docs(wiki): document Unix socket connections (local and via SSH forward)

content/wiki/connections.md

@@ -46,12 +46,14 @@ When creating a connection (`+` button in the sidebar or `Cmd/Ctrl + Shift + N`)
 | **Driver** | Yes | Selects the database type |
 | **Host** | Yes* | Hostname or IP address |
 | **Port** | Yes* | Auto-filled from the driver default |
+| **Local socket path** | No | Unix socket on this machine the drivers connect to instead of Host and Port (MySQL and PostgreSQL). Disables database TLS. Ignored while an SSH or Kubernetes tunnel is enabled. See [Local Unix socket](#local-unix-socket-mysql--postgresql) below. |
 | **Database** | Yes* | The database name to connect to |
 | **Username** | Yes* | Database user |
 | **Password** | No | Stored in OS keychain; never written to disk |
 | **Save in keychain** | — | Controls whether the password persists after closing |
 | **SSH enabled** | No | Activates the SSH tunnel for this connection |
 | **SSH profile** | — | Which saved SSH profile to use for the tunnel |
+| **Socket path** | No | Unix socket on the SSH server the tunnel forwards to instead of Host and Port, for databases that only listen on a socket. Disables database TLS (the SSH tunnel still encrypts the path). See [SSH Tunneling → Forwarding to a Unix Socket](/wiki/ssh-tunneling#forwarding-to-a-unix-socket). |
 | **Allow interactive prompts** | No | Lets the SSH tunnel prompt in-app for a key passphrase, security-key PIN, or password when it can't authenticate silently. See [SSH Tunneling → Interactive Authentication](/wiki/ssh-tunneling#interactive-authentication-passphrases--security-keys). |
 | **Startup script** | No | SQL run on every new pooled connection (see [Startup Script](#startup-script) below). |
 | **Kubernetes** | No | Tunnels the connection through a managed `kubectl port-forward`. Mutually exclusive with SSH. See [Kubernetes Tunneling](/wiki/kubernetes-tunneling). |
@@ -95,6 +97,19 @@ SELECT set_config('app.bypass_rls', 'on', false);
 
 applies to every subsequent query instead of randomly depending on which pooled connection you landed on. Any `SET` or session-setup statement works; multiple statements can be separated normally, and blank or whitespace-only scripts are skipped. The script is stored with the connection profile as non-secret configuration.
 
+### Local Unix socket (MySQL / PostgreSQL)
+
+A database on the same machine can be reached through its Unix socket instead of TCP: set the optional **Local Socket Path** field in the General tab. No tunnel is involved — the drivers dial the socket directly.
+
+When a local socket path is set:
+
+- The drivers connect to that socket instead of Host and Port (both fields grey out).
+- Point at the socket file itself: typically `/tmp/mysql.sock` (MySQL on macOS/Homebrew), `/var/run/mysqld/mysqld.sock` (MySQL on Linux), or `/var/run/postgresql/.s.PGSQL.5432` (PostgreSQL). For PostgreSQL, a plain socket *directory* also works, paired with the Port field.
+- Database TLS is turned off automatically — it cannot be negotiated over a Unix socket, and the traffic never leaves the machine.
+- The field is ignored while an SSH or Kubernetes tunnel is enabled: the tunnel owns the route to the database. To reach a *remote* socket-only database, use [SSH Tunneling → Forwarding to a Unix Socket](/wiki/ssh-tunneling#forwarding-to-a-unix-socket) instead.
+
+Plugin drivers can opt into the field with the `unix_socket` capability in their manifest (see [Plugins → Capabilities](/wiki/plugins#capabilities)).
+
 ### SQLite
 
 For SQLite, provide the absolute path to the `.db` or `.sqlite` file using the file picker. There is no host, port, or authentication.

content/wiki/plugins.md

@@ -92,6 +92,7 @@ Every plugin must include a `manifest.json` that tells Tabularis its capabilitie
 | `connection_string_example` | string | Optional placeholder example shown in the connection string import field (e.g. `"clickhouse://user:pass@localhost:9000/db"`). `connectionStringExample` is also accepted. |
 | `manage_tables` | bool | `true` to enable table and column management UI (Create Table, Add/Modify/Drop Column, Drop Table). Does not control index or FK operations. Defaults to `true`. |
 | `readonly` | bool | When `true`, the driver is read-only: all data modification operations (INSERT, UPDATE, DELETE) are disabled in the UI. Table and column management is also hidden regardless of `manage_tables`. Defaults to `false`. |
+| `unix_socket` | bool | `true` if the driver can connect through a local Unix socket instead of host:port. Shows the **Local Socket Path** field in the connection editor; the path reaches the plugin in the connection params as `unix_socket_path`. `unixSocket` is also accepted. Defaults to `false`. |
 
 ### Data Type Categories
 

content/wiki/ssh-tunneling.md

@@ -92,6 +92,18 @@ Click **Test** before saving. Tabularis performs a real SSH handshake and report
 
 When you connect, the tunnel is established first, then the database driver connects through it. If the tunnel fails, the exact SSH error is surfaced — no generic "connection refused" messages.
 
+## Forwarding to a Unix Socket
+
+Some databases only listen on a Unix socket: MySQL with `skip_networking`, PostgreSQL with `listen_addresses = ''`. For those, set the optional **Socket Path** field in the SSH section of the connection editor. (For a socket-only database on *your own* machine, no tunnel is needed — use the **Local Socket Path** field instead; see [Connections → Local Unix socket](/wiki/connections#local-unix-socket-mysql--postgresql).)
+
+When a socket path is set:
+
+- The SSH server connects to that socket instead of Host and Port (both fields grey out). Under the hood this is a `direct-streamlocal@openssh.com` channel on the Russh backend, and `ssh -L <local_port>:/path/to/socket` on the System SSH backend.
+- Database TLS is turned off automatically. A server listening on a Unix socket cannot negotiate TLS, and the SSH tunnel already encrypts the whole path.
+- The path must be absolute, as it appears on the SSH server, and must point at the socket file itself — not the directory holding it. Typical values are `/var/run/mysqld/mysqld.sock` (MySQL) and `/var/run/postgresql/.s.PGSQL.5432` (PostgreSQL).
+
+The socket path belongs to the database connection, not to the SSH profile, so a single bastion profile can serve both TCP and socket-only databases.
+
 ## Multi-Hop / ProxyJump
 
 For databases behind multiple bastion layers, define the chain in `~/.ssh/config` and use the System SSH backend (key-only auth, no password):