---
name: query-shz-highgo
description: Query the SHZ HighGo Security Enterprise Edition database through its SSH gateway using a guarded read-only psql workflow. Use when Codex is working in the shz-backend project and needs to inspect database schemas, tables, columns, row counts, or application data; diagnose data-related behavior; or execute SELECT, WITH, SHOW, or EXPLAIN statements against the project's HighGo database.
---

# Query SHZ HighGo

Use the bundled script to run read-only SQL through the configured SSH gateway.

## Query workflow

1. Form the narrowest useful query. Add a small `LIMIT` when inspecting rows.
2. For unfamiliar tables, inspect `information_schema.columns` before selecting business data.
3. Run:

   ```bash
   .codex/skills/query-shz-highgo/scripts/query.sh 'SELECT current_database(), current_user, current_schema()'
   ```

4. Summarize the result and distinguish returned facts from inferences.

The script accepts only statements beginning with `SELECT`, `WITH`, `SHOW`, or `EXPLAIN`, rejects multiple statements, sets `search_path` to `shz,public`, enforces database-level read-only mode, and applies a 30-second timeout. Never bypass these controls or perform writes unless the user explicitly requests a separate write-capable workflow.

## Schema discovery

List user tables:

```bash
.codex/skills/query-shz-highgo/scripts/query.sh "SELECT table_schema, table_name FROM information_schema.tables WHERE table_schema NOT IN ('pg_catalog', 'information_schema') ORDER BY 1, 2"
```

Inspect columns:

```bash
.codex/skills/query-shz-highgo/scripts/query.sh "SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = 'shz' AND table_name = 'lowercase_table_name' ORDER BY ordinal_position"
```

HighGo may expose unquoted identifiers in lowercase and quoted identifiers with exact case. Query `information_schema` first when the spelling is uncertain.

## Connection details

Read [references/connection.md](references/connection.md) only when troubleshooting connectivity or updating the endpoint. Do not print, quote, or expose the password file.