Interactive Shell Commands - OpenSRE Documentation

Start the interactive shell with opensre (TTY required). Type a slash command at the prompt, or describe what you want in plain language — the action agent can route intent to the right command. Run /help anytime for the live command list grouped by category. In a TTY, bare /help opens an interactive picker; selecting a command runs it directly. When you type / and browse completions with the arrow keys, the full description of the highlighted command appears in the hint line above the prompt.

Commands marked elevated may prompt for confirmation unless trust mode is on. Non-TTY sessions fail closed on elevated actions.

How the REPL works

Input type	What happens
Slash command (`/status`)	Routed through the action agent and executed via the `slash_invoke` AgentTool
Plain language (`verify datadog`)	Routed by the action agent to slash commands, investigations, or doc-grounded answers
Pasted alert JSON/text	Often starts an investigation without a slash command
Shell one-liner (`kubectl get pods`)	Executed through shell policy when the action agent selects a shell action

TTY vs non-TTY: The full experience (interactive menus, confirmations, onboarding wizards) requires a real terminal. Piping input or running in CI sets non-interactive mode — elevated commands are rejected unless trust mode was enabled in a prior interactive session (prefer explicit CLI commands outside the REPL for automation). Unknown commands: Typos suggest the closest registered command (Did you mean /integrations?). Run /help for the authoritative list — it always matches your installed OpenSRE version. Keyboard shortcuts:

Key	Effect
Up/Down	Recall persisted command history (when enabled); during `/` completion browse, preview the highlighted command description in the hint line above the prompt
Ctrl+C once	Cancel in-flight streaming work or interrupt the current prompt
Ctrl+C twice within 2s	Exit the REPL (prints `/resume` hint)
Ctrl+D	Exit when the prompt is empty (same resume hint as `/exit`)

Quick reference

Help and exit

Command	What it does
`/help`	List commands or show help for one command or category
`/?`	Shortcut for `/help`
`/exit`	Leave the interactive shell
`/quit`	Alias for `/exit`

Session

Command	What it does
`/status`	Session summary — interactions, alerts, provider, effort, trust mode
`/cost`	Token usage and LLM call count for the current session
`/context`	Infra metadata accumulated during the session
`/effort`	Set or show reasoning effort (`low` … `max`)
`/trust`	Enable or disable trust mode (skip confirmation prompts)
`/verbose`	Toggle verbose logging
`/clear`	Clear the screen and re-render the banner
`/compact`	Summarize older context into a replayable compaction entry
`/sessions`	List recent REPL sessions on disk
`/resume <id>`	Restore a past session’s conversation context
`/resume <id>:<entry>`	Restore a specific session branch point
`/new`	Start a new session file while keeping LLM context

Investigation

Command	What it does
`/investigate`	Run an RCA from a file path or sample template
`/template`	Print a starter alert JSON template
`/last`	Reprint the most recent investigation report
`/save <path>`	Export the last investigation to a file elevated

Integrations, models, and tools

Command	What it does
`/health`	Integration and agent health check
`/verify`	Verify integration connectivity (all or one service)
`/integrations`	List, verify, show, setup, or remove integrations
`/mcp`	List, connect, or disconnect MCP servers
`/model`	Show or switch LLM provider and models
`/tools`	List registered investigation and chat tools

Privacy and history

Command	What it does
`/history`	Show or manage persisted command history
`/privacy`	History persistence, redaction status, and threat model

Tasks and background work

Command	What it does
`/background`	Run investigations async; track RCAs and completion notifications
`/tasks`	List recent and in-flight background tasks
`/cancel <id>`	Cancel a running task by id elevated
`/stop`	Guidance for stopping investigations and background work

Watchdog

Command	What it does
`/watch`	Watch a process and send Telegram threshold alarms elevated
`/watches`	List active watchdog tasks with latest samples
`/unwatch <id>`	Stop a watchdog task by id elevated
`/watchdog`	CLI-parity wrapper for the watchdog monitor

Agents and alerts

Command	What it does
`/fleet`	View and manage the local AI agent fleet
`/alerts`	Alert listener inbox status

CLI parity

These commands delegate to the same Click CLI you would run outside the REPL.

