akv-manager 0.0.5 → 0.1.1

package/README.md

@@ -34,6 +34,32 @@ If you're not signed in, the UI tells you to run `az login` and press Refresh.
     **edit** values (current value pre-filled), and **batch** enable/disable/set-expiry.
 - **Expiry** — scan every readable vault for secrets/certs that are expired or near
   expiry, plotted on a time horizon.
+- **Clusters** — read-only AKS monitoring: browse namespaces and pods, read **pod
+  logs** and **configmaps**, all as your own `az` identity. Talks to the Kubernetes
+  API directly (no `kubectl`/`kubelogin` needed) via an AAD token for the managed
+  AAD server app. Private API servers need you on the right network (e.g. corporate
+  VPN); the UI flags it when a cluster is unreachable.
+
+### Configuring AKS clusters
+
+Clusters you have ARM *Reader* on are auto-discovered. If you only have **data-plane**
+(Kubernetes-RBAC) access — common — list them yourself via either variable:
+
+```bash
+# inline JSON …
+AZBO_AKS_CLUSTERS='[{"name":"my-aks","resourceGroup":"my-rg","subscription":"My Sub","env":"Dev","label":"My cluster"}]' npx akv-manager
+
+# … or a file
+AZBO_AKS_CLUSTERS_FILE=./aks-clusters.json npx akv-manager
+```
+
+Each entry needs `name`, `resourceGroup`, `subscription` (name or id); `env` and
+`label` are optional. The console never bundles any cluster list — it's yours to provide.
+
+You can also **paste the list in the UI** instead of using a file: open **Clusters →
+✎ Edit cluster list**, paste the same JSON array, and Save. It's kept in your browser's
+`localStorage` and registered with the local server for the session — no file needed.
+File/env clusters and pasted clusters are merged.
 
 ## Configuration (all optional, via environment variables)
 
@@ -44,6 +70,9 @@ If you're not signed in, the UI tells you to run `az login` and press Refresh.
 | `AZBO_NO_OPEN` | — | Set to anything to skip auto-opening the browser. |
 | `AZBO_TITLE` | `Keyvault Console` | Custom title shown in the sidebar. |
 | `AZBO_ENV_RULES` | — | JSON `[["pattern","Label"], …]` mapping subscription-name patterns to environment labels. |
+| `AZBO_PROTECTED_TAGS` | governance set | Comma-separated tag names that are read-only in the UI (`*` = prefix wildcard). Set empty to disable. |
+| `AZBO_AKS_CLUSTERS` | — | JSON array of `{name,resourceGroup,subscription,env?,label?}` clusters to monitor. |
+| `AZBO_AKS_CLUSTERS_FILE` | — | Path to a JSON file with the same cluster array. |
 | `AZ_PATH` | `az` | Path to the Azure CLI binary. |
 | `AZ_TIMEOUT` | `120000` | Per-`az`-call timeout (ms). |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akv-manager",
-  "version": "0.0.5",
+  "version": "0.1.1",
   "description": "Local web console to browse and manage Azure Key Vaults — secrets, keys, certificates, expiry — using your own az login. No credentials are stored.",
   "type": "commonjs",
   "main": "server.js",
@@ -30,7 +30,8 @@
     "cli"
   ],
   "dependencies": {
-    "express": "^4.19.2"
+    "express": "^4.19.2",
+    "ws": "^8.21.0"
   },
   "engines": {
     "node": ">=18"

package/public/index.html

@@ -32,6 +32,10 @@
   };
 </script>
 <link rel="stylesheet" href="/styles.css">
+<!-- xterm.js: in-browser terminal for the AKS pod shell -->
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/xterm@5.3.0/css/xterm.min.css">
+<script src="https://cdn.jsdelivr.net/npm/xterm@5.3.0/lib/xterm.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.8.0/lib/xterm-addon-fit.min.js"></script>
 </head>
 <body>
 <div class="grid min-h-screen grid-cols-[236px_1fr] max-[900px]:grid-cols-1">
@@ -65,6 +69,9 @@
       <button data-view="expiry">
         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="12" cy="12" r="9"/><path d="M12 7v5l3.5 2"/></svg>
         Expiry</button>
+      <button data-view="clusters">
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round"><path d="M12 2l8 4.5v9L12 20l-8-4.5v-9L12 2z"/><path d="M12 7l4 2.2v4.6L12 16l-4-2.2V9.2L12 7z"/></svg>
+        Clusters</button>
     </nav>
 
     <div class="navlabel" id="pinLabel">Pinned</div>
@@ -213,6 +220,7 @@ async function boot(){
   renderSidebar();
   router();
   kickExpiryScan();   // warm the dashboard's lifecycle numbers in the background
+  registerSessionClusters().then(loadClustersCache); // register pasted clusters, then warm ⌘K
 }
 
 async function loadSubs(){
@@ -237,25 +245,30 @@ const META = {
   dashboard:['Operations','Dashboard','Secrets and certificates that need attention, your pinned vaults, and access health.'],
   vaults:['Inventory','Key Vaults','Every readable vault across your subscriptions. Filter by environment and tags; open one to manage it.'],
   expiry:['Lifecycle','Expiring soon','Secrets and certificates that are expired or approaching expiry across every vault you can read.'],
+  clusters:['Kubernetes','Clusters','Read-only monitoring of your AKS clusters — browse pods, read logs and configmaps. Configured locally; runs as your az identity.'],
   settings:['Account','Account & subscriptions','Your Azure identity and the subscription the console is pointed at.'],
 };
 let mountedVault = null;
 function setHead(view){
-  const onVault = view==='vault';
-  $('#headblock').style.display = onVault ? 'none' : '';
-  $('#search').classList.toggle('hide', onVault);
-  if(!onVault && META[view]){ $('#eyebrow').textContent=META[view][0]; $('#title').textContent=META[view][1]; $('#subtitle').textContent=META[view][2]; }
-  document.querySelectorAll('nav button').forEach(b=>b.classList.toggle('active', b.dataset.view===view));
+  const detail = view==='vault' || view==='cluster';   // detail pages carry their own breadcrumb
+  $('#headblock').style.display = detail ? 'none' : '';
+  $('#search').classList.toggle('hide', view!=='vaults' && view!=='dashboard' && view!=='expiry' && view!=='settings');
+  if(!detail && META[view]){ $('#eyebrow').textContent=META[view][0]; $('#title').textContent=META[view][1]; $('#subtitle').textContent=META[view][2]; }
+  const navActive = view==='vault'?'vaults' : view==='cluster'?'clusters' : view;
+  document.querySelectorAll('nav button').forEach(b=>b.classList.toggle('active', b.dataset.view===navActive));
 }
 function router(){
   if(!STATE.account) return;
   const parts = parseHash();
   const route = parts[0]||'dashboard';
   STATE.route = route;
+  if(route!=='cluster') teardownTerm();   // close any open pod shell when leaving Clusters
   if(route!=='vault') mountedVault=null;
   if(route==='vaults'){ setHead('vaults'); viewVaults(); }
   else if(route==='vault'){ setHead('vault'); viewVault(parts[1], parts[2]||'secrets'); }
   else if(route==='expiry'){ setHead('expiry'); viewExpiry(); }
+  else if(route==='clusters'){ setHead('clusters'); viewClusters(); }
+  else if(route==='cluster'){ setHead('cluster'); viewCluster(parts[1], parts[2], parts[3]||'pods'); }
   else if(route==='settings'){ setHead('settings'); viewSettings(); }
   else { setHead('dashboard'); viewDashboard(); }
   renderSidebar();
@@ -433,7 +446,7 @@ function viewVault(name, kind){
   const v = findVault(name) || (name?{name, subscriptionId:'', resourceGroup:'', uri:'', enableRbac:'', tags:{}}:null);
   if(!v){ $('#route').innerHTML=`<div class="panel"><div class="empty">No vault specified. <a href="#/vaults">Back to Key Vaults</a></div></div>`; return; }
   STATE.drawerVault=v; STATE.kind=kind;
-  if(mountedVault!==name){
+  if(mountedVault!==name || !document.getElementById('vbody')){
     mountedVault=name;
     DRW={vault:name, kind, items:[], filter:'', sel:new Set()};
     const tabs = KIND_TABS.map(([k,l])=>`<button data-kind="${k}" class="${k===kind?'active':''}" onclick="goKind('${esc(name)}','${k}')">${l}</button>`).join('');
@@ -954,6 +967,425 @@ function card(k,v,sub,mod){
   return `<div class="card ${mod?'card--'+mod:''}"><div class="k">${esc(k)}</div><div class="v">${v} <small>${esc(sub)}</small></div></div>`;
 }
 
