@carllee1983/dbcli 1.56.0 → 1.57.0

package/dist/core.mjs

@@ -1798,6 +1798,20 @@ Reference: {referencePath}`,
     add_enum_description: "Create an enum type (PostgreSQL only)",
     alter_enum_description: "Add a value to an enum type",
     drop_enum_description: "Drop an enum type"
+  },
+  password: {
+    description: "Change the password of a single connection, leaving every other setting untouched",
+    arg_connection: "Connection name (defaults to the current default connection)",
+    opt_stdin: "Read the new password from stdin (for rotation scripts)",
+    opt_password: "New password given inline (visible in shell history and process list)",
+    opt_skip_test: "Skip verifying the new password against the database before saving",
+    prompt: "New password for connection '{name}'",
+    source_conflict: "--password and --stdin cannot be used together; pick one source.",
+    needs_source: "No terminal available for a masked prompt. Pass the value with --stdin or --password.",
+    empty: "The new password is empty; nothing was changed.",
+    updated: "Password for connection '{name}' updated \u2192 {envFile} ({varName})",
+    converted: 'The literal password in config.json was replaced by a {{ "$env": "{varName}" }} reference; later rotations only touch the env file.',
+    skipped_test: "Verification skipped (--skip-test): the new password was not checked against the database."
   }
 };
 // resources/lang/zh-TW/messages.json
@@ -2078,6 +2092,20 @@ var messages_default2 = {
     add_enum_description: "\u5EFA\u7ACB\u5217\u8209\u578B\u5225\uFF08\u50C5 PostgreSQL\uFF09",
     alter_enum_description: "\u65B0\u589E\u5217\u8209\u503C",
     drop_enum_description: "\u522A\u9664\u5217\u8209\u578B\u5225"
+  },
+  password: {
+    description: "\u53EA\u8B8A\u66F4\u55AE\u4E00\u9023\u7DDA\u7684\u5BC6\u78BC\uFF0C\u5176\u9918\u8A2D\u5B9A\u539F\u5C01\u4E0D\u52D5",
+    arg_connection: "\u9023\u7DDA\u540D\u7A31\uFF08\u7701\u7565\u6642\u6539\u9810\u8A2D\u9023\u7DDA\uFF09",
+    opt_stdin: "\u5F9E stdin \u8B80\u53D6\u65B0\u5BC6\u78BC\uFF08\u4F9B\u8F2A\u66FF\u8173\u672C\u4F7F\u7528\uFF09",
+    opt_password: "\u76F4\u63A5\u5E36\u5165\u65B0\u5BC6\u78BC\uFF08\u6703\u7559\u5728 shell \u6B77\u53F2\u8207\u884C\u7A0B\u5217\u8868\uFF09",
+    opt_skip_test: "\u5B58\u6A94\u524D\u4E0D\u5148\u7528\u65B0\u5BC6\u78BC\u9023\u7DDA\u9A57\u8B49",
+    prompt: "\u9023\u7DDA '{name}' \u7684\u65B0\u5BC6\u78BC",
+    source_conflict: "--password \u8207 --stdin \u53EA\u80FD\u64C7\u4E00\u3002",
+    needs_source: "\u6C92\u6709\u7D42\u7AEF\u6A5F\u53EF\u505A\u906E\u853D\u8F38\u5165\uFF0C\u8ACB\u6539\u7528 --stdin \u6216 --password \u50B3\u5165\u3002",
+    empty: "\u65B0\u5BC6\u78BC\u662F\u7A7A\u7684\uFF0C\u672A\u505A\u4EFB\u4F55\u8B8A\u66F4\u3002",
+    updated: "\u5DF2\u66F4\u65B0\u9023\u7DDA '{name}' \u7684\u5BC6\u78BC \u2192 {envFile}\uFF08{varName}\uFF09",
+    converted: 'config.json \u88E1\u7684\u660E\u6587\u5BC6\u78BC\u5DF2\u6539\u6210 {{ "$env": "{varName}" }} \u53C3\u7167\uFF0C\u4E4B\u5F8C\u8F2A\u66FF\u53EA\u6703\u52D5 env \u6A94\u3002',
+    skipped_test: "\u5DF2\u8DF3\u904E\u9A57\u8B49\uFF08--skip-test\uFF09\uFF1A\u65B0\u5BC6\u78BC\u672A\u7D93\u8CC7\u6599\u5EAB\u78BA\u8A8D\u3002"
   }
 };
 // resources/lang/en/shell.json
@@ -6017,6 +6045,13 @@ async function select(message, choices) {
     return await selectFallback(message, choices);
   return await inquirer.select({ message, choices });
 }
+async function secret(message) {
+  const inquirer = await loadInquirer();
+  if (!inquirer) {
+    throw new Error("Masked input is unavailable; pass the value with --stdin or --password instead.");
+  }
+  return await inquirer.password({ message, mask: "*" });
+}
 async function confirm(message) {
   if (!process.stdin.isTTY)
     return await confirmFallback(message);
@@ -6028,7 +6063,8 @@ async function confirm(message) {
 var promptUser = {
   text,
   select,
-  confirm
+  confirm,
+  secret
 };
 