Command	What it does
`/auth`	Log in to LLM providers, show provider auth status, or clear credentials
`/login`	Shortcut for `/auth login` (`/login chatgpt`, `/login claude`, `/login deepseek`)
`/onboard`	Interactive onboarding wizard
`/remote`	Connect to and operate remote deployed agents
`/config`	Show or edit `~/.opensre/config.yml`
`/cron`	Manage scheduled delivery jobs
`/sentry`	Schedule automated Sentry morning digests or uptime watches (Telegram or Slack required)
`/messaging`	Telegram pairing and allowlist
`/hermes`	Hermes log tailing and incident escalation
`/guardrails`	Sensitive-information guardrail rules
`/tests`	Browse and run inventoried tests
`/update`	Check for updates and upgrade OpenSRE
`/debug`	Targeted runtime diagnostics
`/uninstall`	Remove OpenSRE and local data elevated

System

Command	What it does
`/doctor`	Full local environment diagnostic
`/version`	OpenSRE, Python, and OS versions

Commands with interactive menus (TTY)

Bare invocation opens a picker or submenu:

Command	Menu behavior
`/help`	Browse categories; Enter runs the selected command
`/integrations`	list / verify / show / setup / remove
`/mcp`	list / connect / disconnect
`/model`	show / set / restore / toolcall
`/investigate`	Demo alerts, templates, custom file path
`/template`	Template type picker
`/trust`, `/verbose`	on / off
`/history`	show / clear / off / on / retention
`/resume`	Numbered list of recent sessions

Using `/help`

/help
/help /model
/help investigation
/help tasks
/help all

Form	Result
`/help`	Interactive picker in a TTY; category index otherwise
`/help <command>`	Detailed usage for one command (e.g. `/help /watch`)
`/help <category>`	All commands in a section (`investigation`, `session`, `tasks`, …)
`/help all`	Full command index

Help categories mirror the REPL grouping: Quick Access, Session, Integrations/Models/Tools, Investigation, Privacy, Tasks, Agents, Alerts, CLI parity, and System. Quick Access duplicates frequently used commands (/investigate, /integrations, /model, /health, /watch, /status, /help) for faster discovery in the picker.

Session commands

`/status`

Shows a snapshot of the current REPL session:

/status

Typical fields:

Field	Meaning
`interactions`	Count of recorded turns (chat, slash, alerts)
`incoming alerts`	Alerts received by the local listener this session, plus age of the latest
`last investigation`	`yes` if `/investigate` or a streamed investigation completed
`trust mode`	`on` / `off`
`reasoning effort`	Current `/effort` level (OpenAI/Codex only)
`provider`	Active `LLM_PROVIDER`
`grounding … cache`	Doc/source cache stats used for help answers
`accumulated context`	Comma-separated keys from prior investigations (e.g. `service`, `cluster`)

Use /status for session state. Use /health for integration connectivity.

`/cost`

Shows LLM usage tracked locally for the current REPL session. This is not cloud-provider billing and does not read your vendor invoice.

/cost

Example output (measured + estimated mix):

  Session cost (includes estimates)

  history entries     12
  llm calls           8
  input tokens        4,210 (measured: 1,200 · estimated: 3,010)
  output tokens       890 (estimated: 890)

Field	Meaning
`history entries`	Lines recorded in this session’s in-memory history
`llm calls`	LLM turns counted (planner + chat + help + follow-up)
`input tokens` / `output tokens`	Running totals for prompt and completion usage

Measured vs estimated:

Code path	Token source
Planner `invoke()` (action selection)	Provider usage metadata when the API returns it
Streaming chat, help, follow-up	Estimated from character length (~4 characters per token)

When any estimate is included, the table title notes (includes estimates) and rows show measured vs estimated splits. What increments the counter: Normal LLM chat turns and planner calls. What does not: Non-LLM command handling such as history recall or prompt rendering. Token totals reset on /new or when session identity is rotated. They do not carry across /resume. See Session History.

`/context`

Displays key/value infra metadata collected during investigations and chat — typically service, cluster, region, or similar fields extracted from alert text and investigation state.

/context

Context is inherited across investigations in the same session (and restored by /resume). It is passed as overrides to subsequent /investigate runs so the pipeline does not re-ask for environment details you already established.

`/effort`

Set reasoning depth for OpenAI and Codex providers in this REPL session only.

/effort high
/effort

Level	When to use
`low`	Fast triage, simple lookups, lower token cost
`medium`	Default balance for most incident work
`high`	Deeper RCA when latency is acceptable
`xhigh`, `max`	Maximum reasoning; best with newer GPT-5 or Codex models — older models may reject these levels

Bare /effort prints the current level, the config default for your provider/model, and supported choices. /status includes the same field. Other providers (Anthropic, Ollama, etc.) ignore /effort; the shell prints a hint suggesting /model set openai or /model set codex. Set OPENSRE_REASONING_EFFORT in the environment for non-interactive defaults. See LLM providers.

