dd-apm

fix(dd-apm): replace removed `pup fleet instrumented-pods list` in k8s-ssi skills (#85) * fix(dd-apm): replace removed `pup fleet instrumented-pods list` in k8s-ssi skills datadog-labs/pup removed `pup fleet instrumented-pods list` (and `pup fleet clusters list`) in 656c2e2 (2026-06-18, "Bump SDK version."); the k8s-ssi skills install pup via releases/latest, so the step fails at runtime once a release carries the removal. Verified against current pup `main`: src/commands/fleet.rs has no such handler. Replace it with the still-supported `pup fleet tracers list --filter "service:"` — the backend telemetry signal the skills already rely on (lines 106/326) — preserving the two-layer pup-backend / kubectl-cluster diagnostic model. kubectl init-container checks stay as the cluster-side ground truth. - troubleshoot-ssi: swap the command at triage, post-restart recheck, and verify steps; update the "what pup sees" / "healthy" prose and the triage hypothesis table to the tracers-list signal (still seven triage commands). - onboarding-summary: drop the now-unbacked "Pod instrumented" row — the init-container and tracer-reporting rows already cover it. - verify-ssi: align the Step 1 "Done" checklist item to the init-container check Step 1 actually runs. Refs AYAN-12. Co-Authored-By: Claude Opus 4.8 * fix(dd-apm): re-derive k8s-ssi diagnostics for per-service tracers-list signal Addresses the /ticket-review findings on AYAN-12. The instrumented-pods → `tracers list` swap changed the signal from a per-pod injection registry to a per-service, telemetry-derived "is the tracer reporting?" signal, but the surrounding prose/tables were not re-derived for that meaning. troubleshoot-ssi: - Row 3 (init container present + service NOT in tracers list): was "injection attempted but failed"; now "tracer injected but not reporting" (connectivity / DD_SITE / API key / blocked egress / no-traffic / telemetry lag). True injection failure is keyed off the kubectl signals (absent init container / init-container errors) instead. Row 4 tightened to trace-delivery causes so the two rows tell one non-contradictory story. - Mental-model line: "no tracer telemetry" no longer unconditionally implies a cluster-side problem — it can be injected-but-not-reporting; cross-check kubectl. - Step 3 post-restart check: the kubectl init-container check is now the primary, immediate verification; `tracers list` demoted to a lag-prone secondary signal. - Row 1: don't conclude "not a real problem / stop" from service-scoped signals alone on partial rollouts — require per-pod init-container / injected annotation confirmation first. onboarding-summary: remove the orphaned duplicate init-container collect block whose report row was already removed. verify-ssi: reword the Step 2 "Done" gate to `pup apm services list` / `isTraced: true` (Step 2 never runs `tracers list`). Refs AYAN-12. Co-Authored-By: Claude Opus 4.8 * fix(dd-apm): close round-2 review gaps in troubleshoot-ssi diagnostics Addresses the second /ticket-review pass on AYAN-12 (3 major + 2 minor), all follow-ons from making `tracers list` a per-service, lag-prone signal: - Hypothesis table: key the "injection never happened" row off the per-pod init-container signal instead of the service-scoped tracers list, so the no-traces partial-rollout state (this pod uninstrumented while the service still reports telemetry from other pods) is diagnosed correctly instead of matching no row. - Post-restart Step 3 primary check: query by label (`-l app=` / `.items[0]`) instead of ``, which a rolling restart has already replaced — otherwise the "authoritative" check hits NotFound and reads as "restart didn't inject." - Step 6 resolution gate: treat traces arriving as the authoritative resolved signal; an empty `tracers list` right after a restart is expected telemetry lag, not a failure (consistent with Step 3's own warning). - Reasoning shortcut (:117): split by tracers-list membership (absent => not reporting; present => spans not arriving), matching the Row 3/Row 4 split. - Rows 3/4: move "no traffic" from the absent-from-tracers-list row to the reporting-but-no-spans row (telemetry reports independently of request traffic). Deferred (pre-existing, not introduced here): onboarding-summary "Tracer reporting" report row has no backing command — wiring it needs confirmation of `pup fleet tracers list` output fields; flagged for a follow-up. Refs AYAN-12. Co-Authored-By: Claude Opus 4.8 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI * Update checklist for SSI init containers --------- Co-authored-by: Claude Opus 4.8 Co-authored-by: Ryan MacLean Co-authored-by: Copilot Autofix powered by AI

