mycli 2.3.0__tar.gz → 2.4.0__tar.gz

{mycli-2.3.0 → mycli-2.4.0}/AGENTS.md

@@ -48,6 +48,8 @@ A command line client for MySQL with auto-completion and syntax highlighting.
 ├── mycli/packages/sqlresult.py           # the `SQLResult` dataclass for holding responses
 ├── mycli/packages/string_utils.py        # generic string utilities
 ├── mycli/packages/tabular_output/        # extends cli_helper with additional output formats
+├── mycli/password_sources.py             # password sources and precedence
+├── mycli/ssh_tunnel.py                   # connecting over a tunnel with `--ssh-jump`
 ├── mycli/schema_prefetcher.py            # background prefetcher for multi-schema auto-completion
 ├── mycli/sqlcompleter.py                 # offers SQL completions
 ├── mycli/sqlexecute.py                   # runs SQL queries

{mycli-2.3.0/mycli.egg-info → mycli-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycli
-Version: 2.3.0
+Version: 2.4.0
 Summary: CLI for MySQL Database. With auto-completion and syntax highlighting.
 Author: Mycli Core Team
 License-Expression: BSD-3-Clause

{mycli-2.3.0 → mycli-2.4.0}/changelog.md

@@ -1,3 +1,24 @@
+2.4.0 (2026/07/18)
+==============
+
+Features
+---------
+* Make password sources and precedence configurable.
+* Ability to deselect fallback interactive password prompt.
+* Add `\e` prompt/toolbar format string for edit mode.
+
+
+Bug Fixes
+---------
+* Don't create `~/.myclirc` if the user adopted the XDG layout for myclirc.
+
+
+Internal
+---------
+* Make flaky `/watch` test even more lenient for CI.
+* Add missing file to `AGENTS.md` project layout.
+
+
 2.3.0 (2026/07/16)
 ==============
 

{mycli-2.3.0 → mycli-2.4.0}/mycli/TIPS

@@ -288,6 +288,8 @@ set editor_command = "code --wait" in ~/.myclirc to edit queries using VS Code!
 
 set up an interactive output explorer using the "[explorer]" section of ~/.myclirc!
 
+customize password sources/precedence with "password_sources" in ~/.myclirc!
+
 ###
 ### redirection
 ###

{mycli-2.3.0 → mycli-2.4.0}/mycli/cli_runner.py

@@ -15,6 +15,7 @@ from mycli.main_modes.checkup import main_checkup
 from mycli.main_modes.execute import main_execute_from_cli
 from mycli.main_modes.list_dsn import main_list_dsn
 from mycli.packages.cli_utils import is_valid_connection_scheme
+from mycli.password_sources import PasswordCandidates
 from mycli.vault import (
     DEFAULT_VAULT_EXECUTABLE,
     DEFAULT_VAULT_PASSWORD_FIELD,
@@ -165,10 +166,15 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
     database = cli_args.dbname or cli_args.database
 
     dsn_uri = None
+    dsn_password: str | None = None
 
     # Treat the database argument as a DSN alias only if it matches a configured alias
     # todo why is port tested but not socket?
-    truthy_password = cli_args.password not in (None, EMPTY_PASSWORD_FLAG_SENTINEL)
+    truthy_password = (
+        cli_args.password not in (None, EMPTY_PASSWORD_FLAG_SENTINEL)
+        or cli_args.password_file is not None
+        or os.environ.get('MYSQL_PWD') is not None
+    )
     if (
         database
         and "://" not in database
@@ -235,9 +241,6 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
             database = dsn_database
         if not cli_args.user and dsn_user is not None:
             cli_args.user = dsn_user
-        # todo: rationalize the behavior of empty-string passwords here
-        if not cli_args.password and dsn_password is not None:
-            cli_args.password = dsn_password
         if not cli_args.host:
             cli_args.host = dsn_host
         if not cli_args.port:
@@ -364,25 +367,40 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
         use_keyring = str_to_bool(cli_args.use_keyring)
         reset_keyring = False
 
