mycli 2.24.4__tar.gz → 2.25.0__tar.gz

{mycli-2.24.4 → mycli-2.25.0}/.github/dependabot.yml

@@ -1,6 +1,8 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
+    cooldown:
+      default-days: 7
     directory: "/"
     schedule:
       interval: "daily"

{mycli-2.24.4 → mycli-2.25.0}/.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "latest"
 
@@ -66,7 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "latest"
 
@@ -116,7 +116,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: 'latest'
 
@@ -130,7 +130,7 @@ jobs:
         run: uv sync --all-extras -p ${{ matrix.python-version }}
 
       - name: Set up MySQL
-        uses: shogo82148/actions-setup-mysql@62da9377d83991fce27b6ed2a397d3306121e41d # v1.53.1
+        uses: shogo82148/actions-setup-mysql@083ec148d28e62f2b24b8f4541693dfe1d50488d # v1.54.0
         with:
           mysql-version: '9.7'
           root-password: root
@@ -220,7 +220,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "latest"
 
@@ -249,3 +249,22 @@ jobs:
           TERM: xterm
         run: |
           uv run tox -e py3.14
+
+  docker-build:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build Docker image
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: false

{mycli-2.24.4 → mycli-2.25.0}/.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish Python Package
+name: Publish Packages
 
 on:
   release:
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         version: "latest"
 
@@ -77,7 +77,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         version: "latest"
 
@@ -127,7 +127,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         version: 'latest'
 
@@ -141,7 +141,7 @@ jobs:
       run: uv sync --all-extras -p ${{ matrix.python-version }}
 
     - name: Set up MySQL
-      uses: shogo82148/actions-setup-mysql@62da9377d83991fce27b6ed2a397d3306121e41d # v1.53.1
+      uses: shogo82148/actions-setup-mysql@083ec148d28e62f2b24b8f4541693dfe1d50488d # v1.54.0
       with:
         mysql-version: '9.7'
         root-password: root
@@ -230,7 +230,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         version: "latest"
 
@@ -252,7 +252,7 @@ jobs:
         path: dist/
 
   publish-pypi:
-    name: Publish to PyPI
+    name: Publish Wheel to PyPI
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     needs: [build]
@@ -269,9 +269,11 @@ jobs:
       uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   publish-image:
-    name: Publish to ghcr.io
+    name: Publish Image to ghcr.io
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
+    # doesn't actually need the results of build, but it makes sense to run this
+    # concurrently with publish-pypi
     needs: [build]
     environment: release
 
@@ -293,6 +295,10 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
     - name: Extract metadata (tags, labels) for Docker
       id: meta
       uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
@@ -306,5 +312,6 @@ jobs:
         context: .
         file: docker/Dockerfile
         push: true
+        platforms: linux/amd64,linux/arm64
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}

{mycli-2.24.4 → mycli-2.25.0}/.github/workflows/typecheck.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           python-version: '3.14'
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: 'latest'
 

{mycli-2.24.4 → mycli-2.25.0}/AGENTS.md

@@ -25,8 +25,10 @@ A command line client for MySQL with auto-completion and syntax highlighting.
 ├── mycli/config.py                       # configuration file readers and utilities
 ├── mycli/constants.py                    # shared constants
 ├── mycli/key_bindings.py                 # prompt_toolkit key binding utilities
+├── mycli/keyring_utils.py                # saved credential utilities
 ├── mycli/kubectl_tunnel.py               # connection over kubectl tunnel
 ├── mycli/lexer.py                        # extends `MySqlLexer` from Pygments
+├── mycli/macos_keychain.py               # macOS Keychain credentials preserving access controls
 ├── mycli/main.py                         # processes CLI arguments
 ├── mycli/main_modes/                     # main execution paths
 ├── mycli/main_modes/batch.py             # `--batch` mode

