@skyhook-io/radar-app 1.8.13 → 1.9.1

package/src/components/diagnose/parts.tsx

@@ -27,13 +27,14 @@ import {
   type Diagnosis,
   type DiagnoseStep,
   type AgentInfo,
+  type ExecutionProfile,
   type RunSummary,
 } from "../../api/diagnose";
 import { StatusDot } from "@skyhook-io/k8s-ui";
 import { Markdown } from "../ui/Markdown";
 
-// Segmented two-or-more-way selector — shared shape for the agent picker and the
-// isolation toggle.
+// Segmented two-or-more-way selector — shared shape for the agent and execution
+// profile pickers.
 function Segmented<T extends string | boolean>({
   label,
   options,
@@ -228,15 +229,15 @@ function SelectMenu({
   );
 }
 
-// AgentControls is the full AI-diagnosis config block (agent, isolation, model,
+// AgentControls is the full AI-diagnosis config block (agent, execution profile, model,
 // effort) — pure + prop-driven. It lives in Settings, not the investigation panel,
 // since these are set-once preferences rather than per-run knobs.
 export function AgentControls({
   agents,
   selectedAgent,
   onSelectAgent,
-  isolated,
-  onSetIsolated,
+  profile,
+  onSetProfile,
   model,
   onSetModel,
   effort,
@@ -245,8 +246,8 @@ export function AgentControls({
   agents: AgentInfo[];
   selectedAgent: string;
   onSelectAgent: (name: string) => void;
-  isolated: boolean;
-  onSetIsolated: (v: boolean) => void;
+  profile: ExecutionProfile;
+  onSetProfile: (v: ExecutionProfile) => void;
   model: string;
   onSetModel: (v: string) => void;
   effort: string;
@@ -255,6 +256,17 @@ export function AgentControls({
   const isCodex = selectedAgent === "codex";
   const isClaude = selectedAgent === "claude";
   const isCursor = selectedAgent === "cursor-agent";
+  const selectedAgentInfo = agents.find((a) => a.name === selectedAgent);
+  const selectedAgentLabel =
+    selectedAgentInfo?.label || selectedAgent || "agent";
+  const profiles = selectedAgentInfo?.profiles ?? [];
+  const shownProfile = profiles.includes(profile)
+    ? profile
+    : (profiles[0] ?? profile);
+  const profileLabels: Record<ExecutionProfile, string> = {
+    safeguarded: "Radar safeguards",
+    "full-local": `Your ${selectedAgentLabel} setup`,
+  };
   return (
     <div className="space-y-3">
       {agents.length >= 2 && (
@@ -268,29 +280,66 @@ export function AgentControls({
           }))}
         />
       )}
-      {isCodex && (
+      {profiles.length > 0 && (
         <div>
-          <Segmented<boolean>
-            label="Environment"
-            value={isolated}
-            onChange={onSetIsolated}
-            options={[
-              { value: true, label: "Isolated (recommended)" },
-              { value: false, label: "My setup" },
-            ]}
-          />
-          {isolated ? (
-            <p className="mt-1.5 text-[11px] leading-snug text-theme-text-tertiary">
-              Runs Codex on its own — no access to your other MCP servers,
-              guidelines, or project files.
-            </p>
+          {profiles.length > 1 ? (
+            <>
+              <Segmented<ExecutionProfile>
+                label="How Radar runs it"
+                value={shownProfile}
+                onChange={onSetProfile}
+                options={profiles.map((value) => ({
+                  value,
+                  label: profileLabels[value],
+                }))}
+              />
+              {shownProfile === "safeguarded" ? (
