Slash commands

A message whose first character is / is a command, on every surface — the web chat composer, the CLI REPL, and connected messaging channels. One shared registry serves them all, so the same command works the same way everywhere it is available.

Typing commands

Type / at the start of the composer to open an accessible command popup listing everything available on that surface, with usage and descriptions; keep typing to filter, then pick with the keyboard or pointer. In the CLI REPL, type the command directly (a one-shot holaryn run "/command args" also dispatches it).

The grammar is deterministic — no model turn is involved:

Line 1 carries the command name and inline arguments: /name arg1 arg2.
Lines 2 and onward become the command's body verbatim.
To send a message that literally starts with a slash, escape it with a backslash: \/name ... sends the literal text /name .... A leading space also opts out.

Names are lowercase ASCII ([a-z0-9][a-z0-9-]*), optionally namespaced as namespace:name. Bare names resolve builtin → project → user, in that order — an installed pack, skill, or MCP server can never shadow a builtin or one of your own commands.

Built-in commands

Every install ships four builtins:

/help                                       List the commands available here
/mode ask|selective|allow-all|unrestricted  Change the autonomy posture
/dryrun on|off                              Toggle dry-run staging of irreversible actions
/user-guide [topic|search <query>]          Browse the user guide, or search it

/mode and /dryrun are control-plane commands: a surface must grant the matching capability, so messaging channels and the scheduler refuse them by construction, and the CLI REPL offers only /dryrun among them (its posture is fixed at start). /help and /user-guide work everywhere — /user-guide alone lists the topics, /user-guide memory opens a page, and /user-guide search how to add a model searches the whole guide. See autonomy-and-approvals.md. The names help, mode, dryrun, model, and user-guide are reserved and can never be claimed by user commands or packs.

Your own commands: TOML files

Drop a <name>.toml file into ~/.holaryn/commands/ (user-wide) or ./.holaryn/commands/ (per project; shadows a user command of the same name). The file stem is the command name. A bad file becomes a visible diagnostic, never a broken registry.

A prompt command submits an interpolated prompt to the agent:

version = 1
description = "Summarize a file at a given detail level"
type = "prompt"
prompt = "Summarize {{path}} at {{level}} detail. Extra context:\n{{body}}"

[[args]]
name = "path"
description = "File to summarize"
required = true

[[args]]
name = "level"
default = "medium"

Invoke it as /summarize notes.md high or with keywords: /summarize path=notes.md level=high. Three placeholders are always available without declaring them: {{args}} (the raw first-line remainder) and {{body}} (lines 2+). Substitution is single-pass and terminal — an argument value can never smuggle in another command or placeholder.

Script and app commands (approval-gated)

A command can run a program instead of submitting a prompt. These execute through the same approval gate the agent's own tool calls use — the approval card shows the exact argv that will run, and your autonomy posture and policy rules apply unchanged.

version = 1
description = "Ping a host"
type = "script"

[script]
command = ["ping", "-n", "3", "{{host}}"]
timeout_seconds = 30

[[args]]
name = "host"
required = true

version = 1
description = "Open the calculator"
type = "app"

[app]
command = ["calc.exe"]

Rules enforced at load time: the command is always an argv list (never a shell string), placeholders are not allowed in the executable itself, .bat/.cmd targets are refused (cmd.exe re-parses arguments), and .ps1 scripts must be invoked as ["powershell", "-NoProfile", "-File", <path>, ...]. Script timeouts cap at 600 seconds. Script commands carry the command.script consequence category (irreversible unless the file declares reversible = true under [script]); app launches carry command.app and always keep a human in the loop — even under the unrestricted posture, because a launched app cannot be captured or killed.

Sequence commands (macros / runbooks)

A sequence command chains up to 32 steps — prompts, other commands, and scripts — with shared arguments:

version = 1
description = "Morning routine"
type = "sequence"

[[steps]]
kind = "prompt"
text = "Summarize my unread email."

[[steps]]
kind = "command"
name = "standup-notes"
args = "{{args}}"

[[steps]]
kind = "script"
command = ["python", "sync.py"]
on_error = "continue"

Steps run in order; a failing step stops the sequence unless it sets on_error = "continue". Sequences cannot nest, and control-plane commands (/mode, /dryrun) can never be referenced from a step — a sequence cannot escalate its own autonomy. Script steps go through the approval gate like any other gated command.

Command packs

A pack is a shareable directory of command files plus a pack.toml manifest (id and description). Installed packs contribute namespaced commands: a pack git-helpers containing cut.toml provides /git-helpers:cut. Install one from Settings → Commands (from a local folder path or a git URL, optionally pinned to a ref) — nothing executes at install; a pack's script commands only ever run later through the approval gate. Each install records a content hash, re-verified at every load: a tampered pack disables itself with a visible warning. Install review also flags pack commands whose names shadow or closely resemble a builtin.

Skills and MCP prompts as commands

Two more sources appear automatically:

Installed skills are listed as /skill:<id>. Running one activates the skill — its instructions are injected as a turn, plus anything you typed after the name as the task. See skills.md.
MCP server prompts are listed as /<server>:<prompt> with the prompt's declared arguments. Fetched prompt text from a server you have not marked trusted is wrapped in the same untrusted framing as MCP tool results, and it is submitted as plain text — never re-parsed for further commands. MCP prompt commands become available once a session's MCP connections exist. See tools-and-mcp.md.

Settings → Commands

The Commands page in Settings shows the full catalog with each command's source and any load diagnostics, lets you enable/disable individual user commands, includes a create/edit form for prompt commands (written as managed TOML files you can still edit by hand), and manages packs: install, enable/disable, and delete.

← Previous Skills Next → Sounds