@carllee1983/dbcli 10.0.0 → 11.0.0

package/dist/cli.mjs

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "10.0.0",
+  version: "11.0.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -103,6 +103,7 @@ var package_default = {
     "lru-cache": "^11.4.0",
     "lucide-react": "^1.16.0",
     mongodb: "^7.2.0",
+    "mongodb-connection-string-url": "^7.0.1",
     mysql2: "^3.24.3",
     "node-sql-parser": "5",
     open: "^11.0.0",

package/dist/core.d.ts

@@ -36,6 +36,8 @@ export interface ConnectionOptions {
 	replicaSet?: string;
 	/** MongoDB TLS switch (optional, field-based config; implied true when srv) */
 	tls?: boolean;
+	/** MongoDB extra driver options appended to the URI query string (field-based config, plain strings only) */
+	options?: Record<string, string>;
 	/** MongoDB SRV lookup — build a mongodb+srv:// URI from host (optional, field-based config) */
 	srv?: boolean;
 	/** Connection timeout in milliseconds (default: 5000) */
@@ -440,6 +442,8 @@ interface MongoDBConnectionConfig {
 		$env: string;
 	};
 	tls?: boolean;
+	/** Extra driver options appended to the URI query string; plain strings, no env-ref */
+	options?: Record<string, string>;
 	/** Build a mongodb+srv:// URI from host and expand it via DNS SRV lookup */
 	srv?: boolean;
 }
@@ -1105,6 +1109,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				}>
 			]>>;
 			tls: z.ZodOptional<z.ZodBoolean>;
+			options: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
 			srv: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 		}, "strip", z.ZodTypeAny, {
 			password: string | {
@@ -1134,6 +1139,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 		}, {
@@ -1163,6 +1169,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
@@ -1569,6 +1576,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 	} | {
@@ -1701,6 +1709,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		srv?: boolean | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
@@ -2154,6 +2163,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				}>
 			]>>;
 			tls: z.ZodOptional<z.ZodBoolean>;
+			options: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
 			srv: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 		} & {
 			permission: z.ZodDefault<z.ZodEnum<[
@@ -2193,6 +2203,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			envFile?: string | undefined;
@@ -2224,6 +2235,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
 			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
@@ -2570,6 +2582,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2704,6 +2717,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2980,6 +2994,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3174,6 +3189,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;

