mycli 2.0.0__tar.gz → 2.2.0__tar.gz

{mycli-2.0.0 → mycli-2.2.0}/.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "latest"
 
@@ -66,7 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "latest"
 
@@ -116,7 +116,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: 'latest'
 
@@ -219,7 +219,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "latest"
 

{mycli-2.0.0 → mycli-2.2.0}/.github/workflows/lint.yml

@@ -21,9 +21,9 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run ruff check
-        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
+        uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
 
       - name: Run ruff format
-        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
+        uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
         with:
           args: 'format --check'

{mycli-2.0.0 → mycli-2.2.0}/.github/workflows/publish.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         version: "latest"
 
@@ -74,7 +74,7 @@ jobs:
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         version: "latest"
 
@@ -124,7 +124,7 @@ jobs:
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         version: 'latest'
 
@@ -226,7 +226,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         version: "latest"
 

{mycli-2.0.0 → mycli-2.2.0}/.github/workflows/typecheck.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           python-version: '3.14'
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: 'latest'
 

{mycli-2.0.0 → mycli-2.2.0}/AGENTS.md

@@ -27,8 +27,11 @@ A command line client for MySQL with auto-completion and syntax highlighting.
 ├── mycli/lexer.py                        # extends `MySqlLexer` from Pygments
 ├── mycli/main.py                         # processes CLI arguments
 ├── mycli/main_modes/                     # main execution paths
-├── mycli/main_modes/batch.py             # batch mode execution path
-├── mycli/main_modes/checkup.py           # implementation of `--checkup` mode
+├── mycli/main_modes/batch.py             # `--batch` mode
+├── mycli/main_modes/checkup.py           # `--checkup` mode
+├── mycli/main_modes/execute.py           # `--execute` mode
+├── mycli/main_modes/list_dsn.py          # `--list-dsn` mode
+├── mycli/main_modes/repl.py              # interactive REPL made
 ├── mycli/myclirc                         # project-level configuration file
 ├── mycli/output.py                       # `OutputMixin` mixin for feedback and output of query results
 ├── mycli/packages/                       # application packages
@@ -48,13 +51,14 @@ A command line client for MySQL with auto-completion and syntax highlighting.
 ├── mycli/schema_prefetcher.py            # background prefetcher for multi-schema auto-completion
 ├── mycli/sqlcompleter.py                 # offers SQL completions
 ├── mycli/sqlexecute.py                   # runs SQL queries
+├── mycli/types.py                        # shared types
+├── mycli/vault.py                        # Vault integration
 ├── test/conftest.py                      # pytest configuration
 ├── test/features/                        # behave tests
 ├── test/myclirc                          # mycli configuration used for tests
 ├── test/mylogin.cnf                      # `mylogin.cnf` example used for tests
 ├── test/pytests/                         # pytest tests
-├── test/utils.py                         # shared utilities for tests
-└── types.py                              # shared types
+└── test/utils.py                         # shared utilities for tests
 
 ## Development
 

{mycli-2.0.0/mycli.egg-info → mycli-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycli
-Version: 2.0.0
+Version: 2.2.0
 Summary: CLI for MySQL Database. With auto-completion and syntax highlighting.
 Author: Mycli Core Team
 License-Expression: BSD-3-Clause

{mycli-2.0.0 → mycli-2.2.0}/changelog.md

@@ -1,3 +1,59 @@
+2.2.0 (2026/07/11)
+==============
+
+Breaking Changes
+---------
+* `ssl` is no longer supported as a DSN parameter.  Use `ssl_mode` instead.
+
+
+Features
+---------
+* Configurable tunnel method for `--ssh-jump`, making UDS usually default.
+* Add `--ssh-options` CLI argument to pass extra options with `--ssh-jump`.
+* Make `ssh_jump` a DSN query parameter.
+* Warn on unknown DSN query parameters.
+* Experimental: reading credentials from Vault using the `vault kv get` CLI.
+
+
+Bug Fixes
+---------
+* Allow `/dsn` command to show correct values with `--ssh-jump`.
+
+
+Documentation
+---------
+* Add `--ssh-jump` to TIPS.
+* Better document `/dsn show`.
+* Improve `ssh_options` commentary.
+
+
+Internal
+---------
+* Make flaky `/watch` test more lenient for CI.
+* Tweak `AGENTS.md` project structure.
+
+
+2.1.1 (2026/07/08)
+==============
+
+Breaking Changes
+---------
+* Remove undocumented support for `tcp://` and `socket://` DSNs.
+
+
+Features
+---------
+* Add `--ssh-jump` CLI argument, restoring SSH jump functionality.
+* Add a `/dsn` command to manage persisted DSN aliases.
+* Add `auto` option to ignore keyring when inside an SSH session.
+
+
+Documentation
+---------
+* Fix a typo in myclirc commentary.
+* Advertise forward-slash command forms in more places.
+
+
 2.0.0 (2026/07/03)
 ==============
 

