sql-harness 0.3.2__tar.gz → 0.3.3__tar.gz

{sql_harness-0.3.2 → sql_harness-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sql-harness
-Version: 0.3.2
+Version: 0.3.3
 Summary: Single-process SQL + SSH CLI for LLM agents. PostgreSQL/MySQL/SSH via SQLAlchemy + paramiko. Plaintext credentials in one TOML file. Helpers auto-injected into the heredoc namespace.
 Project-URL: Source, https://github.com/zhaoliuxue/much_bigpy/tree/master/lab/sql_harness
 Project-URL: Issues, https://github.com/zhaoliuxue/much_bigpy/issues

{sql_harness-0.3.2 → sql_harness-0.3.3}/SKILL.md

@@ -48,7 +48,7 @@ PY
 
 ## Drivers & capabilities
 
-Five drivers, one heredoc namespace. URL scheme must match the backend: MySQL requires `mysql+pymysql://`; PostgreSQL accepts `postgres://` / `postgresql://` (normalized to `postgresql+psycopg://`); SSH accepts `ssh://`, `ssh+password://`, `ssh+key://`.
+Five drivers, one heredoc namespace. URL scheme must match the backend: MySQL requires `mysql+pymysql://`; PostgreSQL accepts `postgres://` / `postgresql://` (normalized to `postgresql+psycopg://`); SSH accepts `ssh://`, `ssh+password://`, `ssh+key://`. SSH password auth may come from the connection's standalone `password` key instead of the URL (precedence: URL > `password` > `$BH_SSH_PASSWORD`); a connection that sets a password uses password auth exclusively, ignoring local `~/.ssh` keys.
 
 ### Postgres (`postgres://`)
 
@@ -184,7 +184,7 @@ Reached via `apply_skill("pool")` etc. from any active zone — `zones/meta/skil
 ## Gotchas
 
 - Driver label in TOML must match the URL scheme (`postgres` ⇄ `postgresql://`, `mysql` ⇄ `mysql+pymysql://`, `ssh` ⇄ `ssh://` / `ssh+password://` / `ssh+key://`).
-- Passwords in TOML are plaintext; use `${env:VAR}` indirection for prod secrets.
+- Passwords in TOML are plaintext; use `${env:VAR}` indirection for prod secrets. SSH accepts a standalone `password` key (keeps the URL clean); when one is set, local `~/.ssh` keys are ignored.
 - `query()` is for SELECTs only. For INSERTs, use `execute()`.
 - For tables > 10k rows, use `engine.connect().execution_options(stream_results=True)` and iterate manually — `query()` loads everything into memory.
 - SSH SFTP subsystem may be disabled on the remote host. `ssh_upload/ssh_download` raise `RuntimeError("SFTP subsystem not available")`; fall back to `tar -czf - | ssh host tar -xzf -` via `ssh_exec`.

{sql_harness-0.3.2 → sql_harness-0.3.3}/docs/connections-toml-example.toml

@@ -18,7 +18,9 @@ echo = false
 # Connections
 # ---------------------------------------------------------------------------
 # Each [[connections]] block defines a named profile. Drivers: postgres, mysql,
-# redis (stub), sqlite. URL must match the driver.
+# redis (stub), sqlite, ssh / ssh+password / ssh+key. URL must match the driver.
+# Optional keys: description, password, pool_size, pool_recycle, pre_ping, echo,
+# application_name. `${env:VAR}` is expanded in both `url` and `password`.
 
 [[connections]]
 name = "local_pg"
@@ -51,11 +53,24 @@ driver = "ssh"
 url = "ssh://app@10.0.0.5:2222"
 description = "Production application host (key auth via $BH_SSH_KEY or ~/.ssh/id_ed25519)"
 
+# Password auth, credentials kept out of the URL (recommended). Each connection
+# carries its own password, so switching workspaces needs no env fiddling.
+# Precedence: URL-embedded password > this field > $BH_SSH_PASSWORD.
+# Note: a connection with a password uses password auth exclusively — local
+# ~/.ssh keys are not consulted.
+[[connections]]
+name = "iot_server"
+driver = "ssh"
+url = "ssh://113.44.193.72:22"
+password = "${env:IOT_SSH_PASSWORD}"
+description = "IoT host (password auth)"
+
+# URL-embedded password also works (driver label may be ssh or ssh+password).
 [[connections]]
 name = "lab-server"
 driver = "ssh+password"
 url = "ssh+password://lab:lab@192.168.1.10:22"
-description = "Lab box (password auth)"
+description = "Lab box (password auth, password in URL)"
 
