@carllee1983/dbcli 10.0.0 → 11.0.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Database CLI skill and command reference for AI agents.",
   "author": {
     "name": "Carl Lee",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/.cursor/rules/dbcli.mdc

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/.cursor/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -3644,7 +3644,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.
 

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "dbcli-agent",
   "displayName": "dbcli Agent",
   "description": "Database CLI skill and command reference for AI agents.",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "author": {
     "name": "Carl Lee",
     "url": "https://github.com/CarlLee1983"

package/.github/skills/dbcli/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/.github/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -3644,7 +3644,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.
 

package/CHANGELOG.md

@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [11.0.0] - 2026-10-14
+
+版本為 **11.0.0**。`dbcli init --uri` 寫出的設定形狀改變，且 `--uri` 與欄位 flag 並用會報錯，
+會影響既有腳本，所以採用 major 版本。已存在、含 `uri` 的設定不會被遷移，連線行為不變。
+
+### Changed
+
+- **破壞性變更：`dbcli init --uri` 寫出的設定形狀改變。** 以 `--uri` 傳入的 MongoDB
+  連線字串現在寫入前先拆解成欄位設定（`host`、`user`、`password`、`database`、
+  `authSource`、`replicaSet`、`tls`、`srv`，其餘參數進 `options`），不再原樣存成 `uri`（互動 init 貼上的連線字串也一樣：拆解後列出結果並直接進連線測試，選單第二項改稱「貼上連線字串（Atlas / Compass 複製的）」）；互動終端下 `--uri` 字串沒帶資料庫名稱時，`Database name` 改為必填、不再預設 `testdb`；
+  讀取 `uri` 欄位的腳本須改讀欄位。**既有設定檔裡已存成 `uri` 的連線不會被遷移，照常連線**；
+  只有之後重新以 `--uri` 執行 init 才會套用新的拆解行為。多組 host、帶 `authMechanismProperties`、
+  `tlsCertificateKeyFilePassword`、`proxyPassword`、同一 query 鍵重複出現，或 `authMechanism`
+  不是 `SCRAM-SHA-1`／`SCRAM-SHA-256` 的字串無法拆解，仍存成只含 `system`、
+  `uri`、`database` 的連線並警告帳密明文存放（除此之外一律拆解成欄位）。字串裡的 `ssl` 寫成 `tls`；
+  非 SRV、有帳號、路徑帶資料庫且未寫 `authSource` 的字串，拆解後寫入 `authSource: <路徑資料庫>`，
+  與 driver 對原字串的認證對象一致。`--uri` 與 `--host`／`--port`／`--user`／
+  `--password`／`--auth-source`／`--replica-set`／`--srv`／`--tls`／`--no-tls` 並用，
+  以及與 `--use-env-refs` 並用，現在都會報錯（後者原本只警告）。
+- **`srv: true` 欄位設定的 `authSource` 改為 SRV TXT 優先。** 既有、有 `user` 但未設定
+  `authSource` 的 `srv: true` 連線，若 SRV TXT record 提供 `authSource`，現在會採用該值，
+  不再固定使用 `admin`；TXT 沒有提供時仍補 `admin`。明確設定的 `authSource` 欄位仍優先，
+  非 SRV 的欄位設定維持預設 `admin`。
+
+### Added
+
+- **MongoDB 欄位設定新增 `options`**：字串對字串的物件，內容附加到連線 URI 的 query
+  （例如 `{"retryWrites": "false", "appName": "dbcli"}`）。只接受純字串，不支援 env-ref；
+  鍵若與 `authSource`／`replicaSet`／`tls`／`ssl` 同名（不分大小寫）會驗證失敗並指出該鍵，
+  請改設專屬欄位。設定了 `uri` 時 `options` 被忽略。
+- **`dbcli init` 新增 MongoDB flag**：`--replica-set <name>`、`--srv`、`--tls` / `--no-tls`。
+  `--srv` 寫入 `srv: true` 且不寫 `port`，並在同時給 `--port`／`--env-port` 時警告該 port 被忽略；
+  `--tls` 與 `--no-tls` 皆未給時不寫 `tls`，沿用 driver 預設。互動精靈不會再問已用 flag
+  給的值；搭配 `--use-env-refs` 時這些 flag 同樣生效。
+- **`dbcli doctor` 在 `uri` 與 `options` 並存時警告**：`uri` 優先，`options` 會被忽略
+  （原本只檢查 `host`／`user`，現在 `options` 也納入）。
+
 ## [10.0.0] - 2026-10-13
 
 這次發布整合 npm 9.1.2 之後合併的變更：明確命名連線、可不設預設連線、Bun 1.4.0

package/assets/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/assets/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -3644,7 +3644,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.