internal/

Package agentassets holds lockssh's agent texts (skill, instructions, Cursor rule, example config) and their wiring through lockkit's agentwire.

Package command checks the argv an agent asks the console to run, turns it into the remote command line, and matches it against a profile's allow rules.

Package config loads lockssh profiles from the project and user config files, applies the defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile.

Package mcptools is lockssh's MCP server: one tool per client command, each a thin adapter over the console's methods.

Package outmask masks a command's output before it leaves the console: what the profile's detectors find becomes a keyed pseudonym (⟦email:7F3KQ2M9ZD4X⟧, stable within the console run, so "the same address" still reads as the same), a secret becomes ⟦secret⟧, and invalid UTF-8 becomes U+FFFD.

Package product declares lockssh's names for lockkit.

Package sshconsole is lockssh's console backend for lockkit: its IPC methods (op.plan, op.run), the SSH connection behind them, the account check, its policy.