@carllee1983/dbcli 10.0.0 → 12.0.0

package/dist/cli.mjs

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "10.0.0",
+  version: "12.0.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -103,6 +103,7 @@ var package_default = {
     "lru-cache": "^11.4.0",
     "lucide-react": "^1.16.0",
     mongodb: "^7.2.0",
+    "mongodb-connection-string-url": "^7.0.1",
     mysql2: "^3.24.3",
     "node-sql-parser": "5",
     open: "^11.0.0",

package/dist/core.d.ts

@@ -36,6 +36,8 @@ export interface ConnectionOptions {
 	replicaSet?: string;
 	/** MongoDB TLS switch (optional, field-based config; implied true when srv) */
 	tls?: boolean;
+	/** MongoDB extra driver options appended to the URI query string (field-based config, plain strings only) */
+	options?: Record<string, string>;
 	/** MongoDB SRV lookup — build a mongodb+srv:// URI from host (optional, field-based config) */
 	srv?: boolean;
 	/** Connection timeout in milliseconds (default: 5000) */
@@ -99,6 +101,8 @@ export interface ColumnSchema {
  * Complete schema information for a table
  */
 export interface TableSchema {
+	/** Some metadata was omitted to protect blacklisted identities. No protected names. */
+	metadataOmitted?: boolean;
 	/** Table name */
 	name: string;
 	/** Exact database schema/catalog namespace, when reliably available */
@@ -124,6 +128,8 @@ export interface TableSchema {
 		name: string;
 		columns: string[];
 		unique: boolean;
+		/** False when expressions/predicates prevent complete column-only representation. */
+		columnsComplete?: boolean;
 	}>;
 	/** Column count (used by listTables when full column details are not loaded) */
 	columnCount?: number;
@@ -132,7 +138,7 @@ export interface TableSchema {
 	/** Type of table (table or view) */
 	tableType?: "table" | "view";
 }
-type ConnectionErrorCode = "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "ENOTFOUND" | "EHOSTUNREACH" | "CONNECTION_LOST" | "TOO_MANY_CONNECTIONS" | "TLS_ERROR" | "SERVER_NOT_READY" | "CONNECTION_REJECTED" | "SQL_SYNTAX_ERROR" | "STATEMENT_TIMEOUT" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "QUERY_ONLY_BOUNDARY_FAILED" | "UNKNOWN";
+type ConnectionErrorCode = "ECONNREFUSED" | "ETIMEDOUT" | "AUTH_FAILED" | "DB_PERMISSION_DENIED" | "ENOTFOUND" | "EHOSTUNREACH" | "CONNECTION_LOST" | "TOO_MANY_CONNECTIONS" | "TLS_ERROR" | "SERVER_NOT_READY" | "CONNECTION_REJECTED" | "SQL_SYNTAX_ERROR" | "STATEMENT_TIMEOUT" | "TABLE_NOT_FOUND" | "COLUMN_NOT_FOUND" | "QUERY_ONLY_BOUNDARY_FAILED" | "UNKNOWN";
 export declare class ConnectionError extends Error {
 	/** Error category code */
 	code: ConnectionErrorCode;
@@ -194,6 +200,10 @@ type RedisWarning = {
 	count: number;
 };
 interface TableSchemaOptions {
+	/** Single-object schema command: validate presence/type and mark incomplete index metadata. */
+	metadataProtection?: boolean;
+	/** Explicit SQL namespace; local tableName remains literal. Never performs an exact count. */
+	namespace?: string;
 	/** MongoDB: 取樣文件數 */
 	sampleSize?: number;
 	/** MongoDB: 取樣方式 */
@@ -440,6 +450,8 @@ interface MongoDBConnectionConfig {
 		$env: string;
 	};
 	tls?: boolean;
+	/** Extra driver options appended to the URI query string; plain strings, no env-ref */
+	options?: Record<string, string>;
 	/** Build a mongodb+srv:// URI from host and expand it via DNS SRV lookup */
 	srv?: boolean;
 }
@@ -1105,6 +1117,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				}>
 			]>>;
 			tls: z.ZodOptional<z.ZodBoolean>;
+			options: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
 			srv: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 		}, "strip", z.ZodTypeAny, {
 			password: string | {
@@ -1134,6 +1147,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 		}, {
@@ -1163,6 +1177,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
@@ -1569,6 +1584,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 	} | {
@@ -1701,6 +1717,7 @@ declare const DbcliConfigSchema: z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		srv?: boolean | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
@@ -2154,6 +2171,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				}>
 			]>>;
 			tls: z.ZodOptional<z.ZodBoolean>;
+			options: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
 			srv: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 		} & {
 			permission: z.ZodDefault<z.ZodEnum<[
@@ -2193,6 +2211,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			timeout?: number | undefined;
 			statementTimeout?: number | undefined;
 			envFile?: string | undefined;
@@ -2224,6 +2243,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 				$env: string;
 			} | undefined;
 			tls?: boolean | undefined;
+			options?: Record<string, string> | undefined;
 			srv?: boolean | undefined;
 			timeout?: number | undefined;
 			permission?: "admin" | "query-only" | "read-write" | "data-admin" | undefined;
@@ -2570,6 +2590,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2704,6 +2725,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -2980,6 +3002,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;
@@ -3174,6 +3197,7 @@ declare const DbcliConfigV2Schema: z.ZodEffects<z.ZodObject<{
 			$env: string;
 		} | undefined;
 		tls?: boolean | undefined;
+		options?: Record<string, string> | undefined;
 		timeout?: number | undefined;
 		statementTimeout?: number | undefined;
 		envFile?: string | undefined;

