README
¶
lockkit
lockkit is the shared foundation of locksql
and its sibling products: the console that holds the credentials and asks
the human, its isolated account and socket, the policy files that the AI
may tighten and only the human loosens, the approval screen, the audit log,
credential sources (ask, OS keychain, Vault), personal-data detectors and
masks, and the MCP and agent wiring. A product plugs its own operations into
the console through a Backend. There is no stability promise before v1:
products pin an exact version.
Start with GUIDE.md.
Directories
¶
| Path | Synopsis |
|---|---|
|
User scope: wires agents through files under the home directory (and `claude mcp add --scope user`).
|
User scope: wires agents through files under the home directory (and `claude mcp add --scope user`). |
|
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data.
|
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data. |
|
Package client is the secret-free side of a product: it dials the console socket of a project and profile and calls the console's JSON-RPC methods.
|
Package client is the secret-free side of a product: it dials the console socket of a project and profile and calls the console's JSON-RPC methods. |
|
Package config is the product-neutral half of a product's configuration: where the project and user config files are, how a TOML file is decoded without ever reading a secret, the profile base every product shares (credentials, Vault, TLS, SSH bastion, production, session limits), the policy fingerprint, the diff helpers that mark loosenings, and the store of the policies the human approved.
|
Package config is the product-neutral half of a product's configuration: where the project and user config files are, how a TOML file is decoded without ever reading a secret, the profile base every product shares (credentials, Vault, TLS, SSH bastion, production, session limits), the policy fingerprint, the diff helpers that mark loosenings, and the store of the policies the human approved. |
|
Package console is the human side of a lockkit product: it holds the credentials and the only backend connection, enforces the approved policy, shows every request that needs a human decision on an approval screen, and writes the audit trail.
|
Package console is the human side of a lockkit product: it holds the credentials and the only backend connection, enforces the approved policy, shows every request that needs a human decision on an approval screen, and writes the audit trail. |
|
Package fingerprint verifies the human's finger on the machine's reader through fprintd, for the console's approvals in desktop mode.
|
Package fingerprint verifies the human's finger on the machine's reader through fprintd, for the console's approvals in desktop mode. |
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check.
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check. |
|
Package kit names a product built on lockkit.
|
Package kit names a product built on lockkit. |
|
Package mcpkit is the product-neutral half of a product's MCP server: the server and its stdio transport, the profile a call is for, progress notifications while the human decides, the untrusted-data framing of results, the "no console" answer naming the start command, refusals as structured tool errors and exact large integers.
|
Package mcpkit is the product-neutral half of a product's MCP server: the server and its stdio transport, the profile a call is for, progress notifications while the human decides, the untrusted-data framing of results, the "no console" answer naming the start command, refusals as structured tool errors and exact large integers. |
|
Package pii is the product-neutral half of personal-data masking: value detectors (email, phone, IBAN, card, national ids), mask modes, the multilingual name heuristics that propose mask rules, and the store of the clear values behind redacted references.
|
Package pii is the product-neutral half of personal-data masking: value detectors (email, phone, IBAN, card, national ids), mask modes, the multilingual name heuristics that propose mask rules, and the store of the clear values behind redacted references. |
|
Package refusal names why a console refused a request.
|
Package refusal names why a console refused a request. |
|
Package render turns a (masked) product result into the text an agent sees, within the caps of a profile: a table (TSV or JSON) or any typed JSON value.
|
Package render turns a (masked) product result into the text an agent sees, within the caps of a profile: a table (TSV or JSON) or any typed JSON value. |
|
Package sanitize cleans text before it leaves the console: error messages for a client or the audit log (known secrets in every encoded form, then the product's registered patterns), and any text printed for the human (control and bidi characters escaped, so that client-supplied text cannot drive or spoof the terminal).
|
Package sanitize cleans text before it leaves the console: error messages for a client or the audit log (known secrets in every encoded form, then the product's registered patterns), and any text printed for the human (control and bidi characters escaped, so that client-supplied text cannot drive or spoof the terminal). |
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings.
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings. |
|
Package sysconf reads a product's machine-wide setup that separates the console from the agent: the console runs as a dedicated account (the product's, used in its own login session) that alone holds the credentials, and the agent's account reaches it through a socket that a group grants access to.
|
Package sysconf reads a product's machine-wide setup that separates the console from the agent: the console runs as a dedicated account (the product's, used in its own login session) that alone holds the credentials, and the agent's account reaches it through a socket that a group grants access to. |
|
Package tunnel opens the SSH connection to a profile's bastion and dials the backend through it, to any address the bastion reaches (one tunnel serves several ports).
|
Package tunnel opens the SSH connection to a profile's bastion and dials the backend through it, to any address the bastion reaches (one tunnel serves several ports). |
|
Package ui holds the look of a product's human-facing output: the palette of the logo, the banner and the status marks.
|
Package ui holds the look of a product's human-facing output: the palette of the logo, the banner and the status marks. |
|
Package update checks a release's signature before a product installs anything from it: the keyless cosign signature of an artifact (typically checksums.txt) against the identity of the release workflow, then the checksums of the files.
|
Package update checks a release's signature before a product installs anything from it: the keyless cosign signature of an artifact (typically checksums.txt) against the identity of the release workflow, then the checksums of the files. |
Click to show internal directories.
Click to hide internal directories.