pgcli 4.6.0__tar.gz → 4.7.0__tar.gz

{pgcli-4.6.0 → pgcli-4.7.0}/.github/workflows/publish.yml

@@ -65,7 +65,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
-        python-version: '3.13'
+        python-version: '3.14'
 
     - name: Install dependencies
       run: uv sync --all-extras -p 3.14

{pgcli-4.6.0 → pgcli-4.7.0}/AUTHORS

@@ -145,6 +145,7 @@ Contributors:
     * fbdb
     * Charbel Jacquin (charbeljc)
     * Jeronimo Garcia (bechampion)
+    * Diego
     * Devadathan M B (devadathanmb)
     * Charalampos Stratakis
     * Laszlo Bimba (bimlas)
@@ -154,6 +155,7 @@ Contributors:
     * Diego
     * Chris (ChrisJr404)
     * Pieter Ouwerkerk (pouwerkerk)
+    * VXNCXNX
 
 Creator:
 --------

{pgcli-4.6.0 → pgcli-4.7.0}/PKG-INFO

@@ -1,10 +1,13 @@
 Metadata-Version: 2.4
 Name: pgcli
-Version: 4.6.0
+Version: 4.7.0
 Summary: CLI for Postgres Database. With auto-completion and syntax highlighting.
 Author-email: Pgcli Core Team <pgcli-dev@googlegroups.com>
 License-Expression: BSD-3-Clause
 Project-URL: Homepage, https://pgcli.com
+Project-URL: Changelog, https://github.com/dbcli/pgcli/blob/main/changelog.rst
+Project-URL: Repository, https://github.com/dbcli/pgcli/
+Project-URL: Issues, https://github.com/dbcli/pgcli/issues
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: Unix
 Classifier: Programming Language :: Python
@@ -405,7 +408,7 @@ which is quite literally the backbone library, that made this app possible.
 Jonathan has also provided valuable feedback and support during the development
 of this app.
 
-`Click <https://click.pocoo.org/>`_ is used for command line option parsing
+`Click <https://click.palletsprojects.com/>`_ is used for command line option parsing
 and printing error messages.
 
 Thanks to `psycopg <https://www.psycopg.org/>`_ for providing a rock solid

{pgcli-4.6.0 → pgcli-4.7.0}/README.rst

@@ -352,7 +352,7 @@ which is quite literally the backbone library, that made this app possible.
 Jonathan has also provided valuable feedback and support during the development
 of this app.
 
-`Click <https://click.pocoo.org/>`_ is used for command line option parsing
+`Click <https://click.palletsprojects.com/>`_ is used for command line option parsing
 and printing error messages.
 
 Thanks to `psycopg <https://www.psycopg.org/>`_ for providing a rock solid

{pgcli-4.6.0 → pgcli-4.7.0}/changelog.rst

@@ -1,8 +1,70 @@
+Upcoming
+========
+
+
+
+4.7.0 (2026-09-19)
+==================
+
+Features:
+---------
+* Add support for `single-command` to run a SQL command and exit.
+    * Command line option `-c` or `--command`.
+    * You can specify multiple times.
+    * Runs one statement at a time, like `-f`, and can be combined with `-f`:
+      both run, the same way psql does.
+* Add support for forcing destructive commands without confirmation.
+    * Command line option `-y` or `--yes`.
+    * Skips the destructive command confirmation prompt when enabled.
+    * Useful for automated scripts and CI/CD pipelines.
+* Add a ``-t``/``--tuples-only`` command line option that prints the rows and
+  nothing else, matching psql: no column headers, no title, no status footer
+  and no timing line. The configured table format is left untouched, so ``\T``
+  still reports it and can still change it mid-session.
+* Add support for executing SQL commands from file and exit.
+    * Command line option `-f` or `--file`.
+    * Multiple files can be specified.
+    * Files run one statement at a time, like psql, so a ``\watch`` only
+      repeats its own statement (and a bare ``\watch`` re-runs the statement
+      before it), instead of re-running the whole file. A backslash command
+      spans only its own line, also like psql, so a metacommand followed by
+      SQL on the next line does not swallow the SQL.
+
+Bug fixes:
+----------
+* Fix special commands being broken while explain mode (F5) is on. Every input
+  was prefixed with ``EXPLAIN (...)`` and sent to the server as SQL, including
+  backslash commands and the bare words ``exit``/``quit``, so ``\q``, ``\d``,
+  ``\i``, named queries and ``\G`` all failed with ``syntax error at or near
+  "\"`` and there was no way to leave explain mode or quit. Special commands
+  are now detected first and the EXPLAIN prefix is applied only to real SQL.
+* Fix ``-l``/``--list`` and ``--ping`` discarding the connection string. The
+  positional argument was unconditionally replaced with ``postgres``, which
+  also threw away a connection URI or ``key=value`` conninfo (host, user, port,
+  ``sslmode``, everything) and silently fell back to a local socket connection
+  as the OS user. The database argument is now kept, like psql; only when no
+  database is given at all does the listing connect to ``postgres``.
+
 4.6.0 (2026-08-26)
 ==================
 