package/dist/core.mjs

@@ -1028,6 +1028,7 @@ var COMMAND_CAPABILITY_KEYS = Object.freeze([
   "update",
   "delete",
   "export",
+  "blacklistRead",
   "blacklist",
   "check",
   "diff",
@@ -1096,6 +1097,7 @@ var SQL_BASE = {
   update: cap("supported", "db-write", "Dedicated UPDATE command is supported."),
   delete: cap("supported", "db-write", "Dedicated DELETE command is supported."),
   export: cap("supported", "readonly", "SQL export is supported."),
+  blacklistRead: cap("supported", "readonly", "Reads the configured blacklist rules."),
   blacklist: cap("supported", "local-write", "Blacklist management and enforcement are supported."),
   check: cap("supported", "readonly", "Data health checks are SQL-only."),
   diff: cap("supported", "readonly", "Relational schema snapshots are supported."),
@@ -1196,6 +1198,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
     update: cap("limited", "db-write", "Document update is supported with Mongo-specific behavior."),
     delete: cap("limited", "db-write", "Document delete is supported with Mongo-specific behavior."),
     export: cap("limited", "readonly", "MongoDB export is supported with document-query syntax."),
+    blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
     blacklist: cap("limited", "local-write", "Rule management works; enforcement differs from SQL column enforcement."),
     check: cap("unsupported", "none", "Data health check is SQL-only."),
     diff: cap("unsupported", "none", "Schema snapshots are relational only."),
@@ -1216,6 +1219,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
     update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
     delete: cap("limited", "db-write", "Basic delete via DEL/HDEL/LREM/SREM/ZREM (needs data-admin); supports --dry-run."),
     export: cap("unsupported", "none", "Redis export is not supported."),
+    blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
     blacklist: cap("limited", "local-write", "Key-glob rejection (Redis-native pattern) plus value/hash-field masking ([REDACTED])."),
     check: cap("unsupported", "none", "Data health check is SQL-only."),
     diff: cap("unsupported", "none", "Schema snapshots are relational only."),
@@ -1236,6 +1240,7 @@ var ENGINE_CAPABILITIES = Object.freeze({
     update: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
     delete: cap("unsupported", "none", "Dedicated write subcommand is not exposed."),
     export: cap("limited", "readonly", "Exports DSL hits or a full index via scroll, capped at 1000 rows (use --no-limit)."),
+    blacklistRead: cap("limited", "readonly", "Reads the engine-specific blacklist rules."),
     blacklist: cap("limited", "local-write", "Index-level and flattened-column enforcement differ from SQL."),
     check: cap("unsupported", "none", "Data health check is SQL-only."),
     diff: cap("unsupported", "none", "Schema snapshots are relational only."),
@@ -1261,6 +1266,23 @@ var messages_default = {
     secret_alternatives_sql: "pass --password, supply the credential through .env or the process environment, or store a reference with --use-env-refs",
     secret_alternatives_mongo_password: "pass --password, supply the credential through .env or the process environment, or paste the connection string with --uri",
     secret_alternatives_mongo_uri: "pass the connection string with --uri",
