@skyhook-io/radar-app 1.8.8 → 1.8.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.8.8",
+  "version": "1.8.10",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "diff": "^9.0.0",
     "monaco-editor": "^0.55.1",
     "react-markdown": "^10.1.0",
-    "react-virtuoso": "^4.18.10",
+    "react-virtuoso": "^4.18.11",
     "remark-gfm": "^4.0.1",
     "shiki": "^4.2.0",
     "yaml": "^2.9.0"
@@ -59,7 +59,7 @@
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.1",
     "@tanstack/react-query": "^5.101.2",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -80,7 +80,7 @@
     "tailwindcss": "^4.3.1",
     "typescript": "^6.0.2",
     "typescript-eslint": "^8.62.0",
-    "vite": "^8.0.12"
+    "vite": "^8.1.5"
   },
   "sideEffects": [
     "*.css",

package/src/App.tsx

@@ -11,7 +11,7 @@ import { useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
 import { DiagnoseSurface } from './components/diagnose/DiagnoseSurface'
 import { TopologyGraph, TopologySearch, TopologyBreadcrumb, TopologyFilterSidebar, TopologyControls, FreshnessControl, gitOpsRouteForKind, gitOpsRouteForResource, ScopePill, PaneLoader } from '@skyhook-io/k8s-ui'
 import { initNavigationMap } from '@skyhook-io/k8s-ui/utils/navigation'
-import { useAPIResources, CORE_RESOURCES } from './api/apiResources'
+import { useAPIResources, findAPIResourceForRoute } from './api/apiResources'
 import { TimelineView } from './components/timeline/TimelineView'
 import { ResourcesView } from './components/resources/ResourcesView'
 import { serializeColumnFilters } from './components/resources/resource-utils'
@@ -61,7 +61,7 @@ import { useTheme } from './context/ThemeContext'
 import { Tooltip } from './components/ui/Tooltip'
 import { LargeClusterNamespacePicker } from './components/shared/LargeClusterNamespacePicker'
 import { SettingsDialog } from './components/settings/SettingsDialog'
-import type { TopologyNode, GroupingMode, MainView, SelectedResource, SelectedHelmRelease, NodeKind, TopologyMode, Topology, K8sEvent } from './types'
+import type { APIResource, TopologyNode, GroupingMode, MainView, SelectedResource, SelectedHelmRelease, NodeKind, TopologyMode, Topology, K8sEvent } from './types'
 import { kindToPlural, pluralToKind, openExternal, apiVersionToGroup, relatedResourcePath, searchHitToSelectedResource } from './utils/navigation'
 import { type OmnibarHandle } from './components/ui/Omnibar'
 import { RadarOmnibar } from './components/ui/RadarOmnibar'
@@ -150,7 +150,8 @@ function getViewFromPath(pathname: string): ExtendedMainView {
 function namespaceFilterDisabled(
   view: ExtendedMainView,
   pathname: string,
-  apiResources?: { name: string; kind: string; namespaced: boolean }[],
+  search = '',
+  apiResources?: APIResource[],
 ): { disabled: boolean; tooltip?: string } {
   if (
     view === 'cost' &&
@@ -170,7 +171,8 @@ function namespaceFilterDisabled(
   }
   if (view === 'resources') {
     const kindSlug = segments[1]
-    const match = kindSlug ? apiResources?.find(r => r.name === kindSlug) : undefined
+    const group = new URLSearchParams(search).get('apiGroup') || ''
+    const match = kindSlug ? findAPIResourceForRoute(apiResources, kindSlug, group) : undefined
     if (match && !match.namespaced) {
       return {
         disabled: true,
@@ -185,7 +187,7 @@ function namespaceFilterDisabled(
 // correct regardless of which component renders it. A detail drawer that opens
 // over a list (?resource=…) is deliberately NOT titled — it's the same page, so
 // it keeps the list's title.
-function radarPageTitle(pathname: string, search = '', apiResources?: { name: string; kind: string; group?: string }[]): string | null {
+function radarPageTitle(pathname: string, search = '', apiResources?: APIResource[]): string | null {
   const decode = (s: string) => {
     try {
       return decodeURIComponent(s)
@@ -196,7 +198,7 @@ function radarPageTitle(pathname: string, search = '', apiResources?: { name: st
   const capitalize = (text: string) =>
     text ? text.charAt(0).toUpperCase() + text.slice(1) : text
   const pluralKindTitle = (kind: string, resourceName: string) =>
-    kind.toLowerCase() === resourceName.toLowerCase() ? kind : englishPlural(kind)
+    kind.toLowerCase() === resourceName.toLowerCase() || /Metrics$/.test(kind) ? kind : englishPlural(kind)
   const pathSegments = pathname.replace(/^\//, '').split('/').filter(Boolean)
   const view = getViewFromPath(pathname)
 
