Halon's terminal

Halon has a terminal, a Linux sandbox where it runs shell commands and scripts of its own. It uses it when a question needs more than one tool call can give, such as counting the errors in a large log, grouping a hundred CI runs by the test that failed, or checking how your site answers from outside.

The terminal works in chats and in investigations. It starts the first time Halon needs it. In a chat it stays for later questions and stops once it has gone unused for 15 minutes. In an investigation it stops when the investigation ends.

What Halon does there

Each command shows as a Run command step in the chat or investigation, with the command it ran.

• Large results. When a tool’s answer is too large to read whole, Halon can place it in the terminal as a file and run a script over it, so it reads only the answer, such as a count per status code. A large file you give Halon in a chat can be placed the same way.
• Scripts. The sandbox has Python, Ruby, jq, awk, SQLite, curl and dig.
• Your connected tools. A script calls any connected tool Halon could call in that chat with Firefight’s own command, ff, such as ff search_logs resource=checkout minutes=30. Each call runs as the person who asked and is recorded in Activity like any other call Halon makes.
• Provider command line tools. With Northflank connected, northflank works in the terminal against your connection, for anything inside a project. With Kubernetes connected, kubectl reads your cluster, such as kubectl get pods -n checkout, and never changes it. With several connections to one provider, Halon names the one it means.

A command runs for up to 2 minutes unless Halon gives it longer, and never more than 15 minutes. One command can make up to 500 calls to your tools.

Keys stay out

The sandbox holds no key, token or password of yours. A call a command makes goes through Firefight, which checks the person’s permissions and your approval rules, adds the connection’s key itself and records the call.

Changes ask first

A command that only reads runs without asking. A command that changes something through a connected tool, such as restarting a service, asks you first, like any other change Halon makes. The question says what Halon wants to do, with the command under Details, and you answer with Approve or Cancel, or allow it for the rest of the chat, as described in Asking before a change.

Allow for the rest of this chat stops covering commands once Halon has read something from outside, such as a log line or an issue, so each command after that asks again. Without your confirmation, any call in the command that would change something is refused and nothing changes.

Some changes are never made from a command, even a confirmed one: writing rows in a database, stopping something someone else started, a change customers feel for a while such as a block or a feature flag, and a change to who can reach something or to a secret, such as setting a GitHub Actions secret. Halon makes those with the tool itself, so you are asked about that one call with what it will touch. Approval rules still apply to each call the command makes, so a call a rule holds waits for its approvers. An investigation only reads, so a change from its terminal is always refused.

Checking an address from outside

Halon can check an address the way a user reaches it. It reports:

Check	What you see
DNS	The A, AAAA and CNAME records, with how long each is cached
HTTP	The status, any redirects, the address that answered, and how long each part took (DNS, connect, TLS, first byte, total)
Certificate	Who it was issued to and by, when it expires and how many days are left, whether it covers the host, and whether it is trusted

The check runs from the sandbox, so it sees your site from one place, and Halon says which region that is. A certificate that expires within two weeks is called out. Only GET and HEAD requests are made, so a check never changes anything.

To see an address from several regions, connect an uptime monitor such as OpenStatus, Better Stack or Honeybadger. Halon then reads that monitor’s own checks, region by region, and says which monitor it used.

Where it is recorded

Every command and every outside check is in Activity as sandbox.read, under Halon with the access of the person who asked in a chat, such as Halon, for Maya Ortiz, and under Halon in an investigation. Each call a command makes to a connected tool is recorded as that tool, the same as when Halon calls it directly.