<memvid-mind-context>
# 🧠 Claude Mind Ready

📁 Project: **eks-cluster-applications**
💾 Memory will be created at: `.claude/mind.mv2`

_Your observations will be automatically captured._
</memvid-mind-context>


<EXTREMELY_IMPORTANT>
You have superpowers.

**Below is the full content of your 'superpowers:using-superpowers' skill - your introduction to using skills. For all other skills, use the 'Skill' tool:**

---
name: using-superpowers
description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
---

<SUBAGENT-STOP>
If you were dispatched as a subagent to execute a specific task, skip this skill.
</SUBAGENT-STOP>

<EXTREMELY-IMPORTANT>
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.

IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.

This is not negotiable. This is not optional. You cannot rationalize your way out of this.
</EXTREMELY-IMPORTANT>

## Instruction Priority

Superpowers skills override default system prompt behavior, but **user instructions always take precedence**:

1. **User's explicit instructions** (CLAUDE.md, GEMINI.md, AGENTS.md, direct requests) — highest priority
2. **Superpowers skills** — override default system behavior where they conflict
3. **Default system prompt** — lowest priority

If CLAUDE.md, GEMINI.md, or AGENTS.md says "don't use TDD" and a skill says "always use TDD," follow the user's instructions. The user is in control.

## How to Access Skills

**In Claude Code:** Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you—follow it directly. Never use the Read tool on skill files.

**In Copilot CLI:** Use the `skill` tool. Skills are auto-discovered from installed plugins. The `skill` tool works the same as Claude Code's `Skill` tool.

**In Gemini CLI:** Skills activate via the `activate_skill` tool. Gemini loads skill metadata at session start and activates the full content on demand.

**In other environments:** Check your platform's documentation for how skills are loaded.

## Platform Adaptation

Skills use Claude Code tool names. Non-CC platforms: see `references/copilot-tools.md` (Copilot CLI), `references/codex-tools.md` (Codex) for tool equivalents. Gemini CLI users get the tool mapping loaded automatically via GEMINI.md.

# Using Skills

## The Rule

**Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it.

```dot
digraph skill_flow {
    "User message received" [shape=doublecircle];
    "About to EnterPlanMode?" [shape=doublecircle];
    "Already brainstormed?" [shape=diamond];
    "Invoke brainstorming skill" [shape=box];
    "Might any skill apply?" [shape=diamond];
    "Invoke Skill tool" [shape=box];
    "Announce: 'Using [skill] to [purpose]'" [shape=box];
    "Has checklist?" [shape=diamond];
    "Create TodoWrite todo per item" [shape=box];
    "Follow skill exactly" [shape=box];
    "Respond (including clarifications)" [shape=doublecircle];

    "About to EnterPlanMode?" -> "Already brainstormed?";
    "Already brainstormed?" -> "Invoke brainstorming skill" [label="no"];
    "Already brainstormed?" -> "Might any skill apply?" [label="yes"];
    "Invoke brainstorming skill" -> "Might any skill apply?";

    "User message received" -> "Might any skill apply?";
    "Might any skill apply?" -> "Invoke Skill tool" [label="yes, even 1%"];
    "Might any skill apply?" -> "Respond (including clarifications)" [label="definitely not"];
    "Invoke Skill tool" -> "Announce: 'Using [skill] to [purpose]'";
    "Announce: 'Using [skill] to [purpose]'" -> "Has checklist?";
    "Has checklist?" -> "Create TodoWrite todo per item" [label="yes"];
    "Has checklist?" -> "Follow skill exactly" [label="no"];
    "Create TodoWrite todo per item" -> "Follow skill exactly";
}
```

## Red Flags

These thoughts mean STOP—you're rationalizing:

| Thought | Reality |
|---------|---------|
| "This is just a simple question" | Questions are tasks. Check for skills. |
| "I need more context first" | Skill check comes BEFORE clarifying questions. |
| "Let me explore the codebase first" | Skills tell you HOW to explore. Check first. |
| "I can check git/files quickly" | Files lack conversation context. Check for skills. |
| "Let me gather information first" | Skills tell you HOW to gather information. |
| "This doesn't need a formal skill" | If a skill exists, use it. |
| "I remember this skill" | Skills evolve. Read current version. |
| "This doesn't count as a task" | Action = task. Check for skills. |
| "The skill is overkill" | Simple things become complex. Use it. |
| "I'll just do this one thing first" | Check BEFORE doing anything. |
| "This feels productive" | Undisciplined action wastes time. Skills prevent this. |
| "I know what that means" | Knowing the concept ≠ using the skill. Invoke it. |

## Skill Priority

When multiple skills could apply, use this order:

1. **Process skills first** (brainstorming, debugging) - these determine HOW to approach the task
2. **Implementation skills second** (frontend-design, mcp-builder) - these guide execution

"Let's build X" → brainstorming first, then implementation skills.
"Fix this bug" → debugging first, then domain-specific skills.

