Incident response

When something's on fire, the job is context-gathering under pressure: logs, diagnostics, the affected host, a shareable summary. This guide shows how Mel compresses that first frantic stretch — locally and over SSH.

1. Get the logs into blocks

Tail the logs the way you always would — journalctl -f, tail -f, kubectl logs, whatever fits. In Mel, that output is a block, not a wall of text:

• Select the block and open the filter bar: type a query and only matching lines show, with a live match count. Toggle .* for regex and Aa for case sensitivity.
• Filtering is re-evaluated every frame, so it works on streaming output — filter a live tail -f down to ERROR lines while they keep arriving.
• File paths in the output are links; ctrl+click opens them.

2. Put the agent on the case

Press ctrl+enter and describe the symptom. The agent inspects logs, runs health checks and diagnostics as run_command blocks, and greps the codebase for the error signature — every step recorded in the transcript. For unfamiliar errors it can use its built-in web search tool (free, no key needed) right inside the conversation.

Commands go through approval cards by default — during an incident on a production-adjacent box, that gate is a feature. Keep autonomy off and read each command before you Allow it.

3. Move to the affected host

Most incidents don't live on your laptop. Run ssh user@host — Mel gives you a full-fidelity remote session (password or key auth, real remote shell). Then melt it: press ctrl+enter inside the SSH session and the agent's tools — read_file, list_dir, grep, find_files, run_command, and even write_file/edit_file — execute on the remote host over that SSH connection. Nothing gets installed on the server. See SSH & remote sessions.

A prompt that earns its keep:

Find what's filling the disk under /var and show the top offenders. Then
check the service logs for the last hour for errors and summarize the
timeline of what happened.

4. Step away safely

Long investigations run while you handle the humans. If an agent in a background tab finishes or gets blocked on an approval, Mel flashes a notification card and records it in the titlebar inbox (🔔) — status, title, and relative time. One click drops you back into the exact conversation. The bell shows an unread badge until you catch up.

5. Hand off cleanly

The whole investigation — commands, output, findings — is a saved conversation you can reopen anytime (conversation management). Ask the agent to write the summary for the incident channel: the timeline, the evidence, the likely cause, and the proposed mitigation. The mitigation itself arrives as a reviewable diff or a runnable command — you approve it, it lands, and the postmortem practically writes itself. For the follow-up code fix, continue in the bug investigation guide.