v0.26.33 • Slack Socket Mode • Zero Inbound Ports

Control Your Home Network
From Any Slack Channel.

Turn Slack messages into real-time commands across your LAN. Works seamlessly behind NAT, firewalls, and CGNAT with zero open ports. Discover network devices, send Wake-on-LAN packets, manage Docker containers, and execute commands on remote Windows and Linux PCs via authenticated standalone agents.

Download Standalone Agent Try Interactive Simulator 5-Min Setup

bash — docker quick start

$docker run -d --net host --env-file .env lhotakj/cmdiqo-bot:latest

0 Ports

Inbound Open Ports

WSS TLS

Socket Mode Outbound

1.1 – 3.3 MB

Super-Lightweight Agent RAM

Win & Linux

x86_64, ARM64 & ARMv6

Core Capabilities

Engineered for Complete Network Autonomy

A lightweight, enterprise-grade architecture that bridges your Slack workspace to distributed machines without exposing a single open port.

Security

Socket Mode & Zero Open Ports

Outbound TLS WebSocket

Classic Slack bots require public HTTPS endpoints and port forwarding. Cmdiqo leverages Slack Socket Mode to establish a single encrypted outbound WebSocket connection. Works completely behind NAT, firewalls, and CGNAT with zero exposed ports.

Zero open inbound firewall ports
Works behind CGNAT, cellular, and hotel WiFi
TLS encryption handled directly by Slack Bolt

Zero-Install

Native C++20 Standalone Agents & Setup

Windows & Linux (x64 / ARM64 / ARMv6) Binaries

Ultra-compact standalone daemons written in ISO C++20 with super-lightweight memory footprint (under 1.5 MB binary, ~1.1 MB RAM on Linux x86_64, ARM64 & ARMv6, ~3.3 MB RAM on Windows) and sub-10ms startup. Features native setup wizards (~5.2 MB RAM on Windows GUI, CLI on ARM64 and ARMv6) with UAC elevation, Authenticode signing, and Win32 Job Object process isolation.

Super-lightweight C++20 binaries: ~1.1 MB RAM on Linux (x64/ARM64/ARMv6), ~3.3 MB on Windows
Full architecture support: Windows x64, Linux x86_64, Linux ARM64, and Linux ARMv6 (RPi Zero W / Pi 1)
Win32 Job Objects & POSIX process group process tree isolation
Authenticode signed Windows PE executables & systemd service

Extensible

YAML-Driven Extensibility & Subcommand Help

Shell, Python Backends & Dynamic Manual

Add custom commands in seconds without writing bot code. Simply define command triggers, arguments, and regex captures in commands.yaml. Built-in interactive help engine dynamically resolves multi-word subcommand topics like /help host restriction or /help docker with copy-pasteable examples.

Captured argument placeholders like {host}, {user}, and {svc}
Intelligent second-level /help discovery for subcommands (e.g. /help host restriction, /help blockapp)
Configurable execution timeouts and working directories
Automatic slash command aliases like /home, /wol, and /restrict

Network

LAN Discovery & Wake-on-LAN

Network Surveillance

Keep complete visibility of your home network. Discover active devices via arp-scan with ip neigh fallback, map MAC vendors, ping IP addresses, and send Wake-on-LAN magic packets to wake sleeping PCs across subnets.

Instant ARP sweep of local subnet with MAC lookup
Wake-on-LAN magic packet injection
Live agent ping and connectivity checks

Containers

Docker & Container Ops

DevOps from your Phone

Control Docker containers running on any host from your mobile Slack app. Inspect running containers, inspect memory and CPU utilization stats, tail the last 50 lines of logs, and trigger compose restarts on demand.

Live docker ps and resource stats snapshots
Tail container logs straight into Slack threads
Automatic thread responses with clean formatting

Monitoring

Remote Host Telemetry

Uptime, RAM, Disk & Top

Query real-time hardware and OS metrics across your fleet. Inspect uptime, free RAM, drive space partitions, and top CPU-consuming processes on Windows and Linux machines without SSH or RDP overhead.

Instant RAM and storage utilization metrics
Cross-platform top CPU process identification
Safe remote system reboot and shutdown commands

WebGUI

Integrated Real-time WebGUI

Live Fleet Dashboard & Event Stream

Launch an ultra-lightweight, zero-install web dashboard directly from the bot container by setting the WEB_PORT. Real-time Server-Sent Events (SSE) stream host connectivity, architecture badges, sortable connected hosts with persistent order, synchronized live uptimes, and terminal events without polling.

Zero-configuration single-port activation via WEB_PORT
Sortable Connected Agents table (Host Name, Arch, OS, Uptime) with localStorage persistence
Real-time SSE event log ring buffer with zero polling overhead

Administration

System Services & Windows Updates

Systemd & Windows SCM

Manage system background daemons remotely. Query service states, restart failing services via systemd or Windows Service Control Manager, and query installed Windows Hotfix updates for security compliance.

Service status inspection and restart triggers
Windows SCM and Linux systemd unification
Installed Windows Update hotfix auditing

Guard

Parental, App & Logon Guard

DNS, IFEO Process & Schedule Shield

Enforce focus or bedtime rules in one message. Enforce allowed logon hours (M-F schedules), lock desktop sessions, audit active screentime, send on-screen alerts, and instantly block or restore games (Roblox, Minecraft, Steam, Epic, Discord, etc.) via DNS hosts redirects and OS-level execution interception (Windows IFEO/AppX & Linux Flatpak).

Mandatory user logon hours enforcement with T-5m toast, T-1m alert, and cutoff forced logoff
Instant graphical desktop lock (/host lock) and screentime session auditing
DNS and hosts-file domain blocking for video and gaming sites
Native process execution blocking via Windows IFEO & Linux Flatpak overrides

Live Fleet Dashboard

Integrated Real-Time WebGUI & Remote Console

Need a visual overview of your home fleet? Activate the built-in WebGUI with a single environment variable (WEB_PORT=8080). Monitor connected nodes with zero polling, trigger host actions with one click, and inspect Slack-formatted terminal output right in your browser.

Cmdiqo Hubv0.26.33

connected (SSE)

Connected Agents4 Active

Host Name	Operating System	Uptime	Action
PC-KIDS v0.26.33 • 192.168.1.105	Windows 11 Pro	01d 04h 22m 18s	Actions for PC-KIDS Parental Controls Domain Blocking› Logon Hours› System & Docker Uptime & Metrics› Remote Power›
pi-home v0.26.33 • 192.168.1.15	Debian 12 (bookworm)	42d 18h 05m 12s
backup-nas v0.26.33 • 192.168.1.40	Ubuntu 24.04 LTS	18d 02h 45m 30s

Live Agent Fleet Grid

Sort connected hosts by Name, Architecture, OS, or Uptime with full localStorage persistence. WebP architecture icons and 1Hz local uptime tickers deliver instant fleet status.

One-Click Action Menus

Trigger system telemetry, tail Docker logs, restart containers, manage system services, and apply parental rules directly from categorized context submenus without typing raw CLI commands.

Slack-Rendered Terminal

Live execution responses translate Slack formatting, code syntax, and emojis in real time. Automated status detection flags failed commands with red FAILED badges.

Server-Sent Events (SSE)

Real-time event stream pushes host registrations, disconnections, and command outputs directly to your browser with zero polling overhead. Built-in 50-event ring buffer with reverse-order toggle.

Interactive Terminal

Experience Cmdiqo Right in Your Browser

Click a quick command pill below or type your own slash command into the interactive Slack simulator. Experience how real-time Socket Mode acknowledgments and output blocks arrive in Slack channels.

Try a command:

#lan-control Socket Mode Active

Topic: Cmdiqo LAN Management Bot (v0.26.33) • Zero Inbound Ports

cmdiqo-botAPPToday at 12:00

Connected to Slack via Socket Mode • WebSocket Hub listening on ws://0.0.0.0:8765 (3 remote agents online).
Type a slash command or click one of the pills above to test remote network operations!

