Workflow
Diagnostics
porthole probe — collect read-only diagnostics into a shareable report.
porthole probe replaces the "can you run these twenty commands and paste the
output" exchange with one command.
porthole probe
porthole probe --profile nodejs -o report.json| Flag | Default | Description |
|---|---|---|
--profile <name> | default | One of default, web-server, nodejs, python, database, kubernetes, docker. |
--dry-run | false | List the commands that would run, without executing them. |
--output <path>, -o | none | Write the report to a file. Without it, a summary goes to stdout. |
--include <cmd> | none | Additional command to run. Repeatable. |
--json | false | Print the full report as JSON to stdout. |
--no-mask | false | Do not redact credentials from the captured output. |
How it stays safe
Probe never invokes a shell. Commands are executed directly with an explicit
argument list, so pipes, redirects, ; chaining, and command substitution are
not features that exist — there is no interpreter to inject into.
Layered on top:
- Only binaries on a built-in allowlist may run.
- Executables must be bare names resolved through
PATH, so/bin/shcannot be reached by path. - Arguments matching credential material (
~/.ssh/id_*,.aws/credentials,.env,/etc/shadow,*.pem, …) are refused. - Diagnostics run with a minimal environment and cannot inherit your secrets.
- Each command is bounded by a timeout and an output cap.
$ porthole probe --include "rm -rf /"
porthole: command "rm -rf /": "rm" is not on the probe allowlist
$ porthole probe --include "cat ~/.ssh/id_rsa"
porthole: command "cat ~/.ssh/id_rsa": refusing to read "~/.ssh/id_rsa"Run porthole probe --dry-run to see exactly what will execute before it does.
Output is credential-masked by default, because a report is a file that ends
up in issue trackers and chat threads. The same best-effort caveat as
--mask applies — read the report before you paste
it somewhere public.