Dashboard manual

The tray menu

Left-clicking the tray icon shows or hides the window and right-clicking it opens this menu, so for a lot of daily use this menu is the dashboard. It carries its own copy of the controls that matter, it reports the machine’s state in six readings at the top, and it can connect a tunnel, route the system through Tor, change your hardware address, wipe browser data or shut the machine down while the window is nowhere on screen.

System trayNo window needed97 rowsRead from the source

MANUALStartup AutoShield Circle Lite Classic ColonyOps SOC Vitals Settings Guides and wizards Tray menu Shared controls

Why there is no walkthrough here The tray menu has no web page behind it. It is built in the application’s Rust, as a native menu the desktop draws, so this manual’s capture harness cannot render it or measure its rows, and there is no walkthrough to click through. The picture is a plain screenshot of the menu on a Kodachi test machine running the shipped build, with that machine’s own address and identity masked. The rows below are read directly out of the source that builds the menu, most explanations start from the description of the command that row runs, rewritten for a first-time reader where the product’s wording assumed too much, and a check in the build refuses if that source changes and this page does not.

The Kodachi tray menu: six greyed status readings, then Show Dashboard, Compact mode, Nuke mode and the Dashboard, Connect, Protection, Network / DNS, Identity, Session and Danger submenus, then Logout and Quit Kodachi. — Right-click the Kodachi icon in the panel and this menu opens. The six greyed rows at the top are readings, not buttons; the masked parts are the test machine’s own IP address, hostname, MAC address and timezone.

The menu itself, 18 rows

The first six rows are readings, not controls: they are disabled by design and carry the live login, VPN, Tor, IP, tunnel, DNS and identity state so you can check the machine without opening anything. Everything below them acts.

#	Control	What it does
1	Kodachi, checking...	The first reading. It says Kodachi followed by what is protecting you right now: VPN + Tor, VPN (Kodachi network), VPN, Tor or no tunnel. It is rewritten every ten seconds and is disabled because it is a label, not a control.
2	Login: ... VPN: ... Tor: ...	Login, VPN and Tor state on one line. Disabled: it reports, it does not act.
3	IP: checking...	Your public address as the last probe saw it. Disabled: a reading.
4	Tunnel: checking...	Which tunnel is up, if any, and through what. Disabled: a reading.
5	DNS: checking...	Which resolver is answering and whether it is encrypted. Disabled: a reading.
6	Host: ... MAC: ... TZ: ...	Host name, hardware address and timezone as the machine currently presents them. Disabled: a reading.

8	Show Dashboard	Brings the window back and focuses it. A left click on the tray icon also shows a hidden window, and hides a shown one.
9	Compact mode	Shrinks the window to its compact layout, or restores the full one.
10	Nuke mode	Shrinks the window to a small panel with the Destroy button, a button that opens its options in Settings, an Always-on-top toggle, and a button that leaves the panel, because the window has no title bar in this mode. The dashboard's panels are hidden, not changed, and come back exactly as they were when you leave it or choose this row again.
11	Dashboardsubmenu	Opens the Dashboard group: 4 rows, further down this page.

13	Connectsubmenu	Opens the Connect group: 16 rows, further down this page.
14	Protectionsubmenu	Opens the Protection group: 8 rows, further down this page.
15	Network / DNSsubmenu	Opens the Network / DNS group: 11 rows, further down this page.
16	Identitysubmenu	Opens the Identity group: 8 rows, further down this page.
17	Sessionsubmenu	Opens the Session group: 3 rows, further down this page.

19	Dangersubmenu	Opens the Danger group: 5 rows, further down this page.

21	Login	Signs you in with the account saved on this machine and keeps the session alive by signing in again automatically when it expires. Once you are signed in the row reads Logout and clicking it ends the session. Nothing in this menu is hidden while you are signed out, but about forty rows run a command that refuses without a session, so they fail quietly until you sign in here or in the window. runs online-auth authenticate --relogin, or online-auth logout when signed in
22	Quit Kodachi	Quits the dashboard. Any tunnel, Tor routing and DNS (Domain Name System) setting the background services hold stays exactly as it is. The only things that stop are the WatchGuard watchers the dashboard itself started, and their saved state is cleared so the next start begins clean.