package/dist/core.mjs

@@ -1261,6 +1261,22 @@ var messages_default = {
     secret_alternatives_sql: "pass --password, supply the credential through .env or the process environment, or store a reference with --use-env-refs",
     secret_alternatives_mongo_password: "pass --password, supply the credential through .env or the process environment, or paste the connection string with --uri",
     secret_alternatives_mongo_uri: "pass the connection string with --uri",
+    mongo_uri_conflicts_fields: "--uri cannot be combined with {flags}: the connection string already carries those settings. Use one or the other (--name may be combined to override the database name).",
+    mongo_uri_with_env_refs: "--uri cannot be combined with --use-env-refs: the connection string is decomposed into config fields, and its credentials are not moved into environment variables. Either remove --use-env-refs so dbcli decomposes the string into the field config, or use the --env-* flags (--env-host, --env-user, --env-password, ...) to name one variable per field.",
+    mongo_uri_fallback_warning: "\u26A0\uFE0F  This connection string {reasons}, so it cannot become fields. It is stored as-is in uri, and its credentials will sit in plaintext in the config file.",
+    mongo_uri_reason_multi_host: "contains more than one host (a field config holds only one)",
+    mongo_uri_reason_secret_option: "contains secret option(s) ({keys}) that would land in plaintext options",
+    mongo_uri_reason_duplicate_key: "repeats the query key(s) {keys} (a field config can hold only one value per key)",
+    mongo_uri_reason_non_scram: "uses the non-SCRAM auth mechanism {mechanism} (field config cannot express it)",
+    mongo_decomposed_header: "Connection string decomposed into these fields (password hidden):",
+    mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs does not apply to a pasted connection string: its credentials are written to the config file as they are, not as environment-variable references.",
+    mongo_setup_mode_paste: "Paste a connection string (copied from Atlas / Compass)",
+    mongo_string_invalid: "Not a valid MongoDB connection string (it is not echoed because it may carry credentials).",
+    mongo_string_bad_host: "The connection string has an invalid host or port (the port must be an integer from 1 to 65535).",
+    mongo_string_bad_credentials: "The connection string's credentials contain an unescaped reserved character such as @, : or /. Percent-encode it (for example @ as %40).",
+    mongo_string_tls_conflict: "The connection string sets tls and ssl to different values.",
+    mongo_string_bad_tls: "The connection string's {key} must be true or false.",
+    mongo_string_empty_option: "The connection string sets {key} but leaves it empty. Give it a value or remove it.",
     prompt_name: "Database name: ",
     prompt_permission: "Permission level (query-only, read-write, data-admin, admin): ",
     env_parse_note: "Note: Unable to parse .env configuration, using interactive prompts",
@@ -1598,6 +1614,22 @@ var messages_default2 = {
     secret_alternatives_sql: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --use-env-refs \u5B58\u6210\u53C3\u7167",
     secret_alternatives_mongo_password: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --uri \u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32",
     secret_alternatives_mongo_uri: "\u4EE5 --uri \u50B3\u5165\u9023\u7DDA\u5B57\u4E32",
+    mongo_uri_conflicts_fields: "--uri \u4E0D\u80FD\u8207 {flags} \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u5DF2\u5305\u542B\u9019\u4E9B\u8A2D\u5B9A\u3002\u8ACB\u64C7\u4E00\u4F7F\u7528\uFF08--name \u53EF\u4E26\u7528\uFF0C\u7528\u4F86\u8986\u84CB\u8CC7\u6599\u5EAB\u540D\u7A31\uFF09\u3002",
+    mongo_uri_with_env_refs: "--uri \u4E0D\u80FD\u8207 --use-env-refs \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u6703\u88AB\u62C6\u89E3\u6210\u6B04\u4F4D\u8A2D\u5B9A\u5BEB\u5165\uFF0C\u5E33\u5BC6\u4E0D\u6703\u88AB\u62BD\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002\u8ACB\u6539\u8D70\u4E0B\u5217\u4EFB\u4E00\u505A\u6CD5\uFF1A\u62FF\u6389 --use-env-refs\uFF0C\u8B93 dbcli \u62C6\u89E3\u5B57\u4E32\u5BEB\u5165\u6B04\u4F4D\u8A2D\u5B9A\uFF1B\u6216\u6539\u7528 --env-* flag\uFF08--env-host\u3001--env-user\u3001--env-password \u7B49\uFF09\u9010\u6B04\u7D66\u8B8A\u6578\u540D\u7A31\u3002",
+    mongo_uri_fallback_warning: "\u26A0\uFE0F  \u6B64\u9023\u7DDA\u5B57\u4E32{reasons}\uFF0C\u7121\u6CD5\u62C6\u6210\u6B04\u4F4D\u8A2D\u5B9A\uFF0C\u5DF2\u539F\u6A23\u5B58\u5165 uri\uFF1B\u5E33\u5BC6\u5C07\u660E\u6587\u5B58\u653E\u65BC\u8A2D\u5B9A\u6A94\u3002",
+    mongo_uri_reason_multi_host: "\u542B\u591A\u7D44 host\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u53EA\u80FD\u8868\u9054\u4E00\u7D44\uFF09",
