Tools and task types
/tools lists visible/executable tools by mode and plan; /tools desc adds descriptions, not toggles. Registration does not guarantee permission to execute.
D = direct action; P = agent task; D+P = pre-action already performed, followed by an agent task. Direct actions may send model requests, access the network or change files; they are not necessarily free or read-only.
/tools desc
/web https://example.com
/test gen src/example.ts
/docs src/example.ts
/mermaid project architecture
/web <url> fetches up to 30,000 characters and then requests a summary. External content is not an instruction. /test gen|generate [target] requests writing, running and fixing tests on Pro or above; without a target, it uses the project. It has no watch, coverage or run flag. /docs [target] requests documentation for the target or project on Pro or above, without an output-format flag. /mermaid [target] requests diagram code, not automatic file creation or rendering.
TDD and prompt editor
Warning: TDD feature tasks and /tdd-implement may change files, run tests and create commits.
/tdd warn
/tdd strict
/tdd Add validation for empty usernames
/tdd-implement
/tdd off
/edit
/tdd on means warn. Feature text enables strict and requests RED/GREEN/REFACTOR, including tests and commits. Without arguments it shows help, not status. /tdd-implement requests implementation of existing tests, refactoring and a commit, but does not itself enable a guard. Check the existing test tooling; not every project has npm test.
/edit opens a temporary prompt editor, not an arbitrary project file. It uses EDITOR, then VISUAL, then vi. There is no /editor alias. Closing the editor submits its text as the task.
Native review and security analysis
Warning: Analyses can incur costs and overwrite report files without another dialog. Security findings are uploaded by default. Review destinations and data disclosure first.
/review --staged --json review-results.json
/security-review --diff --focus auth --html
/review (alias /code-review) and /security-review (alias /scan) run native analyses on Pro or above; they are not merely prompt templates. Supply option values as separate arguments: --html, --json <path>, --model <public selection>, --tier <max|eu|custom>, --provider <eu|anthropic|openai|openai-global|gemini|global|lurus>. Use public selections, not internally resolved identifiers.
| Analysis | Additional flags/defaults | Effect |
|---|---|---|
| Security | --diff, --diff-base <ref>, --focus <crypto|auth|injection|supply-chain>; default whole project | HTML security-report.html/JSON target, findings uploaded by default, no patches. |
| Review | --full, --staged, --diff-base <ref>, --no-prechecks; diff by default, full and staged off, prechecks on | HTML code-review-report.html/JSON target, no findings upload here/patch application. |
Reports can overwrite without another dialog. Cancellation or an exhausted balance can leave partial results. Native analysis is not proof of complete security. CI/CD covers headless exits and PR actions.
Git and external actions
Git and, for GitHub workflows, available/authenticated gh are prerequisites.
Warning: These commands may initiate commits, branches, file changes and externally visible pull requests. Cancelling later does not automatically undo completed pre-actions. Select the intended command deliberately.
/commit Improve validation tests
/create-pr --draft --reviewer team-name --label tests
/analyze-issue 42
/fix-issue 42
/fix-pr
/changelog
| Command | Type/effect |
|---|---|
/commit [message] | D: Checks Git diff and offers git add -A if needed, defaulting to No. Generates a message when absent. Commit/Edit/Cancel dialog defaults to Cancel; no further dialog after Edit and no push. |
/create-pr [--draft] [--reviewer <value>] [--label <value>] | D+P: checks gh/auth/log, then requests gh pr create; base determined, no own base/title/body flags. PRs are externally visible; approve actual creation deliberately. |
/analyze-issue <number> | D+P: issue fetch/analysis asks for read-only, does not enforce a read-only mode. |
/fix-issue <number> | D+P: issue fetch/branch attempt fix/issue-N, continues with fix/test task even if branch creation fails. |
/fix-pr | D+P: Fetches comments on the current PR and requests fixes. No PR-number argument or automatic push. |
/changelog | D+P: Git since latest tag, otherwise HEAD~20; Keep-a-Changelog request, not a deterministic file writer. |
Replace the example number 42 with the actual issue number. Cancellation after a pre-action does not automatically undo it. Do not infer pushing/PRs/commits from a read-only request.
Diff and undo
Warning: Undo restores older contents in paths affected by the agent. Your later edits in those same paths may also be overwritten. There is no further confirmation after selection. Review and protect your changes, and check /undo list first.
/diff
/undo list
/undo 1
/undo all
/diff shows checkpoint changes since session start with a 60-line patch preview. /undo list lists available project checkpoints. With /undo N, 1 is the newest checkpoint; all selects the oldest retained project checkpoint, not necessarily the start of the session. Restoration is limited to agent-affected paths and truncates checkpoint history from the selected target onwards. /undo without arguments restores directly if only one checkpoint exists. /rewind chat changes messages only.
Reports and status
Warning: /report overwrites files with the same name without another dialog. Opening the HTML report loads an external chart library. Review contents before sharing.
/report
/report --json diagnostics.json
/report writes lurus-report.html and opens the browser. /report --json [filename] defaults to lurus-report.json. Only the filename portion of a JSON path is used, not an arbitrary target directory. Reports contain metadata and counters, not full transcripts.
/help shows static help, not filtered search. /stats shows duration, model, mode, turns and tool definitions; the definition count is not the tool-call count. /cost shows tokens and costs, including cache usage, but is not a billing guarantee. /status shows session, budget, context and proxy information.
Troubleshooting
For missing tools, check the mode, plan and permission rules. For missing tests, check the scripts and frameworks that actually exist. After a failed Git pre-action, inspect the current state rather than assume rollback. Before undo, inspect retained checkpoints and affected paths.
Next: permissions, automation.