help
CommandShow available THRUNT threat hunting commands and artifact layout
Reapply local modifications after a THRUNT update
description: Reapply local modifications after a THRUNT update allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
<purpose> After a THRUNT update wipes and reinstalls files, this command merges user's previously saved local modifications back into the new version. Uses intelligent comparison to handle cases where the upstream file also changed. </purpose>
<process>
Check for local patches directory:
# Global install — detect runtime config directory
if [ -d "$HOME/.config/opencode/thrunt-local-patches" ]; then
PATCHES_DIR="$HOME/.config/opencode/thrunt-local-patches"
elif [ -d "$HOME/.opencode/thrunt-local-patches" ]; then
PATCHES_DIR="$HOME/.opencode/thrunt-local-patches"
elif [ -d "$HOME/.gemini/thrunt-local-patches" ]; then
PATCHES_DIR="$HOME/.gemini/thrunt-local-patches"
else
PATCHES_DIR="$HOME/.claude/thrunt-local-patches"
fi
# Local install fallback — check all runtime directories
if [ ! -d "$PATCHES_DIR" ]; then
for dir in .config/opencode .opencode .gemini .claude; do
if [ -d "./$dir/thrunt-local-patches" ]; then
PATCHES_DIR="./$dir/thrunt-local-patches"
break
fi
done
fiRead `backup-meta.json` from the patches directory.
**If no patches found:**
No local patches found. Nothing to reapply. Local patches are automatically saved when you run /thrunt:update after modifying any THRUNT workflow, command, or agent files.
Exit.
## Local Patches to Reapply
**Backed up from:** v{from_version}
**Current version:** {read VERSION file}
**Files modified:** {count}
| # | File | Status |
|---|------|--------|
| 1 | {file_path} | Pending |
| 2 | {file_path} | Pending |For each file in `backup-meta.json`:
1. **Read the backed-up version** (user's modified copy from `thrunt-local-patches/`) 2. **Read the newly installed version** (current file after update) 3. **Compare and merge:**
**Merge strategy:**
4. **Write merged result** to the installed location 5. **Report status:**
After reapplying, regenerate the file manifest so future updates correctly detect these as user modifications:
# The manifest will be regenerated on next /thrunt:update # For now, just note which files were modified
Ask user:
## Patches Reapplied
| # | File | Status |
|---|------|--------|
| 1 | {file_path} | ✓ Merged |
| 2 | {file_path} | ○ Skipped (already upstream) |
| 3 | {file_path} | ⚠ Conflict resolved |
{count} file(s) updated. Your local modifications are active again.</process>
<success_criteria>
</success_criteria>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…