`/trust`

Trust mode skips execution confirmation prompts for elevated commands (/save, /watch, /cancel, /uninstall, integration remove, etc.).

/trust on
/trust off
/trust

In a TTY, bare /trust opens an interactive on/off menu. Trust mode is a session preference — it is not restored by /resume.

During watchdog demos or repeated /save exports, /trust on avoids confirmation fatigue. Turn it off before running destructive commands you might mistype.

`/verbose`

Toggle TRACER_VERBOSE logging for the REPL process (deeper internal logs to stderr).

/verbose on
/verbose off
/verbose

`/clear`

Clears the terminal and re-renders the OpenSRE banner. Does not reset session state, token usage, LLM conversation context, or accumulated infra context.

/clear

`/compact`

Summarizes older conversation context, keeps recent messages, and persists a compaction entry in the session file. Future /resume calls replay the summary before the kept messages.

/compact

If there are not enough messages to compact, the command reports nothing to compact. OpenSRE also compacts automatically before a shell turn when the replayed branch context exceeds the runtime threshold.

`/sessions`

List up to 20 recent sessions stored on disk, newest first:

/sessions

  Recent sessions

   #  Session ID  Name                           Started            Duration  Turns  Investigations
   ─────────────────────────────────────────────────────────────────────────────────────────────
   1  3f8a1c2d    (current)                      Jun 17 10:00       42m       8      2
   2  9b2e4f7a    why is CPU spiking on prod-api Jun 16 14:30       1h 5m    15     4

Column	Meaning
`Session ID`	First 8 characters of the UUID (enough for `/resume`)
`Name`	Derived from the first user message or resumed session label
`Turns`	Total chat + slash + alert turns recorded
`Investigations`	Count of investigation turns

The current row updates duration live. Sessions with no name show (current) or ↩ <resumed-from> when applicable.

`/resume`

Restore LLM conversation context and accumulated infra context from a previous session.

/resume 9b2e4f7a
/resume 9b2e4f7a:abc123
/resume redis
/resume

Form	Behavior
ID prefix	Match session UUID by prefix (must be unique)
ID + entry prefix	Replay the branch ending at the matching entry ID prefix
Name substring	Match when ≥3 characters and exactly one session matches (e.g. `/resume redis`)
Bare `/resume`	Interactive numbered picker of recent sessions (TTY)

Current session: If the ID prefix matches the session you are already in, /resume is a no-op — OpenSRE prints a hint to pick a previous session from /sessions. When you resume a different session, OpenSRE:

Switches the active session file to the target session
Restores cli_agent_messages so the assistant remembers prior turns
Restores accumulated_context keys
Reprints conversation history (user prompts, assistant replies, slash commands)

Compaction entries are replayed as summary messages before the kept branch messages. Restored vs not restored:

	`/resume`
Conversation context	Yes
Infra context keys	Yes
Trust mode, reasoning effort	No — per-session preferences
Token usage / `/cost` counters	No — fresh counters for the resumed session identity
In-memory history count	Yes — turn stubs from the saved session

Warning: Resuming a different session replaces the current session’s LLM context if messages already exist. Session replay reads the current version-2 session tree format. Older session files are ignored by /sessions and /resume. See Session History.

`/new`

Rotate to a new session file while keeping the current LLM conversation thread and accumulated context.

/new

new session started — conversation context carried forward.
  14 messages in context · type to continue

Command	Session file	LLM context	Token counters
`/clear`	Same	Kept	Kept
`/new`	New UUID	Kept	Reset
`/resume`	Target session	Replaced with target	Reset for that session

Use /new after a long /resume so /sessions stays tidy without losing your place in the conversation.

Exit paths

/exit, /quit, double Ctrl+C, or Ctrl+D (empty prompt) all print:

Resume this session with:
/resume 3f8a1c2d
opensre --resume 3f8a1c2d
goodbye.

Investigation commands

Three ways to start RCA from the REPL:

Method	Example	Best for
Plain language	`checkout returns 502 on prod`	Quick starts, pasted context
Slash + file/template	`/investigate alert.json`	Repeatable runs, CI fixtures
Slash + interactive picker	`/investigate` → choose template	Demos, first-time users

Investigations inherit accumulated context from earlier runs in the same session.