## Skill Types

**Rigid** (TDD, debugging): Follow exactly. Don't adapt away discipline.

**Flexible** (patterns): Adapt principles to context.

The skill itself tells you which.

## User Instructions

Instructions say WHAT, not HOW. "Add X" or "Fix Y" doesn't mean skip workflows.

</EXTREMELY_IMPORTANT>


<memvid-mind-context>
# 🧠 Claude Mind Ready

📁 Project: **eks-cluster-applications**
💾 Memory will be created at: `.claude/mind.mv2`

_Your observations will be automatically captured._
</memvid-mind-context>

<EXTREMELY_IMPORTANT>
You have superpowers.

**Below is the full content of your 'superpowers:using-superpowers' skill - your introduction to using skills. For all other skills, use the 'Skill' tool:**

---
name: using-superpowers
description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
---

<SUBAGENT-STOP>
If you were dispatched as a subagent to execute a specific task, skip this skill.
</SUBAGENT-STOP>

<EXTREMELY-IMPORTANT>
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.

IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.

This is not negotiable. This is not optional. You cannot rationalize your way out of this.
</EXTREMELY-IMPORTANT>

## Instruction Priority

Superpowers skills override default system prompt behavior, but **user instructions always take precedence**:

1. **User's explicit instructions** (CLAUDE.md, GEMINI.md, AGENTS.md, direct requests) — highest priority
2. **Superpowers skills** — override default system behavior where they conflict
3. **Default system prompt** — lowest priority

If CLAUDE.md, GEMINI.md, or AGENTS.md says "don't use TDD" and a skill says "always use TDD," follow the user's instructions. The user is in control.

## How to Access Skills

**In Claude Code:** Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you—follow it directly. Never use the Read tool on skill files.

**In Copilot CLI:** Use the `skill` tool. Skills are auto-discovered from installed plugins. The `skill` tool works the same as Claude Code's `Skill` tool.

**In Gemini CLI:** Skills activate via the `activate_skill` tool. Gemini loads skill metadata at session start and activates the full content on demand.

**In other environments:** Check your platform's documentation for how skills are loaded.

## Platform Adaptation

Skills use Claude Code tool names. Non-CC platforms: see `references/copilot-tools.md` (Copilot CLI), `references/codex-tools.md` (Codex) for tool equivalents. Gemini CLI users get the tool mapping loaded automatically via GEMINI.md.

# Using Skills

## The Rule

**Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it.

```dot
digraph skill_flow {
    "User message received" [shape=doublecircle];
    "About to EnterPlanMode?" [shape=doublecircle];
    "Already brainstormed?" [shape=diamond];
    "Invoke brainstorming skill" [shape=box];
    "Might any skill apply?" [shape=diamond];
    "Invoke Skill tool" [shape=box];
    "Announce: 'Using [skill] to [purpose]'" [shape=box];
    "Has checklist?" [shape=diamond];
    "Create TodoWrite todo per item" [shape=box];
    "Follow skill exactly" [shape=box];
    "Respond (including clarifications)" [shape=doublecircle];

    "About to EnterPlanMode?" -> "Already brainstormed?";
    "Already brainstormed?" -> "Invoke brainstorming skill" [label="no"];
    "Already brainstormed?" -> "Might any skill apply?" [label="yes"];
    "Invoke brainstorming skill" -> "Might any skill apply?";

    "User message received" -> "Might any skill apply?";
    "Might any skill apply?" -> "Invoke Skill tool" [label="yes, even 1%"];
    "Might any skill apply?" -> "Respond (including clarifications)" [label="definitely not"];
    "Invoke Skill tool" -> "Announce: 'Using [skill] to [purpose]'";
    "Announce: 'Using [skill] to [purpose]'" -> "Has checklist?";
    "Has checklist?" -> "Create TodoWrite todo per item" [label="yes"];
    "Has checklist?" -> "Follow skill exactly" [label="no"];
    "Create TodoWrite todo per item" -> "Follow skill exactly";
}
```