{mycli-2.24.4/mycli.egg-info → mycli-2.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycli
-Version: 2.24.4
+Version: 2.25.0
 Summary: Rich MySQL terminal client with autocompletion, syntax highlighting, and dataframes
 Author: Mycli Core Team
 License-Expression: BSD-3-Clause
@@ -143,20 +143,26 @@ mycli --help
 * Fuzzy history search using [fzf](https://github.com/junegunn/fzf).
 * Output explorer using [fzf](https://github.com/junegunn/fzf) or other tools.
 * Syntax highlighting using [Pygments](https://pygments.org/).
-* Smart-completion (enabled by default) will suggest context-sensitive completion.
-    - `SELECT * FROM <tab>` will only show table names.
-    - `SELECT * FROM users WHERE <tab>` will only show column names.
-* Support for multiline queries.
+* Smart-completion suggests context-sensitive completion:
+    - `SELECT * FROM `<kbd>tab</kbd> will only show table names.
+    - `SELECT * FROM users WHERE `<kbd>tab</kbd> will only show column names.
+* Multiline queries.
 * Favorite queries with positional or named parameters using [Jinja](https://jinja.palletsprojects.com/en/stable/). Save a query using
-  `/fs <alias> <query>` and execute it with `/f <alias>` or `/f <alias> --key=value`.
-* Timing of sql statements and table rendering.
-* Log every query and its results to a file (disabled by default).
-* Pretty print tabular data with colors.
-* Support for SSL connections.
+    ```
+    /fs alias <query>
+    ```
+  and execute it with
+    ```
+    /f alias --key=value
+    ```
+* Timing of SQL statements and table rendering.
+* Logging of every query and its results to a file (off by default).
+* Pretty printing of tabular data.
 * Shell-style trailing redirects with `$>`, `$>>` and `$|` operators.
 * [Polars](https://pola.rs) dataframe [transforms and plots](https://github.com/dbcli/mycli/blob/main/doc/transforms.md) with `.|`, and Parquet saves with `.>`.
-* Support for [querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
-* Support for storing passwords in the system keyring.
+* [Querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
+* Storing passwords in the system keyring.
+* Modern defaults such as UTF-8 connection type and SSL.
 * Integrations with: [SSH](https://www.openssh.org/), [Kubernetes](https://kubernetes.io/), [Vault](https://github.com/hashicorp/vault), and [Boundary](https://github.com/hashicorp/boundary).
 
 Mycli creates a config file `~/.myclirc` on the first run; you can use the

{mycli-2.24.4 → mycli-2.25.0}/README.md

@@ -71,20 +71,26 @@ mycli --help
 * Fuzzy history search using [fzf](https://github.com/junegunn/fzf).
 * Output explorer using [fzf](https://github.com/junegunn/fzf) or other tools.
 * Syntax highlighting using [Pygments](https://pygments.org/).
-* Smart-completion (enabled by default) will suggest context-sensitive completion.
-    - `SELECT * FROM <tab>` will only show table names.
-    - `SELECT * FROM users WHERE <tab>` will only show column names.
-* Support for multiline queries.
+* Smart-completion suggests context-sensitive completion:
+    - `SELECT * FROM `<kbd>tab</kbd> will only show table names.
+    - `SELECT * FROM users WHERE `<kbd>tab</kbd> will only show column names.
+* Multiline queries.
 * Favorite queries with positional or named parameters using [Jinja](https://jinja.palletsprojects.com/en/stable/). Save a query using
-  `/fs <alias> <query>` and execute it with `/f <alias>` or `/f <alias> --key=value`.
-* Timing of sql statements and table rendering.
-* Log every query and its results to a file (disabled by default).
-* Pretty print tabular data with colors.
-* Support for SSL connections.
+    ```
+    /fs alias <query>
+    ```
+  and execute it with
+    ```
+    /f alias --key=value
+    ```
+* Timing of SQL statements and table rendering.
+* Logging of every query and its results to a file (off by default).
+* Pretty printing of tabular data.
 * Shell-style trailing redirects with `$>`, `$>>` and `$|` operators.
 * [Polars](https://pola.rs) dataframe [transforms and plots](https://github.com/dbcli/mycli/blob/main/doc/transforms.md) with `.|`, and Parquet saves with `.>`.
-* Support for [querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
-* Support for storing passwords in the system keyring.
+* [Querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
+* Storing passwords in the system keyring.
+* Modern defaults such as UTF-8 connection type and SSL.
 * Integrations with: [SSH](https://www.openssh.org/), [Kubernetes](https://kubernetes.io/), [Vault](https://github.com/hashicorp/vault), and [Boundary](https://github.com/hashicorp/boundary).
 
