Keeping sensitive source encrypted on disk while still running Python code

HY LUO — Fri, 16 Oct 2026 17:02:44 +0000

AI coding tools need to read project files. Some source code should still stay out of the workspace in plaintext.

I built AILatch for that boundary: files stay encrypted on disk, while Python code can run with plaintext materialized only inside the AILatch process.

The basic flow is:

pip install ailatch

ailatch lock secret.py
cat secret.py          # ordinary file reads see ciphertext
ailatch run secret.py  # run the program without restoring plaintext

ailatch run decrypts the entry file in memory and keeps the working-tree file encrypted. Encrypted Python modules can still import each other, and application code can use normal open() and pathlib reads through the runtime hooks.

When I need to inspect or edit a locked file, AILatch provides a controlled plaintext view:

ailatch open .
ailatch show secret.py

The project also includes encrypted backups and recovery commands:

ailatch lock secret.py --recovery
ailatch restore secret.py
ailatch recover secret.py

This is aimed at filesystem-level reads by AI tools and ordinary file utilities. It does not claim to stop a privileged local attacker who can inspect process memory or persuade a user to decrypt a file. Stronger isolation still requires operating-system permissions, process isolation, and careful credential handling.

AILatch currently targets Python 3.11+ and is primarily tested on Windows and macOS.

Repository and full command reference: github.com/lo2589/AILatch

Tags: #opensource #python #security #ai

Repairing one malformed JSONL record with JSONSEEK

HY LUO — Wed, 14 Oct 2026 12:08:53 +0000

A JSONL file can be awkward to inspect when one record stops parsing. I built JSONSEEK to make that workflow more focused: locate the bad line, preview a replacement, then check the file again. Disclosure: I’m the project’s author.

Here’s a small example you can reproduce:

cat > sample.jsonl <<'EOF'
{"id":1,"name":"Ada"}
{"id":2,"name":"unfinished}
EOF

pip install jsonseek
jsonseek shape sample.jsonl

shape reports invalid JSONL lines with their line numbers and parser errors. In this example, line 2 is malformed. Once you know what that record should contain, preview the replacement before writing it:

jsonseek replaceline sample.jsonl 2 '{"id":2,"name":"Grace"}' --dry-run
jsonseek replaceline sample.jsonl 2 '{"id":2,"name":"Grace"}' --backup
jsonseek shape sample.jsonl

The first write command previews the change. The second makes the replacement and requests a .bak backup. The final shape call checks the result.

The same CLI also has path-based commands for inspecting JSON and JSONL (fields, ls, and get), searching with query, and editing values with commands such as set and add. The idea is to inspect the relevant structure or record before changing it.

JSONSEEK is MIT-licensed. The repository has the command reference and more examples. If you work with JSONL, how do you usually find and repair a malformed record?

Tags: #showdev #python #cli #json

DEV Community: HY LUO

Keeping sensitive source encrypted on disk while still running Python code

Repairing one malformed JSONL record with JSONSEEK