## Red Flags

These thoughts mean STOP—you're rationalizing:

| Thought | Reality |
|---------|---------|
| "This is just a simple question" | Questions are tasks. Check for skills. |
| "I need more context first" | Skill check comes BEFORE clarifying questions. |
| "Let me explore the codebase first" | Skills tell you HOW to explore. Check first. |
| "I can check git/files quickly" | Files lack conversation context. Check for skills. |
| "Let me gather information first" | Skills tell you HOW to gather information. |
| "This doesn't need a formal skill" | If a skill exists, use it. |
| "I remember this skill" | Skills evolve. Read current version. |
| "This doesn't count as a task" | Action = task. Check for skills. |
| "The skill is overkill" | Simple things become complex. Use it. |
| "I'll just do this one thing first" | Check BEFORE doing anything. |
| "This feels productive" | Undisciplined action wastes time. Skills prevent this. |
| "I know what that means" | Knowing the concept ≠ using the skill. Invoke it. |

## Skill Priority

When multiple skills could apply, use this order:

1. **Process skills first** (brainstorming, debugging) - these determine HOW to approach the task
2. **Implementation skills second** (frontend-design, mcp-builder) - these guide execution

"Let's build X" → brainstorming first, then implementation skills.
"Fix this bug" → debugging first, then domain-specific skills.

## Skill Types

**Rigid** (TDD, debugging): Follow exactly. Don't adapt away discipline.

**Flexible** (patterns): Adapt principles to context.

The skill itself tells you which.

## User Instructions

Instructions say WHAT, not HOW. "Add X" or "Fix Y" doesn't mean skip workflows.

</EXTREMELY_IMPORTANT>


@datadog_agent.tf @vector.tf bugbot gave the following find, can you help? Vector module index access crashes when vector disabled

High Severity

When var.vector_dd_agent_logs_enabled is explicitly set to true while vector is disabled, module.vector[0].service_endpoint_dd_agent will cause an index-out-of-range error because module.vector has count = 0. The guard condition local.vector_dd_agent_logs_enabled does not guarantee module.vector has any instances. The rest of the codebase uses length(module.X) > 0 guards (e.g., cilium.tf) to safely access counted module outputs.


# ---------------------------------------------------------------------------------------------------------------------
# METRICS SERVER
# ---------------------------------------------------------------------------------------------------------------------
locals {
  datadog_agent_enabled = (
    var.datadog_agent_enabled != null
    ? var.datadog_agent_enabled
    : lookup(var.datadog_agent_enabled_cluster_types, local.cluster_type, true)
  )

  vector_dd_agent_logs_enabled = (
    var.vector_dd_agent_logs_enabled != null
    ? var.vector_dd_agent_logs_enabled
    : local.vector_enabled
  )
}

# Datadog Agent
module "datadog_agent" {
  source  = "crow.infrastructure.immuta.io/internal/monitoring-datadog-agent/kubernetes"
  version = "1.1.2"
  count  = local.datadog_agent_enabled ? 1 : 0

  providers = {
    kubernetes = kubernetes.local-cluster
    helm       = helm.local-cluster
  }

  chart_version                  = var.datadog_agent_version
  image_tag                      = var.datadog_agent_image_tag
  create_namespace               = var.datadog_create_namespace
  cluster_name                   = var.cluster_name
  global_segment                 = var.global_segment
  datadog_tags                   = var.datadog_tags
  enable_nowrds_monitoring       = var.datadog_enable_nowrds_monitoring
  enable_now_obfusicator_options = var.datadog_enable_now_obfusicator_options
  enable_mrds_monitoring         = var.datadog_enable_mrds_monitoring
  now_obfusicator_options        = var.datadog_now_obfusicator_options

  logs_intake_url                = local.vector_dd_agent_logs_enabled ? module.vector[0].service_endpoint_dd_agent : null

  tags                           = var.tags
  env                            = var.env
}