+                <p className="mt-1.5 text-[11px] leading-snug text-theme-text-tertiary">
+                  {isClaude
+                    ? "Claude’s built-in tools are disabled, and MCP access is limited to Radar’s read-only investigation tools. Your Claude settings, hooks, and CLAUDE.md instructions still apply and are outside Radar’s control."
+                    : isCodex
+                      ? "Radar excludes your Codex configuration and other MCP servers. Codex’s sandboxed shell can still read files on this machine; it cannot write or reach the network."
+                      : "Radar uses this agent’s safeguarded execution profile. Review the agent’s documented restrictions before continuing."}
+                </p>
+              ) : (
+                <div className="mt-1.5 flex items-start gap-1.5 rounded border border-amber-500/40 bg-amber-500/10 p-2 text-[11px] leading-snug text-theme-text-secondary">
+                  <AlertTriangle className="mt-0.5 h-3 w-3 shrink-0 text-amber-500" />
+                  <span>
+                    Uses your agent&apos;s normal configuration and other
+                    configured tools and MCP servers. Radar cannot constrain that
+                    external tooling; it may access local files or the network
+                    and may be able to change your cluster.{" "}
+                    {isClaude
+                      ? "Claude uses the permissions from your setup; Radar does not override them."
+                      : "Radar still enables the agent CLI’s own sandbox, but that sandbox does not constrain external MCP servers."}{" "}
+                    Choose this only when you need that setup.
+                  </span>
+                </div>
+              )}
+            </>
+          ) : shownProfile === "safeguarded" ? (
+            <div className="flex items-start gap-1.5 rounded border border-theme-border bg-theme-base p-2 text-[11px] leading-snug text-theme-text-secondary">
+              <ShieldCheck className="mt-0.5 h-3 w-3 shrink-0 text-accent" />
+              <span>
+                Radar always runs this agent with safeguards.
+                {isClaude
+                  ? " Claude’s built-in tools are disabled, and MCP access is limited to Radar’s read-only investigation tools. Your Claude settings, hooks, and CLAUDE.md instructions still apply and are outside Radar’s control."
+                  : isCodex
+                    ? " Your Codex configuration and other MCP servers are excluded. Codex’s sandboxed shell can still read files on this machine; it cannot write or reach the network."
+                    : " Review the agent’s documented restrictions before continuing."}
+              </span>
+            </div>
           ) : (
-            <div className="mt-1.5 flex items-start gap-1.5 rounded border border-amber-500/40 bg-amber-500/10 p-2 text-[11px] leading-snug text-theme-text-secondary">
+            <div className="flex items-start gap-1.5 rounded border border-amber-500/40 bg-amber-500/10 p-2 text-[11px] leading-snug text-theme-text-secondary">
               <AlertTriangle className="mt-0.5 h-3 w-3 shrink-0 text-amber-500" />
               <span>
-                Runs Codex with your full setup — your own MCP servers (which may
-                be write- or network-capable) and guidelines, and it can read
-                local files. Only choose this if you rely on that config.
+                Radar must use this agent&apos;s normal setup. Radar cannot
