Flag a 401 on the Helm read and explain the flag to agents

A 401 means Radar's own credentials failed, not that the caller may not
read release Secrets, so it now sets helm_issues_unchecked and is logged as
a failure. Only a Kubernetes Forbidden answer still counts as the caller's
permission boundary.

The MCP issues tool description now says what helm_issues_unchecked means,
since agents read the description, not the docs.

Author: hisco

internal/helm/issue_releases.go

@@ -61,13 +61,20 @@ func (c *Client) ListIssueReleasesAcrossNamespaces(ctx context.Context, namespac
 	return listIssueReleasesWithClients(ctx, client, labelsClient, contextName, namespaces)
 }
 
+// IssueReadDenied reports whether a failed ListIssueReleasesAcrossNamespaces
+// was Kubernetes refusing the caller's release Secret list. A 401 is not: it
+// is Radar's own credentials failing, not the caller's permissions.
+func IssueReadDenied(err error) bool {
+	return err != nil && isReleaseReadForbidden(err)
+}
+
 // IssueReadUnchecked reports whether a failed ListIssueReleasesAcrossNamespaces
-// leaves the caller's Helm issues unknown. A denial is not: the caller may not
-// read release Secrets, so it sees no Helm issues, like any other kind it can't
-// list. Neither is a caller that left, since nobody gets the answer. Radar's
-// own request deadline is a failure: the caller is still waiting.
+// leaves the caller's Helm issues unknown. A denial does not: the caller may
+// not read release Secrets, so it sees no Helm issues, like any other kind it
+// can't list. Neither does a caller that left, since nobody gets the answer.
+// Radar's own request deadline does: the caller is still waiting.
 func IssueReadUnchecked(ctx context.Context, err error) bool {
-	return err != nil && !IsForbiddenError(err) && !errors.Is(ctx.Err(), context.Canceled)
+	return err != nil && !IssueReadDenied(err) && !errors.Is(ctx.Err(), context.Canceled)
 }
 
 func listIssueReleasesWithClients(ctx context.Context, client kubernetes.Interface, labelsClient metadata.Interface, contextName string, namespaces []string) ([]HelmRelease, error) {

internal/mcp/helm_issues_unchecked_test.go

@@ -15,6 +15,7 @@ import (
 	"k8s.io/client-go/rest"
 
 	"github.com/skyhook-io/radar/internal/helm"
+	"github.com/skyhook-io/radar/internal/issues"
 	"github.com/skyhook-io/radar/internal/k8s"
 )
 
@@ -38,6 +39,13 @@ func TestIssuesToolSaysWhenHelmReleasesCouldNotBeChecked(t *testing.T) {
 			status: http.StatusForbidden,
 			body:   `{"kind":"Status","apiVersion":"v1","status":"Failure","message":"secrets is forbidden","reason":"Forbidden","code":403}`,
 		},
+		{
+			// Radar's own credentials failing is not the caller's permissions.
+			name:          "API server rejects Radar's credentials",
+			status:        http.StatusUnauthorized,
+			body:          `{"kind":"Status","apiVersion":"v1","status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}`,
+			wantUnchecked: true,
+		},
 		{
 			name:   "read succeeded",
 			status: http.StatusOK,
@@ -86,3 +94,18 @@ func TestIssuesToolSaysWhenHelmReleasesCouldNotBeChecked(t *testing.T) {
 		})
 	}
 }
+
+// A caller that already left gets no answer, so its read cut short is not
+// a failed check.
+func TestNativeHelmIssuesDoNotSayUncheckedWhenCallerLeft(t *testing.T) {
+	helm.ResetClient()
+	if err := helm.InitializeWithRESTConfig(&rest.Config{Host: "http://127.0.0.1:1"}); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(helm.ResetClient)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, unchecked := nativeHelmIssuesForContext(ctx, []string{"shop"}, issues.Filters{}); unchecked {
+		t.Error("a caller that left was told Helm releases couldn't be checked")
+	}
+}

internal/mcp/tools.go

@@ -389,6 +389,8 @@ func registerTools(server *mcp.Server, includeWrites bool, paramRegistry *toolPa
 			"grouped critical/warning failures across workloads, Jobs/CronJobs, HPAs, " +
 			"PVCs, Nodes, references, pod startup, native Helm, and False controller conditions. " +
 			"Use CEL `filter` for source/taxonomy slices; no source parameter. " +
+			"`helm_issues_unchecked: true` means Helm releases couldn't be read, so failed " +
+			"Helm releases may be missing; don't call Helm healthy. " +
 			"`diagnostic_context.role` marks roots, rollups, symptoms, or context; " +
 			"`related_issues[].count` is the root's affected subset, not the linked issue total. " +
 			"Confidence: `high` declared edge, `medium` lead to verify, `low` heuristic. " +
@@ -3158,7 +3160,7 @@ func nativeHelmIssuesForContext(ctx context.Context, namespaces []string, filter
 	}
 	releases, err := helmClient.ListIssueReleasesAcrossNamespaces(ctx, helmNamespaces, username, groups)
 	if err != nil {
-		if !errors.Is(ctx.Err(), context.Canceled) && !helm.IsForbiddenError(err) {
+		if !errors.Is(ctx.Err(), context.Canceled) && !helm.IssueReadDenied(err) {
 			log.Printf("[mcp] Failed to list Helm releases for issue stream: %v", err)
 		}
 		return nil, helm.IssueReadUnchecked(ctx, err)

internal/server/issues_handler.go

@@ -231,7 +231,7 @@ func (s *Server) nativeHelmIssuesForRequest(r *http.Request, namespaces []string
 		switch {
 		case errors.Is(ctx.Err(), context.Canceled):
 			// The caller went away; nobody is left to tell.
-		case !helm.IsForbiddenError(err):
+		case !helm.IssueReadDenied(err):
 			log.Printf("[issues] Failed to list Helm releases for issue stream: %v", err)
 		default:
 			if _, seen := helmIssuesDeniedLogged.LoadOrStore(pkgauth.IdentityCacheKey(username, groups), struct{}{}); !seen {