+Internal:
+---------
+* Make the external-editor behave scenario less flaky: the ``expect_exact``
+  timeouts in ``tests/features/steps/iocommands.py`` were as low as 1-2
+  seconds, which intermittently expired on loaded CI runners and reported
+  ``Scenario: edit sql in file with external editor`` as an error. Raised to 10
+  seconds; passing runs are unaffected because pexpect returns as soon as the
+  expected text appears.
+
 Bug fixes:
 ----------
+* Fix ``--list-dsn`` and ``-D``/``--dsn`` not finding ``[alias_dsn]`` entries.
+  On a fresh install (no config written yet) ``--list-dsn`` printed a misleading
+  "Invalid DSNs found" error. ``--list-dsn`` now treats a missing config or
+  ``[alias_dsn]`` section as simply nothing to list, without writing a config
+  file, and ``-D`` resolves the alias from the config already loaded at startup
+  instead of reading it again ([issue 1489](https://github.com/dbcli/pgcli/issues/1489)).
 * Restore cursor shape behaviour for Emacs mode
 * Fix ``TypeError: cannot use a string pattern on a bytes-like object`` when
   completion metadata comes back as bytes (e.g. ``SQL_ASCII`` client encoding).
@@ -11,9 +73,17 @@ Bug fixes:
   issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping
   bug (CVE-2026-59894); the previous ``<0.6`` cap prevented users from
   installing the fixed release.
+* Detect an unconditional ``UPDATE`` with ``sqlparse`` rather than splitting on whitespace, so a
+  ``WHERE`` appearing inside a string literal no longer suppresses the destructive-statement warning.
 
 Features:
 ---------
+* Add a ``--timeout`` command line option and a ``connect_timeout`` config value
+  (default 30 seconds) for the connection timeout. Precedence, highest first:
+  ``--timeout``, then a ``connect_timeout`` in the connection string, then
+  ``$PGCONNECT_TIMEOUT``, then the config value. libpq's own default is 0,
+  which waits until the operating system gives up on the TCP connection, so an
+  unreachable host used to hang for minutes.
 * Honor the ``PSQL_EDITOR`` environment variable when opening the external
   editor (``\\e``, ``\\ev``, ``\\ef``, ``\\ne``), matching psql's precedence of
   ``PSQL_EDITOR``, then ``EDITOR``, then ``VISUAL`` ([issue 1398](https://github.com/dbcli/pgcli/issues/1398)).

{pgcli-4.6.0 → pgcli-4.7.0}/pgcli/main.py

@@ -119,7 +119,8 @@ MetaQuery.__new__.__defaults__ = ("", False, 0, 0, False, False, False, False)
 
 OutputSettings = namedtuple(
     "OutputSettings",
-    "table_format dcmlfmt floatfmt column_date_formats missingval expanded max_width case_function style_output max_field_width",
+    "table_format dcmlfmt floatfmt column_date_formats missingval expanded max_width case_function style_output "
+    "max_field_width tuples_only",
 )
 OutputSettings.__new__.__defaults__ = (
     None,
@@ -132,6 +133,7 @@ OutputSettings.__new__.__defaults__ = (
     lambda x: x,
     None,
     DEFAULT_MAX_FIELD_WIDTH,
+    False,
 )
 
