Chatting with Halon
A chat is a conversation with Halon where you ask a question or ask it to do something, and it does the work the question needs before it answers. You chat with Halon on the Chat page of the dashboard, or by mentioning @Firefight in an active incident’s channel in Slack.
In the dashboard
Section titled “In the dashboard”Open Chat under Halon in the sidebar. A new chat asks What do you want to know? above the message box. Below it are example questions to start from:
- Which incidents are open?
- What changed before an incident?
- Has this happened before?
- Set up Firefight, shown first to anyone who may change the workspace’s settings
Choosing one puts it in the message box for you to finish. Type @ to pick one of the newest active incidents, or keep typing to search for one. Press Enter to send, and Shift+Enter for a new line. You can also attach files to a message, see Giving Halon a file.
The chat is named after your first question, and only you see your own chats. Asking needs Investigations with create, which every member has unless an admin took it away. See Permissions.
While Halon works
Section titled “While Halon works”While Halon works, the chat shows its turn in the order it happened: each step it takes, and the short notes it writes as it goes, such as “The deploy went out at 14:02, so I am reading the logs from then”, as quieter lines among the steps. While it is still working, a finished stretch of several steps folds into one line saying what it did, such as Looked at 12 things · GitHub. Once it is done, the whole stretch folds away under a line such as Worked for 12s · 4 steps. Choose a folded line to open it again. A question Halon asks you, and its answer, stay in view and never fold.
Each step names what Halon did. A step through one of your connections names the call and the connection, such as Search logs · Production (Northflank), so you can tell which account it reached. Next to it is what told that step apart from the others, such as the name it looked up. Choose a step to see everything it was given.
| Mark | Meaning |
|---|---|
| Running | Halon is waiting on this step |
| Done | The step finished |
| Failed | The step was refused for lack of permission or returned an error. Halon still reads why |
| Not found | The provider answered that what Halon asked about is not there. That is an answer, not a failure |
| Refused | One of Firefight’s own rules stopped the step, such as a protected branch. Halon tells you the rule and does not look for another way around it |
| Waiting for you | The step needs your confirmation before it runs |
| Cancelled | The step did not run |
| Stopped | You stopped the answer while the step ran or before it started |
A step that failed or waits on you keeps the list open, since it needs a look.
A code fix as it happens
Section titled “A code fix as it happens”When Halon writes a code fix in a chat, the Fix code step shows what its agent is doing while it works, which can take several minutes. Under the step you see:
- The last few things the agent did, such as Read config/database.yml, Searched for ‘pool’, Edited config/routes.rb or Ran bin/rails test test/pool_test.rb, with passed or failed after a test run. The newest one is marked as where the agent is now
- How long it has been working, and the files it has changed so far
- Show 12 steps before these, which opens the earlier ones
The agent’s notes to itself show as a line starting with Thinking. A step names files and commands only, never what a file holds, and anything that looks like a password or key is hidden.
The agent starts from what you asked in your own words, including anything you corrected later in the chat, and from what Halon already read, such as a log search or a workflow file. While it works it can read your connected tools the way Halon does, as you, such as logs, deploys, CI runs, the resource map, past incidents and each provider’s own guides, so a line such as Read with github_list_workflows is the agent checking something for itself. It never changes anything through them, and each read is in Activity under Coding agent. It also reads the documentation Firefight keeps for your connected providers before it searches the web.
When the agent asks you something
Section titled “When the agent asks you something”When what to do is a choice only you can make, the agent asks. The step shows Waiting for an answer, and under it The coding agent asks with the question, explained with an example and what happens today, then two to four options. Each option says what choosing it leads to, and the one the agent recommends is marked Recommended with why. The agent recommends what matches how your code already behaves and what you asked for. Click an option to answer, or write your own answer under Something else and choose Send answer. A message confirms it reached the agent, which carries on with it. Halon answers first when what you said or what it read settles the question, and the step then shows Halon chose: or Halon answered:.
Only the person who asked for the change can answer, since it runs as you. When nobody answers before the time the step shows, five minutes after the question, the agent goes with the option it recommended, and the step says so. In a Slack thread the question is its own message with a button for each option and Something else, which opens a form, and it says who can answer and by when.