Dashboard, 9 rows

Opens one of the startup surfaces in the window. These change nothing on the machine. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Launcher (Simple)	Opens the simple Quick Launch picker inside the window.
2	Advanced Setup	Opens the Advanced setup screen inside the window. Its tabs are Launch (readiness and launch settings), Advanced, Mobile (pairing a phone), AutoShield, About and Terms. It changes nothing on the machine.
3	AutoShield	Opens the same Advanced setup screen with its AutoShield tab already selected. AutoShield is the boot automation you can arm to run a set of actions at every start. It is a tab on that screen, not a separate window.
4	Setup Wizard	Opens the Routing Guide, the wizard that recommends a protocol mix for what you are trying to do.
5	Switch to Circleadded at runtime	Switches the window to Circle, the single-ring quick view. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above.
6	Switch to Lite Classicadded at runtime	Switches the window to Lite Classic, the complete control workspace. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above.
7	Switch to Vitalsadded at runtime	Switches the window to Vitals, the live system monitor. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above.
8	Switch to SOCadded at runtime	Switches the window to SOC, the security operations monitor. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above.
9	Switch to ColonyOpsadded at runtime	Switches the window to ColonyOps, the workflow operator mode. This row is added by the application at start-up from its dashboard list rather than written in the tray source, so it appears below the four rows above.

Connect, 16 rows

One row per protocol routing-switch accepts, drawn as a radio because the tick is a real probe off routing-switch status rather than a guess. Auto-select picks by a static score table, not by measuring your network now. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Auto-select best protocol	Picks a protocol for you and connects with it. The choice comes from a fixed score each protocol carries on your account card, not from testing your network now, and the obfuscated transports (AmneziaWG and OpenVPN over Cloak) are left out unless you ask for them. Needs sign-in, because the protocol list and the server details come from your account. runs routing-switch auto-select

