investigate

investigate is a command for Claude Code from Ramsbaby/jarvis. It costs 59 tokens per session (3,238 once invoked), scanned A, original, MIT.

A command for tracing the underlying cause of failures and reproducible bugs using a structured chain of questions. It is designed for incidents such as failed scheduled jobs, stopped bots, and unresponsive services.

In plain words
What is it for?
Use it to investigate error logs, collect reproduction details, compare failures with known mistakes, and build a root-cause chain before changing the system.
Why use it?
It separates finding the cause from temporarily hiding the symptoms. This helps avoid applying a fix that leaves the real problem in place or makes later debugging harder.

Command for Claude Code

Written for Claude Code: a Claude Code command (commands/*.md). Also seen: names the AskUserQuestion tool; built for gstack.

Good fit Use it to investigate error logs, collect reproduction details, compare failures with known mistakes, and build a root-cause chain before changing the system.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/ramsbaby/jarvis/investigate
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/Ramsbaby/jarvis

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for investigate

README.md
[![agentmods](https://agentmods.dev/badge/commands/ramsbaby/jarvis/investigate.svg)](https://agentmods.dev/commands/ramsbaby/jarvis/investigate)
Your own site
<a href="https://agentmods.dev/commands/ramsbaby/jarvis/investigate"><img src="https://agentmods.dev/badge/commands/ramsbaby/jarvis/investigate.svg" alt="Measured on agentmods" height="20"></a>
Per session 59 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,238 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00059 $0.03238
Opus 5 $0.00030 $0.01619
Sonnet 5 $0.00012 $0.00648
Haiku 4.5 $0.00006 $0.00324

Measured 8d ago against content hash b0efb7be67b8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

investigate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

dotfiles/claude/commands/investigate.md · 330 lines

How it starts

The opening of the file, as written. The whole thing — 330 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Investigate — 5 Why 근본 원인 체인 추적

이 커맨드는 gstack의 /investigate를 Jarvis 페르소나·한국어 환경에 맞춰 이식한 것입니다. 목적은 증상 억제가 아니라 근본 원인(root cause) 발견입니다.


🎯 발동 조건

  • 크론 작업 실패, LaunchAgent 비정상 종료, 봇 무응답 등 장애
  • 재현 가능한 버그의 원인 추적
  • "왜 실패했어?" / "근본 원인이 뭐야?" / "investigate" 요청

🧭 기존 Jarvis 도구와의 역할 구분

세 스킬은 상호 보완 관계입니다. 혼동 금지.

  • doctor (증상 레벨) — "지금 다 정상이야?"
  • /investigate (원인 레벨) — "왜 실패했지?"
  • crisis (조치 레벨) — "봇 죽었어, 일단 살려"

흐름 예: crisis로 지혈 → /investigate로 원인 추적 → doctor로 정기 점검.


🏛️ Iron Law

근본 원인 확인 없이 수정 금지 (NO FIXES WITHOUT ROOT CAUSE).

증상만 고치는 수정은 다음 버그를 더 찾기 어렵게 만듭니다.


🔗 Phase 0 — 사전 조사

0.1 auto-diagnose 결과 수집

if [ -x ~/jarvis/scripts/auto-diagnose.sh ]; then
  ~/jarvis/scripts/auto-diagnose.sh --json > /tmp/investigate-symptoms.json
fi

이 결과는 증상 스냅샷입니다. 이 스킬의 역할은 원인 체인을 찾는 것.

0.2 오답노트 스캔

if [ -f ~/jarvis/runtime/wiki/meta/learned-mistakes.md ]; then
  grep -A 3 -i "$KEYWORD" ~/jarvis/runtime/wiki/meta/learned-mistakes.md || true
fi

과거 패턴 매칭 시 주인님께 즉시 보고: "이전 학습된 실수 패턴과 유사합니다. 파일: [경로], 발생일: [날짜]."


📋 Phase 1 — 근본 원인 조사

1.1 증상 수집

  • 에러 메시지, 스택 트레이스, 재현 절차 전문 확보
  • AskUserQuestion으로 한 번에 하나씩 질문
  • 로그: ~/.jarvis/logs/, ~/Library/Logs/jarvis/

1.2 코드 경로 추적

  • Grep으로 증상 발생 지점부터 역방향 추적
  • Read로 각 호출 지점 로직 확인
  • 전체 파일 읽기 금지 — Serena MCP 활용

1.3 최근 변경 확인 (회귀)

git log --oneline -20 -- <파일>
git diff HEAD~5 -- <파일>

이전에 동작했다면 회귀(regression). 근본 원인은 diff 안에 있습니다.

1.4 결정론적 재현

  • 타이밍 의존 → 경쟁 상태
  • 환경 의존 → 환경 변수 / DB 상태 / 캐시
  • 재현 불가 버그에 추측 수정 금지. 로깅 추가 → 다음 발생 대기.

1.5 5 Why 체인

증상: 크론 작업 실패 (exit 1)
  └─ 왜? 스크립트 내 source 명령 실패
    └─ 왜? 설정 파일이 없음
      └─ 왜? launchd가 cwd를 $HOME로 설정
        └─ 왜? plist에 WorkingDirectory 누락
          └─ 왜? 초기 작성 시 체크리스트 없었음 ← 구조적 근본 원인

5단계 도달 전 멈추지 마십시오. 3단계에서 멈추면 증상 수정.


🧪 Phase 2 — 패턴 매칭

알려진 패턴:

  • 경쟁 상태: 간헐적, 타이밍 의존, 공유 상태 동시 접근
  • Null 전파: NoneType, TypeError, 옵셔널 가드 누락
  • 상태 손상: 부분 업데이트, 트랜잭션, 콜백
  • 통합 실패: 타임아웃, 외부 API, 서비스 경계
  • 설정 드리프트: 로컬 OK, 프로덕션 실패, env vars / DB 상태
  • 캐시 오염: 오래된 데이터, Redis / CDN / 브라우저

Read the full file on GitHub · 330 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 330 lines · 59 tokens per session scan A b0efb7be67b8

Subscribe to this mod's changes

investigate is a command published in the GitHub repository Ramsbaby/jarvis (16 stars, last pushed 16d ago), licensed MIT. It adds 59 tokens to every session and 3,238 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.