DEV

YouToday at 12:01

/lan devices list

cmdiqo-botAPPToday at 12:01

✅lan-devices-list • 4 active devices discovered on subnet:

IP ADDRESS     MAC ADDRESS        HOST NAME
192.168.1.1    aa:bb:cc:dd:ee:ff  router.home
192.168.1.10   22:33:44:55:66:77  nas.home
192.168.1.20   11:22:33:44:55:66  rpi4-server.home
192.168.1.55   88:99:aa:bb:cc:dd  workstation-win11.home

Zero-Trust Architecture

Decoupled Three-Tier Topology

Engineered specifically for home labs and distributed networks. Outbound WebSockets eliminate inbound firewall holes, dynamic DNS headaches, and reverse proxy vulnerabilities.

1. Slack Cloud Platform

User Interface & Notification Dispatch

Users interact seamlessly via Slack desktop, browser, or mobile apps. Slash commands and messages are queued through Slack's secure cloud infrastructure.

ProtocolWSS TLS 1.3

Port Exposure0 Ports

Client SupportiOS / Android / Desktop

2. cmdiqo-bot & WebSocket Hub

Socket Mode Dispatcher & Central Switch

Runs as a Docker container or Python service on your primary local server. Connects OUTBOUND to Slack via Socket Mode, parses YAML commands, checks user permissions, dispatches tasks to remote agents, and serves an optional real-time WebGUI dashboard.

Hub Port8765 (Local LAN)

WebGUI (Optional)SSE Real-Time Stream

Auth MethodHMAC SHA-256

Command EngineShell & Python

3. Distributed Native C++20 Agents

Super-Lightweight Nodes on Managed Machines

Statically linked native C++20 standalone binaries (under 1.5 MB). Each agent maintains a persistent outbound WebSocket to the Hub, executes commands safely with Win32 Job Objects / POSIX process tree isolation, and streams stdout/stderr back.

Linux (x64/ARM64) RAM~1.1 MB (super-lightweight)

Windows Agent RAM~3.3 MB RAM

Windows Installer GUI~5.2 MB RAM

Cold Boot Time< 10 ms

🗺️

System Architecture & Agent Communication Topology

Visual overview of Slack Socket Mode, Hub container orchestration, and remote agent WebSocket channels

Cmdiqo System Architecture and Agent Communication Topology Diagram

⚡

End-to-End Command Dispatch Lifecycle

Slack User

Sends `/host PC-OLO win reboot` or `/home docker restart plex`.

Command is issued in Slack private or public channel.

Slack API

Pushes WebSocket event down the persistent Socket Mode stream.

Zero incoming NAT/firewall configuration required.

cmdiqo-bot

Validates user permissions, matches command regex, sanitizes parameters.

Instantly posts acknowledgment: '⏳ Running command on PC-OLO...'

WebSocket Hub

Generates unique UUID req_id, dispatches JSON payload to target agent.

Correlated across all logs via 8-char request hash.

cmdiqo-agent

Executes command via PowerShell or Bash subprocess with timeout protection.

Captures exit code, stdout, and stderr safely.

Hub & Bot

Receives JSON result, resolves future, posts thread reply in Slack with mrkdwn.

Thread reply formatted with ✅ status and clean preformatted block.

Sent by the agent immediately upon initiating an outbound connection to ws://<hub_ip>:8765 with Bearer token authentication:

{
  "type": "hello",
  "name": "PC-OLO",
  "version": "1.0.42",
  "platform": "windows"
}

Dispatched from Hub to the target agent. Correlated via 32-character UUID:

{
  "id": "a1b2c3d4e5f67890123456789abcdef0",
  "type": "exec",
  "kind": "ps1",
  "cmd": "Get-Service | Where-Object {$_.Status -ne 'Running'} | Format-Table -AutoSize",
  "cwd": null,
  "timeout": 180
}

Returned from agent to Hub upon subprocess completion:

{
  "id": "a1b2c3d4e5f67890123456789abcdef0",
  "type": "result",
  "ok": true,
  "code": 0,
  "output": "Status   Name      DisplayName\n------   ----      -----------\nStopped  ALG       Application Layer Gateway Service...",
  "error": null
}

Command Catalog

Built-In Operations & Custom Extensions

Explore default Slack commands for network administration, remote diagnostics, and container management. Extend effortlessly with your own custom shell scripts or Python functions in commands.yaml.

lan

Alias: lan devices list

/lan devices list

List all devices seen on local network via ARP broadcast scan

Examples (click to copy):

/lan devices list

Simulated Output:

IP ADDRESS     MAC ADDRESS        HOST NAME
192.168.1.1    aa:bb:cc:dd:ee:ff  router.home
192.168.1.10   22:33:44:55:66:77  nas.home
192.168.1.20   11:22:33:44:55:66  rpi4-server.home
192.168.1.55   88:99:aa:bb:cc:dd  workstation-win11.home

lan

Alias: /wol 00:11:22:33:44:55

/lan wake 00:11:22:33:44:55

Send Wake-on-LAN magic packet to boot a sleeping PC or server

Examples (click to copy):

/lan wake 00:11:22:33:44:55/lan wake 192.168.1.50/wol 00:11:22:33:44:55

Simulated Output:

✨ Magic packet sent to 00:11:22:33:44:55 on port 9
(broadcast 255.255.255.255). Target device should boot shortly.

lan

/lan ping 192.168.1.1

Ping an IP or hostname from Hub container to verify latency

Examples (click to copy):

/lan ping 192.168.1.1/lan ping nas.lan

Simulated Output:

PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.421 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.389 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.405 ms
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max = 0.389/0.405/0.421 ms

lan

/lan agents list

List all connected remote agents, platform, version, and IP

Examples (click to copy):

/lan agents list

Simulated Output:

CONNECTED AGENTS (3 online):
NAME          PLATFORM   IP             VERSION          CONNECTED
home-nas      linux      192.168.1.10   1.0.42           3d 14h 22m
PC-GAMING     windows    192.168.1.55   1.0.42           8h 12m 04s
rpi-sensor    linux      192.168.1.20   1.0.42           12d 02h 11m

lan

Alias: /host version

/lan version

Check running cmdiqo-bot hub version and connected socket engine

Examples (click to copy):

/lan version/host version

Simulated Output:

ℹ️ *Cmdiqo Version*
cmdiqo-bot v0.12.14

lan

/host home ping 1.1.1.1

Ping an IP or domain name directly from the remote agent's perspective

Examples (click to copy):

/host home ping 1.1.1.1/host AMD ping google.com/host PC-KIDS ping router.lan

Simulated Output:

PING 1.1.1.1 (1.1.1.1) from home:
64 bytes from 1.1.1.1: icmp_seq=1 ttl=58 time=7.82 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=58 time=7.65 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=58 time=7.91 ms
--- 1.1.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, rtt min/avg/max = 7.65/7.79/7.91 ms

lan

/host home ports

List listening network TCP/UDP ports and owning processes on remote host

Examples (click to copy):

/host home ports/host AMD ports

Simulated Output:

[home] LISTENING PORTS & PROCESSES:
PROTO  LOCAL ADDRESS          PORT   PID    PROCESS
TCP    0.0.0.0                22     812    sshd
TCP    0.0.0.0                8765   1402   cmdiqo-bot
TCP    0.0.0.0                32400  1822   plex-mediaserver
TCP    127.0.0.1              5432   930    postgres
UDP    0.0.0.0                53     610    pihole-FTL

lan

/host home speedtest

Benchmark internet download speed & latency via Cloudflare CDN on host

Examples (click to copy):

/host home speedtest/host AMD speedtest

Simulated Output:

⚡ [home] Cloudflare Speedtest Benchmark:
• Downloaded: 10 MB payload
• Duration: 0.12s
• Throughput: 666.67 Mbps
• Status: Excellent WAN connectivity

system

Alias: /home uptime

/host home uptime

Check standardized system uptime, boot time, and current load average

Examples (click to copy):

/host home uptime/host AMD uptime/home uptime

Simulated Output:

[home] Uptime: 45d 08h 12m 00s
Boot time: 2026-08-11 14:22:18 UTC
Load Average: 0.18, 0.22, 0.19 (4 cores)

system

Alias: /home memory

/host home memory

Inspect RAM usage, free memory, and swap utilization

Examples (click to copy):

/host home memory/host AMD memory/home memory

Simulated Output:

[home] MEMORY USAGE:
Total RAM:   31.2 GB
Used RAM:    12.4 GB (39.7%)
Available:   18.8 GB (60.3%)
Swap:        2.0 GB used of 8.0 GB

system

Alias: /home disk

/host home disk

Check disk partitions, mounts, and available storage space

Examples (click to copy):

/host home disk/host AMD disk/home disk

Simulated Output:

[home] FILESYSTEM USAGE:
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p2  938G  312G  579G  36% /
/dev/sda1       7.3T  4.1T  2.9T  59% /data/storage
/dev/sdb1       3.6T  1.2T  2.3T  35% /mnt/backup

system

/host home top

Display top 10 CPU-consuming processes on remote host

Examples (click to copy):

/host home top/host AMD top

Simulated Output:

[home] TOP CPU PROCESSES:
PID    USER       %CPU  %MEM  COMMAND
14202  docker     14.2  8.1   plex-transcoder
18911  root        3.8  2.4   containerd
2290   node        2.1  3.2   homebridge
841    systemd     0.4  0.2   systemd-journald

system

/host home users

List all OS users on remote host (active ✔️ or locked 🚫)

Examples (click to copy):

/host home users/host AMD users

Simulated Output:

[home] OS USERS:
USERNAME        STATUS    SESSIONS
admin           active ✔️ (console, 2h 15m)
deploy          active ✔️ (ssh, 45m)
guest           locked 🚫 (none)

system

Alias: /host home user john

/host home user john status

Inspect specific user profile, home directory, and active session duration

Examples (click to copy):

/host home user john status/host home user john/host AMD user Administrator

Simulated Output:

👤 *User Status for `john` on `home`:*
• Full Name: John Doe
• Home Directory: `/home/john`
• Status: ✔️ active
• Current Session: 2h 15m 30s

system

Alias: /host home user guest enable

/host home user guest disable

Lock (disable) or unlock (enable) user account without physical or RDP access

Examples (click to copy):

/host home user guest disable/host AMD user tempuser enable

Simulated Output:

🚫 *User `guest` on `home` disabled (locked).*

system

/host PC-OLO reboot

Reboot remote host safely after 10-second warning

Examples (click to copy):

/host PC-OLO reboot/host home reboot/host AMD reboot

Simulated Output:

✅ [PC-OLO] System reboot initiated successfully:
shutdown /r /t 10
Machine will restart in 10 seconds.

system

/host PC-OLO shutdown

Safely power down remote host after 10-second warning

Examples (click to copy):

/host PC-OLO shutdown/host home shutdown

Simulated Output:

✅ [PC-OLO] System shutdown initiated successfully:
shutdown /s /t 10
Machine will power off in 10 seconds.

system

/host PC-KIDS screentime

Show active logged-in user sessions, console/RDP state, and idle time

Examples (click to copy):

/host PC-KIDS screentime/host home screentime

Simulated Output:

⏱️ [PC-KIDS] Active Sessions & Screentime:
USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
alex                  console             1  Active       none  2026-10-11 15:30

system

/host PC-KIDS lock

Instantly lock active graphical workstation session without closing apps

Examples (click to copy):

/host PC-KIDS lock/host home lock

Simulated Output:

🔒 [PC-KIDS] Workstation locked.
Active desktop session is now locked. Running applications remain open in the background.

system

/host PC-KIDS msg Dinner is ready!

Broadcast an on-screen desktop notification or popup alert to target PC

Examples (click to copy):

/host PC-KIDS msg Dinner is ready!/host PC-KIDS msg Please save your game.

Simulated Output:

💬 [PC-KIDS] Message delivered: Dinner is ready!
On-screen alert displayed to the active user session.

system

/host PC-OLO events

Show recent system warning and error event logs (Windows Event Log or journalctl)

Examples (click to copy):

/host PC-OLO events/host home events/host AMD events

Simulated Output:

[PC-OLO] RECENT SYSTEM EVENTS (Warning / Error):
TimeCreated          Id    Level    Message
2026-10-11 18:22:10  10016 Warning  The application-specific permission settings do not grant Local Activation
2026-10-11 17:05:40  7036  Info     The Windows Modules Installer service entered the stopped state.
2026-10-11 14:12:02  41    Critical The system has rebooted without cleanly shutting down first.

docker

Alias: /home docker ps

/host home docker ps

List all running and stopped Docker containers

Examples (click to copy):

/host home docker ps/host nas docker ps/home docker ps

Simulated Output:

CONTAINER ID   IMAGE                 STATUS         PORTS                     NAMES
b8f9e0a12c4d   plexinc/pms-docker    Up 14 days     0.0.0.0:32400->32400/tcp  plex
a1b2c3d4e5f6   homeassistant/home    Up 45 days     0.0.0.0:8123->8123/tcp    homeassistant
e7f8a9b0c1d2   portainer/portainer   Up 45 days     0.0.0.0:9443->9443/tcp    portainer
3c4d5e6f7a8b   pihole/pihole:latest  Up 45 days     0.0.0.0:53->53/udp        pihole

docker

Alias: /home docker restart plex

/host home docker restart plex

Restart Docker container or docker compose service

Examples (click to copy):

/host home docker restart plex/host home docker restart vaultwarden/home docker restart plex

Simulated Output:

✅ [home] Container plex restarted successfully in 2.14s.
Status: Up 2 seconds (healthy)

docker

Alias: /home docker logs plex

/host home docker logs plex

Tail the last 50 lines of container standard output & error logs into Slack

Examples (click to copy):

/host home docker logs plex/host home docker logs pihole

Simulated Output:

[plex] LAST 50 LOG LINES:
[2026-10-09 17:45:10] INFO - Starting Plex Media Server (v1.40.2)...
[2026-10-09 17:45:12] INFO - Database migration completed in 120ms.
[2026-10-09 17:45:14] INFO - Listening for TLS socket connections on port 32400.
[2026-10-09 17:45:15] INFO - DLNA server ready.

docker

/host home docker stats

Snapshot of CPU, RAM, and network usage per container

Examples (click to copy):

/host home docker stats/host nas docker stats

Simulated Output:

NAME             CPU %   MEM USAGE / LIMIT     MEM %   NET I/O
plex             8.42%   1.41GiB / 31.24GiB    4.52%   142MB / 8.9GB
homeassistant    1.12%   485MiB / 31.24GiB     1.51%   45MB / 12MB
pihole           0.28%   128MiB / 31.24GiB     0.40%   89MB / 67MB

services

/host PC-OLO services

List active system daemons (systemd or Windows SCM)

Examples (click to copy):

/host PC-OLO services/host home services/host AMD services

Simulated Output:

[PC-OLO] ACTIVE SYSTEM SERVICES:
SERVICE NAME                 DISPLAY NAME                           STATUS
cmdiqo-agent                 Cmdiqo Agent Daemon                    Running
LanmanServer                 Server (SMB/CIFS)                      Running
wuauserv                     Windows Update                         Running
WinDefend                    Microsoft Defender Antivirus Service   Running

services

Alias: /host nas service status smbd

/host PC-OLO service status WinDefend

Inspect specific daemon or service state and startup type

Examples (click to copy):

