fix(keychain) + release: macOS keychain ACL self-repair, bump 0.8.1 (#37 )

* fix(keychain): repair stale macOS keychain ACLs before reads macOS records the trusted application of a legacy keychain item as the executable *path* for an ad-hoc (dev/linker-signed) build, and as a code requirement + cdhash partition list for a signed bundle. When the path changes — the monorepo move (`src-tauri/` -> `desktop/src-tauri/`), a reinstalled app, running the installed app after a dev build — the ACL no longer admits the running binary, so macOS demands the keychain password on *every* access: once per secret, every time, with no "Always Allow". The pin only ran after writes, and writing to an inaccessible item needs the same authorization, so the ACL was never repaired. - keychain_acl::is_item_trusted() answers "am I already in this item's ACL?" with a metadata-only, prompt-free lookup (SecKeychainItemCopyAccess + SecAccessCopyACLList + comparison against this process's own SecTrustedApplication representation; a signed bundle's `cdhash:` partition lists count as trusted and are left alone). - ensure_item_acl() now no-ops when already trusted (no duplicate ACL entries, no redundant authorization) and otherwise pins exactly as before. - New before_read() hook, called from every keychain read path (DB password, SSH password, SSH passphrase — commands and internal helpers), so a stale item costs one authorization and is silent from then on. - ItemSearchOptions reports "nothing matched" as errSecItemNotFound, which is now handled as "no item" instead of a lookup error — previously every connection without a stored password logged a spurious failure. Verified: cargo test --lib (408 passed) plus the ignored live test (`cargo test --lib -- --ignored keychain_acl`), which asserts a fresh item is already trusted, repairs are idempotent and the secret still reads back. That test now finishes in 0.25s instead of ~8s because the redundant SecKeychainItemSetAccess is gone. * chore(release): bump 0.8.1 and document GitHub-only releases Version 0.8.0 -> 0.8.1 across every synced location: desktop/package.json, desktop/src-tauri/Cargo.toml (+ Cargo.lock gridline entry), tauri.conf.json, www/src/pages/index.astro, www/public/landing.js, both README download tables (+ the MAINTENANCE note), and the version/docs-coverage/bundle-config tests. Adds the 0.8.1 changelog entry (site + README Recent Changes). AGENTS.md: releases are GitHub-only — tag `prod` and `git push github vN.M.N` (origin/Gitea is a just-in-case mirror; never push branches, PRs or tags there), and the keychain row documents the self-healing ACL repair.
fix(connections): persist SSL settings and honor a URL's sslmode (#36 )
2026-09-24 03:43:46 +08:00 · 2026-09-24 03:25:13 +08:00
29 changed files with 916 additions and 214 deletions
@@ -167,17 +167,19 @@ cargo test                                         # Rust tests (from desktop/sr
 ### Branch & PR workflow
 **GitHub is the only remote that matters.** The canonical repo is `github` → [AdrianBonpin/gridline](https://github.com/AdrianBonpin/gridline) (default branch `prod`, issues, PRs, Actions, releases). The `origin` remote (`git.ranio.xyz/adrianbonpin/gridline`) is a **just-in-case mirror** — do not push branches, open PRs, or publish releases/tags there. If you must mirror something manually, push to `github` first.
 **Never commit or push directly to `prod`** — `prod` is protected (branch rules require a pull request). Always:
 1. Branch out first — `git checkout -b feat/<short-name>` (or `fix/…`, `docs/…`) from `prod`
-2. Commit and push the feature branch
+2. Commit and push the feature branch to `github` (`git push -u github <branch>`)
-3. Open a PR into `prod` and merge it there
+3. Open a PR into `prod` on GitHub (`gh pr create --repo AdrianBonpin/gridline --base prod`) and merge it there
 Direct pushes to `prod` will be bypassed only in emergencies; prefer the PR path so changes land through the PR gate.
 ### Releases
-Cut a release by tagging the **`prod`** branch once the PR is merged — `git tag vN.M.N && git push origin vN.M.N`. GitHub Actions (`release.yml`) builds installers for macOS (Apple Silicon + Intel), Windows, and Linux and opens a **draft** release (review + publish on GitHub).
+**Releases are GitHub-only.** Tag `prod` and push the tag to the `github` remote — `git tag vN.M.N && git push github vN.M.N`. GitHub Actions (`release.yml`) builds installers for macOS (Apple Silicon + Intel), Windows, and Linux and opens a **draft** release (review + publish on GitHub). Never push release tags to `origin`/Gitea; it exists only as a fallback copy of the code.
 **Before tagging**, keep everything in sync:
 - Version number across `desktop/package.json`, `desktop/src-tauri/Cargo.toml`, `desktop/src-tauri/tauri.conf.json`, and `www/src/pages/index.astro` (the landing page version string)
@@ -239,18 +241,18 @@ Planned work is prioritized in the [Project Roadmap](./ROADMAP.md) (source of tr
 | :--- | :---: | :--- |
 | Connections CRUD (PostgreSQL, MySQL, SQLite, Redis, MariaDB) | ✅ | Full create/read/update/delete with form validation |
 | MariaDB connections | ✅ | First-class db_type on the MySQL driver path (v0.8.0) |
-| New Connection screen (revamped) | ✅ | Two-stage entry → configured flow: Connection URI + 6-card provider grid (PostgreSQL / MySQL / SQLite / Redis / Supabase / NeonDB) with an OR divider → expands into label + tags/env/folder + General|SSH·SSL tabs. Supabase & NeonDB are managed-PostgreSQL presets (persist as `postgresql`) with in-app setup guides + SSL hints; PlanetScale is a managed-MySQL (Vitess) preset (persists as `mysql`) with a setup guide + `.psdb.cloud` host detection (v0.8.0); SQLite swaps the URI field for a file-path + Browse input (v0.7.0) |
+| New Connection screen (revamped) | ✅ | Two-stage entry → configured flow: Connection URI + 6-card provider grid (PostgreSQL / MySQL / SQLite / Redis / Supabase / NeonDB) with an OR divider → expands into label + tags/env/folder + General|SSH·SSL tabs. **Pasting a URI fills every setting it can** — type, host, port, user, password, database, `?sslmode=`/`ssl-mode=` (Neon/Supabase → Require, MySQL `VERIFY_IDENTITY` → verify-full) — and offers a URL-derived label (database name, else host) as a placeholder that Save/Test uses when the field is left blank; Supabase & NeonDB are managed-PostgreSQL presets (persist as `postgresql`) with in-app setup guides + SSL hints, PlanetScale is a managed-MySQL (Vitess) preset (persists as `mysql`) with a setup guide + `.psdb.cloud` host detection (v0.8.0); presets pre-select their TLS mode (Supabase/Neon Require, PlanetScale Verify Full); SQLite swaps the URI field for a file-path + Browse input (v0.7.0)
