> ## Documentation Index > Fetch the complete documentation index at: https://opensre.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Interactive Shell Commands > Complete reference for every slash command in the OpenSRE REPL — session control, investigations, integrations, tasks, watchdogs, and more Start the interactive shell with `opensre` (TTY required). Type a slash command at the prompt, or describe what you want in plain language — the action agent can route intent to the right command. Run `/help` anytime for the live command list grouped by category. In a TTY, bare `/help` opens an interactive picker; selecting a command runs it directly. When you type `/` and browse completions with the arrow keys, the full description of the highlighted command appears in the hint line above the prompt. Commands marked **elevated** may prompt for confirmation unless [trust mode](#trust-mode-and-confirmations) is on. Non-TTY sessions fail closed on elevated actions. ## How the REPL works | Input type | What happens | | ------------------------------------ | ------------------------------------------------------------------------------------- | | Slash command (`/status`) | Routed through the action agent and executed via the `slash_invoke` AgentTool | | Plain language (`verify datadog`) | Routed by the action agent to slash commands, investigations, or doc-grounded answers | | Pasted alert JSON/text | Often starts an investigation without a slash command | | Shell one-liner (`kubectl get pods`) | Executed through shell policy when the action agent selects a shell action | **TTY vs non-TTY:** The full experience (interactive menus, confirmations, onboarding wizards) requires a real terminal. Piping input or running in CI sets non-interactive mode — elevated commands are rejected unless trust mode was enabled in a prior interactive session (prefer explicit CLI commands outside the REPL for automation). **Unknown commands:** Typos suggest the closest registered command (`Did you mean /integrations?`). Run `/help` for the authoritative list — it always matches your installed OpenSRE version. **Keyboard shortcuts:** | Key | Effect | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Up/Down** | Recall persisted command history (when enabled); during `/` completion browse, preview the highlighted command description in the hint line above the prompt | | **Ctrl+C** once | Cancel in-flight streaming work or interrupt the current prompt | | **Ctrl+C** twice within 2s | Exit the REPL (prints `/resume` hint) | | **Ctrl+D** | Exit when the prompt is empty (same resume hint as `/exit`) | *** ## Quick reference ### Help and exit | Command | What it does | | ------- | ------------------------------------------------------ | | `/help` | List commands or show help for one command or category | | `/?` | Shortcut for `/help` | | `/exit` | Leave the interactive shell | | `/quit` | Alias for `/exit` | ### Session | Command | What it does | | ---------------------- | -------------------------------------------------------------------- | | `/status` | Session summary — interactions, alerts, provider, effort, trust mode | | `/cost` | Token usage and LLM call count for the current session | | `/context` | Infra metadata accumulated during the session | | `/effort` | Set or show reasoning effort (`low` … `max`) | | `/trust` | Enable or disable trust mode (skip confirmation prompts) | | `/verbose` | Toggle verbose logging | | `/clear` | Clear the screen and re-render the banner | | `/compact` | Summarize older context into a replayable compaction entry | | `/sessions` | List recent REPL sessions on disk | | `/resume ` | Restore a past session's conversation context | | `/resume :` | Restore a specific session branch point | | `/new` | Start a new session file while keeping LLM context | ### Investigation | Command | What it does | | -------------- | ---------------------------------------------------- | | `/investigate` | Run an RCA from a file path or sample template | | `/template` | Print a starter alert JSON template | | `/last` | Reprint the most recent investigation report | | `/save ` | Export the last investigation to a file **elevated** | ### Integrations, models, and tools | Command | What it does | | --------------- | ---------------------------------------------------- | | `/health` | Integration and agent health check | | `/verify` | Verify integration connectivity (all or one service) | | `/integrations` | List, verify, show, setup, or remove integrations | | `/mcp` | List, connect, or disconnect MCP servers | | `/model` | Show or switch LLM provider and models | | `/tools` | List registered investigation and chat tools | ### Privacy and history | Command | What it does | | ---------- | ------------------------------------------------------- | | `/history` | Show or manage persisted command history | | `/privacy` | History persistence, redaction status, and threat model | ### Tasks and background work | Command | What it does | | -------------- | -------------------------------------------------------- | | `/tasks` | List recent and in-flight background tasks | | `/cancel ` | Cancel a running task by id **elevated** | | `/stop` | Guidance for stopping investigations and background work | ### Watchdog | Command | What it does | | --------------- | --------------------------------------------------------------- | | `/watch` | Watch a process and send Telegram threshold alarms **elevated** | | `/watches` | List active watchdog tasks with latest samples | | `/unwatch ` | Stop a watchdog task by id **elevated** | | `/watchdog` | CLI-parity wrapper for the watchdog monitor | ### Agents and alerts | Command | What it does | | --------- | ---------------------------------------- | | `/fleet` | View and manage the local AI agent fleet | | `/alerts` | Alert listener inbox status | ### CLI parity These commands delegate to the same Click CLI you would run outside the REPL. | Command | What it does | | ------------- | --------------------------------------------------------------------------------- | | `/auth` | Log in to LLM providers, show provider auth status, or clear credentials | | `/login` | Shortcut for `/auth login` (`/login chatgpt`, `/login claude`, `/login deepseek`) | | `/onboard` | Interactive onboarding wizard | | `/remote` | Connect to and operate remote deployed agents | | `/config` | Show or edit `~/.opensre/config.yml` | | `/cron` | Manage scheduled delivery jobs | | `/messaging` | Telegram pairing and allowlist | | `/hermes` | Hermes log tailing and incident escalation | | `/guardrails` | Sensitive-information guardrail rules | | `/tests` | Browse and run inventoried tests | | `/update` | Check for updates and upgrade OpenSRE | | `/debug` | Targeted runtime diagnostics | | `/uninstall` | Remove OpenSRE and local data **elevated** | ### System | Command | What it does | | ---------- | --------------------------------- | | `/doctor` | Full local environment diagnostic | | `/version` | OpenSRE, Python, and OS versions | ### Commands with interactive menus (TTY) Bare invocation opens a picker or submenu: | Command | Menu behavior | | -------------------- | -------------------------------------------------- | | `/help` | Browse categories; Enter runs the selected command | | `/integrations` | list / verify / show / setup / remove | | `/mcp` | list / connect / disconnect | | `/model` | show / set / restore / toolcall | | `/investigate` | Demo alerts, templates, custom file path | | `/template` | Template type picker | | `/trust`, `/verbose` | on / off | | `/history` | show / clear / off / on / retention | | `/resume` | Numbered list of recent sessions | *** ## Using `/help` ```text theme={null} /help /help /model /help investigation /help tasks /help all ``` | Form | Result | | ------------------ | ------------------------------------------------------------------ | | `/help` | Interactive picker in a TTY; category index otherwise | | `/help ` | Detailed usage for one command (e.g. `/help /watch`) | | `/help ` | All commands in a section (`investigation`, `session`, `tasks`, …) | | `/help all` | Full command index | Help categories mirror the REPL grouping: Quick Access, Session, Integrations/Models/Tools, Investigation, Privacy, Tasks, Agents, Alerts, CLI parity, and System. **Quick Access** duplicates frequently used commands (`/investigate`, `/integrations`, `/model`, `/health`, `/watch`, `/status`, `/help`) for faster discovery in the picker. *** ## Session commands ### `/status` Shows a snapshot of the **current** REPL session: ```text theme={null} /status ``` Typical fields: | Field | Meaning | | --------------------- | -------------------------------------------------------------------------- | | `interactions` | Count of recorded turns (chat, slash, alerts) | | `incoming alerts` | Alerts received by the local listener this session, plus age of the latest | | `last investigation` | `yes` if `/investigate` or a streamed investigation completed | | `trust mode` | `on` / `off` | | `reasoning effort` | Current `/effort` level (OpenAI/Codex only) | | `provider` | Active `LLM_PROVIDER` | | `grounding … cache` | Doc/source cache stats used for help answers | | `accumulated context` | Comma-separated keys from prior investigations (e.g. `service`, `cluster`) | Use `/status` for **session** state. Use `/health` for **integration connectivity**. ### `/cost` Shows LLM usage tracked **locally** for the current REPL session. This is not cloud-provider billing and does not read your vendor invoice. ```text theme={null} /cost ``` Example output (measured + estimated mix): ```text theme={null} Session cost (includes estimates) history entries 12 llm calls 8 input tokens 4,210 (measured: 1,200 · estimated: 3,010) output tokens 890 (estimated: 890) ``` | Field | Meaning | | -------------------------------- | ----------------------------------------------------- | | `history entries` | Lines recorded in this session's in-memory history | | `llm