An answer can still change while the agent writes the change, whether Halon gave it, you gave it or the agent went with its recommendation. Choose Change answer under the question, pick another option or write your own answer, and choose Submit. A message confirms the new answer reached the agent, and the question shows Changed to with the new answer and who changed it. The agent is told the new answer replaces the earlier one. When it had already finished, the change goes back to it with the new answer before Halon reviews it. In a Slack thread the answered question keeps a Change answer button, which opens a form with the options and a box for your own words. Only the person who asked for the change can change the answer, and everyone else sees Change answer greyed out with who can. Once the change has finished it can no longer change. If you change it just as the change is pushed, nothing is pushed and the step says so, so ask Halon again.
Before the pull request opens
Section titled “Before the pull request opens”The agent writes the change first, then checks its own work as far as it can. A test it cannot run there, such as one that needs a database, never stops the change. The pull request still opens with that test listed under Could not run here with the reason, and your repository’s own CI runs it. A repository with no CI is said to have none in the pull request and in Halon’s answer, so your review decides (see Repository setup). Firefight then checks the files the pull request changes with what your repository has, such as its linter, its type checker, the tests the change touched and the tests for the files it changed, and a workflow linter for a GitHub Actions file. A check that cannot run there is listed as could not run with the reason, never as a problem with the change. Halon then reviews the change against what you asked, and against what the evidence and the provider’s documentation say, such as a rule an error message states. Only the pull request’s own change is checked and reviewed, even after the agent merges the base branch in to resolve a conflict. A change the review finds wrong goes back to the agent once with what the review found. When it is still wrong, nothing is opened, and the step and Halon’s answer say what the review found.
Once the pull request is open, the step sums up Halon’s review, the files it changed with the lines added and removed, the tests it ran and whether each passed the last time, the checks and how each went, and Open the pull request. Verified says what the review checked and against what, Found in review lists problems worth a look, and Open questions lists only what could not be checked and matters, such as how another system reads a value the change sends. When a change is too large to review whole, Not reviewed names the files that were left out. The files you named are always reviewed whole.
The pull request’s description says the same, written only from the change, its checks and Halon’s review, so nothing Halon read from your live systems or told the coding agent ends up in it. When Halon adds to a pull request it opened, it writes the description again for the whole change as it now stands. When Halon changes a pull request’s title, description or labels, or comments on it, it tells you what GitHub now shows.
The pull request’s title says what the change does. Its description starts with what the change does and why, then the same lists, then the files it changes. When Halon adds to a pull request that is already open, its comment says what this update changed. Halon tells you the same in the chat, in a few plain sentences. Show the steps lists everything it did. When you asked Halon to add the fix to a pull request that is already open, the step ends with Added to the pull request and the same summary. When the agent stops without a change, the step keeps its last few steps and says why.
The agent always starts from the newest commit of the branch the pull request goes into, so it does not conflict with something merged minutes earlier. When it fixes a pull request that conflicts with its base, it merges the base in and resolves the conflict, so the pull request shows a merge commit. The agent never holds your GitHub token and can push only to its own branch. A change that touches your repository’s paths Halon may not change is never opened. Halon’s answer ends with what GitHub says about the pull request, such as whether it can merge and which checks fail, and Halon never says a conflict is resolved unless GitHub does.
When a fix reaches its spending limit
Section titled “When a fix reaches its spending limit”Each fix has a spending limit for the AI it uses, $2 unless an admin set another (see Settings). When a fix reaches it before finishing, it pauses rather than failing. Its work so far is saved on a branch of its own, such as halon/fix-1a2b3c4d, and nothing is opened or changed on a pull request. A card appears in the chat under Halon’s answer, This fix has reached its spending limit before finishing. Continue?, with what the fix spent, what Continue gives it, and Continue and Stop. The step shows the same question with both buttons, and in a Slack thread it is its own message. Only the person who asked for the change can choose, since it runs as you, and approval rules apply as usual. Everyone else sees who can.
Continue is how a fix gets more to spend. It gives the fix the same limit again, the limit it paused with, and carries on where it stopped. The chat shows the fix’s progress again at once. Within about 15 minutes of pausing it picks up exactly where it was. After that it starts again from the saved branch, with what you asked, your answers to its questions and what it already changed. Stop asks you to confirm first, since it deletes the saved branch. Once you choose, the card says who chose what.