`/investigate`

/investigate alert.json
/investigate generic
/investigate sample:datadog
/investigate ./alerts/checkout-502.json
/investigate

Target	Behavior
`alert.json`	Bundled demo alert file shipped with OpenSRE
`generic`, `datadog`, `grafana`, `honeycomb`, `coralogix`, `splunk`	Built-in sample templates (runs immediately)
`sample:<name>` or `template:<name>`	Explicit template prefix
File path	Read alert text from disk (`.json`, `.md`, `.txt`)
Bare `/investigate`	Interactive picker in a TTY

Template names win over same-named files in the working directory. Force file mode: /investigate ./generic

During a run:

Output streams to the terminal like chat
Ctrl+C cancels and marks the task cancelled
/tasks shows the investigation task id and status
On completion, last_state is updated for /last and /save
Infra fields from the result merge into accumulated context

Errors: Missing files, unreadable paths, and pipeline failures print actionable messages; failed runs do not update last_state.

`/template`

Print starter alert JSON to stdout — copy, edit, save, then /investigate your-file.json.

/template generic
/template datadog
/template

Template	Typical use
`generic`	Minimal portable alert shape
`datadog`	Datadog monitor-style payload
`grafana`	Grafana alerting format
`honeycomb`	Honeycomb trigger shape
`coralogix`	Coralogix alert JSON
`splunk`	Splunk notable-event style

`/last`

Reprint the root cause and report sections from the most recent successful investigation in this session.

/last

Sections rendered when present: Root Cause, Report (from problem_md or slack_message). If no investigation ran yet, prints a dim empty-state message.

`/save`

Write the last investigation to disk. Requires confirmation unless trust mode is on.

/save report.md
/save out.json
/save ./rca/checkout-502.json

Extension	Output
`.json`	Full investigation state object (machine-readable)
Other (`.md`, `.txt`, …)	Markdown with `## Root Cause` and `## Report` sections

Parent directories must exist or be creatable; write failures print the underlying error.

Integrations, models, and tools

Choosing the right diagnostic command

Question	Command
Are my integrations configured and reachable?	`/verify`, `/health`, or `/integrations verify`
Verify one integration by name?	`/verify datadog` or `/integrations verify datadog`
Show one integration’s credentials/endpoints?	`/integrations show datadog`
Is Python/Docker/venv OK on this machine?	`/doctor`
What integrations exist in OpenSRE generally?	Ask in plain language (docs answer) — not `/integrations list`

`/health`

Read-only pass/fail report for the local OpenSRE agent, LLM connectivity, and each configured integration.

/health

Runs live verification against the integration store. Use before incidents to confirm Datadog/Grafana/K8s credentials still work. For integration-only checks without the full agent/LLM report, prefer /verify.

`/verify`

Shortcut for integration connectivity checks (same as opensre integrations verify / make verify-integrations).

/verify
/verify datadog
/verify telegram

Form	Behavior
Bare `/verify`	Verify all integrations; prints status table plus `all integrations ok` or `N integration(s) need attention`
`/verify <service>`	Verify one named integration

`/integrations`

/integrations
/integrations list
/integrations verify
/integrations verify datadog
/integrations show datadog
/integrations setup datadog
/integrations remove datadog

Subcommand	Behavior
`list` (default)	Verify all configured integrations and render status table
`verify`	Verify all integrations; prints summary line
`verify <service>`	Verify one integration (same as `/verify <service>`)
`show <service>`	Verify one service and print key/value config (masked secrets)
`setup <service>`	Launch setup wizard via CLI subprocess
`remove <service>`	Remove from local store elevated

Bare /integrations opens an interactive menu in a TTY with service pickers for show/remove.

`/mcp`

MCP-capable integrations only (subset of the full integration catalog).

/mcp list
/mcp connect github
/mcp disconnect github

Subcommand	Maps to
`list`	Table of MCP servers from verified integrations
`connect <server>`	`opensre integrations setup <server>`
`disconnect <server>`	`opensre integrations remove <server>`

`/model`

Show or change LLM provider and models. Updates project .env (default: repository root .env, override with OPENSRE_PROJECT_ENV_PATH), ~/.opensre/opensre.json, and resets in-process LLM caches.