-    if cli_args.password is None and cli_args.vault_secret:
+    password_candidates = PasswordCandidates()
+    if cli_args.password == EMPTY_PASSWORD_FLAG_SENTINEL:
+        password_candidates.add_value('prompt', cli_args.password)
+    elif cli_args.password is not None:
+        password_candidates.add_value('literal', cli_args.password)
+    if cli_args.password_file:
+        password_candidates.add_loader('file', lambda: main_module.get_password_from_file(cli_args.password_file))
+    if os.environ.get('MYSQL_PWD') is not None:
+        password_candidates.add_value('environment', os.environ.get('MYSQL_PWD'))
+    if dsn_password is not None:
+        password_candidates.add_value('dsn', dsn_password)
+
+    if cli_args.vault_secret:
+        vault_secret = cli_args.vault_secret
         vault_config = mycli.config.get('vault_beta', {})
         vault_address = cli_args.vault_address or os.environ.get('VAULT_ADDR') or vault_config.get('address') or None
         vault_mount = cli_args.vault_mount or vault_config.get('default_mount') or None
         vault_field = cli_args.vault_password_field or vault_config.get('default_password_field') or DEFAULT_VAULT_PASSWORD_FIELD
         vault_executable = vault_config.get('vault_executable') or DEFAULT_VAULT_EXECUTABLE
-        try:
-            vault_password: str | None = get_field_from_vault(
-                vault_field,
-                cli_args.vault_secret,
-                executable=vault_executable,
-                mount=vault_mount,
-                address=vault_address,
-            )
-        except VaultError as exc:
-            click.secho(f'Error reading password from Vault: {exc}', err=True, fg='red')
-            sys.exit(1)
-    else:
-        vault_password = None
+
+        def load_vault_password() -> str | None:
+            try:
+                return get_field_from_vault(
+                    vault_field,
+                    vault_secret,
+                    executable=vault_executable,
+                    mount=vault_mount,
+                    address=vault_address,
+                )
+            except VaultError as exc:
+                click.secho(f'Error reading password from Vault: {exc}', err=True, fg='red')
+                sys.exit(1)
+
+        password_candidates.add_loader('vault', load_vault_password)
 
     if cli_args.user is None and cli_args.vault_secret:
         vault_config = mycli.config.get('vault_beta', {})
@@ -409,7 +427,7 @@ def run_from_cli_args(cli_args: 'CliArgs', client_factory: ClientFactory) -> Non
         mycli.connect(
             database=database,
             user=vault_username if cli_args.user is None else cli_args.user,
-            passwd=vault_password if cli_args.password is None else cli_args.password,
+            password_candidates=password_candidates,
             host=cli_args.host,
             port=cli_args.port,
             socket=cli_args.socket,

{mycli-2.3.0 → mycli-2.4.0}/mycli/client.py

@@ -58,9 +58,9 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
 
     # check XDG_CONFIG_HOME exists and not an empty string
     xdg_config_home = os.environ.get("XDG_CONFIG_HOME", "~/.config")
+    xdg_config_file = os.path.join(os.path.expanduser(xdg_config_home), "mycli", "myclirc")
     system_config_files: list[str | IO[str]] = [
         "/etc/myclirc",
-        os.path.join(os.path.expanduser(xdg_config_home), "mycli", "myclirc"),
     ]
 
     def __init__(
@@ -72,7 +72,7 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
         login_path: str | None = None,
         auto_vertical_output: bool = False,
         warn: bool | None = None,
-        myclirc: str = "~/.myclirc",
+        myclirc: str | None = None,
         show_warnings: bool | None = None,
         cli_verbosity: int = 0,
     ) -> None:
@@ -87,6 +87,12 @@ class MyCli(AppStateMixin, OutputMixin, ClientCommandsMixin, ClientConnectionMix
         self.sandbox_mode: bool = False
         self.checkpoint: IO | None = None
 
+        if myclirc is None:
+            if os.path.exists(self.xdg_config_file):
+                myclirc = self.xdg_config_file
+            else:
+                myclirc = '~/.myclirc'
+
         # Load config.
         config_files: list[str | IO[str]] = self.system_config_files + [myclirc]
 