 | Connection testing (all DB types) | ✅ | PostgreSQL, MySQL, SQLite, Redis all testable |
 | DB Viewer: PostgreSQL browse + query | ✅ | Schemas, tables, paginated data, FK preview, JSON viewer |
 | DB Viewer: SQLite browse + query | ✅ | Full support via rusqlite |
 | DB Viewer: MySQL browse + query + edit | ✅ | Full viewer: connect (SSL + SSH tunnel), databases/tables/columns/FKs, query + pagination, inline cell editing + changes queue, DDL copy (`SHOW CREATE TABLE`), CSV/JSON import — added in v0.7.0. PK-only editing (no ctid equivalent); VARBINARY `information_schema` columns decoded correctly |
 | DB Viewer: Redis browse | ❌ | Connection + test only; browsing gated off with a clean "not supported" state (v0.7.0) |
-| Password storage in OS keychain | ✅ | macOS Keychain, Linux Secret Service, Windows Credential Manager; macOS items get an explicit `SecAccess` ACL pinning them to the app's code-signature requirement on every save (`keychain_acl.rs`) — items survive re-signs/upgrades without keychain permission prompts |
+| Password storage in OS keychain | ✅ | macOS Keychain, Linux Secret Service, Windows Credential Manager. macOS items get an explicit `SecAccess` ACL pinning them to the app's code-signature requirement on every save (`keychain_acl.rs`) — items survive re-signs/upgrades without keychain permission prompts. **Self-healing ACLs**: the ACL is also (silently) verified *before* reads and repaired when this app isn't in it, so items pinned to an older binary path (pre-monorepo `src-tauri/`, a reinstalled app, an ad-hoc dev build) cost one authorization instead of asking for the keychain password on every access, per secret |
 | Enable keychain toggle | ✅ | Default ON (opt-out); OFF = don't persist the DB password (session-only, re-prompt on connect) + purge existing keychain entry; SSH secrets stay keychain-only (v0.7.6) |
 | SSH tunnel config UI | ✅ | Host, port, user, auth method, key path, passphrase fields |
 | SSH tunnel runtime | ✅ | Real ssh2 tunnel (password + key auth), binds 127.0.0.1 only, secrets in OS keychain (`ssh_password:<id>` / `ssh_passphrase:<id>`), closed on pool eviction / app exit; TLS downgraded to `require` through the tunnel |
-| SSL/TLS config UI | ✅ | Mode (disable/require/verify-ca/verify-full), cert paths |
+| SSL/TLS config UI | ✅ | Mode (disable/require/verify-ca/verify-full), cert paths. Selections (mode + CA/client cert/key) are persisted on create **and** edit — the form data type carries the `ssl_*` fields and the submit handlers pass them through (previously the SSH/SSL tab's values were dropped, so connections saved with TLS off and managed providers rejected them) |
-| SSL/TLS runtime | ✅ | PostgreSQL all modes via rustls (disable/require/verify-ca/verify-full; **v1: `verify-ca` behaves as `verify-full`** — documented refinement), client certs PKCS#1/PKCS#8/EC, encrypted client keys rejected; MySQL test path maps modes (verify-full → VerifyIdentity) |
+| SSL/TLS runtime | ✅ | PostgreSQL all modes via rustls (disable/require/verify-ca/verify-full; **v1: `verify-ca` behaves as `verify-full`** — documented refinement), client certs PKCS#1/PKCS#8/EC, encrypted client keys rejected; MySQL test path maps modes (verify-full → VerifyIdentity). Managed hosts (`*.neon.tech` / `*.supabase.co` / `*.psdb.cloud`) default to `require` when the connection has no `ssl_mode` (`db::tls::resolve_ssl_mode`), so pre-fix saved connections still connect; an explicit mode always wins |
 | Roles & grants (PG) | ✅ | Create/edit/drop PostgreSQL roles and GRANT/REVOKE privileges per object class from a UI (v0.7.7) |
 ### Home Screen & Organization
@@ -30,16 +30,16 @@
 ## Download
-Grab the installer for your OS from the [latest release](https://github.com/AdrianBonpin/gridline/releases/latest) — the links below point at the current release (**v0.8.0**):
+Grab the installer for your OS from the [latest release](https://github.com/AdrianBonpin/gridline/releases/latest) — the links below point at the current release (**v0.8.1**):
 | OS                           | Architecture                 | Download                                                                                                                             |
 | :--------------------------- | :--------------------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
-| **macOS**                    | Apple Silicon (M1/M2/M3/M4…) | [Gridline_0.8.0_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_aarch64.dmg)         |
+| **macOS**                    | Apple Silicon (M1/M2/M3/M4…) | [Gridline_0.8.1_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_aarch64.dmg)         |
-| **macOS**                    | Intel                        | [Gridline_0.8.0_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_x64.dmg)                 |
+| **macOS**                    | Intel                        | [Gridline_0.8.1_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_x64.dmg)                 |
-| **Windows**                  | x64                          | [Gridline_0.8.0_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_x64-setup.exe)     |
+| **Windows**                  | x64                          | [Gridline_0.8.1_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_x64-setup.exe)     |
-| **Debian / Ubuntu**          | amd64                        | [Gridline_0.8.0_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_amd64.deb)             |
+| **Debian / Ubuntu**          | amd64                        | [Gridline_0.8.1_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_amd64.deb)             |
-| **Fedora / RHEL / openSUSE** | x86_64                       | [Gridline-0.8.0-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline-0.8.0-1.x86_64.rpm)       |
+| **Fedora / RHEL / openSUSE** | x86_64                       | [Gridline-0.8.1-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline-0.8.1-1.x86_64.rpm)       |
-| **Other Linux**              | amd64                        | [Gridline_0.8.0_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_amd64.AppImage)   |
+| **Other Linux**              | amd64                        | [Gridline_0.8.1_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_amd64.AppImage)   |
 **macOS via Homebrew** (recommended for Mac users):
@@ -57,7 +57,7 @@ The cask installs the app directly. The DMGs are Developer-ID signed and notariz
 > **macOS first launch:** Gridline is Developer-ID signed and notarized, so macOS opens it without a Gatekeeper prompt. Not sure if your Mac is Intel or Apple Silicon? See [Which file should I download?](#which-file-should-i-download) below.
