README
¶
Airlock
Airlock is a self-hosted platform for creating and deploying AI-native apps. Build an app in Go or prompt one into existence, then run it with web UI, AI chat, APIs, authentication, storage, integrations, logs, and its own subdomain on infrastructure you control.
Installation
This branch is a prerelease development cycle, not a production installation target. Installation quickstarts are available with stable releases; see the installation guide.
Development
Development requires Go 1.26+, Docker with Compose v2, and pnpm. Start from the development environment preset:
cp .env.dev.example .env
cd frontend && pnpm install && cd ..
make dev
make dev starts the bundled infrastructure and ingress services, watches the frontend, and runs the Airlock server from source. Set AGENT_LIBS_PATH in .env to build apps against local agentsdk, goai, and sol source.
See CONTRIBUTING.md for contribution guidelines and AGENTS.md for repository architecture and development rules.
Companion projects
- agentsdk - Go SDK and CLI for Airlock apps
- goai - Go toolkit for building AI-powered applications
- sol - agent runtime and coding harness
License
AGPL-3.0. The community edition is fully usable when self-hosted. Some operational features, including SSO/OIDC and audit-log export, are available under a commercial license. Contact hello@airlock.run for commercial licensing.
The companion libraries are licensed under Apache-2.0.
Security
Report vulnerabilities to security@airlock.run. Do not open a public issue for security reports.
Documentation
¶
Index ¶
Constants ¶
View Source
const Version = "0.7.0-rc.6"
Version is the airlock release version. The release tag in git is "v"+Version (e.g. "v0.3.4"). Bumped manually before tagging; check-versions.sh enforces that this constant, the docker-compose.yml ghcr tags, and the README install step all agree.
Consumed at the module level so the default AGENT_BUILDER_IMAGE / AGENT_BASE_IMAGE in config tracks airlock's own version — drift between airlock and its matched toolserver/runtime images becomes a build-time error.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package apihelpers carries the low-level HTTP/db utility functions shared by airlock's two HTTP surfaces:
|
Package apihelpers carries the low-level HTTP/db utility functions shared by airlock's two HTTP surfaces: |
|
Package apperr holds the cross-cutting sentinel errors, their detail-wrapper, and the HTTP status mapping.
|
Package apperr holds the cross-cutting sentinel errors, their detail-wrapper, and the HTTP status mapping. |
|
Package attachref resolves S3-backed attachment references (`s3ref:K`) emitted by agentsdk.attachToContext into storage-ready or LLM-ready forms.
|
Package attachref resolves S3-backed attachment references (`s3ref:K`) emitted by agentsdk.attachToContext into storage-ready or LLM-ready forms. |
|
Package audio centralises audio-format conversion so every transcription entry point (bridge voice notes, agent-invoked /api/agent/llm/transcribe) normalises to a format every STT model accepts.
|
Package audio centralises audio-format conversion so every transcription entry point (bridge voice notes, agent-invoked /api/agent/llm/transcribe) normalises to a format every STT model accepts. |
|
lockout
Package lockout implements per-(email, ip) login throttling for the airlock auth path.
|
Package lockout implements per-(email, ip) login throttling for the airlock auth path. |
|
passkey
Package passkey wraps go-webauthn for airlock's human login.
|
Package passkey wraps go-webauthn for airlock's human login. |
|
Package authz is the single authorization layer every surface gates through.
|
Package authz is the single authorization layer every surface gates through. |
|
Package builder implements the agent build and upgrade pipeline.
|
Package builder implements the agent build and upgrade pipeline. |
|
cmd
|
|
|
airlock
command
|
|
|
airlockvet
command
airlockvet runs the project-specific static checks for the airlock codebase.
|
airlockvet runs the project-specific static checks for the airlock codebase. |
|
Package compat verifies that agent containers and this airlock process were built against compatible agentsdk versions.
|
Package compat verifies that agent containers and this airlock process were built against compatible agentsdk versions. |
|
Package container provides container lifecycle management for agents.
|
Package container provides container lifecycle management for agents. |
|
Package convert provides dbq→proto conversion functions shared by api and realtime packages.
|
Package convert provides dbq→proto conversion functions shared by api and realtime packages. |
|
Package crypto provides AES-256-GCM encryption with versioned keys for rotation.