/host PC-OLO service status WinDefend/host nas service status smbd/host AMD service status Spooler

Simulated Output:

[PC-OLO] SERVICE STATUS:
Name        : WinDefend
DisplayName : Microsoft Defender Antivirus Service
Status      : Running
StartType   : Automatic

services

Alias: /host nas service restart smbd

/host PC-OLO service restart Spooler

Force-restart a hanging Windows SCM service or Linux systemd unit

Examples (click to copy):

/host PC-OLO service restart Spooler/host nas service restart smbd

Simulated Output:

✅ [PC-OLO] Service Spooler restarted successfully.
Status: Running

services

/host PC-OLO win updates

Query installed Windows updates and recent hotfixes

Examples (click to copy):

/host PC-OLO win updates/host DESKTOP-01 win updates

Simulated Output:

[PC-OLO] RECENT WINDOWS HOTFIXES:
HotFixID   Description      InstalledBy          InstalledOn
KB5039212  Security Update  NT AUTHORITY\SYSTEM  2026-09-12
KB5038285  Update           NT AUTHORITY\SYSTEM  2026-08-20
KB5037771  Security Update  NT AUTHORITY\SYSTEM  2026-07-15

parental

Alias: /parental PC-KIDS on

/host PC-KIDS parental on

Block YouTube, Roblox, TikTok, Twitch, Discord, Minecraft, and gaming/proxy sites in hosts file & flush DNS

Examples (click to copy):

/host PC-KIDS parental on/parental PC-KIDS on/parental AMD on

Simulated Output:

🛡️ [PC-KIDS] Parental Guard ENABLED.
Blocked domains: YouTube, Roblox, Minecraft, Discord, TikTok, Twitch, Instagram, Reddit, AI, Web Games, Proxies
DNS resolver cache flushed successfully.

parental

Alias: /parental PC-KIDS off

/host PC-KIDS parental off

Unblock gaming and video sites and restore normal internet access

Examples (click to copy):

/host PC-KIDS parental off/parental PC-KIDS off

Simulated Output:

🔓 [PC-KIDS] Parental Guard DISABLED.
Hosts file restored. DNS resolver cache flushed successfully.

parental

Alias: /parental PC-KIDS status

/host PC-KIDS parental status

Query active parental blocking status without physical access

Examples (click to copy):

/host PC-KIDS parental status/parental PC-KIDS status

Simulated Output:

[PC-KIDS] Parental Guard Status:
Status: ACTIVE 🛡️
Blocked categories: Entertainment (YouTube, TikTok, Twitch), Gaming (Roblox, Minecraft, Poki, now.gg), Chat/Social (Discord, Instagram, Reddit), AI & Proxies (Character.ai, CroxyProxy)
Rule applied at: 2026-09-25 18:00:00

parental

Alias: /blockapp PC-KIDS roblox on

/host PC-KIDS blockapp roblox on

Block execution of games and apps via IFEO, AppX, or Flatpak overrides

Examples (click to copy):

/host PC-KIDS blockapp roblox on/host PC-KIDS blockapp tlauncher on/host PC-KIDS blockapp steam on/blockapp PC-KIDS roblox on

Simulated Output:

✅ 🚫 [PC-KIDS] Application execution BLOCKED!
Target: Windows (PC-KIDS IFEO/AppX)
Blocked Apps: Roblox
Interception rules and process termination applied.

parental

Alias: /blockapp PC-KIDS roblox off

/host PC-KIDS blockapp roblox off

Cleanly restore normal execution permissions for blocked applications

Examples (click to copy):

/host PC-KIDS blockapp roblox off/host PC-KIDS blockapp tlauncher off/blockapp PC-KIDS roblox off

Simulated Output:

✅ 🔓 [PC-KIDS] Application execution UNBLOCKED!
Target: Windows (PC-KIDS IFEO/AppX)
Unblocked Apps: Roblox
Clean execution state restored successfully.

parental

Alias: /blockapp PC-KIDS tlauncher on | /appblock PC-KIDS tlauncher on

/host PC-KIDS blockapp tlauncher on

Block TLauncher Minecraft launcher executables and process trees on target machine

Examples (click to copy):

/host PC-KIDS blockapp tlauncher on/host PC-KIDS blockapp tlauncher off/host PC-KIDS blockapp tlauncher/blockapp PC-KIDS tlauncher on

Simulated Output:

✅ 🚫 Application execution BLOCKED on `PC-KIDS`
Target: Windows (`PC-KIDS` IFEO/AppX)
Blocked Apps:
• TLauncher (TLauncher.exe, TLauncherBeta.exe, tlauncher.exe)
Interception debugger rules applied & active processes terminated.

parental

Alias: /blockapp PC-KIDS all on | /appblock PC-KIDS all on

/host PC-KIDS blockapp all on

Block execution for ALL configured games, launchers, and apps simultaneously

Examples (click to copy):

/host PC-KIDS blockapp all on/blockapp PC-KIDS all on/appblock PC-KIDS all on

Simulated Output:

✅ 🚫 Application execution BLOCKED on `PC-KIDS`
Target: Windows (`PC-KIDS` IFEO/AppX)
Blocked Apps: Roblox, Steam, Epic Games, Discord, Minecraft, TLauncher, Riot Games, Battle.net, TikTok, GeForce NOW
Interception rules applied across all 10 configured apps & active processes terminated.

parental

Alias: /blockapp PC-KIDS all off | /appblock PC-KIDS all off

/host PC-KIDS blockapp all off

Cleanly restore execution permissions for ALL configured applications at once

Examples (click to copy):

/host PC-KIDS blockapp all off/blockapp PC-KIDS all off/appblock PC-KIDS all off

Simulated Output:

✅ 🔓 Application execution UNBLOCKED on `PC-KIDS`
Target: Windows (`PC-KIDS` IFEO/AppX)
Unblocked Apps: Roblox, Steam, Epic Games, Discord, Minecraft, TLauncher, Riot Games, Battle.net, TikTok, GeForce NOW
Interception rules cleared. Clean execution state restored across all apps.

parental

Alias: /blockapp PC-KIDS all | /host PC-KIDS blockapp all status

/host PC-KIDS blockapp all

Query execution interception status across all configured apps (defaults to status)

Examples (click to copy):

/host PC-KIDS blockapp all/host PC-KIDS blockapp all status/host PC-KIDS blockapp/blockapp PC-KIDS all

Simulated Output:

🛡️ Application Execution Status on PC-KIDS:
• Roblox (roblox): 🚫 BLOCKED
• Steam (steam): ✅ ALLOWED
• Epic Games Launcher (epic): ✅ ALLOWED
• Discord (discord): 🚫 BLOCKED
• Minecraft (minecraft): ✅ ALLOWED
• TLauncher (tlauncher): 🚫 BLOCKED
• Riot Games (riot): ✅ ALLOWED
• Battle.net (battlenet): ✅ ALLOWED
• TikTok (tiktok): 🚫 BLOCKED
• GeForce NOW (gfn): ✅ ALLOWED

parental

Alias: /blockapp PC-KIDS tlauncher | /host PC-KIDS blockapp roblox

/host PC-KIDS blockapp tlauncher

Check execution status of an individual application without altering state (defaults to status)

Examples (click to copy):

/host PC-KIDS blockapp tlauncher/host PC-KIDS blockapp roblox/blockapp PC-KIDS tlauncher/blockapp PC-KIDS steam

Simulated Output:

🛡️ Application Execution Status on `PC-KIDS` (Windows/11):
• TLauncher (tlauncher): 🚫 BLOCKED
  Executables: TLauncher.exe, TLauncherBeta.exe, tlauncher.exe
  Mechanism: IFEO Debugger hook (systray/sub-process blocked)

parental

Alias: /restrict PC-KIDS alex status

/host PC-KIDS restrict alex status

Inspect active user logon hours allowed on remote host (Windows SAM or Linux PAM)

