Chapter 4 — LCOT Panel

LCOT stands for Local Chain of Thought. In practice it is a categorised library of 800+ ready-made commands you can run on the currently focused connection with a single click. Think of it as a button-driven cheat sheet that knows what kind of device you are on.

Where it lives

The LCOT panel docks on the right side of every connection tab. It is not visible on feature tabs (Fleet Manager, etc.) because those tabs do not target a specific host.

If you do not see it:

Make sure you are looking at a connection tab, not a feature tab.
View → Toggle LCOT Panel — re-enables it if you previously hid it.
Drag the splitter from the right edge of the window leftward if the panel has been collapsed to zero width.

How it works

LCOT is a tree. Top-level nodes are zones, then categories, then subcategories, then individual commands at the leaves. Click a leaf and the command runs in the connection's terminal pane immediately.

[R] READ Scripts           ← green/neutral icons
  ├ System Snapshot
  │   ├ uptime
  │   ├ kernel
  │   └ ...
  ├ Network Diagnostics
  ├ Services
  └ Hardware Health

[W] WRITE Scripts          ← red leaves
  ├ Service Control
  ├ Package Management
  ├ Filesystem Ops
  ├ Network Config
  └ Embedded Quick Ops

READ vs WRITE zones

Every command in LCOT is classified as either READ or WRITE.

[R] READ Scripts — safe, diagnostic. Reads state but does not modify it. Examples: uptime, ps aux, df -h, ip addr, systemctl list-units.
[W] WRITE Scripts — modifies state. Examples: package install, service restart, firewall rule, GPIO write, reboot.

WRITE leaves are coloured red. Clicking one always pops up a confirmation dialog showing the exact command before it runs. You have to click Confirm explicitly. This is intentional — it prevents the "I meant to ping, I rebooted production" class of accident.

The classification is part of the metadata, not a per-user setting. You cannot turn off the WRITE confirmation prompt by accident.

Command categories

The built-in library is organised by domain. Most users only see the categories relevant to the kind of device they are connected to, but everything is available everywhere:

Network Utilities — ping, traceroute, dig, nmap, ip, ss, netstat, tcpdump, iperf.
Built-in / Linux — basic Linux ops (file listings, processes, users, journalctl).
Containers — Docker (docker ps, image listings, prune), Docker Compose, basic Kubernetes.
Databases — MySQL, PostgreSQL, MongoDB, Redis client commands.
IoT — common Pi/ESP32/Jetson commands (GPIO, I²C, SPI scans, temp/voltage probes).
Development — git, build/run idioms for various toolchains.
Monitoring — system / network / logging probes.
PLC (Industrial) — Modbus, Ethernet/IP, S7, OPC UA snippets.
Manufacturer-specific — Cisco IOS, Juniper Junos, Ubiquiti EdgeOS/UniFi, MikroTik RouterOS, Fortinet, Palo Alto PAN-OS, Netgate pfSense, Arista.
Bluetooth — discovery, pairing, GATT probes.

The full count is north of 800 commands today. Searching is the way to find a specific one.

Sysadmin Quick Toolkit

A curated set of 62 commands across 9 sub-groups designed for the "fix it in 30 seconds" sysadmin loop. Lives under its own Quick Toolkit category. Half the sub-groups are READ-tagged, half WRITE-tagged:

READ sub-groups

System Snapshot — uptime, kernel, last logins, who, top CPU/MEM, ports, disk usage, big files.
Network Diagnostics — IP + routes, DNS resolvers, gateway ping, public IP, dig, nc port check.
Services — systemctl listings.
Hardware Health — temp/power/sensors.

WRITE sub-groups

Service Control — start/stop/restart/enable systemd units.
Package Management — apt/yum/dnf install, upgrade, remove.
Filesystem Ops — mkdir, chmod, chown, rm patterns.
Network Config — ip route, iptables/ufw rules, restart networking.
Embedded Quick Ops — reboot, dmesg clear, GPIO writes.

Searching

The search box at the top of the LCOT panel filters the tree as you type. Search matches against the command name, description, and tags. Press Esc to clear.

Running a command

Find the command in the tree (or by search).
Click the leaf. For READ commands the terminal runs it immediately. For WRITE commands you get a confirmation dialog with the full text — read it, then click Confirm.
Output appears in the terminal pane of the connection tab. Scroll buffer is preserved.

Many commands include {placeholder} slots — when you click them, AidaIDE prompts for the placeholder values first (e.g. port for an nc -z host port probe). Recently used values are remembered per command per host.

Adding your own command

Right-click anywhere in the LCOT tree → Add Command… opens AddCommandDialog:

Name — what the leaf will say in the tree.
Description — shown as tooltip.
Category / Subcategory — where it lives. Pick existing or type a new one.
Command — the actual text to run. Use {placeholder} for prompted variables.
WRITE checkbox — tick this if the command modifies state. The leaf will be red and confirmation will be required.
Tags — for search.

Click Save. The command is added to your personal LCOT library at ~/.aidaide/lcot_user_commands.json and survives across launches and across hosts (it shows up on every connection).

Edit / delete a custom command

Right-click the custom leaf → Edit or Delete. Built-in commands are read-only; you cannot edit them, but you can hide them via Settings → Editor → LCOT → Hidden Commands.

Per-device command sets

LCOT can show different categories depending on the connected host:

A Raspberry Pi tab gets the IoT and Linux categories highlighted.
A Cisco router tab puts manufacturer-specific Cisco IOS commands at the top.
A Windows-via-WinRM tab swaps out Linux commands for PowerShell equivalents.

This is driven by host detection on first connect. Override it from Connection Manager → host → Type if AidaIDE guesses wrong.

Tab into the LCOT tree.
Arrow keys navigate. Enter runs the focused leaf (with confirmation if WRITE).
Ctrl+F (when LCOT panel is focused) jumps into the search box.

Terms & Setup

Why "Chain of Thought"?

The original intent of LCOT was to give the AI assistant a list of vetted commands to suggest, so the AI's reasoning steps were grounded in real, runnable building blocks. The library outgrew its origin; today it is also a great human cheat sheet.

"I clicked a WRITE command and nothing seems to have happened"

Look at the terminal pane. The confirmation dialog runs, then output goes there. If output is empty, the command may have succeeded silently (e.g. systemctl restart nginx prints nothing on success).

"A command is failing"

Most LCOT failures are environment, not bug:
- Missing tool on the remote (nmap not installed → nmap commands fail).
- Sudo not configured (apt install requires root).
- Wrong device type (a Cisco IOS command on a Linux box).

The terminal shows the actual error. Fix on the remote, retry.

"I want a command across all my devices"

LCOT is interactive — it runs one command on one host at a time. For "do X on every device in my fleet," use Fleet Manager (see Chapter 5). Fleet Manager can ingest the same command catalogue.

Editing the user-command file by hand

~/.aidaide/lcot_user_commands.json is a plain JSON file. Power users can edit it directly. AidaIDE re-reads it on next LCOT panel open. Schema:

{
  "commands": [
    {
      "name": "Tail nginx error log",
      "description": "Live tail",
      "category": "Monitoring",
      "subcategory": "Web",
      "command": "tail -f /var/log/nginx/error.log",
      "write": false,
      "tags": ["nginx", "log", "web"]
    }
  ]
}

Always include encoding="utf-8" if you edit this in another tool — non-ASCII command names corrupt silently on Windows otherwise.

Hidden commands

Hide built-in commands you never use via Settings → Editor → LCOT → Hidden Commands. Hidden commands are filtered from the tree but remain in the source library; un-hide any time.