calls` | LLM turns counted (planner + chat + help + follow-up) | | `input tokens` / `output tokens` | Running totals for prompt and completion usage | **Measured vs estimated:** | Code path | Token source | | ------------------------------------- | ---------------------------------------------------------- | | Planner `invoke()` (action selection) | Provider usage metadata when the API returns it | | Streaming chat, help, follow-up | Estimated from character length (\~4 characters per token) | When any estimate is included, the table title notes `(includes estimates)` and rows show measured vs estimated splits. **What increments the counter:** Normal LLM chat turns and planner calls. **What does not:** Non-LLM command handling such as history recall or prompt rendering. Token totals reset on `/new` or when session identity is rotated. They do **not** carry across `/resume`. See [Session History](/sessions). ### `/context` Displays key/value infra metadata collected during investigations and chat — typically `service`, `cluster`, `region`, or similar fields extracted from alert text and investigation state. ```text theme={null} /context ``` Context is **inherited** across investigations in the same session (and restored by `/resume`). It is passed as overrides to subsequent `/investigate` runs so the pipeline does not re-ask for environment details you already established. ### `/effort` Set reasoning depth for **OpenAI and Codex** providers in this REPL session only. ```text theme={null} /effort high /effort ``` | Level | When to use | | -------------- | ----------------------------------------------------------------------------------------------- | | `low` | Fast triage, simple lookups, lower token cost | | `medium` | Default balance for most incident work | | `high` | Deeper RCA when latency is acceptable | | `xhigh`, `max` | Maximum reasoning; best with newer GPT-5 or Codex models — older models may reject these levels | Bare `/effort` prints the current level, the config default for your provider/model, and supported choices. `/status` includes the same field. Other providers (Anthropic, Ollama, etc.) ignore `/effort`; the shell prints a hint suggesting `/model set openai` or `/model set codex`. Set `OPENSRE_REASONING_EFFORT` in the environment for non-interactive defaults. See [LLM providers](/llm-providers). ### `/trust` Trust mode skips execution confirmation prompts for **elevated** commands (`/save`, `/watch`, `/cancel`, `/uninstall`, integration remove, etc.). ```text theme={null} /trust on /trust off /trust ``` In a TTY, bare `/trust` opens an interactive on/off menu. Trust mode is a **session preference** — it is not restored by `/resume`. During watchdog demos or repeated `/save` exports, `/trust on` avoids confirmation fatigue. Turn it off before running destructive commands you might mistype. ### `/verbose` Toggle `TRACER_VERBOSE` logging for the REPL process (deeper internal logs to stderr). ```text theme={null} /verbose on /verbose off /verbose ``` ### `/clear` Clears the terminal and re-renders the OpenSRE banner. Does **not** reset session state, token usage, LLM conversation context, or accumulated infra context. ```text theme={null} /clear ``` ### `/compact` Summarizes older conversation context, keeps recent messages, and persists a `compaction` entry in the session file. Future `/resume` calls replay the summary before the kept messages. ```text theme={null} /compact ``` If there are not enough messages to compact, the command reports nothing to compact. OpenSRE also compacts automatically before a shell turn when the replayed branch context exceeds the runtime threshold. ### `/sessions` List up to **20** recent sessions stored on disk, newest first: ```text theme={null} /sessions ``` ```text theme={null} Recent sessions # Session ID Name Started Duration Turns Investigations ───────────────────────────────────────────────────────────────────────────────────────────── 1 3f8a1c2d (current) Jun 17 10:00 42m 8 2 2 9b2e4f7a why is CPU spiking on prod-api Jun 16 14:30 1h 5m 15 4 ``` | Column | Meaning | | ---------------- | ------------------------------------------------------------ | | `Session ID` | First 8 characters of the UUID (enough for `/resume`) | | `Name` | Derived from the first user message or resumed session label | | `Turns` | Total chat + slash + alert turns recorded | | `Investigations` | Count of investigation turns | The current row updates **duration** live. Sessions with no name show `(current)` or `↩ ` when applicable. ### `/resume` Restore LLM conversation context and accumulated infra context from a previous session. ```text theme={null} /resume 9b2e4f7a /resume 9b2e4f7a:abc123 /resume redis /resume ``` | Form | Behavior | | ----------------- | ------------------------------------------------------------------------------- | | ID prefix | Match session UUID by prefix (must be unique) | | ID + entry prefix | Replay the branch ending at the matching entry ID prefix | | Name substring | Match when ≥3 characters and exactly one session matches (e.g. `/resume redis`) | | Bare `/resume` | Interactive numbered picker of recent sessions (TTY) | **Current session:** If the ID prefix matches the session you are already in, `/resume` is a no-op — OpenSRE prints a hint to pick a previous session from `/sessions`. When you resume a **different** session, OpenSRE: 1. Switches the active session file to the target session 2. Restores `cli_agent_messages` so the assistant remembers prior turns 3. Restores `accumulated_context` keys 4. Reprints conversation history (user prompts, assistant replies, slash commands) Compaction entries are replayed as summary messages before the kept branch messages. **Restored vs not restored:** | | `/resume` | | ------------------------------ | ---------------------------------------------------- | | Conversation context | Yes | | Infra context keys | Yes | | Trust mode, reasoning effort | No — per-session preferences | | Token usage / `/cost` counters | No — fresh counters for the resumed session identity | | In-memory history count | Yes — turn stubs from the saved session | **Warning:** Resuming a different session replaces the current session's LLM context if messages already exist. Session replay reads the current version-2 session tree format. Older session files are ignored by `/sessions` and `/resume`. See [Session History](/sessions). ### `/new` Rotate to a **new session file** while keeping the current LLM conversation thread and accumulated context. ```text theme={null} /new ``` ```text theme={null} new session started — conversation context carried forward. 14 messages in context · type to continue ``` | Command | Session file | LLM context | Token counters | | --------- | -------------- | -------------------- | ---------------------- | | `/clear` | Same | Kept | Kept | | `/new` | New UUID | Kept | Reset | | `/resume` | Target session | Replaced with target | Reset for that session | Use `/new` after a long `/resume` so `/sessions` stays tidy without losing your place in the conversation. ### Exit paths `/exit`, `/quit`, double **Ctrl+C**, or **Ctrl+D** (empty prompt) all print: ```text theme={null} Resume this session with: /resume 3f8a1c2d opensre --resume 3f8a1c2d goodbye. ``` *** ## Investigation commands Three ways to start RCA from the REPL: | Method | Example | Best for | | -------------------------- | -------------------------------- | ---------------------------- | | Plain language | `checkout returns 502 on prod` | Quick starts, pasted context | | Slash + file/template | `/investigate alert.json` | Repeatable runs, CI fixtures | | Slash + interactive picker | `/investigate` → choose template | Demos, first-time users | Investigations inherit [accumulated context](#context) from earlier runs in the same session. ### `/investigate` ```text theme={null} /investigate alert.json /investigate generic /investigate sample:datadog /investigate ./alerts/checkout-502.json /investigate ``` | Target | Behavior | | ------------------------------------------------------------------- | -------------------------------------------------- | | `alert.json` | Bundled demo alert file shipped with OpenSRE | | `generic`, `datadog`, `grafana`, `honeycomb`, `coralogix`, `splunk` | Built-in sample templates (runs immediately) | | `sample:` or `template:` | Explicit template prefix | | File path | Read alert text from disk (`.json`, `.md`, `.txt`) | | Bare `/investigate` | Interactive picker in a TTY | Template names win over same-named files in the working directory. Force file mode: `/investigate ./generic` **During a run:** * Output streams to the terminal like chat * **Ctrl+C** cancels and marks the task cancelled * `/tasks` shows the investigation task id and status * On completion, `last_state` is updated for `/last` and `/save` * Infra fields from the result merge into accumulated context **Errors:** Missing files, unreadable paths, and pipeline failures print actionable messages; failed runs do not update `last_state`. ### `/template` Print starter alert JSON to stdout — copy, edit, save, then `/investigate your-file.json`. ```text theme={null} /template generic /template datadog /template ``` | Template | Typical use | | ----------- | ----------------------------- | | `generic` | Minimal portable alert shape | | `datadog` | Datadog monitor-style payload | | `grafana` | Grafana alerting format | | `honeycomb` | Honeycomb trigger shape | | `coralogix` | Coralogix alert JSON | | `splunk` | Splunk notable-event style | ### `/last` Reprint the root cause and report sections from the most recent successful investigation in **this session**. ```text theme={null} /last ``` Sections rendered when present: **Root Cause**, **Report** (from `problem_md` or `slack_message`). If no investigation ran yet, prints a dim empty-state message. ### `/save` Write the last investigation to disk. Requires confirmation unless trust mode is on. ```text theme={null} /save report.md /save out.json /save ./rca/checkout-502.json ``` | Extension | Output | | ------------------------ | ------------------------------------------------------ | | `.json` | Full investigation state object (machine-readable) | | Other (`.md`, `.txt`, …) | Markdown with `## Root Cause` and `## Report` sections | Parent directories must exist or be creatable; write failures print the underlying error. *** ## Integrations, models, and tools ### Choosing the right diagnostic command | Question | Command | | --------------------------------------------- | -------------------------------------------------------------- | | Are my integrations configured and reachable? | `/verify`, `/health`, or `/integrations verify` | | Verify one integration by name? | `/verify datadog` or `/integrations verify datadog` | | Show one integration's credentials/endpoints? | `/integrations show datadog` | | Is Python/Docker/venv OK on this machine? | `/doctor` | | What integrations exist in OpenSRE generally? | Ask in plain language (docs answer) — not `/integrations list` | ### `/health` Read-only pass/fail report for the local OpenSRE agent, LLM connectivity, and each configured integration. ```text theme={null} /health ``` Runs live verification against the integration store. Use before incidents to confirm Datadog/Grafana/K8s credentials still work. For integration-only checks without the full agent/LLM report, prefer `/verify`. ### `/verify` Shortcut for integration connectivity checks (same as `opensre integrations verify` / `make verify-integrations`). ```text theme={null} /verify /verify datadog /verify telegram ``` | Form | Behavior | | ------------------- | ------------------------------------------------------------------------------------------------------------ | | Bare `/verify` | Verify all integrations; prints status table plus `all integrations ok` or `N integration(s) need attention` | | `/verify ` | Verify one named integration | ### `/integrations` ```text theme={null} /integrations /integrations list /integrations verify /integrations verify datadog /integrations show datadog /integrations setup datadog /integrations remove datadog ``` | Subcommand | Behavior | | ------------------ | -------------------------------------------------------------- | | `list` (default) | Verify all configured integrations and render status table | | `verify` | Verify all integrations; prints summary line | | `verify ` | Verify one integration (same as `/verify `) | | `show ` | Verify one service and print key/value config (masked secrets) | | `setup ` | Launch setup wizard via CLI subprocess | | `remove ` | Remove from local store **elevated** | Bare `/integrations` opens an interactive menu in a TTY with service pickers for show/remove. ### `/mcp` MCP-capable integrations only (subset of the full integration catalog). ```text theme={null} /mcp list /mcp connect github /mcp disconnect github ``` | Subcommand | Maps to | | --------------------- | ----------------------------------------------- | | `list` | Table of MCP servers from verified integrations | | `connect ` | `opensre integrations setup ` | | `disconnect ` | `opensre integrations remove ` | ### `/model` Show or change LLM provider and models. Updates project `.env` (default: repository root `.env`, override with `OPENSRE_PROJECT_ENV_PATH`), `~/.opensre/opensre.json`, and resets in-process LLM caches. ```text theme={null} /model show /model set openai gpt-4.1 /model set anthropic claude-sonnet-4-20250514 --toolcall-model claude-sonnet-4-20250514 /model set claude-sonnet-4-20250514 /model restore /model restore anthropic /model toolcall set gpt-4.1-mini /model ``` | Subcommand | Behavior | | ----------------------------------------------- | --------------------------------------------------------- | | `show` (default) | Provider, reasoning model env var, toolcall model env var | | `set [model] [--toolcall-model ]` | Switch provider; optional per-slot models | | `set ` (no provider) | Update reasoning model for **current** provider only | | `restore [provider]` | Reset to provider's default reasoning model | | `toolcall set ` | Set investigation tool-call model for active provider | **Credential guard:** Switching to a provider without prompt-safe auth status fails fast with setup instructions. Run `/auth login ` or export the provider API key before switching. If status is stale, run `/auth verify `. **Reasoning vs toolcall model:** Reasoning model drives chat and planning; toolcall model drives investigation tool invocation when the provider exposes a separate slot (common on Anthropic/OpenAI). Interactive `/model` menu flow: pick provider → reasoning model (or default) → optional toolcall model (`keep`, `match-reasoning`, or explicit). See [LLM providers](/llm-providers). ### `/tools` List tools available to investigation and chat surfaces in this build (name, source, surfaces). ```text theme={null} /tools /tools list ``` There is no global `/list` command — use domain-specific