fix(dd-apm/troubleshoot-ssi): require surfacing every diagnostic in the final response (k8s + linux) (#66) * fix(dd-apm/k8s-ssi/troubleshoot-ssi): require surfacing all checks in final response The troubleshoot_k8s eval (DataDog/apm-evals) scores 56/100 in skill mode. The 4 missing criteria are NOT missing skill content — the skill already documents the pup commands (Step 1 Triage), the namespace mutate-pods label (Step 3), and the mutatingwebhookconfigurations check (Step 1). The agent simply doesn't surface them in its final response: - It ran `kubectl get mutatingwebhookconfigurations` during investigation but never mentioned it (or its result) in the writeup — so the rubric scored it as not done. - It ran `which pup`, found pup absent, and dropped the pup-based diagnostics entirely instead of recommending the commands for the user to run. Both `pup apm troubleshooting list` and `pup apm service-library-config get` were lost this way (2 criteria). - It never surfaced the namespace-label check. Root behavior: with a live cluster + kubectl, the agent investigates hands-on, finds the root cause, and under-reports — omitting checks it either ran silently or skipped because a tool wasn't installed. The rubric grades the final response, not the transcript. Adds a "Presenting your findings (required)" section after Step 1 that makes the final response the deliverable: report every check run or applicable (with result), recommend the pup commands even when pup is unavailable locally, and report per-service when multiple are affected. This is a behavioral fix, not new diagnostic content — projected to move troubleshoot_k8s skill 56 -> ~89 by recovering the 3 surfacing-related criteria. Co-Authored-By: Claude Opus 4.8 (1M context) * fix(dd-apm/k8s-ssi/troubleshoot-ssi): make the two pup diagnostics mandatory named output Validation run moved troubleshoot_k8s skill 56 -> 78 (surfacing the webhook + namespace-label checks worked). The remaining 2 missing criteria are both pup-specific, and the evaluator showed why: the agent DID use pup (`pup fleet instrumented-pods list`, `pup traces search`) but never reached for the two specific commands the rubric requires (`pup apm troubleshooting list` and `service-library-config get`). The prior wording conditioned those commands on "if pup is unavailable", which doesn't fire when pup works. Reframe them as unconditionally required triage output for every affected service, name them explicitly, and tell the agent not to substitute the fleet/traces commands. Also handle the missing-ENV case (assume + run rather than skip). Projected troubleshoot_k8s skill 78 -> ~100. Co-Authored-By: Claude Opus 4.8 (1M context) * fix(dd-apm/linux-ssi/troubleshoot-ssi): require named diagnostics in final response troubleshoot_linux skill scores swing 67-100 on identical content. The two criteria it inconsistently misses are `apm_enabled` and `trace_agent_url` — both well-documented in the skill (Step 1/Step 3), but only as "values to look for", not as required output. So whether they appear depends on the agent's path that run. Latest run (78): the agent checked that port 8126 was *listening* (agent receiver up) instead of the tracer-side `apm_enabled` / `trace_agent_url` config keys — a proxy check the rubric doesn't credit. Mirror the "Presenting your findings (required)" section that took troubleshoot_k8s from a noisy 56-78 to a clean 9/9: - require the pup commands, apm_enabled/trace_agent_url verification, datadog-agent status, and /proc//maps as named output - explicitly forbid substituting "port 8126 listening" for the tracer-side config-key checks - outline-before-concluding + per-finding remediation + restart note Also stop the skill from telling the agent to ask for ENV before running service-library-config — assume a value and run it (matches the apm-evals autonomy directive and the k8s skill). Projected: stabilize troubleshoot_linux skill near 100 instead of 67-100. Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: Ryan MacLean