+                constrain its external tools or MCP servers; they may access
+                local files or the network and may be able to change your
+                cluster. Radar still enables the agent CLI&apos;s own sandbox,
+                but that sandbox does not constrain external MCP servers.
+                {isCursor &&
+                  " Cursor always loads your global MCP servers, so Radar cannot exclude them."}
               </span>
             </div>
           )}
@@ -304,7 +353,7 @@ export function AgentControls({
           onChange={onSetModel}
           hint="Aliases always resolve to the latest of that tier."
         />
-      ) : (
+      ) : isCodex || isCursor ? (
         <TextField
           label="Model"
           value={model}
@@ -317,11 +366,19 @@ export function AgentControls({
           hint={
             isCursor
               ? "Leave empty for your Cursor default, or enter a model slug Cursor supports."
-              : !isolated
-                ? "“My setup” uses your own Codex config's model; set a slug here to override it."
+              : shownProfile === "full-local"
+                ? "Your Codex setup uses its configured model; set a slug here to override it."
                 : "Leave empty for Codex's default, or enter a model your Codex version supports."
           }
         />
+      ) : (
+        <TextField
+          label="Model"
+          value={model}
+          placeholder="Default"
+          onChange={onSetModel}
+          hint="Leave empty for the agent's default, or enter a model identifier it supports."
+        />
       )}
       {isCodex && (
         <SelectMenu
@@ -591,10 +648,12 @@ function ConsentCardShell({
   bullets,
   settingsLabel,
   approveLabel = "Approve & investigate",
+  warning = false,
   onOpenSettings,
   onApprove,
   onCancel,
 }: DiagnoseConsentCopy & {
+  warning?: boolean;
   onOpenSettings?: () => void;
   onApprove: () => void;
   onCancel: () => void;
@@ -606,9 +665,19 @@ function ConsentCardShell({
       ? "Change the agent and how it runs in Settings"
       : settingsLabel;
   return (
-    <div className="rounded-lg border border-theme-border bg-theme-elevated p-4">
+    <div
+      className={
+        warning
+          ? "rounded-lg border border-amber-500/40 bg-amber-500/10 p-4"
+          : "rounded-lg border border-theme-border bg-theme-elevated p-4"
+      }
+    >
       <div className="mb-2 flex items-center gap-2">
-        <ShieldCheck className="h-4 w-4 text-accent" />
+        {warning ? (
+          <AlertTriangle className="h-4 w-4 text-amber-500" />
+        ) : (
+          <ShieldCheck className="h-4 w-4 text-accent" />
+        )}
         <div className="text-sm font-medium text-theme-text-primary">
           {title}
         </div>
@@ -660,7 +729,7 @@ function ConsentCardShell({
 export function ConsentCard({
   agentName,
   agent,
-  isolated = true,
+  profile,
   copy,
   onOpenSettings,
   onApprove,
@@ -668,7 +737,7 @@ export function ConsentCard({
 }: {
   agentName: string;
   agent?: string;
-  isolated?: boolean;
+  profile: ExecutionProfile;
   copy?: DiagnoseConsentCopy;
   onOpenSettings?: () => void;
   onApprove: () => void;
@@ -679,17 +748,19 @@ export function ConsentCard({
   // Tier 1: a host (e.g. radar-hub-web) supplied its own copy — use it verbatim.
   if (copy) return <ConsentCardShell {...copy} {...chrome} />;
 