{mycli-2.0.0 → mycli-2.2.0}/mycli/TIPS

@@ -20,7 +20,7 @@ the --character-set option sets the character set for a single session!
 
 the --unbuffered flag can save memory when in batch mode!
 
---use-keyring=true lets you access the system keyring for passwords!
+--use-keyring=auto lets you access the system keyring for passwords!
 
 --use-keyring=reset resets a password saved to the system keyring!
 
@@ -40,6 +40,8 @@ the --login-path option lets you work with login-path files!
 
 --keepalive-ticks=<num> sets keepalive pings for a single session!
 
+connect via an SSH tunnel with --ssh-jump!
+
 ###
 ### commands
 ###
@@ -108,6 +110,8 @@ the /watch command executes a query every N seconds!
 
 use /bug to file a bug on GitHub!
 
+use /dsn to manage saved DSNs!
+
 ###
 ### environment variables
 ###

{mycli-2.0.0 → mycli-2.2.0}/mycli/cli_runner.py

@@ -9,18 +9,39 @@ from urllib.parse import parse_qs, unquote, urlparse
 import click
 
 from mycli.config import str_to_bool
-from mycli.constants import EMPTY_PASSWORD_FLAG_SENTINEL, ISSUES_URL
+from mycli.constants import EMPTY_PASSWORD_FLAG_SENTINEL
 from mycli.main_modes.batch import main_batch_from_stdin, main_batch_with_progress_bar, main_batch_without_progress_bar
 from mycli.main_modes.checkup import main_checkup
 from mycli.main_modes.execute import main_execute_from_cli
 from mycli.main_modes.list_dsn import main_list_dsn
 from mycli.packages.cli_utils import is_valid_connection_scheme
+from mycli.vault import (
+    DEFAULT_VAULT_EXECUTABLE,
+    DEFAULT_VAULT_PASSWORD_FIELD,
+    DEFAULT_VAULT_USERNAME_FIELD,
+    VaultError,
+    get_field_from_vault,
+)
 
 if TYPE_CHECKING:
     from mycli.main import CliArgs
 
 ClientFactory = Callable[..., Any]
 ENV_VAR_PATTERN = re.compile(r'^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$')
+KNOWN_DSN_QUERY_PARAMS = {
+    'character_set',
+    'keepalive_ticks',
+    'socket',
+    'ssh_jump',
+    'ssl_ca',
+    'ssl_capath',
+    'ssl_cert',
+    'ssl_cipher',
+    'ssl_key',
+    'ssl_mode',
+    'ssl_verify_server_cert',
+    'tls_version',
+}
 
 
 class DsnAliasEnvVarError(ValueError):
@@ -79,7 +100,10 @@ def expand_dsn_alias_env_vars(
     except ValueError as exc:
         raise DsnAliasEnvVarError(f'Port in DSN alias {alias_name} must be an integer.') from exc
 
-    params = {key: [expand_dsn_alias_env_var(value, alias_name) or '' for value in values] for key, values in parse_qs(uri.query).items()}
+    params = {
+        key: [expand_dsn_alias_env_var(value, alias_name) or '' for value in values]
+        for key, values in parse_qs(uri.query, keep_blank_values=True).items()
+    }
 
     return (
         expand_dsn_alias_env_var(unquote(username) if username is not None else None, alias_name),
@@ -200,7 +224,7 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
             dsn_host = uri.hostname
             dsn_port = uri.port
             dsn_database = uri.path[1:]
-            dsn_params = parse_qs(uri.query) if uri.query else {}
+            dsn_params = parse_qs(uri.query, keep_blank_values=True) if uri.query else {}
 
         if not database:
             database = dsn_database
@@ -214,16 +238,13 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
         if not cli_args.port:
             cli_args.port = dsn_port
 