|
Package crypto provides AES-256-GCM encryption with versioned keys for rotation. |
|
notifications
Package notifications relays PostgreSQL wakeup hints.
|
Package notifications relays PostgreSQL wakeup hints. |
|
gen
|
|
|
Package hostapi implements the authenticated airlock-host control-plane protocol.
|
Package hostapi implements the authenticated airlock-host control-plane protocol. |
|
Package llmledger is the single writer for the llm_usage ledger — the authoritative record of every LLM token/cost charge in Airlock.
|
Package llmledger is the single writer for the llm_usage ledger — the authoritative record of every LLM token/cost charge in Airlock. |
|
Package locale validates the persisted UI locale and renders soft language guidance for human-facing LLM output.
|
Package locale validates the persisted UI locale and renders soft language guidance for human-facing LLM output. |
|
Package modelresolve holds the pure capability→model resolution shared by the runtime LLM proxy (agentapi.resolveModel) and the model-config display (service/models).
|
Package modelresolve holds the pure capability→model resolution shared by the runtime LLM proxy (agentapi.resolveModel) and the model-config display (service/models). |
|
Package networkpolicy provides the outbound HTTP transport used for user-configured destinations.
|
Package networkpolicy provides the outbound HTTP transport used for user-configured destinations. |
|
Package oauth provides OAuth 2.0 PKCE support for Airlock credential management.
|
Package oauth provides OAuth 2.0 PKCE support for Airlock credential management. |
|
scripts
|
|
|
js-executor-check
command
Command js-executor-check verifies the packaged supervisor and its runtime.
|
Command js-executor-check verifies the packaged supervisor and its runtime. |
|
js-executor-check/release
command
Command release checks published images without accessing private source or mutating a registry or Git repository.
|
Command release checks published images without accessing private source or mutating a registry or Git repository. |
|
Package secrets provides a forward-compatible interface for secret storage.
|
Package secrets provides a forward-compatible interface for secret storage. |
|
Package service holds the per-domain business-logic layer that sits between HTTP handlers and the database.
|
Package service holds the per-domain business-logic layer that sits between HTTP handlers and the database. |
|
accounts
Package accounts owns self-profile, session, and subscription projections.
|
Package accounts owns self-profile, session, and subscription projections. |
|
agentruns
Package agentruns owns durable application task sessions, hierarchical calls, scheduling and budgets.
|
Package agentruns owns durable application task sessions, hierarchical calls, scheduling and budgets. |
|
agents
Package agents owns the agent-lifecycle business logic: create, configure, build/upgrade/rollback, start/stop/suspend, list/get detail, and the per-agent git-remote bindings.
|
Package agents owns the agent-lifecycle business logic: create, configure, build/upgrade/rollback, start/stop/suspend, list/get detail, and the per-agent git-remote bindings. |
|
agentstorage
Package agentstorage owns authorization and canonical resolution for paths supplied through user, run, and MCP surfaces.
|
Package agentstorage owns authorization and canonical resolution for paths supplied through user, run, and MCP surfaces. |
|
appruntime
Package appruntime implements capabilities granted to a current app credential.
|
Package appruntime implements capabilities granted to a current app credential. |
|
bridgeevents
Package bridgeevents authorizes bridge controls against their exact persisted platform, account, conversation, and run binding.
|
Package bridgeevents authorizes bridge controls against their exact persisted platform, account, conversation, and run binding. |
|
bridges
Package bridges owns the chat-platform-integration lifecycle: create / list / update / delete a bridge row plus the corresponding poller goroutine and per-bridge driver state.
|
Package bridges owns the chat-platform-integration lifecycle: create / list / update / delete a bridge row plus the corresponding poller goroutine and per-bridge driver state. |
|
capabilities
Package capabilities is the run-scoped authorization and dispatch boundary shared by direct tools and JavaScript capability callbacks.
|
Package capabilities is the run-scoped authorization and dispatch boundary shared by direct tools and JavaScript capability callbacks. |
|
catalog
Package catalog owns the read-only provider/model catalog and the per-provider capability matrix the Settings UI renders.
|
Package catalog owns the read-only provider/model catalog and the per-provider capability matrix the Settings UI renders. |
|
chat
Package chat runs app-bound conversations in Airlock through the shared Sol runtime.