-  // Tier 2: OSS BYO-local default. Cursor can't be isolated (no flag suppresses
-  // its global MCP servers), so it gets its own honest framing rather than the
-  // isolated/my-setup pair.
-  const isCursor = agent === "cursor-agent";
   return (
     <ConsentCardShell
       {...chrome}
+      warning={profile === "full-local"}
+      approveLabel={
+        profile === "full-local"
+          ? "Continue with my agent setup"
+          : "Approve & investigate"
+      }
       title={
-        isolated && !isCursor
-          ? "Run a read-only AI investigation?"
-          : "Run an AI investigation?"
+        profile === "safeguarded"
+          ? "Run an AI investigation with Radar safeguards?"
+          : `Run using your ${agentName} setup?`
       }
       body={
         <>
@@ -698,48 +769,68 @@ export function ConsentCard({
             your own {agentName}
           </span>{" "}
           on your machine — no Radar cloud, no API key, no account. Radar sends
-          this resource&apos;s spec, recent events, and pod logs to it (and on to
-          its model provider under your account, not to Radar). Transcripts are
-          kept in your local Radar history on this machine until cleared.
-          {isolated && !isCursor && (
+          this resource&apos;s spec, recent events, and pod logs to it (and on
+          to its model provider under your account, not to Radar). Transcripts
+          are kept in your local Radar history on this machine until cleared.
+          {profile === "safeguarded" && (
             <>
               {" "}
-              Through Radar the agent can only{" "}
-              <span className="font-medium">read</span> — it cannot change your
-              cluster.
+              Radar&apos;s investigation tools can only{" "}
+              <span className="font-medium">read</span> your cluster.
             </>
           )}
         </>
       }
-      bullets={[
-        isCursor ? (
-          <>
-            Through Radar the agent only{" "}
-            <span className="font-medium">reads</span> your cluster. But Cursor
-            also loads your own global MCP servers and Radar can&apos;t exclude
-            them (unlike Claude or Codex), so if any of those can make changes,
-            Cursor could use them.
-          </>
-        ) : isolated ? (
-          <>
-            Isolated: only Radar&apos;s read-only investigation tools — your
-            other CLI config and MCP servers are excluded.
-            {agent === "codex" && (
+      bullets={
+        profile === "safeguarded"
+          ? [
+              agent === "claude" ? (
+                <>
+                  Radar safeguards disable Claude&apos;s built-in tools and limit
+                  MCP access to Radar&apos;s read-only investigation tools. Your
+                  Claude settings, hooks, and CLAUDE.md instructions still apply
+                  and are outside Radar&apos;s control.
+                </>
+              ) : agent === "codex" ? (
+                <>
+                  Radar safeguards exclude your Codex configuration and other MCP
+                  servers. Codex&apos;s sandboxed shell can still read files on
+                  this machine; it cannot write or reach the network.
+                </>
+              ) : (
+                <>
+                  Radar uses this agent&apos;s safeguarded execution profile.
+                  Review the agent&apos;s documented restrictions before
+                  continuing.
+                </>
+              ),
+            ]
+          : [
               <>
-                {" "}
-                Codex&apos;s sandboxed shell can still <em>read</em> files on
-                your machine (it cannot write or reach the network).
-              </>
-            )}
-          </>
-        ) : (
-          <>
-            &ldquo;My setup&rdquo;: the agent also runs with your own CLI config
-            + MCP servers and can read local files. Only Radar&apos;s own tools
-            are read-only.
-          </>
-        ),
-      ]}
+                Radar cannot constrain the agent&apos;s other configured tools or
+                MCP servers. They may access local files or the network and may
+                be able to change your cluster.
+              </>,
+              agent === "claude" ? (
+                <>
+                  Claude uses the permissions from your setup; Radar does not
+                  override them.
+                </>
+              ) : (
+                <>
+                  Radar still enables the agent CLI&apos;s own sandbox, but that
+                  sandbox does not constrain external MCP servers.
+                  {agent === "cursor-agent" && (
+                    <>
+                      {" "}
+                      Cursor always loads your global MCP servers; Radar cannot
+                      exclude them.
+                    </>
+                  )}
+                </>
+              ),
+            ]
+      }
     />
   );
 }