3	WireGuardone of a set	Connects WireGuard: a modern VPN protocol with a minimal attack surface, excellent performance and low latency, using ChaCha20 and Curve25519. The practical starting point for most users; if it is blocked or slow, benchmark the alternatives. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect wireguard
4	Hysteria2one of a set	Connects Hysteria2: a UDP protocol built on QUIC with its own congestion control, optimised for unstable or high-latency links such as mobile connections. On a clean link it buys you nothing over WireGuard. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect hysteria2
5	OpenVPNone of a set	Connects OpenVPN: the mature, battle-tested VPN protocol, highly configurable, TCP or UDP, with full certificate validation. The one to fall back to when WireGuard will not connect through a fussy firewall. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect openvpn
6	AmneziaWGone of a set	Connects AmneziaWG: WireGuard with its recognisable handshake disguised by junk packets and randomised headers, to get past networks that block plain WireGuard. Same speed class once connected, but it costs bandwidth, needs its own kernel module, cannot talk to a stock WireGuard peer, and sits outside the automatic ranking. Try it first when plain WireGuard is blocked. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect amneziawg
7	OpenVPN over Cloakone of a set	Connects OpenVPN over Cloak: OpenVPN wrapped in a transport that looks like ordinary browser HTTPS to a real decoy website, so a probe that is not a Cloak client is served the decoy. It is TCP inside TCP, which degrades badly on a link that loses packets, so it is the answer when UDP itself is blocked, not the first thing to try. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect openvpn-cloak
8	Shadowsocksone of a set	Connects Shadowsocks: a lightweight encrypted proxy designed to bypass censorship. Plain Shadowsocks is encrypted proxy traffic, not HTTPS; only a transport plugin adds camouflage, and how well it evades detection depends on the server, cipher, transport and the network in front of you. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect shadowsocks
9	V2Rayone of a set	Connects V2Ray: the advanced proxy platform behind the VMess family, with multiple protocols and transports. A censorship-bypass tool rather than a faster tunnel. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect v2ray
10	Xray, VLESSone of a set	Connects Xray VLESS: the lightweight, minimal-overhead protocol of the Xray platform, the cheaper choice when both it and VMess would work. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vless
11	Xray, VLESS Realityone of a set	Connects Xray VLESS with Reality: VLESS with enhanced obfuscation that mimics TLS to real websites, for networks that inspect traffic closely. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vless-reality
12	Xray, Trojanone of a set	Connects Xray Trojan: an HTTPS-based protocol whose traffic appears as normal web traffic to a network watching it. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-trojan
13	Xray, VMessone of a set	Connects Xray VMess: the fully encrypted Xray protocol with UUID authentication; heavier than VLESS. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect xray-vmess
14	Mieru (Mita)one of a set	Connects Mieru (Mita): a lightweight proxy for specific use cases, built to evade deep packet inspection. Reach for it when the more common transports are recognised and blocked. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect mita
15	Dante (SOCKS5)one of a set	Connects Dante, a SOCKS5 proxy with username and password authentication. A proxy, not a full tunnel: it routes what is pointed at it, which is useful for one application, and does not cover the whole machine. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect dante
16	Tor (redsocks)one of a set	Connects the Tor route through redsocks, a local transparent proxy that sends traffic into the Tor network so applications need no Tor settings of their own. Slower than any VPN: the product's own words are that slower speeds provide stronger anonymity through multiple encrypted relays. One of a set: the tick marks the protocol a probe of `routing-switch status` found active, and choosing another asks `routing-switch connect` to bring that one up instead. Needs sign-in, because the server details come from your account. runs routing-switch connect tor

18	Disconnect	Safely disconnect from all proxy protocols and restore direct internet access. Your traffic will no longer be encrypted through external servers runs routing-switch disconnect

Torrify, 5 rows

Send the whole machine through Tor, and the DNS half separately. Detorrify is the way back, and nothing is anonymised once it runs. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	System via Tor (single instance)	Routes every connection this machine makes through one Tor instance, using nftables firewall rules. It does not move your DNS (Domain Name System) lookups into Tor; the Tor DNS rows two lines below do that separately. Needs sign-in. runs tor-switch torrify-system-nftables

3	Tor DNS	A tick that reports whether DNS (Domain Name System) lookups go through Tor. Clicking it starts or stops Tor DNS with nftables. Starting needs sign-in; stopping works signed out. runs tor-switch start-tor-dns-nftables, or stop-tor-dns-nftables
4	Start Tor DNS	Sends every DNS (Domain Name System) lookup through Tor, so the names of the sites you visit are resolved inside the Tor network instead of by your local resolver. Uses nftables firewall rules. Needs sign-in. runs tor-switch start-tor-dns-nftables
5	Stop Tor DNS	Stops sending DNS (Domain Name System) lookups through Tor and removes the nftables rules that did it. Your normal resolver takes over again. Works signed out. runs tor-switch stop-tor-dns-nftables

7	Detorrify system	Takes the whole machine back off Tor. Two commands run in order: the nftables rules that route everything through Tor are removed first so connectivity comes back, then the legacy iptables rules are cleaned up. System traffic no longer goes through Tor once it has run; any VPN tunnel you have up is unaffected. runs tor-switch detorrify-system-nftables, then detorrify-system-iptables

Tor daemon, 6 rows

The Tor service itself, and circuit rotation. A new circuit changes the exit, never who you are signed in as. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Start Tor	Starts the Tor service. This makes the Tor network available for anonymous browsing and for the other Tor rows in this menu. Needs sign-in. runs tor-switch start-tor
2	Stop Tor	Stop the Tor service completely. All Tor connections will be terminated and the daemon will shut down runs tor-switch stop-tor
3	Restart Tor	Stops and starts the Tor service again. Use it when Tor stops responding or after changing its settings. Needs sign-in. runs tor-switch restart-tor