|
Package chat runs app-bound conversations in Airlock through the shared Sol runtime. |
|
chatruns
Package chatruns owns durable hosted-run leases.
|
Package chatruns owns durable hosted-run leases. |
|
connections
Package connections owns reusable connection and MCP credentials, their need-aware OAuth lifecycle, agent env vars, and aggregate setup status.
|
Package connections owns reusable connection and MCP credentials, their need-aware OAuth lifecycle, agent env vars, and aggregate setup status. |
|
connectorartifacts
Package connectorartifacts owns operator access to same-repository connector builds and the cross-replica retention sweep for their object storage.
|
Package connectorartifacts owns operator access to same-repository connector builds and the cross-replica retention sweep for their object storage. |
|
connectordirectories
Package connectordirectories authorizes and dispatches connector directory operations and owns direct agent-storage transfer finalization.
|
Package connectordirectories authorizes and dispatches connector directory operations and owns direct agent-storage transfer finalization. |
|
connectorjobs
Package connectorjobs owns durable connector command dispatch, delivery leases, progress, cancellation, completion, and cross-replica waiting.
|
Package connectorjobs owns durable connector command dispatch, delivery leases, progress, cancellation, completion, and cross-replica waiting. |
|
connectormaintenance
Package connectormaintenance reconciles durable connector lifecycle state.
|
Package connectormaintenance reconciles durable connector lifecycle state. |
|
connectororchestration
Package connectororchestration owns static target groups and persisted multi-target connector command orchestration.
|
Package connectororchestration owns static target groups and persisted multi-target connector command orchestration. |
|
connectors
Package connectors owns connector interface contracts, readiness, grants, and operator-visible connector resources.
|
Package connectors owns connector interface contracts, readiness, grants, and operator-visible connector resources. |
|
conversations
Package conversations owns the read/list/delete + topic-subscription lifecycle of web conversation threads.
|
Package conversations owns the read/list/delete + topic-subscription lifecycle of web conversation threads. |
|
execution
Package execution admits runs with immutable host-derived origin and rechecks their credential and grant state across replicas.
|
Package execution admits runs with immutable host-derived origin and rechecks their credential and grant state across replicas. |
|
gitcredentials
Package gitcredentials owns the per-user git PAT credential surface (list / create / delete).
|
Package gitcredentials owns the per-user git PAT credential surface (list / create / delete). |
|
grants
Package grants owns model entitlements ((provider, model) -> principal).
|
Package grants owns model entitlements ((provider, model) -> principal). |
|
hosts
Package hosts owns host enrollment, authentication, inventory, connector ownership, and durable host management work.
|
Package hosts owns host enrollment, authentication, inventory, connector ownership, and durable host management work. |
|
identity
Package identity owns the per-user mapping from airlock users to external chat-platform user IDs (telegram).
|
Package identity owns the per-user mapping from airlock users to external chat-platform user IDs (telegram). |
|
inboundoauth
Package inboundoauth owns external-client entitlement and authenticated grant management.
|
Package inboundoauth owns external-client entitlement and authenticated grant management. |
|
integrations
Package integrations provides authenticated development-time access to an agent's bound connections and MCP servers.
|
Package integrations provides authenticated development-time access to an agent's bound connections and MCP servers. |
|
jobs
Package jobs owns durable background-job acceptance and lifecycle access.
|
Package jobs owns durable background-job acceptance and lifecycle access. |
|
managedbots
Package managedbots owns the Telegram Bot API "Managed Bots" create-flow's session correlation: airlock UI button → manager-bot deep link → user creates a bot in Telegram → the manager bridge's poll loop receives ManagedBotCreated → bridge row inserted.
|
Package managedbots owns the Telegram Bot API "Managed Bots" create-flow's session correlation: airlock UI button → manager-bot deep link → user creates a bot in Telegram → the manager bridge's poll loop receives ManagedBotCreated → bridge row inserted. |
|
mcpaccess
Package mcpaccess owns external MCP admission, catalogue and file authorization, and durable, credential-bound request cancellation.
|
Package mcpaccess owns external MCP admission, catalogue and file authorization, and durable, credential-bound request cancellation. |
|
members
Package members owns add/list/remove of agent_grants rows — the per-agent sharing list.