-        if params := dsn_params.get('ssl'):
+        if unknown_dsn_params := sorted(set(dsn_params) - KNOWN_DSN_QUERY_PARAMS):
             click.secho(
-                'Warning: The "ssl" DSN URI parameter is deprecated and will be removed in a future release. '
-                'Please use the "ssl_mode" parameter instead. '
-                f'See issue {ISSUES_URL}/1507',
+                f'Warning: Ignored unknown DSN URI query parameters: {", ".join(unknown_dsn_params)}.',
                 err=True,
                 fg='yellow',
             )
-            if params[0].lower() == 'true':
-                cli_args.ssl_mode = 'on'
+
         if params := dsn_params.get('ssl_mode'):
             cli_args.ssl_mode = cli_args.ssl_mode or params[0]
         if params := dsn_params.get('ssl_ca'):
@@ -254,6 +275,8 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
                 cli_args.keepalive_ticks = int(params[0])
         if params := dsn_params.get('character_set'):
             cli_args.character_set = cli_args.character_set or params[0]
+        if params := dsn_params.get('ssh_jump'):
+            cli_args.ssh_jump = cli_args.ssh_jump or params[0]
 
     keepalive_ticks = cli_args.keepalive_ticks if cli_args.keepalive_ticks is not None else mycli.default_keepalive_ticks
     ssl_mode = cli_args.ssl_mode or mycli.ssl_mode
@@ -304,52 +327,111 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
     if cli_args.use_keyring is not None and cli_args.use_keyring.lower() == 'reset':
         use_keyring = True
         reset_keyring = True
+    elif cli_args.use_keyring is not None and cli_args.use_keyring.lower() == 'auto':
+        if os.environ.get('SSH_CONNECTION'):
+            use_keyring = False
+            reset_keyring = False
+        else:
+            use_keyring = True
+            reset_keyring = False
     elif cli_args.use_keyring is None:
-        use_keyring = str_to_bool(mycli.config['main'].get('use_keyring', 'False'))
-        reset_keyring = False
+        if mycli.config['main'].get('use_keyring', 'False').lower() == 'auto':
+            if os.environ.get('SSH_CONNECTION'):
+                use_keyring = False
+                reset_keyring = False
+            else:
+                use_keyring = True
+                reset_keyring = False
+        else:
+            use_keyring = str_to_bool(mycli.config['main'].get('use_keyring', 'False'))
+            reset_keyring = False
     else:
         use_keyring = str_to_bool(cli_args.use_keyring)
         reset_keyring = False
 
