Add CLI enhancements: -c/--command, -f/--file, -y/--yes flags and .pgpass SSH tunnel support

.gitignore

@@ -74,3 +74,4 @@ venv/
 .ropeproject/
 uv.lock
 
+pgcli/__init__.py

AUTHORS

@@ -144,6 +144,7 @@ Contributors:
     * Jay Knight (jay-knight)
     * fbdb
     * Charbel Jacquin (charbeljc)
+    * Diego
 
 Creator:
 --------

changelog.rst

@@ -9,6 +9,18 @@ Features:
     * Support dsn specific init-command in the config file
 * Add suggestion when setting the search_path
 * Allow per dsn_alias ssh tunnel selection
+* Add support for `single-command` to run a SQL command and exit.
+    * Command line option `-c` or `--command`.
+    * You can specify multiple times.
+* Add support for `file` to execute commands from a file and exit.
+    * Command line option `-f` or `--file`.
+    * You can specify multiple times.
+    * Similar to psql's `-f` option.
+* Add support for forcing destructive commands without confirmation.
+    * Command line option `-y` or `--yes`.
+    * Skips the destructive command confirmation prompt when enabled.
+    * Useful for automated scripts and CI/CD pipelines.
+* Add hostaddr to handle .pgpass with ssh tunnels
 
 Internal:
 ---------

pgcli/__init__.py

@@ -1 +1 @@
-__version__ = "4.3.0"
+__version__ = "4.3.4"

pgcli/main.py

@@ -185,12 +185,14 @@ def __init__(
         warn=None,
         ssh_tunnel_url: Optional[str] = None,
         log_file: Optional[str] = None,
+        force_destructive: bool = False,
     ):
         self.force_passwd_prompt = force_passwd_prompt
         self.never_passwd_prompt = never_passwd_prompt
         self.pgexecute = pgexecute
         self.dsn_alias = None
         self.watch_command = None
+        self.force_destructive = force_destructive
 
         # Load config.
         c = self.config = get_config(pgclirc_file)
@@ -484,7 +486,10 @@ def execute_from_file(self, pattern, **_):
             ):
                 message = "Destructive statements must be run within a transaction. Command execution stopped."
                 return [(None, None, None, message)]
-            destroy = confirm_destructive_query(query, self.destructive_warning, self.dsn_alias)
+            if self.force_destructive:
+                destroy = True
+            else:
+                destroy = confirm_destructive_query(query, self.destructive_warning, self.dsn_alias)
             if destroy is False:
                 message = "Wise choice. Command execution stopped."
                 return [(None, None, None, message)]
@@ -594,7 +599,8 @@ def connect_uri(self, uri):
         kwargs = conninfo_to_dict(uri)
         remap = {"dbname": "database", "password": "passwd"}
         kwargs = {remap.get(k, k): v for k, v in kwargs.items()}
-        self.connect(**kwargs)
+        # Pass the original URI as dsn parameter for .pgpass support with SSH tunnels
+        self.connect(dsn=uri, **kwargs)
 
     def connect(self, database="", host="", user="", port="", passwd="", dsn="", **kwargs):
         # Connect to the database.
@@ -657,6 +663,14 @@ def should_ask_for_password(exc):
                     break
 
         if self.ssh_tunnel_url:
+            if not SSH_TUNNEL_SUPPORT:
+                click.secho(
+                    "SSH tunnel requires sshtunnel package. Install it with: pip install sshtunnel",
+                    err=True,
+                    fg="red",
+                )
+                sys.exit(1)
+
             # We add the protocol as urlparse doesn't find it by itself
             if "://" not in self.ssh_tunnel_url:
                 self.ssh_tunnel_url = f"ssh://{self.ssh_tunnel_url}"
@@ -667,6 +681,9 @@ def should_ask_for_password(exc):
                 "remote_bind_address": (host, int(port or 5432)),
                 "ssh_address_or_host": (tunnel_info.hostname, tunnel_info.port or 22),
                 "logger": self.logger,
+                "ssh_config_file": "~/.ssh/config",  # Use SSH config for host settings
+                "allow_agent": True,  # Allow SSH agent for authentication
+                "compression": False,  # Disable compression for better performance
             }
             if tunnel_info.username:
                 params["ssh_username"] = tunnel_info.username
@@ -687,11 +704,16 @@ def should_ask_for_password(exc):
             self.logger.handlers = logger_handlers
 
             atexit.register(self.ssh_tunnel.stop)
-            host = "127.0.0.1"
+            # Preserve original host for .pgpass lookup and SSL certificate verification
+            # Use hostaddr to specify the actual connection endpoint (SSH tunnel)
+            hostaddr = "127.0.0.1"
             port = self.ssh_tunnel.local_bind_ports[0]
 
             if dsn:
-                dsn = make_conninfo(dsn, host=host, port=port)
+                dsn = make_conninfo(dsn, host=host, hostaddr=hostaddr, port=port)
+            else:
+                # For non-DSN connections, pass hostaddr via kwargs
+                kwargs["hostaddr"] = hostaddr
 