@@ -207,7 +209,8 @@ function radarPageTitle(pathname: string, search = '', apiResources?: { name: st
   if (view === 'resources') {
     const resourceName = decode(pathSegments[1] ?? '')
     if (!resourceName) return 'Resources'
-    const match = apiResources?.find((r) => r.name === resourceName)
+    const group = new URLSearchParams(search).get('apiGroup') || ''
+    const match = findAPIResourceForRoute(apiResources, resourceName, group)
     return pluralKindTitle(match?.kind ?? pluralToKind(resourceName), resourceName)
   }
   // GitOps detail is /gitops/detail/<kind>/<ns>/<name> → the resource name;
@@ -387,10 +390,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
 
   // View-aware namespace scope: disabled on cluster-scoped surfaces so the
   // chip isn't a dead control next to the cluster switcher.
-  // Fall back to the static core-resource list before discovery loads, so the
-  // chip disables immediately on a cluster-scoped core kind (Nodes, PVs, …)
-  // instead of flickering enabled until /api-resources resolves.
-  const namespaceFilter = namespaceFilterDisabled(mainView, location.pathname, navApiResources ?? CORE_RESOURCES)
+  const namespaceFilter = namespaceFilterDisabled(mainView, location.pathname, location.search, navApiResources)
 
   // One URL-derived tab title for every view (see radarPageTitle). Driving it
   // from the URL — not the mounted component. Off unless the host opts in

package/src/RadarApp.tsx

@@ -40,7 +40,10 @@ import type { ClusterLoadState } from "./types/clusterLoadState";
 import { TimelineSourceProvider } from "./context/TimelineSource";
 import type { TimelineSourceConfig } from "./api/timelineSource";
 import { DiagnoseCustomizationProvider } from "./context/DiagnoseCustomization";
-import type { RenderDiagnoseAction } from "./context/DiagnoseCustomization";
+import type {
+  RenderDiagnoseAction,
+  DiagnoseConsentCopy,
+} from "./context/DiagnoseCustomization";
 import { defaultDiagnoseAction } from "./components/diagnose/LocalDiagnoseAction";
 import { DiagnoseProvider } from "./components/diagnose/DiagnoseContext";
 
@@ -110,6 +113,15 @@ export interface RadarAppProps {
    * agent-free. See ./context/DiagnoseCustomization for the render-prop shape.
    */
   renderDiagnoseAction?: RenderDiagnoseAction;
+  /**
+   * Replaces the first-run consent card's trust copy. REQUIRED of any host whose
+   * backend runs the agent somewhere other than the user's own machine — the
+   * default copy states the agent runs locally, under the user's own model
+   * account, with transcripts kept on their disk, and none of that is true of a
+   * hosted runner. Radar keeps the card's chrome and the Approve/Cancel flow; a
+   * host only supplies the claims. See ./context/DiagnoseCustomization.
+   */
+  diagnoseConsent?: DiagnoseConsentCopy;
   /**
    * Initial route for `router: 'memory'` (ignored for 'browser'). Lets a host
    * deep-link a specific view (e.g. '/topology') without owning the URL bar —
@@ -184,6 +196,7 @@ export function RadarApp({
   manageDocumentTitle = false,
   documentTitleSuffix,
   renderDiagnoseAction,
+  diagnoseConsent,
   initialPath,
   onClusterLoadStateChange,
   timelineSource,
@@ -213,6 +226,7 @@ export function RadarApp({
               <TimelineSourceProvider config={timelineSource}>
                 <DiagnoseCustomizationProvider
                   value={renderDiagnoseAction ?? defaultDiagnoseAction}
+                  consentCopy={diagnoseConsent}
                 >
                   <DiagnoseProvider>
                     <App

package/src/api/apiResources.ts

@@ -3,7 +3,7 @@ import type { APIResource } from '../types'
 import { apiUrl, getAuthHeaders, getCredentialsMode } from './config'
 