-    mycli.connect(
-        database=database,
-        user=cli_args.user,
-        passwd=cli_args.password,
-        host=cli_args.host,
-        port=cli_args.port,
-        socket=cli_args.socket,
-        local_infile=cli_args.local_infile,
-        ssl=ssl,
-        init_command=combined_init_cmd,
-        unbuffered=cli_args.unbuffered,
-        character_set=cli_args.character_set,
-        use_keyring=use_keyring,
-        reset_keyring=reset_keyring,
-        keepalive_ticks=keepalive_ticks,
-    )
-
-    if combined_init_cmd:
-        click.echo(f"Executing init-command: {combined_init_cmd}", err=True)
+    if cli_args.password is None and cli_args.vault_secret:
+        vault_config = mycli.config.get('vault_beta', {})
+        vault_address = cli_args.vault_address or os.environ.get('VAULT_ADDR') or vault_config.get('address') or None
+        vault_mount = cli_args.vault_mount or vault_config.get('default_mount') or None
+        vault_field = cli_args.vault_password_field or vault_config.get('default_password_field') or DEFAULT_VAULT_PASSWORD_FIELD
+        vault_executable = vault_config.get('vault_executable') or DEFAULT_VAULT_EXECUTABLE
+        try:
+            vault_password: str | None = get_field_from_vault(
+                vault_field,
+                cli_args.vault_secret,
+                executable=vault_executable,
+                mount=vault_mount,
+                address=vault_address,
+            )
+        except VaultError as exc:
+            click.secho(f'Error reading password from Vault: {exc}', err=True, fg='red')
+            sys.exit(1)
+    else:
+        vault_password = None
+
+    if cli_args.user is None and cli_args.vault_secret:
+        vault_config = mycli.config.get('vault_beta', {})
+        vault_address = cli_args.vault_address or os.environ.get('VAULT_ADDR') or vault_config.get('address') or None
+        vault_mount = cli_args.vault_mount or vault_config.get('default_mount') or None
+        vault_field = cli_args.vault_username_field or vault_config.get('default_username_field') or DEFAULT_VAULT_USERNAME_FIELD
+        vault_executable = vault_config.get('vault_executable') or DEFAULT_VAULT_EXECUTABLE
+        try:
+            vault_username = get_field_from_vault(
+                vault_field,
+                cli_args.vault_secret,
+                executable=vault_executable,
+                mount=vault_mount,
+                address=vault_address,
+            )
+        except VaultError as exc:
+            click.secho(f'Error reading username from Vault: {exc}', err=True, fg='red')
+            sys.exit(1)
+    else:
+        vault_username = None
 
-    mycli.logger.debug(
-        "Launch Params: \n\tdatabase: %r\tuser: %r\thost: %r\tport: %r",
-        database,
-        cli_args.user,
-        cli_args.host,
-        cli_args.port,
-    )
+    try:
+        mycli.connect(
+            database=database,
+            user=vault_username if cli_args.user is None else cli_args.user,
+            passwd=vault_password if cli_args.password is None else cli_args.password,
+            host=cli_args.host,
+            port=cli_args.port,
+            socket=cli_args.socket,
+            local_infile=cli_args.local_infile,
+            ssl=ssl,
+            init_command=combined_init_cmd,
+            unbuffered=cli_args.unbuffered,
+            character_set=cli_args.character_set,
+            use_keyring=use_keyring,
+            reset_keyring=reset_keyring,
+            keepalive_ticks=keepalive_ticks,
+            ssh_jump=cli_args.ssh_jump,
+            ssh_cli_options=cli_args.ssh_options,
+        )
+
+        if combined_init_cmd:
+            click.echo(f"Executing init-command: {combined_init_cmd}", err=True)
+
+        mycli.logger.debug(
+            "Launch Params: \n\tdatabase: %r\tuser: %r\thost: %r\tport: %r",
+            database,
+            cli_args.user,
+            cli_args.host,
+            cli_args.port,
+        )
 
-    if cli_args.execute is not None:
-        sys.exit(main_execute_from_cli(mycli, cli_args))
+        if cli_args.execute is not None:
+            sys.exit(main_execute_from_cli(mycli, cli_args))
 
-    if cli_args.batch is not None and cli_args.batch != '-' and cli_args.progress and sys.stderr.isatty():
-        sys.exit(main_batch_with_progress_bar(mycli, cli_args))
+        if cli_args.batch is not None and cli_args.batch != '-' and cli_args.progress and sys.stderr.isatty():
+            sys.exit(main_batch_with_progress_bar(mycli, cli_args))
 
-    if cli_args.batch is not None:
-        sys.exit(main_batch_without_progress_bar(mycli, cli_args))
+        if cli_args.batch is not None:
+            sys.exit(main_batch_without_progress_bar(mycli, cli_args))
 
-    if not sys.stdin.isatty():
-        sys.exit(main_batch_from_stdin(mycli, cli_args))
+        if not sys.stdin.isatty():
+            sys.exit(main_batch_from_stdin(mycli, cli_args))
 
-    mycli.run_cli()
-    mycli.close()
+        mycli.run_cli()
+    finally:
+        mycli.close()