 # ---------------------------------------------------------------------------
 # Optional per-connection pool overrides (alternative syntax)

{sql_harness-0.3.2/skills/sql-harness/references → sql_harness-0.3.3/docs}/install.md

@@ -79,9 +79,19 @@ name = "prod_pg"
 driver = "postgres"
 url = "${env:PROD_PG_URL}"            # env-var indirection
 pool_size = 10
+
+[[connections]]
+name = "iot_server"
+driver = "ssh"
+url = "ssh://113.44.193.72:22"
+password = "${env:IOT_SSH_PASSWORD}"  # standalone secret — keeps the URL clean
 ```
 
-`${env:VAR}` placeholders inside `url` are expanded at load time from the process environment — keep prod secrets out of the file.
+`${env:VAR}` placeholders inside `url` and `password` are expanded at load time from the process environment — keep prod secrets out of the file.
+
+Optional per-connection keys: `description`, `password`, `pool_size`, `pool_recycle`, `pre_ping`, `echo`, `application_name`.
+
+SSH password precedence (highest first): password embedded in `url` > the `password` key > `$BH_SSH_PASSWORD`. A connection that sets a password uses password auth exclusively — local `~/.ssh` keys are not consulted (see `interaction-skills/ssh/auth-and-tunnels.md`).
 
 ## Configuration env vars
 
@@ -110,7 +120,7 @@ pool_size = 10
 | `ssh` / `ssh+password` / `ssh+key` | remote shell + SFTP (paramiko) | `paramiko>=3.4` | ✅ |
 
 To enable Redis: `uv add "redis>=5.0,<6"` then implement `drivers/redis.py`.
-To add another SSH host: append a `[[connections]]` block with `driver = "ssh"` and an `ssh://...` URL.
+To add another SSH host: append a `[[connections]]` block with `driver = "ssh"` and an `ssh://...` URL. Use the `password` key for password auth, or `?key=/abs/path` for a key outside the default locations. `sql-harness test <name>` probes SSH with a remote `echo` instead of `SELECT 1`.
 
 ## Troubleshooting
 

{sql_harness-0.3.2 → sql_harness-0.3.3}/interaction-skills/ssh/auth-and-tunnels.md

@@ -16,15 +16,29 @@
 
 ### 1.1 三种 scheme 对照
 
-`drivers/ssh.py:_parse_url` 支持的三种 URL 形式：
+`drivers/ssh.py` 认这三种 URL 形式：
 
-| URL 形式 | 何时用 | 取 key 顺序 |
+| URL 形式 | 何时用 | 认证方式 |
 |---|---|---|
-| `ssh://user@host:port` | 默认 key auth | `?key=...` → `$BH_SSH_KEY` → `~/.ssh/id_ed25519` → `id_rsa` → `id_ecdsa`（`KEY_FALLBACK`） |
-| `ssh+key://user@host:port?key=/abs/path` | key 不在默认路径 | URL 里的 `?key=` 单独覆盖 |
-| `ssh+password://user:pw@host:port` | 跳板 / 临时主机，没配 key | URL 嵌入密码；也可用 `$BH_SSH_PASSWORD` |
+| `ssh://user@host:port` | 默认 | 显式 key（`?key=`/`$BH_SSH_KEY`）→ key；否则配了密码 → 纯密码；都没有 → 自动找 `~/.ssh` key |
+| `ssh+key://user@host:port?key=/abs/path` | key 不在默认路径 | key 认证，密码作后备 |
+| `ssh+password://user[:pw]@host:port` | 跳板 / 临时主机 | 纯密码认证；密码可嵌 URL，也可放字段/env |
 
-**注意**：`ssh+password` 要求密码嵌入 URL。不想明文落 TOML，把密码放 `$BH_SSH_PASSWORD` 并用 `ssh://user@host`，但驱动**不会**自动回退到 env 密码（仅 key 走 env fallback）。这是常见混淆点。
+**密码来源优先级**（高 → 低）：URL 内嵌 > 连接里的 `password` 字段 > `$BH_SSH_PASSWORD`。
+
+**`password` 字段**（推荐——密码按连接存，切 workspace 不用动环境变量）：
+
+```toml
+[[connections]]
+name = "iot_server"
+driver = "ssh"
+url = "ssh://113.44.193.72:22"
+password = "${env:IOT_SSH_PASSWORD}"   # 也可直接写明文
+```
+
+**认证策略**（`_open_client`）：显式给 key（`?key=`/`$BH_SSH_KEY`）→ key 优先、密码兜底；没给 key 但配了密码 → **纯密码**，不翻 `~/.ssh`；都没有 → 自动发现 `~/.ssh/id_{ed25519,rsa,ecdsa}`。
+
+> 第三条很关键：paramiko 开着 `look_for_keys` 会逐个试 `~/.ssh` 里的 key，只要里面有一把解析不了的（旧 DSA key 是常见雷），认证线程直接抛异常、**在密码之前**就中断握手。所以配了密码就不会被本地散装 key 劫持。
 
 ### 1.2 用哪个连接串
 
@@ -32,7 +46,7 @@
 有 ed25519 key 在 ~/.ssh/ 且 authorized_keys 已加？
   ├─ 是 → ssh://user@host                                (默认 key path)
   └─ 否：
-      有密码但没 key？ → ssh+password://user:pw@host
+      有密码？ → 连接里加 password = "..."（driver 用 ssh 即可）
       key 在非默认路径？ → ssh://user@host?key=/path/to/k
       key 在 ssh-agent？ → §1.3
 ```
@@ -131,7 +145,8 @@ sql-harness 不内置 SSH SOCKS 代理；本机 `psql`/`TablePlus` 直连躲在
 ## Gotchas
 