# ---------------------------------------------------------------------------------------------------------------------
# REQUIRED PARAMETERS
# These variables must be set.
# ---------------------------------------------------------------------------------------------------------------------
variable "datadog_agent_version" {
  description = "Version of otel-collector helm chart"
  type        = string
  default     = ""
  validation {
    condition     = var.datadog_agent_version == "" && local.datadog_agent_enabled ? false : true
    error_message = "datadog_agent_version must be set when datadog_agent is enabled"
  }
}

variable "datadog_agent_image_tag" {
  description = "Version of otel-collector image tag"
  type        = string
  default     = ""
  validation {
    condition     = var.datadog_agent_image_tag == "" && local.datadog_agent_enabled ? false : true
    error_message = "datadog_agent_image_tag must be set when datadog_agent is enabled"
  }
}

# ---------------------------------------------------------------------------------------------------------------------
# OPTIONAL PARAMETERS
# These variables are configurable, but have reasonable defaults set.
# ---------------------------------------------------------------------------------------------------------------------
variable "datadog_agent_enabled_cluster_types" {
  description = "Types of clusters datadog_agent should be enabled on by default"
  type        = map(string)
  default = {
    "mgmt"  = true
    "cps"   = true
    "saas"  = true
    "infra" = false
    "dev"   = false
  }
}

variable "datadog_tags" {
  description = "Map of tags to apply to datadog metrics"
  type        = list(string)
  default     = []
}

variable "datadog_enable_nowrds_monitoring" {
  description = "Enable monitoring for NOWRDS."
  type        = bool
  default     = false
}

variable "datadog_enable_mrds_monitoring" {
  description = "Enable multitenant RDS monitoring"
  type        = bool
  default     = false
}

variable "datadog_enable_now_obfusicator_options" {
  description = "Whether to enable the NOWRDS obfuscator options in the Datadog agent configuration."
  type        = bool
  default     = false
}

variable "datadog_now_obfusicator_options" {
  description = "A map of options to configure the NOWRDS obfuscator in the Datadog agent configuration."
  type        = map(string)
  default = {
    replace_digits = "true"
  }
}

variable "datadog_create_namespace" {
  type    = bool
  default = false
}

variable "datadog_agent_enabled" {
  description = "Override for explicitly enabling or disabling otel-collector"
  type        = bool
  default     = null
}

variable "vector_dd_agent_logs_enabled" {
  description = "Override for routing DD Agent logs through Vector. When null (default), inherits from local.vector_enabled (i.e., on wherever Vector is on). Set to false to keep DD Agent shipping logs directly to DD SaaS even when Vector is deployed."
  type        = bool
  default     = null
}


# ---------------------------------------------------------------------------------------------------------------------
# VECTOR
# ---------------------------------------------------------------------------------------------------------------------
locals {
  vector_enabled = (
    var.vector_enabled != null
    ? var.vector_enabled
    : lookup(var.vector_enabled_cluster_types, local.cluster_type, true)
  )
}

module "vector" {
  source = "crow.infrastructure.immuta.io/internal/monitoring-vector/kubernetes"
  version = "1.1.0"

  count  = local.vector_enabled ? 1 : 0

  providers = {
    kubernetes = kubernetes.local-cluster
    helm       = helm.local-cluster
  }

  chart_version               = var.vector_chart_version
  image                       = var.vector_image
  image_tag_version           = var.vector_image_tag
  replicas                    = var.vector_replicas
  datadog_site                = var.vector_datadog_site
  datadog_api_key_vault_path  = var.vector_datadog_api_key_vault_path
  audit_drop_patterns         = var.vector_audit_drop_patterns
  email_redaction_enabled     = var.vector_email_redaction_enabled
  email_redaction_replacement = var.vector_email_redaction_replacement
  email_redaction_dry_run     = var.vector_email_redaction_dry_run
  additional_config           = var.vector_additional_config

  # NOTE: The external-secrets internal-module (v1.2.0) has an empty outputs.tf
  # and does not expose cluster_secret_store_name. Until that output is added
  # to the external-secrets module, the ClusterSecretStore name is passed
  # explicitly via var.vector_external_secrets_cluster_store_name.
  # TODO: replace with module.external_secrets[0].cluster_secret_store_name
  # once the external-secrets internal-module exposes that output.
  external_secrets_cluster_store_name = var.vector_external_secrets_cluster_store_name

  depends_on = [
    module.cilium,
    module.external_secrets,
  ]
}

data "external" "vector_validate" {
  count = local.vector_enabled && !local.external_secrets_enabled ? 1 : 0

  program = ["Error: vector can only be set if external-secrets is enabled as well"]
}