 // Re-export pure functions from package
-export { categorizeResources, CORE_RESOURCES, formatGroupName, shortenGroupName, getKindLabel, getKindPlural } from '@skyhook-io/k8s-ui'
+export { categorizeResources, CORE_RESOURCES, findAPIResourceForRoute, formatGroupName, shortenGroupName, getKindLabel, getKindPlural } from '@skyhook-io/k8s-ui'
 export type { ResourceCategory } from '@skyhook-io/k8s-ui'
 
 async function fetchJSON<T>(path: string): Promise<T> {

package/src/api/client.ts

@@ -255,15 +255,6 @@ export interface DashboardResourceCounts {
   restricted?: string[] // Resource kinds the user cannot list due to RBAC
 }
 
-export interface DashboardEvent {
-  type: string
-  reason: string
-  message: string
-  involvedObject: string
-  namespace: string
-  timestamp: string
-}
-
 export interface DashboardChange {
   kind: string
   namespace: string
@@ -387,7 +378,6 @@ export interface DashboardResponse {
   health: DashboardHealth
   problems: DashboardProblem[]
   resourceCounts: DashboardResourceCounts
-  recentEvents: DashboardEvent[]
   recentChanges: DashboardChange[]
   topologySummary: DashboardTopologySummary
   trafficSummary: DashboardTrafficSummary | null

package/src/components/diagnose/DiagnoseContext.tsx

@@ -361,6 +361,7 @@ export function DiagnoseProvider({ children }: { children: ReactNode }) {
     startRunRef.current(t);
   }, []);
   const openRun = useCallback((id: string) => {
+    setStartError(null);
     setActiveRunId(id);
     setView("investigation");
     setOpen(true);

package/src/components/diagnose/DiagnoseSurface.tsx

@@ -23,6 +23,7 @@ import {
   agentLabelFor,
   openDiagnoseSettings,
 } from "./DiagnoseContext";
+import { useDiagnoseCustomization } from "../../context/DiagnoseCustomization";
 import { InvestigationView } from "./InvestigationView";
 import { RecentList } from "./Home";
 import { ConsentCard } from "./parts";
@@ -136,6 +137,11 @@ function InvestigationMenu({ run }: { run: RunSummary }) {
 // Helm drawers, so it no longer floats viewport-fixed or DOM-measures the chrome.
 export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
   const d = useDiagnose();
+  // Injected settings action: undefined = Radar's own Settings dialog;
+  // null = hide the gear + links.
+  const { consentCopy, onOpenSettings: hostOpenSettings } = useDiagnoseCustomization();
+  const openSettings =
+    hostOpenSettings === undefined ? openDiagnoseSettings : hostOpenSettings;
   const {
     maximized,
     setMaximized,
@@ -203,7 +209,8 @@ export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
           agentName={d.agentLabel}
           agent={d.selectedAgent}
           isolated={d.isolated}
-          onOpenSettings={openDiagnoseSettings}
+          copy={consentCopy}
+          onOpenSettings={openSettings ?? undefined}
           onApprove={d.approveConsent}
           onCancel={d.cancelConsent}
         />
@@ -303,15 +310,17 @@ export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
             </div>
             <div className="flex items-center gap-1 text-xs text-theme-text-tertiary">
               <span className="truncate">{configLine}</span>
-              <Tooltip content="AI settings" position="bottom">
-                <button
-                  onClick={openDiagnoseSettings}
-                  className="shrink-0 rounded p-0.5 text-theme-text-tertiary hover:text-theme-text-primary"
-                  aria-label="AI settings"
-                >
-                  <Settings2 className="h-3 w-3" />
-                </button>
-              </Tooltip>
+              {openSettings && (
+                <Tooltip content="AI settings" position="bottom">
+                  <button
+                    onClick={openSettings}
+                    className="shrink-0 rounded p-0.5 text-theme-text-tertiary hover:text-theme-text-primary"
+                    aria-label="AI settings"
+                  >
+                    <Settings2 className="h-3 w-3" />
+                  </button>
+                </Tooltip>
+              )}
             </div>
           </div>
         </div>