 - **paramiko 不会自动用 ssh-agent**——见 §1.3。
-- **`ssh+password://` 必须嵌入密码**——`BH_SSH_PASSWORD` env 不会回退（仅 key 走 env fallback）。
+- **密码优先级**：URL 内嵌 > `password` 字段 > `$BH_SSH_PASSWORD`。配了密码即纯密码认证，本地 key 不再参与（见 §1.1）。
+- **服务端禁密码登录**：报 `Authentication failed` 时先确认服务端开了 `PasswordAuthentication`，别急着改本地配置。
 - **堡垒机转发时 `ssh -fN` 在某些堡垒机受限**——`AllowTcpForwarding no`。失败就 §2.2 走 paramiko `request_port_forward`。
 - **`request_port_forward` 返回的对象必须在 finally 里 cancel**，否则下次 `use_workspace` 复用 transport 报端口占用。
 - **workspace disconnect 不自动清 tunnel**——硬规矩：tunnel 用 try/finally 包起来。

{sql_harness-0.3.2 → sql_harness-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-harness"
-version = "0.3.2"
+version = "0.3.3"
 description = "Single-process SQL + SSH CLI for LLM agents. PostgreSQL/MySQL/SSH via SQLAlchemy + paramiko. Plaintext credentials in one TOML file. Helpers auto-injected into the heredoc namespace."
 readme = "docs/README.md"
 license = { text = "MIT" }

{sql_harness-0.3.2/docs → sql_harness-0.3.3/skills/sql-harness/references}/install.md

