execsql2 2.29.0__py3-none-any.whl → 2.31.1__py3-none-any.whl

execsql/__main__.py

@@ -1,11 +1,10 @@
-from __future__ import annotations
+"""Entry point for ``python -m execsql``.
 
+Calls :func:`execsql.cli._legacy_main`, so the package runs without the
+installed ``execsql`` script.
 """
-Entry point for ``python -m execsql``.
 
-Delegates immediately to :func:`execsql.cli.main` so the package can be
-invoked directly without going through the installed ``execsql2`` script.
-"""
+from __future__ import annotations
 
 from execsql.cli import _legacy_main
 

execsql/api.py

@@ -297,6 +297,7 @@ def _connect_from_dsn(dsn: str, new_db: bool = False) -> Any:
             user=user,
             password=password,
             port=port,
+            trust_server_certificate=params["trust_server_certificate"],
         )
     elif db_type == "o":
         return db_Oracle(
@@ -594,6 +595,11 @@ def run(
                     pass
             if ctx.tempfiles is not None:
                 ctx.tempfiles.remove_all()
+            if ctx.cd_from is not None:  # the script ran CD: the caller's directory is theirs
+                try:
+                    os.chdir(ctx.cd_from)
+                except OSError:
+                    pass  # it no longer exists
 
     return ScriptResult(
         success=len(errors) == 0,

execsql/cli/__init__.py

@@ -22,31 +22,20 @@ from pathlib import Path
 
 from execsql.cli import commands  # noqa: F401 — registers every command on app
 from execsql.cli.application import app
-from execsql.cli.commands.run import main
-from execsql.cli.dsn import _parse_connection_string, _SCHEME_TO_DBTYPE  # noqa: F401 — re-export
-from execsql.cli.help import _console, _err_console, _init_config, _print_encodings, _print_metacommands  # noqa: F401 — re-export
-from execsql.cli.run import _connect_initial_db, _run  # noqa: F401 — re-export
-from execsql.cli.run import _end_run_on_sigterm
+from execsql.cli.dsn import _parse_connection_string  # noqa: F401 — re-export
+from execsql.cli.run import _end_run_on_sigterm, _run  # noqa: F401 — re-export
 from execsql.exceptions import ConfigError, ConfigFileError, ErrInfo
 
 __all__ = [
-    "_SCHEME_TO_DBTYPE",
-    "_connect_initial_db",
-    "_console",
-    "_err_console",
-    "_init_config",
     "_legacy_main",
     "_parse_connection_string",
-    "_print_encodings",
-    "_print_metacommands",
     "_run",
     "app",
-    "main",
 ]
 
 
 # ---------------------------------------------------------------------------
-# Legacy entry point (kept for backwards compat with pyproject.toml script)
+# Entry point for ``python -m execsql`` (the ``execsql`` script is cli.dispatch:dispatch)
 # ---------------------------------------------------------------------------
 
 

execsql/cli/application.py

@@ -6,6 +6,7 @@ Every command registers itself on :data:`app` from a module in
 
 from __future__ import annotations
 
+import sys
 from collections.abc import Iterator
 from contextlib import contextmanager
 from typing import Any
@@ -225,7 +226,9 @@ class ExecsqlGroup(TyperGroup):
         self.format_commands(ctx, formatter)
 
     def format_commands(self, ctx: Any, formatter: Any) -> None:
-        # Click's own version, with the command names colored.
+        # Click's own version, with the command names colored and each
+        # summary (the first sentence of its help) whole: Click would cut it
+        # to fit the terminal with "...", write_dl wraps it instead.
         commands = [
             (name, cmd)
             for name in self.list_commands(ctx)
@@ -233,10 +236,9 @@ class ExecsqlGroup(TyperGroup):
         ]
         if not commands:
             return
-        limit = formatter.width - 6 - max(len(name) for name, _ in commands)
         with _section(formatter, "Commands"):
             formatter.write_dl(
-                [(_style(name, fg="cyan", bold=True), cmd.get_short_help_str(limit)) for name, cmd in commands],
+                [(_style(name, fg="cyan", bold=True), cmd.get_short_help_str(sys.maxsize)) for name, cmd in commands],
             )
 
 
@@ -280,7 +282,7 @@ def _online_help_callback(value: bool) -> None:
     if value:
         import webbrowser
 
