@skyhook-io/radar-app 1.8.13 → 1.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.8.13",
+  "version": "1.9.1",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -41,7 +41,7 @@
     "yaml": "^2.9.0"
   },
   "peerDependencies": {
-    "@skyhook-io/k8s-ui": ">=1.8.15",
+    "@skyhook-io/k8s-ui": ">=1.10.0",
     "@tanstack/react-query": ">=5",
     "@xyflow/react": ">=12.0.0",
     "clsx": ">=2",
@@ -54,15 +54,15 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@playwright/test": "^1.59.1",
+    "@playwright/test": "^1.62.0",
     "@skyhook-io/k8s-ui": "*",
     "@tailwindcss/typography": "^0.5.20",
-    "@tailwindcss/vite": "^4.3.1",
-    "@tanstack/react-query": "^5.101.2",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-query": "^5.101.4",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.2",
+    "@vitejs/plugin-react": "^6.0.4",
     "@xyflow/react": "^12.11.2",
     "clsx": "^2.1.1",
     "elkjs": "^0.11.1",
@@ -77,7 +77,7 @@
     "react-dom": "^19.2.7",
     "react-router-dom": "^7.18.1",
     "tailwind-merge": "^3.6.0",
-    "tailwindcss": "^4.3.1",
+    "tailwindcss": "^4.3.3",
     "typescript": "^6.0.2",
     "typescript-eslint": "^8.62.0",
     "vite": "^8.1.5"

package/src/App.tsx

@@ -50,7 +50,7 @@ import { DiagnosticsOverlay } from './components/ui/DiagnosticsOverlay'
 import { useEventSource } from './hooks/useEventSource'
 import { debugNamespaceLog, useNamespaces, useNamespaceScope, useSetActiveNamespace, useSwitchContext, useAuthMe, useAudit } from './api/client'
 import { buildAuditSeverityMap } from './utils/auditBadges'
-import { routePath, apiUrl, getAuthHeaders, getCredentialsMode } from './api/config'
+import { routePath, apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from './api/config'
 import { KeyboardShortcutProvider, useRegisterShortcut, useRegisterShortcuts, useSuppressBaseShortcuts } from './hooks/useKeyboardShortcuts'
 import { useAnimatedUnmount } from './hooks/useAnimatedUnmount'
 import { useDocumentTitle } from './hooks/useDocumentTitle'
@@ -60,7 +60,7 @@ import { Network, List, Clock, Package, Sun, Moon, Activity, Home, Star, Search,
 import { useTheme } from './context/ThemeContext'
 import { Tooltip } from './components/ui/Tooltip'
 import { LargeClusterNamespacePicker } from './components/shared/LargeClusterNamespacePicker'
-import { SettingsDialog } from './components/settings/SettingsDialog'
+import { SettingsDialog, type SettingsSectionId } from './components/settings/SettingsDialog'
 import type { APIResource, TopologyNode, GroupingMode, MainView, SelectedResource, SelectedHelmRelease, NodeKind, TopologyMode, Topology, K8sEvent } from './types'
 import { kindToPlural, pluralToKind, openExternal, apiVersionToGroup, relatedResourcePath, searchHitToSelectedResource } from './utils/navigation'
 import { type OmnibarHandle } from './components/ui/Omnibar'
@@ -343,12 +343,19 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // Auth check — detect if auth is enabled but user is not authenticated
   const { data: authMe, isPending: authMePending } = useAuthMe()
 
-  // Restore navigation path after session-expiry re-auth redirect
+  // Restore navigation path after session-expiry re-auth redirect.
+  // The stored value is basename-relative, but strip defensively anyway:
+  // sessionStorage outlives app upgrades, so a value written by an older
+  // version may still carry the basename — and navigate() re-applies the
+  // basename, which would double it (/c/abc/c/abc/...). Trade-off: if a host
+  // mounts the app at a basename that exactly equals an internal route (e.g.
+  // /topology), this second strip eats the route and re-auth lands on home —
+  // accepted, since a wrong-but-valid landing beats a doubled URL.
   useEffect(() => {
     const returnPath = sessionStorage.getItem('radar_return_path')
     if (returnPath) {
       sessionStorage.removeItem('radar_return_path')
-      navigate(returnPath, { replace: true })
+      navigate(stripBasename(returnPath), { replace: true })
     }
   }, [navigate])
 
@@ -507,13 +514,23 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
 
   // Settings dialog state
   const [showSettings, setShowSettings] = useState(false)
+  const [settingsSection, setSettingsSection] = useState<SettingsSectionId>('overview')
+  const openSettings = useCallback((section: SettingsSectionId = 'overview') => {
+    setSettingsSection(section)
+    setShowSettings(true)
+  }, [])
 