 
@@ -157,6 +159,35 @@ def get_editor():
     return os.environ.get("PSQL_EDITOR") or os.environ.get("EDITOR") or os.environ.get("VISUAL") or None
 
 
+def get_connect_timeout(explicit, dsn, kwargs, default):
+    """Pick the connection timeout to apply, in seconds.
+
+    Precedence, highest first:
+
+    1. ``explicit``, i.e. ``--timeout`` on the command line
+    2. ``connect_timeout`` in the connection string, or in ``kwargs``
+    3. ``$PGCONNECT_TIMEOUT``
+    4. ``default``, the ``connect_timeout`` config value
+
+    Returns ``None`` when the user already stated a timeout by one of the
+    means we must not override, in which case the caller leaves the
+    connection parameters alone and libpq reads it from where it already is.
+
+    A default matters because libpq's own is 0, which waits until the
+    operating system gives up on the TCP connection, so an unreachable host
+    hangs for minutes.
+    """
+    if explicit is not None:
+        return explicit
+    if "connect_timeout" in kwargs:
+        return None
+    if dsn and "connect_timeout" in conninfo_to_dict(dsn):
+        return None
+    if os.environ.get("PGCONNECT_TIMEOUT"):
+        return None
+    return default
+
+
 class PGCli:
     default_prompt = "\\u@\\h:\\d> "
     max_len_prompt = 30
@@ -192,18 +223,22 @@ class PGCli:
         application_name="pgcli",
         single_connection=False,
         less_chatty=None,
+        tuples_only=None,
         prompt=None,
         prompt_dsn=None,
         auto_vertical_output=False,
         warn=None,
         ssh_tunnel_url: str | None = None,
+        connect_timeout: int | None = None,
         log_file: str | None = None,
+        force_destructive: bool = False,
     ):
         self.force_passwd_prompt = force_passwd_prompt
         self.never_passwd_prompt = never_passwd_prompt
         self.pgexecute = pgexecute
         self.dsn_alias = None
         self.watch_command = None
+        self.force_destructive = force_destructive
 
         # Load config.
         c = self.config = get_config(pgclirc_file)
@@ -250,6 +285,13 @@ class PGCli:
         self.min_num_menu_lines = c["main"].as_int("min_num_menu_lines")
         self.multiline_continuation_char = c["main"]["multiline_continuation_char"]
         self.table_format = c["main"]["table_format"]
+        # psql's -t prints the rows and nothing else: no column headers, no
+        # title, no status footer and no timing line. The table format is left
+        # alone here and switched to an unadorned one at output time, so \T
+        # still reports (and can change) the configured format.
+        self.tuples_only = bool(tuples_only)
+        if self.tuples_only:
+            self.pgspecial.timing_enabled = False
         self.syntax_style = c["main"]["syntax_style"]
         self.cli_style = c["colors"]
         self.wider_completion_menu = c["main"].as_bool("wider_completion_menu")
@@ -263,6 +305,9 @@ class PGCli:
         self.prompt_format = prompt if prompt is not None else c["main"].get("prompt", self.default_prompt)
         self.prompt_dsn_format = prompt_dsn
         self.on_error = c["main"]["on_error"].upper()
+        # Connection timeout, in seconds. See connect() for the precedence.
+        self.connect_timeout = connect_timeout
+        self.default_connect_timeout = c["main"].as_int("connect_timeout")
         self.decimal_format = c["data_formats"]["decimal"]
         self.float_format = c["data_formats"]["float"]
         self.column_date_formats = c["column_date_formats"]
@@ -553,7 +598,7 @@ class PGCli:
             ):
                 message = "Destructive statements must be run within a transaction. Command execution stopped."
                 return [(None, None, None, message)]
-            destroy = confirm_destructive_query(query, self.destructive_warning, self.dsn_alias)
+            destroy = confirm_destructive_query(query, self.destructive_warning, self.dsn_alias, self.force_destructive)
             if destroy is False:
                 message = "Wise choice. Command execution stopped."
                 return [(None, None, None, message)]
@@ -676,6 +721,12 @@ class PGCli:
 
         kwargs.setdefault("application_name", self.application_name)
 