-        webbrowser.open("https://execsql2.readthedocs.io/en/latest/", new=2, autoraise=True)
+        webbrowser.open("https://execsql2.readthedocs.io/en/stable/", new=2, autoraise=True)
         raise typer.Exit()
 
 

execsql/cli/commands/lint.py

@@ -93,7 +93,10 @@ def lint_paths(
         except OSError as exc:
             found = [_issue("P001", label, 0, f"cannot read: {exc.strerror or exc}")]
         else:
-            found = lint_source(source, label, script_path=None if stdin else label)
+            try:
+                found = lint_source(source, label, script_path=None if stdin else label)
+            except Exception as exc:  # one script lint cannot check must not hide the others' findings
+                found = [_issue("P001", label, 0, f"execsql could not check this script ({type(exc).__name__}: {exc})")]
         per_file.append((label, sorted(filter_issues(found, select, ignore), key=lambda i: (i.line, i.code))))
 
     reported = [issue for _, issues in per_file for issue in issues]
@@ -140,7 +143,7 @@ class LintFormat(str, Enum):
         "Every issue names its rule code, which --select and --ignore accept, as a full "
         "code (V001) or a prefix (V). Parse errors (P001) are always reported. Exits 1 "
         "when any error is found; warnings alone exit 0 unless --strict is given.\n\n"
-        "Rules: https://execsql2.readthedocs.io/en/latest/reference/lint/"
+        "Rules: https://execsql2.readthedocs.io/en/stable/reference/lint/"
     ),
 )
 def lint_cmd(

execsql/cli/commands/lsp.py

@@ -2,6 +2,10 @@
 
 from __future__ import annotations
 
+import logging
+from enum import Enum
+from pathlib import Path
+
 import typer
 from rich.markup import escape
 
@@ -28,6 +32,29 @@ def _pygls_version() -> str:
         return "unknown"
 
 
+class LogLevel(str, Enum):
+    error = "error"
+    warning = "warning"
+    info = "info"
+    debug = "debug"
+
+
+def _configure_logging(level: LogLevel, log_file: Path | None) -> None:
+    """Send the server's log (execsql's and pygls's) to stderr, which editors show, or to *log_file*.
+
+    stdout carries the protocol, so nothing may be logged there.
+    """
+    handler: logging.Handler = (
+        logging.FileHandler(log_file, encoding="utf-8") if log_file is not None else logging.StreamHandler()
+    )
+    handler.setFormatter(logging.Formatter("%(asctime)s %(levelname)s %(name)s: %(message)s"))
+    root = logging.getLogger()
+    root.addHandler(handler)
+    root.setLevel(level.value.upper())
+    # pygls logs every message it sends at info, script text included: only debug shows them.
+    logging.getLogger("pygls").setLevel(logging.DEBUG if level is LogLevel.debug else logging.WARNING)
+
+
 @app.command(
     cls=ExecsqlCommand,
     name="lsp",
@@ -43,6 +70,20 @@ def lsp_cmd(
     # Editors' language clients pass --stdio (VS Code always does); stdio is the only transport.
     stdio: bool = typer.Option(False, "--stdio", hidden=True),
     check: bool = typer.Option(False, "--check", help="Report whether the language server can start, and exit."),
+    log_level: LogLevel = typer.Option(
+        LogLevel.warning,
+        "--log-level",
+        envvar="EXECSQL_LSP_LOG_LEVEL",
+        case_sensitive=False,
+        help="How much the server logs: error, warning, info (adds a startup record and each folder's config files) "
+        "or debug (adds every protocol message).",
+    ),
+    log_file: Path | None = typer.Option(
+        None,
+        "--log-file",
+        dir_okay=False,
+        help="Append the log to this file instead of stderr, for an editor that does not show the server's stderr.",
+    ),
 ) -> None:
     """The ``lsp`` command; its user-facing help is the decorator's ``help``."""
     try:
@@ -61,4 +102,5 @@ def lsp_cmd(
     if check:
         typer.echo(f"execsql lsp is ready (pygls {_pygls_version()}).")
         return
+    _configure_logging(log_level, log_file)
     create_server().start_io()

execsql/cli/dsn.py

@@ -40,7 +40,9 @@ def _parse_connection_string(dsn: str) -> dict:
     written ``%40``, ``%3A``, ``%2F``, ``%3F``, ``%23``, ``%25``.
 