 <!--
-  MAINTENANCE: These links are STATIC (versioned) — they point at the v0.8.0
+  MAINTENANCE: These links are STATIC (versioned) — they point at the v0.8.1
  release assets, not at a moving "latest" target. On every new release,
  update BOTH tables here (Download + Which file should I download?) to the
  new version's asset names, which are tauri-action's default naming:
@@ -102,6 +102,8 @@ Gridline is built for developers and small teams who manage multiple database en
 <details>
 <summary>View the full changelog</summary>
 - **v0.8.1** — **Neon / Supabase / PlanetScale connections fixed**: a pasted connection string's `?sslmode=` is now carried into the saved connection (it was silently dropped, so TLS stayed off and Neon replied *"connection is insecure (try using `sslmode=require`)"*); the SSH / SSL tab's mode and certificate paths persist on create *and* edit, managed presets pre-select their TLS mode, and `*.neon.tech` / `*.supabase.co` / `*.psdb.cloud` hosts default to `require` when no mode is stored — so previously-saved connections keep working. Pasting a URI also fills every setting it can and suggests a name, so a URL can be tested and saved with no retyping. **macOS keychain prompts self-heal**: items whose ACL still points at an older binary path made macOS ask for the keychain password on *every* access, once per secret — the app now checks the ACL (silently, before reading) and repairs it when needed, so you authorize a secret once. Version bump.
 - **v0.7.15** — **Support channel on the landing page**: optional coffee via [Ko-fi](https://ko-fi.com/adrianbonpin), never gates a feature. Landing copy refreshed (em dashes dropped, OSS section simplified, funding FAQ); version bump.
 - **v0.7.14** — **No more repeated macOS keychain prompts**: saved connection passwords and SSH secrets are now ACL-pinned to the app's code signature on every save (`keychain_acl`), so app upgrades never re-trigger the macOS keychain access dialog (users upgrading from pre-signing builds see one final prompt — choose **Always Allow**). **Install via Homebrew**: `brew tap AdrianBonpin/gridline https://github.com/AdrianBonpin/homebrew-gridline.git` then `brew install --cask gridline`; version bump.
@@ -344,16 +346,16 @@ Gridline's macOS builds are **Developer-ID signed and notarized by GitHub Action
 #### Which file should I download?
-Each release contains **one file per platform** — you only need the one that matches your computer. The links below point at the current release (**v0.8.0**):
+Each release contains **one file per platform** — you only need the one that matches your computer. The links below point at the current release (**v0.8.1**):
 | Your system                            | Download this                                                                                                                                | Notes                                                            |
 | :------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------- |
-| macOS **Apple Silicon** (M1/M2/M3/M4…) | [Gridline_0.8.0_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_aarch64.dmg)                 | `aarch64` = Apple's own chip                                     |
+| macOS **Apple Silicon** (M1/M2/M3/M4…) | [Gridline_0.8.1_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_aarch64.dmg)                 | `aarch64` = Apple's own chip                                     |
-| macOS **Intel**                        | [Gridline_0.8.0_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_x64.dmg)                         | `x64` = Intel/AMD                                                |
+| macOS **Intel**                        | [Gridline_0.8.1_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_x64.dmg)                         | `x64` = Intel/AMD                                                |
-| **Windows** (most PCs)                 | [Gridline_0.8.0_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_x64-setup.exe)             | The `.msi` is an alternate installer (for enterprises/IT admins) |
+| **Windows** (most PCs)                 | [Gridline_0.8.1_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_x64-setup.exe)             | The `.msi` is an alternate installer (for enterprises/IT admins) |
-| **Debian / Ubuntu**                    | [Gridline_0.8.0_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_amd64.deb)                     | Install: `sudo apt install ./Gridline_0.8.0_amd64.deb`           |
+| **Debian / Ubuntu**                    | [Gridline_0.8.1_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_amd64.deb)                     | Install: `sudo apt install ./Gridline_0.8.1_amd64.deb`           |
-| **Fedora / RHEL / openSUSE**           | [Gridline-0.8.0-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline-0.8.0-1.x86_64.rpm)               | Install: `sudo dnf install Gridline-0.8.0-1.x86_64.rpm`          |
+| **Fedora / RHEL / openSUSE**           | [Gridline-0.8.1-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline-0.8.1-1.x86_64.rpm)               | Install: `sudo dnf install Gridline-0.8.1-1.x86_64.rpm`          |
-| **Any other Linux**                    | [Gridline_0.8.0_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.0/Gridline_0.8.0_amd64.AppImage)           | Works on every distro: `chmod +x` the file, then double-click it |
+| **Any other Linux**                    | [Gridline_0.8.1_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.8.1/Gridline_0.8.1_amd64.AppImage)           | Works on every distro: `chmod +x` the file, then double-click it |
 **Not sure if your Mac is Intel or Apple Silicon?** Click the **Apple menu** → **About This Mac**. If it shows "Apple M1/M2/M3/M4…" download the `aarch64` file; if it shows an Intel chip, download `x64`. Downloading the wrong one won't run.
@@ -16,6 +16,12 @@ This file is the **source of truth** for what Gridline is building. [AGENTS.md](
 - **PlanetScale preset** — managed MySQL (Vitess) provider card + setup guide + `.psdb.cloud` host detection; persists as `db_type: mysql`
 - **Version bump** 0.7.15 → **0.8.0**.
 ## ✅ Shipped (unreleased)
 - **Connection-string SSL mode is honored end to end** — pasting a provider URL now carries its `?sslmode=` (Neon/Supabase `require`, `verify-full`, MySQL `ssl-mode=`) into the saved connection instead of silently connecting with TLS off, and the SSH/SSL tab's mode + certificate paths are persisted on create/edit (they were previously dropped before reaching the backend). Save/Test also fall back to a URL-derived label, so a pasted URL can be saved without typing anything. Fixes managed-provider connections failing with *"connection is insecure (try using `sslmode=require`)"*.
 - **Managed hosts default to TLS** — `*.neon.tech` / `*.supabase.co` / `*.psdb.cloud` resolve to `require` when a connection has no `ssl_mode`, so connections saved before the form persisted it (or imported without it) connect again without being re-saved. An explicit mode — including `disable` — always wins.
 - **Managed presets preselect their TLS mode** — Supabase/NeonDB → Require, PlanetScale → Verify Full.