Examples (click to copy):

/host PC-KIDS restrict alex status/host PC-KIDS restrict alex/restrict PC-KIDS alex status

Simulated Output:

⏰ Logon Hours Status on PC-KIDS:
• User: alex
• Allowed Hours: Monday 07:00 - 18:00, Tuesday 07:00 - 18:00, Wednesday 07:00 - 18:00, Thursday 07:00 - 18:00, Friday 07:00 - 18:00, Saturday 08:00 - 18:00, Sunday 08:00 - 18:00
• Status: 🔒 Restricted (M-F: 07:00-18:00; Sa-Su: 08:00-18:00)
• Active Tasks: 5-min toast warning, 1-min alert dialog & forced logoff

parental

Alias: /restrict PC-KIDS alex set M-F,07:00-18:00;Sa-Su,08:00-18:00

/host PC-KIDS restrict alex set M-F,07:00-18:00;Sa-Su,08:00-18:00

Enforce allowed login schedule with 5m toast, 1m modal alert, and forced cutoff logoff

Examples (click to copy):

/host PC-KIDS restrict alex set M-F,07:00-18:00;Sa-Su,08:00-18:00/host PC-KIDS restrict alex set M-F,16:00-20:00/restrict PC-KIDS alex set M-F,07:00-18:00;Sa-Su,08:00-18:00

Simulated Output:

✅ 🔒 Logon hours restriction successfully applied on PC-KIDS:
• Target: alex
• Schedule: M-F,07:00-18:00;Sa-Su,08:00-18:00
• Rule: Access permitted M-F 07:00-18:00, Sa-Su 08:00-18:00 with T-5m toast warning, T-1m alert, and cutoff logoff.

parental

Alias: /restrict PC-KIDS alex off

/host PC-KIDS restrict alex off

Clear logon restrictions, purge scheduled enforcement tasks, and restore unlimited 24/7 access

Examples (click to copy):

/host PC-KIDS restrict alex off/restrict PC-KIDS alex off

Simulated Output:

✅ 🔓 Logon hours restriction removed on PC-KIDS:
• Target: alex
• Allowed Hours: All (unlimited 24/7 access restored)
• Cleanup: All scheduled warning and logoff tasks purged.

aliases

Alias: /lan help | /host help

/help [topic]

Dynamic command manual with nested topic breakdowns and trailing help routing

Examples (click to copy):

/help/help host restriction/help restrict/help blockapp/help parental/lan help/host help

Simulated Output:

Available Categories:
• /lan devices list | wake <mac> | ping <ip> | agents list | version
• /host <name> uptime | memory | disk | top | reboot | shutdown | events
• /host <name> users | user <user> [status|disable|enable] | screentime | lock | msg <text>
• /host <name> docker ps | logs <svc> | restart <svc> | stats
• /host <name> services | service restart <svc> | win updates
• /host <name> parental on | off | status
• /host <name> blockapp <app|all> on | off | status (alias: appblock)
• /host <name> restrict <user> <status|set <schedule>|off> (alias: /restrict)
• /host <name> ping <target> | ports | speedtest
• Configured Aliases: /home <action>, /wol <target>, /restrict <host> <user> <action>

Pro-tip: Append 'help' to any category (e.g. /lan help, /host help, /blockapp help, /restrict help) or query specific subcommands (e.g. /help host restriction).

aliases

Alias: /help host restriction | /help restrict

/help [subcommand]

Intelligent second-level subcommand search with multi-word and synonym matching

Examples (click to copy):

/help host restriction/help host restrict/help restrict/help blockapp/help docker ps

Simulated Output:

Command: /host {host} restrict {user} <status | set <schedule> | off> (alias: /restrict)
Description: Manage user logon hours restriction on Windows (SAM / Task Scheduler / Toast & Alert) or Linux (PAM time.conf)
Actions:
• status: Show active logon hours and scheduled tasks for user
• set <schedule>: Enforce allowed schedule with T-5m toast notification, T-1m alert, and forced logoff
• off: Remove all restrictions, purge enforcement tasks, and restore unlimited 24/7 access
Schedule Syntax:
• Weekdays 7am-6pm, Weekends 8am-6pm: M-F,07:00-18:00;Sa-Su,08:00-18:00
• Weekdays after school: M-F,16:00-20:00

aliases

Alias: /host home docker restart plex

/home docker restart plex

Configurable prefix alias routing /home directly to /host home

Examples (click to copy):

/home docker restart plex/home docker ps/home uptime

Simulated Output:

✅ [home] Container plex restarted successfully in 2.14s.
Status: Up 2 seconds (healthy)

aliases

Alias: /lan wake 00:11:22:33:44:55

/wol 00:11:22:33:44:55

Convenience shortcut sending Wake-on-LAN magic packet to target MAC

Examples (click to copy):

/wol 00:11:22:33:44:55/wol 192.168.1.50

Simulated Output:

✨ Magic packet sent to 00:11:22:33:44:55 on port 9
(broadcast 255.255.255.255). Target device should boot shortly.

aliases

Alias: /host PC-KIDS blockapp roblox on

/blockapp PC-KIDS roblox on

Direct root shortcut for application execution blocking (also /appblock)

Examples (click to copy):

/blockapp PC-KIDS roblox on/blockapp PC-KIDS tlauncher on/blockapp PC-KIDS all on/blockapp PC-KIDS all

Simulated Output:

✅ 🚫 [PC-KIDS] Application execution BLOCKED!
Target: Windows (PC-KIDS IFEO/AppX)
Blocked Apps: Roblox
Interception rules and process termination applied.

aliases

Alias: /blockapp PC-KIDS tlauncher on | /appblock PC-KIDS all

/appblock PC-KIDS tlauncher on

Interchangeable alias for /blockapp and /host {host} blockapp

Examples (click to copy):

/appblock PC-KIDS tlauncher on/appblock PC-KIDS all status/appblock PC-KIDS all/appblock PC-KIDS roblox off

Simulated Output:

✅ 🚫 Application execution BLOCKED on `PC-KIDS` (alias: appblock)
Target: Windows (`PC-KIDS` IFEO/AppX)
Blocked Apps:
• TLauncher (TLauncher.exe, TLauncherBeta.exe, tlauncher.exe)
Interception debugger rules applied & active processes terminated.

Release Hub

Download Standalone Binaries & Containers

Precompiled standalone executables for Windows and Linux, multi-architecture Docker containers, and the offline console emulator.

Latest Release: v0.26.33• Verified GitHub Build

⚡ Preferred One-Liner Installation

Single-Command Piped Setup

Single-command bootstrap with automatic architecture detection, background service registration, and instant startup. The fastest and recommended way to deploy the Cmdiqo Agent across servers, cloud instances, and workstations without manually unzipping or moving files.

Linux / Cloud Server

Zero Dependencies

Ubuntu / Debian / Fedora / RHEL / Arch / Raspbian • x86_64, aarch64, armv6l

Auto-detects CPU architecture, downloads the lightweight headless daemon (~1.1 MB RAM, no X11/GTK), creates the system user, installs systemd unit, and starts the service immediately.

Bash One-Liner (curl | bash)

curl -fsSL https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.sh | sudo bash -s -- --hub-url ws://<HUB_IP>:8765 --token <AGENT_TOKEN> --name <HOST_NAME>

💡Replace <HUB_IP>, <AGENT_TOKEN>, and <HOST_NAME> with your hub details. Requires curl and sudo.

Windows 10 / 11 / Server

PowerShell Admin

Windows 10 / 11 / Server 2016+ (x64) • x86_64

Downloads the verified Windows setup package and automatically configures and registers the cmdiqo-agent service (~3.3 MB RAM) with the Service Control Manager (SCM).

PowerShell One-Liner (irm | iex)

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.ps1))) -HubUrl "ws://<HUB_IP>:8765" -Token "<AGENT_TOKEN>" -Name "<HOST_NAME>"

💡Run in an elevated PowerShell session (Run as Administrator). Supports both interactive wizard and silent service installation.