When you ask Halon to raise the limit, or why a fix stopped, it points you to Continue on the card.
After the pull request opens
Section titled “After the pull request opens”Halon follows every pull request it opens until it is merged or closed. When one conflicts with its base branch, a check fails, or a reviewer asks for changes, a card appears in the chat you asked from, such as PR #689 in acme/web needs attention, with why, what fixing it will do, Fix it and Open the pull request. In a Slack thread the same message is posted in the thread. For a chat in the dashboard it comes to you as a direct message from Firefight, with Open the chat.
Nothing on the branch changes until you choose Fix it. The fix runs as you, with your permissions and any approval rules, and only the person who asked for the change can press it. Halon then says in the chat how it went. When newer problems come in, the card says it was replaced by a new one. When the problems go away on their own, the card says GitHub no longer shows them.
Leaving the page loses nothing. Open the chat again, or from another device, and the step shows the same. In a Slack thread the step shows how far the agent got in numbers only, such as Writing the change: 14 steps, 2 files changed so far, updated every few seconds, and how it ended once it is done. It never names the files the agent read or the commands it ran there.
Adding to a question
Section titled “Adding to a question”You can keep typing while Halon works. The message box says Add something while Halon works. Whatever you send shows under the answer with Halon reads this at its next step, and joins the answer Halon is already working on rather than waiting for it to finish. Your newest message decides what Halon checks next, so use it to steer, such as “skip the database, it is the worker”.
Stopping an answer
Section titled “Stopping an answer”While Halon works and the message box is empty, the send button becomes Stop. Choose it and Halon stops at once, even in the middle of a long step such as a command in its terminal or a code fix, and ends the answer with Stopped. The message box says Stopping until it has. What Halon already did stays in the chat, a step it was running shows Stopped, nothing it had not started runs, and your next question starts clean.
Choosing the model
Section titled “Choosing the model”The message box shows which AI model Halon answers with, such as Claude Sonnet 5.5. A new chat starts on the main model of your workspace’s AI account, marked Default. Choose the model’s name to see the others you can switch to, each with a few words on what it is for, such as Everyday questions, Investigations and tricky problems or Hardest problems and production changes, costs more. Everyday models come first. When there is only one model to run, the message box shows none.
Pick a model before your first question and the new chat starts on it. Pick one in an open chat and a message confirms it, such as This chat now uses Claude Opus 5.5. The choice belongs to that chat and applies from your next question, so an answer Halon is already writing finishes on the model it started with. Choosing the default again puts the chat back on your workspace’s main model, and it follows that model if an admin changes it.
| Account’s provider | Models you can switch to |
|---|---|
| OpenRouter | Claude Haiku 5.5, GLM-5.3 Flash, GLM-5.2, DeepSeek V4.1 Flash, DeepSeek V4 Pro, Claude Sonnet 5.5, GLM-5.3, GPT-6 Sol, Claude Opus 5.5 |
| Anthropic | Claude Haiku 5.5, Claude Sonnet 5.5, Claude Opus 5.5 |
| OpenAI | GPT-6 Luna, GPT-6 Sol, GPT-6 Astra |
| Google Gemini | Gemini 3.8 Flash, Gemini 3.1 Pro |
| Google Vertex AI | Claude Haiku 5.5, Gemini 3.8 Flash, Claude Sonnet 5.5, Gemini 3.1 Pro, Claude Opus 5.5 |
| Amazon Bedrock | Claude Haiku 5.5, Claude Sonnet 5.5, GPT-6 Sol, Claude Opus 5.5 |
| DeepSeek | DeepSeek V4.1 Flash, DeepSeek V4 Pro |
| Mistral | Mistral Medium, Mistral Large 4 |
| xAI | Grok 4.3, Grok 4.7 |
The main model is always in the list, along with any of these your provider serves. Azure AI Foundry, Ollama and GPUStack run models you name yourself, so they offer only the main model.
Each answer names the model that wrote it in small text underneath, so you can compare them. When Halon moved to another account part way through an answer, both are named.
When the model you picked stops answering, or its account runs out of credit, Halon carries on with another model for that answer and says so in one line, such as Claude Opus 5.5 is not answering, so I switched to Claude Haiku 5.5 for this reply. Your next question starts on your pick again.