+// ---------- CLUSTERS (AKS — read-only: pods, logs, configmaps) ----------
+let CL = { all:null, name:'', cluster:null, ns:'', kind:'pods', items:[], namespaces:[], logPod:null, filter:'', tier:'all', cm:{} };
+let mountedCluster = null;
+function age(iso){ if(!iso) return ''; const s=(Date.now()-Date.parse(iso))/1000;
+  if(s<3600) return Math.max(1,Math.floor(s/60))+'m'; if(s<86400) return Math.floor(s/3600)+'h'; return Math.floor(s/86400)+'d'; }
+function clErr(r){
+  if(r.network) return `<div class="empty">🚫 Can't reach this cluster's API server — it's private. Connect to the corporate VPN and retry.<div class="hint" style="margin-top:8px">${esc(r.error||'')}</div></div>`;
+  if(r.needLogin) return `<div class="empty">Not signed in — run <code>az login</code>, then Refresh.</div>`;
+  if(r.forbidden) return `<div class="empty">🔒 Your identity has no Kubernetes-RBAC permission for this on this cluster.<div class="hint" style="margin-top:8px">${esc(r.error||'')}</div></div>`;
+  return `<div class="empty">${esc(r.error||'failed')}</div>`;
+}
+async function loadClustersCache(){ const r=await api('/api/aks/clusters'); if(r.ok) CL.all=r.data.clusters||[]; return CL.all; }
+
+// Clusters the user pasted, kept in this browser. Registered with the local server each
+// load so the data-plane endpoints (which validate the cluster) accept them.
+function lsAks(){ try{ return localStorage.getItem('akv.aksClusters')||''; }catch{ return ''; } }
+function setLsAks(t){ try{ if(t) localStorage.setItem('akv.aksClusters',t); else localStorage.removeItem('akv.aksClusters'); }catch{} }
+async function registerSessionClusters(){
+  const txt=lsAks().trim(); if(!txt) return;
+  let arr; try{ arr=JSON.parse(txt); }catch{ return; }
+  if(!Array.isArray(arr)||!arr.length) return;
+  try{ await api('/api/aks/clusters',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({clusters:arr})}); }catch{}
+}
+
+async function viewClusters(){
+  $('#route').innerHTML = `<div class="panel"><div class="empty"><span class="spin"></span> loading clusters…</div></div>`;
+  await registerSessionClusters();
+  const r = await api('/api/aks/clusters');
+  if(STATE.route!=='clusters') return;
+  if(!r.ok){ $('#route').innerHTML = `<div class="panel">${clErr(r)}</div>`; return; }
+  CL.all = r.data.clusters||[];
+  CL.configuredCount = r.data.configured;
+  const envs=[...new Set(CL.all.map(c=>c.env).filter(Boolean))].sort();
+  const envSeg = envs.length>1 ? `<div class="seg" id="clEnvSeg">
+    <button data-e="all" class="${CL.clEnv==='all'||!CL.clEnv?'active':''}">All</button>
+    ${envs.map(e=>`<button data-e="${esc(e)}" class="${CL.clEnv===e?'active':''}">${esc(e)}</button>`).join('')}</div>` : '';
+  $('#route').innerHTML = `
+    <div class="cmctl" style="margin-bottom:12px">
+      <input class="search" id="clqIn" placeholder="filter clusters by name, env or resource group…" value="${esc(CL.clq||'')}" autocomplete="off" style="min-width:280px">
+      ${envSeg}
+      <button class="btn sm" id="clEdit">＋ Add / edit clusters</button>
+      <span class="faint mono" id="clqCount" style="margin-left:auto"></span></div>
+    <div class="createp hide" id="clEditor"></div>
+    <div id="clTable"></div>`;
+  $('#clqIn').oninput=e=>{ CL.clq=e.target.value; renderClusterRows(); };
+  if($('#clEnvSeg')) $('#clEnvSeg').querySelectorAll('button').forEach(b=>b.onclick=()=>{ CL.clEnv=b.dataset.e;
+    $('#clEnvSeg').querySelectorAll('button').forEach(x=>x.classList.toggle('active',x===b)); renderClusterRows(); });
+  $('#clEdit').onclick=()=>{ const el=$('#clEditor'); el.classList.contains('hide')?openClusterEditor():el.classList.add('hide'); };
+  renderClusterRows();
+}
+function openClusterEditor(){
+  const el=$('#clEditor');
+  const stored=lsAks();
+  const seed = stored || JSON.stringify((CL.all||[]).filter(c=>c.source==='session').map(c=>({name:c.name,resourceGroup:c.resourceGroup,subscription:c.subscription,env:c.env,label:c.label})),null,2);
+  el.innerHTML = `<h4>Your cluster list · saved in this browser</h4>
+    <div class="sub" style="margin-bottom:10px">Paste a JSON array of <code>{ name, resourceGroup, subscription, env?, label? }</code>. It's stored in this browser's localStorage and registered with the local server — no file needed. Clusters from <code>AZBO_AKS_CLUSTERS(_FILE)</code> still work and are merged in.</div>
+    <div class="fld" style="align-items:flex-start"><textarea id="clJson" spellcheck="false" placeholder='[\n  { "name": "my-aks", "resourceGroup": "my-rg", "subscription": "My Sub", "env": "Dev", "label": "My cluster" }\n]' style="min-height:230px">${esc(seed)}</textarea></div>
+    <div class="actions"><button class="btn sm" onclick="saveClusterList()">Save</button>
+      <button class="btn sm ghost" onclick="document.getElementById('clEditor').classList.add('hide')">Cancel</button>
+      <button class="btn sm ghost" onclick="clearClusterList()">Clear stored</button>
+      <span class="hint" id="clJsonMsg"></span></div>`;
+  el.classList.remove('hide');
+}
+async function saveClusterList(){
+  const msg=$('#clJsonMsg'), raw=$('#clJson').value.trim();
+  let arr=[];
+  if(raw){ try{ arr=JSON.parse(raw); }catch(e){ msg.textContent='Invalid JSON: '+e.message; return; } }
+  if(!Array.isArray(arr)){ msg.textContent='Must be a JSON array'; return; }
+  for(const c of arr){ if(!c||!c.name||!c.resourceGroup||!c.subscription){ msg.textContent='Each entry needs name, resourceGroup, subscription'; return; } }
+  msg.textContent='saving…';
+  const r=await api('/api/aks/clusters',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({clusters:arr})});
+  if(!r.ok){ msg.textContent=r.error||'failed'; return; }
+  setLsAks(raw); CL.all=null; toast(`Saved ${r.data.count} cluster${r.data.count!==1?'s':''}`);
+  loadClustersCache(); viewClusters();
+}
+function clearClusterList(){
+  if(!confirm('Remove the clusters stored in this browser? (file / env clusters stay.)')) return;
+  setLsAks('');
+  api('/api/aks/clusters',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({clusters:[]})})
+    .then(()=>{ toast('Cleared stored clusters'); CL.all=null; loadClustersCache(); viewClusters(); });
+}
+function renderClusterRows(){
+  if(!CL.all.length){
+    $('#clqCount').textContent='';
+    $('#clTable').innerHTML=`<div class="panel"><div class="empty" style="padding:38px;line-height:1.8">No AKS clusters yet.<br>
+      <span class="faint mono" style="font-size:12px">Click <b>✎ Edit cluster list</b> to paste them, or set <b>AZBO_AKS_CLUSTERS(_FILE)</b>.</span></div></div>`;
+    return;
+  }
+  const q=(CL.clq||'').toLowerCase(), env=CL.clEnv||'all';
+  const list=CL.all.filter(c=>{
+    if(env!=='all' && c.env!==env) return false;
+    return !q || [c.label,c.name,c.env,c.resourceGroup,c.subscription].filter(Boolean).some(s=>String(s).toLowerCase().includes(q));
+  });
+  $('#clqCount').textContent = `${list.length}${list.length!==CL.all.length?' / '+CL.all.length:''} cluster${CL.all.length!==1?'s':''}`;
+  if(!list.length){ $('#clTable').innerHTML=`<div class="empty">No clusters match your filter.</div>`; return; }
+  $('#clTable').innerHTML = `<div class="panel"><div class="scroll"><table>
+      <thead><tr><th>Cluster</th><th>Env</th><th>Version</th><th>Network</th><th>Source</th><th class="right">Actions</th></tr></thead>
+      <tbody>${list.map(c=>`<tr>
+        <td class="mono"><b>${esc(c.label||c.name)}</b>${c.label&&c.label!==c.name?`<br><span class="faint" style="font-size:11px">${esc(c.name)}</span>`:''}</td>
+        <td>${c.env?`<span class="tag ${envClass(c.env)}">${esc(c.env)}</span>`:'<span class="faint">—</span>'}</td>
+        <td class="mono muted">${esc(c.version||'—')}</td>
+        <td>${c.private?'<span class="pill policy">private · VPN</span>':c.private===false?'<span class="pill rbac">public</span>':'<span class="faint mono">?</span>'}</td>
+        <td><span class="pill">${c.source==='session'?'pasted':c.source==='file'?'file':'discovered'}</span></td>
+        <td class="right"><button class="iconbtn" onclick="openCluster('${esc(c.name)}')">Open</button></td>
+      </tr>`).join('')}</tbody>
+    </table></div></div>
+    <div class="tablenote">${CL.all.length} cluster${CL.all.length!==1?'s':''} · ${CL.configuredCount} configured locally</div>`;
+}
+function openCluster(name){ navigate('cluster/'+encodeURIComponent(name)); }
+
+function viewCluster(name){
+  CL.name = name;
+  if(mountedCluster!==name || !document.getElementById('clBody')){
+    mountedCluster=name; CL.ns=''; CL.items=[]; CL.namespaces=[]; CL.logPod=null; CL.cluster=null; CL.kind='pods';
+    $('#route').innerHTML = `
+      <div class="vhead">
+        <div class="crumb"><a href="#/clusters">Clusters</a><span class="sep">/</span>
+          <span class="here" id="clName">${esc(name)}</span> <span id="clEnv"></span></div>
+        <div class="vmeta" id="clMeta"><span class="faint">read-only · pods · logs · configmaps</span></div>
+      </div>
+      <div class="cmctl">
+        <div class="seg" id="clKind"><button data-k="pods" class="active">Pods</button><button data-k="configmaps">ConfigMaps</button></div>
+        <button class="btn ghost" id="clRefresh">↻ Refresh</button>
+      </div>
+      <div id="clBody"><div class="empty"><span class="spin"></span> loading…</div></div>`;
+    $('#clKind').querySelectorAll('button').forEach(b=>b.onclick=()=>{ CL.kind=b.dataset.k;
+      $('#clKind').querySelectorAll('button').forEach(x=>x.classList.toggle('active',x===b)); loadClusterContent(); });
+    $('#clRefresh').onclick=()=>{ if(CL.logPod) fetchLogs(); else loadClusterContent(); };
+    enrichClusterMeta(name);
+    loadClusterContent();
+  } else {
+    loadClusterContent();
+  }
+}
+async function enrichClusterMeta(name){
+  const list = CL.all || await loadClustersCache();
+  const c = (list||[]).find(x=>x.name===name); if(!c) return;
+  CL.cluster=c;
+  if(STATE.route!=='cluster' || CL.name!==name) return;
+  if($('#clName')) $('#clName').textContent = c.label||c.name;
+  if($('#clEnv')&&c.env) $('#clEnv').innerHTML = `<span class="tag ${envClass(c.env)}">${esc(c.env)}</span>`;
+  if($('#clMeta')) $('#clMeta').innerHTML = `<span class="mono">${esc(c.name)}</span><span class="sep">·</span>`+
+    `<span class="mono">${esc(c.resourceGroup||'')}</span>${c.private?'<span class="sep">·</span><span class="pill policy">private · VPN</span>':''}`;
+}
+function loadClusterContent(){
+  CL.logPod=null; CL.termPod=null; CL.filter=''; teardownTerm();
+  $('#clBody').innerHTML='<div class="empty"><span class="spin"></span></div>';
+  if(CL.kind==='pods') loadPods(); else loadConfigMaps();
+}
+function clFilterBar(placeholder, extra){
+  return `<div class="cmctl" style="margin-bottom:10px">