 Mycli creates a config file `~/.myclirc` on the first run; you can use the

{mycli-2.24.4 → mycli-2.25.0}/changelog.md

@@ -1,3 +1,31 @@
+2.25.0 (2026/09/16)
+==============
+
+Features
+--------
+* Publish multi-architecture Docker images.
+
+
+2.24.5 (2026/09/16)
+==============
+
+Bug Fixes
+--------
+* New macOS keyring entries no longer automatically trust Python.
+
+
+Documentation
+--------
+* Update features bullets in `README.md`.
+
+
+Internal
+--------
+* Naming and commentary in `publish.yml` workflow.
+* Build Docker image as part of regular CI tests.
+* One week cooldown for dependabot.
+
+
 2.24.4 (2026/09/12)
 ==============
 

{mycli-2.24.4 → mycli-2.25.0}/docker/resources/test_db-1.0.7.tar.gz

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
-name: mycli-2.24.4/docker/resources/test_db-1.0.7.tar.gz
+name: mycli-2.25.0/docker/resources/test_db-1.0.7.tar.gz
 size: 35607473 bytes
 sha256: c44c140f352f35d47fdb65df60f52b779ef552822fad6c4efcfa7b134c3faf84

{mycli-2.24.4 → mycli-2.25.0}/mycli/client_connection.py

@@ -22,6 +22,7 @@ from mycli.constants import (
     EMPTY_PASSWORD_FLAG_SENTINEL,
     ER_MUST_CHANGE_PASSWORD_LOGIN,
 )
+from mycli.keyring_utils import set_keyring_password
 from mycli.kubectl_tunnel import KubectlTunnel, KubectlTunnelError
 from mycli.packages.filepaths import guess_socket_location
 from mycli.packages.special.utils import format_connection_dsn
@@ -381,7 +382,7 @@ class ClientConnectionMixin:
                 try:
                     saved_pw = keyring.get_password(keyring_domain, keyring_identifier)
                     if password != saved_pw or reset_keyring:
-                        keyring.set_password(keyring_domain, keyring_identifier, password)
+                        set_keyring_password(keyring_domain, keyring_identifier, password)
                         click.secho(
                             f'Password from source: "{password_source}" '
                             f'saved to the system keyring at {keyring_domain}/{keyring_identifier}',

mycli-2.25.0/mycli/keyring_utils.py

@@ -0,0 +1,34 @@
+import sys
+
+import keyring
+from keyring.backend import KeyringBackend
+
+
+def _set_password_with_backend(backend: KeyringBackend, service: str, account: str, password: str) -> None:
+    from keyring.backends.macOS import Keyring
+
+    if type(backend) is Keyring:
+        from mycli import macos_keychain
+
+        macos_keychain.set_password(service, account, password)
+    else:
+        backend.set_password(service, account, password)
+
+
+def set_keyring_password(service: str, account: str, password: str) -> None:
+    if sys.platform != 'darwin':
+        keyring.set_password(service, account, password)
+        return
+
+    from keyring.backends.chainer import ChainerBackend  # type: ignore[unreachable]
+
+    backend = keyring.get_keyring()
+    if type(backend) is ChainerBackend:
+        for candidate in backend.backends:
+            try:
+                _set_password_with_backend(candidate, service, account, password)
+                return
+            except NotImplementedError:
+                continue
+    else:
+        _set_password_with_backend(backend, service, account, password)