@@ -79,9 +79,19 @@ name = "prod_pg"
 driver = "postgres"
 url = "${env:PROD_PG_URL}"            # env-var indirection
 pool_size = 10
+
+[[connections]]
+name = "iot_server"
+driver = "ssh"
+url = "ssh://113.44.193.72:22"
+password = "${env:IOT_SSH_PASSWORD}"  # standalone secret — keeps the URL clean
 ```
 
-`${env:VAR}` placeholders inside `url` are expanded at load time from the process environment — keep prod secrets out of the file.
+`${env:VAR}` placeholders inside `url` and `password` are expanded at load time from the process environment — keep prod secrets out of the file.
+
+Optional per-connection keys: `description`, `password`, `pool_size`, `pool_recycle`, `pre_ping`, `echo`, `application_name`.
+
+SSH password precedence (highest first): password embedded in `url` > the `password` key > `$BH_SSH_PASSWORD`. A connection that sets a password uses password auth exclusively — local `~/.ssh` keys are not consulted (see `interaction-skills/ssh/auth-and-tunnels.md`).
 
 ## Configuration env vars
 
@@ -110,7 +120,7 @@ pool_size = 10
 | `ssh` / `ssh+password` / `ssh+key` | remote shell + SFTP (paramiko) | `paramiko>=3.4` | ✅ |
 
 To enable Redis: `uv add "redis>=5.0,<6"` then implement `drivers/redis.py`.
-To add another SSH host: append a `[[connections]]` block with `driver = "ssh"` and an `ssh://...` URL.
+To add another SSH host: append a `[[connections]]` block with `driver = "ssh"` and an `ssh://...` URL. Use the `password` key for password auth, or `?key=/abs/path` for a key outside the default locations. `sql-harness test <name>` probes SSH with a remote `echo` instead of `SELECT 1`.
 
 ## Troubleshooting
 

{sql_harness-0.3.2 → sql_harness-0.3.3}/sql-harness

@@ -16,7 +16,7 @@ set -euo pipefail
 # browser-harness keeps the launcher at repo root; sql-harness's "repo root" is lab/sql_harness/).
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$SCRIPT_DIR"
-SRC="$ROOT/src"r
+SRC="$ROOT/src"
 
 # Isolate dev state.
 export BH_SQL_HOME="$ROOT/.sql-harness-dev"

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/cli.py

@@ -83,6 +83,7 @@ def cmd_list(_args, harness: SqlHarness) -> int:
             "driver": c.driver,
             "url": c.masked_url(),
             "description": c.description,
+            "password_set": bool(c.password),
             "pool_size": c.pool.size,
         })
     _emit({"default_workspace": cfg.default_workspace, "connections": rows})
@@ -111,6 +112,7 @@ def cmd_add(args, harness: SqlHarness) -> int:
         return 2
 
     description = args.description or ""
+    password = getattr(args, "password", None) or ""
     pool = PoolConfig(size=args.pool_size or cfg.pool_defaults.size)
 
     cfg.connections.append(
@@ -119,11 +121,12 @@ def cmd_add(args, harness: SqlHarness) -> int:
             driver=driver,
             url=url,
             description=description,
+            password=password,
             pool=pool,
         )
     )
     save_config(cfg, config_file())
-    _emit({"added": name, "driver": driver, "url": _mask(url)})
+    _emit({"added": name, "driver": driver, "url": _mask(url), "password_set": bool(password)})
     return 0
 
 
@@ -171,6 +174,8 @@ def cmd_show(args, harness: SqlHarness) -> int:
         "driver": c.driver,
         "url": c.masked_url(),
         "description": c.description,
+        "password_set": bool(c.password),
+        "password": c.masked_password(),
         "pool": {
             "size": c.pool.size,
             "recycle": c.pool.recycle,
@@ -182,6 +187,34 @@ def cmd_show(args, harness: SqlHarness) -> int:
     return 0
 
 
+def _probe_workspace(ws) -> dict:
+    """Liveness-probe an open workspace.
+
+    SQL workspaces answer `SELECT 1`; SSH workspaces expose no `.engine.connect()`,
+    so they're probed with a remote `echo`. Returns a result dict whose `ok` flag
+    is the verdict (raises only on transport/library errors).
+    """
+    t0 = time.monotonic()
+    if ws.driver.name == "ssh":
+        result = ws.engine.exec("echo sql-harness-ok")
+        return {
+            "ok": result.ok,
+            "probe": result.command,
+            "stdout": result.stdout.strip(),
+            "stderr": result.stderr.strip(),