list commands (see [Natural language actions](#natural-language-actions)). *** ## Privacy and history Command **history** (up-arrow recall) is separate from **session** history (`/sessions`). Full redaction patterns and env vars: [Interactive Shell Privacy](/interactive-shell-privacy). ### `/history` ```text theme={null} /history /history clear /history off /history on /history retention 1000 ``` | Subcommand | Behavior | | --------------- | ----------------------------------------------------------------------------- | | (none) | Numbered list of persisted prompt lines | | `clear` | Delete `~/.opensre/interactive_history`; up-arrow recall empty on next launch | | `off` | Pause disk writes for this session (in-memory recall still works) | | `on` | Resume persistence | | `retention ` | Cap file entries; prunes immediately (requires redacting backend) | Bare `/history` opens an interactive menu in a TTY (presets: 100, 500, 1000, 5000 for retention). Redaction applies to the **history file**, not necessarily to what is sent to the LLM. Treat shared machines accordingly — run `/history clear` after sensitive sessions. ### `/privacy` ```text theme={null} /privacy ``` Shows persistence on/off, redaction on/off, retention cap, history file path, built-in pattern count, and a short threat-model reminder (unencrypted local disk). *** ## Tasks and background work Long-running work is tracked in a per-session task registry surfaced by `/tasks`. ### Task kinds | Kind | Source | | ---------------- | ------------------------------------------------- | | `investigation` | `/investigate`, streamed free-text investigations | | `watchdog` | `/watch` | | `synthetic_test` | `/tests synthetic`, CloudOpsBench | | `cli_command` | Other `/tests` runs, delegated CLI subprocesses | | `code_agent` | Code-agent integrations (when used) | ### Task statuses | Status | Meaning | | ----------- | ------------------------------- | | `running` | In progress; `/cancel` eligible | | `completed` | Finished successfully | | `cancelled` | User or `/cancel` stopped it | | `failed` | Non-zero exit or pipeline error | | `pending` | Created but not yet started | ### `/tasks` ```text theme={null} /tasks ``` Example: ```text theme={null} Tasks id kind status started (UTC) duration detail abc12 investigation running 2026-06-17 10:01 45.2s streaming… def34 watchdog completed 2026-06-17 09:55 120.0s pid=12345 max_cpu=80% ``` Shows up to **50** recent tasks, newest first. Use the **id** column (short prefix) with `/cancel` or `/unwatch`. ### `/cancel` ```text theme={null} /cancel abc12 ``` * Matches task id by **prefix** (must be unique among active/recent tasks) * Only **running** tasks accept cancellation * Investigations: signals cancel; press **Ctrl+C** if streaming continues * Watchdogs: prefer `/unwatch` for watchdog-specific messaging ### `/stop` Prints guidance only — does not kill processes: ```text theme={null} /stop ``` | Situation | Action | | --------------------------- | --------------------------------- | | Streaming investigation | **Ctrl+C** | | Background test or CLI task | `/tasks` → `/cancel ` | | Watchdog | `/unwatch ` or `/cancel ` | *** ## Watchdog commands Monitor a local process and send **Telegram** alarms when CPU, memory, or runtime thresholds breach. Configure Telegram credentials before use (via `/onboard` or env — see messaging docs). ### `/watch` ```text theme={null} /watch 12345 --max-cpu 80 --max-rss 512M --max-runtime 30m --cooldown 5m --interval 2s --once ``` | Flag | Meaning | Default | | --------------- | ----------------------------------------------- | ---------- | | `` | Process to watch (required first arg) | — | | `--max-cpu` | CPU percent threshold (max ≈ `100 × cpu_count`) | none | | `--max-rss` | Resident memory cap (`512M`, `1G`, `1.5Gib`) | none | | `--max-runtime` | Wall-clock limit (`30s`, `5m`, `1h`) | none | | `--cooldown` | Min seconds between repeat alarms | `300` (5m) | | `--interval` | Sample period | `2s` | | `--once` | At most one alarm per threshold type | off | On start: ```text theme={null} task abc12 started. ``` When a threshold fires (Telegram configured): ```text theme={null} [task abc12] alarm fired: max_cpu … (telegram delivered) ``` **Typical demo workflow:** 1. `/trust on` (optional — skips `/watch` confirmation) 2. `/watch --max-cpu 80` — use a real PID (e.g. the REPL's Python process) 3. `/watches` — confirm `running` status and threshold string 4. `/unwatch abc12` — request stop; `/watches` should show `cancelled` Quoted values are supported: `/watch 12345 --max-cpu "80"`. ### `/watches` ```text theme={null} /watches ``` Watchdog-only view with columns: id, pid, status, started, thresholds (from command summary), **last sample** (live CPU/RSS from progress line). ### `/unwatch` ```text theme={null} /unwatch abc12 ``` Cancels a **watchdog** task by task id. Using `/cancel` also works; `/unwatch` validates the task kind. ### `/watchdog` CLI-parity syntax (subprocess to `opensre watchdog`): ```text