help
CommandShow available THRUNT threat hunting commands and artifact layout
Systematic debugging with persistent state across context resets
name: thrunt:debug description: Systematic debugging with persistent state across context resets argument-hint: "[issue description]" allowed-tools: - Read - Bash - Task - AskUserQuestion
<objective> Debug issues using scientific method with subagent isolation.
**Orchestrator role:** Gather symptoms, spawn thrunt-incident-debugger agent, handle checkpoints, spawn continuations.
**Why subagent:** Investigation burns context fast (reading files, forming hypotheses, testing). Fresh 200k context per investigation. Main context stays lean for user interaction. </objective>
<available_agent_types> Valid THRUNT subagent types (use exact names — do not fall back to 'general-purpose'):
</available_agent_types>
<context> User's issue: $ARGUMENTS
Check for active sessions:
ls .planning/debug/*.md 2>/dev/null | grep -v resolved | head -5
</context>
<process>
INIT=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" state load)
if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fiExtract `commit_docs` from init JSON. Resolve debugger model:
debugger_model=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" resolve-model thrunt-incident-debugger --raw)
If active sessions exist AND no $ARGUMENTS:
If $ARGUMENTS provided OR user describes new issue:
Use AskUserQuestion for each:
1. **Expected behavior** - What should happen? 2. **Actual behavior** - What happens instead? 3. **Error messages** - Any errors? (paste or describe) 4. **Timeline** - When did this start? Ever worked? 5. **Reproduction** - How do you trigger it?
After all gathered, confirm ready to investigate.
Fill prompt and spawn:
<objective>
Investigate issue: {slug}
**Summary:** {trigger}
</objective>
<symptoms>
expected: {expected}
actual: {actual}
errors: {errors}
reproduction: {reproduction}
timeline: {timeline}
</symptoms>
<mode>
symptoms_prefilled: true
goal: find_and_fix
</mode>
<debug_file>
Create: .planning/debug/{slug}.md
</debug_file>Task(
prompt=filled_prompt,
subagent_type="thrunt-incident-debugger",
model="{debugger_model}",
description="Debug {slug}"
)**If `## ROOT CAUSE FOUND`:**
**If `## CHECKPOINT REACHED`:**
**If `## INVESTIGATION INCONCLUSIVE`:**
When user responds to checkpoint, spawn fresh agent:
<objective>
Continue debugging {slug}. Evidence is in the debug file.
</objective>
<prior_state>
<files_to_read>
- .planning/debug/{slug}.md (Debug session state)
</files_to_read>
</prior_state>
<checkpoint_response>
**Type:** {checkpoint_type}
**Response:** {user_response}
</checkpoint_response>
<mode>
goal: find_and_fix
</mode>Task(
prompt=continuation_prompt,
subagent_type="thrunt-incident-debugger",
model="{debugger_model}",
description="Continue debug {slug}"
)</process>
<success_criteria>
</success_criteria>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…