|
Package members owns add/list/remove of agent_grants rows — the per-agent sharing list. |
|
models
Package models owns the per-agent model configuration: the eight capability overrides (build/exec/stt/vision/tts/image_gen/embedding/ search), each a (provider FK, bare model name) pair, plus the declared model slots and their per-slot assignments.
|
Package models owns the per-agent model configuration: the eight capability overrides (build/exec/stt/vision/tts/image_gen/embedding/ search), each a (provider FK, bare model name) pair, plus the declared model slots and their per-slot assignments. |
|
needs
Package needs owns the agent-need → resource lifecycle for connections and MCP servers: instantiating a resource from a need's declared shape, binding an existing resource to a need, and listing the resources that could satisfy a need.
|
Package needs owns the agent-need → resource lifecycle for connections and MCP servers: instantiating a resource from a need's declared shape, binding an existing resource to a need, and listing the resources that could satisfy a need. |
|
passkeys
Package passkeys owns the per-user WebAuthn surface: registering, listing, renaming, and deleting the caller's own passkeys, plus setting and removing the caller's password.
|
Package passkeys owns the per-user WebAuthn surface: registering, listing, renaming, and deleting the caller's own passkeys, plus setting and removing the caller's password. |
|
providers
Package providers owns configured LLM provider rows, optional encrypted API keys, confirmed endpoint-specific models, and model discovery.
|
Package providers owns configured LLM provider rows, optional encrypted API keys, confirmed endpoint-specific models, and model discovery. |
|
resources
Package resources owns the per-user inventory and management surface for reusable resources.
|
Package resources owns the per-user inventory and management surface for reusable resources. |
|
runs
Package runs owns the list / get / log / cancel operations for the runs table.
|
Package runs owns the list / get / log / cancel operations for the runs table. |
|
runtime
Package runtime implements the backing operations used by hosted chat and the authenticated agent protocol.
|
Package runtime implements the backing operations used by hosted chat and the authenticated agent protocol. |
|
settings
Package settings owns the single-row system_settings table: the tenant-wide locale and default (provider FK, bare model name) pairs.
|
Package settings owns the single-row system_settings table: the tenant-wide locale and default (provider FK, bare model name) pairs. |
|
slashcommands
Package slashcommands owns command policy and execution against a scoped conversation capability.
|
Package slashcommands owns command policy and execution against a scoped conversation capability. |
|
systemchat
Package systemchat owns system conversation admission and durable execution state.
|
Package systemchat owns system conversation admission and durable execution state. |
|
topicroutes
Package topicroutes resolves enrolled users to live bridge destinations.
|
Package topicroutes resolves enrolled users to live bridge destinations. |
|
usage
Package usage serves read-only rollups over the llm_usage spend ledger for the admin Usage view: a window summary plus per-agent and per-model breakdowns.
|
Package usage serves read-only rollups over the llm_usage spend ledger for the admin Usage view: a window summary plus per-agent and per-model breakdowns. |
|
users
Package users owns the tenant-wide user directory: reads (List / ListDetail / Get / Lookup) at TenantUserView, self-service display-name updates at TenantSelfProfileUpdate, and admin mutators (Create / UpdateRole / Delete) at TenantUserManage.
|
Package users owns the tenant-wide user directory: reads (List / ListDetail / Get / Lookup) at TenantUserView, self-service display-name updates at TenantSelfProfileUpdate, and admin mutators (Create / UpdateRole / Delete) at TenantUserManage. |
|
Package sysagent is the in-airlock chat agent that lets operators manage agents, bridges, connections, members, runs, and other tenant resources through tool calls.
|
Package sysagent is the in-airlock chat agent that lets operators manage agents, bridges, connections, members, runs, and other tenant resources through tool calls. |
|
agentview
Package agentview projects the public API protos down to a compact, LLM-friendly shape for the system agent's tool outputs.
|
Package agentview projects the public API protos down to a compact, LLM-friendly shape for the system agent's tool outputs. |
|
Package trigger provides services that trigger agent containers in response to external events: webhooks, cron schedules, and channel messages.
|
Package trigger provides services that trigger agent containers in response to external events: webhooks, cron schedules, and channel messages. |
|
tgwebapp
Package tgwebapp verifies Telegram Web App initData payloads.
|
Package tgwebapp verifies Telegram Web App initData payloads. |
Click to show internal directories.
Click to hide internal directories.