 // src/types/blacklist.ts
@@ -10755,43 +10791,11 @@ function listConnections(config) {
   });
 }
 // src/core/config-v2-mutations.ts
-import { join as join8 } from "path";
 var SQL_SYSTEMS = ["postgresql", "mysql", "mariadb"];
 function envVarNameFor(connName, field) {
   const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return `DBCLI_${slug}_${field.toUpperCase()}`;
 }
-async function writeConnectionSecret(projectPath, connName, field, value) {
-  assertConfigMutationApproved();
-  if (value.includes(`
-`) || value.includes("\r")) {
-    throw new Error("secret value \u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
-  }
-  const config = await readV2Config(projectPath);
-  const conn = config.connections[connName];
-  if (!conn)
-    throw new Error(`\u9023\u7DDA '${connName}' \u4E0D\u5B58\u5728`);
-  const storagePath = await resolveConfigStoragePath(projectPath);
-  const envFile = conn.envFile ?? `.env.${connName}`;
-  const envPath = join8(storagePath, envFile);
-  const varName = envVarNameFor(connName, field);
-  let content = "";
-  const file = Bun.file(envPath);
-  if (await file.exists())
-    content = await file.text();
-  const line = `${varName}=${value}`;
-  const re = new RegExp(`^${varName}=.*$`, "m");
-  if (re.test(content)) {
-    content = content.replace(re, line);
-  } else {
-    content = content.length && !content.endsWith(`
-`) ? `${content}
-${line}
-` : `${content}${line}
-`;
-  }
-  await Bun.write(envPath, content);
-}
 function removeConnection(config, name) {
   if (!(name in config.connections))
     throw new Error(`\u9023\u7DDA '${name}' \u4E0D\u5B58\u5728`);
@@ -10853,6 +10857,135 @@ function upsertConnection(config, input) {
     connections: { ...config.connections, [input.name]: connection }
   };
 }
+// src/core/connection-credential.ts
+import { join as join8 } from "path";
+
+// src/core/env-file-writer.ts
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname as dirname2 } from "path";
+var SECRET_FILE_MODE = 384;
+function escapeForRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function upsertEnvVar(envPath, varName, value) {
+  let content = "";
+  try {
+    content = await readFile2(envPath, "utf8");
+  } catch (cause) {
+    const code = cause.code;
+    if (code !== "ENOENT")
+      throw cause;
+    await mkdir3(dirname2(envPath), { recursive: true });
+  }
+  const line = `${varName}="${value}"`;
+  const existing = new RegExp(`^${escapeForRegExp(varName)}=.*$`, "m");
+  if (existing.test(content)) {
+    content = content.replace(existing, () => line);
+  } else {
+    content = content.length && !content.endsWith(`
+`) ? `${content}
+${line}
+` : `${content}${line}
+`;
+  }
+  await writeFile(envPath, content, { mode: SECRET_FILE_MODE });
+  await chmod2(envPath, SECRET_FILE_MODE);
+}
+
+// src/core/connection-credential.ts
+var DEFAULT_ENV_FILE = ".env.local";
+var V1_VAR_NAME = "DBCLI_PASSWORD";
+var V1_CONNECTION_NAME = "default";
+async function readRawConfig(storagePath) {
+  const configPath = join8(storagePath, "config.json");
+  const file = Bun.file(configPath);
+  if (!await file.exists()) {
+    throw new ConfigError(`\u627E\u4E0D\u5230\u8A2D\u5B9A\u6A94\uFF1A${configPath}`);
+  }
+  return JSON.parse(await file.text());
+}
+function envRefName(value) {
+  if (typeof value === "object" && value !== null && "$env" in value) {
+    return String(value.$env);
+  }
+  return;
+}
+async function resolvePasswordTarget(projectPath, connectionName) {
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  if (detectConfigVersion(raw) !== 2) {
+    if (connectionName && connectionName !== V1_CONNECTION_NAME) {
+      throw new ConfigError(`\u9019\u662F v1 \u8A2D\u5B9A\uFF0C\u53EA\u6709\u4E00\u689D\u9023\u7DDA\uFF0C\u7121\u6CD5\u6307\u5B9A\u9023\u7DDA\u540D\u7A31 '${connectionName}'\u3002` + `\u9700\u8981\u591A\u9023\u7DDA\u8ACB\u5148\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2\u3002`);
+    }
+    const connection2 = raw.connection ?? {};
+    const customRef = envRefName(connection2.password);
+    if (customRef !== undefined && customRef !== V1_VAR_NAME) {
+      throw new ConfigError(`\u9019\u500B v1 \u8A2D\u5B9A\u7684\u5BC6\u78BC\u4F86\u81EA\u74B0\u5883\u8B8A\u6578 '${customRef}'\uFF0Cdbcli \u7121\u6CD5\u4EE3\u70BA\u8F2A\u66FF\u3002` + `\u8ACB\u76F4\u63A5\u66F4\u65B0\u8A72\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u7528 dbcli init --conn-name <name> \u5347\u7D1A\u5230 v2 \u5F8C\u518D\u8F2A\u66FF\u3002`);
+    }
+    return {
+      connection: V1_CONNECTION_NAME,
+      envFile: DEFAULT_ENV_FILE,
+      varName: V1_VAR_NAME,
+      convertedToEnvRef: false
+    };
+  }
+  const config = await readV2Config(projectPath);
+  const targetName = connectionName ?? config.default;
+  const connection = config.connections[targetName];
+  if (!connection) {
+    throw new ConfigError(connectionNotFoundMessage(targetName, Object.keys(config.connections)));
+  }
+  const referencedVar = envRefName(connection.password);
+  return {
+    connection: targetName,
+    envFile: connection.envFile ?? DEFAULT_ENV_FILE,
+    varName: referencedVar ?? envVarNameFor(targetName, "password"),
+    convertedToEnvRef: referencedVar === undefined
+  };
+}
+function assertSingleLine(value) {
+  if (value.includes(`
+`) || value.includes("\r")) {
+    throw new ConfigError("\u5BC6\u78BC\u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
+  }
+}
+async function stripV1LiteralPassword(storagePath, raw) {
+  const connection = raw.connection ?? {};
+  if (typeof connection.password !== "string")
+    return;
+  const stripped = { ...raw, connection: { ...connection } };
+  delete stripped.connection.password;
+  await writeConfigWithIntegrity(storagePath, JSON.stringify(stripped, null, 2));
+}
+async function setConnectionPassword(projectPath, connectionName, password) {
+  assertConfigMutationApproved();
+  assertSingleLine(password);
+  const target = await resolvePasswordTarget(projectPath, connectionName);
+  const storagePath = await resolveConfigStoragePath(projectPath);
+  const raw = await readRawConfig(storagePath);
+  await upsertEnvVar(join8(storagePath, target.envFile), target.varName, password);
+  if (detectConfigVersion(raw) !== 2) {
+    await stripV1LiteralPassword(storagePath, raw);
+    return target;
+  }
+  const config = await readV2Config(projectPath);
+  const connection = config.connections[target.connection];
+  const needsEnvFile = connection.envFile === undefined;
+  if (target.convertedToEnvRef || needsEnvFile) {
+    await writeV2Config(projectPath, {
+      ...config,
+      connections: {
+        ...config.connections,
+        [target.connection]: {
+          ...connection,
+          envFile: target.envFile,
+          ...target.convertedToEnvRef && { password: { $env: target.varName } }
+        }
+      }
+    });
+  }
+  return target;
+}
 // src/utils/config-error-format.ts
 var SUPPORTED_SYSTEMS = [
   "postgresql",
@@ -10938,7 +11071,7 @@ function isZodError(error) {
 