+        # The resolved value is passed as a connection parameter rather than
+        # merged into the dsn, leaving the user's connection string untouched.
+        timeout = get_connect_timeout(self.connect_timeout, dsn, kwargs, self.default_connect_timeout)
+        if timeout is not None:
+            kwargs["connect_timeout"] = str(timeout)
+
         # If password prompt is not forced but no password is provided, try
         # getting it from environment variable.
         if not self.force_passwd_prompt and not passwd:
@@ -871,11 +922,11 @@ class PGCli:
                 ):
                     click.secho("Destructive statements must be run within a transaction.")
                     raise KeyboardInterrupt
-                destroy = confirm_destructive_query(text, self.destructive_warning, self.dsn_alias)
+                destroy = confirm_destructive_query(text, self.destructive_warning, self.dsn_alias, self.force_destructive)
                 if destroy is False:
                     click.secho("Wise choice!")
                     raise KeyboardInterrupt
-                elif destroy:
+                elif destroy and not self.force_destructive:
                     click.secho("Your call!")
 
             output, query = self._evaluate_command(text)
@@ -1006,6 +1057,56 @@ class PGCli:
     def run_cli(self):
         logger = self.logger
 
+        # Handle command mode (-c flag) - similar to psql behavior
+        # Multiple -c options are executed sequentially
+        if hasattr(self, 'commands') and self.commands:
+            try:
+                for command in self.commands:
+                    logger.debug("Running command: %s", command)
+                    # Statement by statement, like psql -c: \watch only repeats
+                    # its own statement, not the whole -c block.
+                    if not self._execute_statements(command):
+                        break
+            except PgCliQuitError:
+                # Normal exit from quit command
+                sys.exit(0)
+            except Exception as e:
+                logger.error("Error executing command: %s", e)
+                logger.error("traceback: %r", traceback.format_exc())
+                click.secho(str(e), err=True, fg="red")
+                sys.exit(1)
+            # psql runs both -c and -f when they are given together, so only
+            # exit here when there is no file left to run.
+            if not (hasattr(self, 'input_files') and self.input_files):
+                sys.exit(0)
+
+        # Handle file mode (-f flag) - similar to psql behavior
+        # Multiple -f options are executed sequentially
+        if hasattr(self, 'input_files') and self.input_files:
+            try:
+                for input_file in self.input_files:
+                    logger.debug("Reading commands from file: %s", input_file)
+                    with open(input_file, 'r', encoding='utf-8') as f:
+                        file_content = f.read()
+
+                    if file_content.strip():
+                        logger.debug("Executing commands from file: %s", input_file)
+                        # Statement by statement, like psql -f: \watch only
+                        # repeats its own statement, not the whole file.
+                        if not self._execute_statements(file_content):
+                            break
+
+            except PgCliQuitError:
+                # Normal exit from quit command
+                sys.exit(0)
+            except Exception as e:
+                logger.error("Error executing command: %s", e)
+                logger.error("traceback: %r", traceback.format_exc())
+                click.secho(str(e), err=True, fg="red")
+                sys.exit(1)
+            # Exit successfully after executing all commands
+            sys.exit(0)
+
         history_file = self.config["main"]["history_file"]
         if history_file == "default":
             history_file = config_location() + "history"
@@ -1082,6 +1183,43 @@ class PGCli:
             query = self.execute_command(text)
 