package/src/components/diagnose/InvestigationView.tsx

@@ -44,7 +44,11 @@ export function InvestigationView({
   maximized: boolean;
 }) {
   const { kind, namespace, name } = run;
-  const { refreshRuns, openInvestigation } = useDiagnose();
+  const { refreshRuns, openInvestigation, startError } = useDiagnose();
+  const retryDiagnosis = useCallback(
+    () => openInvestigation({ kind, namespace, name }),
+    [openInvestigation, kind, namespace, name],
+  );
   const queryClient = useQueryClient();
   const [turns, setTurns] = useState<Turn[]>([]);
   // The run is gone server-side (evicted past the retention cap, or lost on a
@@ -505,14 +509,23 @@ export function InvestigationView({
                   onApply={canApply ? requestApply : undefined}
                   onAsk={isLast && !busy && !stale ? askFollowup : undefined}
                   onCheckStatus={canCheck ? checkStatus : undefined}
+                  onRetryDiagnosis={
+                    isLast &&
+                    t.status === "error" &&
+                    !t.question &&
+                    !t.apply &&
+                    !stale
+                      ? retryDiagnosis
+                      : undefined
+                  }
                   hideVerdict={pinned && i === pinnedIdx}
                 />
               );
             })}
-            {actionError && (
+            {(actionError || startError) && (
               <div className="flex items-start gap-2 rounded-lg border border-red-500/30 bg-red-500/10 p-3 text-sm text-theme-text-primary">
                 <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-red-400" />
-                <span>{actionError}</span>
+                <span>{actionError || startError}</span>
               </div>
             )}
           </div>

package/src/components/diagnose/parts.tsx

@@ -22,6 +22,7 @@ import { stringify as toYaml } from "yaml";
 import { codeToHtml } from "shiki";
 import { DialogPortal } from "@skyhook-io/k8s-ui/components/ui/DialogPortal";
 import { useTheme } from "../../context/ThemeContext";
+import { type DiagnoseConsentCopy } from "../../context/DiagnoseCustomization";
 import {
   type Diagnosis,
   type DiagnoseStep,
@@ -402,6 +403,7 @@ export function TurnView({
   onApply,
   onAsk,
   onCheckStatus,
+  onRetryDiagnosis,
   hideVerdict = false,
 }: {
   turn: Turn;
@@ -410,6 +412,7 @@ export function TurnView({
   onApply?: (fix: string) => void;
   onAsk?: (question: string) => void;
   onCheckStatus?: () => void;
+  onRetryDiagnosis?: () => void;
   // In the maximized workspace the pinned turn's verdict renders in the side rail,
   // so the transcript suppresses its own copy (reasoning + tool calls still show).
   hideVerdict?: boolean;
@@ -469,7 +472,18 @@ export function TurnView({
       {turn.status === "error" && turn.error && (
         <div className="flex items-start gap-2 rounded-lg border border-red-500/30 bg-red-500/10 p-3 text-sm text-theme-text-primary">
           <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-red-400" />
-          <span>{turn.error}</span>
+          <div className="flex min-w-0 flex-col gap-2">
+            <span className="whitespace-pre-wrap break-words">{turn.error}</span>
+            {onRetryDiagnosis && (
+              <button
+                type="button"
+                onClick={onRetryDiagnosis}
+                className="btn-brand self-start px-3 py-1 text-xs"
+              >
+                Retry diagnosis
+              </button>
+            )}
+          </div>
         </div>
       )}
     </div>
@@ -568,95 +582,51 @@ export function RunContextCard({ run }: { run: RunSummary }) {
   );
 }
 