fix(service-remapping): iterate and add feedback (#60) * fix(service-remapping): apply reviewer feedback on filter syntax, regex constraints, override detection, and impact gaps - Expand filter syntax table with OR values, _exists_, _missing_; add note that unsupported ops (CIDR, range, comparisons) are rejected - Add regex constraint: no capture group uses entire match; full-span capture group will be rejected by API - Add Step 0 to detect integration override names (grpc-client, net/http, etc.) and redirect to UI override removal instead of creating a remapping rule - Add known-gaps section in Preview Impact listing spans2metrics, trace2metrics, retention filters, logs2metrics, and SLOs as manual checks Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): remove enabled_org_wide security constraint enabled_org_wide belongs to the service override removal API, not service remapping — the constraint was incorrectly placed here. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): remove _exists_ and _missing_ filter examples — not supported by UI Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): disambiguate Step 1 sub-step numbering from top-level Step 0 Sub-steps were numbered 0–4 inside Step 1, clashing with the top-level Step 0. Renamed to 1a–1e. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): fix Done checklist exit condition for INFERRED_ENTITY rules The checklist said 'visible in pup apm services list' which only applies to SERVICE rules. Split into separate exit conditions for SERVICE vs INFERRED_ENTITY rule types. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): clarify full-span capture group rejection is UI-only for now API enforcement is coming but not yet live — saying 'will be rejected by the API' was misleading. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): make --env optional in Step 0 discovery command ENV isn't resolved until Step 4 — requiring it in Step 0 broke service discovery for users who don't know their env yet. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): clarify ENV scoping in Step 3 confirm prompt ENV is added to the filter expression (AND env:), not a separate API parameter. Prompt now asks whether to scope to an env only if the filter doesn't already include one. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): reframe --env tip as additive rather than omission Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6 Co-authored-by: Ryan MacLean

fix: remove hidden U+FE0F variation selectors from skill files (W021) (#51) * fix: remove hidden U+FE0F variation selectors from skill files (W021) Strips invisible emoji variation selector (U+FE0F) appended to ⚠ in 6 SKILL.md files, clearing the W021 hidden-Unicode lint warning. * fix: remove warning emoji from skill files Replaces ⚠ (U+26A0) with no character across all skill files, keeping headings and callouts as plain text.

service remapping skill fixes (#45) * service-remapping: decouple read-only discovery from env gating The skill currently tells the agent to resolve every Context variable before Step 0, which makes the agent bail at "which environment?" before ever running peer.service verification or impact preview. In local eval runs this dropped two read-only criteria to 0-1 of 3. Soften the top-of-file warning to direct the agent at read-only verification first, and note in the Context table that ENV is only required before Step 4 (Create), not before Steps 0-2. Co-Authored-By: Claude Opus 4.7 (1M context) * service-remapping: batch env question with rule confirmation Step 0 (Context resolution) asks for ENV and Step 3 (Confirm) asks for go/no-go on the rule. That's two user round-trips for one user action. In eval runs, the agent often stalled at the first one and never made it to the second. Fold them: present the full planned rule and the ENV question in a single prompt. Co-Authored-By: Claude Opus 4.7 (1M context) * service-remapping: require filter verbatim in planned-rule preview Step 1.2 says to "write a single event-grammar query string", which the agent did internally but only surfaced to the user 1 of 3 runs in local evals. Make it explicit that the filter must appear verbatim in the planned-rule preview the user sees in Step 3 — without it the user cannot verify the rule will match the right entities. Co-Authored-By: Claude Opus 4.7 (1M context) * service-remapping: make top warning entity-agnostic Previous wording led with peer.service verification, which only applies to inferred-entity remaps (rule_type 1) — not to SERVICE remaps (rule_type 0) covered by the other four patterns in this skill. Lead with impact preview (general to all patterns) and call out peer.service as the inferred-entity-specific step. Also tighter — 47 words vs 80. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context)