theme={null} /watchdog --pid 12345 --max-rss 1G --max-cpu 80 ``` Prefer `/watch` inside the REPL — it registers tasks for `/watches` and `/tasks` automatically. *** ## Agents and alerts Fleet coordination is documented further on [Agents](/fleet). Register discovered agents with `opensre fleet scan --register` before `/fleet trace` targets them. ### `/fleet` ```text theme={null} /fleet /fleet budget /fleet budget cursor-agent 5.00 /fleet bus /fleet claim feature-x my-agent /fleet release feature-x /fleet conflicts /fleet kill 12345 /fleet kill 12345 --force /fleet trace 12345 /fleet wait 12345 --on 67890 /fleet graph ``` | Subcommand | Behavior | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | (none) | Dashboard: registered + discovered agents (Cursor, Claude Code, Codex, Aider, …) with pid, uptime, CPU, tokens/min, \$/hr, status | | `budget` | View hourly budgets from `~/.opensre/agents.yaml` | | `budget ` | Set `hourly_budget_usd` for one agent | | `bus` | Live-tail cross-agent context bus until Ctrl+C | | `claim ` | Exclusive branch claim (agent must be in registry) | | `release ` | Release a claim | | `conflicts` | File-write conflict report between agents | | `kill [--force]` | SIGTERM → wait → SIGKILL **elevated**; refuses self-PID | | `trace ` | Live stdout tail of agent process | | `wait --on ` | Record wait dependency for graph | | `graph` | Tree of wait-on relationships | **Kill confirmation:** Without `--force`, prompts `[y/N]`. `--force` skips prompt (still elevated tier unless trust mode). ### `/alerts` ```text theme={null} /alerts ``` When the alert listener is active: | Field | Meaning | | ------------- | ----------------------------------- | | `status` | `listening` | | `queue depth` | Alerts waiting for REPL consumption | | `dropped` | Alerts dropped when queue was full | | `recent` | Up to 5 latest alert names/snippets | If the listener is inactive, prints a warning. Incoming alerts also appear in `/status` as `incoming alerts`. Post alerts to your configured webhook/listener URL during setup; the REPL can start investigations from plain language. *** ## CLI parity commands These spawn `opensre …` subprocesses. Output is captured into the REPL buffer for non-interactive subcommands; wizards attach to the real TTY. ### `/onboard` ```text theme={null} /onboard /onboard local_llm ``` First-run setup: LLM keys, integrations, Telegram, alert listener. Requires exclusive stdin — the REPL tears down prompt\_toolkit before the wizard runs. ### `/remote` ```text theme={null} /remote health /remote investigate /remote ops /remote pull /remote trigger ``` Operate remote deployed OpenSRE agents (EC2, Nitro, hosted runtime). See [Remote runtime investigation](/remote-runtime-investigation). ### `/config` ```text theme={null} /config show /config set interactive.history.max_entries 1000 ``` Read/write `~/.opensre/config.yml`. Prefer env vars for secrets; use config for structured interactive-shell settings. ### `/cron` ```text theme={null} /cron list /cron add /cron remove /cron run /cron logs ``` Scheduled investigation or report delivery. See [Cron](/cron). ### `/messaging` ```text theme={null} /messaging pair /messaging allow /messaging revoke /messaging status ``` Telegram bot pairing and sender allowlist — required for `/watch` alarms and some delivery features. ### `/hermes` ```text theme={null} /hermes watch ``` Tail Hermes logs and escalate classified incidents. See [Hermes](/hermes) and [Hermes runbook](/hermes_runbook). ### `/guardrails` ```text theme={null} /guardrails audit /guardrails init /guardrails rules /guardrails test ``` | Subcommand | Purpose | | ---------- | ------------------------------------------ | | `init` | Scaffold local guardrail config | | `rules` | List active masking rules | | `test` | Run sample text through rules | | `audit` | Scan recent content for sensitive patterns | Related: [Masking](/masking). ### `/tests` ```text theme={null} /tests /tests list /tests run /tests synthetic /tests cloudopsbench /tests synthetic --scenario ``` | Form | Behavior | | ----------------------------------- | --------------------------------------------------------------- | | Bare `/tests` | Interactive multi-select picker; chosen tests run in background | | `list` | Print inventoried tests (captured output) | | `run`, `synthetic`, `cloudopsbench` | Background task — monitor with `/tasks` | | Flags after subcommand | Passed through to CLI | Synthetic tests can run for a long time; default timeout is generous — use `/cancel` to stop. ### `/update` ```text theme={null} /update ``` Checks PyPI and upgrades OpenSRE in-place (5-minute network timeout). Non-zero exit prints CLI error code. ### `/debug` ```text theme={null} /debug sentry ``` Targeted smoke tests (Sentry, etc.) — subcommands match `opensre debug --help`. ### `/uninstall` ```text theme={null} /uninstall ``` Removes OpenSRE and local data. **Destructive** — confirmation required unless trust mode. Delegates to interactive