 // src/core/config.ts
 import { join as join9 } from "path";
-import { mkdir as mkdir3 } from "fs/promises";
+import { mkdir as mkdir4 } from "fs/promises";
 // src/agent-core/env-ref.ts
 function resolveEnvRef(value, fieldName, env = process.env) {
   if (typeof value === "string")
@@ -11008,7 +11141,11 @@ function resolveEnvReferences(config, env, parentKey) {
 }
 function parseEnvPassword(content) {
   const match = content.match(/^DBCLI_PASSWORD=(.+)$/m);
-  return match?.[1] != null ? match[1].trim() : null;
+  if (match?.[1] == null)
+    return null;
+  const raw = match[1].trim();
+  const quoted = raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'");
+  return quoted && raw.length >= 2 ? raw.slice(1, -1) : raw;
 }
 var configModule = {
   async read(path, connectionName, options = {}) {
@@ -11187,7 +11324,7 @@ ${formatConfigValidationError(error, raw)}`);
         isDirectory = false;
       }
       if (isDirectory || path.endsWith(".dbcli") || path === storagePath && isDirectory) {
-        await mkdir3(storagePath, { recursive: true });
+        await mkdir4(storagePath, { recursive: true });
         const hasEnvReferences = isEnvReference(config.connection.password);
         if (hasEnvReferences) {
           const configJson = JSON.stringify(config, null, 2);
@@ -11543,9 +11680,10 @@ var readConfig = (path, connectionName) => configModule.read(path, connectionNam
 export {
   writeV2Config,
   writeProjectBinding,
-  writeConnectionSecret,
   upsertConnection,
   setDefaultConnection,
+  setConnectionPassword,
+  resolvePasswordTarget,
   resolveConnection,
   resolveConfigStoragePath,
   removeConnection,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "1.56.0",
+  "version": "1.57.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {

package/plugins/dbcli-agent/skills/dbcli/SKILL.md

@@ -310,6 +310,19 @@ dbcli init --rename staging:stg           # rename
 dbcli init --remove stg                   # remove
 ```
 
+Rotating one connection's password — nothing else in the config moves:
+
+```bash
+dbcli password prod                       # masked prompt
+rotate-secret | dbcli password prod --stdin   # for scheduled rotation scripts
+```
+
+The value goes to the env var the config actually references (a literal password
+is converted to `{ "$env": ... }` on first use, and a connection with no
+`envFile` gets one recorded so the reader loads it), is verified by connecting
+before it is saved (`--skip-test` to opt out), and the env file is written
+`0600` on POSIX.
+
 For a connection shared across projects, use the explicit root-level `--global` scope. It stores a v2 registry at `~/.config/dbcli/config.json`; it does not create or modify a project binding:
 
 ```bash

package/plugins/dbcli-agent/skills/dbcli/reference.md

@@ -22,6 +22,7 @@ never the right move.
 **Commands** —
 [init](#init) ·
 [use](#use) ·
+[password](#password) ·
 [list](#list) ·
 [schema](#schema) ·
 [query](#query) ·
@@ -196,6 +197,46 @@ dbcli list --use prod
 
 **Options:** `--list`, `--format <text|json>`, `--confirm-production <name>` (required when explicitly selecting a production connection as the default).
 
+### password
+
+Change one connection's password without touching any other setting — built for
+environments where credentials rotate on a schedule.
+
+```bash
+dbcli password                       # Masked prompt, rotates the default connection
+dbcli password prod                  # Masked prompt, rotates 'prod'
+rotate-secret | dbcli password prod --stdin   # Non-interactive, nothing lands in shell history
+dbcli password prod --password "$NEW" --skip-test --format json
+```
+
+Where the value lands is read from the config, never guessed: a connection whose
+`password` is `{ "$env": "NAME" }` gets `NAME` rewritten in its `envFile`. A
+connection that declares no `envFile` has one recorded (`.env.local`) as part of
+the rotation — without it the reader would never load the file. A connection
+still holding a literal password is converted to
+`{ "$env": "DBCLI_<CONN>_PASSWORD" }` once, so later rotations only touch the env
+file. Values are written quoted (`NAME="..."`), so leading and trailing
+whitespace survives the round trip.
+
+v1 configs rewrite `DBCLI_PASSWORD` in `.env.local`, matching the v1 reader. A v1
+config whose password comes from some other environment variable is refused with
+an explanation: v1 has no per-connection env file, so no file dbcli writes could
+make that variable resolve — set it in the environment, or migrate to v2.
+
+The new password is verified by connecting with it before anything is written,
+so a bad rotation fails without leaving broken credentials behind. Pass
+`--skip-test` when the database is unreachable from where the command runs. The
+env file is written with `0600` permissions on POSIX systems (Windows has no
+equivalent mode bit — the file inherits the directory's ACL), and the value is
+never echoed or
+logged.
+
+**Options:** `[connection]`, `--stdin`, `--password <value>` (visible in shell
+history and the process list — prefer `--stdin`), `--skip-test`,
+`--format <text|json>`.
+
+Blocked under `DBCLI_AGENT_MODE=1` like every other credential mutation.
+
 ### Agent configuration trust boundary
 