The choice changes only who answers you in that chat. The same account pays for it, or your Firefight credits when Halon runs on those. Investigations Halon starts, code fixes, helpers and quick work such as summaries keep their own models, and a chat in Slack always runs on the workspace’s main model.
Being told later
Section titled “Being told later”Ask Halon to tell you when something finishes, such as a CI run or a deploy, and it keeps watching after its answer and reports back in the chat and in a Slack direct message. While a watch is going, it is pinned above the message box under Watching, however far the chat scrolls. See Halon watching for you.
What Halon says before and after it acts
Section titled “What Halon says before and after it acts”When a request reaches more than one system, or could mean more than one thing, Halon first says its plan back as short numbered steps naming each system, such as “1. Start the Release workflow in acme/web. 2. Follow the release workflow it starts on Northflank. 3. Tell you when both finish.” It acts once you agree. A request that is clear and touches one system it just does.
When Halon said it cannot do something and you tell it that it can, or that you have since connected, granted or switched something on, it checks again before it answers. It then says what it found, such as “You were right, that is in the Code tools”, or what still blocks it and what would unblock it.
Halon looks up what it can find itself rather than asking you. “The latest main” means it reads which commit main is at.
An answer about a problem, or about work that just finished, ends with the most useful next step and an offer to take it, such as “Next I would read the error the webhook returned, shall I?” Halon changes nothing until you say yes, and you can say no or suggest something else. It recommends a fix only when something it read shows the cause. When the cause is still unknown, the next step it offers is the check that would show it.
What an answer can hold
Section titled “What an answer can hold”Answers are formatted text, with tables and code blocks. Code is coloured for its language, such as Ruby, TypeScript, YAML, SQL or a shell command, and a long line scrolls inside its block. Copy code on a code block copies it. A link to another site opens in a new tab, so following a source never loses the chat.
Some results are drawn rather than written.
| Card | When it appears |
|---|---|
| Charts | Halon read metrics from a connected tool. Halon places each chart in its answer right after the sentence about it, and charts it wants you to compare sit side by side. A chart it placed nowhere follows the answer. Each chart shows its title, unit and time range, and Open the live chart when the provider has one. A chart only ever shows with the answer that drew it |
| Integrations | Halon showed you a kind of integration, such as where alerts come from. Each provider shows whether it is Connected, Needs attention, Turned off or Not connected, with Connect, Reconnect or Manage. See all integrations opens the Integrations page |
| An investigation | Halon started an investigation for you. See Investigations |
Connecting from an integrations card opens the same dialog as the Integrations page, and coming back to the chat shows the provider connected. A person who cannot connect integrations sees An admin can connect this instead.
A long chat can fill the space the AI model has to work in. When Halon makes room, a quiet line says Shortened its working notes to make room. See AI data handling.
Confirming a change
Section titled “Confirming a change”Halon asks before a risky change, or one an approval rule covers. A safe change runs without asking and shows in the chat instead. See Changes without asking. The question appears at the foot of the chat as one card, saying what Halon wants to do, such as Halon wants to: restart web, with one line under it, Approve, Cancel and Details. Where the change may be allowed for the chat, an Allow for the rest of this chat tick sits above the buttons. When Halon asks about several changes at once, each is its own question in the same card. Answer each one, and while others still wait, Change reopens an answer you already gave. Halon carries on once every question is answered, the card shows Sent, and a message says how each change now stands, such as “Restart web is approved.” What each choice does, and which changes ask, is in What Halon can do.
To read the chat around a question first, close the card with its cross, and Open approval brings it back.
When a change needs someone else’s approval, Halon says it is waiting and carries on. A card in the chat shows who may approve it, and once it is approved the change runs and the card follows it until it is done. See Waiting for someone else’s approval.
Entering a secret
Section titled “Entering a secret”Some changes need a value Halon should never see, such as a secret for a GitHub Actions workflow. Halon never asks you to type it in the chat. It names the secret, and a card appears under its answer, such as Enter the value for DEPLOY_HOOK in acme/web. Click Enter value and type it in the field that opens. Firefight sends it straight to the provider and keeps no copy, and a message confirms it once it is set. The card then says who set it and when.