# ---------------------------------------------------------------------------------------------------------------------
# REQUIRED PARAMETERS
# These variables must be set.
# ---------------------------------------------------------------------------------------------------------------------
variable "vector_chart_version" {
  description = "Version of vector helm chart"
  type        = string
  default     = ""
  validation {
    condition     = var.vector_chart_version == "" && local.vector_enabled ? false : true
    error_message = "vector_chart_version must be set when vector is enabled"
  }
}

variable "vector_image_tag" {
  description = "Vector image tag"
  type        = string
  default     = ""
  validation {
    condition     = var.vector_image_tag == "" && local.vector_enabled ? false : true
    error_message = "vector_image_tag must be set when vector is enabled"
  }
}

variable "vector_datadog_site" {
  description = "Datadog site for vector sinks (e.g. datadoghq.com)"
  type        = string
  default     = "datadoghq.com"
  validation {
    condition     = var.vector_datadog_site == "" && local.vector_enabled ? false : true
    error_message = "vector_datadog_site must be set when vector is enabled"
  }
}

variable "vector_datadog_api_key_vault_path" {
  description = "Vault path for the Datadog API key (consumed by ExternalSecret in vector ns)"
  type        = string
  default     = "secret/data/saas/infrastructure/datadog-api-key"
  validation {
    condition     = var.vector_datadog_api_key_vault_path == "" && local.vector_enabled ? false : true
    error_message = "vector_datadog_api_key_vault_path must be set when vector is enabled"
  }
}

variable "vector_external_secrets_cluster_store_name" {
  description = "Name of the ClusterSecretStore to use for vector ExternalSecret resources. Pass the name created by the external-secrets module (typically 'vault-cluster-store'). Required when vector is enabled."
  type        = string
  default     = "vault"
  validation {
    condition     = var.vector_external_secrets_cluster_store_name == "" && local.vector_enabled ? false : true
    error_message = "vector_external_secrets_cluster_store_name must be set when vector is enabled"
  }
}

# ---------------------------------------------------------------------------------------------------------------------
# OPTIONAL PARAMETERS
# These variables are configurable, but have reasonable defaults set.
# ---------------------------------------------------------------------------------------------------------------------
variable "vector_enabled_cluster_types" {
  description = "Types of clusters Vector should be enabled on by default"
  type        = map(string)
  default = {
    "mgmt"  = true
    "cps"   = true
    "saas"  = true
    "infra" = false
    "dev"   = false
  }
}

variable "vector_enabled" {
  description = "Override for explicitly enabling or disabling Vector"
  type        = bool
  default     = null
}

variable "vector_image" {
  description = "Image for Vector"
  type        = string
  default     = "registry.ic-ops.net/cache-docker-hub/timberio/vector"
}

variable "vector_replicas" {
  description = "Number of Vector aggregator replicas"
  type        = number
  default     = 3
}

variable "vector_audit_drop_patterns" {
  description = "Regex patterns; matching log message bodies are dropped"
  type        = list(string)
  default = [
    "Audit\\s-\\s.+",
    "\"level\":\"audit\"",
  ]
}

variable "vector_email_redaction_enabled" {
  description = "Toggle the email-redact VRL transform across all signals"
  type        = bool
  default     = true
}

variable "vector_email_redaction_replacement" {
  description = "String that replaces matched email addresses"
  type        = string
  default     = "[REDACTED-EMAIL]"
}

variable "vector_email_redaction_dry_run" {
  description = "String to enable dry run on email redaction"
  type = bool
  default = false
}

variable "vector_additional_config" {
  description = "Alternate helm chart customConfig (overwrites entire helm config)"
  type        = any
  default     = null
}


## claude.ai Context7
Use this server to fetch current documentation whenever the user asks about a library, framework, SDK, API, CLI tool, or cloud service -- even well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. This includes API syntax, configuration, version migration, library-specific debugging, setup instructions, and CLI tool usage. Use even when you think you know the answer -- your training data may not reflect recent changes. Prefer this over web search for library docs.

Do not use for: refactoring, writing scripts from scratch, debugging business logic, code review, or general programming concepts.