+    mongo_uri_conflicts_fields: "--uri cannot be combined with {flags}: the connection string already carries those settings. Use one or the other (--name may be combined to override the database name).",
+    mongo_uri_with_env_refs: "--uri cannot be combined with --use-env-refs: the connection string is decomposed into config fields, and its credentials are not moved into environment variables. Either remove --use-env-refs so dbcli decomposes the string into the field config, or use the --env-* flags (--env-host, --env-user, --env-password, ...) to name one variable per field.",
+    mongo_uri_fallback_warning: "\u26A0\uFE0F  This connection string {reasons}, so it cannot become fields. It is stored as-is in uri, and its credentials will sit in plaintext in the config file.",
+    mongo_uri_reason_unix_socket: "uses a Unix domain socket",
+    mongo_uri_reason_multi_host: "contains more than one host (a field config holds only one)",
+    mongo_uri_reason_secret_option: "contains secret option(s) ({keys}) that would land in plaintext options",
+    mongo_uri_reason_duplicate_key: "repeats the query key(s) {keys} (a field config can hold only one value per key)",
+    mongo_uri_reason_non_scram: "uses the non-SCRAM auth mechanism {mechanism} (field config cannot express it)",
+    mongo_decomposed_header: "Connection string decomposed into these fields (password hidden):",
+    mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs does not apply to a pasted connection string: its credentials are written to the config file as they are, not as environment-variable references.",
+    mongo_setup_mode_paste: "Paste a connection string (copied from Atlas / Compass)",
+    mongo_string_invalid: "Not a valid MongoDB connection string (it is not echoed because it may carry credentials).",
+    mongo_string_bad_host: "The connection string has an invalid host or port (the port must be an integer from 1 to 65535).",
+    mongo_string_bad_credentials: "The connection string's credentials contain an unescaped reserved character such as @, : or /. Percent-encode it (for example @ as %40).",
+    mongo_string_tls_conflict: "The connection string sets tls and ssl to different values.",
+    mongo_string_bad_tls: "The connection string's {key} must be true or false.",
+    mongo_string_empty_option: "The connection string sets {key} but leaves it empty. Give it a value or remove it.",
     prompt_name: "Database name: ",
     prompt_permission: "Permission level (query-only, read-write, data-admin, admin): ",
     env_parse_note: "Note: Unable to parse .env configuration, using interactive prompts",
@@ -1598,6 +1620,23 @@ var messages_default2 = {
     secret_alternatives_sql: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --use-env-refs \u5B58\u6210\u53C3\u7167",
     secret_alternatives_mongo_password: "\u6539\u7528 --password\u3001\u628A\u6191\u8B49\u653E\u9032 .env \u6216\u884C\u7A0B\u74B0\u5883\u8B8A\u6578\uFF0C\u6216\u4EE5 --uri \u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32",
     secret_alternatives_mongo_uri: "\u4EE5 --uri \u50B3\u5165\u9023\u7DDA\u5B57\u4E32",
+    mongo_uri_conflicts_fields: "--uri \u4E0D\u80FD\u8207 {flags} \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u5DF2\u5305\u542B\u9019\u4E9B\u8A2D\u5B9A\u3002\u8ACB\u64C7\u4E00\u4F7F\u7528\uFF08--name \u53EF\u4E26\u7528\uFF0C\u7528\u4F86\u8986\u84CB\u8CC7\u6599\u5EAB\u540D\u7A31\uFF09\u3002",