/model show
/model set openai gpt-4.1
/model set anthropic claude-sonnet-4-20250514 --toolcall-model claude-sonnet-4-20250514
/model set claude-sonnet-4-20250514
/model restore
/model restore anthropic
/model toolcall set gpt-4.1-mini
/model

Subcommand	Behavior
`show` (default)	Provider, reasoning model env var, toolcall model env var
`set <provider> [model] [--toolcall-model <m>]`	Switch provider; optional per-slot models
`set <model>` (no provider)	Update reasoning model for current provider only
`restore [provider]`	Reset to provider’s default reasoning model
`toolcall set <model>`	Set investigation tool-call model for active provider

Credential guard: Switching to a provider without prompt-safe auth status fails fast with setup instructions. Run /auth login <provider> or export the provider API key before switching. If status is stale, run /auth verify <provider>. Reasoning vs toolcall model: Reasoning model drives chat and planning; toolcall model drives investigation tool invocation when the provider exposes a separate slot (common on Anthropic/OpenAI). Interactive /model menu flow: pick provider → reasoning model (or default) → optional toolcall model (keep, match-reasoning, or explicit). See LLM providers.

`/tools`

List tools available to investigation and chat surfaces in this build (name, source, surfaces).

/tools
/tools list

There is no global /list command — use domain-specific list commands (see Natural language actions).

Privacy and history

Command history (up-arrow recall) is separate from session history (/sessions). Full redaction patterns and env vars: Interactive Shell Privacy.

`/history`

/history
/history clear
/history off
/history on
/history retention 1000

Subcommand	Behavior
(none)	Numbered list of persisted prompt lines
`clear`	Delete `~/.opensre/interactive_history`; up-arrow recall empty on next launch
`off`	Pause disk writes for this session (in-memory recall still works)
`on`	Resume persistence
`retention <N>`	Cap file entries; prunes immediately (requires redacting backend)

Bare /history opens an interactive menu in a TTY (presets: 100, 500, 1000, 5000 for retention).

Redaction applies to the history file, not necessarily to what is sent to the LLM. Treat shared machines accordingly — run /history clear after sensitive sessions.

`/privacy`

/privacy

Shows persistence on/off, redaction on/off, retention cap, history file path, built-in pattern count, and a short threat-model reminder (unencrypted local disk).

Tasks and background work

Long-running work is tracked in a per-session task registry surfaced by /tasks.

Task kinds

Kind	Source
`investigation`	`/investigate`, streamed free-text investigations
`watchdog`	`/watch`
`synthetic_test`	`/tests synthetic`, CloudOpsBench
`cli_command`	Other `/tests` runs, delegated CLI subprocesses
`code_agent`	Code-agent integrations (when used)

Task statuses

Status	Meaning
`running`	In progress; `/cancel` eligible
`completed`	Finished successfully
`cancelled`	User or `/cancel` stopped it
`failed`	Non-zero exit or pipeline error
`pending`	Created but not yet started

`/tasks`

/tasks

Example:

  Tasks

  id      kind           status     started (UTC)     duration  detail
  abc12   investigation  running    2026-06-17 10:01  45.2s     streaming…
  def34   watchdog       completed  2026-06-17 09:55  120.0s    pid=12345 max_cpu=80%

Shows up to 50 recent tasks, newest first. Use the id column (short prefix) with /cancel or /unwatch.

`/cancel`

/cancel abc12

Matches task id by prefix (must be unique among active/recent tasks)
Only running tasks accept cancellation
Investigations: signals cancel; press Ctrl+C if streaming continues
Watchdogs: prefer /unwatch for watchdog-specific messaging

`/stop`

Prints guidance only — does not kill processes:

/stop

Situation	Action
Streaming investigation	Ctrl+C
Background test or CLI task	`/tasks` → `/cancel <id>`
Watchdog	`/unwatch <id>` or `/cancel <id>`

`/background`

Session-local async investigation mode. Launch an RCA, keep using the shell, and get the finished report delivered to email or Telegram.

Subcommand	What it does
`/background on` \| `off`	Enable or disable async investigation launches
`/background status`	Mode, tracked job count, and active notify channels
`/background list`	Tracked jobs with status and root cause
`/background show <task_id>`	Full RCA summary plus per-channel notification result
`/background use <task_id>`	Promote a completed RCA into active follow-up context
`/background notify list`	Show the current completion channels
`/background notify set <channel[,channel...]>`	Set channels — `email`, `telegram`, or both

/background on
/background notify set email,telegram
/investigate datadog
/background show <task_id>

Channels are off by default and reset on REPL restart. email requires the smtp integration; telegram requires the telegram integration. Interactive shell only — there is no opensre background … CLI command. Full guide: Background investigations.

