Directories
¶
| Path | Synopsis |
|---|---|
|
Package agentinit implements `locksql init <agent>`: it writes the files that connect a coding agent to locksql inside one project, and prints the steps for any file outside it.
|
Package agentinit implements `locksql init <agent>`: it writes the files that connect a coding agent to locksql inside one project, and prints the steps for any file outside it. |
|
Package audit writes the console's append-only JSONL audit trail.
|
Package audit writes the console's append-only JSONL audit trail. |
|
Package client is the secret-free side of locksql: it dials the console socket of a project and profile and calls the console's JSON-RPC methods.
|
Package client is the secret-free side of locksql: it dials the console socket of a project and profile and calls the console's JSON-RPC methods. |
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile.
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile. |
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail.
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail. |
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans.
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans. |
|
mysql
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column).
|
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column). |
|
postgres
Package postgres is the PostgreSQL engine, on pgx v5.
|
Package postgres is the PostgreSQL engine, on pgx v5. |
|
sqlite
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver.
|
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver. |
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check.
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check. |
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12).
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12). |
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself.
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself. |
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps.
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps. |
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings.
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings. |
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ...
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ... |
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier.
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier. |
|
Package sysconf reads the machine-wide locksql setup that separates the console from the agent: the console runs as a dedicated account (locksql, used in its own login session) that alone holds the database credentials, and the agent's account reaches it through a socket that a group grants access to.
|
Package sysconf reads the machine-wide locksql setup that separates the console from the agent: the console runs as a dedicated account (locksql, used in its own login session) that alone holds the database credentials, and the agent's account reaches it through a socket that a group grants access to. |
|
Package ui holds the look of locksql's human-facing output: the palette of the logo, the banner and the status marks.
|
Package ui holds the look of locksql's human-facing output: the palette of the logo, the banner and the status marks. |
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE.
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE. |
Click to show internal directories.
Click to hide internal directories.