-// The first-run consent + trust card. Its copy is the OSS BYO-local trust story
-// ("your own agent, on your machine, nothing to Radar").
-// TODO(cloud): this copy must become embedder-overridable for Radar Cloud, where
-//   the agent runs in the cloud (the company's self-hosted instance + their key /
-//   local LLM, OR our SaaS) — a different, honestly-different trust story ("runs in
-//   your Radar Cloud, audited, managed key"). Plumb an override through the
-//   DiagnoseCustomization seam (same place Hub overrides the entry button) before
-//   the k8s-ui lift, so OSS and Cloud don't ship the same claim over different data
-//   flows. This is also a natural "upgrade to Cloud" surface.
-export function ConsentCard({
-  agentName,
-  agent,
-  isolated = true,
+// ConsentCardShell owns the card chrome (icon, layout, settings link, Approve/
+// Cancel) so every copy tier — the OSS default, the hosted fallback, and a host
+// override — feeds the same frame instead of duplicating it.
+function ConsentCardShell({
+  title,
+  body,
+  bullets,
+  settingsLabel,
+  approveLabel = "Approve & investigate",
   onOpenSettings,
   onApprove,
   onCancel,
-}: {
-  agentName: string;
-  agent?: string;
-  isolated?: boolean;
+}: DiagnoseConsentCopy & {
   onOpenSettings?: () => void;
   onApprove: () => void;
   onCancel: () => void;
 }) {
-  // Cursor can't be isolated (no flag suppresses its global MCP servers), so it
-  // gets its own honest framing rather than the isolated/my-setup pair.
-  const isCursor = agent === "cursor-agent";
+  // `settingsLabel: null` hides the link outright — a host with one fixed agent
+  // has nothing behind it. `undefined` keeps the OSS default label.
+  const resolvedSettingsLabel =
+    settingsLabel === undefined
+      ? "Change the agent and how it runs in Settings"
+      : settingsLabel;
   return (
     <div className="rounded-lg border border-theme-border bg-theme-elevated p-4">
       <div className="mb-2 flex items-center gap-2">
         <ShieldCheck className="h-4 w-4 text-accent" />
         <div className="text-sm font-medium text-theme-text-primary">
-          {isolated && !isCursor
-            ? "Run a read-only AI investigation?"
-            : "Run an AI investigation?"}
+          {title}
         </div>
       </div>
-      <p className="text-sm leading-relaxed text-theme-text-secondary">
-        This runs{" "}
-        <span className="font-medium text-theme-text-primary">
-          your own {agentName}
-        </span>{" "}
-        on your machine — no Radar cloud, no API key, no account. Radar sends
-        this resource&apos;s spec, recent events, and pod logs to it (and on to
-        its model provider under your account, not to Radar). Transcripts are
-        kept in your local Radar history on this machine until cleared.
-        {isolated && !isCursor && (
-          <>
-            {" "}
-            Through Radar the agent can only{" "}
-            <span className="font-medium">read</span> — it cannot change your
-            cluster.
-          </>
-        )}
-      </p>
-      <ul className="mt-2 space-y-1 text-xs text-theme-text-tertiary">
-        {isCursor ? (
-          <li>
-            • Through Radar the agent only <span className="font-medium">reads</span>{" "}
-            your cluster. But Cursor also loads your own global MCP servers and
-            Radar can&apos;t exclude them (unlike Claude or Codex), so if any of
-            those can make changes, Cursor could use them.
-          </li>
-        ) : isolated ? (
-          <li>
-            • Isolated: only Radar&apos;s read-only investigation tools — your
-            other CLI config and MCP servers are excluded.
-            {agent === "codex" && (
-              <>
-                {" "}
-                Codex&apos;s sandboxed shell can still <em>read</em> files on
-                your machine (it cannot write or reach the network).
-              </>
-            )}
-          </li>
-        ) : (
-          <li>
-            • &ldquo;My setup&rdquo;: the agent also runs with your own CLI
-            config + MCP servers and can read local files. Only Radar&apos;s own
-            tools are read-only.
-          </li>
-        )}
-      </ul>
-      {onOpenSettings && (
+      <div className="text-sm leading-relaxed text-theme-text-secondary">{body}</div>
+      {bullets && bullets.length > 0 && (
+        <ul className="mt-2 space-y-1 text-xs text-theme-text-tertiary">
+          {bullets.map((b, i) => (
+            <li key={i}>• {b}</li>
+          ))}
+        </ul>
+      )}
+      {onOpenSettings && resolvedSettingsLabel && (
         <button
           onClick={onOpenSettings}
           className="mt-3 text-xs text-accent hover:underline"
         >
-          Change the agent and how it runs in Settings
+          {resolvedSettingsLabel}
         </button>
       )}
       <div className="mt-4 flex gap-2">
@@ -670,13 +640,110 @@ export function ConsentCard({
           onClick={onApprove}
           className="flex-1 rounded-lg btn-brand py-1.5 text-sm"
         >
-          Approve &amp; investigate
+          {approveLabel}
         </button>
       </div>
     </div>
   );
 }
 