{mycli-2.3.0 → mycli-2.4.0}/mycli/client_connection.py

@@ -23,6 +23,7 @@ from mycli.constants import (
 )
 from mycli.packages.filepaths import guess_socket_location
 from mycli.packages.special.utils import format_connection_dsn
+from mycli.password_sources import PasswordCandidates
 from mycli.sqlexecute import SQLExecute
 from mycli.ssh_tunnel import SshTunnel, SshTunnelError
 
@@ -49,7 +50,7 @@ class ClientConnectionMixin:
         self,
         database: str | None = "",
         user: str | None = "",
-        passwd: str | int | None = None,
+        password_candidates: PasswordCandidates | None = None,
         host: str | None = "",
         port: str | int | None = "",
         socket: str | None = "",
@@ -86,6 +87,11 @@ class ClientConnectionMixin:
             if not host or host == DEFAULT_HOST:
                 socket = socket or user_connection_config.get("default_socket") or mylogin_cnf["socket"] or guess_socket_location()
 
+        if self.config.get('main', {}).get('password_sources'):
+            password_source_precedence = self.config.get('main').as_list('password_sources')
+        else:
+            password_source_precedence = ['prompt']
+
         if ssh_jump:
             remote_host = host or DEFAULT_HOST
             remote_port = int_port or DEFAULT_PORT
@@ -114,7 +120,8 @@ class ClientConnectionMixin:
                     pass
                 sys.exit(1)
 
-        passwd = passwd if isinstance(passwd, (str, int)) else mylogin_cnf["password"]
+        if password_candidates is None:
+            password_candidates = PasswordCandidates()
 
         if not character_set:
             if 'main' in self.config_without_package_defaults and 'default_character_set' in self.config_without_package_defaults['main']:
@@ -167,15 +174,6 @@ class ClientConnectionMixin:
         if not any(v for v in ssl_config.values()):
             ssl_config = {}
 
-        # password hierarchy
-        # 1. -p / --pass/--password CLI options
-        # 2. --password-file CLI option
-        # 3. envvar (MYSQL_PWD)
-        # 4. DSN (mysql://user:password)
-        # 5. Vault
-        # 6. .mylogin.cnf
-        # 7. keyring
-
         ssh_tunnel_field = urlquote(ssh_jump or '')
         if ssh_tunnel_field:
             ssh_tunnel_field = ':' + ssh_tunnel_field
@@ -183,15 +181,17 @@ class ClientConnectionMixin:
         keyring_domain = 'mycli.net'
         keyring_retrieved_cleanly = False
 
-        if passwd is None and use_keyring and not reset_keyring:
-            passwd = keyring.get_password(keyring_domain, keyring_identifier)
-            if passwd is not None:
-                keyring_retrieved_cleanly = True
+        password_candidates.add_value('login_path', mylogin_cnf['password'])
+        if use_keyring and not reset_keyring:
+            password_candidates.add_loader('keyring', lambda: keyring.get_password(keyring_domain, keyring_identifier))
+
+        selected_password = password_candidates.resolve(password_source_precedence)
+        passwd = selected_password.value if selected_password is not None else None
+        keyring_retrieved_cleanly = selected_password is not None and selected_password.source == 'keyring'
 
         # prompt for password if requested by user
         if passwd == EMPTY_PASSWORD_FLAG_SENTINEL:
             passwd = click.prompt(f"Enter password for {user}", hide_input=True, show_default=False, default='', type=str, err=True)
-            keyring_retrieved_cleanly = False
 