5	New Tor Circuit	Asks Tor for a new circuit, so your traffic leaves through a different exit and shows a different public address. Who you are signed in as does not change. Needs sign-in. runs tor-switch new-tor-circuit
6	New Circuit, All Instances	Asks every running Tor instance for a new circuit at once. Useful when the system is load balanced across several instances. Needs sign-in. runs tor-switch new-tor-circuit-all

8	Clear Exit Node	Removes any country restriction on the Tor exit, so Tor picks exits by speed and availability again. Needs sign-in. runs tor-switch clear-exit-node

Auto IP change, 4 rows

Rotate the Tor circuit on a timer. Useful for anonymity, awkward for anything holding a session open. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Every 10 minutes	Requests a new Tor circuit every ten minutes, so your exit address keeps changing. The menu cannot show which interval is armed, so these rows carry no tick. Needs sign-in. runs tor-switch auto-ip-change 10m
2	Every 30 minutes	Requests a new Tor circuit every thirty minutes. The exit changes each time; who you are signed in as does not. Needs sign-in. runs tor-switch auto-ip-change 30m
3	Every hour	Requests a new Tor circuit every hour. The exit changes each time; who you are signed in as does not. Needs sign-in. runs tor-switch auto-ip-change 1h

5	Off	Stops the automatic circuit timer. Your current Tor circuit stays until you change it by hand. Needs sign-in. runs tor-switch stop-auto-ip-change

Protection, 8 rows

The three at-a-glance states, the routing submenus, and the blunt internet cut. The tick boxes report what is on; they are not a wish list. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	VPN	A tick that reports whether a tunnel is up, and the label names the live protocol when one is. Clicking it while nothing is up connects with WireGuard, always, which is why the row then reads VPN (connects WireGuard); pick any other protocol from the Connect group. Clicking it while a tunnel is up disconnects. Connecting needs sign-in; disconnecting does not. runs routing-switch connect wireguard, or routing-switch disconnect
2	System via Tor (load balanced)	A tick that reports whether the whole system is routed through Tor. Clicking it while off runs two commands: it sets round-robin load balancing across several Tor instances, then routes everything through them with nftables rules. Clicking it while on takes the machine back off Tor, removing the nftables rules first and then any older iptables rules. Turning it on needs sign-in; turning it off does not. runs tor-switch set-load-balancing-mode round-robin then torrify-system-nftables-load-balanced, or detorrify-system-nftables then detorrify-system-iptables
3	System hardened	A tick that shows when more than half of the hardening checks pass. Clicking it while off applies the standard hardening profile, the soft one that breaks nothing. Clicking it while on reverts the hardening while keeping the framework ready to re-apply. Both directions need sign-in. runs health-control security-harden, or health-control security-recover

5	Torrifysubmenu	Opens the Torrify group: 5 rows, further down this page.
6	Tor daemonsubmenu	Opens the Tor daemon group: 6 rows, further down this page.
7	Auto IP changesubmenu	Opens the Auto IP change group: 4 rows, further down this page.

9	Block Internet	Blocks all internet traffic at once, using the best firewall method available on this machine (nftables, iptables or ufw). No confirmation, on purpose, because this is the control you reach for in a hurry. It needs sign-in, so when you are signed out the click refuses and nothing is blocked. Unblock Internet is the way back. runs health-control block-internet
10	Unblock Internet	Removes every block the row above put in place and lets traffic flow again. It is not the way back after a panic: it only reverses a block that Block Internet put in place, never the panic itself; use Recover on the dashboard's Emergency page for that, or `sudo health-control panic-recover` in a terminal, which works signed out. Works signed out, no confirmation. runs health-control unblock-internet

