@skyhook-io/radar-app 1.9.5 → 1.9.7

package/src/components/diagnose/parts.tsx

@@ -649,11 +649,17 @@ function ConsentCardShell({
   settingsLabel,
   approveLabel = "Approve & investigate",
   warning = false,
+  error,
   onOpenSettings,
   onApprove,
   onCancel,
 }: DiagnoseConsentCopy & {
   warning?: boolean;
+  // Why the last approval failed, straight from the server. The card stays up on
+  // failure so retrying works in place, which means this is the ONLY chance to
+  // say why — a host that records consent above the individual refuses the
+  // wrong person here, and only its message knows who to ask.
+  error?: string | null;
   onOpenSettings?: () => void;
   onApprove: () => void;
   onCancel: () => void;
@@ -698,6 +704,19 @@ function ConsentCardShell({
           {resolvedSettingsLabel}
         </button>
       )}
+      {/* Red, not amber: the full-local card is itself amber, so an amber box on
+          it reads as another paragraph of body copy. role="alert" because nothing
+          else moves on failure — focus stays on Approve, so without it a screen
+          reader says nothing and the user re-presses a button that cannot succeed. */}
+      {error && (
+        <div
+          role="alert"
+          className="mt-3 flex items-start gap-2 rounded-md border border-red-500/30 bg-red-500/10 p-2 text-xs text-theme-text-primary"
+        >
+          <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0 text-red-400" />
+          <span>{error}</span>
+        </div>
+      )}
       <div className="mt-4 flex gap-2">
         <button
           onClick={onCancel}
@@ -731,6 +750,7 @@ export function ConsentCard({
   agent,
   profile,
   copy,
+  error,
   onOpenSettings,
   onApprove,
   onCancel,
@@ -739,11 +759,12 @@ export function ConsentCard({
   agent?: string;
   profile: ExecutionProfile;
   copy?: DiagnoseConsentCopy;
+  error?: string | null;
   onOpenSettings?: () => void;
   onApprove: () => void;
   onCancel: () => void;
 }) {
-  const chrome = { onOpenSettings, onApprove, onCancel };
+  const chrome = { onOpenSettings, onApprove, onCancel, error };
 
   // Tier 1: a host (e.g. radar-hub-web) supplied its own copy — use it verbatim.
   if (copy) return <ConsentCardShell {...copy} {...chrome} />;

package/src/components/home/HomeView.tsx

@@ -390,9 +390,14 @@ function ProblemsPanel({
                         <div className="flex items-center gap-1.5">
                           <span className="text-[10px] text-theme-text-tertiary bg-theme-elevated px-1 py-0.5 rounded">{issue.kind}</span>
                           <span className="text-xs text-theme-text-primary truncate font-medium">{issue.name}</span>
-                          {(age || timing) && (
+                          {(age || timing || issue.onset_unknown) && (
                             <span className="ml-auto flex shrink-0 items-center gap-1">
                               {age && <span className="text-[10px] text-theme-text-tertiary tabular-nums">{age}</span>}
+                              {issue.onset_unknown && (
+                                <Tooltip content="Radar can confirm this issue is active, but current Kubernetes state does not reveal when it began." delay={100}>
+                                  <span className="text-[10px] text-theme-text-tertiary">Onset unknown</span>
+                                </Tooltip>
+                              )}
                               {timing && (
                                 <Tooltip content={timing.tooltip} delay={100}>
                                   <span className="badge-sm text-[10px] text-theme-text-secondary">{timing.chip}</span>

package/src/components/home/mcpToolCatalog.ts

@@ -109,14 +109,16 @@ export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
   },
   {
     name: 'diagnose',
-    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues.',
+    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues; network entry kinds (Service / Ingress / HTTPRoute / GRPCRoute / Gateway) get a path-shaped trace naming the first broken hop, with an optional one-shot reachability test.',
     params: [
-      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, or Flux HelmRelease' },
+      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, Flux HelmRelease, service, ingress, httproute, grpcroute, or gateway' },
       { arg: 'namespace', required: true, desc: 'resource namespace' },
       { arg: 'name', required: true, desc: 'resource name' },
-      { arg: 'container', desc: 'specific container (defaults to all)' },
-      { arg: 'tail_lines', desc: 'lines per pod/stream (default 100)' },
-      { arg: 'since', desc: 'only logs newer than this duration' },
+      { arg: 'probe', desc: 'network kinds only: add active DNS/TCP/TLS/HTTP probes against the declared path (0-3s wall time)' },
+      { arg: 'in_cluster', desc: 'network kinds: run the probe from inside the cluster via short-lived self-destructing pods (real dataplane) - confirms a route the apiserver proxy could only reach indirectly. Creates up to 5 short-lived probe pods (one per dialed target) under your RBAC' },
+      { arg: 'container', desc: 'workload kinds: specific container (defaults to all)' },
+      { arg: 'tail_lines', desc: 'workload kinds: lines per pod/stream (default 100)' },
+      { arg: 'since', desc: 'workload kinds: only logs newer than this duration' },
     ],
   },
   {