@skyhook-io/radar-app 1.8.9 → 1.8.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "diff": "^9.0.0",
     "monaco-editor": "^0.55.1",
     "react-markdown": "^10.1.0",
-    "react-virtuoso": "^4.18.10",
+    "react-virtuoso": "^4.18.11",
     "remark-gfm": "^4.0.1",
     "shiki": "^4.2.0",
     "yaml": "^2.9.0"
@@ -59,7 +59,7 @@
     "@tailwindcss/typography": "^0.5.20",
     "@tailwindcss/vite": "^4.3.1",
     "@tanstack/react-query": "^5.101.2",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -80,7 +80,7 @@
     "tailwindcss": "^4.3.1",
     "typescript": "^6.0.2",
     "typescript-eslint": "^8.62.0",
-    "vite": "^8.0.12"
+    "vite": "^8.1.5"
   },
   "sideEffects": [
     "*.css",

package/src/components/diagnose/DiagnoseSurface.tsx

@@ -23,7 +23,7 @@ import {
   agentLabelFor,
   openDiagnoseSettings,
 } from "./DiagnoseContext";
-import { useDiagnoseConsentCopy } from "../../context/DiagnoseCustomization";
+import { useDiagnoseCustomization } from "../../context/DiagnoseCustomization";
 import { InvestigationView } from "./InvestigationView";
 import { RecentList } from "./Home";
 import { ConsentCard } from "./parts";
@@ -137,7 +137,11 @@ function InvestigationMenu({ run }: { run: RunSummary }) {
 // Helm drawers, so it no longer floats viewport-fixed or DOM-measures the chrome.
 export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
   const d = useDiagnose();
-  const consentCopy = useDiagnoseConsentCopy();
+  // Injected settings action: undefined = Radar's own Settings dialog;
+  // null = hide the gear + links.
+  const { consentCopy, onOpenSettings: hostOpenSettings } = useDiagnoseCustomization();
+  const openSettings =
+    hostOpenSettings === undefined ? openDiagnoseSettings : hostOpenSettings;
   const {
     maximized,
     setMaximized,
@@ -206,7 +210,7 @@ export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
           agent={d.selectedAgent}
           isolated={d.isolated}
           copy={consentCopy}
-          onOpenSettings={openDiagnoseSettings}
+          onOpenSettings={openSettings ?? undefined}
           onApprove={d.approveConsent}
           onCancel={d.cancelConsent}
         />
@@ -306,15 +310,17 @@ export function DiagnoseSurface({ topInset = 0 }: { topInset?: number }) {
             </div>
             <div className="flex items-center gap-1 text-xs text-theme-text-tertiary">
               <span className="truncate">{configLine}</span>
-              <Tooltip content="AI settings" position="bottom">
-                <button
-                  onClick={openDiagnoseSettings}
-                  className="shrink-0 rounded p-0.5 text-theme-text-tertiary hover:text-theme-text-primary"
-                  aria-label="AI settings"
-                >
-                  <Settings2 className="h-3 w-3" />
-                </button>
-              </Tooltip>
+              {openSettings && (
+                <Tooltip content="AI settings" position="bottom">
+                  <button
+                    onClick={openSettings}
+                    className="shrink-0 rounded p-0.5 text-theme-text-tertiary hover:text-theme-text-primary"
+                    aria-label="AI settings"
+                  >
+                    <Settings2 className="h-3 w-3" />
+                  </button>
+                </Tooltip>
+              )}
             </div>
           </div>
         </div>

package/src/components/home/mcpToolCatalog.ts

@@ -96,13 +96,13 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_pod_logs',
-    desc: 'Filtered log lines from a pod, prioritizing errors and warnings, falling back to recent tail lines. Optional grep, since, and previous-container logs.',
+    desc: 'Pod logs with secret redaction. Without grep, prioritizes errors and warnings and falls back to recent tail lines; grep returns only regex matches instead.',
     params: [
       { arg: 'namespace', required: true, desc: 'pod namespace' },
       { arg: 'name', required: true, desc: 'pod name' },
       { arg: 'container', desc: 'container name (defaults to first)' },
       { arg: 'tail_lines', desc: 'lines from end (default 200)' },
-      { arg: 'grep', desc: 'regex to filter lines, like kubectl logs | grep' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
       { arg: 'since', desc: 'only logs newer than this duration (e.g. 30s, 10m, 1h)' },
       { arg: 'previous', desc: 'logs from the previous terminated container (CrashLoopBackOff)' },
     ],
@@ -194,11 +194,17 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_subject_permissions',
-    desc: 'Effective RBAC for a ServiceAccount, User, or Group: the bindings that grant access, a flattened rule list, and (for SAs) the Pods running as it. Answers "what\'s the blast radius if compromised?".',
+    desc: 'Effective RBAC for a ServiceAccount, User, or Group. Returns the full bindings/rules dump by default, or an authoritative SubjectAccessReview answer when verb and resource are supplied for a ServiceAccount.',
     params: [
       { arg: 'kind', required: true, desc: 'ServiceAccount, User, or Group' },
       { arg: 'name', required: true, desc: 'subject name' },
       { arg: 'namespace', desc: 'required for ServiceAccount; omit for User/Group' },
+      { arg: 'verb', desc: 'access check: Kubernetes API verb; requires resource' },
+      { arg: 'resource', desc: 'access check: plural API resource; requires verb' },
+      { arg: 'group', desc: 'access check: API group; omit for core/v1' },
+      { arg: 'resource_namespace', desc: 'access check target; defaults to subject namespace' },
+      { arg: 'subresource', desc: 'access check subresource, e.g. log for pods/log' },
+      { arg: 'resource_name', desc: 'access check target resource name' },
     ],
   },
   {
@@ -237,14 +243,14 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'get_workload_logs',
-    desc: 'Aggregated, filtered logs across all pods of a workload (Deployment, StatefulSet, DaemonSet, Job, or Argo Workflow) — collected concurrently, filtered for errors/warnings, and deduplicated.',
+    desc: 'Aggregated logs across all pods of a workload. Without grep, filters for diagnostic relevance; grep returns only matching timestamp-prefixed lines instead.',
     params: [
       { arg: 'kind', desc: 'deployment (default), statefulset, daemonset, job, or workflow' },
       { arg: 'namespace', required: true, desc: 'workload namespace' },
       { arg: 'name', required: true, desc: 'workload name' },
       { arg: 'container', desc: 'specific container (defaults to all)' },
       { arg: 'tail_lines', desc: 'lines per pod (default 100)' },
-      { arg: 'grep', desc: 'regex to filter lines, like kubectl logs | grep' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
       { arg: 'since', desc: 'only logs newer than this duration' },
       { arg: 'previous', desc: 'logs from the previous terminated container' },
     ],