+    mongo_uri_with_env_refs: "--uri \u4E0D\u80FD\u8207 --use-env-refs \u4E26\u7528\uFF1A\u9023\u7DDA\u5B57\u4E32\u6703\u88AB\u62C6\u89E3\u6210\u6B04\u4F4D\u8A2D\u5B9A\u5BEB\u5165\uFF0C\u5E33\u5BC6\u4E0D\u6703\u88AB\u62BD\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002\u8ACB\u6539\u8D70\u4E0B\u5217\u4EFB\u4E00\u505A\u6CD5\uFF1A\u62FF\u6389 --use-env-refs\uFF0C\u8B93 dbcli \u62C6\u89E3\u5B57\u4E32\u5BEB\u5165\u6B04\u4F4D\u8A2D\u5B9A\uFF1B\u6216\u6539\u7528 --env-* flag\uFF08--env-host\u3001--env-user\u3001--env-password \u7B49\uFF09\u9010\u6B04\u7D66\u8B8A\u6578\u540D\u7A31\u3002",
+    mongo_uri_fallback_warning: "\u26A0\uFE0F  \u6B64\u9023\u7DDA\u5B57\u4E32{reasons}\uFF0C\u7121\u6CD5\u62C6\u6210\u6B04\u4F4D\u8A2D\u5B9A\uFF0C\u5DF2\u539F\u6A23\u5B58\u5165 uri\uFF1B\u5E33\u5BC6\u5C07\u660E\u6587\u5B58\u653E\u65BC\u8A2D\u5B9A\u6A94\u3002",
+    mongo_uri_reason_unix_socket: "\u4F7F\u7528 Unix domain socket\uFF08\u672C\u6A5F\u901A\u8A0A\u7AEF\uFF09",
+    mongo_uri_reason_multi_host: "\u542B\u591A\u7D44 host\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u53EA\u80FD\u8868\u9054\u4E00\u7D44\uFF09",
+    mongo_uri_reason_secret_option: "\u542B\u6A5F\u5BC6 option\uFF08{keys}\uFF09\uFF0C\u62C6\u9032 options \u6703\u660E\u6587\u843D\u76E4",
+    mongo_uri_reason_duplicate_key: "\u542B\u91CD\u8907\u7684 query \u9375\uFF08{keys}\uFF09\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u6BCF\u500B\u9375\u53EA\u80FD\u5B58\u4E00\u500B\u503C\uFF09",
+    mongo_uri_reason_non_scram: "\u4F7F\u7528\u975E SCRAM \u7684\u8A8D\u8B49\u6A5F\u5236 {mechanism}\uFF08\u6B04\u4F4D\u8A2D\u5B9A\u7121\u6CD5\u8868\u9054\uFF09",
+    mongo_decomposed_header: "\u9023\u7DDA\u5B57\u4E32\u5DF2\u62C6\u89E3\u6210\u4E0B\u5217\u6B04\u4F4D\uFF08\u5BC6\u78BC\u5DF2\u906E\u853D\uFF09\uFF1A",
+    mongo_paste_env_refs_warning: "\u26A0\uFE0F  --use-env-refs \u4E0D\u9069\u7528\u65BC\u8CBC\u4E0A\u7684\u9023\u7DDA\u5B57\u4E32\uFF1A\u5E33\u5BC6\u6703\u4EE5\u5B57\u9762\u503C\u5BEB\u5165\u8A2D\u5B9A\u6A94\uFF0C\u4E0D\u6703\u8B8A\u6210\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u3002",
+    mongo_setup_mode_paste: "\u8CBC\u4E0A\u9023\u7DDA\u5B57\u4E32\uFF08Atlas / Compass \u8907\u88FD\u7684\uFF09",
+    mongo_string_invalid: "\u4E0D\u662F\u5408\u6CD5\u7684 MongoDB \u9023\u7DDA\u5B57\u4E32\uFF08\u5B57\u4E32\u53EF\u80FD\u5E36\u6709\u5E33\u5BC6\uFF0C\u6240\u4EE5\u4E0D\u5370\u51FA\uFF09\u3002",
+    mongo_string_bad_host: "\u9023\u7DDA\u5B57\u4E32\u7684 host \u6216\u57E0\u865F\u4E0D\u5408\u6CD5\uFF08\u57E0\u865F\u9808\u70BA 1 \u81F3 65535 \u7684\u6574\u6578\uFF09\u3002",
+    mongo_string_bad_credentials: "\u9023\u7DDA\u5B57\u4E32\u7684\u5E33\u865F\u6216\u5BC6\u78BC\u542B\u6709\u672A\u8DF3\u812B\u7684\u4FDD\u7559\u5B57\u5143\uFF08\u5982 @\u3001:\u3001/\uFF09\u3002\u8ACB\u505A\u767E\u5206\u6BD4\u7DE8\u78BC\uFF08\u4F8B\u5982 @ \u5BEB\u6210 %40\uFF09\u3002",
+    mongo_string_tls_conflict: "\u9023\u7DDA\u5B57\u4E32\u540C\u6642\u6307\u5B9A\u4E86 tls \u8207 ssl \u4E14\u503C\u4E0D\u540C\u3002",
+    mongo_string_bad_tls: "\u9023\u7DDA\u5B57\u4E32\u7684 {key} \u53EA\u63A5\u53D7 true \u6216 false\u3002",
+    mongo_string_empty_option: "\u9023\u7DDA\u5B57\u4E32\u6307\u5B9A\u4E86 {key} \u537B\u6C92\u6709\u503C\u3002\u8ACB\u7D66\u503C\u6216\u79FB\u9664\u3002",
     prompt_name: "\u8CC7\u6599\u5EAB\u540D\u7A31\uFF1A",
     prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, data-admin, admin\uFF09\uFF1A",
