[JetSquirrel]

Part of #72 and #64. This leaves #72 open: see "What's left".

Why

An agent reading ducklocal open --state couldn't tell a local result from one that came over the network on the person's credentials. It could also read a key typed into a query tab, which #72 says must never happen.

What

open --state gains two things, both additive within schema_version 1:

"connections": {
  "s3": {"endpoint": "s3.example.com", "region": "eu-west-1"},
  "databases": [{"name": "warehouse", "kind": "quack", "location": "remote",
                 "address": "quack:host:9494", "read_only": true}]
}

"reach": {"reach": "remote", "remote_sources": ["s3://b/x.parquet"], "uses_credentials": true}

It also keeps keys out:

Where a key could leak	Now
A query tab's SQL, result SQL, error and chart text	Replaced, with sql_withheld: true on the tab
An address's query string or password	Removed or replaced, in connections, reach and attached
S3Config's Debug output, which printed the secret	Leaves out the key and secret

No network, and the window doesn't wait. The list comes from duckdb_databases(), which is local, unlike load_catalog. If a query holds the connection, databases is null instead of the window blocking.

Recovery hints: CLI errors for an unreachable source now say to check the address and to DETACH and ATTACH again. A 401 or 403 says to have the person check the key, and never to put one in SQL.

Decisions to review

• withheld reuses the session's word list, so a column called access_key or token hides that tab's SQL from the agent. That's common in security logs, and Walk a made-up CloudTrail incident from first query to reviewed report #81 ran into the same cost in a session file. I kept it because the failure is asking the person rather than leaking a key, but it's the choice most likely to annoy.
• reach: "local" means nothing it names is remote. It's read from the SQL alone, so a local view over remote data reads as local. The docs and the skill say so. unknown covers what can't be told, including a bare table name while a remote database is attached.
• connections and reach are outside the revision, like limits. Otherwise a query holding the connection would change the revision with nothing on screen changing.
• Withheld text is redacted before the revision is taken, so its hash can't be tested against guesses. The cost is that editing inside withheld SQL doesn't change the revision.

What's left on #72

• Nothing shows in the window yet: no local or remote indicator, and no warning before running a remote query. I can't check either by eye without changing your saved workspace, and the warning needs a decision on how intrusive it should be.
• Connection setup, validation and reconnect aren't touched. Nothing detects a dropped connection, so location: "remote" says where a database is and not that it answers.
• Query history isn't redacted. It's local, and docs/network-and-privacy.md already says it keeps your SQL, but a typed CREATE SECRET lands there.
• Hints are CLI only. The window shows DuckDB's message as it is.

Testing

• the_state_says_what_it_reaches_and_no_key runs in a test window with S3 configured and a key typed into a tab, then asserts the key appears nowhere in the state and that it fits the schema.
• connections.rs unit tests cover classifying databases, reach and address cleaning.
• cargo test --locked -- --skip perf_probe:: on Windows passes before the final edits: 493 unit, 40 CLI, 3 example, 8 LSP and 4 network-path tests. After them I reran the affected tests; clippy and fmt are clean.
• Not tested against a real server. quack and httpfs aren't installed on this machine, and installing them changes the shared extension folder. So the address format a real Quack attach reports, and the exact wording of the connection errors the hints match, are assumptions. If a wording differs, the error simply has no hint. If Quack's kind differs from quack, it reads as local, but Refresh a quack attach's catalog before listing tables #58 already relies on that kind in schema.rs.

🤖 Generated with Claude Code