The controls

5.1 The rail

The rail runs down the left edge and stays in view on every page. On a phone (480 px wide or narrower) it becomes a bar along the bottom. Each icon has its name as a tooltip and as its accessible label.

The Connectors, Approvals, Modes and Account pages also show a settings list at their left (a row of links on a narrow screen). Modes is reached from that list, from the Account page, or from the chip's panel. In a team, a Team entry is in that list too (chapter 9).

5.2 The chat

The chat is where you work. From top to bottom, left to right:

Under the box, one line repeats the safety promise: "Every write the Copilot proposes waits for your approval. Nothing ships without you."

A banner at the top of a chat says when Sandbox is on: "Sandbox is on: Cockpit can read your connected systems but nothing can be changed. If you ask for a change, it will say so and change nothing." If only that chat has been made Sandbox, the banner says that chat stays Sandbox.

While the Copilot works, you see its steps stream into the chat. If your connection drops during a run, the console reconnects to the run by itself with growing pauses, so a deploy or a network blip does not lose the answer.

5.3 The Chats panel and the Brain panel

• New thread starts a chat. Search chats finds earlier ones by their words.
• Each chat has an Options menu with Rename, Delete, and Make this chat sandbox. After you use the last, the menu reads "This chat is Sandbox" and the chat carries a green Sandbox tag. A chat can only be tightened this way, never loosened.
• An amber dot beside a chat means it is waiting for your approval.
• Delete asks first. The chat leaves your list at once and is removed for good after 30 days.

Under 900 px wide, the Chats and Brain panels open as drawers over the conversation. Escape closes a drawer.

The Brain panel says who is working and what it did. It has four tabs:

The panel also shows API usage for your Salesforce org ("No Salesforce API calls in this thread yet" until one is made) and a Safety badge: "Read-only" with "Sandbox is on: nothing can be changed.", or "Read + write" with "Production mode (read + write): every change asks for your approval first."

5.4 The mode chip, the mode panel and the Modes page

Click the chip to open the mode panel. It has a master switch and a row for each connector.

• Production mode (read + write) is the master switch. Turning it on asks you to confirm: "Switch to Production mode (read + write)?" The confirmation says Cockpit will be able to make changes where a write action exists, that every change still asks for your approval, that the mode does not describe what kind of org is connected, and that you can switch back to Sandbox at any time with no confirmation. The buttons are Switch to Production mode and Stay in Sandbox.
• Per connector rows (Salesforce, MuleSoft, Slack, GitHub, Postman, Workstation) show, in Sandbox, "read only in Sandbox". In Production mode, each shows "can write, each write asks for approval" with a switch you can turn off, which changes it to "read only (you switched writes off)". A connector with no write action shows "read only (no write actions yet)" and its switch is locked.
• The Modes page has the same switches, a note that a new chat follows the account mode, a count of requests held back by a mode in the last 30 days ("These are not errors: nothing was changed."), and a list of recent mode changes with times.

5.5 Connectors

Open Connectors from the rail. The page explains that you have one connection per platform, except Salesforce and MuleSoft, where you can connect several and pick one for each chat. Google is how you signed in.

• A Search box filters by name.
• Two tabs, Connected and Available, with counts. The page opens on Available until something is connected.
• The Salesforce and MuleSoft cards sit above the tabs, because each can hold several connections.
• Each other connector is a row. Click its name to open its detail: Identity (who the connection is), Health (status, last test, connected since, last used, token expiry, last error) and App (which app, the saved key and whether a secret is saved, and the scopes, summarised as "N permissions (show all)").
• A row shows connected or not connected, its capability tag, and a Connect button when it is not connected.
• A connected row has Test, Reconnect, Disconnect and, for connectors you connect with your own app or key, Delete. Test makes one real read-only call and reports "Test passed" or "Test failed" with a reason. Each of Disconnect and Delete asks you to confirm.

The Salesforce card lists every org you connected, each with its name, org-type chip, a health label (Working, Needs reconnect, or Not checked yet), when it was connected and last used, and buttons:

• Add Salesforce org opens the four-step guide of chapter 6. Setup guide opens the same guide.
• Rename gives an org a name you recognise (up to 120 characters).
• Reconnect replaces that org's sign-in. Disconnect keeps the org's chats but they cannot read it until you reconnect.
• Run discovery report (where switched on) reads the org once and writes the Org Discovery Report into a chat. Hovering it says "Reads this org and writes a report. It changes nothing in Salesforce." The finished report can be downloaded as Markdown (.md) or as its tables in CSV.

The MuleSoft card works the same way, with Add MuleSoft connector, and shows the region and organisation of each connection. A red notice at the top of a card with "Needs reconnect" means the provider refused the saved sign-in.

5.6 Approvals

The Approvals page lists every approval card waiting across all your chats, grouped by chat, newest first, with a Refresh button. It says: "Every write the Copilot proposes waits here. Nothing ships without you." When nothing is pending it shows "All clear" and "No pending approvals." with a link back to the console.

Each card has the layout shown in chapter 2: summary, exactly what will run, fingerprint, tags and the target. Approve and Deny decide it. A decided card shows who decided and when. After your trial has ended, both buttons are disabled and a line says so.

5.7 Account

5.8 The microphone

The microphone beside the send button dictates into the message box, using your browser's or phone's own speech recognition. Cockpit's servers do not do the speech recognition. The button is hidden where the browser has none.

5.9 The attach menu (arriving)

• Plus opens a small menu: Salesforce org (with a count such as "2 connected"), or Connect something new.... With no org connected, the first entry reads Connect a Salesforce org.
• Choosing Salesforce org opens a sheet, Attach a Salesforce org: pick the org, give it a short name (lower-case letters, digits and dashes, up to 24 characters, starting with a letter or digit; suggestions are dev, qa and uat for a sandbox and prod for Production), and press Attach.
• The sheet shows Access as Read only; "Read and write" is greyed out with the note "Writing through an attached org comes later. For now it is read only."
• A chat can have up to 4 orgs attached. They appear as chips such as "dev · Salesforce · read only", each with a Detach button, and you can then ask the Copilot to compare them by name.

5.10 The desktop apps

Cockpit for Mac and Cockpit for Windows are the same console in a window of its own. They are beta downloads. The download buttons appear for approved accounts only, on the Account page and in the chat's top bar, and not inside the apps.

The card for your own system comes first with the main button; the other follows as a second choice.

The menu bar also has the usual Edit, View and Window menus, and a Help menu with Cockpit Manual (opens this manual in the app), Check for Updates and Copy Diagnostics. The zoom, reload and close keys are the ones every app uses. Check for Updates tells you only when a newer version exists; it never installs anything. Where update checks are not switched on, it opens the Cockpit website instead.

A line reads "unknown" when it could not be found, for example the service versions when you are offline.

If the page itself stops working, the app reloads it, up to three times in a minute, and then leaves you on that screen. The app also remembers its window size and place, and reopens in them; if a screen has been unplugged it opens on one that is there. The window cannot be made smaller than 900 by 600.

5.11 Phones

Controls checklist