mycli-2.25.0/mycli/macos_keychain.py

@@ -0,0 +1,80 @@
+import ctypes
+from typing import Any
+
+from keyring.errors import KeyringLocked, PasswordSetError
+
+
+def _get_api() -> Any:
+    from keyring.backends.macOS import api
+
+    return api
+
+
+def set_password(service: str, account: str, password: str) -> None:
+    """Preserve existing ACLs and create credentials without trusting Python."""
+    api = _get_api()
+    cf_array_create = api._found.CFArrayCreate
+    cf_array_create.restype = ctypes.c_void_p
+    cf_array_create.argtypes = (ctypes.c_void_p, ctypes.c_void_p, ctypes.c_long, ctypes.c_void_p)
+    cf_data_create = api._found.CFDataCreate
+    cf_data_create.restype = ctypes.c_void_p
+    cf_data_create.argtypes = (ctypes.c_void_p, ctypes.c_void_p, ctypes.c_long)
+    cf_release = api._found.CFRelease
+    cf_release.restype = None
+    cf_release.argtypes = (ctypes.c_void_p,)
+    sec_access_create = api._sec.SecAccessCreate
+    sec_access_create.restype = api.OS_status
+    sec_access_create.argtypes = (ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p))
+    sec_item_update = api._sec.SecItemUpdate
+    sec_item_update.restype = api.OS_status
+    sec_item_update.argtypes = (ctypes.c_void_p, ctypes.c_void_p)
+
+    retained: list[ctypes.c_void_p] = []
+
+    def retain(value: int | ctypes.c_void_p | None, name: str) -> ctypes.c_void_p:
+        if not value:
+            raise RuntimeError(f'Unable to allocate Keychain {name}')
+        pointer = value if isinstance(value, ctypes.c_void_p) else ctypes.c_void_p(value)
+        retained.append(pointer)
+        return pointer
+
+    try:
+        service_value = retain(api.create_cf(service), 'service')
+        account_value = retain(api.create_cf(account), 'account')
+        encoded = password.encode('utf-8')
+        password_value = retain(cf_data_create(None, ctypes.create_string_buffer(encoded), len(encoded)), 'password')
+        search = retain(
+            api.create_query(
+                kSecClass=api.k_('kSecClassGenericPassword'),
+                kSecAttrService=service_value,
+                kSecAttrAccount=account_value,
+            ),
+            'search',
+        )
+        attributes = retain(api.create_query(kSecValueData=password_value), 'attributes')
+        status = sec_item_update(search, attributes)
+        if status == api.error.item_not_found:
+            # An empty array trusts nobody; NULL would trust the calling executable.
+            trusted_apps = retain(cf_array_create(None, None, 0, None), 'access controls')
+            access = ctypes.c_void_p()
+            api.Error.raise_for_status(sec_access_create(service_value, trusted_apps, ctypes.byref(access)))
+            retain(access, 'access')
+            item = retain(
+                api.create_query(
+                    kSecClass=api.k_('kSecClassGenericPassword'),
+                    kSecAttrService=service_value,
+                    kSecAttrAccount=account_value,
+                    kSecValueData=password_value,
+                    kSecAttrAccess=access,
+                ),
+                'item',
+            )
+            status = api.SecItemAdd(item, None)
+        api.Error.raise_for_status(status)
+    except api.KeychainDenied as e:
+        raise KeyringLocked(f"Can't store password on keychain: {e}") from e
+    except api.Error as e:
+        raise PasswordSetError(f"Can't store password on keychain: {e}") from e
+    finally:
+        for value in reversed(retained):
+            cf_release(value)

{mycli-2.24.4 → mycli-2.25.0/mycli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycli
-Version: 2.24.4
+Version: 2.25.0
 Summary: Rich MySQL terminal client with autocompletion, syntax highlighting, and dataframes
 Author: Mycli Core Team
 License-Expression: BSD-3-Clause
@@ -143,20 +143,26 @@ mycli --help
 * Fuzzy history search using [fzf](https://github.com/junegunn/fzf).
 * Output explorer using [fzf](https://github.com/junegunn/fzf) or other tools.
 * Syntax highlighting using [Pygments](https://pygments.org/).
-* Smart-completion (enabled by default) will suggest context-sensitive completion.
-    - `SELECT * FROM <tab>` will only show table names.
-    - `SELECT * FROM users WHERE <tab>` will only show column names.
-* Support for multiline queries.
+* Smart-completion suggests context-sensitive completion:
+    - `SELECT * FROM `<kbd>tab</kbd> will only show table names.
+    - `SELECT * FROM users WHERE `<kbd>tab</kbd> will only show column names.
+* Multiline queries.
 * Favorite queries with positional or named parameters using [Jinja](https://jinja.palletsprojects.com/en/stable/). Save a query using
-  `/fs <alias> <query>` and execute it with `/f <alias>` or `/f <alias> --key=value`.
-* Timing of sql statements and table rendering.
-* Log every query and its results to a file (disabled by default).
-* Pretty print tabular data with colors.
-* Support for SSL connections.
+    ```
+    /fs alias <query>
+    ```
+  and execute it with
+    ```
+    /f alias --key=value
+    ```
+* Timing of SQL statements and table rendering.
+* Logging of every query and its results to a file (off by default).
+* Pretty printing of tabular data.
 * Shell-style trailing redirects with `$>`, `$>>` and `$|` operators.
 * [Polars](https://pola.rs) dataframe [transforms and plots](https://github.com/dbcli/mycli/blob/main/doc/transforms.md) with `.|`, and Parquet saves with `.>`.
-* Support for [querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
-* Support for storing passwords in the system keyring.
+* [Querying LLMs](https://www.mycli.net/llm) with context derived from your schema using `/llm`.
+* Storing passwords in the system keyring.
+* Modern defaults such as UTF-8 connection type and SSL.
 * Integrations with: [SSH](https://www.openssh.org/), [Kubernetes](https://kubernetes.io/), [Vault](https://github.com/hashicorp/vault), and [Boundary](https://github.com/hashicorp/boundary).
 