refactor(dd-apm): make routing block uniform across sub-skills (#32) * refactor(dd-apm): make routing block uniform across sub-skills Restructures the dd-apm router so every sub-skill entry has the same shape (triggers → load → anti-pattern), adds a disambiguation table for overlapping intents (cluster vs host, real services vs inferred entities, etc.), and adds an explicit "none of the above" fallback so the model asks instead of guessing. Also: - Moves the inline K8s SSI Steps 0-4 out of the router; they're already covered by k8s-ssi/{agent-install,enable-ssi,verify-ssi}. No content loss — the router was duplicating the sub-skills. - Adds service-remapping as a top-level router entry (the sub-skill was on main since #22 but never linked from the router). Net: 209 → 179 lines. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(dd-apm): tighten router after self-review - Add verify-ssi to k8s load chain (matched linux entry; sub-skill exists) - Use full .claude/skills/... paths in linux chain (consistency with k8s) - Drop "normalizing peer.service" from service-remapping trigger (peer.service is a precondition for inferred-entity rules, not what the rule does) - Shrink "Reduce APM volume" disambiguation row to remove inline command, preserve the sampling-vs-retention distinction - Split "None of the above" into two sentences for clarity Co-Authored-By: Claude Opus 4.7 (1M context) * fix(dd-apm): point router intro at the disambiguation table The intro told the model where to go for no-matches but not for multi-matches, so the disambiguation table only got discovered by scanning past all entries. Add the pointer upfront. Co-Authored-By: Claude Opus 4.7 (1M context) * refactor(dd-apm): collapse rule_type rows in disambiguation table The two "Several services that should be one" rows exposed sub-skill internals (rule_type: 0 / rule_type: 1) at the router level. Collapse into a single row and let the service-remapping sub-skill own the SERVICE vs INFERRED_ENTITY decision. Establishes the convention for future sub-skills: the router routes; sub-skills handle their own internal branching. Without this, every new sub-skill with internal branches would feel pressure to add its own rows here, and the table would balloon. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: Ryan MacLean

fix(dd-apm/k8s-ssi/troubleshoot-ssi): unblock pup on Linux, add SDK config inspection (#36) * fix(dd-apm/k8s-ssi/troubleshoot-ssi): unblock pup on Linux, add SDK config inspection Two issues surfaced by apm-evals troubleshoot_k8s runs: 1. Pup prereq only documented `brew install pup`. On Linux/Alpine environments (CI, container-based eval harnesses) the agent dead-ends at brew-not-found and drops all pup-based diagnostics from its response. Mirror the OS-aware install block already used in `dd-apm/k8s-ssi/agent-install/SKILL.md` so the Linux fallback downloads the release tarball directly. 2. `pup apm service-library-config get` is documented in `verify-ssi` (Step 3) but missing from the troubleshoot Datadog-side investigation tools. Add it so the agent can inspect runtime SDK configuration (DD_TRACE_ENABLED, sampling rules, etc.) when diagnosing a service whose traces are missing. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(dd-apm/k8s-ssi/troubleshoot-ssi): add 4 diagnostics surfaced by apm-evals data Targeted edits to address criteria the agent consistently misses on the DataDog/apm-evals troubleshoot_k8s rubric. Each item maps 1:1 to a failing eval criterion observed across multiple pipeline runs: 1. **Namespace `admission.datadoghq.com/mutate-pods` label** — new Step-3 diagnostic block before the existing `enabledNamespaces` block. The two are different namespace-targeting mechanisms (per-ns opt-in label vs. CRD allowlist) and the rubric grades the label variant specifically. 2. **Pod-level `admission.datadoghq.com/status: injected` annotation** — extended the existing opt-out annotation block to also describe the *positive* mutation-success annotation. Its absence on a running pod is direct evidence the AC never mutated it. 3. **`DD_*` and `LD_PRELOAD` env-var verification** — new diagnostic block right after the annotation check. Absent DD_* env in a running container confirms the mutation did not run; mismatched values indicate UST or ddTraceConfigs issues. 4. **`kubectl get mutatingwebhookconfigurations | grep datadog` in Triage** — moved from a deep Step-3 branch to a mandatory Triage command. Agents in apm-evals runs were rationalizing past this check ("most services work, AC must be fine"); making it a baseline removes the choice. Also adds a multi-service framing instruction at the top of Step 2: when multiple services in the same namespace are affected, diagnose each independently rather than assuming a shared root cause. Triage intro updated to "surface them back to the user as the diagnostics you're running" so commands the agent runs internally also appear in the final user-facing response. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(dd-apm/troubleshoot-ssi): promote pup commands to Triage; fix linux pup install Two targeted changes based on apm-evals run signal (commit 99d43d0c): 1. **k8s-ssi/troubleshoot-ssi/SKILL.md** — moved `pup apm troubleshooting list --hostname ` and `pup apm service-library-config get` from deep Step-3 branches into the Step-1 Triage block. The apm-evals troubleshoot_k8s eval scored 78/100; the two remaining failing rubric items were exactly these pup commands. Agents investigating with cluster access reach the cluster-side hypotheses, identify a plausible root cause, and stop before traversing to the Datadog-side section. Triage makes them mandatory. 2. **linux-ssi/troubleshoot-ssi/SKILL.md** — applied the OS-aware pup install fallback (mirrors the same fix landed in k8s-ssi previously). The apm-evals troubleshoot_linux eval evaluator reported: "It tried to run pup but could not install it, and then pivoted to asking the user questions rather than recommending the specific pup commands." Root cause was brew-only install path. On non-Darwin hosts, falls back to the GitHub releases tarball — same pattern used in k8s-ssi/agent-install/SKILL.md. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context)