         # Attempt to connect to the database.
         # Note that passwd may be empty on the first attempt. If connection
@@ -792,7 +814,10 @@ def execute_command(self, text, handle_closed_connection=True):
                 ):
                     click.secho("Destructive statements must be run within a transaction.")
                     raise KeyboardInterrupt
-                destroy = confirm_destructive_query(text, self.destructive_warning, self.dsn_alias)
+                if self.force_destructive:
+                    destroy = True
+                else:
+                    destroy = confirm_destructive_query(text, self.destructive_warning, self.dsn_alias)
                 if destroy is False:
                     click.secho("Wise choice!")
                     raise KeyboardInterrupt
@@ -911,6 +936,44 @@ def _check_ongoing_transaction_and_allow_quitting(self):
     def run_cli(self):
         logger = self.logger
 
+        # Handle command mode (-c flag) and/or file mode (-f flag)
+        # Similar to psql behavior: execute commands/files and exit
+        has_commands = hasattr(self, 'commands') and self.commands
+        has_input_files = hasattr(self, 'input_files') and self.input_files
+
+        if has_commands or has_input_files:
+            try:
+                # Execute -c commands first, if any
+                if has_commands:
+                    for command in self.commands:
+                        logger.debug("Running command: %s", command)
+                        self.handle_watch_command(command)
+
+                # Then execute commands from files, if provided
+                # Multiple -f options are executed sequentially
+                if has_input_files:
+                    for input_file in self.input_files:
+                        logger.debug("Reading commands from file: %s", input_file)
+                        with open(input_file, 'r', encoding='utf-8') as f:
+                            file_content = f.read()
+
+                        # Execute the entire file content as a single command
+                        # This matches psql behavior where the file is treated as one unit
+                        if file_content.strip():
+                            logger.debug("Executing commands from file: %s", input_file)
+                            self.handle_watch_command(file_content)
+
+            except PgCliQuitError:
+                # Normal exit from quit command
+                sys.exit(0)
+            except Exception as e:
+                logger.error("Error executing command: %s", e)
+                logger.error("traceback: %r", traceback.format_exc())
+                click.secho(str(e), err=True, fg="red")
+                sys.exit(1)
+            # Exit successfully after executing all commands
+            sys.exit(0)
+
         history_file = self.config["main"]["history_file"]
         if history_file == "default":
             history_file = config_location() + "history"
@@ -1278,7 +1341,10 @@ def is_too_tall(self, lines):
         return len(lines) >= (self.prompt_app.output.get_size().rows - 4)
 
     def echo_via_pager(self, text, color=None):
-        if self.pgspecial.pager_config == PAGER_OFF or self.watch_command:
+        # Disable pager for -c/--command mode, -f/--file mode, and \watch command
+        has_commands = hasattr(self, 'commands') and self.commands
+        has_input_files = hasattr(self, 'input_files') and self.input_files
+        if self.pgspecial.pager_config == PAGER_OFF or self.watch_command or has_commands or has_input_files:
             click.echo(text, color=color)
         elif self.pgspecial.pager_config == PAGER_LONG_OUTPUT and self.table_format != "csv":
             lines = text.split("\n")
@@ -1426,6 +1492,29 @@ def echo_via_pager(self, text, color=None):
     type=str,
     help="SQL statement to execute after connecting.",
 )
+@click.option(
+    "-c",
+    "--command",
+    "commands",
+    multiple=True,
+    help="run command (SQL or internal) and exit. Multiple -c options are allowed.",
+)
+@click.option(
+    "-f",
+    "--file",
+    "input_files",
+    multiple=True,
+    type=click.Path(exists=True, readable=True, dir_okay=False),
+    help="execute commands from file, then exit. Multiple -f options are allowed.",
+)
+@click.option(
+    "-y",
+    "--yes",
+    "force_destructive",
+    is_flag=True,
+    default=False,
+    help="Force destructive commands without confirmation prompt.",
+)
 @click.argument("dbname", default=lambda: None, envvar="PGDATABASE", nargs=1)
 @click.argument("username", default=lambda: None, envvar="PGUSER", nargs=1)
 def cli(
@@ -1454,6 +1543,9 @@ def cli(
     ssh_tunnel: str,
     init_command: str,
     log_file: str,
+    commands: tuple,
+    input_files: tuple,
+    force_destructive: bool,
 ):
     if version:
         print("Version:", __version__)
@@ -1512,8 +1604,15 @@ def cli(
         warn=warn,
         ssh_tunnel_url=ssh_tunnel,
         log_file=log_file,
+        force_destructive=force_destructive,
     )
 