DNS category, 4 rows

Each row switches the machine to three random servers drawn from that pool right away, and needs a signed-in session. The Random row in the Network group picks from the reputable pool. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Reputable	Switches the system to three servers picked at random from the Reputable pool, the well known providers. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category reputable
2	Normal	Switches the system to three servers picked at random from the Normal pool, the ordinary public providers. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category normal
3	Fallback	Switches the system to three servers picked at random from the Fallback pool, the emergency set Kodachi ships for when everything else fails. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category fallback
4	Remotely fetched	Switches the system to three servers picked at random from the Remotely fetched pool, the list Kodachi fetched from its own server. It changes your DNS (Domain Name System) settings right away. Needs sign-in. runs dns-switch switch --category remotely_fetched

Network / DNS, 11 rows

Encrypted DNS, filtering, and the recovery actions for when the network stops working. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Switch to DNSCrypt	Points the system resolver at DNSCrypt, so every DNS lookup leaves the machine encrypted and authenticated instead of in plain text. The fallback and category rows below choose which servers; this row chooses the transport. runs dns-switch switch --names dnscrypt
2	Pi-hole	A tick that reports whether Pi-hole filtering is on. Clicking it on sends every DNS (Domain Name System) lookup on the machine through Pi-hole, not only the browser; clicking it off removes that. It refuses while a third-party VPN application owns your DNS, and it needs Pi-hole to be installed. No sign-in needed. runs dns-switch pihole-enable, or dns-switch pihole-disable

4	Use Random DNS Server	Picks three servers at random from the reputable pool and makes them your DNS (Domain Name System) resolvers. It is one pick, made when you click; it does not keep rotating afterwards. No sign-in needed. runs dns-switch random
5	Fallback DNS	Switches to the emergency resolver set built into Kodachi, the one to reach for when name resolution is broken. No sign-in needed. runs dns-switch fallback
6	DNS categorysubmenu	Opens the DNS category group: 4 rows, further down this page.

8	Fix DNS	Repair broken DNS resolution when websites fail to load after switching DNS modes, toggling VPN, or changing network configuration. Runs health checks and fixes only the stages that are actually broken runs dns-switch fix-dns
9	Restart DNSCrypt	Restart DNSCrypt proxy without removing config runs dns-switch dnscrypt-restart
10	Clean DNS Temp Files	Removes the temporary files the DNS service leaves behind. Housekeeping, not a change to how names are resolved. runs dns-switch clean
11	Restore Default DNS...	Resets the DNS (Domain Name System) server database to the factory list, then makes the built-in fallback resolvers your active servers. Any servers you added by hand and the health history the picker uses to rank servers are deleted, and that cannot be undone. A confirmation opens in the window first. No sign-in needed. runs dns-switch restore-default

13	Recover Network Routing	Repairs a half-broken routing state after a connect or disconnect that did not finish: it cleans up, restores the routes and resets DNS (Domain Name System). This is the my internet is stuck row. No sign-in needed. runs routing-switch recover
14	Recover Internet Connection	Works down a ladder of repairs until connections come back: restarting the network manager, clearing the firewall, flushing the route cache, restarting the network interfaces and renewing their addresses, and fixing the resolver file. It skips the repairs when the connection already looks healthy. No sign-in needed. runs health-control recover-internet

Identity, 8 rows

What the local network can use to recognise this machine: hardware address, host name, clock. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Rotate Identity Now...	Asks first, then runs three changes in order: randomizes the MAC (hardware) addresses, sets a random host name, and matches the timezone to your exit country. The MAC step skips the network card carrying your default route, so on a machine with one card only the name and the timezone change; use Force Randomize MACs for that card. The timezone step needs sign-in. runs health-control mac-change-all, then set-random-hostname, then sync-timezone