 ## 📋 In the queue
 ### Full Redis Support
@@ -36,7 +42,6 @@ MariaDB and TimescaleDB moved to [0.8.0](#-next-up-080). Remaining candidates: C
 Supabase and NeonDB presets shipped in v0.7.0; PlanetScale moved to [0.8.0](#-next-up-080). Remaining:
 - **Turso** (libSQL — not SQLite over the wire; needs a `libsql` driver path in the Rust backend, not just a connection preset)
 - Provider detection guidance: paste a provider URL → Gridline auto-fills host/port/SSL mode; provider "connect" docs linked from the connection form
 ### Query Workbench Upgrades
@@ -1,7 +1,7 @@
 {
    "name": "gridline-desktop",
    "private": true,
-    "version": "0.8.0",
+    "version": "0.8.1",
    "description": "An open-source, high-performance database GUI client for PostgreSQL and beyond",
    "type": "module",
    "scripts": {
@@ -1783,7 +1783,7 @@ dependencies = [
 [[package]]
 name = "gridline"
-version = "0.8.0"
+version = "0.8.1"
 dependencies = [
 "bytes",
 "chrono",
@@ -1,6 +1,6 @@
 [package]
 name = "gridline"
-version = "0.8.0"
+version = "0.8.1"
 description = "An open-source, high-performance database GUI client for PostgreSQL and beyond"
 authors = ["you"]
 edition = "2021"
@@ -1005,7 +1005,7 @@ pub(crate) async fn run_mysql_connect(
    // TLS: through a tunnel the peer is loopback, so verify-ca/verify-full
    // degrade to encrypt-only `require`. Direct connections honor the mode.
    let decision = crate::commands::ssh::effective_tls_decision(
-        crate::db::tls::tls_decision(config.ssl_mode.as_deref()),
+        crate::db::tls::tls_decision_for(&config.host, config.ssl_mode.as_deref()),
        via_tunnel,
    );
    match decision {
@@ -1084,7 +1084,7 @@ pub async fn db_connect(
        // connections honor the user's mode. Building this before opening the
        // tunnel means a config error can't leak the tunnel.
        let decision = crate::commands::ssh::effective_tls_decision(
-            crate::db::tls::tls_decision(config.ssl_mode.as_deref()),
+            crate::db::tls::tls_decision_for(&config.host, config.ssl_mode.as_deref()),
            will_tunnel,
        );
        let tls = crate::db::tls::build_tls_config(
@@ -25,6 +25,9 @@ pub fn get_connection_password(
    app: tauri::AppHandle,
    connection_id: String,
 ) -> Result<Option<String>, String> {
    // Repair a stale item ACL first: after a rebuild/path change macOS would
    // otherwise ask for the keychain password on every access (once per secret).
    keychain_acl::before_read(&app, &connection_id);
    app.keyring()
        .store
        .get_password(&connection_id)
@@ -37,6 +40,7 @@ pub fn get_connection_password_internal(
    app: &tauri::AppHandle,
    connection_id: &str,
 ) -> Result<Option<String>, String> {
    keychain_acl::before_read(app, connection_id);
    app.keyring()
        .store
        .get_password(connection_id)
@@ -71,6 +75,7 @@ pub fn get_connection_ssh_password(
    app: tauri::AppHandle,
    connection_id: String,
 ) -> Result<Option<String>, String> {
    keychain_acl::before_read(&app, &ssh_account("password", &connection_id));
    app.keyring()
        .store
        .get_password(&ssh_account("password", &connection_id))
@@ -111,6 +116,7 @@ pub fn get_connection_ssh_passphrase(
    app: tauri::AppHandle,
    connection_id: String,
 ) -> Result<Option<String>, String> {
    keychain_acl::before_read(&app, &ssh_account("passphrase", &connection_id));
    app.keyring()
        .store
        .get_password(&ssh_account("passphrase", &connection_id))
@@ -135,6 +141,7 @@ pub fn get_connection_ssh_password_internal(
    app: &tauri::AppHandle,
    connection_id: &str,
 ) -> Result<Option<String>, String> {
    keychain_acl::before_read(app, &ssh_account("password", connection_id));
    app.keyring()
        .store
        .get_password(&ssh_account("password", connection_id))
@@ -265,7 +265,7 @@ async fn test_pg_connection(config: &DbConfig, ssh: &SshManager) -> TestConnecti
    // TLS: through a tunnel the peer is loopback, so verify-ca/verify-full
    // degrade to encrypt-only `require`. Direct connections honor the mode.
    let decision = crate::commands::ssh::effective_tls_decision(
-        crate::db::tls::tls_decision(config.ssl_mode.as_deref()),
+        crate::db::tls::tls_decision_for(&config.host, config.ssl_mode.as_deref()),
        target.via_tunnel,
    );
    let tls = match crate::db::tls::build_tls_config(
@@ -368,7 +368,7 @@ async fn test_mysql_connection(config: &DbConfig, ssh: &SshManager) -> TestConne
    // TLS: through a tunnel the peer is loopback, so verify-ca/verify-full
    // degrade to encrypt-only `require`. Direct connections honor the mode.
    let decision = crate::commands::ssh::effective_tls_decision(
-        crate::db::tls::tls_decision(config.ssl_mode.as_deref()),
+        crate::db::tls::tls_decision_for(&config.host, config.ssl_mode.as_deref()),
        target.via_tunnel,
    );
    match decision {
@@ -29,6 +29,37 @@ pub fn tls_decision(ssl_mode: Option<&str>) -> TlsDecision {
    }
 }
 /// Host suffixes of managed providers that reject plaintext connections with
 /// `connection is insecure (try using 'sslmode=require')`.
 const MANAGED_SSL_HOST_SUFFIXES: [&str; 3] = [".neon.tech", ".supabase.co", ".psdb.cloud"];
 /// Resolve the SSL mode to use for a connection, defaulting these managed
 /// providers to `require` when the connection carries no explicit mode.
 ///
 /// Connections saved before the UI persisted `ssl_mode` (or imported without
 /// it) would otherwise connect with TLS disabled and be refused by the server.
