Merge remote-tracking branch 'origin/main' into dd/fix/logs-auto-flex-fallback-20260813

Co-authored-by: platinummonkey <cody.lee@datadoghq.com>

# Conflicts:
#	src/commands/logs.rs
#	src/test_commands.rs

Author: datadog-bits

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "pup"
-version = "1.10.7"
+version = "1.10.8"
 edition = "2021"
 rust-version = "1.93.1"
 publish = false

Cargo.toml

@@ -24,7 +24,7 @@ pup <domain> <subgroup> <action> [options] # Nested commands
 | acp | serve | src/commands/acp.rs | ✅ |
 | auth | login, logout, status, refresh | src/commands/auth.rs | ✅ |
 | metrics | query, list, search, timeseries, metadata, tags, submit | src/commands/metrics.rs | ✅ |
-| logs | search, list, aggregate, saved-views (list, get, create, delete) | src/commands/logs.rs | ✅ |
+| logs | search, list, aggregate, patterns, saved-views (list, get, create, delete) | src/commands/logs.rs | ✅ |
 | traces | metrics (list, get, create, update, delete) | src/commands/traces.rs | ✅ |
 | monitors | list, get, create, update, delete, search, diff | src/commands/monitors.rs | ✅ |
 | dashboards | list, get, delete, url, annotations (list, get-page, create, update, delete) | src/commands/dashboards.rs, src/commands/annotations.rs | ✅ |
@@ -66,7 +66,7 @@ pup <domain> <subgroup> <action> [options] # Nested commands
 | data-deletion | requests (list, create, cancel) | src/commands/data_deletion.rs | ✅ |
 | data-governance | scanner-rules (list) | src/commands/data_governance.rs | ✅ |
 | obs-pipelines | list, get, create, update, delete, validate | src/commands/obs_pipelines.rs | ✅ |
-| llm-obs | projects (create, list), experiments (create, list, update, delete, summary, events (list, get, submit), metric-values, dimension-values), datasets (create, list, batch-update, clone, restore, records, records-add, records-all, records-full), spans (search), patterns (configs (list, get), runs (list, status), topics, topics-with-points, points), agent-insights (list, get, update-status, submit-feedback), model-pricing | src/commands/llm_obs.rs | ✅ |
+| llm-obs | projects (create, list), experiments (create, list, update, delete, summary, events (list, get, submit), metric-values, dimension-values), datasets (create, list, batch-update, clone, restore, records, records-add, records-all, records-full), spans (search), patterns (configs (list, get), runs (list, status), topics, topics-with-points, points), agent-insights (list, get, update-status, submit-feedback), annotation-queues (create, list, update, delete, interactions (add, delete, list), schema (get, update), annotations (upsert, delete)), model-pricing | src/commands/llm_obs.rs | ✅ |
 | reference-tables | list, get, create, batch-query | src/commands/reference_tables.rs | ✅ |
 | network | flows list, devices (list, get, interfaces, tags), interfaces (list, update) | src/commands/network.rs | ✅ |
 | cloud | aws, gcp, azure, oci | src/commands/cloud.rs | ✅ |
@@ -111,6 +111,7 @@ pup slos get abc-123-def
 ```bash
 pup logs search --query="status:error" --from="1h"
 pup logs search --query="service:api" --from="7d" --storage="flex"
+pup logs patterns --query="status:error" --pattern-field="message" --from="1h"
 pup logs query --query="service:api" --index="main,security" --from="1h"
 pup logs saved-views create --file=saved-view.json
 pup dbm samples search --query="dbm_type:activity service:orders env:prod" --from="1h" --limit=10

docs/COMMANDS.md

@@ -131,6 +131,27 @@ pup logs query --query="service:api" --index="main,security" --from="1h"
 pup logs query --query="service:api" --index="main" --index="security" --from="1h"
 ```
 
+### Find Similar Log Patterns
+```bash
+# Cluster similar message values instead of grouping exact values
+pup logs patterns \
+  --query="status:error" \
+  --pattern-field="message" \
+  --from="1h"
+
+# Analyze a specific index with larger sampling limits and grouping fields
+pup logs patterns \
+  --query="service:api" \
+  --pattern-field="@request.path" \
+  --group-by="service,status" \
+  --index="main" \
+  --sample-limit=100 \
+  --event-limit=20000 \
+  --from="24h"
+```
+
+Pattern clustering returns similar-value groups. Use `logs aggregate --group-by` when exact-value buckets are required.
+
 ### Aggregate Logs
 ```bash
 # Count logs by status

docs/EXAMPLES.md

@@ -400,6 +400,23 @@ mod tests {
         assert!(!ro.contains(&"logs_write_pipelines"));
     }
 
+    #[test]
+    fn test_default_scopes_excludes_workload_identity_federation() {
+        let scopes = default_scopes();
+        // workload_identity_federation_read/write are only ever granted to
+        // admins, so they're opt-in only (see 'pup cloud-auth' AUTHENTICATION
+        // doc) rather than requested by default.
+        assert!(!scopes.contains(&"workload_identity_federation_read"));
+        assert!(!scopes.contains(&"workload_identity_federation_write"));
+    }
+
+    #[test]
+    fn test_read_only_scopes_excludes_workload_identity_federation() {
+        let ro = read_only_scopes();
+        assert!(!ro.contains(&"workload_identity_federation_read"));
+        assert!(!ro.contains(&"workload_identity_federation_write"));
+    }
+
     #[test]
     fn test_read_only_scopes_subset_of_default() {
         let default: std::collections::HashSet<&str> = default_scopes().into_iter().collect();