     env_parse_note: "\u63D0\u793A\uFF1A\u7121\u6CD5\u89E3\u6790 .env \u914D\u7F6E\uFF0C\u4F7F\u7528\u4E92\u52D5\u5F0F\u63D0\u793A",
@@ -2168,6 +2207,61 @@ var messageLoader = MessageLoader.getInstance();
 var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
+// src/adapters/grant-redaction.ts
+var PRIVILEGES = new Set([
+  "ALL",
+  "ALL PRIVILEGES",
+  "ALTER",
+  "ALTER ROUTINE",
+  "BINLOG ADMIN",
+  "BINLOG MONITOR",
+  "BINLOG REPLAY",
+  "CONNECTION ADMIN",
+  "CREATE",
+  "CREATE ROUTINE",
+  "CREATE TABLESPACE",
+  "CREATE TEMPORARY TABLES",
+  "CREATE USER",
+  "CREATE VIEW",
+  "DELETE",
+  "DELETE HISTORY",
+  "DROP",
+  "EVENT",
+  "EXECUTE",
+  "FEDERATED ADMIN",
+  "FILE",
+  "GRANT OPTION",
+  "INDEX",
+  "INSERT",
+  "LOCK TABLES",
+  "PROCESS",
+  "READ ONLY ADMIN",
+  "RELOAD",
+  "REPLICATION CLIENT",
+  "REPLICATION MASTER ADMIN",
+  "REPLICATION SLAVE",
+  "REPLICATION SLAVE ADMIN",
+  "REFERENCES",
+  "SELECT",
+  "SET USER",
+  "SHOW CREATE ROUTINE",
+  "SHOW DATABASES",
+  "SHOW VIEW",
+  "SHUTDOWN",
+  "SLAVE MONITOR",
+  "SUPER",
+  "TRIGGER",
+  "UPDATE",
+  "USAGE"
+]);
+var RESOURCE_OPTIONS = new Set([
+  "MAX_QUERIES_PER_HOUR",
+  "MAX_UPDATES_PER_HOUR",
+  "MAX_CONNECTIONS_PER_HOUR",
+  "MAX_USER_CONNECTIONS",
+  "MAX_STATEMENT_TIME"
+]);
+
 // src/utils/case-fold.ts
 function foldCase(text) {
   const lowered = (text.includes("\u0130") ? text.replaceAll("\u0130", "i") : text).toLowerCase();
@@ -8496,6 +8590,24 @@ var TimeoutField = {
   timeout: numberType().int().min(MIN_CONNECTION_TIMEOUT_MS).max(MAX_CONNECTION_TIMEOUT_MS).optional(),
   statementTimeout: numberType().int().min(MIN_STATEMENT_TIMEOUT_MS).max(MAX_STATEMENT_TIMEOUT_MS).optional()
 };
+var RESERVED_MONGODB_OPTION_KEYS = {
+  authsource: "authSource",
+  replicaset: "replicaSet",
+  tls: "tls",
+  ssl: "tls"
+};
+var MongoDBOptionsSchema = recordType(stringType(), stringType()).superRefine((options, ctx) => {
+  for (const key of Object.keys(options)) {
+    const field = RESERVED_MONGODB_OPTION_KEYS[key.toLowerCase()];
+    if (field) {
+      ctx.addIssue({
+        code: ZodIssueCode.custom,
+        path: [key],
+        message: `options.${key} duplicates the dedicated '${field}' field; set '${field}' instead`
+      });
+    }
+  }
+});
 var MongoDBConnectionConfigSchema = objectType({
   system: literalType("mongodb"),
   uri: unionType([stringType(), EnvRefSchema]).optional(),
@@ -8507,6 +8619,7 @@ var MongoDBConnectionConfigSchema = objectType({
   authSource: unionType([stringType(), EnvRefSchema]).optional(),
   replicaSet: unionType([stringType(), EnvRefSchema]).optional(),
   tls: booleanType().optional(),
+  options: MongoDBOptionsSchema.optional(),
   srv: booleanType().optional().default(false),
   ...TimeoutField
 });
@@ -9877,6 +9990,15 @@ var DECLARATIONS = [
     permission: "query-only",
     requiresConnection: true
   },
+  {
+    id: "blacklist.read",
+    key: "blacklistRead",
+    command: "blacklist list",
+    description: "Read the configured table, column and key rules that hide sensitive data.",
+    permission: "query-only",
+    requiresConnection: false,
+    mutatesConfiguration: false
+  },
   {
     id: "blacklist.manage",
     key: "blacklist",
@@ -10191,6 +10313,7 @@ var COMMAND_SURFACE = Object.freeze({
     "delete",
     "export",
     "check",
+    "blacklist list",
     "inspect",
     "report",
     "guide",