         # should not fail, but will help the typechecker
         assert not isinstance(passwd, int)
@@ -285,15 +285,18 @@ class ClientConnectionMixin:
                     _connect(
                         retry_ssl=True, keyring_retrieved_cleanly=keyring_retrieved_cleanly, keyring_save_eligible=keyring_save_eligible
                     )
-                elif e1.args[0] == ACCESS_DENIED_ERROR and connection_info["password"] is None:
+                elif e1.args[0] == ACCESS_DENIED_ERROR and connection_info["password"] is None and 'fallback' in password_source_precedence:
                     # if we already tried and failed to connect with a new password, raise the error
                     if retry_password:
                         raise e1
-                    # ask the user for a new password and try to connect again
-                    new_password = click.prompt(
-                        f"Enter password for {user}", hide_input=True, show_default=False, default='', type=str, err=True
+                    password_candidates.add_loader(
+                        'fallback',
+                        lambda: click.prompt(
+                            f"Enter password for {user}", hide_input=True, show_default=False, default='', type=str, err=True
+                        ),
                     )
-                    connection_info["password"] = new_password
+                    fallback_password = password_candidates.resolve(['fallback'])
+                    connection_info["password"] = fallback_password.value if fallback_password is not None else None
                     keyring_retrieved_cleanly = False
                     _connect(
                         retry_password=True,

{mycli-2.3.0 → mycli-2.4.0}/mycli/clitoolbar.py

@@ -8,6 +8,17 @@ from prompt_toolkit.key_binding.vi_state import InputMode
 from mycli.packages import special
 
 
+def get_vi_mode() -> str:
+    """Get the current vi mode for display."""
+    return {
+        InputMode.INSERT: "I",
+        InputMode.NAVIGATION: "N",
+        InputMode.REPLACE: "R",
+        InputMode.REPLACE_SINGLE: "R",
+        InputMode.INSERT_MULTIPLE: "M",
+    }[get_app().vi_state.input_mode]
+
+
 def create_toolbar_tokens_func(
     mycli,
     show_initial_toolbar_help: Callable[[], bool],
@@ -45,8 +56,8 @@ def create_toolbar_tokens_func(
 
         if mycli.prompt_session.editing_mode == EditingMode.VI:
             result.append(divider)
-            result.append(("class:bottom-toolbar", "Vi:"))
-            result.append(("class:bottom-toolbar.on", _get_vi_mode()))
+            result.append(("class:bottom-toolbar", "vi:"))
+            result.append(("class:bottom-toolbar.on", get_vi_mode()))
 
         if mycli.toolbar_error_message:
             dynamic.append(divider)
@@ -92,14 +103,3 @@ def create_toolbar_tokens_func(
         return result
 
     return get_toolbar_tokens
-
-
-def _get_vi_mode() -> str:
-    """Get the current vi mode for display."""
-    return {
-        InputMode.INSERT: "I",
-        InputMode.NAVIGATION: "N",
-        InputMode.REPLACE: "R",
-        InputMode.REPLACE_SINGLE: "R",
-        InputMode.INSERT_MULTIPLE: "M",
-    }[get_app().vi_state.input_mode]

{mycli-2.3.0 → mycli-2.4.0}/mycli/main.py

@@ -195,7 +195,6 @@ class CliArgs:
     )
     myclirc: str = clickdc.option(
         type=click.Path(),
-        default='~/.myclirc',
         help='Location of myclirc file.',
     )
     auto_vertical_output: bool = clickdc.option(
@@ -391,14 +390,6 @@ def preprocess_cli_args(
         cli_args.database = cli_args.password
         cli_args.password = EMPTY_PASSWORD_FLAG_SENTINEL
 
-    if cli_args.password is None and cli_args.password_file:
-        password_from_file = get_password_from_file(cli_args.password_file)
-        if password_from_file is not None:
-            cli_args.password = password_from_file
-
-    if cli_args.password is None and os.environ.get('MYSQL_PWD') is not None:
-        cli_args.password = os.environ.get('MYSQL_PWD')
-
     if cli_args.resume and not cli_args.checkpoint:
         click.secho('Error: --resume requires a --checkpoint file.', err=True, fg='red')
         sys.exit(1)