GUI & CLI Installer

Windows Setup Wizard (.exe)

Windows 10 / 11 / Server (x64)

Self-contained native C++ setup executable embedding the agent payload. Features an ultra-lightweight graphical setup wizard (~5.2 MB RAM) with UAC elevation, token validation, and automated Windows Service (SCM) registration (~3.3 MB RAM).

Quick Installation Command:

# 1. Quick One-Liner (PowerShell as Administrator):
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.ps1))) -HubUrl "ws://192.168.1.10:8765" -Token "<AGENT_TOKEN>" -Name "PC-01"

# Or download and run native GUI setup wizard:
.\cmdiqo-agent-windows-x64-setup.exe

Download cmdiqo-agent-windows-x64-setup.exe Release Notes →

Authenticode Signed

Windows Standalone Agent (ZIP)

Windows 10 / 11 / Server (x64)

Native C++20 cmdiqo-agent.exe executable (~3.3 MB RAM, sub-10ms startup), automated PowerShell service installer (install-service.ps1), uninstall script, and configuration templates.

Quick Installation Command:

# 1. Extract zip and navigate to directory:
Expand-Archive cmdiqo-agent-windows-x64.zip -DestinationPath C:\cmdiqo-agent
cd C:\cmdiqo-agent

# 2. Install as automatic background Windows Service:
powershell.exe -ExecutionPolicy Bypass -File .\install-service.ps1 -HubUrl "ws://192.168.1.10:8765" -Token "<AGENT_TOKEN>" -Name "MY-PC"

Download cmdiqo-agent-windows-x64.zip Release Notes →

Headless Server Setup

Linux x64 CLI Installer

Ubuntu / Debian / Fedora / RHEL (x64 Server)

Pure headless C++ setup executable embedding the agent payload. Zero GUI/X11 dependencies — built specifically for headless cloud hosts (Oracle Cloud OCI, AWS EC2, GCP, Hetzner), VPS, and minimal server distributions. Installs and registers the super-lightweight background daemon (~1.1 MB RAM) with systemd.

Quick Installation Command:

# 1. Quick One-Liner (Auto-detects architecture & installs systemd service):
curl -fsSL https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.sh | sudo bash -s -- --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name server

# Or run standalone CLI setup binary:
chmod +x cmdiqo-agent-linux-x64-setup-cli
sudo ./cmdiqo-agent-linux-x64-setup-cli --install --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name server

Download cmdiqo-agent-linux-x64-setup-cli Release Notes →

Desktop GTK3 Wizard

Linux Desktop Setup Wizard

Ubuntu / Debian / Fedora / RHEL (x64 Desktop)

Interactive native setup wizard for Linux desktop workstations with a graphical session (X11 / Wayland, GTK3). Provides visual connection testing, credential input, and automated background daemon registration (~1.1 MB RAM).

Quick Installation Command:

# 1. Make executable and run setup wizard:
chmod +x cmdiqo-agent-linux-x64-setup
sudo ./cmdiqo-agent-linux-x64-setup --install --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name desktop

# Or in-place upgrade keeping existing configuration:
sudo ./cmdiqo-agent-linux-x64-setup --upgrade

Download cmdiqo-agent-linux-x64-setup Release Notes →

Systemd Ready

Linux Standalone Agent (ZIP)

Ubuntu / Debian / Fedora / RHEL (x64)

Single-file native C++20 cmdiqo-agent binary (under 1.5 MB binary size, super-lightweight ~1.1 MB RAM) with systemd service unit, automated installer script (install-service.sh), and environment templates.

Quick Installation Command:

# 1. Unzip archive:
unzip cmdiqo-agent-linux-x64.zip -d /opt/cmdiqo-agent
cd /opt/cmdiqo-agent

# 2. Install and start as systemd service:
sudo ./install-service.sh --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name server

Download cmdiqo-agent-linux-x64.zip Release Notes →

Native CLI Setup

Linux ARM64 CLI Installer

Raspberry Pi / AWS Graviton / Debian / Ubuntu (ARM64)

Self-contained native setup executable embedding the agent payload for 64-bit ARM architectures (Raspberry Pi, SBCs, Graviton). Automatically provisions directories, generates systemd unit files, and registers the super-lightweight background daemon (~1.1 MB RAM).

Quick Installation Command:

# 1. Quick One-Liner (Auto-detects architecture & installs systemd service):
curl -fsSL https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.sh | sudo bash -s -- --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name rpi

# Or run standalone ARM64 CLI setup binary:
chmod +x cmdiqo-agent-linux-arm64-setup
sudo ./cmdiqo-agent-linux-arm64-setup --cli --install --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name rpi

Download cmdiqo-agent-linux-arm64-setup Release Notes →

ARM64 Systemd

Linux ARM64 Standalone Agent (ZIP)

Raspberry Pi / AWS Graviton / Debian / Ubuntu (ARM64)

Single-file native C++20 cmdiqo-agent binary for aarch64 architectures (under 1.5 MB binary size, super-lightweight ~1.1 MB RAM) with systemd service unit, automated installer script (install-service.sh), and environment templates.

Quick Installation Command:

# 1. Unzip archive:
unzip cmdiqo-agent-linux-arm64.zip -d /opt/cmdiqo-agent
cd /opt/cmdiqo-agent

# 2. Install and start as systemd service:
sudo ./install-service.sh

Download cmdiqo-agent-linux-arm64.zip Release Notes →

ARMv6 CLI Setup

Linux ARMv6 CLI Installer

Raspberry Pi Zero / Zero W / Pi 1 (armv6l)

Self-contained native setup executable embedding the agent payload for 32-bit ARMv6 architectures (Raspberry Pi Zero, Zero W, Pi 1). Cross-compiled with -march=armv6zk -mfloat-abi=hard -mfpu=vfp. Automatically provisions directories and installs systemd daemon service.

Quick Installation Command:

# 1. Quick One-Liner (Auto-detects architecture & installs systemd service):
curl -fsSL https://raw.githubusercontent.com/lhotakj/cmdiqo/main/install.sh | sudo bash -s -- --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name rpi-zero

# Or run standalone ARMv6 CLI setup binary:
chmod +x cmdiqo-agent-linux-armv6-setup
sudo ./cmdiqo-agent-linux-armv6-setup --cli --install --hub-url ws://192.168.1.10:8765 --token <AGENT_TOKEN> --name rpi-zero

Download cmdiqo-agent-linux-armv6-setup Release Notes →

ARMv6 Systemd

Linux ARMv6 Standalone Agent (ZIP)

Raspberry Pi Zero / Zero W / Pi 1 (armv6l)

Single-file native C++20 cmdiqo-agent binary for 32-bit ARMv6 (armv6l) architectures (Raspberry Pi Zero / Zero W / Pi 1) with systemd service unit, automated installer script (install-service.sh), and environment templates.

Quick Installation Command:

# 1. Unzip archive:
unzip cmdiqo-agent-linux-armv6.zip -d /opt/cmdiqo-agent
cd /opt/cmdiqo-agent

# 2. Install and start as systemd service:
sudo ./install-service.sh

Download cmdiqo-agent-linux-armv6.zip Release Notes →

Multi-Arch

Docker Hub Bot Container

Docker / Podman (AMD64 & ARM64)

All-in-one container including Python runtime, Slack Bolt with Socket Mode, WebSocket Hub server, arp-scan LAN tools, and Docker CLI.

Quick Installation Command:

# Pull image from Docker Hub:
docker pull lhotakj/cmdiqo-bot:latest

# Run container with your .env file:
docker run -d --name cmdiqo-bot \
  --restart unless-stopped \
  --net host \
  --env-file .env \
  -v /var/run/docker.sock:/var/run/docker.sock \
  lhotakj/cmdiqo-bot:latest

Download lhotakj/cmdiqo-bot:latest Release Notes →

Zero-Token Testing

Interactive Slack Simulator

Cross-Platform Python 3.12+

Built-in interactive Slack console emulator. Test commands, regex captures, and live remote agents without needing Slack credentials or Socket Mode.