+    mongo_uri_reason_secret_option: "\u542B\u6A5F\u5BC6 option\uFF08{keys}\uFF09\uFF0C\u62C6\u9032 options \u6703\u660E\u6587\u843D\u76E4",
+    mongo_uri_reason_duplicate_key: "\u542B\u91CD\u8907\u7684 query \u9375\uFF08{keys}\uFF09\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u6BCF\u500B\u9375\u53EA\u80FD\u5B58\u4E00\u500B\u503C\uFF09",
+    mongo_uri_reason_non_scram: "\u4F7F\u7528\u975E SCRAM \u7684\u8A8D\u8B49\u6A5F\u5236 {mechanism}\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u7121\u6CD5\u8868\u9054\uFF09",
+    mongo_decomposed_header: "\u9023\u7DDA\u5B57\u4E32\u5DF2\u62C6\u89E3\u6210\u4E0B\u5217\u6B04\u4F4D\uFF08\u5BC6\u78BC\u5DF2\u906E\u853D\uFF09\uFF1A",
+    mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs \u4E0D\u9069\u7528\u65BC\u8CBC\u4E0A\u7684\u9023\u7DDA\u5B57\u4E32\uFF1A\u5E33\u5BC6\u6703\u4EE5\u5B57\u9762\u503C\u5BEB\u5165\u8A2D\u5B9A\u6A94\uFF0C\u4E0D\u6703\u8B8A\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002",
+    mongo_setup_mode_paste: "\u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32\uFF08Atlas / Compass \u8907\u88FD\u7684\uFF09",
+    mongo_string_invalid: "\u4E0D\u662F\u5408\u6CD5\u7684 MongoDB \u9023\u7DDA\u5B57\u4E32\uFF08\u5B57\u4E32\u53EF\u80FD\u5E36\u6709\u5E33\u5BC6\uFF0C\u6240\u4EE5\u4E0D\u5370\u51FA\uFF09\u3002",
+    mongo_string_bad_host: "\u9023\u7DDA\u5B57\u4E32\u7684 host \u6216\u57E0\u865F\u4E0D\u5408\u6CD5\uFF08\u57E0\u865F\u9808\u70BA 1 \u81F3 65535 \u7684\u6574\u6578\uFF09\u3002",
+    mongo_string_bad_credentials: "\u9023\u7DDA\u5B57\u4E32\u7684\u5E33\u865F\u6216\u5BC6\u78BC\u542B\u6709\u672A\u8DF3\u812B\u7684\u4FDD\u7559\u5B57\u5143\uFF08\u5982 @\u3001:\u3001/\uFF09\u3002\u8ACB\u505A\u767E\u5206\u6BD4\u7DE8\u78BC\uFF08\u4F8B\u5982 @ \u5BEB\u6210 %40\uFF09\u3002",
+    mongo_string_tls_conflict: "\u9023\u7DDA\u5B57\u4E32\u540C\u6642\u6307\u5B9A\u4E86 tls \u8207 ssl \u4E14\u503C\u4E0D\u540C\u3002",
+    mongo_string_bad_tls: "\u9023\u7DDA\u5B57\u4E32\u7684 {key} \u53EA\u63A5\u53D7 true \u6216 false\u3002",
+    mongo_string_empty_option: "\u9023\u7DDA\u5B57\u4E32\u6307\u5B9A\u4E86 {key} \u537B\u6C92\u6709\u503C\u3002\u8ACB\u7D66\u503C\u6216\u79FB\u9664\u3002",
     prompt_name: "\u8CC7\u6599\u5EAB\u540D\u7A31\uFF1A",
     prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, data-admin, admin\uFF09\uFF1A",
     env_parse_note: "\u63D0\u793A\uFF1A\u7121\u6CD5\u89E3\u6790 .env \u914D\u7F6E\uFF0C\u4F7F\u7528\u4E92\u52D5\u5F0F\u63D0\u793A",
@@ -8496,6 +8528,24 @@ var TimeoutField = {
   timeout: numberType().int().min(MIN_CONNECTION_TIMEOUT_MS).max(MAX_CONNECTION_TIMEOUT_MS).optional(),
   statementTimeout: numberType().int().min(MIN_STATEMENT_TIMEOUT_MS).max(MAX_STATEMENT_TIMEOUT_MS).optional()
 };
+var RESERVED_MONGODB_OPTION_KEYS = {
+  authsource: "authSource",
+  replicaset: "replicaSet",
+  tls: "tls",
+  ssl: "tls"
+};
+var MongoDBOptionsSchema = recordType(stringType(), stringType()).superRefine((options, ctx) => {
+  for (const key of Object.keys(options)) {
+    const field = RESERVED_MONGODB_OPTION_KEYS[key.toLowerCase()];
+    if (field) {
+      ctx.addIssue({
+        code: ZodIssueCode.custom,
+        path: [key],
+        message: `options.${key} duplicates the dedicated '${field}' field; set '${field}' instead`
+      });
+    }
+  }
+});
 var MongoDBConnectionConfigSchema = objectType({
   system: literalType("mongodb"),
   uri: unionType([stringType(), EnvRefSchema]).optional(),
@@ -8507,6 +8557,7 @@ var MongoDBConnectionConfigSchema = objectType({
   authSource: unionType([stringType(), EnvRefSchema]).optional(),
   replicaSet: unionType([stringType(), EnvRefSchema]).optional(),
   tls: booleanType().optional(),
+  options: MongoDBOptionsSchema.optional(),
   srv: booleanType().optional().default(false),
   ...TimeoutField
 });

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Database CLI skill and command reference for AI agents.",
   "contextFileName": "AGENTS.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {
@@ -100,6 +100,7 @@
     "lru-cache": "^11.4.0",
     "lucide-react": "^1.16.0",
     "mongodb": "^7.2.0",
+    "mongodb-connection-string-url": "^7.0.1",
     "mysql2": "^3.24.3",
     "node-sql-parser": "5",
     "open": "^11.0.0",

package/plugins/dbcli-agent/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/plugins/dbcli-agent/skills/dbcli/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/plugins/dbcli-agent/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -3644,7 +3644,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.
 

package/skills/dbcli/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -3644,7 +3644,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.