // kind shared across groups doesn't bleed findings across the two lists. Only
+  // "badge-worthy" findings count (reference-integrity / lifecycle) — posture
+  // and best-practice nags fire near-universally and would just be noise.
+  const audit = useAudit(namespaces)
+  const auditBadges = useMemo(() => {
+    if (!selectedKind || !audit.data?.findings) return undefined
+    const wantGroup = isSelectedCrd ? '' : selectedKind.group
+    const map: Record<string, { danger: number; warning: number; messages: AuditBadgeMessage[] }> = {}
+    for (const f of audit.data.findings) {
+      if (f.kind !== selectedKindCanonical || (f.group ?? '') !== wantGroup) continue
+      if (!isBadgeWorthy(f, audit.data.checks)) continue
+      const k = `${f.namespace || ''}/${f.name}`
+      const cur = map[k] ?? { danger: 0, warning: 0, messages: [] }
+      if (f.severity === 'danger') cur.danger++
+      else if (f.severity === 'warning') cur.warning++
+      cur.messages.push({ severity: f.severity, message: f.message })
+      map[k] = cur
+    }
+    for (const cur of Object.values(map)) {
+      cur.messages.sort((a, b) => (a.severity === 'danger' ? 0 : 1) - (b.severity === 'danger' ? 0 : 1))
+    }
+    return map
+  }, [audit.data?.findings, audit.data?.checks, selectedKind, selectedKindCanonical, isSelectedCrd])
+
   const selectedCountKey = selectedKind ? resourceCountKey(selectedKind) : ''
   const selectedCount = selectedCountKey ? countsData?.counts[selectedCountKey] : undefined
   const selectedCountUnavailable = selectedCountKey ? countsData?.unavailable?.includes(selectedCountKey) ?? false : false
@@ -294,6 +334,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       topNodeMetrics={topNodeMetrics}
       certExpiry={certExpiry}
       certExpiryError={certExpiryError}
+      auditBadges={auditBadges}
       // Pinned kinds
       pinned={pinned}
       togglePin={togglePin}

package/src/components/resources/renderers/PodRenderer.tsx

@@ -2,7 +2,7 @@ import { PodRenderer as BasePodRenderer } from '@skyhook-io/k8s-ui/components/re
 import type { CopyHandler } from '@skyhook-io/k8s-ui/components/ui/drawer-components'
 import type { ResolvedEnvFrom } from '@skyhook-io/k8s-ui'
 import { useOpenTerminal, useOpenLogs } from '../../dock'
-import { useNamespacedCapabilities } from '../../../contexts/CapabilitiesContext'
+import { useNamespacedCapabilities, useIsLocalDeployment } from '../../../contexts/CapabilitiesContext'
 import { usePodMetrics, usePodMetricsHistory, usePrometheusResourceMetrics, usePrometheusStatus } from '../../../api/client'
 import { useRBACSubject } from '../../../api/rbac'
 import { PortForwardInlineButton } from '../../portforward/PortForwardButton'
@@ -27,6 +27,11 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
 
   // Capabilities (namespace-scoped: re-checks RBAC if globally denied)
   const { canExec, canViewLogs, canPortForward } = useNamespacedCapabilities(namespace)
+  // Show the port-forward affordance for a live forward (local + RBAC) OR when
+  // not local — in-cluster/Cloud surfaces a copy-paste kubectl command instead.
+  // The button itself picks live vs. copy-command based on deployment mode.
+  const isLocal = useIsLocalDeployment()
+  const showPortForward = canPortForward || !isLocal
 
   // Metrics
   const { data: metrics } = usePodMetrics(namespace, podName)
@@ -65,7 +70,7 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
       rbacError={rbacError as Error | null}
       canExec={canExec}
       canViewLogs={canViewLogs}
-      canPortForward={canPortForward}
+      canPortForward={showPortForward}
       onOpenTerminal={(params) => openTerminal(params)}
       onOpenLogsPanel={(params) => openLogsPanel(params)}
       renderPortAction={({ namespace: ns, podName: pod, port, protocol, disabled }) => (