+    # Store commands for -c option (can be multiple)
+    pgcli.commands = commands if commands else None
+
+    # Store file paths for -f option (can be multiple)
+    pgcli.input_files = input_files if input_files else None
+
     # Choose which ever one has a valid value.
     if dbname_opt and dbname:
         # work as psql: when database is given as option and argument use the argument as user

pgcli/pgexecute.py

@@ -212,7 +212,11 @@ def connect(
         new_params.update(kwargs)
 
         if new_params["dsn"]:
-            new_params = {"dsn": new_params["dsn"], "password": new_params["password"]}
+            # Preserve hostaddr when using DSN (needed for SSH tunnels with .pgpass)
+            preserved_params = {"dsn": new_params["dsn"], "password": new_params["password"]}
+            if "hostaddr" in new_params:
+                preserved_params["hostaddr"] = new_params["hostaddr"]
+            new_params = preserved_params
 
             if new_params["password"]:
                 new_params["dsn"] = make_conninfo(new_params["dsn"], password=new_params.pop("password"))

pyproject.toml

@@ -41,6 +41,8 @@ dependencies = [
     # so we'll only install it if we're not in Windows.
     "setproctitle >= 1.1.9; sys_platform != 'win32' and 'CYGWIN' not in sys_platform",
     "tzlocal >= 5.2",
+    "sshtunnel >= 0.4.0",
+    "paramiko >= 3.0, < 4.0",  # paramiko 4.0+ breaks sshtunnel 0.4.0 (DSSKey removed)
 ]
 dynamic = ["version"]
 
@@ -50,7 +52,10 @@ pgcli = "pgcli.main:cli"
 
 [project.optional-dependencies]
 keyring = ["keyring >= 12.2.0"]
-sshtunnel = ["sshtunnel >= 0.4.0"]
+sshtunnel = [
+    "sshtunnel >= 0.4.0",
+    "paramiko >= 3.0, < 4.0",  # paramiko 4.0+ breaks sshtunnel 0.4.0 (DSSKey removed)
+]
 dev = [
     "behave>=1.2.4",
     "coverage>=7.2.7",
@@ -61,6 +66,7 @@ dev = [
     "pytest-cov>=4.1.0",
     "ruff>=0.11.7",
     "sshtunnel>=0.4.0",
+    "paramiko >= 3.0, < 4.0",  # paramiko 4.0+ breaks sshtunnel 0.4.0 (DSSKey removed)
     "tox>=1.9.2",
 ]
 

tests/features/command_option.feature

@@ -0,0 +1,38 @@
+Feature: run the cli with -c/--command option,
+  execute a single command,
+  and exit
+
+  Scenario: run pgcli with -c and a SQL query
+     When we run pgcli with -c "SELECT 1 as test_diego_column"
+      then we see the query result
+      and pgcli exits successfully
+
+  Scenario: run pgcli with --command and a SQL query
+     When we run pgcli with --command "SELECT 'hello' as greeting"
+      then we see the query result
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -c and a special command
+     When we run pgcli with -c "\dt"
+      then we see the command output
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -c and an invalid query
+     When we run pgcli with -c "SELECT invalid_column FROM nonexistent_table"
+      then we see an error message
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -c and multiple statements
+     When we run pgcli with -c "SELECT 1; SELECT 2"
+      then we see both query results
+      and pgcli exits successfully
+
+  Scenario: run pgcli with multiple -c options
+     When we run pgcli with multiple -c options
+      then we see all command outputs
+      and pgcli exits successfully
+
+  Scenario: run pgcli with mixed -c and --command options
+     When we run pgcli with mixed -c and --command
+      then we see all command outputs
+      and pgcli exits successfully

tests/features/file_option.feature

@@ -0,0 +1,39 @@
+Feature: run the cli with -f/--file option,
+  execute commands from file,
+  and exit
+
+  Scenario: run pgcli with -f and a SQL query file
+     When we create a file with "SELECT 1 as test_diego_column"
+      and we run pgcli with -f and the file
+     then we see the query result
+      and pgcli exits successfully
+
+  Scenario: run pgcli with --file and a SQL query file
+     When we create a file with "SELECT 'hello' as greeting"
+      and we run pgcli with --file and the file
+     then we see the query result
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -f and a file with special command
+     When we create a file with "\dt"
+      and we run pgcli with -f and the file
+     then we see the command output
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -f and a file with multiple statements
+     When we create a file with "SELECT 1; SELECT 2"
+      and we run pgcli with -f and the file
+     then we see both query results
+      and pgcli exits successfully
+
+  Scenario: run pgcli with -f and a file with an invalid query
+     When we create a file with "SELECT invalid_column FROM nonexistent_table"
+      and we run pgcli with -f and the file
+     then we see an error message
+      and pgcli exits successfully
+
+  Scenario: run pgcli with both -c and -f options
+     When we create a file with "SELECT 2 as second"
+      and we run pgcli with -c "SELECT 1 as first" and -f with the file
+     then we see both query results
+      and pgcli exits successfully