Watchdog commands

Monitor a local process and send Telegram alarms when CPU, memory, or runtime thresholds breach. Configure Telegram credentials before use (via /onboard or env — see messaging docs).

`/watch`

/watch 12345 --max-cpu 80 --max-rss 512M --max-runtime 30m --cooldown 5m --interval 2s --once

Flag	Meaning	Default
`<pid>`	Process to watch (required first arg)	—
`--max-cpu`	CPU percent threshold (max ≈ `100 × cpu_count`)	none
`--max-rss`	Resident memory cap (`512M`, `1G`, `1.5Gib`)	none
`--max-runtime`	Wall-clock limit (`30s`, `5m`, `1h`)	none
`--cooldown`	Min seconds between repeat alarms	`300` (5m)
`--interval`	Sample period	`2s`
`--once`	At most one alarm per threshold type	off

On start:

task abc12 started.

When a threshold fires (Telegram configured):

[task abc12] alarm fired: max_cpu … (telegram delivered)

Typical demo workflow:

/trust on (optional — skips /watch confirmation)
/watch <pid> --max-cpu 80 — use a real PID (e.g. the REPL’s Python process)
/watches — confirm running status and threshold string
/unwatch abc12 — request stop; /watches should show cancelled

Quoted values are supported: /watch 12345 --max-cpu "80".

`/watches`

/watches

Watchdog-only view with columns: id, pid, status, started, thresholds (from command summary), last sample (live CPU/RSS from progress line).

`/unwatch`

/unwatch abc12

Cancels a watchdog task by task id. Using /cancel also works; /unwatch validates the task kind.

`/watchdog`

CLI-parity syntax (subprocess to opensre watchdog):

/watchdog --pid 12345 --max-rss 1G --max-cpu 80

Prefer /watch inside the REPL — it registers tasks for /watches and /tasks automatically.

Agents and alerts

Fleet coordination is documented further on Agents. Register discovered agents with opensre fleet scan --register before /fleet trace targets them.

`/fleet`

/fleet
/fleet budget
/fleet budget cursor-agent 5.00
/fleet bus
/fleet claim feature-x my-agent
/fleet release feature-x
/fleet conflicts
/fleet kill 12345
/fleet kill 12345 --force
/fleet trace 12345
/fleet wait 12345 --on 67890
/fleet graph

Subcommand	Behavior
(none)	Dashboard: registered + discovered agents (Cursor, Claude Code, Codex, Aider, …) with pid, uptime, CPU, tokens/min, $/hr, status
`budget`	View hourly budgets from `~/.opensre/agents.yaml`
`budget <agent> <usd>`	Set `hourly_budget_usd` for one agent
`bus`	Live-tail cross-agent context bus until Ctrl+C
`claim <branch> <agent>`	Exclusive branch claim (agent must be in registry)
`release <branch>`	Release a claim
`conflicts`	File-write conflict report between agents
`kill <pid> [--force]`	SIGTERM → wait → SIGKILL elevated; refuses self-PID
`trace <pid>`	Live stdout tail of agent process
`wait <pid> --on <other-pid>`	Record wait dependency for graph
`graph`	Tree of wait-on relationships

Kill confirmation: Without --force, prompts [y/N]. --force skips prompt (still elevated tier unless trust mode).

`/alerts`

/alerts

When the alert listener is active:

Field	Meaning
`status`	`listening`
`queue depth`	Alerts waiting for REPL consumption
`dropped`	Alerts dropped when queue was full
`recent`	Up to 5 latest alert names/snippets

If the listener is inactive, prints a warning. Incoming alerts also appear in /status as incoming alerts. Post alerts to your configured webhook/listener URL during setup; the REPL can start investigations from plain language.

CLI parity commands

These spawn opensre … subprocesses. Output is captured into the REPL buffer for non-interactive subcommands; wizards attach to the real TTY.

`/onboard`

/onboard
/onboard local_llm

First-run setup: LLM keys, integrations, Telegram, alert listener. Requires exclusive stdin — the REPL tears down prompt_toolkit before the wizard runs.

`/remote`

/remote health
/remote investigate
/remote ops
/remote pull
/remote trigger

Operate remote deployed OpenSRE agents (EC2, Nitro, hosted runtime). See Remote runtime investigation.

`/config`

/config show
/config set interactive.history.max_entries 1000

Read/write ~/.opensre/config.yml. Prefer env vars for secrets; use config for structured interactive-shell settings.