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "12.0.0",
   "description": "Database CLI skill and command reference for AI agents.",
   "contextFileName": "AGENTS.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "10.0.0",
+  "version": "12.0.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {
@@ -100,6 +100,7 @@
     "lru-cache": "^11.4.0",
     "lucide-react": "^1.16.0",
     "mongodb": "^7.2.0",
+    "mongodb-connection-string-url": "^7.0.1",
     "mysql2": "^3.24.3",
     "node-sql-parser": "5",
     "open": "^11.0.0",

package/plugins/dbcli-agent/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "10.0.0",
+  "version": "12.0.0",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/plugins/dbcli-agent/skills/dbcli/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/plugins/dbcli-agent/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -1868,8 +1868,11 @@ at execution time, and no human has agreed to anything. `admin` in a config file
 is a permission level, not a DBA sign-off.
 
 `schema.read` is available under `DBCLI_AGENT_MODE=1`, and `dbcli schema` runs
-there: storing the schema cache is not a configuration change. Agent mode still
-refuses every change to connection identity, permission and credentials.
+there: storing the schema cache is not a configuration change. `blacklist.read`
+(`blacklist list`) is available there too, so read-only Task Packs that inspect
+the blacklist can plan; `blacklist.manage`, which adds and removes rules, is
+refused. Agent mode still refuses every change to connection identity,
+permission and credentials.
 
 **Permission:** query-only+ (no connection is made)
 
@@ -3644,7 +3647,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.
 

package/skills/dbcli/SKILL.md

@@ -372,7 +372,7 @@ dbcli init                                                # parses .env in cwd
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 \
   --user admin --password '<secret>' --auth-source admin --name mydb
-# MongoDB — full URI (advanced escape hatch: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb \
   --uri "mongodb+srv://user:pw@cluster.example.mongodb.net/mydb?authSource=admin"
 
@@ -494,9 +494,10 @@ refs have no value to connect with yet.
   natively or via the DoH fallback; useful when the runtime restricts DNS.
 - **MongoDB `authSource` / `replicaSet` / `tls` / `srv`** — `init` asks for
   these interactively (`authSource` only when a user is set; `replicaSet` /
-  `tls` behind an "advanced options?" prompt); `--auth-source <db>` is the
-  only one with a dedicated non-interactive flag, so set `replicaSet` / `tls`
-  interactively or edit `.dbcli` afterward. If a config has both `uri` and
+  `tls` behind an "advanced options?" prompt); non-interactive flags are
+  `--auth-source <db>`, `--replica-set <name>`, `--srv` (no `port` written) and
+  `--tls` / `--no-tls` (neither given writes no `tls`); a flag you pass skips
+  its prompt. If a config has both `uri` and
   per-field values, `uri` wins silently — `dbcli doctor` flags this and also
   warns when `srv: true` is combined with a non-default `port`.
 - **MySQL/Postgres password with `@` `:` `/`** — when using `DATABASE_URL`,

package/skills/dbcli/reference.md

@@ -127,7 +127,7 @@ dbcli init --conn-name local --no-interactive --force    # Non-interactive; cred
 # MongoDB — field-by-field (primary path, same shape as SQL)
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --user admin --password secret --auth-source admin --name mydb
 dbcli init --conn-name local --system mongodb --host localhost --port 27017 --name mydb  # No auth
-# MongoDB — full URI (advanced fallback: multi-host, non-standard driver options)
+# MongoDB — full URI (decomposed into fields on write; multi-host / secret-option strings stay as `uri` with a warning)
 dbcli init --conn-name local --system mongodb --uri "mongodb://user:pass@host:27017/mydb?authSource=admin"
 
 # Redis (database = logical DB index)
@@ -161,7 +161,7 @@ New initialization always creates named v2 configuration, including plain `init`
 