 /// An explicit mode always wins, so a deliberate `disable` is never overridden,
 /// and the inferred mode only encrypts — it never verifies certificates.
 pub fn resolve_ssl_mode(host: &str, ssl_mode: Option<&str>) -> Option<String> {
    if let Some(mode) = ssl_mode {
        return Some(mode.to_string());
    }
    let host = host.to_ascii_lowercase();
    if MANAGED_SSL_HOST_SUFFIXES
        .iter()
        .any(|suffix| host.ends_with(suffix))
    {
        return Some("require".to_string());
    }
    None
 }
 /// TLS decision for a connection, applying the managed-provider default from
 /// [`resolve_ssl_mode`] before mapping to a [`TlsDecision`].
 pub fn tls_decision_for(host: &str, ssl_mode: Option<&str>) -> TlsDecision {
    tls_decision(resolve_ssl_mode(host, ssl_mode).as_deref())
 }
 /// Build a rustls `ClientConfig` for tokio-postgres, or `None` for disable.
 /// `ca_path` is required for Verify; `cert_path`/`key_path` are optional client auth.
 pub fn build_tls_config(
@@ -197,6 +228,50 @@ mod tests {
        assert!(matches!(tls_decision(Some("bogus")), TlsDecision::Disable));
    }
    #[test]
    fn resolve_ssl_mode_defaults_managed_hosts_to_require() {
        // Saved connections that predate the form storing `ssl_mode` still work.
        for host in [
            "ep-hidden-star-b3hqtp4x-pooler.c-4.ap-southeast-1.aws.neon.tech",
            "db.abcdefghijklmnopqrst.supabase.co",
            "xxxx.us-east-2.psdb.cloud",
            "EP-X-POOLER.EU.AWS.NEON.TECH",
        ] {
            assert_eq!(resolve_ssl_mode(host, None).as_deref(), Some("require"));
        }
    }
    #[test]
    fn resolve_ssl_mode_leaves_other_hosts_and_explicit_modes_alone() {
        assert_eq!(resolve_ssl_mode("localhost", None), None);
        assert_eq!(resolve_ssl_mode("prod.example.com", None), None);
        // An explicit mode always wins — a deliberate `disable` is never overridden.
        assert_eq!(
            resolve_ssl_mode("ep-x.eu.aws.neon.tech", Some("disable")).as_deref(),
            Some("disable")
        );
        assert_eq!(
            resolve_ssl_mode("ep-x.eu.aws.neon.tech", Some("verify-full")).as_deref(),
            Some("verify-full")
        );
    }
    #[test]
    fn tls_decision_for_honors_managed_default_and_explicit_modes() {
        assert!(matches!(
            tls_decision_for("ep-x.eu.aws.neon.tech", None),
            TlsDecision::Require
        ));
        assert!(matches!(
            tls_decision_for("ep-x.eu.aws.neon.tech", Some("disable")),
            TlsDecision::Disable
        ));
        assert!(matches!(
            tls_decision_for("db.example.com", None),
            TlsDecision::Disable
        ));
    }
    #[test]
    fn build_tls_disable_returns_none() {
        assert!(build_tls_config(TlsDecision::Disable, None, None, None)
@@ -1,117 +1,45 @@
-//! Keychain ACL normalization for stored secrets (macOS).
+//! Keychain ACL normalization and repair for stored secrets (macOS).
 //!
 //! # Why this exists
 //!
-//! Generic-password items stored via the legacy keychain API get a default ACL
+//! Generic-password items stored via the legacy keychain API are guarded by an
-//! that grants access to "the application that created the item". When a Tauri
+//! item ACL. For a dev (linker-signed / ad-hoc) binary macOS records that ACL's
-//! app is rebuilt, its code signature changes (dev builds are ad-hoc signed, so
+//! trusted application as **the path of the executable** — not a code
-//! the identity differs on every build), and the new binary no longer matches
+//! requirement — so the item stays readable across rebuilds *as long as the
-//! the item's ACL — macOS then shows the "Gridline wants to access your
+//! binary keeps living at that path*. A properly signed bundle is recorded as a
-//! keychain" prompt.
+//! code requirement plus a `cdhash` partition list, which is stable across
 //! versions and even moves.
 //!
-//! The fix: after storing a secret, replace the item's ACL with an explicit
+//! Two failure modes follow from that:
 //! `SecAccess` whose trusted-application list contains exactly *this app*,
 //! resolved by `SecTrustedApplicationCreateFromPath(NULL)` — the current
 //! process's code-signature requirement. For a Developer ID-signed release
 //! build that requirement is stable across versions (anchored to the signing
 //! certificate), so items stay accessible without prompts through upgrades.
 //!
-//! # Prompt behavior
+//! 1. **The path changes** (monorepo move `src-tauri/` → `desktop/src-tauri/`,
 //!    app reinstalled elsewhere, release vs. dev binary). The stored paths no
 //!    longer match the running binary, so macOS treats it as a *foreign* app and
 //!    asks for the keychain password on **every** access — per secret, and with
 //!    no "Always Allow", because the item's ACL lists only other apps.
 //! 2. **A differently-signed build wrote the item** and the pin never ran again.
 //!
-//! - Item created by this build → the ACL set is silent.
+//! Pinning only after writes (`after_store`) can't repair either case: writing
-//! - Item created by an older/differently-signed build → macOS shows the
+//! to an item we can't access already needs the same authorization, so the ACL
-//!   standard one-time authorization dialog; "Always Allow" replaces the ACL
+//! is never corrected. This module therefore also *repairs before reads*.
 //!   and the prompt never reappears (the same dialog the app would show on the
 //!   first read anyway — this just makes the result permanent and clean).
 //!
-//! All operations are best-effort: `after_store` swallows errors so keychain
+//! # How the repair works
-//! writes never fail because of ACL normalization.
+//!
-
+//! [`ensure_access`] first asks, **without prompting**, whether this process is
-/// Best-effort ACL normalization after a successful keychain write.
+//! already represented in the item's ACL (see [`is_item_trusted`]). Only when it
-///
+//! is not does it call `SecKeychainItemSetAccess` with an ACL whose trusted list
-/// Resolves the service name the same way `tauri-plugin-keyring-store` does
+//! is exactly this app. That call is what macOS gates behind the authorization
-/// (the Tauri bundle identifier) and never fails the caller's operation.
+//! dialog — so a stale item costs the user **one** authorization, and every
-pub fn after_store(app: &tauri::AppHandle, account: &str) {
+//! later access (including after future rebuilds at the same path) is silent.
-    let service = app.config().identifier.clone();
+//! Items that are already trusted are left alone, so the ACL never accumulates
-    if let Err(e) = ensure_item_acl(&service, account) {
+//! duplicate entries.
-        eprintln!("[keychain_acl] skipped for {account}: {e}");
+//!