package/src/components/workload/WorkloadView.tsx

@@ -288,7 +288,7 @@ function useActionsBarProps(kind: string, namespace: string, name: string) {
   const uncordonMutation = useUncordonNode()
   const drainMutation = useDrainNode()
 
-  const renderDiagnose = useDiagnoseCustomization()
+  const { renderAction: renderDiagnose } = useDiagnoseCustomization()
 
   return {
     canExec,

package/src/context/DiagnoseCustomization.tsx

@@ -9,7 +9,7 @@
 //
 // Default (no provider): Radar renders no Diagnose button — OSS stays
 // agent-free.
-import { createContext, useContext } from 'react';
+import { createContext, useContext, useMemo } from 'react';
 import type { ReactNode } from 'react';
 
 /** Render prop for the resource-level Diagnose action. */
@@ -46,31 +46,48 @@ export type DiagnoseConsentCopy = {
   approveLabel?: string;
 };
 
-const DiagnoseCustomizationContext = createContext<RenderDiagnoseAction | undefined>(undefined);
-const DiagnoseConsentCopyContext = createContext<DiagnoseConsentCopy | undefined>(undefined);
+// One context for the whole customization seam — the values are host config
+// set once at mount, so per-value re-render isolation buys nothing.
+export interface DiagnoseCustomization {
+  renderAction: RenderDiagnoseAction | undefined;
+  consentCopy: DiagnoseConsentCopy | undefined;
+  // undefined = default (CustomEvent → Radar's own Settings dialog);
+  // null = hide the settings affordances.
+  onOpenSettings: (() => void) | null | undefined;
+}
+
+const DEFAULTS: DiagnoseCustomization = {
+  renderAction: undefined,
+  consentCopy: undefined,
+  onOpenSettings: undefined,
+};
+
+const DiagnoseCustomizationContext = createContext<DiagnoseCustomization>(DEFAULTS);
 
 export function DiagnoseCustomizationProvider({
   value,
   consentCopy,
+  onOpenSettings,
   children,
 }: {
   value: RenderDiagnoseAction | undefined;
   consentCopy?: DiagnoseConsentCopy;
+  /** Where "AI settings" affordances lead. Omit for Radar's own Settings
+   *  dialog; pass `null` to hide them. */
+  onOpenSettings?: (() => void) | null;
   children: ReactNode;
 }) {
+  const ctx = useMemo(
+    () => ({ renderAction: value, consentCopy, onOpenSettings }),
+    [value, consentCopy, onOpenSettings],
+  );
   return (
-    <DiagnoseCustomizationContext.Provider value={value}>
-      <DiagnoseConsentCopyContext.Provider value={consentCopy}>
-        {children}
-      </DiagnoseConsentCopyContext.Provider>
+    <DiagnoseCustomizationContext.Provider value={ctx}>
+      {children}
     </DiagnoseCustomizationContext.Provider>
   );
 }
 
-export function useDiagnoseCustomization(): RenderDiagnoseAction | undefined {
+export function useDiagnoseCustomization(): DiagnoseCustomization {
   return useContext(DiagnoseCustomizationContext);
 }
-
-export function useDiagnoseConsentCopy(): DiagnoseConsentCopy | undefined {
-  return useContext(DiagnoseConsentCopyContext);
-}

package/src/index.ts

@@ -30,6 +30,24 @@ export type {
   RenderDiagnoseAction,
   DiagnoseConsentCopy,
 } from './context/DiagnoseCustomization';
+
+// Standalone AI-diagnose surface — mount the investigation panel outside a
+// full <RadarApp>. No router dependency, no client-side cluster state: the
+// backend set via setApiBase() picks the cluster, so hosts remount
+// <DiagnoseProvider key={cluster}> to switch. Mount order: ThemeProvider >
+// DiagnoseCustomizationProvider > DiagnoseProvider > DiagnoseSurface, under a
+// @tanstack/react-query QueryClientProvider.
+export {
+  DiagnoseProvider,
+  useDiagnose,
+  useDiagnoseLayout,
+} from './components/diagnose/DiagnoseContext';
+export type { Target as DiagnoseTarget } from './components/diagnose/DiagnoseContext';
+export { DiagnoseSurface } from './components/diagnose/DiagnoseSurface';
+export { DiagnoseCustomizationProvider } from './context/DiagnoseCustomization';
+// The panel reads Radar's ThemeContext (throws unprovided). It follows
+// localStorage['radar-theme'], so host and panel flip together.
+export { ThemeProvider } from './context/ThemeContext';
 export { ShortcutHelpOverlay } from './components/ui/ShortcutHelpOverlay';
 
 // Shared cluster-switcher primitive — re-exported from @skyhook-io/k8s-ui so