Skip to content

CloudSlash Horizon (app.cloudslash.dev) & CLI Sync

CloudSlash Horizon (app.cloudslash.dev) is the collaborative web dashboard for Engineering, FinOps, and Platform teams.

Strictly Read-Only by Design

Horizon SaaS never executes destructive cloud mutations. Finance, Product, and Platform leads review findings and compile Ed25519-signed S.A.U. (Sequential Atomic Unwind) plans in Horizon, and engineers execute those plans locally via cs remediate with their own cloud credentials and full cs revert rollback protection.

1. Connecting the CLI to Horizon

Authenticate your terminal session and push your local graph snapshot (~/.cloudslash/state/latest.json) to your organization workspace:

# 1. Authenticate via browser OAuth loopback (127.0.0.1:9876)
cs login

# 2. Run a local scan with your installed provider plugins
cs scan --region us-east-1

# 3. Push the anonymized/typed resource graph snapshot to Horizon
cs sync

You can also connect read-only cloud credentials directly inside Horizon → Cloud Accounts to run scheduled or on-demand hosted analyses without running the CLI manually.

2. Core Horizon Workspaces

View Purpose
Overview Real-time KPI summary of monthly cloud spend, potential waste savings, active findings, and connected providers.
Findings Filter discovered waste nodes by severity, provider, and rule ID. Select resources to compile a cryptographically signed .json S.A.U. plan.
Resource Inspector Deep-dive into every discovered CRN (crn://provider/region/account/type/id), its monthly cost, tags, and upstream/downstream dependencies.
Infrastructure Inspect interactive Resource Topology graphs, K8s Costs by namespace, Rightsizing recommendations, Network Flow costs, and Shared Costs.
Cost Trends Historical waste and spend time-series (7d, 30d, 90d) plus 30-day projected waste forecasting.
Reports Live Team Chargeback attribution tables (CSV export), Due-Diligence Audit summaries (JSON export), and Snapshot Diffs comparing any two scans.
S.A.U. Plans Ledger of all compiled S.A.U. remediation plans, Ed25519 signatures, and CLI execution commands.
Policy Registry Browse active detection rules by category (Compute, Storage, Network, Cleanup) and inspect their technical evaluation criteria.
Cloud Accounts Connect AWS, GCP, Azure, or Kubernetes read-only credentials and trigger hosted scans.
Marketplace Browse verified community and official gRPC plugins from registry.cloudslash.dev.

3. End-to-End Remediation Workflow (Horizon → CLI)

sequenceDiagram
    participant Team as FinOps / Platform Lead (Web)
    participant Horizon as Horizon SaaS (app.cloudslash.dev)
    participant Eng as DevOps / Engineer (CLI / TUI)
    participant Cloud as Cloud Provider APIs

    Team->>Horizon: Select idle findings & click "Create S.A.U. Plan"
    Horizon->>Horizon: Compute topological unwind order & sign with Ed25519
    Horizon-->>Team: Plan ID (e.g., plan_9f8a7b) or signed .json file
    Eng->>Horizon: cs remediate --plan-id plan_9f8a7b
    Eng->>Cloud: Execute pre-stop snapshots & mutations locally via gRPC plugin
    Eng->>Horizon: Post execution audit trail (status: executed)
    Note over Eng,Cloud: Need to undo? Run `cs revert <id>` anytime.

Step 1: Compile a Signed Plan in Horizon

  1. Open app.cloudslash.dev and navigate to Findings.
  2. Select the idle or orphaned resources your team wants to clean up.
  3. Click Create S.A.U. Plan to generate a tamper-proof, Ed25519-signed remediation plan (plan-<id>.json).

Step 2: Inspect & Execute Locally in the CLI

Engineers review and execute the signed plan from their terminal or CI runner:

# Preview the plan actions without modifying cloud resources
cs remediate --plan-id <plan-id> --dry-run

# Or execute from a downloaded .json plan file
cs remediate --file ./cloudslash-plan.json

# Need to roll back a remediation? Unwind from the local S.A.U. ledger
cs revert <action-id>

4. Configuring Finding Rules & BYOK AI in Settings

Organization administrators can customize workspace behavior under Settings:

  • Finding rules (Settings → Finding rules): Toggle built-in detection rule packs (Idle compute CPU, Unattached storage volumes, Unattached public IPs, Stopped compute instances) or add custom property conditions to create a new immutable analysis profile revision.
  • Organization AI (Settings → AI): Configure an encrypted Bring-Your-Own-Key (BYOK) provider (OpenAI, Anthropic, OpenRouter, or any OpenAI-compatible endpoint) to power DEVI. It is in early access and free for every workspace; your provider bills the requests.
  • Billing & Plans (Settings → Billing): Manage your workspace tier (Community Free, Pro, or Commercial) and check monthly hosted scan and connection usage.

Importing a local scan

Local scans are stored in a predictable place:

  • ~/.cloudslash/state/latest.json — the latest completed scan (canonical, importable).
  • ~/.cloudslash/snapshots/ — timestamped archives, newest 50 kept.

Two ways to bring them into Horizon:

  1. Upload: open the workspace dashboard or Configure → Import a local scan and select ~/.cloudslash/state/latest.json (or an archive).
  2. Sync: run cs login, then cs sync. It validates the session, uploads latest.json, prints the snapshot id and resource count, and shows the dashboard URL. Use cs sync --file <path> for an archive and cs sync --dry-run to inspect the payload.

If cs sync reports an expired session, run cs login again. A CLI session is valid for about an hour.