+      <input class="search" id="clFilter" placeholder="${placeholder}" value="${esc(CL.filter)}" autocomplete="off" style="min-width:300px">
+      ${extra||''}
+      <span class="faint mono" id="clCount"></span></div>
+    <div id="clList"></div>`;
+}
+const TIER_RE = {
+  cache:/(^|-)cache(\d+)?(-|$)|-cache$/,
+  fe:/frontend|-fe-|-fe\b|-web\b|-ui\b|-spa\b/,
+  be:/backend|-be-|-be\b|-api\b|-svc\b|-worker\b|-jobs?\b|-bgjobs?\b/,
+};
+function podTier(nm){ nm=(nm||'').toLowerCase(); if(TIER_RE.cache.test(nm))return'cache'; if(TIER_RE.fe.test(nm))return'fe'; if(TIER_RE.be.test(nm))return'be'; return'other'; }
+async function loadPods(){
+  const name=CL.name;
+  const r = await api(`/api/aks/${name}/pods`);
+  if(STATE.route!=='cluster'||CL.name!==name||CL.kind!=='pods'||CL.logPod||CL.termPod) return;
+  if(!r.ok){ $('#clBody').innerHTML=clErr(r); return; }
+  CL.items=r.data||[];
+  const tier = `<div class="seg" id="clTier">
+    <button data-t="all" class="${CL.tier==='all'?'active':''}">All</button>
+    <button data-t="be" class="${CL.tier==='be'?'active':''}">Backend</button>
+    <button data-t="fe" class="${CL.tier==='fe'?'active':''}">Frontend</button>
+    <button data-t="cache" class="${CL.tier==='cache'?'active':''}">Cache</button></div>`;
+  $('#clBody').innerHTML = clFilterBar('filter pods by name or namespace…', tier);
+  $('#clFilter').oninput=e=>{ CL.filter=e.target.value; renderPodRows(); };
+  $('#clTier').querySelectorAll('button').forEach(b=>b.onclick=()=>{ CL.tier=b.dataset.t;
+    $('#clTier').querySelectorAll('button').forEach(x=>x.classList.toggle('active',x===b)); renderPodRows(); });
+  renderPodRows();
+}
+function podMatches(p){
+  if(CL.tier!=='all' && podTier(p.name)!==CL.tier) return false;
+  const q=CL.filter.toLowerCase();
+  const nm=p.name.toLowerCase();
+  return !q || nm.includes(q) || (p.namespace||'').toLowerCase().includes(q);
+}
+function renderPodRows(){
+  const list=CL.items.filter(podMatches);
+  $('#clCount').textContent = CL.items.length ? `${list.length}${list.length!==CL.items.length?' / '+CL.items.length:''} pod${CL.items.length!==1?'s':''}` : '';
+  if(!CL.items.length){ $('#clList').innerHTML=`<div class="empty">No pods visible on this cluster.</div>`; return; }
+  if(!list.length){ $('#clList').innerHTML=`<div class="empty">No pods match your filter.</div>`; return; }
+  $('#clList').innerHTML = `<div class="panel"><div class="scroll"><table>
+    <thead><tr><th>Pod</th><th>Namespace</th><th>Build</th><th>Ready</th><th>Status</th><th class="right">Restarts</th><th>Age</th><th class="right">Actions</th></tr></thead>
+    <tbody>${list.map(p=>`<tr>
+      <td class="mono"><b><span class="ell" title="${esc(p.name)}">${esc(p.name)}</span></b></td>
+      <td class="mono muted"><span class="ell ns" title="${esc(p.namespace||'')}">${esc(p.namespace||'')}</span></td>
+      <td class="mono"><span class="ell" style="max-width:140px" title="${esc(p.build||'')}">${esc(p.build||'—')}</span></td>
+      <td class="mono">${esc(p.ready||'')}</td>
+      <td><span class="phase ${esc(p.phase||'')}">${esc(p.phase||'?')}</span></td>
+      <td class="right mono ${p.restarts>0?'':'muted'}">${p.restarts}</td>
+      <td class="mono muted">${age(p.created)}</td>
+      <td class="right" style="white-space:nowrap"><button class="iconbtn" onclick="openPodDetail('${esc(p.namespace)}','${esc(p.name)}')">Details</button>
+        <button class="iconbtn" onclick="showLogs('${esc(p.namespace)}','${esc(p.name)}')">Logs</button>
+        <button class="iconbtn" onclick="openTerminal('${esc(p.namespace)}','${esc(p.name)}')">Terminal</button>
+        <button class="iconbtn" onclick="openPodVaults('${esc(p.namespace)}','${esc(p.name)}')">Vaults</button></td>
+    </tr>`).join('')}</tbody></table></div></div>`;
+}
+async function openPodDetail(ns,pod){
+  CL.logPod=null; CL.termPod=null; teardownTerm();
+  $('#clBody').innerHTML = `<div class="cmctl"><button class="iconbtn" onclick="loadClusterContent()">← Pods</button>
+      <span class="mono"><b>${esc(pod)}</b></span><span class="faint mono">${esc(ns)}</span></div>
+    <div id="pdOut"><div class="empty"><span class="spin"></span> loading pod details…</div></div>`;
+  const r=await api(`/api/aks/${CL.name}/${ns}/pods/${pod}/detail`);
+  if(STATE.route!=='cluster') return; const out=$('#pdOut'); if(!out) return;
+  if(!r.ok){ out.innerHTML=clErr(r); return; }
+  const d=r.data; const labels=Object.entries(d.labels||{});
+  const labelChips = labels.length
+    ? `<div class="tagchips">${labels.map(([k,v])=>`<span class="tagchip"><b>${esc(k)}</b>${v?' '+esc(v):''}</span>`).join('')}</div>`
+    : '<span class="faint mono">no labels</span>';
+  const cont=(d.containers||[]).map(c=>{
+    const rows=(c.env||[]).map(e=>{
+      const val = e.value!=null ? esc(e.value)
+        : e.from ? `<span class="faint">← ${esc(e.from.kind)} ${esc(e.from.name||'')}${e.from.key?'.'+esc(e.from.key):''}</span>` : '';
+      return `<tr><td class="mono"><b>${esc(e.name)}</b></td><td class="mono" style="word-break:break-all">${val}</td></tr>`;
+    }).join('');
+    const efRows=(c.envFrom||[]).map(ef=>`<tr><td class="mono faint">∗ all keys</td><td class="mono faint">← ${esc(ef.kind)} ${esc(ef.name||'')}${ef.prefix?` (prefix ${esc(ef.prefix)})`:''}${ef.kind==='secret'?' · values not shown':''}</td></tr>`).join('');
+    const body = rows||efRows
+      ? `<div class="panel" style="margin-top:6px"><div class="scroll" style="max-height:none"><table>
+          <thead><tr><th>Env var</th><th>Value / source</th></tr></thead><tbody>${rows}${efRows}</tbody></table></div></div>`
+      : '<div class="faint mono" style="margin-top:6px">no env vars declared</div>';
+    return `<div style="margin:16px 0">
+      <div class="kvline" style="padding:4px 0"><span class="nm mono"><b>${esc(c.name)}</b>${c.init?' <span class="pill">init</span>':''}</span>
+        <span class="meta">${c.tag?`<span class="tagchip">build ${esc(c.tag)}</span>`:''}</span></div>
+      <div class="cmval">${esc(c.image||'')}</div>${body}</div>`;
+  }).join('');
+  out.innerHTML = `<div class="secthead">Labels (tags)</div>${labelChips}
+    <div class="secthead" style="margin-top:18px">Containers · image · env vars</div>${cont}`;
+}
+function showLogs(ns,pod){
+  const p = CL.items.find(x=>x.name===pod&&x.namespace===ns) || {name:pod, containers:[]};
+  CL.logNs=ns; CL.logPod=pod;
+  const conts = p.containers||[];
+  const contSel = conts.length>1
+    ? `<select class="facetsel" id="logC">${conts.map(c=>`<option value="${esc(c)}">${esc(c)}</option>`).join('')}</select>`
+    : conts.length ? `<input type="hidden" id="logC" value="${esc(conts[0])}">` : '';
+  $('#clBody').innerHTML = `
+    <div class="cmctl">
+      <button class="iconbtn" onclick="loadClusterContent()">← Pods</button>
+      <span class="mono"><b>${esc(pod)}</b></span><span class="faint mono">${esc(ns)}</span>
+      ${contSel}
+      <select class="facetsel" id="logTail"><option value="200">200 lines</option><option value="1000" selected>1000 lines</option><option value="5000">5000 lines</option><option value="20000">20000 lines</option></select>
+      <label class="selall"><input type="checkbox" id="logTs"> timestamps</label>
+      <label class="selall"><input type="checkbox" id="logPrev"> previous (crash)</label>
+      <button class="btn sm" id="logGo">Load</button>
+      <span class="newbtns"><button class="iconbtn" id="logCopy">⧉ Copy</button><button class="iconbtn" id="logDl">↓ Download</button></span>
+    </div>
+    <div class="logbox" id="logOut"><div class="empty"><span class="spin"></span></div></div>`;
+  $('#logGo').onclick=fetchLogs;
+  $('#logTail').onchange=fetchLogs; $('#logC') && ($('#logC').onchange=fetchLogs);
+  $('#logCopy').onclick=()=>{ const t=$('#logOut').dataset.raw||''; t?copy(t):toast('Nothing to copy'); };
+  $('#logDl').onclick=downloadLog;
+  fetchLogs();
+}
+async function fetchLogs(){
+  const out=$('#logOut'); if(!out) return;
+  out.innerHTML='<div class="empty"><span class="spin"></span> fetching logs…</div>';
+  const cEl=$('#logC'); const container=cEl?cEl.value:'';
+  const qs=new URLSearchParams({tailLines:$('#logTail').value});
+  if(container) qs.set('container',container);
+  if($('#logTs').checked) qs.set('timestamps','true');
+  if($('#logPrev').checked) qs.set('previous','true');
+  const pod=CL.logPod;
+  const r=await api(`/api/aks/${CL.name}/${CL.logNs}/pods/${pod}/log?${qs.toString()}`);
+  if(STATE.route!=='cluster' || CL.logPod!==pod) return;
+  if(!r.ok){ out.innerHTML=clErr(r); return; }
+  const text=r.data.log||'';
+  out.dataset.raw=text;
+  out.textContent = text || '(empty log)';   // textContent: safe against log content
+}
+function downloadLog(){
+  const text=$('#logOut').dataset.raw||''; if(!text){ toast('Nothing to download'); return; }
+  const env=(CL.cluster&&CL.cluster.env)?CL.cluster.env+'-':'';
+  const blob=new Blob([text],{type:'text/plain'}); const url=URL.createObjectURL(blob);
+  const a=document.createElement('a'); a.href=url; a.download=`log-${env}${CL.logNs}-${CL.logPod}.txt`; a.click(); URL.revokeObjectURL(url);
+}
+async function loadConfigMaps(){
+  const name=CL.name;
+  const r=await api(`/api/aks/${name}/configmaps`);
+  if(STATE.route!=='cluster'||CL.name!==name||CL.kind!=='configmaps'||CL.logPod||CL.termPod) return;
+  if(!r.ok){ $('#clBody').innerHTML=clErr(r); return; }
+  CL.items=r.data||[];
+  $('#clBody').innerHTML = clFilterBar('filter configmaps by name or namespace…');
+  $('#clFilter').oninput=e=>{ CL.filter=e.target.value; renderCmRows(); };
+  renderCmRows();
+}
+function renderCmRows(){
+  const q=CL.filter.toLowerCase();
+  const list=CL.items.filter(m=>!q||m.name.toLowerCase().includes(q)||(m.namespace||'').toLowerCase().includes(q));
+  $('#clCount').textContent = CL.items.length ? `${list.length}${list.length!==CL.items.length?' / '+CL.items.length:''} configmap${CL.items.length!==1?'s':''}` : '';
+  if(!CL.items.length){ $('#clList').innerHTML=`<div class="empty">No configmaps visible on this cluster.</div>`; return; }
+  if(!list.length){ $('#clList').innerHTML=`<div class="empty">No configmaps match “${esc(CL.filter)}”.</div>`; return; }
+  $('#clList').innerHTML = `<div class="panel"><div class="scroll"><table>
+    <thead><tr><th>ConfigMap</th><th>Namespace</th><th>Keys</th><th class="right">Actions</th></tr></thead>
+    <tbody>${list.map(m=>`<tr>
+      <td class="mono"><b><span class="ell" title="${esc(m.name)}">${esc(m.name)}</span></b></td>
+      <td class="mono muted"><span class="ell ns" title="${esc(m.namespace||'')}">${esc(m.namespace||'')}</span></td>
+      <td class="faint mono ell" style="font-size:11px;max-width:360px" title="${esc((m.keys||[]).join(', '))}">${(m.keys||[]).slice(0,6).map(esc).join(', ')}${m.keys.length>6?` +${m.keys.length-6}`:''}</td>