         self.query_history.append(query)
+        return query
+
+    def _execute_statements(self, text):
+        r"""Run a block of SQL the way psql -f does: one statement at a time.
+
+        get_watch_command()'s regex captures ALL the text before a \watch, so
+        feeding a whole file to handle_watch_command would make \watch repeat
+        every statement in it. Splitting first keeps \watch scoped to its own
+        statement, and a bare \watch picks up the previous statement through
+        query_history, exactly like psql.
+
+        A backslash command spans only its own line, like in psql, so a
+        metacommand followed by SQL on the next line does not swallow the
+        SQL (sqlparse only cuts at semicolons).
+
+        Honors on_error: with STOP, the first failed statement stops the run.
+        Returns True when every statement succeeded.
+        """
+        ok = True
+        statements = sqlparse.split(text)
+        while statements:
+            statement = statements.pop(0)
+            stripped = statement.strip()
+            if not stripped:
+                continue
+            if stripped.startswith("\\") and "\n" in stripped:
+                # psql's rule: a backslash command ends at its newline. Put
+                # the rest back through the splitter.
+                first_line, rest = stripped.split("\n", 1)
+                statements = sqlparse.split(rest) + statements
+                statement = first_line
+            query = self.handle_watch_command(statement)
+            if query is not None and not query.successful:
+                ok = False
+                if self.on_error != "RESUME":
+                    break
+        return ok
 
     def _build_cli(self, history):
         key_bindings = pgcli_bindings(self)
@@ -1231,6 +1369,7 @@ class PGCli:
                 case_function=(self.completer.case if self.settings["case_column_headers"] else lambda x: x),
                 style_output=self.style_output,
                 max_field_width=self.max_field_width,
+                tuples_only=self.tuples_only,
             )
 
             # Hide query text for named queries in quiet mode
@@ -1387,7 +1526,13 @@ class PGCli:
         return len(lines) >= (self.prompt_app.output.get_size().rows - 4)
 
     def echo_via_pager(self, text, color=None):
-        if self.pgspecial.pager_config == PAGER_OFF or self.watch_command:
+        # Disable pager for -c/--command and -f/--file modes and \watch command
+        if (
+            self.pgspecial.pager_config == PAGER_OFF
+            or self.watch_command
+            or (hasattr(self, 'commands') and self.commands)
+            or (hasattr(self, 'input_files') and self.input_files)
+        ):
             click.echo(text, color=color)
         elif self.pgspecial.pager_config == PAGER_LONG_OUTPUT and self.table_format != "csv":
             lines = text.split("\n")
@@ -1425,6 +1570,13 @@ class PGCli:
     help="Username to connect to the postgres database.",
 )
 @click.option("-u", "--user", "username_opt", help="Username to connect to the postgres database.")
+@click.option(
+    "--timeout",
+    "connect_timeout",
+    type=click.INT,
+    default=None,
+    help="Seconds to wait for a connection before giving up (0 waits forever). Overrides the connection string and $PGCONNECT_TIMEOUT.",
+)
 @click.option(
     "-W",
     "--password",
@@ -1490,6 +1642,14 @@ class PGCli:
     default=False,
     help="Skip intro on startup and goodbye on exit.",
 )
+@click.option(
+    "-t",
+    "--tuples-only",
+    "tuples_only",
+    is_flag=True,
+    default=False,
+    help="Print rows only: no column headers, no status footer and no timing, like psql.",
+)
 @click.option("--prompt", help='Prompt format (Default: "\\u@\\h:\\d> ").')
 @click.option(
     "--prompt-dsn",
@@ -1535,6 +1695,29 @@ class PGCli:
     type=str,
     help="SQL statement to execute after connecting.",
 )
+@click.option(
+    "-c",
+    "--command",
+    "commands",
+    multiple=True,
+    help="run command (SQL or internal) and exit. Multiple -c options are allowed.",
+)
+@click.option(
+    "-y",
+    "--yes",
+    "force_destructive",
+    is_flag=True,
+    default=False,
+    help="Force destructive commands without confirmation prompt.",
+)
+@click.option(
+    "-f",
+    "--file",
+    "input_files",
+    multiple=True,
+    type=click.Path(exists=True, readable=True, dir_okay=False),
+    help="execute commands from file, then exit. Multiple -f options are allowed.",
+)
 @click.argument("dbname", default=lambda: None, envvar="PGDATABASE", nargs=1)
 @click.argument("username", default=lambda: None, envvar="PGUSER", nargs=1)
 def cli(
@@ -1553,6 +1736,7 @@ def cli(
     row_limit,
     application_name,
     less_chatty,
+    tuples_only,
     prompt,
     prompt_dsn,
     list_databases,
@@ -1563,6 +1747,10 @@ def cli(
     ssh_tunnel: str,
     init_command: str,
     log_file: str,
+    commands: tuple,
+    force_destructive: bool,
+    input_files: tuple,
+    connect_timeout: int | None,
 ):
     if version:
         print("Version:", __version__)
@@ -1585,9 +1773,14 @@ def cli(
                 config_full_path,
             )
     if list_dsn:
+        config_file = get_config_filename(pgclirc)
+        if not os.path.exists(config_file):
+            # Nothing is configured yet, so there is nothing to list. Don't write
+            # out the default config just to read it back for a read-only command.
+            sys.exit(0)
         try:
-            cfg = load_config(pgclirc, config_full_path)
-            for alias in cfg["alias_dsn"]:
+            cfg = load_config(config_file)
+            for alias in cfg.get("alias_dsn", {}):
                 click.secho(alias + " : " + cfg["alias_dsn"][alias])
             sys.exit(0)
         except Exception:
@@ -1615,14 +1808,22 @@ def cli(
         application_name=application_name,
         single_connection=single_connection,
         less_chatty=less_chatty,
+        tuples_only=tuples_only,
         prompt=prompt,
         prompt_dsn=prompt_dsn,
         auto_vertical_output=auto_vertical_output,
         warn=warn,
         ssh_tunnel_url=ssh_tunnel,
         log_file=log_file,
+        force_destructive=force_destructive,
+        connect_timeout=connect_timeout,
     )
 