package/src/components/home/mcpToolCatalog.ts

@@ -141,7 +141,7 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
     params: [
       { arg: 'namespace', desc: 'filter to a specific namespace' },
       { arg: 'category', desc: 'Security, Reliability, or Efficiency' },
-      { arg: 'severity', desc: 'danger or warning' },
+      { arg: 'severity', desc: 'posture priority: critical, high, medium, or low (built-ins use high or medium)' },
       { arg: 'limit', desc: 'max findings (default 30, max 100)' },
     ],
   },

package/src/components/resources/ResourcesView.tsx

@@ -4,7 +4,7 @@ import { useQuery } from '@tanstack/react-query'
 import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
 import { isBadgeWorthy } from '../../utils/auditBadges'
 import type { AuditBadgeMessage } from '@skyhook-io/k8s-ui'
-import { apiUrl, getAuthHeaders, getCredentialsMode, getBasename } from '../../api/config'
+import { apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from '../../api/config'
 import { useAPIResources } from '../../api/apiResources'
 import { useConnection } from '../../context/ConnectionContext'
 import { initNavigationMap } from '@skyhook-io/k8s-ui'
@@ -198,7 +198,13 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   const podCountAllowsBulkMetrics = countsData != null && podCountKnown && !podCountUnavailable && (podCount ?? 0) <= LARGE_RESOURCE_LIST_LIMIT
   const selectedKindName = selectedKind?.name.toLowerCase() ?? ''
   const topPodMetricsEnabled = selectedKindName === 'pods' && podCountAllowsBulkMetrics
-  const topNodeMetricsEnabled = selectedKindName === 'nodes' && namespaces.length === 0 && podCountAllowsBulkMetrics
+  // Node metrics back the Nodes table and, for the Pods table, the pod-vs-node
+  // context line in the CPU/Memory tooltip (a pod can be fine against its own
+  // limit yet at risk from a saturated node). Nodes are cluster-wide, so the
+  // pods case is not gated on the namespace filter.
+  const topNodeMetricsEnabled =
+    ((selectedKindName === 'nodes' && namespaces.length === 0) || selectedKindName === 'pods') &&
+    podCountAllowsBulkMetrics
   const largeListGuard = selectedKind && largeListBlocked
     ? {
         kind: selectedKind.name,
@@ -295,13 +301,8 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   // any host that mounts RadarApp under a non-empty basename (Radar Cloud).
   // Strip the basename here so react-router can re-apply it cleanly.
   const handleNavigate = useMemo(() => {
-    const base = getBasename()
     return (path: string, options?: { replace?: boolean }) => {
-      let p = path
-      if (base && (p === base || p.startsWith(base + '/') || p.startsWith(base + '?'))) {
-        p = p.slice(base.length) || '/'
-      }
-      navigate(p, { replace: options?.replace })
+      navigate(stripBasename(path), { replace: options?.replace })
     }
   }, [navigate])
 

package/src/components/settings/SettingsDialog.tsx

@@ -60,6 +60,7 @@ interface ConfigResponse {
 interface SettingsDialogProps {
   open: boolean
   onClose: () => void
+  initialSection?: SettingsSectionId
 }
 
 // The settings surface splits into three honest apply buckets:
@@ -68,7 +69,7 @@ interface SettingsDialogProps {
 //   • Live integrations (Prometheus, Argo CD) — their own Apply/Connect endpoints
 //     re-point the running server; effect immediately, NOT part of footer dirty.
 //   • AI diagnose — client-side prefs, self-saving, editable by everyone.
-type SectionId =
+export type SettingsSectionId =
   | 'overview' | 'perms' | 'connection' | 'prometheus' | 'argocd' | 'ai' | 'advanced'
 
 // Only STARTUP fields count toward footer dirty. Integration fields (prometheusUrl,
@@ -89,7 +90,11 @@ function normalizeStartup(c: Config) {
   }
 }
 
-export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
+export function SettingsDialog({
+  open,
+  onClose,
+  initialSection = 'overview',
+}: SettingsDialogProps) {
   const dialogRef = useRef<HTMLDivElement>(null)
   const { shouldRender, isOpen } = useAnimatedUnmount(open, 200)
   const { data: versionInfo } = useVersionCheck()
@@ -107,7 +112,7 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
   const [saving, setSaving] = useState(false)
   const [saveMessage, setSaveMessage] = useState<string | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
-  const [section, setSection] = useState<SectionId>('overview')
+  const [section, setSection] = useState<SettingsSectionId>('overview')
   const [confirmingClose, setConfirmingClose] = useState(false)
 
   // AI Diagnosis prefs are client-side (localStorage) and now SELF-SAVING: the
@@ -117,14 +122,14 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
   const aiAvailable = diag.available && diag.agents.length > 0
   const [aiDraft, setAiDraft] = useState<AIDraft>({
     agent: diag.selectedAgent,
-    isolated: diag.isolated,
+    profile: diag.profile,
     model: diag.model,
     effort: diag.effort,
   })
   const [aiSaved, setAiSaved] = useState(false)
   const aiDirty =
     aiDraft.agent !== diag.selectedAgent ||
-    aiDraft.isolated !== diag.isolated ||
+    aiDraft.profile !== diag.profile ||
     aiDraft.model !== diag.model ||
     aiDraft.effort !== diag.effort
 