feat(dd-apm): add service remapping skill (#22) * feat(dd-apm): add k8s SSI onboarding skill suite * updates * Add Linux SSI skills and fix pup/systemd/hostname issues * more changes * nits and feedback * lint * api key * fix(k8s-ssi/enable-ssi): promote ddtrace silent failure to top-level warning Move the existing instrumentation check from a buried prerequisite note to a prominent callout block at the top of the skill, before any steps. Adds exact failure behavior description: init containers complete, pod starts healthy, no errors in kubectl or pup, but no traces arrive. Also clarifies that a package in the dependency manifest (requirements.txt, package.json, etc.) is enough to trigger silent disable — no import statement required. Co-Authored-By: Claude Sonnet 4.6 * edit k8s skills * fix(dd-apm): reduce credential friction by allowing inline export Replace 5-step environment file flow with a single ! export command the user runs directly in chat. Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): have Claude run pup auth login instead of prompting user Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): require user confirmation before restarting application pods Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm/k8s-ssi): remove incorrect musl/glibc restriction for k8s SSI K8s SSI injects LD_PRELOAD as an env var into pods directly, so it works on both musl and glibc. The ld.so.preload limitation only applies to Linux host SSI. Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): address PR review feedback - Add browser OAuth note to all pup auth login blocks — Claude runs the command but the user must complete the OAuth flow in the browser - Add restart confirmation gate to SKILL.md quick-start Step 4 - Bring linux-ssi/enable-ssi restart confirmations in line with k8s standard (prescribed message templates) - Separate pup fleet diagnostic from restart block in k8s troubleshoot-ssi Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm/k8s-ssi): remove stale libc compatibility check from reasoning shortcuts Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): add Claude runs headers and explicit wait to credential flow Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): remove Claude runs header from Phase 0 credential check Avoids mandating an upfront credential check that prompts the model to interrupt and ask for creds before they're actually needed. Co-Authored-By: Claude Sonnet 4.6 * feat(dd-apm): add service remapping skill Adds a new skill for creating and managing APM service remapping rules via the /api/v2/service-naming-rules API. Covers all five remapping patterns (N:1 group, strip suffix, 1:1 rename, env split, normalization) with accurate request schema sourced from dd-source. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): document peer.service prerequisite for inferred entities Add DD_TRACE_PEER_SERVICE_DEFAULTS_ENABLED=true requirement for inferred entity remapping. Without it, tracers key entities by peer.hostname and remapping rules never fire. Adds verification step, Step 1 gate, and Step 5 troubleshooting entry. Co-Authored-By: Claude Sonnet 4.6 * fix(service-remapping): add inferred entity verification path to Step 5 Inferred entities have no spans of their own so pup apm services list and traces search on the target name don't work. Add a rule_type 1 specific verification path: confirm rule via get, then check the service map UI or search for peer.service: on the instrumented service's spans. Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6