+    # Store commands for -c option (can be multiple)
+    pgcli.commands = commands if commands else None
+    # Store file paths for -f option (can be multiple)
+    pgcli.input_files = input_files if input_files else None
+
     # Choose which ever one has a valid value.
     if dbname_opt and dbname:
         # work as psql: when database is given as option and argument use the argument as user
@@ -1634,11 +1835,27 @@ def cli(
         service = database[8:]
     elif os.getenv("PGSERVICE") is not None:
         service = os.getenv("PGSERVICE")
-    # because option --ping, --list or -l are not supposed to have a db name
+    # because option --ping, --list or -l are not supposed to have a db name.
+    # A connection string is not a db name though: a URI or a key=value conninfo
+    # carries the whole connection (host, user, port, sslmode, ...), so replacing
+    # it with "postgres" would throw all of that away and fall back to a local
+    # socket connection as the OS user. Only a plain db name is discarded here;
+    # a connection string that names no database gets "postgres" for the
+    # listing, since libpq would otherwise default to the OS user name.
+    is_conn_string = "://" in database or ("=" in database and service is None)
     if list_databases or ping_database:
-        database = "postgres"
-
-    cfg = load_config(pgclirc, config_full_path)
+        if not database:
+            database = "postgres"
+        elif is_conn_string:
+            try:
+                if not conninfo_to_dict(database).get("dbname"):
+                    database = make_conninfo(database, dbname="postgres")
+            except Exception:
+                pass  # invalid conninfo: let the connection attempt report it
+
+    # PGCli() already loaded (and, if needed, wrote) the config above, so reuse it
+    # rather than reading the file a second time to resolve the -D alias.
+    cfg = pgcli.config
     if dsn != "":
         try:
             dsn_config = cfg["alias_dsn"][dsn]
@@ -1906,7 +2123,15 @@ def exception_formatter(e, verbose_errors: bool = False):
 def format_output(title, cur, headers, status, settings, explain_mode=False):
     output = []
     expanded = settings.expanded or settings.table_format == "vertical"
-    table_format = "vertical" if settings.expanded else settings.table_format
+    if settings.tuples_only:
+        # Rows and nothing else, so an unadorned format. This wins over
+        # expanded output: with the headers suppressed there is no label
+        # column left for the vertical formatter to lay out.
+        table_format = "plain"
+    elif settings.expanded:
+        table_format = "vertical"
+    else:
+        table_format = settings.table_format
     max_width = settings.max_width
     case_function = settings.case_function
     if explain_mode:
@@ -1964,11 +2189,12 @@ def format_output(title, cur, headers, status, settings, explain_mode=False):
         dialect = "excel" if platform.system() == "Windows" else "unix"
         output_kwargs["dialect"] = dialect
 