+      <td class="right"><button class="iconbtn" onclick="viewCm('${esc(m.namespace)}','${esc(m.name)}')">View</button>
+        <button class="iconbtn" onclick="copy('kubectl describe configmap ${esc(m.name)} -n ${esc(m.namespace)}')">⧉</button></td>
+    </tr><tr><td colspan="4" style="padding:0;border:0"><div class="hide" id="cm-${esc(m.namespace)}__${esc(m.name)}"></div></td></tr>`).join('')}</tbody>
+  </table></div></div>`;
+}
+async function viewCm(ns,name){
+  const box=document.getElementById('cm-'+ns+'__'+name); if(!box) return;
+  if(!box.classList.contains('hide')){ box.classList.add('hide'); box.innerHTML=''; return; }
+  box.classList.remove('hide'); box.innerHTML='<div class="empty"><span class="spin"></span></div>';
+  const r=await api(`/api/aks/${CL.name}/${ns}/configmaps/${name}`);
+  if(!r.ok){ box.innerHTML=clErr(r); return; }
+  const data=r.data.data||{}; const keys=Object.keys(data); const ckey=ns+'/'+name; CL.cm[ckey]=data;
+  box.innerHTML = `<div style="padding:8px 0 12px">${keys.length? keys.map(k=>`
+    <div class="cmkey"><div class="kvline" style="padding:5px 0"><span class="nm mono"><b>${esc(k)}</b></span>
+      <span class="meta"><button class="iconbtn" onclick='copyCm(${JSON.stringify(ckey)},${JSON.stringify(k)})'>⧉ copy</button></span></div>
+      <pre class="cmval"></pre></div>`).join('') : '<div class="empty">empty configmap</div>'}</div>`;
+  const pres=box.querySelectorAll('pre.cmval'); keys.forEach((k,i)=>{ if(pres[i]) pres[i].textContent=data[k]; });
+}
+function copyCm(ckey,k){ const d=CL.cm[ckey]||{}; copy(d[k]!=null?String(d[k]):''); }
+
+// ---------- which Key Vaults does a pod use ----------
+async function openPodVaults(ns,pod){
+  CL.logPod=null; CL.termPod=null; teardownTerm();
+  $('#clBody').innerHTML = `<div class="cmctl"><button class="iconbtn" onclick="loadClusterContent()">← Pods</button>
+      <span class="mono"><b>${esc(pod)}</b></span><span class="faint mono">${esc(ns)}</span><span class="faint mono">Key Vault references</span></div>
+    <div id="pkvOut"><div class="empty"><span class="spin"></span> inspecting pod env, configmaps and CSI SecretProviderClasses…</div></div>`;
+  const r = await api(`/api/aks/${CL.name}/${ns}/pods/${pod}/keyvaults`);
+  if(STATE.route!=='cluster') return;
+  const out=$('#pkvOut'); if(!out) return;
+  if(!r.ok){ out.innerHTML=clErr(r); return; }
+  const vaults=r.data.vaults||[];
+  const spcs=r.data.spcs||[];
+  const eso=r.data.externalSecrets||[];
+  const unreadable=spcs.filter(s=>!s.readable);
+  const esoUnresolved=eso.filter(e=>!e.resolvable);
+  const spcNote = spcs.length
+    ? `<div style="margin-top:10px">Mounts CSI SecretProviderClass(es): <span class="tagchips" style="display:inline-flex">${spcs.map(s=>`<span class="tagchip">${esc(s.name)}${s.readable?'':' 🔒'}</span>`).join('')}</span>${unreadable.length?`<div class="hint" style="margin-top:6px">🔒 couldn't read ${unreadable.length} SecretProviderClass(es) to resolve the Key Vault — needs read on <code>secretproviderclasses</code>.</div>`:''}</div>`
+    : '';
+  const esoNote = esoUnresolved.length
+    ? `<div style="margin-top:10px">Config synced by <b>External Secrets Operator</b> from a Key Vault: <span class="tagchips" style="display:inline-flex">${esoUnresolved.map(e=>`<span class="tagchip">${esc(e.externalSecret)} 🔒</span>`).join('')}</span>
+       <div class="hint" style="margin-top:6px">🔒 the source vault is defined in the ExternalSecret's SecretStore — ${esc(esoUnresolved[0].reason||'not readable')}.</div></div>`
+    : '';
+  if(!vaults.length){
+    out.innerHTML=`<div class="empty">No Key Vault could be resolved for this pod.
+      <div class="hint" style="margin-top:8px">Checked CSI SecretProviderClasses, External Secrets, container env, and ${r.data.configmapsScanned.length} configmap(s).</div>
+      ${spcNote}${esoNote}</div>`;
+    return;
+  }
+  out.innerHTML = `<div class="panel"><div class="scroll"><table>
+    <thead><tr><th>Key Vault</th><th>Referenced via</th><th class="right">Actions</th></tr></thead>
+    <tbody>${vaults.map(v=>{ const known=findVault(v.name);
+      return `<tr><td class="mono"><b>${esc(v.name)}</b></td>
+        <td><div class="tagchips">${v.sources.map(s=>`<span class="tagchip">${esc(s)}</span>`).join('')}</div></td>
+        <td class="right">${known
+          ? `<button class="iconbtn" onclick="openVault('${esc(known.name)}')">Open vault →</button>`
+          : `<span class="faint mono" title="not in your visible inventory">not visible</span>`}</td></tr>`;
+    }).join('')}</tbody></table></div></div>
+    <div class="tablenote">${vaults.length} vault${vaults.length!==1?'s':''} · scanned ${r.data.configmapsScanned.length} configmap(s), ${spcs.length} SecretProviderClass(es), ${eso.length} ExternalSecret(s)</div>
+    ${unreadable.length?`<div class="tablenote">${spcNote}</div>`:''}
+    ${esoUnresolved.length?`<div class="tablenote">${esoNote}</div>`:''}`;
+}
+
+// ---------- in-pod terminal (xterm.js over a WS exec bridge) ----------
+let TERM=null, TERMWS=null, TERMRO=null;
+function teardownTerm(){
+  try{ TERMRO&&TERMRO.disconnect(); }catch{} TERMRO=null;
+  try{ TERMWS&&TERMWS.close(); }catch{} TERMWS=null;
+  try{ TERM&&TERM.dispose(); }catch{} TERM=null;
+}
+function openTerminal(ns,pod){
+  const p = CL.items.find(x=>x.name===pod&&x.namespace===ns) || {name:pod, containers:[]};
+  CL.logPod=null; CL.termNs=ns; CL.termPod=pod;
+  const conts=p.containers||[];
+  const contSel = conts.length>1
+    ? `<select class="facetsel" id="tmC">${conts.map(c=>`<option value="${esc(c)}">${esc(c)}</option>`).join('')}</select>`
+    : conts.length ? `<input type="hidden" id="tmC" value="${esc(conts[0])}">` : '';
+  $('#clBody').innerHTML = `
+    <div class="cmctl">
+      <button class="iconbtn" onclick="closeTerminal()">← Pods</button>
+      <span class="mono"><b>${esc(pod)}</b></span><span class="faint mono">${esc(ns)}</span>
+      ${contSel}
+      <span class="faint mono" id="tmStatus">connecting…</span>
+      <span class="newbtns"><button class="iconbtn" id="tmReconnect">↻ Reconnect</button></span>
+    </div>
+    <div id="termHost" class="termhost"></div>`;
+  $('#tmReconnect').onclick=()=>startTerm();
+  const cSel=$('#tmC'); if(cSel && cSel.tagName==='SELECT') cSel.onchange=()=>startTerm();
+  startTerm();
+}
+function closeTerminal(){ teardownTerm(); CL.termPod=null; loadClusterContent(); }
+function tmStatus(txt, cls){ const el=$('#tmStatus'); if(!el)return; el.textContent=txt; el.className='mono '+(cls||'faint'); }
+function startTerm(){
+  if(typeof Terminal==='undefined' || typeof FitAddon==='undefined'){ tmStatus('terminal library failed to load (offline?)','dead'); return; }
+  teardownTerm();
+  const host=$('#termHost'); if(!host) return; host.innerHTML='';
+  TERM=new Terminal({ fontFamily:'"IBM Plex Mono", ui-monospace, monospace', fontSize:12.5, cursorBlink:true,
+    theme:{ background:'#070A11', foreground:'#CDE0F5', cursor:'#5B9DFF' } });
+  const fit=new FitAddon.FitAddon(); TERM.loadAddon(fit); TERM.open(host);
+  try{ fit.fit(); }catch{}
+  const cont=$('#tmC')?$('#tmC').value:'';
+  const proto=location.protocol==='https:'?'wss':'ws';
+  const qs=new URLSearchParams({cluster:CL.name, ns:CL.termNs, pod:CL.termPod}); if(cont) qs.set('container',cont);
+  const ws=new WebSocket(`${proto}://${location.host}/ws/aks/exec?${qs.toString()}`);
+  ws.binaryType='arraybuffer'; TERMWS=ws;
+  const sendResize=()=>{ try{ fit.fit(); if(ws.readyState===1) ws.send(JSON.stringify({type:'resize',cols:TERM.cols,rows:TERM.rows})); }catch{} };
+  ws.onopen=()=>{ tmStatus('connected','live'); sendResize(); TERM.focus(); };
+  ws.onmessage=ev=>{ if(typeof ev.data==='string') TERM.write(ev.data); else TERM.write(new Uint8Array(ev.data)); };
+  ws.onclose=()=>tmStatus('disconnected','dead');
+  ws.onerror=()=>tmStatus('connection error','dead');
+  TERM.onData(d=>{ if(ws.readyState===1) ws.send(new TextEncoder().encode(d)); });
+  TERMRO=new ResizeObserver(()=>sendResize()); TERMRO.observe(host);
+}
+
 // ---------- command palette ----------
 let CMDK = { open:false, items:[], cur:0 };
 function cmdkActions(){
@@ -961,6 +1393,7 @@ function cmdkActions(){
     {type:'view', label:'Dashboard', hint:'go', act:()=>navigate('dashboard')},
     {type:'view', label:'Key Vaults', hint:'go', act:()=>navigate('vaults')},
     {type:'view', label:'Expiry', hint:'go', act:()=>navigate('expiry')},
+    {type:'view', label:'Clusters', hint:'go', act:()=>navigate('clusters')},
     {type:'view', label:'Account & subscriptions', hint:'go', act:()=>navigate('settings')},
     {type:'action', label:'Refresh inventory', hint:'run', act:()=>{ doRefresh(); }},
   ];
@@ -974,16 +1407,22 @@ function renderCmdk(q){
     .filter(v=>!q || v.name.toLowerCase().includes(q) || (v.service||'').toLowerCase().includes(q) || Object.values(v.tags||{}).join(' ').toLowerCase().includes(q))
     .slice(0,40)
     .map(v=>({type:'vault', label:v.name, sub:v.env, env:v.env, act:()=>openVault(v.name)}));
-  CMDK.items = [...acts, ...vaults]; CMDK.cur=0;
+  const clusters = (CL.all||[])
+    .filter(c=>!q || (c.label||c.name).toLowerCase().includes(q) || c.name.toLowerCase().includes(q))
+    .slice(0,20)
+    .map(c=>({type:'cluster', label:c.label||c.name, sub:c.env, act:()=>openCluster(c.name)}));
+  CMDK.items = [...acts, ...clusters, ...vaults]; CMDK.cur=0;
   const list=$('#cmdkList');
   if(!CMDK.items.length){ list.innerHTML='<div class="cmdk-empty">No matches.</div>'; return; }
   const vIco='<svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="4" y="10" width="16" height="11" rx="2"/><path d="M8 10V7a4 4 0 0 1 8 0v3"/></svg>';
+  const cIco='<svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round"><path d="M12 2l8 4.5v9L12 20l-8-4.5v-9L12 2z"/></svg>';
   const gIco='<svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 12h14M5 6h14M5 18h14"/></svg>';
+  const secName={vault:'Vaults',cluster:'Clusters',view:'Go to',action:'Actions'};
   let html=''; let lastType='';
   CMDK.items.forEach((it,idx)=>{
-    if(it.type!==lastType){ html+=`<div class="cmdk-sec">${it.type==='vault'?'Vaults':it.type==='view'?'Go to':'Actions'}</div>`; lastType=it.type; }
+    if(it.type!==lastType){ html+=`<div class="cmdk-sec">${secName[it.type]||''}</div>`; lastType=it.type; }
     html+=`<div class="cmdk-it ${idx===CMDK.cur?'cur':''}" data-i="${idx}">
-      ${it.type==='vault'?vIco:gIco}
+      ${it.type==='vault'?vIco:it.type==='cluster'?cIco:gIco}
       <span class="lbl">${esc(it.label)}${it.sub?`<small>${esc(it.sub)}</small>`:''}</span>
       <span class="hint">${it.hint?esc(it.hint):'open'}</span></div>`;
   });