   // Listen for "open-settings" DOM event (used by MCPSetupDialog etc.)
   useEffect(() => {
-    const handler = () => setShowSettings(true)
+    const handler = (event: Event) => {
+      const section =
+        (event as CustomEvent<{ section?: SettingsSectionId }>).detail?.section ??
+        'overview'
+      openSettings(section)
+    }
     window.addEventListener('radar:open-settings', handler)
     return () => window.removeEventListener('radar:open-settings', handler)
-  }, [])
+  }, [openSettings])
 
   // Listen for "open-local-terminal" DOM event — the AI surface is portaled above
   // the DockProvider, so it can't call useOpenLocalTerminal directly; it dispatches
@@ -853,7 +870,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           description: 'Open settings',
           category: 'General' as const,
           scope: 'global' as const,
-          handler: () => setShowSettings(true),
+          handler: () => openSettings(),
         }]
       : []),
   ])
@@ -967,6 +984,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     if (tl.timer === null) {
       tl.timer = window.setTimeout(() => {
         queryClient.invalidateQueries({ queryKey: ['changes'] })
+        // The ring-and-delta timeline path: an invalidation costs one ~KB
+        // cursor delta, so SSE keeps the timeline fresh within seconds and
+        // the hook's 10s poll remains the no-SSE fallback.
+        queryClient.invalidateQueries({ queryKey: ['timeline-ring'] })
         timelineInvalidationRef.current = { timer: null }
       }, 5000)
     }
@@ -1512,10 +1533,9 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   }, [displayedTopology, visibleKinds, namespaces, topologyMode])
 
   // Cluster Audit findings, joined onto topology nodes by the audit key the
-  // backend stamps on each node (data.auditKey). The graph surfaces DANGER only
-  // (warnings would turn a dense graph into a heatmap); the node component reads
-  // data.auditDanger. Re-runs only when findings change, and copies nodes only
-  // when there are findings to attach — no overhead on clusters with none.
+  // backend stamps on each node (data.auditKey). Only badge-worthy findings
+  // reach the graph; the raw auditDanger/auditWarning property names remain at
+  // this compatibility boundary while the node presents them as High/Medium.
   const audit = useAudit(namespaces)
   const auditSeverityMap = useMemo(
     () => buildAuditSeverityMap(audit.data?.findings, audit.data?.checks),
@@ -1596,7 +1616,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           pinned={navRailEffectivePinned}
           onTogglePinned={toggleNavRailPinned}
           showPinToggle={!railForcedSlim}
-          onOpenSettings={() => setShowSettings(true)}
+          onOpenSettings={() => openSettings()}
           accountSlot={<UserMenu variant="rail" pinned={navRailEffectivePinned} />}
         />
       )}
@@ -2183,7 +2203,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
               navigateToResource(resource)
             }}
             onClearNamespaces={clearAllNamespaces}
-            onOpenSettings={() => setShowSettings(true)}
+            onOpenSettings={() => openSettings()}
           />
         )}
 
@@ -2414,6 +2434,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       {/* Settings dialog — My permissions is rendered inline in its own section */}
       <SettingsDialog
         open={showSettings}
+        initialSection={settingsSection}
         onClose={() => setShowSettings(false)}
       />
 

package/src/api/client.ts

@@ -42,7 +42,7 @@ import type {
   ArgoRevisionMetadata,
 } from '../types'
 import type { GitOpsOperationResponse } from '../types/gitops'
-import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath } from './config'
+import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath, stripBasename } from './config'
 import { pluralToKind } from '../utils/navigation'
 
 // Auto-refresh cadences (ms) — named constants for each polled hook's
@@ -74,11 +74,13 @@ export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<
     const authPrefix = `${getBasename()}/auth`
     if (response.status === 401 && !window.location.pathname.startsWith(authPrefix)) {
       // Save current location so user returns to where they were after re-auth.
+      // Stored basename-relative: the restore path replays it through React
+      // Router's navigate(), which re-applies the basename itself.
       // Editor draft is auto-saved by EditableYamlView via sessionStorage.
       try {
         sessionStorage.setItem(
           'radar_return_path',
-          window.location.pathname + window.location.search,
+          stripBasename(window.location.pathname) + window.location.search,
         )
       } catch {
         /* best-effort */
@@ -2026,15 +2028,28 @@ export function useNodeMetricsHistory(nodeName: string) {
 }
 
 // Top metrics types (bulk, for resource table view)
+export interface ContainerResourceMetrics {
+  name: string
+  cpu: number // nanocores (usage)
+  cpuRequest: number // nanocores
+  cpuLimit: number // nanocores
+  memory: number // bytes (usage)
+  memoryRequest: number // bytes
+  memoryLimit: number // bytes
+}
+
 export interface TopPodMetrics {
   namespace: string
   name: string
   cpu: number // nanocores (usage)
   memory: number // bytes (usage)
-  cpuRequest: number // nanocores (sum across containers)
-  cpuLimit: number // nanocores (sum across containers)
-  memoryRequest: number // bytes (sum across containers)
-  memoryLimit: number // bytes (sum across containers)
+  cpuRequest: number // nanocores (sum across running containers)
+  cpuLimit: number // nanocores (sum across running containers)
+  memoryRequest: number // bytes (sum across running containers)
+  memoryLimit: number // bytes (sum across running containers)
+  // Per-container breakdown; present only for pods with more than one running
+  // container (regular + native sidecars). Absent for single-container pods.
+  containers?: ContainerResourceMetrics[]
 }
 