     Returns a dict with keys: ``db_type``, ``server``, ``db``, ``db_file``,
-    ``user``, ``password``, ``port``.  Absent components are ``None``.
+    ``user``, ``password``, ``port`` and ``trust_server_certificate`` (from
+    ``?trust_server_certificate=yes`` on an ``mssql://`` URL).  Absent
+    components are ``None``.
 
     Raises :class:`~execsql.exceptions.ConfigError` for an unrecognised
     URL scheme or a completely un-parseable string.
@@ -50,7 +52,9 @@ def _parse_connection_string(dsn: str) -> dict:
     parsed = urlparse(dsn)
     scheme = parsed.scheme.lower()
     if not scheme:
-        raise ConfigError(f"Cannot parse connection string (no scheme): {dsn!r}")
+        # Echoed so the user sees what went wrong, but never with its password.
+        shown = dsn.replace(f":{parsed.password}@", ":***@") if parsed.password else dsn
+        raise ConfigError(f"Cannot parse connection string (no scheme): {shown!r}")
     if scheme not in _SCHEME_TO_DBTYPE:
         raise ConfigError(
             f"Unrecognised connection-string scheme {scheme!r}. "
@@ -84,6 +88,8 @@ def _parse_connection_string(dsn: str) -> dict:
         # Remove leading "/"
         db = raw_path.lstrip("/") or None
 
+    trust_server_certificate = _query_options(parsed.query, db_type)
+
     return {
         "db_type": db_type,
         "server": server,
@@ -92,4 +98,34 @@ def _parse_connection_string(dsn: str) -> dict:
         "user": user,
         "password": password,
         "port": port,
+        "trust_server_certificate": trust_server_certificate,
     }
+
+
+_TRUE = ("yes", "true", "on", "1")
+_FALSE = ("no", "false", "off", "0")
+
+
+def _query_options(query: str, db_type: str) -> bool | None:
+    """Return ``trust_server_certificate`` from a DSN's query string, or None if absent.
+
+    It is the only query parameter execsql reads, and only for SQL Server.
+    Anything else is an error rather than ignored, so a misspelt option
+    cannot silently leave a connection without the setting it asked for.
+    """
+    from urllib.parse import parse_qsl
+
+    trust: bool | None = None
+    for key, value in parse_qsl(query, keep_blank_values=True):
+        if key.lower() != "trust_server_certificate" or db_type != "s":
+            raise ConfigError(
+                f"Unrecognised connection-string parameter {key!r}. "
+                "The only one execsql reads is trust_server_certificate, for mssql:// URLs.",
+            )
+        if value.lower() in _TRUE:
+            trust = True
+        elif value.lower() in _FALSE:
+            trust = False
+        else:
+            raise ConfigError(f"trust_server_certificate must be yes or no, not {value!r}.")
+    return trust

execsql/cli/lint.py

@@ -56,6 +56,7 @@ from collections.abc import Iterable
 from pathlib import Path
 from typing import TYPE_CHECKING, NamedTuple
 
+from execsql.utils.paths import is_network_path
 from execsql.exceptions import ErrInfo
 from execsql.script.ast import (
     BatchBlock,
@@ -461,6 +462,8 @@ def _read_ini_vars(
     language server; a file that is unreadable or not valid INI defines
     nothing.
     """
+    if is_network_path(ini_file):  # see _check_include_path
+        return
     p = Path(ini_file)
     if not p.is_absolute() and script_dir is not None:
         p = script_dir / p
@@ -471,7 +474,7 @@ def _read_ini_vars(
         if stat.st_size > _MAX_INI_BYTES:
             return
         resolved = str(p.resolve())
-    except OSError:
+    except (OSError, ValueError):  # unreadable, or a name the OS rejects
         return
     defined_vars.update(_ini_section_keys(resolved, stat.st_size, stat.st_mtime_ns, section))
 
@@ -582,12 +585,23 @@ def _check_include_path(
     line_no: int,
     issues: list[_Issue],
 ) -> None:
-    """Warn if the INCLUDE target does not exist on disk."""
+    """Warn if the INCLUDE target does not exist on disk.
+
+    A target written as a network path is not checked: on Windows, even
+    asking whether it exists contacts the host it names.
+    """
+    if is_network_path(raw_path):
+        return
     p = Path(raw_path)
     if not p.is_absolute() and script_dir is not None:
         p = script_dir / p
 