 When `DBCLI_AGENT_MODE=1`, configuration, permission, and credential mutations

package/skills/dbcli/SKILL.md

@@ -310,6 +310,19 @@ dbcli init --rename staging:stg           # rename
 dbcli init --remove stg                   # remove
 ```
 
+Rotating one connection's password — nothing else in the config moves:
+
+```bash
+dbcli password prod                       # masked prompt
+rotate-secret | dbcli password prod --stdin   # for scheduled rotation scripts
+```
+
+The value goes to the env var the config actually references (a literal password
+is converted to `{ "$env": ... }` on first use, and a connection with no
+`envFile` gets one recorded so the reader loads it), is verified by connecting
+before it is saved (`--skip-test` to opt out), and the env file is written
+`0600` on POSIX.
+
 For a connection shared across projects, use the explicit root-level `--global` scope. It stores a v2 registry at `~/.config/dbcli/config.json`; it does not create or modify a project binding:
 
 ```bash

package/skills/dbcli/reference.md

@@ -22,6 +22,7 @@ never the right move.
 **Commands** —
 [init](#init) ·
 [use](#use) ·
+[password](#password) ·
 [list](#list) ·
 [schema](#schema) ·
 [query](#query) ·
@@ -196,6 +197,46 @@ dbcli list --use prod
 
 **Options:** `--list`, `--format <text|json>`, `--confirm-production <name>` (required when explicitly selecting a production connection as the default).
 
+### password
+
+Change one connection's password without touching any other setting — built for
+environments where credentials rotate on a schedule.
+
+```bash
+dbcli password                       # Masked prompt, rotates the default connection
+dbcli password prod                  # Masked prompt, rotates 'prod'
+rotate-secret | dbcli password prod --stdin   # Non-interactive, nothing lands in shell history
+dbcli password prod --password "$NEW" --skip-test --format json
+```
+
+Where the value lands is read from the config, never guessed: a connection whose
+`password` is `{ "$env": "NAME" }` gets `NAME` rewritten in its `envFile`. A
+connection that declares no `envFile` has one recorded (`.env.local`) as part of
+the rotation — without it the reader would never load the file. A connection
+still holding a literal password is converted to
+`{ "$env": "DBCLI_<CONN>_PASSWORD" }` once, so later rotations only touch the env
+file. Values are written quoted (`NAME="..."`), so leading and trailing
+whitespace survives the round trip.
+
+v1 configs rewrite `DBCLI_PASSWORD` in `.env.local`, matching the v1 reader. A v1
+config whose password comes from some other environment variable is refused with
+an explanation: v1 has no per-connection env file, so no file dbcli writes could
+make that variable resolve — set it in the environment, or migrate to v2.
+
+The new password is verified by connecting with it before anything is written,
+so a bad rotation fails without leaving broken credentials behind. Pass
+`--skip-test` when the database is unreachable from where the command runs. The
+env file is written with `0600` permissions on POSIX systems (Windows has no
+equivalent mode bit — the file inherits the directory's ACL), and the value is
+never echoed or
+logged.
+
+**Options:** `[connection]`, `--stdin`, `--password <value>` (visible in shell
+history and the process list — prefer `--stdin`), `--skip-test`,
+`--format <text|json>`.
+
+Blocked under `DBCLI_AGENT_MODE=1` like every other credential mutation.
+
 ### Agent configuration trust boundary
 
 When `DBCLI_AGENT_MODE=1`, configuration, permission, and credential mutations