+// The first-run consent + trust card. The copy is checkable fact about a data
+// flow — not marketing — and the wrong claim is a lie, not a typo. It resolves
+// in two tiers:
+//
+//   1. `copy` — the embedding host tells its own trust story. Only the host
+//      knows where its agent runs, whose key pays, and where transcripts live,
+//      so any host that runs the agent somewhere other than the OSS local CLI
+//      MUST override rather than let Radar assert the local story over its flow.
+//   2. No `copy` — the OSS bring-your-own-local-CLI default, the only tier where
+//      "on your machine / no Radar cloud / your account" actually holds.
+export function ConsentCard({
+  agentName,
+  agent,
+  isolated = true,
+  copy,
+  onOpenSettings,
+  onApprove,
+  onCancel,
+}: {
+  agentName: string;
+  agent?: string;
+  isolated?: boolean;
+  copy?: DiagnoseConsentCopy;
+  onOpenSettings?: () => void;
+  onApprove: () => void;
+  onCancel: () => void;
+}) {
+  const chrome = { onOpenSettings, onApprove, onCancel };
+
+  // Tier 1: a host (e.g. radar-hub-web) supplied its own copy — use it verbatim.
+  if (copy) return <ConsentCardShell {...copy} {...chrome} />;
+
+  // Tier 2: OSS BYO-local default. Cursor can't be isolated (no flag suppresses
+  // its global MCP servers), so it gets its own honest framing rather than the
+  // isolated/my-setup pair.
+  const isCursor = agent === "cursor-agent";
+  return (
+    <ConsentCardShell
+      {...chrome}
+      title={
+        isolated && !isCursor
+          ? "Run a read-only AI investigation?"
+          : "Run an AI investigation?"
+      }
+      body={
+        <>
+          This runs{" "}
+          <span className="font-medium text-theme-text-primary">
+            your own {agentName}
+          </span>{" "}
+          on your machine — no Radar cloud, no API key, no account. Radar sends
+          this resource&apos;s spec, recent events, and pod logs to it (and on to
+          its model provider under your account, not to Radar). Transcripts are
+          kept in your local Radar history on this machine until cleared.
+          {isolated && !isCursor && (
+            <>
+              {" "}
+              Through Radar the agent can only{" "}
+              <span className="font-medium">read</span> — it cannot change your
+              cluster.
+            </>
+          )}
+        </>
+      }
+      bullets={[
+        isCursor ? (
+          <>
+            Through Radar the agent only{" "}
+            <span className="font-medium">reads</span> your cluster. But Cursor
+            also loads your own global MCP servers and Radar can&apos;t exclude
+            them (unlike Claude or Codex), so if any of those can make changes,
+            Cursor could use them.
+          </>
+        ) : isolated ? (
+          <>
+            Isolated: only Radar&apos;s read-only investigation tools — your
+            other CLI config and MCP servers are excluded.
+            {agent === "codex" && (
+              <>
+                {" "}
+                Codex&apos;s sandboxed shell can still <em>read</em> files on
+                your machine (it cannot write or reach the network).
+              </>
+            )}
+          </>
+        ) : (
+          <>
+            &ldquo;My setup&rdquo;: the agent also runs with your own CLI config
+            + MCP servers and can read local files. Only Radar&apos;s own tools
+            are read-only.
+          </>
+        ),
+      ]}
+    />
+  );
+}
+
 // The Apply confirmation — wider than a generic confirm so the recommended fix
 // (rendered markdown) is legible, making it unambiguous what the one click does.
 export function ApplyDialog({