-    if not p.exists():
+    try:
+        exists = p.exists()
+    except OSError as exc:  # a name the file system rejects outright (too long, ...)
+        issues.append(_issue("I001", source, line_no, f"INCLUDE path cannot be checked: {exc.strerror or exc}"))
+        return
+    if not exists:
         issues.append(
             _issue("I001", source, line_no, f"INCLUDE file does not exist: {raw_path}"),
         )
@@ -701,7 +715,7 @@ _RX_ANY_VAR = re.compile(r"!(['\"]?)![$&@~#+]?\w+!\1!|!\{[$&@~#+]?\w+\}!")
 _PLACEHOLDERS = ("TRUE", "1", "x")
 
 
-def _with_placeholders(text: str, value: str = "TRUE") -> str:
+def _with_placeholders(text: str, value: str) -> str:
     """Replace each substitution variable with the literal *value*."""
     return _RX_ANY_VAR.sub(value, text)
 
@@ -997,6 +1011,7 @@ def _lint_nodes(
 def lint(
     script: Script,
     script_path: str | None = None,
+    base_dir: str | None = None,
 ) -> list[_Issue]:
     """Perform static analysis on an AST-parsed script.
 
@@ -1004,6 +1019,8 @@ def lint(
         script: The parsed :class:`Script` tree.
         script_path: Path to the source file (for resolving relative
             INCLUDE paths).  ``None`` for inline scripts.
+        base_dir: Where an inline script's relative paths resolve, in place
+            of the working directory.
 
     Returns:
         Every :class:`Issue` found, unfiltered.
@@ -1014,7 +1031,7 @@ def lint(
         issues.append(_issue("S001", script_path or script.source, 0, "script is empty"))
         return issues
 
-    script_dir = Path(script_path).resolve().parent if script_path else None
+    script_dir = Path(script_path).resolve().parent if script_path else (Path(base_dir) if base_dir else None)
     script_blocks = _collect_script_blocks(script)
 
     # Pass 1: collect all variable definitions
@@ -1036,7 +1053,7 @@ def lint(
     return issues
 
 
-def lint_source(source: str, label: str, script_path: str | None = None) -> list[_Issue]:
+def lint_source(source: str, label: str, script_path: str | None = None, base_dir: str | None = None) -> list[_Issue]:
     """Parse *source* and lint it, unfiltered.
 
     Each block-structure error (an IF without ENDIF, a stray END LOOP, ...)
@@ -1047,7 +1064,7 @@ def lint_source(source: str, label: str, script_path: str | None = None) -> list
 
     errors: list[ErrInfo] = []
     tree = parse_string(source, label, errors=errors)
-    return [parse_error(label, exc) for exc in errors] + lint(tree, script_path=script_path)
+    return [parse_error(label, exc) for exc in errors] + lint(tree, script_path=script_path, base_dir=base_dir)
 
 
 # ---------------------------------------------------------------------------

execsql/cli/run.py

@@ -233,11 +233,12 @@ _SENSITIVE_SUBSTRINGS = (
 )
 
 
-def _seed_early_subvars() -> SubVarSet:
+def _seed_early_subvars(start_dir: str | None = None) -> SubVarSet:
     """Create and populate the initial substitution variable pool.
 
     Seeds environment variables (filtering secrets), timestamps, system info,
     and placeholder variables.  Called once at the start of :func:`_run`.
+    ``$STARTING_PATH`` is *start_dir*, or the working directory.
     """
     subvars = SubVarSet()
 
@@ -262,7 +263,7 @@ def _seed_early_subvars() -> SubVarSet:
     subvars.add_substitution("$LAST_ERROR", "")
     subvars.add_substitution("$ERROR_MESSAGE", "")
     subvars.add_substitution("$USER", getpass.getuser())
-    subvars.add_substitution("$STARTING_PATH", os.getcwd() + os.sep)
+    subvars.add_substitution("$STARTING_PATH", (start_dir or os.getcwd()) + os.sep)
     subvars.add_substitution("$PATHSEP", os.sep)
     osys = sys.platform
     if osys.startswith("linux"):
@@ -279,23 +280,33 @@ def _load_config(
     script_name: str | None,
     subvars: SubVarSet,
     config_file: str | None,
+    start_dir: str | None = None,
+    local_only: bool = False,
 ) -> ConfigData:
     """Load and merge configuration files for the given script.
 