-    if title:  # Only print the title if it's not None.
+    # The title is printed unless there is none, or -t asked for rows only.
+    if title and not settings.tuples_only:
         output.append(title)
 
     if cur:
-        headers = [case_function(x) for x in headers]
+        headers = [] if settings.tuples_only else [case_function(x) for x in headers]
         if max_width is not None:
             cur = list(cur)
         column_types = None
@@ -2002,8 +2228,8 @@ def format_output(title, cur, headers, status, settings, explain_mode=False):
 
         output = itertools.chain(output, formatted)
 
-    # Only print the status if it's not None
-    if status:
+    # Likewise the status footer.
+    if status and not settings.tuples_only:
         output = itertools.chain(output, [format_status(cur, status)])
 
     return output

{pgcli-4.6.0 → pgcli-4.7.0}/pgcli/packages/parseutils/__init__.py

@@ -20,10 +20,25 @@ def query_starts_with(formatted_sql, prefixes):
     return bool(formatted_sql) and formatted_sql.split()[0] in prefixes
 
 
-def query_is_unconditional_update(formatted_sql):
-    """Check if the query starts with UPDATE and contains no WHERE."""
-    tokens = formatted_sql.split()
-    return bool(tokens) and tokens[0] == "update" and "where" not in tokens
+def query_is_unconditional_update(query):
+    """Check if the query starts with UPDATE and contains no top-level WHERE clause.
+
+    Uses sqlparse's parse tree (rather than naive whitespace splitting) so that
+    the word "where" appearing inside a string literal, comment, or a nested
+    subquery doesn't get mistaken for an actual WHERE clause.
+    """
+    statements = sqlparse.parse(query)
+    if not statements:
+        return False
+    statement = statements[0]
+
+    first_token = statement.token_first(skip_cm=True)
+    if first_token is None or first_token.ttype is not sqlparse.tokens.DML:
+        return False
+    if first_token.value.upper() != "UPDATE":
+        return False
+
+    return not any(isinstance(token, sqlparse.sql.Where) for token in statement.tokens)
 
 
 def is_destructive(queries, keywords):
@@ -31,7 +46,7 @@ def is_destructive(queries, keywords):
     for query in sqlparse.split(queries):
         if query:
             formatted_sql = sqlparse.format(query.lower(), strip_comments=True).strip()
-            if "unconditional_update" in keywords and query_is_unconditional_update(formatted_sql):
+            if "unconditional_update" in keywords and query_is_unconditional_update(query):
                 return True
             if query_starts_with(formatted_sql, keywords):
                 return True

{pgcli-4.6.0 → pgcli-4.7.0}/pgcli/packages/prompt_utils.py

@@ -3,22 +3,31 @@ import click
 from .parseutils import is_destructive
 
 
-def confirm_destructive_query(queries, keywords, alias):
+def confirm_destructive_query(queries, keywords, alias, force=False):
     """Check if the query is destructive and prompts the user to confirm.
 
     Returns:
     * None if the query is non-destructive or we can't prompt the user.
-    * True if the query is destructive and the user wants to proceed.
+    * True if the query is destructive and the user wants to proceed, or if the
+      confirmation was bypassed with `force`.
     * False if the query is destructive and the user doesn't want to proceed.
 
     """
+    if not is_destructive(queries, keywords):
+        return None
+
+    if force:
+        return True
+
+    if not sys.stdin.isatty():
+        return None
+
     info = "You're about to run a destructive command"
     if alias:
         info += f" in {click.style(alias, fg='red')}"
 
     prompt_text = f"{info}.\nDo you want to proceed?"
-    if is_destructive(queries, keywords) and sys.stdin.isatty():
-        return confirm(prompt_text)
+    return confirm(prompt_text)
 
 
 def confirm(*args, **kwargs):