Two coordinated capabilities for the "drift between deployments and GitOps"
ask, credential-free detection plus a hardened connected deep-diff view.

## Detection (no credentials)

- Manual-sync Applications continuously OutOfSync for >24h reach the issues
  stream (gitops_out_of_sync, warning). Drift onset is tracked Radar-side per
  app UID on the ResourceCache (Argo records no sync-status transition time);
  a restart resets the clock — deliberately conservative.
- New gitops_stale category: a down application-controller emits one critical
  rollup ("sync verdicts are frozen"), a majority-stale fleet (>=3 apps) one
  warning rollup, isolated stale apps per-app warnings. Threshold max(30m,
  10x argocd-cm timeout.reconciliation); controller pods found by label across
  all namespaces.
- Cluster Audit: gitops-unmanaged-workload / gitops-helm-only-workload flag
  top-level workloads outside GitOps via the pkg/subject overlay tiers. Gated
  on real GitOps root objects existing (not just CRDs); ownerRef'd workloads
  skipped; Argo label-tracking recognized by cross-referencing app names.
- GitOps detail page discloses spec.ignoreDifferences as comparison coverage
  (rule/jq/managed-fields counts + kinds).

## Argo CD API deep diff (connected)

- pkg/argoapi: pure REST client for argocd-server (filtered managed-resources,
  session/userinfo probe, version reachability, CLI-config token extraction);
  no internal/ imports, so radar-hub can reuse it.
- internal/argocd: discovery by service label, argocd-owned port-forward for
  out-of-cluster runs, 15s TTL cache, lazy self-reconnect, context-switch reset.
- GET /api/argo/applications/{ns}/{name}/resource-diff: dual RBAC gate
  (Application namespace access + per-kind get SAR) before any upstream call;
  Git-rendered desired vs normalized live YAML + field entries.
- UI: Settings "Argo CD" card (URL/token/insecure-TLS/CLI-session), inline
  unified diff on the expanded change row with a full-screen maximize, and a
  "Connect Argo CD" hint when disconnected.

## Security model (3 review rounds, all findings fixed)

- Token bound to its origin AND kubeconfig context: changing the URL or
  switching context requires re-entering it; the probe runs off an immutable
  snapshot (URL + token + TLS + frozen k8s client/config), fails closed if a
  switch races the capture, and commits only under a generation check — the
  token never reaches a different cluster's argocd-server.
- Secret redaction is fail-closed: data/stringData/binaryData masked in any
  shape, annotation values masked, last-applied/managedFields/status stripped
  before serialization. No un-redact.
- No credential or secret in responses or logs: token redacted from GET
  /api/config and probe logs; upstream Argo error bodies never reach responses.

Verified: full Go suite + tsc green both modules; real-cluster validation
against nonprod GKE Argo (discovery/port-forward/token-verify round-trip);
diff render + redaction + UI verified on the gitops-demo kind cluster.

The field diff compared arrays by serialized equality, so a single field
changing inside one list element (the common case: a container's image,
resources, or env) rendered the whole array as an unreadable one-line JSON
blob on both sides. diffValues now descends element-by-element, so that
change reads as its own path — e.g. spec.containers.[0].resources.limits.memory
changed 128Mi → 256Mi. Index alignment is accurate for these inputs: K8s
controllers preserve list order between apply and observe, and the Argo API
normalizes both sides. A length change surfaces the added/removed element at
its index. Applies to both the last-applied and Argo-API (DiffObjects) paths.

The Sync/Health badges and the action button were pinned to the top of
each row (self-start), so in a tall row (multi-line name + drift/message)
they floated above the row's midline. Center them (self-center) against
the row height.

…modal

The "My permissions" section was a near-empty pane whose only content was an
"Open my permissions" button that launched a separate full-screen dialog — a
pointless hop, and it was the default landing section. Extracted the
permissions viewer into MyPermissionsContent (no modal chrome, apiserver
queries gated on the section being active) and render it directly in the
settings pane. Opening Settings now lands on your actual access inline.
Removed the standalone MyPermissionsDialog usage + onShowMyPermissions
launcher plumbing from App and the dialog props (Settings was its only opener).

The repo forbids native title attributes (check-no-native-title) in favor
of the themed Tooltip. Wrap the disabled-tab hint and the unsaved-changes
dot in Tooltip.

…permissions namespace

- The startup-config PUT no longer owns any live integration field. It
  preserves prometheusUrl/headers and argoCdUrl/token/insecureTls verbatim
  (the /integrations/* endpoints are their sole owners), so a full-config
  save can't race an in-flight Apply/Connect and revert — or clear the token
  on — a live integration.
- ignoreDifferences JSON pointers into array indices now match the bracketed
  drift paths that array descent emits: /spec/containers/0/image strips
  spec.containers.[0].image. Without this, exclusions into arrays silently
  stopped working after per-index diffing landed.
- My permissions lands on an accessible namespace: if the default isn't in the
  user's namespace list and they haven't picked one, it switches to the first
  accessible one instead of showing an empty "default".