package/src/components/home/mcpToolCatalog.ts

@@ -96,13 +96,13 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_pod_logs',
-    desc: 'Filtered log lines from a pod, prioritizing errors and warnings, falling back to recent tail lines. Optional grep, since, and previous-container logs.',
+    desc: 'Pod logs with secret redaction. Without grep, prioritizes errors and warnings and falls back to recent tail lines; grep returns only regex matches instead.',
     params: [
       { arg: 'namespace', required: true, desc: 'pod namespace' },
       { arg: 'name', required: true, desc: 'pod name' },
       { arg: 'container', desc: 'container name (defaults to first)' },
       { arg: 'tail_lines', desc: 'lines from end (default 200)' },
-      { arg: 'grep', desc: 'regex to filter lines, like kubectl logs | grep' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
       { arg: 'since', desc: 'only logs newer than this duration (e.g. 30s, 10m, 1h)' },
       { arg: 'previous', desc: 'logs from the previous terminated container (CrashLoopBackOff)' },
     ],
@@ -194,11 +194,17 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_subject_permissions',
-    desc: 'Effective RBAC for a ServiceAccount, User, or Group: the bindings that grant access, a flattened rule list, and (for SAs) the Pods running as it. Answers "what\'s the blast radius if compromised?".',
+    desc: 'Effective RBAC for a ServiceAccount, User, or Group. Returns the full bindings/rules dump by default, or an authoritative SubjectAccessReview answer when verb and resource are supplied for a ServiceAccount.',
     params: [
       { arg: 'kind', required: true, desc: 'ServiceAccount, User, or Group' },
       { arg: 'name', required: true, desc: 'subject name' },
       { arg: 'namespace', desc: 'required for ServiceAccount; omit for User/Group' },
+      { arg: 'verb', desc: 'access check: Kubernetes API verb; requires resource' },
+      { arg: 'resource', desc: 'access check: plural API resource; requires verb' },
+      { arg: 'group', desc: 'access check: API group; omit for core/v1' },
+      { arg: 'resource_namespace', desc: 'access check target; defaults to subject namespace' },
+      { arg: 'subresource', desc: 'access check subresource, e.g. log for pods/log' },
+      { arg: 'resource_name', desc: 'access check target resource name' },
     ],
   },
   {
@@ -237,14 +243,14 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_workload_logs',
-    desc: 'Aggregated, filtered logs across all pods of a workload (Deployment, StatefulSet, DaemonSet, Job, or Argo Workflow) — collected concurrently, filtered for errors/warnings, and deduplicated.',
+    desc: 'Aggregated logs across all pods of a workload. Without grep, filters for diagnostic relevance; grep returns only matching timestamp-prefixed lines instead.',
     params: [
       { arg: 'kind', desc: 'deployment (default), statefulset, daemonset, job, or workflow' },
       { arg: 'namespace', required: true, desc: 'workload namespace' },
       { arg: 'name', required: true, desc: 'workload name' },
       { arg: 'container', desc: 'specific container (defaults to all)' },
       { arg: 'tail_lines', desc: 'lines per pod (default 100)' },
-      { arg: 'grep', desc: 'regex to filter lines, like kubectl logs | grep' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
       { arg: 'since', desc: 'only logs newer than this duration' },
       { arg: 'previous', desc: 'logs from the previous terminated container' },
     ],

package/src/components/workload/WorkloadView.tsx

@@ -288,7 +288,7 @@ function useActionsBarProps(kind: string, namespace: string, name: string) {
   const uncordonMutation = useUncordonNode()
   const drainMutation = useDrainNode()
 
-  const renderDiagnose = useDiagnoseCustomization()
+  const { renderAction: renderDiagnose } = useDiagnoseCustomization()
 
   return {
     canExec,

package/src/context/DiagnoseCustomization.tsx

@@ -1,4 +1,5 @@
-// Slot-based injection of a resource-level "Diagnose" action.
+// Slot-based injection of a resource-level "Diagnose" action, and of the
+// consent card's trust copy.
 //
 // Lets an embedding host (e.g. Radar Hub) inject a "Diagnose with AI" button
 // into every resource detail action bar — without forking WorkloadView or the
@@ -8,7 +9,7 @@
 //
 // Default (no provider): Radar renders no Diagnose button — OSS stays
 // agent-free.
-import { createContext, useContext } from 'react';
+import { createContext, useContext, useMemo } from 'react';
 import type { ReactNode } from 'react';
 
 /** Render prop for the resource-level Diagnose action. */
@@ -21,22 +22,72 @@ export type RenderDiagnoseAction = (ctx: {
   health?: "problem" | "healthy" | "unknown";
 }) => ReactNode;
 