The field stays open for an hour and only the person who asked can fill it, since the change runs as them. Anyone else sees why the button is unavailable. When the value already exists elsewhere, such as a webhook address Halon just created in Northflank, Halon passes it across itself and the card is not needed.
A webhook address Halon creates works like a password, so Halon never shows it in its answer. A card under the step offers Reveal, which reads the address from the provider and shows it with a copy button. Only the person who asked can reveal it.
A Firefight token works the same way. When Halon creates an agent or an API key for you, or rotates an agent’s token, it never sees the token. A card under the step, named after the token, offers Show token, which shows it once with a copy button. Firefight keeps no copy, so issue a new one if it is lost. Only the person who asked can show it.
In a Slack thread, Halon posts the same card with Enter the value in Firefight or Reveal in Firefight, which opens the chat in the dashboard. You never type a secret into Slack.
Running a saved runbook
Section titled “Running a saved runbook”Ask for a saved runbook by name, such as “release Firefight”, and Halon runs its steps for you. It says what it will do and asks for anything it needs, then the confirmation lists every step with the exact tool and arguments it will use. Confirm it and the steps run one after another as you. If a step is refused, waits for an approval or fails, the run stops there and Halon says which step and why. To save a multi-step task you just did, say “remember this as” and a name. See Runbooks Halon can run.
Setting up your workspace
Section titled “Setting up your workspace”Choose Set up Firefight on a new chat, or ask Halon to help you set up Firefight. It reads what is already configured, then offers the most useful missing piece first, starting with where your alerts come from, then your code, then the rest. It goes one step at a time and changes a setting only once you agree.
Halon never connects an integration for you. It shows you the integrations of the kind you want and you connect from that card. It never asks for a key, token or password, and one pasted into the chat is not used. Halon tells you so and points you to the card.
Managing your chats
Section titled “Managing your chats”Your chats are listed beside the conversation, newest first, under Pinned, Today, Yesterday, Previous 7 days, Previous 30 days and Older. Archived chats are folded away at the end under Archived, with their count. New chat starts another. Chats you had with Halon in your Slack direct messages are listed too, marked Slack. Opening one shows the whole chat, with Open in Slack in place of the message box, since Halon answers it there.
Open a chat’s menu for these actions:
| Action | What happens |
|---|---|
| Rename | Gives the chat a new name |
| Pin / Unpin | Keeps the chat at the top of the list |
| Archive / Unarchive | Moves the chat into the folded Archived section, or back |
| Delete | Asks first, then deletes the chat with its questions, answers and files for good |
Search chats, or Ctrl+K (Cmd+K on a Mac), finds a chat by its name or its latest message. Hide chats folds the list away to give the conversation the whole width, and Show chats brings it back.
On a phone
Section titled “On a phone”On a narrow screen the page shows one thing at a time, either your chats or the open chat. All chats at the top of a chat goes back to the list.
In Slack
Section titled “In Slack”Mention @Firefight in the channel of an active incident with your question, for example @Firefight what changed in checkout in the last hour?. Halon knows which incident the channel is for and its status, and it reads the instructions and memories that apply to the incident’s services.
Firefight adds an eyes reaction to your message while Halon works on it, then answers in a thread under it. Once the answer is in, or Halon asks you to confirm something, the eyes give way to a check mark. Mention it inside a thread and the answer goes in that thread. While Halon works, Slack shows that Firefight is working and lists each step in the reply as it runs, in plain words such as Checked recent deploys or Read the code, then the answer appears. When Slack cannot show the steps, the whole answer is posted once it is ready. A long answer is never cut short. It carries on into more messages, and every link in it opens.
When Firefight cannot answer you, for example because you do not have permission, it tells you in the thread with a note only you can see, and keeps a copy in your direct messages so the reason is still there after you reload.
Charts are posted in the thread after the answer as images, each with a line saying what it shows and a link to the live chart when the provider has one. Only the charts drawn for that answer are posted. At most six are posted under one answer, followed by a note saying how many more there were. An integrations card is posted as a list with a button per provider that opens the dashboard to connect it.
Following up in a thread
Section titled “Following up in a thread”Each thread is one chat. Mention @Firefight again in the same thread and Halon carries on from what was said there, rather than starting over. Anyone in the thread can ask, and each question acts as whoever mentioned Firefight that time. Halon answers only messages that mention it.