- Serialize probes (probeMu) so background reconnect and the on-demand
  probe from ManagedResourcesCached can't race on the port-forward/client.
- Fail closed on a context/token mismatch in auto-discovery: Probe refuses
  (errTokenContextMismatch) instead of connecting unauthenticated, which
  would light deep-diff while every managed-resource call 403s.
- Only rebind tokenContext for an explicitly-provided token (tokenIsFresh);
  re-saving with a carried-forward token no longer rebinds it to the
  current cluster context.
- Offer deep-diff via IsConfigured() right after restart while the
  background reconnect is still in flight, instead of 503 until first probe.
- Reject an empty Application namespace on the resource-diff endpoint (400)
  rather than skipping the namespace RBAC gate.
- Rewrite sanitizeForLog with strings.ReplaceAll (a recognized log-injection
  barrier) and sanitize wrapped error strings at the argo log sites.

Settings now lands on an Overview that shows what this Radar is connected to
at a glance — cluster, Prometheus, Argo CD, MCP (with its endpoint), and AI
diagnose — each row a shortcut into its section. Backed by a new read-only
GET /integrations/argocd/status (configured/connected/address, mirroring the
Prometheus status endpoint), so the Argo row reflects live connection state.

Also from the settings product review:
- Nav is ordered as a narrative (Overview, My permissions, Connection,
  Prometheus, Argo CD, AI diagnose, Advanced) and AI diagnose is always shown.
- When no agent CLI is installed, the AI tab explains the feature and how to
  enable it instead of vanishing.
- Prometheus and MCP now state what they enable (metrics/graphs; AI-tool
  access), matching Argo's framing; the Argo URL field is labeled 'Server URL'
  instead of repeating the section title.

Include the raw Argo connection message (e.g. "authentication required",
"x509: certificate signed by unknown authority") in the issue's rawMessage so
the operator can see why the repo is unreachable — the same audience already
sees the repo URL and repo errors on the Application itself.

Reconciled the 3 conflicts:
- config.go: kept both new field sets (Argo CD URL/token/TLS + AI history/consent).
- AISettings.tsx: kept main's clear-history action (ClearHistoryRow +
  onHistoryCleared) inside this branch's card-less AI-diagnose tab layout.
- SettingsDialog.tsx: kept this branch's tabbed redesign; re-applied main's
  onHistoryCleared wiring and its autocorrect-off <Input> for the text fields.

Verified on the merged tree: go build + go test (pkg + internal), tsc
(web + k8s-ui), frontend build, native-title guard — all green.

An auto-discovery (empty-URL) token is bound to the kubeconfig context it was
configured under, but that binding (tokenContext) was only in memory — never
persisted. After a restart, seed left it empty, so Probe treated the token as a
context mismatch every time and it could never reconnect (while IsConfigured
still advertised deep-diff). Persist it as ArgoCDTokenContext and restore it on
seed; a same-context restart now reconnects, while a genuinely different context
still refuses (restoring it to the CURRENT context would have defeated that
cross-cluster guard). Preserved through the full-replacement PUT /config.

- Rename the footer's 'Reset' to 'Discard changes' and make it revert edits to
  the last-saved values instead of clearing every startup field to defaults —
  the button now does what it looks like it does, non-destructively.
- Drop the pre-save 'Restart Radar to apply' footer text (the section caption
  and the post-save toast already say it) and slide the footer in/out instead
  of hard-appearing.
- Explain 'Open browser on start' with a description line, and give the Browser
  field OS-aware examples (macOS app name vs. Linux/Windows command). Adds an
  optional description slot to ConfigToggle.

An 'argocd login' done over a port-forward records the server as 127.0.0.1:<port>,
which is only reachable while that forward runs — almost never when Radar reads the
config later. Offering it as a one-click just failed 'unreachable' on click, so
suppress loopback sessions from detection; the user connects via the URL field for
those. Real hostnames / in-cluster services (the stable case) are still offered.

The tree the detail page draws has the viewed resource as its root, and that
root was tagged as a GitOps portal node (tool badge, chevron, click-to-dive
ring). Clicking the resource you're already looking at navigated to a fresh
copy of the same page, stacking an identical breadcrumb segment each time.
The root is the subject, not a portal: drop its portal treatment, and no-op a
self-referential open so a page can never nest inside itself.

…ne on expand

The per-resource Argo diff was offered whenever the integration was merely
configured, behind a 'Full diff' button revealed only after expanding a row —
so a resource expanded to show a lone button that then dead-ended on a rejected
or under-scoped token, one integration problem rendered as N failing buttons.

- Gate the diff (and revision-metadata) capability on the app's managed-resources
  call — the diff's own data source — not IsConfigured() or the userinfo probe.
  A token that authenticates but 403s on managed-resources no longer advertises
  diffs; the app surfaces one 'check Argo CD in Settings' hint instead. The probe
  is 15s-cached and shared with the diff endpoint, so per-row diffs reuse it.
- Surface ArgoConfigured separately so the hint distinguishes 'not set up'
  (Connect) from 'set up but not serving' (check Settings).
- Render the diff inline on expand rather than behind a second click, with a
  subtle skeleton in place of the full-pane radar loader — the capability gate
  means it only mounts when the diff can be served.