package/public/styles.css

@@ -358,6 +358,29 @@
   .stick{position:sticky;top:0;z-index:5}
   .itemwrap{margin-top:8px}
 
+  /* ---------- clusters (AKS) ---------- */
+  .cmctl{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin-bottom:16px}
+  .cmctl .seg{padding:3px}
+  .logbox{background:#070A11;border:1px solid var(--line);border-radius:var(--r-sm);padding:13px 15px;
+          font-family:var(--mono);font-size:11.5px;line-height:1.55;color:#CDE0F5;white-space:pre;
+          overflow:auto;max-height:calc(100vh - 300px);tab-size:2}
+  .phase{font-family:var(--mono);font-size:10px;letter-spacing:.05em;padding:2px 8px;border-radius:5px;border:1px solid var(--line);color:var(--muted)}
+  .phase.Running{color:#7FE0C8;border-color:rgba(70,214,180,.3)}
+  .phase.Pending{color:#F4C977;border-color:rgba(242,181,61,.3)}
+  .phase.Failed,.phase.Error,.phase.CrashLoopBackOff{color:#FF8893;border-color:rgba(255,92,108,.32)}
+  .phase.Succeeded,.phase.Completed{color:var(--muted)}
+  .cmval{background:#070A11;border:1px solid var(--line);border-radius:6px;padding:9px 11px;margin:0 0 4px;
+         font-family:var(--mono);font-size:11.5px;color:#A9D2FF;white-space:pre-wrap;word-break:break-word;
+         overflow:auto;max-height:320px}
+  .cmkey{padding:4px 16px 10px}
+  .cmkey .nm{font-size:12.5px}
+  .ell{display:inline-block;max-width:280px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;vertical-align:bottom}
+  .ell.ns{max-width:200px}
+  .termhost{height:calc(100vh - 290px);min-height:340px;background:#070A11;border:1px solid var(--line);
+            border-radius:var(--r-sm);padding:8px 4px 8px 10px;overflow:hidden}
+  .termhost .xterm{height:100%}
+  #tmStatus.live{color:var(--ok)} #tmStatus.dead{color:var(--alert)}
+
   @media (max-width:900px){
     /* .app grid + main padding handled by Tailwind max-[900px]: utilities */
     aside{position:static;height:auto;flex-direction:row;flex-wrap:wrap;align-items:center}

package/server.js

@@ -63,9 +63,10 @@ function az(args, { json = true } = {}) {
 
 function send(res, p) {
   p.then((data) => res.json({ ok: true, data }))
-   .catch((err) => res.status(err.needLogin ? 401 : err.forbidden ? 403 : 500).json({
+   .catch((err) => res.status(err.status || (err.needLogin ? 401 : err.forbidden ? 403 : err.notFound ? 404 : 500)).json({
      ok: false, error: err.stderr || err.message,
      needLogin: !!err.needLogin, forbidden: !!err.forbidden, firewall: !!err.firewall,
+     network: !!err.network, notFound: !!err.notFound,
    }));
 }
 
@@ -600,6 +601,492 @@ app.post('/api/batch', async (req, res) => {
   res.json({ ok: true, results });
 });
 