3	Randomize MAC Addresses	Gives every network card a new random MAC (hardware) address, except the card carrying your default route, which is skipped on purpose so your connection stays up. On a machine with one network card that means nothing changes and the command says so; Force Randomize MACs is the row that includes it. No confirmation, no sign-in. runs health-control mac-change-all
4	Force Randomize MACs...	Randomizes every MAC (hardware) address including the card carrying your default route, by taking each interface down first. Your connection drops and any VPN or Tor session dies with it, so reconnect afterwards. A confirmation opens in the window first. Needs sign-in. runs health-control mac-force-change
5	Reset All MACs...	Puts every network card back on its permanent hardware MAC address, the one that identifies this machine. Active connections drop. A confirmation opens in the window first. No sign-in needed. runs health-control mac-reset-all

7	Randomize Hostname	Gives the machine a new random host name, the name it announces on the local network. No confirmation, no sign-in. runs health-control set-random-hostname
8	Restore Default Hostname	Puts the host name back to the Kodachi default: `Live-OS` on a live boot, `Secure-OS` on an installed system. Needs sign-in. runs health-control set-default-hostname

10	Randomize Timezone	Sets the clock to a random timezone, so the time this machine reports no longer matches where you are. No confirmation, no sign-in. runs health-control set-random-timezone
11	Match Timezone to Exit Country	Sets the clock to the timezone of the country your public address currently belongs to, so the machine's time matches your exit. Needs sign-in. runs health-control sync-timezone

Session, 3 rows

The window and the desktop, not the machine. Close to tray is what makes this menu the whole interface. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Lock Screen	Locks the screen at once, the same as walking away and locking by hand: every application keeps running behind the lock and nothing on the machine changes. It runs `health-control lock-screen` without administrator rights, asks for no confirmation, and works whether or not you are signed in to Kodachi, because locking is not on the binary's sign-in list. runs health-control lock-screen

3	Conky desktop widget	Shows or hides the Conky desktop widget, the always-on status panel drawn on the desktop itself.
4	Close to tray	When on, closing the window hides it to the tray instead of quitting. This is the setting that makes the tray menu the whole interface.

Danger, 5 rows

Every row here is destructive and every one ends in an ellipsis, which is the menu telling you a confirmation follows. The same controls, with their pictures, are on this page of the manual. Back to the menu itself.

#	Control	What it does
1	Panic Soft...	Cuts every network connection, clears the clipboard and locks the screen. A confirmation opens in the window first. It saves the firewall rules, running services and network links first, and Recover on the dashboard's Emergency page puts them back (it runs `sudo health-control panic-recover`, which also works signed out in a terminal). Restarting the network does not undo it, because the firewall stays set to drop everything, and Unblock Internet only reverses its own block, never the panic. No sign-in needed. runs health-control panic-soft
2	Wipe Browser Data...	Asks first, then closes Firefox and wipes its profile data: cache, cookies, saved sessions, download history and form history, followed by a bleachbit pass over Firefox and Chromium. It cannot be undone. Needs sign-in. runs health-control wipe-browser-data
3	Clean Memory...	Asks first, then flushes pending writes to disk and drops the kernel's file caches, so memory that held old data is freed. Programs may pause briefly while they re-read from disk. Needs sign-in. runs health-control memory-clean
4	Wipe Logs...	Asks first, then deletes the system and application logs: everything under `/var/log` including the Tor logs, the login records and the authentication log. Anything you have not read yet is gone. Needs sign-in. runs health-control wipe-logs

6	Shutdown System...	Shuts the machine down after a confirmation in the window. Every row in this group ends in an ellipsis for that reason. No sign-in needed. runs killswitch_shutdown (sudo systemctl poweroff, then sudo shutdown -h now)

The tick boxes are readings, not switches you set. A tick next to VPN, Tor or a protocol means a probe found it on. Clicking one asks for the change; the tick moves when the machine answers, not when you click.

An ellipsis means a confirmation follows. Every row in the Danger group ends in one, so do the identity rows that force a change, and so does Restore Default DNS in the Network group. Nine rows confirm in all; none of them acts on the click alone.

Nine of these rows finish in the window. They open a confirmation there rather than acting from the menu, so the tray will bring the window forward for those even though it hid it a moment ago.