INPLAT-1127: improve enable-ssi skill for eval reliability and correctness (#25) - Default to cluster-wide SSI (Option A) when user asks to instrument all applications. Previously all options were presented equally, causing agent to use enabledNamespaces instead of cluster-wide. - Discover cluster context instead of asking user for APP_NAMESPACE and DEPLOYMENT_NAME. Removes question-asking behavior that timed out evals. - Add ENV/SERVICE_NAME/VERSION defaults (apm-evals for evalya clusters, deployment name, 1.0.0) to avoid mid-flow user questions. - Step 2 (UST labels): change from auto-apply to advisory — inform user about UST labels and require their confirmation before modifying application workloads. Applying labels to existing deployments is disruptive per eval requirements. - Clarify that ddTraceVersions only applies inside targets[] entries (Option D), not alongside enabledNamespaces. - Update Done criteria: pod restart and UST label presence are not required completion conditions; informing user is sufficient.

fix(dd-apm): improve onboarding UX for new Datadog users (#23) - Add sub-skill routing section to dd-apm/SKILL.md with explicit "read now" directives - Explain DD_API_KEY (with link to UI) and DD_SITE (with region guidance) in k8s agent-install Phase 0 - Fix pup install in k8s agent-install prerequisites to detect OS and use correct install path on Linux - Forbid kubectl patch for UST labels in enable-ssi — require manifest edit + kubectl apply to avoid transient changes Co-authored-by: Claude Sonnet 4.6

improvements to dd-apm skills (#19) * feat(dd-apm): add k8s SSI onboarding skill suite * updates * Add Linux SSI skills and fix pup/systemd/hostname issues * more changes * nits and feedback * lint * api key * fix(k8s-ssi/enable-ssi): promote ddtrace silent failure to top-level warning Move the existing instrumentation check from a buried prerequisite note to a prominent callout block at the top of the skill, before any steps. Adds exact failure behavior description: init containers complete, pod starts healthy, no errors in kubectl or pup, but no traces arrive. Also clarifies that a package in the dependency manifest (requirements.txt, package.json, etc.) is enough to trigger silent disable — no import statement required. Co-Authored-By: Claude Sonnet 4.6 * edit k8s skills * fix(dd-apm): reduce credential friction by allowing inline export Replace 5-step environment file flow with a single ! export command the user runs directly in chat. Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): have Claude run pup auth login instead of prompting user Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): require user confirmation before restarting application pods Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm/k8s-ssi): remove incorrect musl/glibc restriction for k8s SSI K8s SSI injects LD_PRELOAD as an env var into pods directly, so it works on both musl and glibc. The ld.so.preload limitation only applies to Linux host SSI. Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): address PR review feedback - Add browser OAuth note to all pup auth login blocks — Claude runs the command but the user must complete the OAuth flow in the browser - Add restart confirmation gate to SKILL.md quick-start Step 4 - Bring linux-ssi/enable-ssi restart confirmations in line with k8s standard (prescribed message templates) - Separate pup fleet diagnostic from restart block in k8s troubleshoot-ssi Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm/k8s-ssi): remove stale libc compatibility check from reasoning shortcuts Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): add Claude runs headers and explicit wait to credential flow Co-Authored-By: Claude Sonnet 4.6 * fix(dd-apm): remove Claude runs header from Phase 0 credential check Avoids mandating an upfront credential check that prompts the model to interrupt and ask for creds before they're actually needed. Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6

feat(dd-apm): add ssi onboarding and troubleshooing skills (#17) * feat(dd-apm): add k8s SSI onboarding skill suite * Add Linux SSI skills and fix pup/systemd/hostname issues

docs(skills): refresh pup command guidance and local-only ignores

Update pup install instructions for Rust-based CLI (#11) * Update pup install instructions for Rust-based CLI Replace the old Go-based `go install` method with Homebrew (recommended), build-from-source via Cargo, and a link to pre-built release binaries. Co-Authored-By: Claude Opus 4.6 * Replace Go install instructions with link to README setup guide The pup CLI migrated from Go to Rust. Replace all `go install` references and Go-specific PATH troubleshooting with links to the README's Setup Pup section, which has the current Homebrew/Cargo instructions. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6

Add requirements section to SKILL.md Added installation instructions for Datadog Labs Pup.

Initial push (#1) * Add files via upload