{mycli-2.0.0 → mycli-2.2.0}/mycli/client.py

@@ -35,11 +35,13 @@ from mycli.constants import DEFAULT_PROMPT
 from mycli.main_modes import repl as repl_package
 from mycli.output import OutputMixin
 from mycli.packages import special
+from mycli.packages.special.dsn_aliases import DsnAliases
 from mycli.packages.special.favoritequeries import FavoriteQueries
 from mycli.packages.tabular_output import sql_format
 from mycli.schema_prefetcher import SchemaPrefetcher
 from mycli.sqlcompleter import SQLCompleter
 from mycli.sqlexecute import SQLExecute
+from mycli.ssh_tunnel import SshTunnel
 from mycli.types import Query
 
 sqlparse.engine.grouping.MAX_GROUPING_DEPTH = None  # type: ignore[assignment]
@@ -75,6 +77,7 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
         cli_verbosity: int = 0,
     ) -> None:
         self.sqlexecute = sqlexecute
+        self.ssh_tunnel: SshTunnel | None = None
         self.logfile = logfile
         self.login_path = login_path
         self.toolbar_error_message: str | None = None
@@ -106,6 +109,7 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
         self.default_keepalive_ticks = c['connection'].as_int('default_keepalive_ticks')
 
         FavoriteQueries.instance = FavoriteQueries.from_config(self.config)
+        DsnAliases.instance = DsnAliases.from_config(self.config)
 
         self.dsn_alias: str | None = None
         self.main_formatter = TabularOutputFormatter(format_name=c["main"]["table_format"])
@@ -198,10 +202,20 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
         special.set_destructive_keywords(self.destructive_keywords)
 
     def close(self) -> None:
-        if hasattr(self, 'schema_prefetcher'):
+        try:
             self.schema_prefetcher.stop()
+        except Exception:
+            pass
         if self.sqlexecute is not None:
-            self.sqlexecute.close()
+            try:
+                self.sqlexecute.close()
+            except Exception:
+                pass
+        if self.ssh_tunnel is not None:
+            try:
+                self.ssh_tunnel.close()
+            except Exception:
+                pass
 
     def run_cli(self) -> None:
         repl_package.main_repl(self)

{mycli-2.0.0 → mycli-2.2.0}/mycli/client_connection.py

@@ -3,7 +3,8 @@ from __future__ import annotations
 import os
 import sys
 import traceback
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Literal
+from urllib.parse import quote as urlquote
 
 import click
 import keyring
@@ -21,7 +22,9 @@ from mycli.constants import (
     ER_MUST_CHANGE_PASSWORD_LOGIN,
 )
 from mycli.packages.filepaths import guess_socket_location
+from mycli.packages.special.utils import format_connection_dsn
 from mycli.sqlexecute import SQLExecute
+from mycli.ssh_tunnel import SshTunnel, SshTunnelError
 
 try:
     from pwd import getpwuid
@@ -58,6 +61,8 @@ class ClientConnectionMixin:
         use_keyring: bool | None = None,
         reset_keyring: bool | None = None,
         keepalive_ticks: int | None = None,
+        ssh_jump: str | None = None,
+        ssh_cli_options: str | None = None,
     ) -> None:
         mylogin_cnf: dict[str, Any] = self.read_mylogin_cnf(self.mylogin_cnf)
         # Fall back to .mylogin.cnf values only if user did not specify a value.
@@ -67,6 +72,7 @@ class ClientConnectionMixin:
         ssl_config: dict[str, Any] = ssl or {}
         user_connection_config = self.config_without_package_defaults.get('connection', {})
         self.keepalive_ticks = keepalive_ticks
+        self.ssh_tunnel = None
 
         int_port = port and int(port)
         if not int_port:
@@ -74,6 +80,34 @@ class ClientConnectionMixin:
             if not host or host == DEFAULT_HOST:
                 socket = socket or user_connection_config.get("default_socket") or mylogin_cnf["socket"] or guess_socket_location()
 