-const DiagnoseCustomizationContext = createContext<RenderDiagnoseAction | undefined>(undefined);
+/**
+ * Trust copy for the first-run consent card.
+ *
+ * The card makes concrete, checkable claims about *where* the agent runs,
+ * *whose* model account it bills, and *where* the transcript is stored. Those
+ * claims are only true of OSS's bring-your-own-local-CLI agent. A host that
+ * runs the agent anywhere else (Radar Cloud runs it as a sandboxed Job under a
+ * managed key) MUST supply its own copy — shipping OSS's over a different data
+ * flow states the opposite of what happens.
+ *
+ * Radar owns the card's chrome (icon, layout, Approve/Cancel) either way; a
+ * host only replaces the claims.
+ */
+export type DiagnoseConsentCopy = {
+  title: string;
+  body: ReactNode;
+  /** Detail list under the body; each entry is rendered as its own "•" row. */
+  bullets?: ReactNode[];
+  /** Label for the settings link. `null` hides it — for hosts with one fixed
+   *  agent and no isolation choice, where it would open an empty dialog. */
+  settingsLabel?: string | null;
+  approveLabel?: string;
+};
+
+// One context for the whole customization seam — the values are host config
+// set once at mount, so per-value re-render isolation buys nothing.
+export interface DiagnoseCustomization {
+  renderAction: RenderDiagnoseAction | undefined;
+  consentCopy: DiagnoseConsentCopy | undefined;
+  // undefined = default (CustomEvent → Radar's own Settings dialog);
+  // null = hide the settings affordances.
+  onOpenSettings: (() => void) | null | undefined;
+}
+
+const DEFAULTS: DiagnoseCustomization = {
+  renderAction: undefined,
+  consentCopy: undefined,
+  onOpenSettings: undefined,
+};
+
+const DiagnoseCustomizationContext = createContext<DiagnoseCustomization>(DEFAULTS);
 
 export function DiagnoseCustomizationProvider({
   value,
+  consentCopy,
+  onOpenSettings,
   children,
 }: {
   value: RenderDiagnoseAction | undefined;
+  consentCopy?: DiagnoseConsentCopy;
+  /** Where "AI settings" affordances lead. Omit for Radar's own Settings
+   *  dialog; pass `null` to hide them. */
+  onOpenSettings?: (() => void) | null;
   children: ReactNode;
 }) {
+  const ctx = useMemo(
+    () => ({ renderAction: value, consentCopy, onOpenSettings }),
+    [value, consentCopy, onOpenSettings],
+  );
   return (
-    <DiagnoseCustomizationContext.Provider value={value}>
+    <DiagnoseCustomizationContext.Provider value={ctx}>
       {children}
     </DiagnoseCustomizationContext.Provider>
   );
 }
 
-export function useDiagnoseCustomization(): RenderDiagnoseAction | undefined {
+export function useDiagnoseCustomization(): DiagnoseCustomization {
   return useContext(DiagnoseCustomizationContext);
 }

package/src/index.ts

@@ -26,7 +26,28 @@ export type {
   TimelineCoverageSpan,
   TimelineOverviewResult,
 } from './api/timelineSource';
-export type { RenderDiagnoseAction } from './context/DiagnoseCustomization';
+export type {
+  RenderDiagnoseAction,
+  DiagnoseConsentCopy,
+} from './context/DiagnoseCustomization';
+
+// Standalone AI-diagnose surface — mount the investigation panel outside a
+// full <RadarApp>. No router dependency, no client-side cluster state: the
+// backend set via setApiBase() picks the cluster, so hosts remount
+// <DiagnoseProvider key={cluster}> to switch. Mount order: ThemeProvider >
+// DiagnoseCustomizationProvider > DiagnoseProvider > DiagnoseSurface, under a
+// @tanstack/react-query QueryClientProvider.
+export {
+  DiagnoseProvider,
+  useDiagnose,
+  useDiagnoseLayout,
+} from './components/diagnose/DiagnoseContext';
+export type { Target as DiagnoseTarget } from './components/diagnose/DiagnoseContext';
+export { DiagnoseSurface } from './components/diagnose/DiagnoseSurface';
+export { DiagnoseCustomizationProvider } from './context/DiagnoseCustomization';
+// The panel reads Radar's ThemeContext (throws unprovided). It follows
+// localStorage['radar-theme'], so host and panel flip together.
+export { ThemeProvider } from './context/ThemeContext';
 export { ShortcutHelpOverlay } from './components/ui/ShortcutHelpOverlay';
 
 // Shared cluster-switcher primitive — re-exported from @skyhook-io/k8s-ui so