 Mycli creates a config file `~/.myclirc` on the first run; you can use the

{mycli-2.24.4 → mycli-2.25.0}/mycli.egg-info/SOURCES.txt

@@ -44,8 +44,10 @@ mycli/completion_refresher.py
 mycli/config.py
 mycli/constants.py
 mycli/key_bindings.py
+mycli/keyring_utils.py
 mycli/kubectl_tunnel.py
 mycli/lexer.py
+mycli/macos_keychain.py
 mycli/main.py
 mycli/myclirc
 mycli/output.py
@@ -159,7 +161,9 @@ test/pytests/test_hybrid_redirection.py
 test/pytests/test_interactive_utils.py
 test/pytests/test_key_binding_utils.py
 test/pytests/test_key_bindings.py
+test/pytests/test_keyring_utils.py
 test/pytests/test_kubectl_tunnel.py
+test/pytests/test_macos_keychain.py
 test/pytests/test_main.py
 test/pytests/test_main_modes_batch.py
 test/pytests/test_main_modes_execute.py

{mycli-2.24.4 → mycli-2.25.0}/mycli.egg-info/scm_file_list.json

@@ -45,8 +45,10 @@
     "mycli/config.py",
     "mycli/constants.py",
     "mycli/key_bindings.py",
+    "mycli/keyring_utils.py",
     "mycli/kubectl_tunnel.py",
     "mycli/lexer.py",
+    "mycli/macos_keychain.py",
     "mycli/main.py",
     "mycli/main_modes/batch.py",
     "mycli/main_modes/checkup.py",
@@ -152,7 +154,9 @@
     "test/pytests/test_interactive_utils.py",
     "test/pytests/test_key_binding_utils.py",
     "test/pytests/test_key_bindings.py",
+    "test/pytests/test_keyring_utils.py",
     "test/pytests/test_kubectl_tunnel.py",
+    "test/pytests/test_macos_keychain.py",
     "test/pytests/test_main.py",
     "test/pytests/test_main_modes_batch.py",
     "test/pytests/test_main_modes_execute.py",

mycli-2.25.0/mycli.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.25.0",
+  "distance": 0,
+  "node": "g225bf21e310f12ec2e22cbb178e1ab93822bb385",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-16"
+}

{mycli-2.24.4 → mycli-2.25.0}/test/pytests/test_client_connection.py

@@ -260,11 +260,14 @@ def test_connect_retrieves_password_from_keyring(monkeypatch: pytest.MonkeyPatch
         return 'from-keyring'
 
     monkeypatch.setattr(client_connection.keyring, 'get_password', fake_get_password)
+    writes: list[tuple[str, str, str]] = []
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *args: writes.append(args))
 
     client.connect(user='alice', host='db', port=3307, use_keyring=True)
 
     assert FakeSQLExecute.calls[-1]['password'] == 'from-keyring'
     assert get_password_calls == [('mycli.net', 'alice@db:3307:')]
+    assert writes == []
 
 
 def test_connect_uses_mylogin_password_before_keyring(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -275,7 +278,7 @@ def test_connect_uses_mylogin_password_before_keyring(monkeypatch: pytest.Monkey
         'get_password',
         lambda domain, identifier: get_password_calls.append((domain, identifier)) or 'from-mylogin',  # type: ignore[func-returns-value]
     )
-    monkeypatch.setattr(client_connection.keyring, 'set_password', lambda *_args: None)
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *_args: None)
 
     client.connect(user='alice', host='db', port=3307, use_keyring=True)
 
@@ -293,7 +296,7 @@ def test_connect_resolves_supplied_candidates_after_connection_details(monkeypat
         'get_password',
         lambda domain, identifier: keyring_calls.append((domain, identifier)) or 'from-dsn',  # type: ignore[func-returns-value]
     )
-    monkeypatch.setattr(client_connection.keyring, 'set_password', lambda *_args: None)
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *_args: None)
 
     client.connect(user='alice', host='db', port=3307, password_candidates=candidates, use_keyring=True)
 