+// ---- API: AKS clusters (read-only monitoring: pods, logs, configmaps) -------
+// Data plane goes straight to the Kubernetes API server over HTTPS, authenticated
+// with an AAD token for the well-known managed-AAD server app — the same token
+// `kubelogin` (azurecli mode) injects, so no kubelogin/kubectl binary is needed.
+
+const https = require('https');
+const AKS_AAD_SERVER_APP = '6dae42f8-4368-4678-94ff-3960e28e3630'; // Microsoft public constant
+const getAksToken = () => getToken(AKS_AAD_SERVER_APP);
+const K8S_NAME = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/; // DNS-1123-ish (namespaces, pods, cms)
+const isK8sName = (v) => typeof v === 'string' && K8S_NAME.test(v);
+
+// Cluster list — NEVER baked in. Two sources, merged: (1) the operator's file/env
+// (AZBO_AKS_CLUSTERS / AZBO_AKS_CLUSTERS_FILE), and (2) a list the user pastes in the
+// UI, persisted in their browser's localStorage and registered with this local server
+// for the session. Each entry: { name, resourceGroup, subscription, env?, label? }.
+const RG_RE = /^[\w.()-]{1,90}$/;
+function clusterValid(c) {
+  return c && isValidName(c.name) && RG_RE.test(c.resourceGroup || '') && SUB_RE.test(c.subscription || '');
+}
+function normalizeClusters(arr, source) {
+  return (Array.isArray(arr) ? arr : []).filter((c) => c && c.name && c.resourceGroup && c.subscription)
+    .map((c) => ({ name: String(c.name), resourceGroup: String(c.resourceGroup), subscription: String(c.subscription),
+      env: c.env ? String(c.env) : '', label: c.label ? String(c.label) : String(c.name), configured: true, source }));
+}
+const AKS_CLUSTERS = (() => {
+  let raw = process.env.AZBO_AKS_CLUSTERS;
+  if (!raw && process.env.AZBO_AKS_CLUSTERS_FILE) {
+    try { raw = require('fs').readFileSync(process.env.AZBO_AKS_CLUSTERS_FILE, 'utf8'); }
+    catch (e) { console.warn('  AZBO_AKS_CLUSTERS_FILE could not be read:', e.message); }
+  }
+  if (!raw) return [];
+  try { return normalizeClusters(JSON.parse(raw), 'file'); }
+  catch { console.warn('  AZBO_AKS_CLUSTERS is not valid JSON — ignoring.'); return []; }
+})();
+let SESSION_CLUSTERS = [];   // set by the client via POST /api/aks/clusters (from its localStorage)
+
+async function resolveSubId(nameOrId) {
+  if (/^[0-9a-fA-F-]{36}$/.test(nameOrId)) return nameOrId;
+  const subs = await listSubscriptions();
+  const s = subs.find((x) => x.displayName === nameOrId || x.subscriptionId === nameOrId);
+  return s ? s.subscriptionId : nameOrId;
+}
+
+// Cache each cluster's API server URL + CA (from listClusterUserCredential) for 30 min.
+const aksCredCache = new Map();
+async function aksCredential(c) {
+  const key = `${c.subscription}/${c.resourceGroup}/${c.name}`;
+  const hit = aksCredCache.get(key);
+  if (hit && Date.now() - hit.at < 30 * 60 * 1000) return hit;
+  const subId = await resolveSubId(c.subscription);
+  const url = `/subscriptions/${subId}/resourceGroups/${c.resourceGroup}` +
+              `/providers/Microsoft.ContainerService/managedClusters/${c.name}` +
+              `/listClusterUserCredential?api-version=2024-05-01`;
+  const out = await armFetch(url, { method: 'POST' });
+  const kc = out.kubeconfigs && out.kubeconfigs[0];
+  if (!kc || !kc.value) throw new Error('No kubeconfig returned for this cluster');
+  const yaml = Buffer.from(kc.value, 'base64').toString('utf8');
+  const server = (yaml.match(/server:\s*(\S+)/) || [])[1];
+  const caB64 = (yaml.match(/certificate-authority-data:\s*(\S+)/) || [])[1];
+  if (!server) throw new Error('Could not parse API server URL from kubeconfig');
+  const cred = { server: server.replace(/\/+$/, ''),
+    ca: caB64 ? Buffer.from(caB64, 'base64').toString('utf8') : undefined, at: Date.now() };
+  aksCredCache.set(key, cred);
+  return cred;
+}
+
+function k8sMsg(body) { try { return JSON.parse(body).message; } catch { return null; } }
+
+// The "build" of a pod = its container image tag (e.g. registry/app:11.5.0387 → 11.5.0387).
+// Digest-pinned images (@sha256:…) have no human tag; callers fall back to a version label.
+function imageTag(img) {
+  if (!img || img.includes('@')) return '';
+  const repoTag = img.slice(img.lastIndexOf('/') + 1);
+  const c = repoTag.indexOf(':');
+  return c >= 0 ? repoTag.slice(c + 1) : '';
+}
+
+// One GET against a cluster's Kubernetes API. raw=true returns text (for pod logs).
+function k8sGet(cred, pathQuery, { raw = false, timeout = 25000 } = {}) {
+  return new Promise((resolve, reject) => {
+    getAksToken().then((token) => {
+      const u = new URL(cred.server + pathQuery);
+      const req = https.request({
+        hostname: u.hostname, port: u.port || 443, path: u.pathname + u.search, method: 'GET',
+        // '*/*' for raw so the log subresource returns text/plain without tripping content negotiation
+        headers: { Authorization: `Bearer ${token}`, Accept: raw ? '*/*' : 'application/json' },
+        ca: cred.ca, timeout,
+      }, (res) => {
+        let data = ''; res.setEncoding('utf8');
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => {
+          const s = res.statusCode;
+          if (s === 401) { tokenCache.delete(AKS_AAD_SERVER_APP); return reject(Object.assign(new Error('Token rejected — run az login'), { needLogin: true })); }
+          if (s === 403) return reject(Object.assign(new Error(k8sMsg(data) || 'Forbidden'), { forbidden: true }));
+          if (s === 404) return reject(Object.assign(new Error(k8sMsg(data) || 'Not found'), { notFound: true }));
+          if (s >= 400) return reject(new Error(k8sMsg(data) || `Kubernetes returned ${s}`));
+          try { resolve(raw ? data : (data ? JSON.parse(data) : null)); }
+          catch (e) { reject(new Error('Failed to parse Kubernetes response: ' + e.message)); }
+        });
+      });
+      req.on('error', (e) => {
+        const code = e.code || '';
+        const network = /ENOTFOUND|ETIMEDOUT|ECONNREFUSED|EAI_AGAIN|ECONNRESET|UNABLE_TO_VERIFY|SELF_SIGNED/.test(code + e.message);
+        reject(Object.assign(new Error(network
+          ? 'Cannot reach the cluster API server — it is private. Connect to the corporate VPN and retry.'
+          : e.message), { network }));
+      });
+      req.on('timeout', () => req.destroy(Object.assign(new Error('Cluster API request timed out — is the VPN connected?'), { network: true })));
+      req.end();
+    }).catch(reject);
+  });
+}
+
+// Discover clusters you have ARM read on (best-effort) and merge with the configured list.
+const AKS_QUERY =
+  "resources | where type =~ 'microsoft.containerservice/managedclusters' " +
+  "| project name, resourceGroup, subscriptionId, " +
+  "ver=tostring(properties.kubernetesVersion), " +
+  "priv=tostring(properties.apiServerAccessProfile.enablePrivateCluster) | order by name asc";
+async function discoverClusters() {
+  try {
+    const subIds = (await listSubscriptions()).map((s) => s.subscriptionId);
+    const out = await armFetch('/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01', {
+      method: 'POST', body: { subscriptions: subIds, query: AKS_QUERY, options: { resultFormat: 'objectArray', $top: 1000 } },
+    });
+    return (out.data || []).map((c) => ({ name: c.name, resourceGroup: c.resourceGroup,
+      subscription: c.subscriptionId, version: c.ver, private: c.priv === 'true', configured: false }));
+  } catch { return []; }
+}
+
+function clusterById(list, id) { return list.find((c) => c.name === id); }
+async function aksList() {
+  const discovered = await discoverClusters();
+  const byKey = new Map();
+  for (const c of discovered) byKey.set(c.name.toLowerCase(), c);
+  for (const c of [...AKS_CLUSTERS, ...SESSION_CLUSTERS]) {   // configured (file then session) win + carry label/env
+    const prev = byKey.get(c.name.toLowerCase()) || {};
+    byKey.set(c.name.toLowerCase(), { ...prev, ...c });
+  }
+  return [...byKey.values()].sort((a, b) => (a.label || a.name).localeCompare(b.label || b.name));
+}
+
+app.get('/api/aks/clusters', (req, res) =>
+  send(res, aksList().then((clusters) => ({ clusters,
+    configured: AKS_CLUSTERS.length + SESSION_CLUSTERS.length, file: AKS_CLUSTERS.length, session: SESSION_CLUSTERS.length }))));
+
+// Register the user's pasted cluster list for this session (from their localStorage).
+// Replaces the previous session list; validated; localhost-only like the rest of the API.
+app.post('/api/aks/clusters', (req, res) => {
+  const { clusters } = req.body || {};
+  if (!Array.isArray(clusters)) return res.status(400).json({ ok: false, error: 'clusters must be a JSON array' });
+  if (clusters.length > 200) return res.status(400).json({ ok: false, error: 'Too many clusters (max 200)' });
+  for (const c of clusters) {
+    if (!c || !c.name || !c.resourceGroup || !c.subscription) return res.status(400).json({ ok: false, error: `Each entry needs name, resourceGroup, subscription (got: ${JSON.stringify(c).slice(0, 60)})` });
+    if (!clusterValid(c)) return res.status(400).json({ ok: false, error: `Invalid cluster entry "${c.name}" — check name / resourceGroup / subscription` });
+  }
+  SESSION_CLUSTERS = normalizeClusters(clusters, 'session');
+  aksCredCache.clear();                              // coordinates may have changed
+  res.json({ ok: true, data: { count: SESSION_CLUSTERS.length } });
+});
+
+// Resolve a :cluster route param to a known cluster, or throw a typed 400/404.
+async function getClusterChecked(name) {
+  if (!isValidName(name)) throw Object.assign(new Error('Invalid cluster name'), { status: 400 });
+  const c = clusterById(await aksList(), name);
+  if (!c) throw Object.assign(new Error('Cluster is not in your configured/visible list'), { status: 404, notFound: true });
+  return c;
+}
+
+app.get('/api/aks/:cluster/namespaces', (req, res) =>
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, '/api/v1/namespaces?limit=500');
+    return (out.items || []).map((n) => ({ name: n.metadata.name, status: n.status && n.status.phase }));