+            "exit_code": result.exit_code,
+            "sftp_available": ws.engine.sftp is not None,
+            "latency_ms": round((time.monotonic() - t0) * 1000, 2),
+        }
+    with ws.engine.connect() as conn:
+        row = conn.execute(text("SELECT 1")).scalar()
+    return {
+        "ok": True,
+        "select_1": row,
+        "latency_ms": round((time.monotonic() - t0) * 1000, 2),
+    }
+
+
 def cmd_test(args, harness: SqlHarness) -> int:
     name = args.name
     try:
@@ -193,16 +226,13 @@ def cmd_test(args, harness: SqlHarness) -> int:
         _emit({"name": name, "ok": False, "error": str(e)})
         return 1
 
-    t0 = time.monotonic()
     try:
-        with ws.engine.connect() as conn:
-            row = conn.execute(text("SELECT 1")).scalar()
-        dt = (time.monotonic() - t0) * 1000
-        _emit({"name": name, "ok": True, "select_1": row, "latency_ms": round(dt, 2)})
-        return 0
+        result = _probe_workspace(ws)
     except Exception as e:
         _emit({"name": name, "ok": False, "error": str(e)})
         return 1
+    _emit({"name": name, "driver": ws.driver.name, **result})
+    return 0 if result["ok"] else 1
 
 
 def cmd_workspace(args, harness: SqlHarness) -> int:
@@ -528,18 +558,14 @@ def cmd_version(_args, _harness: SqlHarness) -> int:
 
 
 def cmd_doctor(_args, harness: SqlHarness) -> int:
-    """Sanity-check: list connections + try SELECT 1 on each."""
+    """Sanity-check: list connections + probe each one."""
     rows = []
     for c in harness.config.connections:
         try:
             ws = harness.workspace(c.name)
-            t0 = time.monotonic()
-            with ws.engine.connect() as conn:
-                conn.execute(text("SELECT 1")).scalar()
-            dt = (time.monotonic() - t0) * 1000
-            rows.append({"name": c.name, "ok": True, "latency_ms": round(dt, 2)})
+            rows.append({"name": c.name, "driver": c.driver, **_probe_workspace(ws)})
         except Exception as e:
-            rows.append({"name": c.name, "ok": False, "error": str(e)})
+            rows.append({"name": c.name, "driver": c.driver, "ok": False, "error": str(e)})
     _emit({"results": rows})
     return 0 if all(r["ok"] for r in rows) else 1
 
@@ -870,9 +896,16 @@ def _build_parser() -> argparse.ArgumentParser:
 
     p_add = sub.add_parser("add", help="add a connection")
     p_add.add_argument("--name")
-    p_add.add_argument("--driver", choices=["postgres", "mysql", "redis", "sqlite", "ssh"])
+    p_add.add_argument(
+        "--driver",
+        choices=["postgres", "mysql", "redis", "sqlite", "ssh", "ssh+password", "ssh+key"],
+    )
     p_add.add_argument("--url")
     p_add.add_argument("--description")
+    p_add.add_argument(
+        "--password",
+        help="standalone secret (SSH password); keeps the URL credential-free",
+    )
     p_add.add_argument("--pool-size", type=int)
 
     p_edit = sub.add_parser("edit", help="edit connections.toml in $EDITOR")
@@ -884,7 +917,9 @@ def _build_parser() -> argparse.ArgumentParser:
     p_show = sub.add_parser("show", help="show connection details (password masked)")
     p_show.add_argument("name")
 
-    p_test = sub.add_parser("test", help="connect + SELECT 1")
+    p_test = sub.add_parser(
+        "test", help="connect + probe (SELECT 1 for SQL, remote echo for SSH)"
+    )
     p_test.add_argument("name")
 
     p_ws = sub.add_parser("workspace", help="manage workspaces")

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/config.py

@@ -14,13 +14,18 @@ Schema (lives at ~/.config/sql-harness/connections.toml by default):
     driver = "postgres"
     url = "postgresql+psycopg://user:pw@host:5432/db"
     description = "..."
+    password = "${env:PG_PASSWORD}"        # optional; overrides URL password
     pool_size = 5
     pool_recycle = 3600
     pre_ping = true
     echo = false
     application_name = "sql-harness"
 
-${env:VAR} in `url` is expanded from the process environment.
+${env:VAR} in `url` and in `password` is expanded from the process environment.
+
+`password` is a standalone secret for drivers that take one separately from the
+URL (currently SSH). Precedence, highest first: password embedded in `url` >