Quick Installation Command:

# Clone repository and run interactive simulator:
git clone https://github.com/lhotakj/cmdiqo.git
cd cmdiqo
python run.py sim

Download slacksim Release Notes →

5-Minute Setup

From Zero to Full Network Control

Follow these four simple steps to provision your Slack App, run the bot container, and register your first remote agent.

Step 1

Create the Slack App

Go to api.slack.com/apps → Create New App → From scratch.

Socket Mode: Settings → Socket Mode → Enable. Create an App-level Token with scope connections:write (copy xapp-...).
Bot Scopes: OAuth & Permissions → Add commands, chat:write, channels:read, groups:read, channels:join, channels:history.
Slash Commands: Add /help, /lan, /host, and optional aliases /home, /wol, /restrict.
Install: Click Install to Workspace and copy the Bot User OAuth Token (xoxb-...).

💡 Step-by-step channel and bot instructions: View Click-by-Click Slack Guide ↓

Step 2

Configure Environment

Create a .env file on your primary server alongside your docker-compose.yml:

SLACK_BOT_TOKEN=xoxb-your-bot-token
SLACK_APP_TOKEN=xapp-your-app-token

# Optional: Restrict to authorized user IDs
ALLOWED_USERS=U0123ABCDEF,U0456GHIJKL

# Optional: Shared secret for agents
AGENT_TOKEN=my-secret-token

# Optional: Enable integrated real-time WebGUI dashboard
WEB_PORT=8080

Step 3

Start the Bot Container

Launch via Docker or run directly with Python. The bot opens a secure outbound TLS WebSocket to Slack:

# Run via Docker:
docker run -d --name cmdiqo-bot \
  --restart unless-stopped \
  --net host \
  --env-file .env \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$PWD/config:/config:ro" \
  lhotakj/cmdiqo-bot:latest

# Or via Docker Compose:
docker compose -f docker/docker-compose.yml up -d

# Or pure Python:
python run.py hub

💡 Run python run.py --help for full CLI command options. If WEB_PORT is configured, navigate to http://<server-ip>:8080 for the live dashboard and real-time SSE stream!

Step 4

Connect Remote Agents

Run the lightweight standalone binary on any Windows or Linux (x86_64 & ARM64) host across your network:

# Windows:
.\cmdiqo-agent.exe --hub-url ws://192.168.1.10:8765 \
  --token my-secret --name PC-01

# Linux:
./cmdiqo-agent --hub-url ws://192.168.1.10:8765 \
  --token my-secret --name nas

💡 Preferred: Use the single-command piped installer to auto-detect architecture, provision, and start the system service instantly! View Quick One-Liners ↓

Step-by-Step Manual

Slack App & Channel Setup Guide

A complete, click-by-click walkthrough to provision your Slack Bot with Socket Mode, configure dedicated channels, invite the bot, and restrict command authorization.

Phase 1

Provisioning the Slack App & Socket Mode

Configure tokens and bot scopes in the Slack Developer Portal. No open ports or public URLs required.

Step 1.1

Create the App from Scratch

Navigate to the Slack App Console at api.slack.com/apps and click Create New App.

Select From scratch in the modal prompt.
Set App Name to cmdiqo-bot.
Pick your desired Slack workspace and click Create App.

Step 1.2

Enable Socket Mode (App Token)

Socket Mode creates a secure, outbound TLS WebSocket connection to Slack's servers, traversing NAT and firewalls automatically.

In the left sidebar, click Socket Mode (under Settings).
Toggle Enable Socket Mode to On.
In the popup, set Token Name to socket-mode-token and verify scope connections:write is selected.
Click Generate, copy the token starting with xapp-..., and save as SLACK_APP_TOKEN.

Step 1.3

Configure OAuth Bot Scopes

Grant the minimal bot permissions required for slash commands, notifications, and channel interactions:

Bot Scope	Operational Purpose
`commands`	Handles `/help`, `/lan`, `/host`, `/home`, `/wol`, and `/restrict`.
`chat:write`	Posts command outputs and agent online alerts.
`channels:read`	Discovers public channels for agent notifications.
`groups:read`	Discovers private channels where bot is invited.
`channels:join`	Enables bot to join public notification channels.
`channels:history`	Processes channel messages without leading slash.
`im:history` & `im:write`	Enables direct message interactions with the bot.

📌 Located in OAuth & Permissions → Scopes → Bot Token Scopes.

Step 1.4

Register Slash Commands

In the left sidebar, click Slash Commands → Create New Command for each command. (Leave Request URL blank — Socket Mode delivers commands automatically!)

/help — Interactive manual and command reference
/lan — Manage local network, ARP scan, WoL & agents
/host — Run host and remote agent commands
/home — Shortcut alias to /host home
/wol — Wake-on-LAN boot shortcut
/restrict — Parental logon hours scheduling shortcut

Step 1.5

Enable Message Event Subscriptions

Allows the bot to process plain messages in channels (e.g. typing lan devices list without slash):

Click Event Subscriptions (under Features) → toggle Enable Events to On.
Expand Subscribe to bot events → click Add Bot User Event.
Add message.channels and message.im.
Click Save Changes at the bottom of the page.

Step 1.6 & 1.7

App Home Messages Tab & Bot Token

⚠️

Crucial Step: Go to App Home → Show Tabs: Turn the Messages Tab toggle ON and check "Allow users to send Slash commands and messages from the messages tab". Otherwise, Slack will show "Sending messages to this app has been turned off".

Next, go to Install App → click Install to Workspace (or Reinstall to Workspace) → click Allow. Copy the Bot User OAuth Token (xoxb-...) and save as SLACK_BOT_TOKEN.

Phase 2

Slack Channel Setup & Access Lockdown

Set up dedicated channels for your home lab, invite the bot, and configure strict user/channel authorization.

Step 2.1

Create a Dedicated Management Channel

Keeping bot notifications and remote execution organized in a dedicated channel ensures a clean audit log and prevents chat pollution.

In Slack, click the + button next to Channels in the left sidebar → Create a channel.
Name your channel (e.g., #homelab, #devops, or #admin-ops).
Channel Visibility Recommendation:
Private Channel (Recommended)
Restricts visibility so only invited administrators can see system metrics, reboot servers, or view active container logs.
Public Channel
Allows anyone in the Slack workspace to see notifications and command results (subject to ALLOWED_USERS authorization).

Step 2.2

Invite cmdiqo-bot to the Channel

Bots cannot listen to channel messages or slash command threads until they are explicitly invited as channel members:

# Inside your new channel (#homelab), type and send:
/invite @cmdiqo-bot

Alternatively, type @cmdiqo-bot into the message composer and press Enter. Slack will display a prompt asking: "cmdiqo-bot is not in this channel" — click Add to Channel.

💡 Once invited, the bot automatically broadcasts dynamic agent connection and disconnection alerts into this channel!

Step 2.3

Retrieve Member ID & Channel ID

Cmdiqo implements zero-trust authorization. Any Slack user or channel not matching your allow-list is rejected immediately:

Find Your Member ID:

Click your profile picture in Slack → Profile.
Click the three dots (...) button.
Click Copy member ID (format: U0123ABCDEF).

Find Your Channel ID:

Right-click your channel name (e.g. #homelab) in the sidebar.
Click Copy link.
The Channel ID is the last segment of the URL (e.g., https://.../archives/C0123456789).