- migrate-flux-app: Use when migrating a Flux CD application from the infrastructure/kubernetes/application-deployments repo to the application-deployment repo. Covers copying app folders, updating kustomizations, committing, pushing, and creating merge requests.
- app-infra-generate: Generate an application-infrastructure Terraform module from a YAML spec produced by app-infra-spec. Reads pattern files and a versions manifest to produce main.tf, variables.tf, outputs.tf, overlay guidance, and a triage list.
- app-infra-spec: Structured questionnaire to gather requirements for an application-infrastructure Terraform module. Produces a YAML spec for the app-infra-generate skill.
- obsidian-load: Load context from Obsidian notes in the `Claude/` directory into the current conversation.
- obsidian-save: Save current conversation context to an Obsidian note under the `Claude/` directory.
- mind:stats: Show memory statistics and storage information
- mind:search: Search memories for specific content or patterns
- mind:ask: Ask questions about memories and get context-aware answers
- mind:recent: Show recent memories and activity timeline
- superpowers:using-git-worktrees: Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
- superpowers:finishing-a-development-branch: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
- superpowers:test-driven-development: Use when implementing any feature or bugfix, before writing implementation code
- superpowers:verification-before-completion: Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
- superpowers:requesting-code-review: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
- superpowers:writing-plans: Use when you have a spec or requirements for a multi-step task, before touching code
- superpowers:systematic-debugging: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- superpowers:writing-skills: Use when creating new skills, editing existing skills, or verifying skills work before deployment
- superpowers:subagent-driven-development: Use when executing implementation plans with independent tasks in the current session
- superpowers:brainstorming: You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
- superpowers:using-superpowers: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
- superpowers:receiving-code-review: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
- superpowers:dispatching-parallel-agents: Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
- superpowers:executing-plans: Use when you have a written implementation plan to execute in a separate session with review checkpoints
- mind:mind: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- mind:memory: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, suggest the /config command.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- fewer-permission-prompts: Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo). Omit the interval to let the model self-pace. - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (routines) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/routines. Also use when the user wants a one-time scheduled run ("run this once at 3pm", "remind me to check X tomorrow").
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements).
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- init: Initialize a new CLAUDE.md file with codebase documentation
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch


@datadog_agent.tf @vector.tf bugbot gave the following find, can you help? Vector module index access crashes when vector disabled  High Severity  When var.vector_dd_agent_logs_enabled is explicitly s…


Fix vector module index access crash when disabled


Looking at the bug: `local.vector_dd_agent_logs_enabled` can be `true` even when `local.vector_enabled` is `false` (e.g., explicit `var.vector_dd_agent_logs_enabled = true` with vector disabled), but `module.vector` has `count = 0` in that case, making `module.vector[0]` crash.


Edit

logs_intake_url                = local.vector_dd_agent_logs_enabled ? module.vector[0].service_endpoint_dd_agent : null

logs_intake_url                = local.vector_dd_agent_logs_enabled && length(module.vector) > 0 ? module.vector[0].service_endpoint_dd_agent : null


The file /Users/steve.briggs/projects/operations/terraform/iac-library/aws/compute/eks-cluster-applications/datadog_agent.tf has been updated successfully. (file state is current in your context — no need to Read it back)

# ---------------------------------------------------------------------------------------------------------------------
# METRICS SERVER
# ---------------------------------------------------------------------------------------------------------------------
locals {
  datadog_agent_enabled = (
    var.datadog_agent_enabled != null
    ? var.datadog_agent_enabled
    : lookup(var.datadog_agent_enabled_cluster_types, local.cluster_type, true)
  )

  vector_dd_agent_logs_enabled = (
    var.vector_dd_agent_logs_enabled != null
    ? var.vector_dd_agent_logs_enabled
    : local.vector_enabled
  )
}