+this field > driver-specific env var (SSH: $BH_SSH_PASSWORD).
 """
 
 from __future__ import annotations
@@ -60,9 +65,10 @@ class ConnectionConfig:
     """A single named connection profile."""
 
     name: str
-    driver: str                                # postgres | mysql | redis
+    driver: str                                # postgres | mysql | redis | ssh
     url: str
     description: str = ""
+    password: str = ""                         # standalone secret (SSH password)
     pool: PoolConfig = field(default_factory=PoolConfig)
     application_name: str = "sql-harness"
 
@@ -70,6 +76,10 @@ class ConnectionConfig:
         """Return the URL with password redacted."""
         return _ENV_RE.sub(lambda m: os.environ.get(m.group(1), ""), _mask_password(self.url))
 
+    def masked_password(self) -> str:
+        """Return the standalone password redacted (empty if unset)."""
+        return "***" if self.password else ""
+
 
 @dataclass
 class ConnectionsConfig:
@@ -149,6 +159,8 @@ def save(cfg: ConnectionsConfig, path: Path) -> None:
         lines.append(f'url = "{_toml_str(c.url)}"')
         if c.description:
             lines.append(f'description = "{_toml_str(c.description)}"')
+        if c.password:
+            lines.append(f'password = "{_toml_str(c.password)}"')
         if c.pool.size != cfg.pool_defaults.size:
             lines.append(f"pool_size = {c.pool.size}")
         if c.pool.recycle != cfg.pool_defaults.recycle:
@@ -205,6 +217,7 @@ def _from_dict(raw: dict[str, Any]) -> ConnectionsConfig:
                 driver=str(entry["driver"]),
                 url=_expand_env(str(entry["url"])),
                 description=str(entry.get("description", "")),
+                password=_expand_env(str(entry.get("password", ""))),
                 pool=pool,
                 application_name=str(entry.get("application_name", "sql-harness")),
             )

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/__init__.py

@@ -17,8 +17,13 @@ class Driver(Protocol):
 
     name: str
 
-    def make_engine(self, url: str, pool: "PoolConfig") -> Engine:
-        """Create a SQLAlchemy Engine with the given pool config."""
+    def make_engine(self, url: str, pool: "PoolConfig", password: str | None = None) -> Engine:
+        """Create a SQLAlchemy Engine with the given pool config.
+
+        `password` is the connection's standalone secret (ConnectionConfig.password).
+        Drivers whose URL already carries credentials (SQL backends) ignore it;
+        SSH uses it when no password is embedded in the URL.
+        """
 
     def list_tables(self, engine: Engine, schema: str | None) -> list[str]:
         """Return table names (and views) visible in the given schema."""

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/mysql.py

@@ -8,7 +8,8 @@ from sqlalchemy import Engine, create_engine, inspect, text
 class MysqlDriver:
     name = "mysql"
 
-    def make_engine(self, url: str, pool) -> Engine:
+    def make_engine(self, url: str, pool, password: str | None = None) -> Engine:
+        # `password` is ignored: credentials live in the URL for SQL backends.
         if not url.startswith("mysql+pymysql://"):
             raise ValueError(
                 f"MySQL URL must start with mysql+pymysql:// (got {url[:30]!r})"

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/postgres.py

@@ -8,7 +8,8 @@ from sqlalchemy import Engine, create_engine, inspect, text
 class PostgresDriver:
     name = "postgres"
 
-    def make_engine(self, url: str, pool) -> Engine:
+    def make_engine(self, url: str, pool, password: str | None = None) -> Engine:
+        # `password` is ignored: credentials live in the URL for SQL backends.
         # Accept all three SQLAlchemy-recognized PostgreSQL URL prefixes:
         #   postgresql+psycopg://  (explicit dialect — preferred)
         #   postgresql://          (SQLAlchemy maps to default psycopg driver)

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/redis.py

@@ -17,7 +17,7 @@ from sqlalchemy import Engine
 class RedisDriver:
     name = "redis"
 
-    def make_engine(self, url: str, pool) -> Engine:
+    def make_engine(self, url: str, pool, password: str | None = None) -> Engine:
         raise NotImplementedError(
             "Redis driver is not yet implemented. "
             "Add redis-py to deps and fill in drivers/redis.py."

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/sqlite.py

@@ -12,8 +12,9 @@ from sqlalchemy import Engine, create_engine, inspect
 class SqliteDriver:
     name = "sqlite"
 
-    def make_engine(self, url: str, pool) -> Engine:
+    def make_engine(self, url: str, pool, password: str | None = None) -> Engine:
         # SQLite ignores most pool settings; StaticPool is fine for in-memory.
+        # `password` is ignored too — SQLite has no auth.
         if not url.startswith("sqlite:"):
             raise ValueError(f"SQLite URL must start with sqlite: (got {url[:30]!r})")
         return create_engine(url, future=True)

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/drivers/ssh.py

@@ -6,14 +6,27 @@ lazy open, cached for the process lifetime, disposed on close.
 
 URL format:
     ssh://user[:password]@host[:port][?key=/path/to/private_key]
-    ssh+password://user:password@host:port
+    ssh+password://user[:password]@host:port
     ssh+key://user@host:port?key=/path/to/private_key
-    ssh://user@host:port (uses BH_SSH_KEY env or ~/.ssh/id_rsa default)
+    ssh://user@host:port (uses the connection's `password` field, $BH_SSH_PASSWORD, or a default key)
 
-If `?key=...` is omitted, paramiko falls back to:
+Password precedence (highest first):
+  1. password embedded in the URL          (ssh://user:pw@host)
+  2. the connection's `password` field     (connections.toml: password = "...")
+  3. $BH_SSH_PASSWORD
+
+Key resolution (when `?key=...` is absent):
   1. $BH_SSH_KEY env var
-  2. ~/.ssh/id_rsa
-  3. password-less (no auth — likely to fail)
+  2. ~/.ssh/id_ed25519, id_rsa, id_ecdsa (skipped when a password is set)
+  3. none — password-only auth
+
+Which auth wins is decided by what the connection states explicitly:
+  - an explicit key (?key= / $BH_SSH_KEY) → key auth, password as fallback
+  - otherwise, a password                → password-only auth
+  - otherwise                            → auto-discovered ~/.ssh key
+
+So each connection carries its own credential and switching workspaces needs no
+env fiddling; a configured password is never shadowed by an unrelated key.
 
 Use the `Workspace.client` attribute (and `.sftp`) for shell + file ops.
 """
@@ -24,6 +37,7 @@ import os
 import shlex
 import time
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Any
 
 import paramiko
@@ -69,18 +83,26 @@ class SshDriver:
 
     name = "ssh"
 
-    def make_engine(self, url: str, pool):  # noqa: D401 — mirror DB Driver API
+    def make_engine(self, url: str, pool, password: str | None = None):
         """Return a live `SshClient` (opened). Caller owns it.
 
+        `password` is the connection's standalone secret
+        (ConnectionConfig.password), so each connection carries its own
+        credentials and switching workspaces needs no env fiddling.
+        Precedence: URL-embedded > `password` > $BH_SSH_PASSWORD.
+
         PoolConfig is ignored for SSH (no pooling). We accept it for API parity
         with DB drivers.
         """
-        host, port, username, password, key_path = _parse_url(url)
+        fallback = password or os.environ.get(PASSWORD_ENV)
+        host, port, username, resolved_password, key_path = _parse_url(
+            url, fallback_password=fallback
+        )
         client = _open_client(
             host=host,
             port=port,
             username=username,
-            password=password,
+            password=resolved_password,
             key_path=key_path,
         )
         # Attach a long-lived shell channel (paramiko's transport keeps it
@@ -172,13 +194,19 @@ class _SshHandle:
 # --- URL parsing + connection bootstrap ----------------------------------
 
 
-def _parse_url(url: str) -> tuple[str, int, str, str | None, str | None]:
+def _parse_url(
+    url: str, fallback_password: str | None = None
+) -> tuple[str, int, str, str | None, str | None]:
     """Extract (host, port, username, password, key_path) from ssh:// URL.
 
+    `fallback_password` supplies the password when the URL carries none —