@@ -158,16 +163,10 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
     setAiSaved(false)
     setAiDraft({
       agent: diag.selectedAgent,
-      isolated: diag.isolated,
+      profile: diag.profile,
       model: diag.model,
       effort: diag.effort,
     })
-    // Overview is the landing section — a status-at-a-glance of what Radar is
-    // connected to (cluster, integrations, MCP, AI), useful to owners and
-    // viewers alike, rather than dropping owners on a config form or everyone
-    // on a permissions dump.
-    setSection('overview')
-
     fetch(apiUrl('/config'), { credentials: getCredentialsMode(), headers: getAuthHeaders() })
       .then((res) => {
         if (!res.ok) throw new Error(`HTTP ${res.status}`)
@@ -185,6 +184,19 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [open])
 
+  useEffect(() => {
+    if (open) setSection(initialSection)
+  }, [open, initialSection])
+
+  useEffect(() => {
+    if (!open || diag.agents.length === 0) return
+    setAiDraft((current) => {
+      const profiles = diag.agents.find((agent) => agent.name === current.agent)?.profiles ?? []
+      if (profiles.length === 0 || profiles.includes(current.profile)) return current
+      return { ...current, profile: profiles[0] }
+    })
+  }, [open, diag.agents])
+
   const updateConfigField = useCallback(<K extends keyof Config>(field: K, value: Config[K]) => {
     setEditedConfig((prev) => ({ ...prev, [field]: value }))
     setSaveMessage(null)
@@ -234,7 +246,7 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
   // agent first, then restore the draft's model/effort.
   const saveAi = useCallback(() => {
     diag.setSelectedAgent(aiDraft.agent)
-    diag.setIsolated(aiDraft.isolated)
+    diag.setProfile(aiDraft.profile)
     diag.setModel(aiDraft.model)
     diag.setEffort(aiDraft.effort)
     setAiSaved(true)
@@ -335,7 +347,7 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
           // Fixed height so the dialog doesn't jump when switching tabs — short
           // tabs leave breathing room, tall ones scroll inside the content pane.
           // max-h keeps it on-screen on short viewports.
-          'sm:rounded-xl sm:max-w-4xl sm:mx-4 sm:h-[620px] sm:max-h-[85vh]',
+          'sm:rounded-xl sm:max-w-4xl sm:mx-4 sm:h-[660px] sm:max-h-[85vh]',
           TRANSITION_PANEL,
           isOpen ? 'opacity-100 scale-100' : 'opacity-0 scale-95'
         )}
@@ -667,7 +679,7 @@ export function SettingsDialog({ open, onClose }: SettingsDialogProps) {
 // -- Sidebar primitives -------------------------------------------------------
 
 interface NavItemDef {
-  id: SectionId
+  id: SettingsSectionId
   label: string
   icon: LucideIcon
   ownerOnly: boolean
@@ -748,8 +760,8 @@ function SectionPane({
   locked,
   children,
 }: {
-  id: SectionId
-  active: SectionId
+  id: SettingsSectionId
+  active: SettingsSectionId
   title: string
   caption?: string
   live?: boolean
@@ -802,7 +814,7 @@ function LockWall() {
 type OverviewTone = 'ok' | 'warn' | 'off' | 'unknown'
 
 interface OverviewRow {
-  id: SectionId
+  id: SettingsSectionId
   icon: LucideIcon
   label: string
   tone: OverviewTone
@@ -817,7 +829,7 @@ interface OverviewRow {
 // probe, so we don't want it firing when Settings opens on another section);
 // cluster and Prometheus status are shared app-wide caches, so they're read
 // unconditionally.
-function OverviewPanel({ active, onNavigate }: { active: boolean; onNavigate: (s: SectionId) => void }) {
+function OverviewPanel({ active, onNavigate }: { active: boolean; onNavigate: (s: SettingsSectionId) => void }) {
   const { data: cluster } = useClusterInfo()
   const { data: prom } = usePrometheusStatus()
   const { data: argo } = useArgoStatus(active)