+  })()));
+
+// Cluster-wide pod list (all namespaces) — each row carries its namespace.
+app.get('/api/aks/:cluster/pods', (req, res) =>
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, '/api/v1/pods?limit=5000');
+    return (out.items || []).map((p) => {
+      const cs = (p.status && p.status.containerStatuses) || [];
+      const spec = (p.spec && p.spec.containers) || [];
+      const labels = p.metadata.labels || {};
+      const build = imageTag((spec[0] || {}).image) || labels['app.kubernetes.io/version'] || labels.version || labels['tags.datadoghq.com/version'] || '';
+      return { name: p.metadata.name, namespace: p.metadata.namespace, phase: p.status && p.status.phase, node: p.spec && p.spec.nodeName,
+        build,
+        restarts: cs.reduce((a, x) => a + (x.restartCount || 0), 0),
+        ready: `${cs.filter((x) => x.ready).length}/${cs.length || spec.length}`,
+        containers: spec.map((x) => x.name), created: p.metadata.creationTimestamp };
+    });
+  })()));
+
+// Pod detail: labels (tags), images+tags, and declared env vars (names + inline values +
+// secret/configmap references). Secret VALUES are never read — only the declarations.
+app.get('/api/aks/:cluster/:ns/pods/:pod/detail', (req, res) => {
+  const { ns, pod } = req.params;
+  if (!isK8sName(ns) || !isK8sName(pod)) return res.status(400).json({ ok: false, error: 'Invalid namespace/pod' });
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const p = await k8sGet(cred, `/api/v1/namespaces/${ns}/pods/${pod}`);
+    const md = p.metadata || {}, spec = p.spec || {};
+    const inits = spec.initContainers || [];
+    const descFrom = (vf) => {
+      if (!vf) return null;
+      if (vf.secretKeyRef) return { kind: 'secret', name: vf.secretKeyRef.name, key: vf.secretKeyRef.key };
+      if (vf.configMapKeyRef) return { kind: 'configMap', name: vf.configMapKeyRef.name, key: vf.configMapKeyRef.key };
+      if (vf.fieldRef) return { kind: 'field', key: vf.fieldRef.fieldPath };
+      if (vf.resourceFieldRef) return { kind: 'resource', key: vf.resourceFieldRef.resource };
+      return { kind: '?' };
+    };
+    const containers = [...(spec.containers || []), ...inits].map((c) => ({
+      name: c.name, init: inits.includes(c), image: c.image, tag: imageTag(c.image),
+      env: (c.env || []).map((e) => ({ name: e.name, value: e.value != null ? e.value : undefined, from: descFrom(e.valueFrom) })),
+      envFrom: (c.envFrom || []).map((ef) => ({ kind: ef.secretRef ? 'secret' : ef.configMapRef ? 'configMap' : '?', name: (ef.secretRef || ef.configMapRef || {}).name, prefix: ef.prefix || '' })),
+    }));
+    return { name: md.name, namespace: md.namespace, node: spec.nodeName, labels: md.labels || {}, annotations: md.annotations || {}, containers };
+  })());
+});
+
+// Cluster-wide configmap list (all namespaces).
+app.get('/api/aks/:cluster/configmaps', (req, res) =>
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, '/api/v1/configmaps?limit=5000');
+    return (out.items || []).map((m) => ({ name: m.metadata.name, namespace: m.metadata.namespace,
+      keys: Object.keys(m.data || {}), created: m.metadata.creationTimestamp }));
+  })()));
+
+app.get('/api/aks/:cluster/:ns/pods', (req, res) => {
+  if (!isK8sName(req.params.ns)) return res.status(400).json({ ok: false, error: 'Invalid namespace' });
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, `/api/v1/namespaces/${req.params.ns}/pods?limit=1000`);
+    return (out.items || []).map((p) => {
+      const cs = (p.status && p.status.containerStatuses) || [];
+      const spec = (p.spec && p.spec.containers) || [];
+      return { name: p.metadata.name, phase: p.status && p.status.phase, node: p.spec && p.spec.nodeName,
+        restarts: cs.reduce((a, x) => a + (x.restartCount || 0), 0),
+        ready: `${cs.filter((x) => x.ready).length}/${cs.length || spec.length}`,
+        containers: spec.map((x) => x.name), created: p.metadata.creationTimestamp };
+    });
+  })());
+});
+
+app.get('/api/aks/:cluster/:ns/pods/:pod/log', (req, res) => {
+  const { ns, pod } = req.params;
+  if (!isK8sName(ns) || !isK8sName(pod)) return res.status(400).json({ ok: false, error: 'Invalid namespace/pod' });
+  const q = new URLSearchParams();
+  const tail = Math.min(20000, Math.max(1, Number(req.query.tailLines) || 1000));
+  q.set('tailLines', String(tail));
+  if (req.query.timestamps === 'true') q.set('timestamps', 'true');
+  if (req.query.previous === 'true') q.set('previous', 'true');
+  if (req.query.container && isK8sName(req.query.container)) q.set('container', req.query.container);
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const text = await k8sGet(cred, `/api/v1/namespaces/${ns}/pods/${pod}/log?${q.toString()}`, { raw: true });
+    return { log: text, lines: text ? text.split('\n').length : 0 };
+  })());
+});
+
+app.get('/api/aks/:cluster/:ns/configmaps', (req, res) => {
+  if (!isK8sName(req.params.ns)) return res.status(400).json({ ok: false, error: 'Invalid namespace' });
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, `/api/v1/namespaces/${req.params.ns}/configmaps?limit=500`);
+    return (out.items || []).map((m) => ({ name: m.metadata.name, keys: Object.keys(m.data || {}),
+      created: m.metadata.creationTimestamp }));
+  })());
+});
+
+app.get('/api/aks/:cluster/:ns/configmaps/:cm', (req, res) => {
+  const { ns, cm } = req.params;
+  if (!isK8sName(ns) || !isK8sName(cm)) return res.status(400).json({ ok: false, error: 'Invalid namespace/configmap' });
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const out = await k8sGet(cred, `/api/v1/namespaces/${ns}/configmaps/${cm}`);
+    return { name: out.metadata.name, data: out.data || {} };
+  })());
+});
+
+// Which Key Vaults does a pod reference? Three signals, best-effort:
+//   1) CSI Secrets Store — pod volume → SecretProviderClass → keyvaultName (exact, declarative)
+//   2) container env values containing a *.vault.azure.net URL
+//   3) configmaps the pod consumes (envFrom / valueFrom / volume) whose values contain one
+const VAULT_URL_RE = /\b([a-z0-9][a-z0-9-]{1,22}[a-z0-9])\.vault\.azure\.(?:net|cn|usgovcloudapi\.net)\b/gi;
+function scanVaultRefs(text, set, source, srcMap) {
+  if (typeof text !== 'string') return;
+  let m; VAULT_URL_RE.lastIndex = 0;
+  while ((m = VAULT_URL_RE.exec(text))) { const n = m[1].toLowerCase(); set.add(n); (srcMap[n] = srcMap[n] || new Set()).add(source); }
+}
+async function fetchSpc(cred, ns, name) {
+  for (const v of ['v1', 'v1alpha1']) {
+    try { return await k8sGet(cred, `/apis/secrets-store.csi.x-k8s.io/${v}/namespaces/${ns}/secretproviderclasses/${name}`); }
+    catch (e) { if (e.notFound) continue; throw e; }
+  }
+  return null;
+}
+
+app.get('/api/aks/:cluster/:ns/pods/:pod/keyvaults', (req, res) => {
+  const { ns, pod } = req.params;
+  if (!isK8sName(ns) || !isK8sName(pod)) return res.status(400).json({ ok: false, error: 'Invalid namespace/pod' });
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const p = await k8sGet(cred, `/api/v1/namespaces/${ns}/pods/${pod}`);
+    const spec = p.spec || {};
+    const containers = [...(spec.containers || []), ...(spec.initContainers || []), ...(spec.ephemeralContainers || [])];
+    const set = new Set(), srcMap = {};
+    // 2) inline env values
+    for (const c of containers) for (const e of (c.env || [])) scanVaultRefs(e.value, set, 'env', srcMap);
+    // configmaps the pod directly references (envFrom / valueFrom / configMap & projected volumes)
+    const refNames = new Set();
+    for (const c of containers) {
+      for (const ef of (c.envFrom || [])) if (ef.configMapRef && ef.configMapRef.name) refNames.add(ef.configMapRef.name);
+      for (const e of (c.env || [])) if (e.valueFrom && e.valueFrom.configMapKeyRef) refNames.add(e.valueFrom.configMapKeyRef.name);
+    }
+    for (const v of (spec.volumes || [])) {
+      if (v.configMap && v.configMap.name) refNames.add(v.configMap.name);
+      for (const s of ((v.projected && v.projected.sources) || [])) if (s.configMap && s.configMap.name) refNames.add(s.configMap.name);
+    }
+    // 3) List the namespace's configmaps (data included) and scan the ones that are either
+    //    referenced by the pod, or name-related to it (the "<app>-appsettings" convention).
+    const podLc = pod.toLowerCase();
+    const cmBase = (n) => n.toLowerCase().replace(/-(appsettings|configmap|config|settings|secrets?|env|vars|values)$/, '');
+    const scanned = [];
+    try {
+      const list = await k8sGet(cred, `/api/v1/namespaces/${ns}/configmaps?limit=500`);
+      for (const m of (list.items || [])) {
+        const nm = m.metadata.name, base = cmBase(nm);
+        const related = refNames.has(nm) || podLc === base || podLc.startsWith(base + '-') || podLc.startsWith(nm.toLowerCase() + '-');
+        if (!related) continue;
+        scanned.push(nm);
+        for (const val of Object.values(m.data || {})) scanVaultRefs(val, set, 'configmap:' + nm, srcMap);
+      }
+    } catch { /* can't list configmaps — skip that signal */ }
+    // 1) CSI SecretProviderClasses referenced by the pod's volumes
+    const spcNames = new Set();
+    for (const v of (spec.volumes || [])) {
+      const drv = (v.csi && v.csi.driver) || '';
+      if (/secrets-store\.csi/.test(drv) && v.csi.volumeAttributes && v.csi.volumeAttributes.secretProviderClass)
+        spcNames.add(v.csi.volumeAttributes.secretProviderClass);
+    }
+    const spcs = [];
+    for (const spc of spcNames) {
+      try {
+        const o = await fetchSpc(cred, ns, spc);
+        if (!o) { spcs.push({ name: spc, readable: false }); continue; }
+        const params = (o.spec && o.spec.parameters) || {};
+        const kv = params.keyvaultName || params.keyvaultname || params.keyVaultName;
+        if (kv) { const n = String(kv).toLowerCase(); set.add(n); (srcMap[n] = srcMap[n] || new Set()).add('csi:' + spc); }