# Datadog Agent
module "datadog_agent" {
  source  = "crow.infrastructure.immuta.io/internal/monitoring-datadog-agent/kubernetes"
  version = "1.1.2"
  count  = local.datadog_agent_enabled ? 1 : 0

  providers = {
    kubernetes = kubernetes.local-cluster
    helm       = helm.local-cluster
  }

  chart_version                  = var.datadog_agent_version
  image_tag                      = var.datadog_agent_image_tag
  create_namespace               = var.datadog_create_namespace
  cluster_name                   = var.cluster_name
  global_segment                 = var.global_segment
  datadog_tags                   = var.datadog_tags
  enable_nowrds_monitoring       = var.datadog_enable_nowrds_monitoring
  enable_now_obfusicator_options = var.datadog_enable_now_obfusicator_options
  enable_mrds_monitoring         = var.datadog_enable_mrds_monitoring
  now_obfusicator_options        = var.datadog_now_obfusicator_options

  logs_intake_url                = local.vector_dd_agent_logs_enabled ? module.vector[0].service_endpoint_dd_agent : null

  tags                           = var.tags
  env                            = var.env
}

# ---------------------------------------------------------------------------------------------------------------------
# REQUIRED PARAMETERS
# These variables must be set.
# ---------------------------------------------------------------------------------------------------------------------
variable "datadog_agent_version" {
  description = "Version of otel-collector helm chart"
  type        = string
  default     = ""
  validation {
    condition     = var.datadog_agent_version == "" && local.datadog_agent_enabled ? false : true
    error_message = "datadog_agent_version must be set when datadog_agent is enabled"
  }
}

variable "datadog_agent_image_tag" {
  description = "Version of otel-collector image tag"
  type        = string
  default     = ""
  validation {
    condition     = var.datadog_agent_image_tag == "" && local.datadog_agent_enabled ? false : true
    error_message = "datadog_agent_image_tag must be set when datadog_agent is enabled"
  }
}

# ---------------------------------------------------------------------------------------------------------------------
# OPTIONAL PARAMETERS
# These variables are configurable, but have reasonable defaults set.
# ---------------------------------------------------------------------------------------------------------------------
variable "datadog_agent_enabled_cluster_types" {
  description = "Types of clusters datadog_agent should be enabled on by default"
  type        = map(string)
  default = {
    "mgmt"  = true
    "cps"   = true
    "saas"  = true
    "infra" = false
    "dev"   = false
  }
}

variable "datadog_tags" {
  description = "Map of tags to apply to datadog metrics"
  type        = list(string)
  default     = []
}

variable "datadog_enable_nowrds_monitoring" {
  description = "Enable monitoring for NOWRDS."
  type        = bool
  default     = false
}

variable "datadog_enable_mrds_monitoring" {
  description = "Enable multitenant RDS monitoring"
  type        = bool
  default     = false
}

variable "datadog_enable_now_obfusicator_options" {
  description = "Whether to enable the NOWRDS obfuscator options in the Datadog agent configuration."
  type        = bool
  default     = false
}

variable "datadog_now_obfusicator_options" {
  description = "A map of options to configure the NOWRDS obfuscator in the Datadog agent configuration."
  type        = map(string)
  default = {
    replace_digits = "true"
  }
}

variable "datadog_create_namespace" {
  type    = bool
  default = false
}

variable "datadog_agent_enabled" {
  description = "Override for explicitly enabling or disabling otel-collector"
  type        = bool
  default     = null
}

variable "vector_dd_agent_logs_enabled" {
  description = "Override for routing DD Agent logs through Vector. When null (default), inherits from local.vector_enabled (i.e., on wherever Vector is on). Set to false to keep DD Agent shipping logs directly to DD SaaS even when Vector is deployed."
  type        = bool
  default     = null
}

-  logs_intake_url                = local.vector_dd_agent_logs_enabled ? module.vector[0].service_endpoint_dd_agent : null

+  logs_intake_url                = local.vector_dd_agent_logs_enabled && length(module.vector) > 0 ? module.vector[0].service_endpoint_dd_agent : null

tags                           = var.tags

env                            = var.env


Added `length(module.vector) > 0` guard to line 40, consistent with the pattern used elsewhere in the codebase. Now even if someone explicitly sets `var.vector_dd_agent_logs_enabled = true` with vector disabled, it safely falls back to `null` instead of crashing.


afplay ~/.claude/sounds/mario/stop/stomp.wav 2>/dev/null || true


<local-command-caveat>Caveat: The messages below were generated by the user while running local commands. DO NOT respond to these messages or otherwise consider them in your response unless the user explicitly asks you to.</local-command-caveat>


<command-name>/exit</command-name>
            <command-message>exit</command-message>
            <command-args></command-args>


<local-command-stdout>Catch you later!</local-command-stdout>