CLI uninstall flow. *** ## System commands ### `/doctor` Environment diagnostic distinct from `/health`: ```text theme={null} /doctor ``` Checks Python version, venv, config paths, Docker availability, credential presence, and related local prerequisites. Each row: `ok`, `warn`, or `error` with detail text. Use **`/doctor`** before first install debugging; use **`/health`** before an incident to verify integrations. ### `/version` ```text theme={null} /version ``` | Field | Example | | --------- | ---------------------------- | | `opensre` | Package version from install | | `python` | `3.12.x` | | `os` | `darwin (arm64)` | ### `/exit` and `/quit` ```text theme={null} /exit /quit ``` Clean shutdown with `/resume` hint. Prefer over killing the terminal so session files flush cleanly. *** ## Trust mode and confirmations | Tier | Examples | Confirmation | | -------- | --------------------------------------------------------------------------------- | ------------------------------ | | Exempt | `/help`, `/exit`, `/trust` | Never prompts | | Safe | `/status`, `/health`, `/investigate`, `/integrations list` | Read-only or standard risk | | Elevated | `/save`, `/watch`, `/cancel`, `/integrations remove`, `/fleet kill`, `/uninstall` | Prompt `[y/N]` unless trust on | Non-TTY: elevated commands **fail closed** (error message, no side effect). ```text theme={null} /trust on # skip prompts for this session /trust off # restore prompts ``` *** ## Natural language actions You do not need to memorize every slash command. Examples: | You type | Typical action | | ------------------------------------- | ----------------------------------------- | | "what's my token usage?" | `/cost` | | "verify datadog" | `/verify datadog` | | "show datadog config" | `/integrations show datadog` | | "switch to openai gpt-4.1" | `/model set openai gpt-4.1` | | "run the generic sample alert" | `/investigate generic` | | "list my past sessions" | `/sessions` | | "check health then list integrations" | `/health` then `/integrations list` | | "how do I configure Datadog?" | Doc-grounded answer (no mutating command) | **List intents** — there is no global `/list`: | Intent | Command | | ---------------------- | -------------------- | | Connected integrations | `/integrations list` | | Tools | `/tools` | | Background tasks | `/tasks` | | MCP servers | `/mcp list` | | Cron jobs | `/cron list` | | Past REPL sessions | `/sessions` | | Watchdog tasks | `/watches` | When the planner is uncertain, it asks for clarification or falls back to help — it does not silently run elevated commands. Compound requests ("health then integrations") execute as an ordered sequence of slash actions. *** ## Common workflows ### First-time setup ```text theme={null} /onboard /health /verify /model show ``` ### Incident triage (local) ```text theme={null} /status /alerts /health ``` Paste alert text or: ```text theme={null} /investigate ./alerts/prod-502.json /last /save ./rca/prod-502.md ``` ### Pick up yesterday's thread ```text theme={null} /sessions /resume 9b2e4f7a ``` Continue chatting, then optionally: ```text theme={null} /new ``` ### Switch model mid-session ```text theme={null} /model set anthropic claude-sonnet-4-20250514 /effort high /cost ``` ### Monitor a runaway process ```text theme={null} /watch --max-cpu 90 --max-rss 2G --cooldown 10m /watches /unwatch ``` ### Debug integration failures ```text theme={null} /integrations show datadog /doctor /verbose on ``` *** ## Troubleshooting | Symptom | Try | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- | | `unknown command` | `/help`; check spelling; use suggested correction | | Elevated command blocked in CI | Use CLI equivalent (`opensre investigate …`) or run interactively | | `/cost` shows zero | No LLM turns yet this session; chat once and retry | | `/resume` not found | Run `/sessions`; use longer ID prefix | | `/resume` ambiguous prefix | Add more characters from Session ID column | | `/model set` missing credential | `/auth login ` or export `ANTHROPIC_API_KEY` / etc.; use `/auth verify ` for stale metadata | | `/watch` Telegram error | Configure messaging via `/messaging status` | | `/integrations show` not found | Run `/integrations list` for exact service slug | | History pause not working | Requires redacting backend — see `/privacy` | | Garbage in next prompt after table | Known TTY issue — upgrade OpenSRE; report if persistent | *** ## Related docs * [Session History](/sessions) — persistence format, privacy, `/new` vs `/clear` * [Interactive Shell Privacy](/interactive-shell-privacy) — redaction, env vars, threat model * [Investigation overview](/investigation-overview) — RCA workflow, plain-language actions, CLI investigate * [LLM providers](/llm-providers) — `/model` and `/effort` * [Agents](/fleet) — fleet dashboard, bus, trace, budgets * [Cron](/cron) — `/cron` scheduled deliveries * [Hermes](/hermes) — `/hermes watch` * [Remote runtime investigation](/remote-runtime-investigation) — `/remote`