+    *start_dir* stands in for the working directory (see :class:`ConfigData`).
     Returns a fully populated :class:`ConfigData` instance.
     """
-    script_path = str(Path(script_name).resolve().parent) if script_name else os.getcwd()
-    return ConfigData(script_path, subvars, config_file=config_file)
+    if script_name:
+        script_path = str(Path(script_name).resolve().parent)
+    else:  # resolved, as os.getcwd() is, so the start directory's execsql.conf is not read twice
+        script_path = str(Path(start_dir).resolve()) if start_dir else os.getcwd()
+    return ConfigData(script_path, subvars, config_file=config_file, start_dir=start_dir, local_only=local_only)
 
 
-def _tool_config(config_file: str | None) -> ConfigData:
+def _tool_config(config_file: str | None, start_dir: str | None = None) -> ConfigData:
     """The config ``execsql format`` and ``execsql lint`` read.
 
     Read once per invocation, from the system, user and working-directory
     locations plus *config_file* — not per script, so a script directory's
-    own ``execsql.conf`` applies only when passed with ``--config``.
+    own ``execsql.conf`` applies only when passed with ``--config``.  The
+    language server passes a workspace folder as *start_dir*: the settings
+    those commands would read when run from it.  Config chains written as
+    network paths are skipped untouched (``local_only``): these tools read
+    config from repositories other people write.
     """
-    return _load_config(None, _seed_early_subvars(), config_file)
+    return _load_config(None, _seed_early_subvars(start_dir), config_file, start_dir, local_only=True)
 
 
 def _configured_script_encoding(conf: ConfigData) -> str | None:
@@ -358,6 +369,8 @@ def _apply_dsn(dsn: str, conf: ConfigData, db_type: str | None) -> tuple[str | N
         conf.db = parsed["db"]
     if parsed["db_file"]:
         conf.db_file = parsed["db_file"]
+    if parsed["trust_server_certificate"] is not None:
+        conf.trust_server_certificate = parsed["trust_server_certificate"]
     user = parsed["user"]  # may be None
     if parsed["password"]:
         conf.db_password = parsed["password"]
@@ -561,7 +574,7 @@ def _setup_logging(
         for n, repl in enumerate(sub_vars):
             var = f"$ARG_{n + 1}"
             subvars.add_substitution(var, repl)
-            logger.add_redaction_value(repl)
+            logger.add_redaction_value(repl, argument=True)
             # `-a` values are positional and opaque (no name to denylist
             # against). High-entropy secrets (sk-live-*, AKIA*, ghp_*,
             # JWTs) pass any substring/value heuristic, so log the
@@ -574,7 +587,7 @@ def _setup_logging(
     # redacted for the same reason as -a's.
     for name, value in named_vars or ():
         subvars.add_substitution(name, value)
-        logger.add_redaction_value(value)
+        logger.add_redaction_value(value, argument=True)
         logger.log_status_info(f"Command-line substitution variable assignment: {name} set to {{***}}")
 
     return logger

execsql/config.py

@@ -23,6 +23,7 @@ from configparser import ConfigParser
 from pathlib import Path
 from typing import Protocol
 
+from execsql.utils.paths import is_network_path
 from execsql.exceptions import ConfigError, ConfigFileError
 from execsql.utils.crypto import Encrypt
 
@@ -281,6 +282,7 @@ class ConfigData:
         self._get_bool(cp, self._CONNECT_SECTION, "password_prompt", "passwd_prompt")
         self._get_bool(cp, self._CONNECT_SECTION, "use_keyring", "use_keyring")
         self._get_bool(cp, self._CONNECT_SECTION, "new_db", "new_db")
+        self._get_bool(cp, self._CONNECT_SECTION, "trust_server_certificate", "trust_server_certificate")
         # --- [encoding] ---
         self._get_str(cp, self._ENCODING_SECTION, "database", "db_encoding")
         self._get_str(cp, self._ENCODING_SECTION, "script", "script_encoding", required=True)
@@ -401,6 +403,8 @@ class ConfigData:
         variable_pool: _VariablePool,
         *,
         config_file: str | None = None,
+        start_dir: str | None = None,
+        local_only: bool = False,
     ) -> None:
         """Load and merge all discoverable execsql.conf files for the given script path.
 