+    callers pass the connection's `password` field (then $BH_SSH_PASSWORD),
+    so a URL can stay credential-free while still being password-authenticated.
+
     Accepts:
         ssh://user:pw@host:port?key=/path
-        ssh://user@host:port (auth from env / default key)
-        ssh+password://user:pw@host:port
+        ssh://user@host:port (auth from fallback_password / default key)
+        ssh+password://user[:pw]@host:port
         ssh+key://user@host:port?key=...
     """
     from urllib.parse import urlparse, parse_qs
@@ -192,7 +220,7 @@ def _parse_url(url: str) -> tuple[str, int, str, str | None, str | None]:
         raise ValueError(f"missing host in URL: {url!r}")
     port = p.port or SSH_DEFAULT_PORT
     username = p.username or "root"
-    password = p.password
+    password = p.password or fallback_password
     query = parse_qs(p.query)
     key_path = query.get("key", [None])[0]
     # Scheme hints
@@ -228,13 +256,35 @@ def _resolve_key_path(explicit: str | None) -> str | None:
 def _open_client(
     *, host: str, port: int, username: str, password: str | None, key_path: str | None
 ) -> paramiko.SSHClient:
-    """Open a paramiko SSHClient, with policy that trusts the user's known_hosts."""
+    """Open a paramiko SSHClient, with policy that trusts the user's known_hosts.
+
+    `password` must already be resolved (URL > connection `password` > env) —
+    this function does no further fallback.
+
+    Auth policy, in order of intent:
+      - explicit key (?key= / $BH_SSH_KEY) → key auth, password as fallback
+      - else, a password is set            → password-only, ~/.ssh keys ignored
+      - else                               → auto-discover ~/.ssh/{ed25519,rsa,ecdsa}
+
+    That middle rule matters: with look_for_keys enabled paramiko walks every key
+    in ~/.ssh, and one unparseable key there (a legacy DSA key, say) raises out of
+    the transport thread and aborts the handshake before the password is ever
+    tried. A connection that names a password gets password auth, full stop.
+    """
     client = paramiko.SSHClient()
     # Auto-add host keys (like `ssh` does on first connect, when
     # StrictHostKeyChecking=accept-new is set).
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-    key_file = _resolve_key_path(key_path)
+
+    explicit_key = key_path or os.environ.get(KEY_ENV)
+    if explicit_key:
+        key_file: str | None = _resolve_key_path(explicit_key)
+    elif password:
+        key_file = None
+    else:
+        key_file = _resolve_key_path(None)
+
     try:
         if key_file is not None:
             client.connect(
@@ -252,7 +302,7 @@ def _open_client(
                 hostname=host,
                 port=port,
                 username=username,
-                password=password or os.environ.get(PASSWORD_ENV),
+                password=password,
                 timeout=15.0,
                 allow_agent=False,
                 look_for_keys=False,
@@ -260,8 +310,9 @@ def _open_client(
     except paramiko.AuthenticationException as e:
         raise RuntimeError(
             f"SSH auth failed for {username}@{host}:{port}: {e}\n"
-            f"(provide ?key= or set $BH_SSH_KEY for key auth, "
-            f"or $BH_SSH_PASSWORD / embed password in URL for password auth)"
+            f"(set `password` on the connection in connections.toml, embed it in "
+            f"the URL, or set $BH_SSH_PASSWORD for password auth; "
+            f"provide ?key= or set $BH_SSH_KEY for key auth)"
         ) from e
     return client
 

{sql_harness-0.3.2 → sql_harness-0.3.3}/src/sql_harness/manager.py

@@ -52,7 +52,9 @@ class SqlHarness:
             return self._workspaces[name]
         conn = self.config.get(name)
         driver = get_driver(conn.driver)
-        engine = driver.make_engine(conn.url, conn.pool)
+        # `password` is the connection's standalone secret; SQL drivers ignore
+        # it (their URL carries credentials), SSH uses it when the URL doesn't.
+        engine = driver.make_engine(conn.url, conn.pool, conn.password)
         ws = Workspace(WorkspaceConfig(conn), engine, driver)
         self._workspaces[name] = ws
         return ws