-    }
+//! All operations are best-effort: they log to stderr and never fail the
-}
+//! caller's keychain read/write.
 /// Grant this app (by its code-signature requirement) access to a keychain item.
 #[cfg(target_os = "macos")]
 pub fn ensure_item_acl(service: &str, account: &str) -> Result<(), String> {
    use core_foundation::array::CFArray;
    use core_foundation::base::{CFTypeRef, TCFType};
    use core_foundation::string::CFString;
    use security_framework::item::{ItemClass, ItemSearchOptions, Reference, SearchResult};
    use security_framework::os::macos::access::SecAccess;
    use security_framework_sys::base::SecAccessRef;
    // Locate the item WITHOUT reading its secret: a ref-only lookup
    // (`kSecReturnRef`, no data/attributes) never triggers an authorization
    // prompt, so merely probing an item we can't yet access is safe.
    let found = ItemSearchOptions::new()
        .class(ItemClass::generic_password())
        .service(service)
        .account(account)
        .load_refs(true)
        .load_data(false)
        .load_attributes(false)
        .search()
        .map_err(|e| format!("keychain item lookup failed: {e}"))?;
    let item = match found.first() {
        Some(SearchResult::Ref(Reference::KeychainItem(item))) => item,
        // No item (yet) or an unexpected result shape — nothing to normalize.
        _ => return Ok(()),
    };
    fn cvt(status: i32) -> Result<(), String> {
        if status == 0 {
            Ok(())
        } else {
            Err(format!("security framework error {status}"))
        }
    }
    // Build an access object whose trusted list is exactly this app. A NULL
    // path resolves the trusted application to the current process's code
    // signature requirement.
    unsafe {
        let mut trusted_app_ref: *mut OpaqueSecTrustedApplication = std::ptr::null_mut();
        cvt(SecTrustedApplicationCreateFromPath(std::ptr::null(), &mut trusted_app_ref))?;
        let trusted_app = SecTrustedApplication::wrap_under_create_rule(trusted_app_ref);
        let trusted_list = CFArray::from_CFTypes(&[trusted_app]);
        let descriptor = CFString::new("Gridline");
        let mut access_ref: SecAccessRef = std::ptr::null_mut();
        cvt(SecAccessCreate(
            descriptor.as_concrete_TypeRef() as CFTypeRef,
            trusted_list.as_concrete_TypeRef() as CFTypeRef,
            &mut access_ref,
        ))?;
        let access = SecAccess::wrap_under_create_rule(access_ref);
        // Replace the item's ACL. Silent when we already own the item;
        // one-time authorization dialog when the item was created by a
        // differently-signed build.
        cvt(SecKeychainItemSetAccess(
            item.as_concrete_TypeRef(),
            access.as_concrete_TypeRef(),
        ))
    }
 }
 /// Non-macOS platforms have no keychain ACL concept — nothing to do.
 #[cfg(not(target_os = "macos"))]
 pub fn ensure_item_acl(_service: &str, _account: &str) -> Result<(), String> {
    Ok(())
 }
 #[cfg(target_os = "macos")]
 mod macos_ffi {
-    use core_foundation::base::{CFTypeRef, CFTypeID};
+    use core_foundation::base::{CFTypeID, CFTypeRef};
    /// Minimal `TCFType` wrapper for `SecTrustedApplication` — the
    /// security-framework crate exposes no high-level API for it.
@@ -140,11 +68,29 @@ mod macos_ffi {
            path: CFTypeRef,
            app: *mut SecTrustedApplicationRef,
        ) -> i32;
        pub fn SecTrustedApplicationCopyData(
            app: CFTypeRef,
            data: *mut core_foundation::data::CFDataRef,
        ) -> i32;
        pub fn SecAccessCreate(
            descriptor: CFTypeRef,
-            trustedlist: CFTypeRef,
+            trustedlist: core_foundation::array::CFArrayRef,
            access: *mut security_framework_sys::base::SecAccessRef,
        ) -> i32;
        pub fn SecKeychainItemCopyAccess(
            item: security_framework_sys::base::SecKeychainItemRef,
            access: *mut security_framework_sys::base::SecAccessRef,
        ) -> i32;
        pub fn SecAccessCopyACLList(
            access: security_framework_sys::base::SecAccessRef,
            list: *mut core_foundation::array::CFArrayRef,
        ) -> i32;
        pub fn SecACLCopyContents(
            acl: CFTypeRef,
            apps: *mut core_foundation::array::CFArrayRef,
            desc: *mut core_foundation::string::CFStringRef,
            prompt: *mut u32,
        ) -> i32;
        pub fn SecKeychainItemSetAccess(
            item: security_framework_sys::base::SecKeychainItemRef,
            access: security_framework_sys::base::SecAccessRef,
@@ -152,21 +98,260 @@ mod macos_ffi {
    }
 }
 #[cfg(target_os = "macos")]
 use core_foundation::base::TCFType;
 #[cfg(target_os = "macos")]
 use macos_ffi::{
-    OpaqueSecTrustedApplication, SecAccessCreate, SecKeychainItemSetAccess, SecTrustedApplication,
+    SecACLCopyContents, SecAccessCopyACLList, SecAccessCreate, SecKeychainItemCopyAccess,
    SecKeychainItemSetAccess, SecTrustedApplication, SecTrustedApplicationCopyData,
    SecTrustedApplicationCreateFromPath,
 };
 /// Best-effort ACL normalization after a successful keychain write.
 pub fn after_store(app: &tauri::AppHandle, account: &str) {
    ensure_access(app, account);
 }
 /// Best-effort ACL repair *before* reading a secret.
 ///
 /// A stale ACL is what makes macOS ask for the keychain password on every
 /// access, so this runs before reads: it authorizes/repairs the item once and
 /// leaves it silent from then on. Prompt-free (and cheap) when the item is
 /// already trusted or does not exist.
 pub fn before_read(app: &tauri::AppHandle, account: &str) {
    ensure_access(app, account);
 }
 /// Resolve the keyring service name (the Tauri bundle identifier) and repair the
 /// item's ACL when this app is not already trusted. Never fails the caller.
 fn ensure_access(app: &tauri::AppHandle, account: &str) {
    let service = app.config().identifier.clone();
    if let Err(e) = ensure_item_acl(&service, account) {
        eprintln!("[keychain_acl] skipped for {account}: {e}");
    }
 }
 /// Make sure this app can read `account` without an authorization prompt.