@@ -414,12 +418,23 @@ class ConfigData:
                 Loaded after the implicit search paths so its values take
                 precedence over system, user, script, and working-directory
                 config files.
+            start_dir: The directory a run starts in: its ``execsql.conf`` is
+                read, and relative ``config_file`` paths (``--config`` and
+                ``[config]`` chains) resolve against it.  Defaults to the
+                working directory.  The language server passes each
+                workspace folder, so it never changes the process's directory.
+            local_only: Skip a ``config_file`` chain or ``[include_*]`` path
+                written as a network path (:func:`~execsql.utils.paths.is_network_path`)
+                without touching it.  The static tools pass it: they read
+                config files a cloned repository may supply.
         """
+        self._start_dir = start_dir
+        self._local_only = local_only
         self._set_defaults()
         current_script = str(Path(sys.argv[0]).resolve())
         from collections import deque
 
-        config_queue: deque[str] = deque(self._search_paths(script_path, config_file))
+        config_queue: deque[str] = deque(self._search_paths(script_path, config_file, start_dir))
         self.files_read: list = []
         # Warm the schema registry by running the option reader against an
         # empty ConfigParser. cp.has_option() is False for everything so no
@@ -455,6 +470,11 @@ class ConfigData:
                     if cp.has_option(section, key):
                         self.sources[attr] = configfile
 
+    #: Where relative paths resolve; ``None`` is the working directory.
+    _start_dir: str | None = None
+    #: Whether paths written as network paths are skipped (see ``__init__``).
+    _local_only: bool = False
+
     #: Guard against circular config_file references.
     _MAX_CONFIG_CHAIN = 20
 
@@ -471,6 +491,7 @@ class ConfigData:
         self.use_keyring = True
         self.db_file: str | None = None
         self.new_db = False
+        self.trust_server_certificate = False
         self.user_logfile = False
         self.db_encoding: str | None = None
         self.script_encoding = "utf8"
@@ -562,7 +583,7 @@ class ConfigData:
         self.lint_strict = False
 
     @classmethod
-    def _search_paths(cls, script_path: str, config_file: str | None) -> list[str]:
+    def _search_paths(cls, script_path: str, config_file: str | None, start_dir: str | None = None) -> list[str]:
         """The files a run reads, lowest precedence first: system, user, script dir, working dir, ``--config``.
 
         Files that ``[config] config_file`` and its OS-specific variants chain
@@ -574,22 +595,33 @@ class ConfigData:
             sys_config_file = str(Path(os.path.expandvars(r"%APPDATA%")) / cls.config_file_name)
         user_config_file = str(Path("~/.config").expanduser() / cls.config_file_name)
         script_config_file = str(Path(script_path) / cls.config_file_name)
-        startdir_config_file = str(Path(".").resolve() / cls.config_file_name)
+        start = Path(start_dir or ".")
+        startdir_config_file = str(start.resolve() / cls.config_file_name)
         if startdir_config_file != script_config_file:
             config_files = [sys_config_file, user_config_file, script_config_file, startdir_config_file]
         else:
             config_files = [sys_config_file, user_config_file, startdir_config_file]
         if config_file:
-            config_files.append(str(Path(config_file).resolve()))
+            config_files.append(str((start / config_file).resolve()))
         return config_files
 
     @classmethod
-    def _chain_target(cls, value: str, variable_pool: _VariablePool, *, expand_home: bool) -> str:
+    def _chain_target(
+        cls,
+        value: str,
+        variable_pool: _VariablePool,
+        *,
+        expand_home: bool,
+        start_dir: str | None = None,
+        local_only: bool = False,
+    ) -> str:
         """Resolve a ``config_file``-style value to the file it names.
 
         A leading ``~`` is expanded when *expand_home* is true, substitution
         variables are replaced, and a directory means the ``execsql.conf``
         inside it. The result may not exist; callers decide what that means.
+        With *local_only*, a value that is a network path once substituted
+        gives ``""`` without being touched.
         """
         conffile = value
         if expand_home and conffile and conffile[0] == "~":
@@ -598,10 +630,18 @@ class ConfigData:
             elif len(conffile) > 1 and conffile[1] == os.sep:
                 conffile = str(Path("~").expanduser() / conffile[2:])
         conffile = variable_pool.substitute(conffile)[0]
+        if local_only and is_network_path(conffile):
+            return ""
+        if start_dir and not Path(conffile).is_absolute():
+            conffile = str(Path(start_dir) / conffile)
         if not Path(conffile).is_file():
             conffile = str(Path(conffile) / cls.config_file_name)
         return conffile
 
+    def _skips(self, path: str) -> bool:
+        """Whether *path* is left untouched: a network path when ``local_only``."""
+        return self._local_only and is_network_path(path)
+
     def _apply_file(self, cp: ConfigParser, variable_pool: _VariablePool, current_script: str) -> list[str]:
         """Apply one parsed config file to ``self``; return the files it chains to.
 