 export interface TopNodeMetrics {

package/src/api/config.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, afterEach } from 'vitest'
+
+import { setBasename, stripBasename, routePath } from './config'
+
+// setBasename mutates module state — restore standalone default after each test.
+afterEach(() => {
+  setBasename('')
+})
+
+describe('stripBasename', () => {
+  it('passes paths through unchanged when no basename is configured', () => {
+    expect(stripBasename('/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename('/')).toBe('/')
+  })
+
+  it('strips a configured basename prefix', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename('/c/abc/timeline?range=1h')).toBe('/timeline?range=1h')
+  })
+
+  it('maps the bare basename to root', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc')).toBe('/')
+  })
+
+  it('strips when the basename is followed directly by a query string', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc?tab=events')).toBe('?tab=events')
+  })
+
+  it('leaves basename-relative paths unchanged (idempotent)', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename(stripBasename('/c/abc/resources/pods'))).toBe('/resources/pods')
+  })
+
+  it('does not strip a path that merely shares a string prefix', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abcdef/resources')).toBe('/c/abcdef/resources')
+  })
+
+  it('inverts routePath', () => {
+    setBasename('/c/abc')
+    expect(stripBasename(routePath('/auth/login'))).toBe('/auth/login')
+  })
+})

package/src/api/config.ts

@@ -64,6 +64,21 @@ export function routePath(path: string): string {
   return prefix + path;
 }
 
+/**
+ * Inverse of `routePath`: strips the configured basename from a window-level
+ * path so it can be handed to React Router's navigate(), which re-applies the
+ * basename. Passing an already-prefixed path to navigate() doubles the prefix
+ * (e.g. /c/abc/c/abc/...). Basename-relative paths pass through unchanged.
+ */
+export function stripBasename(path: string): string {
+  const prefix = basename;
+  if (!prefix) return path;
+  if (path === prefix || path.startsWith(prefix + '/') || path.startsWith(prefix + '?')) {
+    return path.slice(prefix.length) || '/';
+  }
+  return path;
+}
+
 /**
  * Builds a WebSocket URL for a given API path.
  *

package/src/api/diagnose.ts

@@ -10,6 +10,8 @@ export interface AgentInfo {
   version: string;
   present: boolean;
   supported: boolean;
+  profiles?: ExecutionProfile[];
+  consentSurfaces?: Partial<Record<ExecutionProfile, string>>;
   hosted?: boolean;
 }
 
@@ -18,9 +20,11 @@ export interface AgentsResponse {
   enabled: boolean;
   // Machine-scoped consent per disclosure surface, recorded server-side
   // (~/.radar) — one acknowledgment covers the web panel and the CLI.
-  consented?: { standard?: boolean; cursor?: boolean };
+  consented?: Record<string, boolean>;
 }
 
+export type ExecutionProfile = "safeguarded" | "full-local";
+
 export interface DiagnoseStep {
   id: string;
   tool: string;
@@ -64,14 +68,7 @@ export interface ResourceHealthSignal {
 }
 
 export interface DiagnoseStreamEvent {
-  type:
-    | "turn"
-    | "phase"
-    | "step"
-    | "thinking"
-    | "done"
-    | "error"
-    | "closed";
+  type: "turn" | "phase" | "step" | "thinking" | "done" | "error" | "closed";
   phase?: string;
   step?: DiagnoseStep;
   token?: string;
@@ -91,7 +88,7 @@ export interface RunSummary {
   name: string;
   context: string;
   agent?: string; // backend CLI that drove this run ("claude"/"codex")
-  isolated?: boolean;
+  profile?: ExecutionProfile;
   model?: string;
   effort?: string;
   managedBy?: string; // GitOps/Helm owner of the target ("Argo CD"/"Flux"/"Helm"), for the Apply warning
@@ -145,7 +142,7 @@ export async function createRun(
   },
   opts?: {
     agent?: string;
-    isolated?: boolean;
+    profile?: ExecutionProfile;
     model?: string;
     effort?: string;
   },
@@ -179,10 +176,8 @@ export async function listRuns(signal?: AbortSignal): Promise<RunsResponse> {
   return { runs: d.runs ?? [], historyDegraded: !!d.historyDegraded };
 }
 
-// recordConsent acknowledges the current disclosure for a surface, server-side.
-export async function recordConsent(
-  surface: "standard" | "cursor",
-): Promise<void> {
+// recordConsent acknowledges the current disclosure for an execution profile, server-side.
+export async function recordConsent(surface: string): Promise<void> {
   const res = await fetch(`${getApiBase()}/diagnose/consent`, {
     method: "POST",
     credentials: getCredentialsMode(),