`/cron`

/cron list
/cron add
/cron remove <id>
/cron run <id>
/cron logs <id>

Scheduled investigation or report delivery. See Cron.

`/sentry`

/sentry digest run
/sentry digest schedule list
/sentry digest schedule add --cron "0 8 * * *" --provider telegram --chat-id <id>
/sentry digest schedule run <id>
/sentry digest schedule remove <id>
/sentry uptime check
/sentry uptime watch list
/sentry uptime watch add --cron "*/5 * * * *" --provider telegram --chat-id <id>
/sentry uptime watch run <id>
/sentry uptime watch remove <id>

Automated Sentry morning digest delivery (#10) and uptime watch notifications (#4032). Requires Sentry plus Telegram or Slack configured for the chosen provider. See Sentry.

`/messaging`

/messaging pair
/messaging allow
/messaging revoke
/messaging status

Telegram bot pairing and sender allowlist — required for /watch alarms and some delivery features.

`/hermes`

/hermes watch

Tail Hermes logs and escalate classified incidents. See Hermes and Hermes runbook.

`/guardrails`

/guardrails audit
/guardrails init
/guardrails rules
/guardrails test

Subcommand	Purpose
`init`	Scaffold local guardrail config
`rules`	List active masking rules
`test`	Run sample text through rules
`audit`	Scan recent content for sensitive patterns

Related: Masking.

`/tests`

/tests
/tests list
/tests run <test_id>
/tests synthetic
/tests cloudopsbench
/tests synthetic --scenario <name>

Form	Behavior
Bare `/tests`	Interactive multi-select picker; chosen tests run in background
`list`	Print inventoried tests (captured output)
`run`, `synthetic`, `cloudopsbench`	Background task — monitor with `/tasks`
Flags after subcommand	Passed through to CLI

Synthetic tests can run for a long time; default timeout is generous — use /cancel to stop.

`/update`

/update

Checks PyPI and upgrades OpenSRE in-place (5-minute network timeout). Non-zero exit prints CLI error code.

`/debug`

/debug sentry

Targeted smoke tests (Sentry, etc.) — subcommands match opensre debug --help.

`/uninstall`

/uninstall

Removes OpenSRE and local data. Destructive — confirmation required unless trust mode. Delegates to interactive CLI uninstall flow.

System commands

`/doctor`

Environment diagnostic distinct from /health:

/doctor

Checks Python version, venv, config paths, Docker availability, credential presence, and related local prerequisites. Each row: ok, warn, or error with detail text. Use /doctor before first install debugging; use /health before an incident to verify integrations.

`/version`

/version

Field	Example
`opensre`	Package version from install
`python`	`3.12.x`
`os`	`darwin (arm64)`

`/exit` and `/quit`

/exit
/quit

Clean shutdown with /resume hint. Prefer over killing the terminal so session files flush cleanly.

Trust mode and confirmations

Tier	Examples	Confirmation
Exempt	`/help`, `/exit`, `/trust`	Never prompts
Safe	`/status`, `/health`, `/investigate`, `/integrations list`	Read-only or standard risk
Elevated	`/save`, `/watch`, `/cancel`, `/integrations remove`, `/fleet kill`, `/uninstall`	Prompt `[y/N]` unless trust on

Non-TTY: elevated commands fail closed (error message, no side effect).

/trust on   # skip prompts for this session
/trust off  # restore prompts

Natural language actions

You do not need to memorize every slash command. Examples:

You type	Typical action
”what’s my token usage?”	`/cost`
”verify datadog”	`/verify datadog`
”show datadog config”	`/integrations show datadog`
”switch to openai gpt-4.1”	`/model set openai gpt-4.1`
”run the generic sample alert”	`/investigate generic`
”list my past sessions”	`/sessions`
”check health then list integrations”	`/health` then `/integrations list`
”how do I configure Datadog?”	Doc-grounded answer (no mutating command)

List intents — there is no global /list:

Intent	Command
Connected integrations	`/integrations list`
Tools	`/tools`
Background tasks	`/tasks`
MCP servers	`/mcp list`
Cron jobs	`/cron list`
Past REPL sessions	`/sessions`
Watchdog tasks	`/watches`

When the planner is uncertain, it asks for clarification or falls back to help — it does not silently run elevated commands. Compound requests (“health then integrations”) execute as an ordered sequence of slash actions.