@@ -651,8 +691,10 @@ class ConfigData:
                 cp.get(self._CONFIG_SECTION, "config_file"),
                 variable_pool,
                 expand_home=os.name == "posix",
+                start_dir=self._start_dir,
+                local_only=self._local_only,
             )
-            if Path(conffile).is_file():
+            if conffile and Path(conffile).is_file():
                 # Silently ignore a non-existent file, for cross-OS compatibility.
                 chained.append(conffile)
         # OS-specific additional config files.
@@ -664,8 +706,14 @@ class ConfigData:
         elif os.name == "nt" and cp.has_option(self._CONFIG_SECTION, "win_config_file"):
             _os_config_key = "win_config_file"
         if _os_config_key:
-            conffile = self._chain_target(cp.get(self._CONFIG_SECTION, _os_config_key), variable_pool, expand_home=True)
-            if Path(conffile).is_file():
+            conffile = self._chain_target(
+                cp.get(self._CONFIG_SECTION, _os_config_key),
+                variable_pool,
+                expand_home=True,
+                start_dir=self._start_dir,
+                local_only=self._local_only,
+            )
+            if conffile and Path(conffile).is_file():
                 chained.append(conffile)
         # dao_flush_delay_secs has a specific error message — keep inline
         if cp.has_option(self._CONFIG_SECTION, "dao_flush_delay_secs"):
@@ -701,7 +749,7 @@ class ConfigData:
         if cp.has_section(self._INCLUDE_REQ_SECTION):
             imp_items = cp.items(self._INCLUDE_REQ_SECTION)
             ord_items = sorted([(int(i[0]), i[1]) for i in imp_items], key=lambda x: x[0])
-            newfiles = [str(Path(f[1]).resolve()) for f in ord_items]
+            newfiles = [str(Path(f[1]).resolve()) for f in ord_items if not self._skips(f[1])]
             u_files = []
             for f in newfiles:
                 if not (f in u_files or f in self.include_req or f in self.include_opt) and f != current_script:
@@ -712,7 +760,7 @@ class ConfigData:
         if cp.has_section(self._INCLUDE_OPT_SECTION):
             imp_items = cp.items(self._INCLUDE_OPT_SECTION)
             ord_items = sorted([(int(i[0]), i[1]) for i in imp_items], key=lambda x: x[0])
-            newfiles = [str(Path(f[1]).resolve()) for f in ord_items]
+            newfiles = [str(Path(f[1]).resolve()) for f in ord_items if not self._skips(f[1])]
             u_files = []
             for f in newfiles:
                 if (

execsql/data/execsql.conf.template

@@ -1,6 +1,6 @@
 # execsql.conf — Configuration file for execsql
 #
-# Documentation: https://execsql2.readthedocs.io/en/latest/reference/configuration/
+# Documentation: https://execsql2.readthedocs.io/en/stable/reference/configuration/
 #
 # This file uses INI format. Section names are case-sensitive (lowercase).
 # Property names are not case-sensitive. Lines starting with # are comments.
@@ -54,6 +54,12 @@
 # Values: Yes or No.  Default: No.
 #new_db=No
 
+# SQL Server only: accept the server's TLS certificate without verifying it,
+# for a server with a self-signed certificate.  ODBC Driver 18 otherwise
+# refuses one it cannot verify.  Applies to CONNECT as well.
+# Values: Yes or No.  Default: No.
+#trust_server_certificate=No
+
 
 [encoding]
 # Character encoding for text input and output.
@@ -279,7 +285,7 @@
 #message_css=
 
 # Obfuscated password (XOR, not cryptographically secure — use keyring instead).
-# See: https://execsql2.readthedocs.io/en/latest/reference/security/#credentials
+# See: https://execsql2.readthedocs.io/en/stable/reference/security/#credentials
 #enc_password=