{mycli-2.3.0 → mycli-2.4.0}/mycli/main_modes/repl.py

@@ -42,7 +42,7 @@ from pymysql.cursors import Cursor
 import mycli as mycli_package
 from mycli.clibuffer import cli_is_multiline
 from mycli.clistyle import style_factory_ptoolkit
-from mycli.clitoolbar import create_toolbar_tokens_func
+from mycli.clitoolbar import create_toolbar_tokens_func, get_vi_mode
 from mycli.compat import WIN
 from mycli.constants import (
     DEFAULT_HOST,
@@ -321,6 +321,14 @@ def render_prompt_string(
     strings = [x.replace('\\_', ' ') for x in strings]
 
     checker_string = ' '.join(strings)
+    if r'\e' in checker_string:
+        if mycli.prompt_session:
+            edit_mode = mycli.prompt_session.editing_mode.value.lower()
+            if edit_mode == 'vi':
+                edit_mode += ':' + get_vi_mode()
+        else:
+            edit_mode = mycli.key_bindings.lower()
+        strings = [x.replace(r'\e', maybe_html_escape(edit_mode, is_html)) for x in strings]
     if hasattr(sqlexecute, 'conn') and sqlexecute.conn is not None:
         if '\\y' in checker_string:
             with sqlexecute.conn.cursor() as cur:

{mycli-2.3.0 → mycli-2.4.0}/mycli/myclirc

@@ -122,6 +122,7 @@ wider_completion_menu = False
 # * \s - seconds of the current time
 # * \P - AM/PM
 # * \d - selected database/schema
+# * \e - current edit mode (emacs or vi)
 # * \h - hostname of the server
 # * \H - shortened hostname of the server
 # * \p - connection port
@@ -205,6 +206,21 @@ enable_pager = True
 # Choose a specific pager
 pager = 'less'
 
+# Comma-separated sources to respect for a password, in order of precedence.
+# Valid choices:
+# * prompt         # plain trailing --password at the CLI
+# * literal        # --password=<literal> at the CLI
+# * file           # --password-file=<file> at the CLI
+# * environment    # $MYSQL_PWD environment variable
+# * dsn            # mysql://user:password@ field in a DSN
+# * boundary       # value provided by Boundary client (not yet implemented)
+# * vault          # value retrieved from "vault kv get"
+# * login_path     # --login-path=<path> at the CLI
+# * keyring        # value retrieved from system keyring
+# * fallback       # interactive prompt after a passwordless connection fails
+# If "fallback" is given, it must come last.
+password_sources = prompt, literal, file, environment, dsn, boundary, vault, login_path, keyring, fallback
+
 # Whether to store and retrieve passwords from the system keyring.
 # * False - never use keyring
 # * True - always use keyring

mycli-2.4.0/mycli/password_sources.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Literal
+
+import click
+
+PasswordSource = Literal[
+    'prompt',
+    'literal',
+    'file',
+    'environment',
+    'dsn',
+    'boundary',
+    'vault',
+    'login_path',
+    'keyring',
+    'fallback',
+]
+PasswordValue = str | int
+PasswordLoader = Callable[[], PasswordValue | None]
+
+KNOWN_PASSWORD_SOURCES: list[PasswordSource] = [
+    'prompt',
+    'literal',
+    'file',
+    'environment',
+    'dsn',
+    'boundary',
+    'vault',
+    'login_path',
+    'keyring',
+    'fallback',
+]
+
+
+@dataclass(frozen=True, slots=True)
+class SelectedPassword:
+    source: PasswordSource
+    value: PasswordValue
+
+
+@dataclass(frozen=True, slots=True)
+class PasswordCandidate:
+    source: PasswordSource
+    value: PasswordValue | None = None
+    loader: PasswordLoader | None = None
+
+    def resolve(self) -> SelectedPassword | None:
+        value = self.loader() if self.loader is not None else self.value
+        if value is None:
+            return None
+        return SelectedPassword(source=self.source, value=value)
+
+
+class PasswordCandidates:
+    def __init__(self) -> None:
+        self._candidates: dict[PasswordSource, PasswordCandidate] = {}
+
+    def add_value(self, source: PasswordSource, value: PasswordValue | None) -> None:
+        self._candidates[source] = PasswordCandidate(source=source, value=value)
+
+    def add_loader(self, source: PasswordSource, loader: PasswordLoader) -> None:
+        self._candidates[source] = PasswordCandidate(source=source, loader=loader)
+
+    def resolve(self, password_source_precedence) -> SelectedPassword | None:
+        for source in password_source_precedence:
+            if source not in KNOWN_PASSWORD_SOURCES:
+                click.secho(f'Skipping unknown password source: {source}.', err=True, fg='red')
+                continue
+            candidate = self._candidates.get(source)
+            if candidate is None:
+                continue
+            if selected := candidate.resolve():
+                return selected
+        return None