 **Environment-reference options:** `--env-host <var>`, `--env-port <var>`, `--env-user <var>`, `--env-password <var>`, `--env-database <var>`
 
-**MongoDB-specific options:** `--uri <uri>` (full connection URI — advanced fallback), `--auth-source <db>` (auth database, default: `admin` when user/password set). Interactive `init` also asks for `replicaSet` and `tls` under an "advanced options?" prompt; there is no dedicated non-interactive flag for either yet — set them interactively or edit `.dbcli` afterward. `srv` (boolean, builds `mongodb+srv://` and resolves hosts via DNS SRV, ignoring `port`) is asked right after `host`, before `port`, since it decides whether `port` is even relevant.
+**MongoDB-specific options:** `--uri <uri>` (full connection URI, decomposed into field config on write: `authSource`/`replicaSet`/`tls`(`ssl`) become dedicated fields, `mongodb+srv` becomes `srv: true`, the path database becomes `database`, other parameters go to `options`; multi-host strings, strings carrying `authMechanismProperties`/`tlsCertificateKeyFilePassword`/`proxyPassword`, strings repeating a query key, and strings whose `authMechanism` is not SCRAM-SHA-1/SCRAM-SHA-256 are stored as-is in `uri` with a plaintext-credentials warning; cannot be combined with `--host`/`--port`/`--user`/`--password`/`--auth-source`/`--replica-set`/`--srv`/`--tls`/`--no-tls` or `--use-env-refs`; `--name` may be combined), `--auth-source <db>` (auth database, default: `admin` when user/password set). `--replica-set <name>` (writes `replicaSet`), `--srv` (writes `srv: true` and no `port`; builds `mongodb+srv://` and resolves hosts via DNS SRV), `--tls` / `--no-tls` (writes `tls: true` / `tls: false`; neither flag writes no `tls` key, so the driver default applies). Interactive `init` skips the prompt for any of these given as a flag; otherwise it asks `srv` right after `host` (before `port`) and `replicaSet` / `tls` under an "advanced options?" prompt. The flags also apply with `--use-env-refs`.
 
 **Elasticsearch-specific options:** `--cloud-id <id>` (Elastic Cloud), `--api-key <key>` (ApiKey auth). Other ES fields (`nodes[]`, `protocol`, `caPath`, `rejectUnauthorized`) can be edited directly in `.dbcli`.
 
@@ -1868,8 +1868,11 @@ at execution time, and no human has agreed to anything. `admin` in a config file
 is a permission level, not a DBA sign-off.
 
 `schema.read` is available under `DBCLI_AGENT_MODE=1`, and `dbcli schema` runs
-there: storing the schema cache is not a configuration change. Agent mode still
-refuses every change to connection identity, permission and credentials.
+there: storing the schema cache is not a configuration change. `blacklist.read`
+(`blacklist list`) is available there too, so read-only Task Packs that inspect
+the blacklist can plan; `blacklist.manage`, which adds and removes rules, is
+refused. Agent mode still refuses every change to connection identity,
+permission and credentials.
 
 **Permission:** query-only+ (no connection is made)
 
@@ -3644,7 +3647,7 @@ Parser behaviour (`src/core/saved-queries/parser.ts::normaliseVisual`):
 
 MongoDB connections use a JSON-based query model instead of SQL. Treat MongoDB support as a narrower document-database path, not as a full SQL feature equivalent.
 
-`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow and the non-interactive path via `--uri` (with the required `--conn-name`). Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
+`init --system mongodb` defaults to a field-by-field wizard (`host`, `srv`, `port`, `user`, `password` + `authSource`, then optional `replicaSet` / `tls`); a full `uri` is an explicit advanced choice in the interactive flow (stored as-is) and the non-interactive path via `--uri` (with the required `--conn-name`), where the string is decomposed into the field config on write. Optional fields `authSource`, `replicaSet`, `tls`, and `srv` express what previously required embedding options in the `uri` query string. Atlas-style `mongodb+srv://` URIs are supported both as a full `uri` and via the per-field `srv: true` option. `list` and `query` run against the database configured for the connection, and `query` always requires `--collection <name>`.
 
 The 5000ms default server-selection timeout is often too tight for a connection over a VPN or to Atlas. Set a `timeout` field (ms) in the connection config, or override it per invocation with root-level `--timeout`, e.g. `dbcli --timeout 20000 --use <conn> list`.