help
CommandShow available THRUNT threat hunting commands and artifact layout
Manage persistent context threads for cross-session work
name: thrunt:thread description: Manage persistent context threads for cross-session work argument-hint: "[name | description]" allowed-tools: - Read - Write - Bash
<objective> Create, list, or resume persistent context threads. Threads are lightweight cross-session knowledge stores for work that spans multiple sessions but doesn't belong to any specific phase. </objective>
<process>
**Parse $ARGUMENTS to determine mode:**
<mode_list> **If no arguments or $ARGUMENTS is empty:**
List all threads:
ls .planning/threads/*.md 2>/dev/null
For each thread, read the first few lines to show title and status:
## Active Threads | Thread | Status | Last Updated | |--------|--------|-------------| | fix-deploy-key-auth | OPEN | 2026-03-15 | | pasta-tcp-timeout | RESOLVED | 2026-03-12 | | perf-investigation | IN PROGRESS | 2026-03-17 |
If no threads exist, show:
No threads found. Create one with: /thrunt:thread <description>
</mode_list>
<mode_resume> **If $ARGUMENTS matches an existing thread name (file exists):**
Resume the thread — load its context into the current session:
cat ".planning/threads/${THREAD_NAME}.md"Display the thread content and ask what the user wants to work on next. Update the thread's status to `IN PROGRESS` if it was `OPEN`. </mode_resume>
<mode_create> **If $ARGUMENTS is a new description (no matching thread file):**
Create a new thread:
1. Generate slug from description:
SLUG=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" generate-slug "$ARGUMENTS")
2. Create the threads directory if needed:
mkdir -p .planning/threads
3. Write the thread file:
cat > ".planning/threads/${SLUG}.md" << 'EOF'
# Thread: {description}
## Status: OPEN
## Goal
{description}
## Context
*Created from conversation on {today's date}.*
## References
- *(add links, file paths, or issue numbers)*
## Next Steps
- *(what the next session should do first)*
EOF4. If there's relevant context in the current conversation (code snippets, error messages, investigation results), extract and add it to the Context section.
5. Commit:
node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" commit "docs: create thread — ${ARGUMENTS}" --files ".planning/threads/${SLUG}.md"6. Report:
## 🧵 Thread Created
Thread: {slug}
File: .planning/threads/{slug}.md
Resume anytime with: /thrunt:thread {slug}</mode_create>
</process>
<notes>
/thrunt:add-phase or /thrunt:add-backlog with context from the thread
</notes>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…