Mentioning Firefight in the thread of an investigation that is still running adds what you wrote to the investigation instead. See Investigations.
One question at a time
Section titled “One question at a time”Halon answers one question at a time in a thread. If you mention it again while it is still answering you, your message joins that answer at its next step. If someone else mentions it meanwhile, their question waits and is answered after, as them.
Stopping and confirming in Slack
Section titled “Stopping and confirming in Slack”Use Slack’s own stop button on Firefight’s reply to stop an answer. The reply ends with Stopped.
When Halon needs a confirmation, it posts “Halon wants to:” and the change in the thread, with one line on what it does or why, and Approve, Cancel and Details, plus Allow for this chat where it may be allowed. Anyone with Investigations create can answer, and the change runs as whoever pressed the button. Once answered, the message says who approved it and follows the change until it says it is done, failed or was cancelled. If someone asks Halon something else before the question is answered, the question is withdrawn and the message says so.
Outside incident channels
Section titled “Outside incident channels”In any other channel, a mention whose first word is investigate starts an investigation, such as @Firefight investigate checkout returns 500 since 14:00. See Investigations. Any other mention outside an active incident’s channel, including in the channel of an incident that has ended, gets no answer. For questions that are not about an active incident, write to Firefight in your direct messages, or use Chat in the dashboard.
In your direct messages
Section titled “In your direct messages”Write to Firefight in your direct messages with the app, as you would on the Chat page. Halon answers as a reply under your message, with everything a thread in a channel has: its steps as it works, confirmations, approvals, plans, watches, files you attach and Slack’s stop button. Each question acts as you, with the permissions you have everywhere else.
A new message carries on the chat you had with Halon while it had a word in the last day. After a day of quiet, a new message starts a new chat. A reply in the thread of an earlier answer carries on that chat however long it has been. Reply under a message Halon sent you on its own, such as a watch update or an approval it waits on, and Halon reads that message first, so “why did that fail?” needs no more words.
These chats are listed on the Chat page with your others, marked Slack. Someone from outside your workspace who writes to the app is told Halon only answers people in this workspace.
Who Halon acts as
Section titled “Who Halon acts as”Every question acts as the person who asked it, with the same permissions they have in the dashboard. Halon can do for an admin what an admin can do, and it is refused where a member would be refused. When something is refused, Halon tells you plainly and who can do it instead. Every call it makes is recorded in Activity under your name. See What Halon can do.
When Halon cannot answer
Section titled “When Halon cannot answer”When Halon cannot finish, it says so in place of an answer, in the dashboard, in the Slack thread and to an agent asking over MCP.
| You see | Why |
|---|---|
| Halon couldn’t reach its AI just now. The team has been told. | The AI Halon runs on refused the call, and the people running Firefight have been told. Your question stays in the chat, so ask again later |
| I could not finish that one. Ask me something narrower, or start an investigation. | The question needed more work than one answer allows. Each new question gets a fresh allowance |
| Something went wrong on my side, so I did not finish that one. Ask me again. | The AI model failed to answer |
| The model sent back a reply I could not read, so I did not finish that one. | The model answered twice in a form Halon could not read. In a chat with more than one model it adds that you can ask again or pick another model |
| I was interrupted before I finished. Ask me again. | Firefight restarted while Halon worked, and the answer could not safely be picked up again, such as when it was making a change |
| The AI model is not fully set up yet. An admin needs to finish setting it up. | The AI model is not set up. In Slack only you see this. In the dashboard you are sent back to the Incidents page with it |
| You don’t have permission to do that in Firefight (investigations.create). Ask a workspace admin to grant you investigations access under Gateway, Permissions. | An admin took asking Halon away from you. In Slack only you see this. In the dashboard the message says you don’t have permission to change investigations, and your question is not sent |
If you run Firefight yourself and its AI account runs out, the message is “Halon couldn’t reach its AI just now.” It adds that the team has been told only once your install sends alerts to a Slack webhook. When your workspace runs Halon on its own AI accounts, the message starts “Halon cannot answer right now because” and names the problem (no AI account set up, an account out of credit or a refused key), then says an admin can fix it under Settings, Workspace, AI accounts. When this month’s included AI and your Firefight credits are used up, it says what ran out and where an admin tops up.