Common workflows

First-time setup

/onboard
/health
/verify
/model show

Incident triage (local)

/status
/alerts
/health

Paste alert text or:

/investigate ./alerts/prod-502.json
/last
/save ./rca/prod-502.md

Pick up yesterday’s thread

/sessions
/resume 9b2e4f7a

Continue chatting, then optionally:

/new

Switch model mid-session

/model set anthropic claude-sonnet-4-20250514
/effort high
/cost

Monitor a runaway process

/watch <pid> --max-cpu 90 --max-rss 2G --cooldown 10m
/watches
/unwatch <task_id>

Debug integration failures

/integrations show datadog
/doctor
/verbose on

Troubleshooting

Symptom	Try
`unknown command`	`/help`; check spelling; use suggested correction
Elevated command blocked in CI	Use CLI equivalent (`opensre investigate …`) or run interactively
`/cost` shows zero	No LLM turns yet this session; chat once and retry
`/resume` not found	Run `/sessions`; use longer ID prefix
`/resume` ambiguous prefix	Add more characters from Session ID column
`/model set` missing credential	`/auth login <provider>` or export `ANTHROPIC_API_KEY` / etc.; use `/auth verify <provider>` for stale metadata
`/watch` Telegram error	Configure messaging via `/messaging status`
`/integrations show` not found	Run `/integrations list` for exact service slug
History pause not working	Requires redacting backend — see `/privacy`
Garbage in next prompt after table	Known TTY issue — upgrade OpenSRE; report if persistent

Session History — persistence format, privacy, /new vs /clear
Interactive Shell Privacy — redaction, env vars, threat model
Investigation overview — RCA workflow, plain-language actions, CLI investigate
LLM providers — /model and /effort
Agents — fleet dashboard, bus, trace, budgets
Cron — /cron scheduled deliveries
Hermes — /hermes watch
Remote runtime investigation — /remote

​How the REPL works

​Quick reference

​Help and exit

​Session

​Investigation

​Integrations, models, and tools

​Privacy and history

​Tasks and background work

​Watchdog

​Agents and alerts

​CLI parity

​System

​Commands with interactive menus (TTY)

​Using /help

​Session commands

​/status

​/cost

​/context

​/effort

​/trust

​/verbose

​/clear

​/compact

​/sessions

​/resume

​/new

​Exit paths

​Investigation commands

​/investigate

​/template

​/last

​/save

​Integrations, models, and tools

​Choosing the right diagnostic command

​/health

​/verify

​/integrations

​/mcp

​/model

​/tools

​Privacy and history

​/history

​/privacy

​Tasks and background work

​Task kinds

​Task statuses

​/tasks

​/cancel

​/stop

​/background

​Watchdog commands

​/watch

​/watches

​/unwatch

​/watchdog

​Agents and alerts

​/fleet

​/alerts

​CLI parity commands

​/onboard

​/remote

​/config

​/cron

​/sentry

​/messaging

​/hermes

​/guardrails

​/tests

​/update

​/debug

​/uninstall

​System commands

​/doctor

​/version

​/exit and /quit

​Trust mode and confirmations

​Natural language actions

​Common workflows

​First-time setup

​Incident triage (local)

How the REPL works

Quick reference

Help and exit

Session

Investigation

Integrations, models, and tools

Privacy and history

Tasks and background work

Watchdog

Agents and alerts

CLI parity

System

Commands with interactive menus (TTY)

Using `/help`

Session commands

`/status`

`/cost`

`/context`

`/effort`

`/trust`

`/verbose`

`/clear`

`/compact`

`/sessions`

`/resume`

`/new`

Exit paths

Investigation commands

`/investigate`

`/template`

`/last`

`/save`

Integrations, models, and tools

Choosing the right diagnostic command

`/health`

`/verify`

`/integrations`

`/mcp`

`/model`

`/tools`

Privacy and history

`/history`

`/privacy`

Tasks and background work

Task kinds

Task statuses

`/tasks`

`/cancel`

`/stop`

`/background`

Watchdog commands

`/watch`

`/watches`

`/unwatch`

`/watchdog`

Agents and alerts

`/fleet`

`/alerts`

CLI parity commands

`/onboard`

`/remote`

`/config`

`/cron`

`/sentry`

`/messaging`

`/hermes`

`/guardrails`

`/tests`

`/update`

`/debug`

`/uninstall`

System commands

`/doctor`

`/version`

`/exit` and `/quit`

Trust mode and confirmations

Natural language actions

Common workflows

First-time setup

Incident triage (local)