+        if ssh_jump:
+            remote_host = host or DEFAULT_HOST
+            remote_port = int_port or DEFAULT_PORT
+            remote_socket = socket or None
+            ssh_executable = self.config.get('ssh', {}).get('ssh_executable', 'ssh') or 'ssh'
+            ssh_config_options = self.config.get('ssh', {}).get('ssh_options')
+            tunnel_method: Literal['auto', 'socket', 'port'] = self.config.get('ssh', {}).get('tunnel_method', 'auto').lower() or 'auto'
+            try:
+                self.ssh_tunnel = SshTunnel.from_target(
+                    ssh_jump,
+                    remote_host=remote_host,
+                    remote_port=int(remote_port),
+                    remote_socket=remote_socket,
+                    ssh_executable=ssh_executable,
+                    ssh_config_options=ssh_config_options,
+                    ssh_cli_options=ssh_cli_options,
+                    tunnel_method=tunnel_method,
+                )
+                self.ssh_tunnel.start()
+            except (OSError, ValueError, SshTunnelError) as exc:
+                click.secho(f'Error: Unable to start SSH tunnel: {exc}', err=True, fg='red')
+                try:
+                    if self.ssh_tunnel:
+                        self.ssh_tunnel.close()
+                except Exception:
+                    pass
+                sys.exit(1)
+
         passwd = passwd if isinstance(passwd, (str, int)) else mylogin_cnf["password"]
 
         if not character_set:
@@ -132,10 +166,14 @@ class ClientConnectionMixin:
         # 2. --password-file CLI option
         # 3. envvar (MYSQL_PWD)
         # 4. DSN (mysql://user:password)
-        # 5. .mylogin.cnf
-        # 6. keyring
-
-        keyring_identifier = f'{user}@{host}:{"" if socket else int_port}:{socket or ""}'
+        # 5. Vault
+        # 6. .mylogin.cnf
+        # 7. keyring
+
+        ssh_tunnel_field = urlquote(ssh_jump or '')
+        if ssh_tunnel_field:
+            ssh_tunnel_field = ':' + ssh_tunnel_field
+        keyring_identifier = f'{user}@{host}:{"" if socket else int_port}:{socket or ""}{ssh_tunnel_field}'
         keyring_domain = 'mycli.net'
         keyring_retrieved_cleanly = False
 
@@ -152,19 +190,41 @@ class ClientConnectionMixin:
         # should not fail, but will help the typechecker
         assert not isinstance(passwd, int)
 
-        connection_info: dict[Any, Any] = {
-            "database": database,
-            "user": user,
-            "password": passwd,
-            "host": host,
-            "port": int_port,
-            "socket": socket,
-            "character_set": character_set,
-            "local_infile": use_local_infile,
-            "ssl": ssl_config,
-            "init_command": init_command,
-            "unbuffered": unbuffered,
+        display_dsn = None
+        if self.ssh_tunnel:
+            display_dsn = format_connection_dsn(
+                user=user,
+                host=remote_host,
+                port=remote_port,
+                socket=remote_socket,
+                database=database,
+                character_set=character_set,
+                ssh_jump=ssh_jump,
+            )
+
+        connection_info: dict[str, Any] = {
+            'database': database,
+            'user': user,
+            'password': passwd,
+            'character_set': character_set,
+            'local_infile': use_local_infile,
+            'ssl': ssl_config,
+            'init_command': init_command,
+            'unbuffered': unbuffered,
+            'display_dsn': display_dsn,
         }
+        if self.ssh_tunnel and self.ssh_tunnel.local_socket:
+            connection_info['host'] = None
+            connection_info['port'] = None
+            connection_info['socket'] = self.ssh_tunnel.local_socket
+        elif self.ssh_tunnel:
+            connection_info['host'] = self.ssh_tunnel.local_host
+            connection_info['port'] = self.ssh_tunnel.local_port
+            connection_info['socket'] = None
+        else:
+            connection_info['host'] = host
+            connection_info['port'] = int_port
+            connection_info['socket'] = socket
 
         def _update_keyring(password: str | None, keyring_retrieved_cleanly: bool):
             if not password:
@@ -239,6 +299,8 @@ class ClientConnectionMixin:
                     socket_owner = getpwuid(os.stat(socket).st_uid).pw_name
                 except KeyError:
                     socket_owner = '<unknown>'
+                except FileNotFoundError:
+                    socket_owner = '<unknown>'
                 self.echo(f"Connecting to socket {socket}, owned by user {socket_owner}", err=True)
                 try:
                     _connect(keyring_retrieved_cleanly=keyring_retrieved_cleanly)