 ///
 /// Idempotent and cheap when the item is already trusted (the common case):
 /// the trust check is a metadata-only, prompt-free lookup. Returns `Ok(())` when
 /// the item exists and now trusts this app, or when there is nothing to do.
 #[cfg(target_os = "macos")]
 pub fn ensure_item_acl(service: &str, account: &str) -> Result<(), String> {
    use security_framework::os::macos::access::SecAccess;
    use security_framework_sys::base::SecAccessRef;
    // Locate the item WITHOUT reading its secret: a ref-only lookup
    // (`kSecReturnRef`, no data/attributes) never triggers an authorization
    // prompt, so merely probing an item we can't yet access is safe.
    let item = match item_ref(service, account)? {
        Some(item) => item,
        // No item (yet) — nothing to normalize.
        None => return Ok(()),
    };
    // Already trusted → leave the ACL alone (repairing again would only
    // authorize-and-append a duplicate entry).
    if is_item_trusted(&item) {
        return Ok(());
    }
    fn cvt(status: i32) -> Result<(), String> {
        if status == 0 {
            Ok(())
        } else {
            Err(format!("security framework error {status}"))
        }
    }
    // Build an access object whose trusted list is exactly this app. A NULL
    // path resolves the trusted application to the current process's identity
    // (its executable path for ad-hoc dev builds, its code requirement for a
    // signed bundle).
    unsafe {
        let mut trusted_app_ref = std::ptr::null_mut();
        cvt(SecTrustedApplicationCreateFromPath(
            std::ptr::null(),
            &mut trusted_app_ref,
        ))?;
        let trusted_app = SecTrustedApplication::wrap_under_create_rule(trusted_app_ref);
        let trusted_list = core_foundation::array::CFArray::from_CFTypes(&[trusted_app]);
        let descriptor = core_foundation::string::CFString::new("Gridline");
        let mut access_ref: SecAccessRef = std::ptr::null_mut();
        cvt(SecAccessCreate(
            descriptor.as_concrete_TypeRef() as core_foundation::base::CFTypeRef,
            trusted_list.as_concrete_TypeRef(),
            &mut access_ref,
        ))?;
        let access = SecAccess::wrap_under_create_rule(access_ref);
        // Replace the item's ACL. Silent when this app already owns the item;
        // the one-time authorization dialog otherwise (this is what makes a
        // stale item permanently silent again).
        cvt(SecKeychainItemSetAccess(
            item.as_concrete_TypeRef(),
            access.as_concrete_TypeRef(),
        ))
    }
 }
 /// Ref-only lookup for a generic-password item. Prompt-free.
 #[cfg(target_os = "macos")]
 fn item_ref(
    service: &str,
    account: &str,
 ) -> Result<Option<security_framework::os::macos::keychain_item::SecKeychainItem>, String> {
    use security_framework::item::{ItemClass, ItemSearchOptions, Reference, SearchResult};
    let found = match ItemSearchOptions::new()
        .class(ItemClass::generic_password())
        .service(service)
        .account(account)
        .load_refs(true)
        .load_data(false)
        .load_attributes(false)
        .search()
    {
        Ok(found) => found,
        // `search()` reports "nothing matched" as an error, not an empty vec.
        // That is the normal case for connections without a stored secret.
        Err(e) if e.code() == security_framework_sys::base::errSecItemNotFound => return Ok(None),
        Err(e) => return Err(format!("keychain item lookup failed: {e}")),
    };
    Ok(match found.first() {
        Some(SearchResult::Ref(Reference::KeychainItem(item))) => Some(item.clone()),
        // No item or an unexpected result shape — nothing to normalize.
        _ => None,
    })
 }
 /// This process's identity as a `SecTrustedApplication`, serialized.
 ///
 /// For a signed bundle this is the code requirement; for a dev/ad-hoc binary it
 /// is the resolved executable path (NUL-terminated). Either way, byte-comparing
 /// it against an item's ACL entries tells us whether the ACL already admits us.
 #[cfg(target_os = "macos")]
 fn own_identity() -> Option<Vec<u8>> {
    unsafe {
        let mut app = std::ptr::null_mut();
        if SecTrustedApplicationCreateFromPath(std::ptr::null(), &mut app) != 0 || app.is_null() {
            return None;
        }
        let app = SecTrustedApplication::wrap_under_create_rule(app);
        let mut data: core_foundation::data::CFDataRef = std::ptr::null();
        if SecTrustedApplicationCopyData(
            app.as_concrete_TypeRef() as core_foundation::base::CFTypeRef,
            &mut data,
        ) != 0
            || data.is_null()
        {
            return None;
        }
        let bytes = std::slice::from_raw_parts(
            core_foundation::data::CFDataGetBytePtr(data),
            core_foundation::data::CFDataGetLength(data) as usize,
        )
        .to_vec();
        core_foundation::base::CFRelease(data as core_foundation::base::CFTypeRef);
        Some(bytes)
    }
 }
 /// Whether this process is already admitted by the item's ACL — **prompt-free**.
 ///
 /// True when an ACL entry's serialized trusted application is byte-identical to
 /// this process's identity, or when the item carries a `cdhash:` partition list
 /// (how macOS records access for a signed bundle — we leave those untouched).
 #[cfg(target_os = "macos")]
 fn is_item_trusted(item: &security_framework::os::macos::keychain_item::SecKeychainItem) -> bool {
    use core_foundation::array::{CFArray, CFArrayRef};
    use core_foundation::base::{CFTypeRef, TCFType};
    use core_foundation::string::{CFString, CFStringRef};
    let Some(own) = own_identity() else {
        return false;
    };
    unsafe {
        let mut access: security_framework_sys::base::SecAccessRef = std::ptr::null_mut();
        if SecKeychainItemCopyAccess(item.as_concrete_TypeRef(), &mut access) != 0
            || access.is_null()
        {
            return false;
        }
        let mut acl_list: CFArrayRef = std::ptr::null();
        if SecAccessCopyACLList(access, &mut acl_list) != 0 || acl_list.is_null() {
            return false;
        }
        let acls = CFArray::<CFTypeRef>::wrap_under_create_rule(acl_list);
        for acl in acls.iter() {
            let mut apps: CFArrayRef = std::ptr::null();
            let mut desc: CFStringRef = std::ptr::null();
            let mut prompt: u32 = 0;
            if SecACLCopyContents(*acl, &mut apps, &mut desc, &mut prompt) != 0 {
                continue;
            }
            if !desc.is_null() {
                // Signed-bundle items store a code-signing partition list here.
                if CFString::wrap_under_create_rule(desc)
                    .to_string()
                    .contains("cdhash:")
                {
                    return true;
                }
            }
            if apps.is_null() {
                continue;
            }
            let list = CFArray::<CFTypeRef>::wrap_under_create_rule(apps);
            for app in list.iter() {
                let mut data: core_foundation::data::CFDataRef = std::ptr::null();
                if SecTrustedApplicationCopyData(*app, &mut data) != 0 || data.is_null() {
                    continue;
                }
                let bytes = std::slice::from_raw_parts(
                    core_foundation::data::CFDataGetBytePtr(data),
                    core_foundation::data::CFDataGetLength(data) as usize,
                );
                if bytes == own.as_slice() {
                    return true;
                }
            }
        }
        false
    }
 }
 /// Non-macOS platforms have no keychain ACL concept — nothing to do.
