help
CommandShow available THRUNT threat hunting commands and artifact layout
Manage parallel workstreams — list, create, switch, status, progress, complete, and resume
description: Manage parallel workstreams — list, create, switch, status, progress, complete, and resume
Manage parallel workstreams for concurrent milestone work.
`/thrunt:workstreams [subcommand] [args]`
| Command | Description | |---------|-------------| | `list` | List all workstreams with status | | `create <name>` | Create a new workstream | | `status <name>` | Detailed status for one workstream | | `switch <name>` | Set active workstream | | `progress` | Progress summary across all workstreams | | `complete <name>` | Archive a completed workstream | | `resume <name>` | Resume work in a workstream |
Parse the user's input to determine which workstream operation to perform. If no subcommand given, default to `list`.
Run: `node "$THRUNT_TOOLS" workstream list --raw --cwd "$CWD"` Display the workstreams in a table format showing name, status, current phase, and progress.
Run: `node "$THRUNT_TOOLS" workstream create <name> --raw --cwd "$CWD"` After creation, display the new workstream path and suggest next steps:
Run: `node "$THRUNT_TOOLS" workstream status <name> --raw --cwd "$CWD"` Display detailed phase breakdown and state information.
Run: `node "$THRUNT_TOOLS" workstream set <name> --raw --cwd "$CWD"` Also set `THRUNT_WORKSTREAM` env var for the current session.
Run: `node "$THRUNT_TOOLS" workstream progress --raw --cwd "$CWD"` Display a progress overview across all workstreams.
Run: `node "$THRUNT_TOOLS" workstream complete <name> --raw --cwd "$CWD"` Archive the workstream to milestones/.
Set the workstream as active and suggest `/thrunt:resume-work --ws <name>`.
Format the JSON output from thrunt-tools into a human-readable display. Include the `${THRUNT_WS}` flag in any routing suggestions.
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…