{mycli-2.3.0 → mycli-2.4.0/mycli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycli
-Version: 2.3.0
+Version: 2.4.0
 Summary: CLI for MySQL Database. With auto-completion and syntax highlighting.
 Author: Mycli Core Team
 License-Expression: BSD-3-Clause

{mycli-2.3.0 → mycli-2.4.0}/mycli.egg-info/SOURCES.txt

@@ -43,6 +43,7 @@ mycli/lexer.py
 mycli/main.py
 mycli/myclirc
 mycli/output.py
+mycli/password_sources.py
 mycli/schema_prefetcher.py
 mycli/sqlcompleter.py
 mycli/sqlexecute.py
@@ -150,6 +151,7 @@ test/pytests/test_main_modes_list_dsn.py
 test/pytests/test_main_modes_repl.py
 test/pytests/test_naive_completion.py
 test/pytests/test_output.py
+test/pytests/test_password_sources.py
 test/pytests/test_ptoolkit_fzf.py
 test/pytests/test_ptoolkit_history.py
 test/pytests/test_ptoolkit_utils.py

{mycli-2.3.0 → mycli-2.4.0}/mycli.egg-info/scm_file_list.json

@@ -60,6 +60,7 @@
     "test/pytests/test_key_binding_utils.py",
     "test/pytests/test_clitoolbar.py",
     "test/pytests/conftest.py",
+    "test/pytests/test_password_sources.py",
     "test/pytests/test_special_main.py",
     "test/pytests/test_main_modes_repl.py",
     "test/pytests/test_schema_prefetcher.py",
@@ -114,6 +115,7 @@
     "mycli/clibuffer.py",
     "mycli/client_query.py",
     "mycli/sqlcompleter.py",
+    "mycli/password_sources.py",
     "mycli/types.py",
     "mycli/constants.py",
     "mycli/config.py",

mycli-2.4.0/mycli.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.4.0",
+  "distance": 0,
+  "node": "gc11245d74ff60a8e61f84b8d2eb6fbf773cb7ee3",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-07-18"
+}

{mycli-2.3.0 → mycli-2.4.0}/test/myclirc

@@ -122,6 +122,7 @@ wider_completion_menu = False
 # * \s - seconds of the current time
 # * \P - AM/PM
 # * \d - selected database/schema
+# * \e - current edit mode (emacs or vi)
 # * \h - hostname of the server
 # * \H - shortened hostname of the server
 # * \p - connection port
@@ -205,6 +206,21 @@ enable_pager = True
 # Choose a specific pager
 pager = python test/features/wrappager.py ---boundary---
 
+# Comma-separated sources to respect for a password, in order of precedence.
+# Valid choices:
+# * prompt         # plain trailing --password at the CLI
+# * literal        # --password=<literal> at the CLI
+# * file           # --password-file=<file> at the CLI
+# * environment    # $MYSQL_PWD environment variable
+# * dsn            # mysql://user:password@ field in a DSN
+# * boundary       # value provided by Boundary client (not yet implemented)
+# * vault          # value retrieved from "vault kv get"
+# * login_path     # --login-path=<path> at the CLI
+# * keyring        # value retrieved from system keyring
+# * fallback       # interactive prompt after a passwordless connection fails
+# If "fallback" is given, it must come last.
+password_sources = prompt, literal, file, environment, dsn, boundary, vault, login_path, keyring, fallback
+
 # Whether to store and retrieve passwords from the system keyring.
 # * False - never use keyring
 # * True - always use keyring