package/src/components/timeline/RetainedTimelineScrubber.tsx

@@ -13,10 +13,11 @@ import {
   type ScrubberRange,
   type TimelineLiveState,
 } from '@skyhook-io/k8s-ui'
-import type {
-  TimelineSource,
-  TimelineOverviewBucket,
-  TimelineOverviewResult,
+import {
+  RETAINED_CLOCK_SKEW_SLACK_MS,
+  type TimelineSource,
+  type TimelineOverviewBucket,
+  type TimelineOverviewResult,
 } from '../../api/timelineSource'
 import { getApiBase } from '../../api/config'
 
@@ -25,8 +26,11 @@ const DAY_MS = 24 * HOUR_MS
 const EMPTY_BUCKETS: TimelineOverviewBucket[] = []
 const MAX_STRIP_BARS = 512
 
-// Per-request guard on the retained events endpoint: never brush wider than 7d.
-const MAX_SELECTION_MS = 7 * DAY_MS
+// Absolute per-request ceiling on the retained events endpoint, matching the
+// hub's own timelineEventsMaxRange. The effective cap is the smaller of this
+// and the embedder's declared retention depth (maxRangeDays), so a host that
+// advertises 30d of retention can load all 30d in one view.
+const MAX_SELECTION_MS = 31 * DAY_MS
 
 // Group the server's hour buckets into fixed display buckets aligned to the
 // display size, summing counts. The host owns this so the pure scrubber only
@@ -83,8 +87,8 @@ export function buildPresets(maxRangeDays: number): ScrubberPreset[] {
     { label: '24h', ms: DAY_MS },
     { label: '7d', ms: 7 * DAY_MS },
   ]
-  // 30d is a domain-context preset — it clamps to the 7d per-request cap, but
-  // signals the deeper retained window is available.
+  // 30d loads the full retained window in one request (bounded by the hub's
+  // per-request cap); shown only when the retention depth reaches it.
   if (maxRangeDays >= 30) presets.push({ label: '30d', ms: 30 * DAY_MS })
   return presets
 }
@@ -176,17 +180,21 @@ export function RetainedTimelineScrubber({ source, selection, onSelectionChange,
   const availableFromMs = overview.data?.availableFromMs
 
   const domain = useMemo<ScrubberRange>(() => {
-    // Clamp the domain floor to the queryable window. availableFromMs can point
+    // Clamp the domain floor to the LOADED window. availableFromMs can point
     // at ancient synthesized-historical event times (resource creation dates on
-    // long-lived clusters), which would stretch the strip over years of
-    // unreachable nothing — the UI can never brush past maxRangeDays anyway.
-    const floor = now - maxRangeDays * DAY_MS
+    // long-lived clusters), and a host may declare maxRangeDays deeper than the
+    // ring the client actually loads (MAX_SELECTION_MS) — either would stretch
+    // the strip over regions that render empty despite overview density. The
+    // ring's window slides forward by the clock-skew slack, so the floor does
+    // too — without it the oldest slack-width sliver is brushable but never
+    // loadable.
+    const floor = now - Math.min(maxRangeDays * DAY_MS, MAX_SELECTION_MS) + RETAINED_CLOCK_SKEW_SLACK_MS
     const fromMs = availableFromMs != null ? Math.max(availableFromMs, floor) : floor
     return { fromMs: Math.min(fromMs, now - HOUR_MS), toMs: now }
   }, [availableFromMs, now, maxRangeDays])
 
   const domainWidth = domain.toMs - domain.fromMs
-  const maxSelectionMs = Math.min(MAX_SELECTION_MS, domainWidth)
+  const maxSelectionMs = Math.min(maxRangeDays * DAY_MS, MAX_SELECTION_MS, domainWidth)
 
   // The histogram spans the QUERY RANGE (selection) directly —
   // no ×8 framing, no minimap. The query is the view, so a narrow window is never