@@ -326,8 +329,8 @@ def test_connect_saves_selected_password_to_keyring(monkeypatch: pytest.MonkeyPa
     secho_calls: list[tuple[str, dict[str, Any]]] = []
     monkeypatch.setattr(client_connection.keyring, 'get_password', lambda *_args: 'old-secret')
     monkeypatch.setattr(
-        client_connection.keyring,
-        'set_password',
+        client_connection,
+        'set_keyring_password',
         lambda domain, identifier, password: set_password_calls.append((domain, identifier, password)),
     )
     monkeypatch.setattr(client_connection.click, 'secho', lambda message, **kwargs: secho_calls.append((message, kwargs)))
@@ -348,7 +351,7 @@ def test_connect_reports_keyring_save_error(monkeypatch: pytest.MonkeyPatch) ->
     def fail_set_password(*_args: Any) -> None:
         raise RuntimeError('locked')
 
-    monkeypatch.setattr(client_connection.keyring, 'set_password', fail_set_password)
+    monkeypatch.setattr(client_connection, 'set_keyring_password', fail_set_password)
     monkeypatch.setattr(client_connection.click, 'secho', lambda message, **kwargs: secho_calls.append((message, kwargs)))
 
     client.connect(user='alice', host='db', port=3307, password_candidates=candidates, use_keyring=True)
@@ -356,6 +359,46 @@ def test_connect_reports_keyring_save_error(monkeypatch: pytest.MonkeyPatch) ->
     assert secho_calls == [('Password not saved to the system keyring: locked', {'err': True, 'fg': 'red'})]
 
 
+def test_connect_saves_fallback_password_when_keyring_is_empty(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyClient()
+    FakeSQLExecute.effects = [op_error(1045), None]
+    writes: list[tuple[str, str, str]] = []
+    monkeypatch.setattr(client_connection.keyring, 'get_password', lambda *_args: None)
+    monkeypatch.setattr(client_connection.click, 'prompt', lambda *_args, **_kwargs: 'new-secret')
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *args: writes.append(args))
+
+    client.connect(user='alice', host='db', port=3307, use_keyring=True)
+
+    assert writes == [('mycli.net', 'alice@db:3307:', 'new-secret')]
+
+
+def test_connect_does_not_rewrite_rejected_keyring_password(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyClient()
+    FakeSQLExecute.effects = [op_error(1045)]
+    writes: list[tuple[str, str, str]] = []
+    monkeypatch.setattr(client_connection.keyring, 'get_password', lambda *_args: 'old-secret')
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *args: writes.append(args))
+
+    with pytest.raises(SystemExit):
+        client.connect(user='alice', host='db', port=3307, use_keyring=True)
+
+    assert writes == []
+
+
+@pytest.mark.parametrize('reset', [False, True])
+def test_connect_only_rewrites_unchanged_password_for_reset(monkeypatch: pytest.MonkeyPatch, reset: bool) -> None:
+    client = DummyClient()
+    candidates = PasswordCandidates()
+    candidates.add_value('literal', 'secret')
+    writes: list[tuple[str, str, str]] = []
+    monkeypatch.setattr(client_connection.keyring, 'get_password', lambda *_args: 'secret')
+    monkeypatch.setattr(client_connection, 'set_keyring_password', lambda *args: writes.append(args))
+
+    client.connect(user='alice', host='db', port=3307, password_candidates=candidates, use_keyring=True, reset_keyring=reset)
+
+    assert writes == ([('mycli.net', 'alice@db:3307:', 'secret')] if reset else [])
+
+
 def test_connect_uses_ssh_jump_with_remote_socket(monkeypatch: pytest.MonkeyPatch) -> None:
     tunnel_calls: list[dict[str, Any]] = []
 
@@ -485,8 +528,8 @@ def test_connect_uses_kubectl_tunnel_with_resolved_database_port(monkeypatch: py
         lambda domain, identifier: keyring_calls.append(('get', domain, identifier)),
     )
     monkeypatch.setattr(
-        client_connection.keyring,
-        'set_password',
+        client_connection,
+        'set_keyring_password',
         lambda domain, identifier, password: keyring_calls.append(('set', domain, identifier, password)),
     )
     password_candidates = PasswordCandidates()