Step 2.4

Deploy .env & Test Channel Execution

Add the retrieved IDs to your bot's .env file to lock down access:

# Primary Bot Server (.env)
SLACK_BOT_TOKEN=xoxb-your-bot-token
SLACK_APP_TOKEN=xapp-your-app-token

# Security Allow-Lists:
ALLOWED_USERS=U0123ABCDEF
ALLOWED_CHANNELS=C0123456789

# Shared Secret for Windows & Linux Agents:
AGENT_TOKEN=random-secure-secret-token

Start the bot (docker compose up -d). Inside #homelab, type /lan or /help. The bot will respond in thread with active system tools!

Configuration & Security

YAML Command Engine & Environment Variables

Customize commands, aliases, timeouts, and authorization allow-lists using declarative YAML configuration.

📄config/commands.yaml

# Define custom aliases
aliases:
  - name: home
    input: "/home"
    output: "/host home"
    description: "Shortcut alias targeting host 'home'"

# Define modular OS-agnostic commands
commands:
  - name: host-uptime
    trigger: "/host {host} uptime"
    description: "Show system uptime"
    command:
      shell: "uptime"
      ps1: "$b = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime; $u = (Get-Date) - $b; 'Uptime: {0}d {1}h {2}m {3}s' -f [int]$u.TotalDays, $u.Hours, $u.Minutes, $u.Seconds"

  - name: host-docker-restart
    trigger: "/host {host} docker restart {service}"
    description: "Restart docker compose service"
    command:
      shell: "docker compose -f /docker/{service}/docker-compose.yml restart"
    timeout: 60

  - name: host-parental
    trigger: "/host {host} parental {action}"
    description: "Toggle or inspect parental DNS guard"
    command:
      python: "commands.parental:manage_parental"
    config:
      domains:
        - "youtube.com"
        - "roblox.com"
        - "discord.com"

  - name: host-blockapp
    trigger: "/host {host} blockapp {app} {action}"
    description: "Low-level process execution blocker"
    examples:
      - "/host PC-KIDS blockapp roblox on"
      - "/host PC-KIDS blockapp tlauncher on"
      - "/host PC-KIDS blockapp all on"
    command:
      python: "commands.appblock:manage_appblock"
    config:
      apps:
        roblox: ["RobloxPlayerBeta.exe", "Bloxstrap.exe"]
        steam: ["steam.exe", "steamwebhelper.exe"]
        tlauncher: ["TLauncher.exe", "tlauncher.exe"]

  - name: host-blockapp-query
    trigger: "/host {host} blockapp {app}"
    description: "Check app execution status (defaults to status)"
    examples:
      - "/host PC-KIDS blockapp all"
      - "/host PC-KIDS blockapp tlauncher"
    command:
      python: "commands.appblock:manage_appblock"

  - name: direct-blockapp
    trigger: "/blockapp {host} {app} {action}"
    description: "Direct root shortcut without /host prefix"
    examples:
      - "/blockapp PC-KIDS tlauncher on"
      - "/blockapp PC-KIDS all"
    command:
      python: "commands.appblock:manage_appblock"

  - name: host-restrict-set
    trigger: "/host {host} restrict {user} set {schedule}"
    description: "Enforce allowed logon hours for {user} on {host}"
    examples:
      - "/host PC-KIDS restrict alex set M-F,07:00-18:00;Sa-Su,08:00-18:00"
    command:
      python: "commands.restrict:manage_restrict"

Environment Variables Reference

Slack & Bot Credentials

Required tokens to connect the bot to Slack via Socket Mode.

SLACK_BOT_TOKENRequired

Bot User OAuth Token (starts with xoxb-). Generated in Slack App settings under OAuth & Permissions after installing to workspace.

SLACK_APP_TOKENRequired

App-Level Token (starts with xapp-) with connections:write scope. Generated in Slack App settings under Socket Mode.

Access Control & Security

Restrict bot commands to authorized users and specific channels.

ALLOWED_USERSOptional

Comma-separated list of authorized Slack User IDs (e.g. U0123ABCDEF,U0456GHIJKL). Anyone not listed will be rejected.

Default: (empty: anyone with channel access)

ALLOWED_CHANNELSOptional

Comma-separated list of allowed Slack Channel IDs (starts with C, e.g. C0123CHANNELID). Prevents bot execution in unauthorized channels.

Default: (empty: all invited channels)

AGENT_TOKENOptional

Shared secret token for HMAC-SHA256 handshake between Hub server and remote agents. Highly recommended for multi-node deployments.

Default: (empty: unauthenticated)

Hub & WebGUI Server

Settings for the embedded WebSocket agent hub and optional real-time WebGUI.

HUB_PORTOptional

TCP port where the embedded WebSocket Hub listens for outbound agent connections (default: 8765).

Default: 8765

WEB_PORTOptional

Port number to start the integrated real-time single-page WebGUI dashboard (e.g. 8080) with sortable connected agents, 32x32 architecture badges, and event logs via SSE.

Default: (disabled)

HUB_ENABLEDOptional

Controls whether the embedded WebSocket Hub server is enabled inside the bot container.

Default: true

Agent Configuration

Settings applied to cmdiqo-agent daemon instances on remote machines.

HUB_URLRequired

WebSocket URL of the running cmdiqo-bot Hub server (e.g. ws://192.168.1.10:8765).

Default: ws://127.0.0.1:8765

AGENT_NAMEOptional

Unique name identifying this agent in Slack commands (e.g. /host [AGENT_NAME] uptime).

Default: (hostname)

COMMAND_TIMEOUTOptional

Maximum execution duration in seconds for commands before terminating subprocess.

Default: 180

SHELL_TIMEOUTOptional

Default fallback timeout in seconds for local shell commands executed inside bot container.

Default: 120

Control Your Home Network From Any Slack Channel.

Engineered for Complete Network Autonomy

Socket Mode & Zero Open Ports

Native C++20 Standalone Agents & Setup

YAML-Driven Extensibility & Subcommand Help

LAN Discovery & Wake-on-LAN

Docker & Container Ops

Remote Host Telemetry

Integrated Real-time WebGUI

System Services & Windows Updates

Parental, App & Logon Guard

Integrated Real-Time WebGUI & Remote Console

Live Agent Fleet Grid

One-Click Action Menus

Slack-Rendered Terminal

Server-Sent Events (SSE)

Experience Cmdiqo Right in Your Browser

Decoupled Three-Tier Topology

1. Slack Cloud Platform

2. cmdiqo-bot & WebSocket Hub

3. Distributed Native C++20 Agents

System Architecture & Agent Communication Topology

End-to-End Command Dispatch Lifecycle

Built-In Operations & Custom Extensions

Download Standalone Binaries & Containers

Single-Command Piped Setup

Linux / Cloud Server

Windows 10 / 11 / Server

Windows Setup Wizard (.exe)

Windows Standalone Agent (ZIP)

Linux x64 CLI Installer

Linux Desktop Setup Wizard

Linux Standalone Agent (ZIP)

Linux ARM64 CLI Installer

Linux ARM64 Standalone Agent (ZIP)

Linux ARMv6 CLI Installer

Linux ARMv6 Standalone Agent (ZIP)

Docker Hub Bot Container

Interactive Slack Simulator

From Zero to Full Network Control

Create the Slack App

Configure Environment

Start the Bot Container

Connect Remote Agents

Slack App & Channel Setup Guide

Provisioning the Slack App & Socket Mode

Create the App from Scratch

Enable Socket Mode (App Token)

Configure OAuth Bot Scopes

Register Slash Commands

Enable Message Event Subscriptions

App Home Messages Tab & Bot Token

Slack Channel Setup & Access Lockdown

Create a Dedicated Management Channel

Invite cmdiqo-bot to the Channel

Retrieve Member ID & Channel ID

Deploy .env & Test Channel Execution

YAML Command Engine & Environment Variables

Environment Variables Reference

Slack & Bot Credentials

Access Control & Security

Hub & WebGUI Server

Agent Configuration

Control Your Home Network
From Any Slack Channel.