Directories
¶
| Path | Synopsis |
|---|---|
|
Package agentinit implements `locksql init <agent>`: it writes the files that connect a coding agent to locksql inside one project, and prints the steps for any file outside it.
|
Package agentinit implements `locksql init <agent>`: it writes the files that connect a coding agent to locksql inside one project, and prints the steps for any file outside it. |
|
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data.
|
Package audit writes the console's JSONL audit trail: one record per event, never secrets and never row data. |
|
Package client is the secret-free side of locksql: it dials the console socket of a project and profile and calls the console's JSON-RPC methods.
|
Package client is the secret-free side of locksql: it dials the console socket of a project and profile and calls the console's JSON-RPC methods. |
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile.
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile. |
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail.
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail. |
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans.
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans. |
|
mysql
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column).
|
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column). |
|
postgres
Package postgres is the PostgreSQL engine, on pgx v5.
|
Package postgres is the PostgreSQL engine, on pgx v5. |
|
sqlite
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver.
|
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver. |
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check.
|
Package ipc is the console's local transport: a Unix domain socket in a directory private to the user (on Linux and macOS), newline-delimited JSON-RPC 2.0 framing capped at 1 MiB, and a peer check. |
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12).
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12). |
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself.
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself. |
|
Package refusal names why locksql refused a statement.
|
Package refusal names why locksql refused a statement. |
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps.
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps. |
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings.
|
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings. |
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ...
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ... |
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier.
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier. |
|
Package stats reads the console's audit log and counts the refusals by code and by the token or node that triggered them, so that grammar work starts with the constructs users hit most.
|
Package stats reads the console's audit log and counts the refusals by code and by the token or node that triggered them, so that grammar work starts with the constructs users hit most. |
|
Package sysconf reads the machine-wide locksql setup that separates the console from the agent: the console runs as a dedicated account (locksql, used in its own login session) that alone holds the database credentials, and the agent's account reaches it through a socket that a group grants access to.
|
Package sysconf reads the machine-wide locksql setup that separates the console from the agent: the console runs as a dedicated account (locksql, used in its own login session) that alone holds the database credentials, and the agent's account reaches it through a socket that a group grants access to. |
|
Package tunnel opens the SSH connection to a profile's bastion and dials the database server through it.
|
Package tunnel opens the SSH connection to a profile's bastion and dials the database server through it. |
|
Package ui holds the look of locksql's human-facing output: the palette of the logo, the banner and the status marks.
|
Package ui holds the look of locksql's human-facing output: the palette of the logo, the banner and the status marks. |
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE.
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE. |
Click to show internal directories.
Click to hide internal directories.