+        for (const val of Object.values(params)) scanVaultRefs(String(val), set, 'csi:' + spc, srcMap);  // objects YAML etc.
+        spcs.push({ name: spc, readable: true, vault: kv ? String(kv).toLowerCase() : null });
+      } catch (e) {
+        // The CRD is often unreadable, but a SecretProviderClass is commonly named after its
+        // vault — if that name matches a vault you can see, surface it (no false positives).
+        let inferred = null;
+        try { const mv = await findVaultMeta(spc); if (mv) { const n = mv.name.toLowerCase(); set.add(n); (srcMap[n] = srcMap[n] || new Set()).add('csi:' + spc + ' (by name)'); inferred = mv.name; } } catch { /* ignore */ }
+        spcs.push({ name: spc, readable: false, forbidden: !!e.forbidden, inferredVault: inferred });
+      }
+    }
+    // 4) Secrets the pod consumes that are synced from a Key Vault by External Secrets
+    //    Operator. We read only secret METADATA (never values) to find the owning
+    //    ExternalSecret, then resolve its SecretStore's azurekv vaultUrl when readable.
+    const secretNames = new Set();
+    for (const c of containers) {
+      for (const ef of (c.envFrom || [])) if (ef.secretRef && ef.secretRef.name) secretNames.add(ef.secretRef.name);
+      for (const e of (c.env || [])) if (e.valueFrom && e.valueFrom.secretKeyRef) secretNames.add(e.valueFrom.secretKeyRef.name);
+    }
+    for (const v of (spec.volumes || [])) {
+      if (v.secret && v.secret.secretName) secretNames.add(v.secret.secretName);
+      for (const s of ((v.projected && v.projected.sources) || [])) if (s.secret && s.secret.name) secretNames.add(s.secret.name);
+    }
+    const esNames = new Set();
+    for (const sn of secretNames) {
+      try {
+        const s = await k8sGet(cred, `/api/v1/namespaces/${ns}/secrets/${sn}`);   // metadata only is used below
+        const md = s.metadata || {};
+        const owner = (md.ownerReferences || []).find((o) => o.kind === 'ExternalSecret');
+        const eso = owner || (md.labels && md.labels['reconcile.external-secrets.io/managed'] === 'true') ||
+          Object.keys(md.annotations || {}).some((a) => a.startsWith('reconcile.external-secrets.io/'));
+        if (eso) esNames.add(owner ? owner.name : sn);
+      } catch { /* can't read secret metadata — skip */ }
+    }
+    const externalSecrets = [];
+    const getCRD = async (path) => { for (const ver of ['v1', 'v1beta1']) { try { return await k8sGet(cred, path.replace('{v}', ver)); } catch (e) { if (e.notFound) continue; throw e; } } return null; };
+    for (const esn of esNames) {
+      const entry = { externalSecret: esn, vault: null, resolvable: false, reason: null };
+      try {
+        const es = await getCRD(`/apis/external-secrets.io/{v}/namespaces/${ns}/externalsecrets/${esn}`);
+        const ref = (es && es.spec && es.spec.secretStoreRef) || {};
+        const storePath = ref.kind === 'ClusterSecretStore'
+          ? `/apis/external-secrets.io/{v}/clustersecretstores/${ref.name}`
+          : `/apis/external-secrets.io/{v}/namespaces/${ns}/secretstores/${ref.name}`;
+        const store = ref.name ? await getCRD(storePath) : null;
+        const akv = store && store.spec && store.spec.provider && store.spec.provider.azurekv;
+        const url = akv && (akv.vaultUrl || akv.vaultUri);
+        const m = url && /([a-z0-9][a-z0-9-]{1,22}[a-z0-9])\.vault\.azure\./i.exec(url);
+        if (m) { const n = m[1].toLowerCase(); set.add(n); (srcMap[n] = srcMap[n] || new Set()).add('eso:' + esn); entry.vault = n; entry.resolvable = true; }
+        else entry.reason = 'store has no azurekv vaultUrl';
+      } catch (e) { entry.reason = e.forbidden ? 'needs read on externalsecrets / secretstores' : (e.message || 'unreadable'); }
+      externalSecrets.push(entry);
+    }
+    const vaults = [...set].sort().map((name) => ({ name, sources: [...(srcMap[name] || [])] }));
+    return { vaults, configmapsScanned: scanned, spcs, externalSecrets };
+  })());
+});
+
+// Interactive shell INTO a pod, in the browser. The browser opens a WebSocket to us;
+// we open an upstream WebSocket to the Kubernetes `exec` endpoint (CA + AAD bearer
+// token) and bridge the channel-framed streams. No kubectl needed. The API server
+// enforces Kubernetes RBAC (pods/exec) — this grants nothing the identity lacks.
+const { WebSocketServer, WebSocket } = require('ws');
+const execWss = new WebSocketServer({ noServer: true });
+
+function attachExecWss(server) {
+  server.on('upgrade', (req, socket, head) => {
+    let url; try { url = new URL(req.url, 'http://localhost'); } catch { socket.destroy(); return; }
+    if (url.pathname !== '/ws/aks/exec') { socket.destroy(); return; }
+    execWss.handleUpgrade(req, socket, head, (client) => bridgeExec(client, url.searchParams));
+  });
+}
+
+async function bridgeExec(client, params) {
+  const clusterName = params.get('cluster'), ns = params.get('ns'), pod = params.get('pod');
+  const container = params.get('container') || null;
+  const tell = (m) => { try { if (client.readyState === 1) client.send(m); } catch { /* ignore */ } };
+  if (!isValidName(clusterName || '') || !isK8sName(ns || '') || !isK8sName(pod || '') || (container && !isK8sName(container))) {
+    tell('\r\n\x1b[31mInvalid cluster/namespace/pod.\x1b[0m\r\n'); client.close(); return;
+  }
+  let cred, token;
+  try {
+    const c = clusterById(await aksList(), clusterName);
+    if (!c) throw new Error('Cluster is not in your configured/visible list');
+    cred = await aksCredential(c);
+    token = await getAksToken();
+  } catch (e) {
+    tell('\r\n\x1b[31m' + (e.network ? 'Cannot reach the cluster — connect to the VPN.' : (e.message || 'auth failed')) + '\x1b[0m\r\n');
+    client.close(); return;
+  }
+  const q = new URLSearchParams();
+  q.set('stdin', 'true'); q.set('stdout', 'true'); q.set('stderr', 'true'); q.set('tty', 'true');
+  if (container) q.set('container', container);
+  // Prefer bash, fall back to ash/sh — one exec, the shell picks what exists.
+  for (const part of ['/bin/sh', '-c', 'clear; (bash || ash || sh)']) q.append('command', part);
+  const wsUrl = cred.server.replace(/^https:/, 'wss:') + `/api/v1/namespaces/${ns}/pods/${pod}/exec?` + q.toString();
+
+  const upstream = new WebSocket(wsUrl, ['v4.channel.k8s.io', 'channel.k8s.io'], {
+    headers: { Authorization: `Bearer ${token}` }, ca: cred.ca,
+  });
+  let handled = false;   // so the generic 'error' doesn't double-report a decoded HTTP status
+
+  // The exec handshake is plain HTTP until it upgrades; decode a non-101 status precisely.
+  upstream.on('unexpected-response', (reqU, resU) => {
+    handled = true;
+    let body = ''; resU.on('data', (d) => { body += d; }); resU.on('end', () => {
+      let msg; try { msg = JSON.parse(body).message; } catch { /* ignore */ }
+      const s = resU.statusCode;
+      const friendly = s === 401 ? 'Not authorized — token rejected. Run az login (and check the cluster is managed-AAD).'
+        : s === 403 ? 'Forbidden — your identity lacks Kubernetes "pods/exec" permission in this namespace.'
+        : s === 404 ? 'Pod, namespace or container not found.'
+        : (msg || `Kubernetes returned ${s}`);
+      tell('\r\n\x1b[31m' + friendly + '\x1b[0m\r\n'); try { client.close(); } catch { /* ignore */ }
+    });
+  });
+
+  upstream.on('open', () => tell(`\x1b[32m● connected to ${ns}/${pod}${container ? ' [' + container + ']' : ''}\x1b[0m\r\n`));
+  upstream.on('message', (data) => {
+    if (!data || !data.length) return;
+    const ch = data[0], payload = data.subarray(1);     // channel: 1=stdout 2=stderr 3=error/status
+    if (ch === 1 || ch === 2) { if (client.readyState === 1) client.send(payload); }
+    else if (ch === 3) { try { const j = JSON.parse(payload.toString()); if (j.status === 'Failure' && j.message) tell('\r\n\x1b[31m' + j.message + '\x1b[0m\r\n'); } catch { /* ignore */ } }
+  });
+  upstream.on('close', () => { tell('\r\n\x1b[33m● session closed\x1b[0m\r\n'); try { client.close(); } catch { /* ignore */ } });
+  upstream.on('error', (e) => { if (handled) return; tell('\r\n\x1b[31m' + (e.message || 'connection error — is the VPN connected?') + '\x1b[0m\r\n'); try { client.close(); } catch { /* ignore */ } });
+
+  client.on('message', (msg, isBinary) => {
+    if (upstream.readyState !== 1) return;
+    if (isBinary) { upstream.send(Buffer.concat([Buffer.from([0]), msg])); return; }   // channel 0 = stdin
+    try { const j = JSON.parse(msg.toString());                                         // text = control (resize)
+      if (j.type === 'resize') upstream.send(Buffer.concat([Buffer.from([4]), Buffer.from(JSON.stringify({ Width: j.cols, Height: j.rows }))]));
+    } catch { /* ignore */ }
+  });
+  client.on('close', () => { try { upstream.close(); } catch { /* ignore */ } });
+}
+
 // ---- fallback --------------------------------------------------------------
 
 app.get('/api/health', (req, res) => res.json({ ok: true, az: AZ }));
@@ -613,7 +1100,7 @@ const ENV_RULES = (() => {
 const PKG_VERSION = (() => { try { return require('./package.json').version; } catch { return null; } })();
 app.get('/api/config', (req, res) =>
   res.json({ ok: true, data: { envRules: ENV_RULES, title: process.env.AZBO_TITLE || null,
-    version: PKG_VERSION, protectedTags: PROTECTED_TAGS } }));
+    version: PKG_VERSION, protectedTags: PROTECTED_TAGS, aksConfigured: AKS_CLUSTERS.length } }));
 
 function openBrowser(url) {
   if (process.env.AZBO_NO_OPEN) return;
@@ -630,6 +1117,7 @@ function start(port, attemptsLeft = 12) {
     console.log(`  Stop with Ctrl-C.\n`);
     openBrowser(url);
   });
+  attachExecWss(server);   // browser ⇆ Kubernetes exec bridge for the in-pod terminal
   server.on('error', (e) => {
     if (e.code === 'EADDRINUSE' && attemptsLeft > 0) {
       console.log(`  Port ${port} in use, trying ${port + 1}…`);