 #[cfg(not(target_os = "macos"))]
 pub fn ensure_item_acl(_service: &str, _account: &str) -> Result<(), String> {
    Ok(())
 }
 #[cfg(all(test, target_os = "macos"))]
 mod tests {
    use super::*;
    use security_framework::os::macos::keychain::SecKeychain;
    use security_framework::os::macos::passwords::find_generic_password;
-    /// Real-keychain integration test: creates a generic-password item the
+    /// A missing item is a silent no-op — no lookup errors, no prompts. This is
-    /// same way the keyring store does, normalizes its ACL, verifies the
+    /// the path taken for every connection that never stored a password, so it
-    /// secret is still readable, and cleans up.
+    /// must stay cheap and quiet.
    #[test]
    fn ensure_item_acl_missing_item_is_noop() {
        let service = "com.adrianbonpin.gridline.acl-test.missing";
        let account = "definitely-not-stored";
        ensure_item_acl(service, account).expect("no-op for a missing item");
    }
    /// Real-keychain integration test: creates a generic-password item the same
    /// way the keyring store does, asserts the trust check, repairs the ACL,
    /// verifies the item is now trusted (and that repairing again is a silent
    /// no-op), reads the secret back, and cleans up.
    ///
    /// Ignored by default (`cargo test`) so CI/dev runs never touch the login
    /// keychain. Run explicitly with:
@@ -184,8 +369,21 @@ mod tests {
            .set_generic_password(service, &account, b"test-secret")
            .expect("create test item");
-        // ACL normalization must succeed on an item we just created.
+        // Fresh items are created with this build as the trusted app, so the
        // trust check must already be true and the repair a no-op.
        let item = item_ref(service, &account)
            .expect("lookup")
            .expect("item exists");
        assert!(is_item_trusted(&item), "fresh item should already trust us");
        ensure_item_acl(service, &account).expect("normalize ACL");
        assert!(
            is_item_trusted(&item),
            "item must be trusted after repair"
        );
        // Idempotent: a second repair must not need authorization again.
        ensure_item_acl(service, &account).expect("second repair");
        // The item must remain readable with the correct secret.
        let (password, item) =
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2",
  "productName": "Gridline",
-  "version": "0.8.0",
+  "version": "0.8.1",
  "identifier": "com.adrianbonpin.gridline",
  "build": {
    "beforeDevCommand": "bun run dev",
@@ -4,16 +4,19 @@ import type { ConnectionFormData } from "./connectionFormData";
 interface ConnectionMetadataRowProps {
  form: ConnectionFormData;
  onChange: (updates: Partial<ConnectionFormData>) => void;
  /** Shown when the label is empty — usually the name derived from a pasted
   *  connection string, which Test/Save uses as a fallback. */
  namePlaceholder?: string;
 }
-export function ConnectionMetadataRow({ form, onChange }: ConnectionMetadataRowProps) {
+export function ConnectionMetadataRow({ form, onChange, namePlaceholder }: ConnectionMetadataRowProps) {
  return (
    <div className="space-y-3">
      <label className="block text-sm text-text mb-1.5">Connection Label</label>
      <Input
        value={form.name}
        onChange={(value) => onChange({ name: value })}
-        placeholder="My Production Database"
+        placeholder={namePlaceholder || "My Production Database"}
        aria-label="Connection Label"
      />
    </div>
@@ -9,14 +9,17 @@ export interface DetailedConnectionFormProps {
  form: ConnectionFormData;
  onChange: (updates: Partial<ConnectionFormData>) => void;
  managedPreset?: "supabase" | "neon" | "planetscale" | null;
  /** Placeholder for the Connection Label when the field is empty, e.g. the
   *  name derived from a pasted connection string. */
  namePlaceholder?: string;
 }
-export function DetailedConnectionForm({ form, onChange, managedPreset }: DetailedConnectionFormProps) {
+export function DetailedConnectionForm({ form, onChange, managedPreset, namePlaceholder }: DetailedConnectionFormProps) {
  const [activeTab, setActiveTab] = useState<"general" | "tagsEnv" | "ssh">("general");
  return (
    <div className="space-y-4">
-      <ConnectionMetadataRow form={form} onChange={onChange} />
+      <ConnectionMetadataRow form={form} onChange={onChange} namePlaceholder={namePlaceholder} />
      <div>
        <div className="flex gap-6 border-b border-border mb-4">
          <button type="button" onClick={() => setActiveTab("general")} className={`pb-2 text-sm cursor-pointer transition-colors ${activeTab === "general" ? "text-text border-b-2 border-text" : "text-text-muted hover:text-text"}`}>General</button>
@@ -52,6 +52,60 @@ describe("NewConnectionScreen", () => {
    expect(screen.getByLabelText("User")).toHaveValue("u");
  });
  it("paste a Neon URL pre-fills every required setting, including SSL mode", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
    await user.type(
      screen.getByLabelText(/connection uri/i),
      "postgresql://neondb_owner:npg_secret@ep-hidden-star-b3hqtp4x-pooler.c-4.ap-southeast-1.aws.neon.tech/neondb?sslmode=require&channel_binding=require",
    );
    // Every field the URL can supply is filled, so no manual cleanup is needed
    expect(screen.getByLabelText("Host")).toHaveValue(
      "ep-hidden-star-b3hqtp4x-pooler.c-4.ap-southeast-1.aws.neon.tech",
    );
    expect(screen.getByLabelText("Port")).toHaveValue(5432);
    expect(screen.getByLabelText("User")).toHaveValue("neondb_owner");
    expect(screen.getByLabelText("Password")).toHaveValue("npg_secret");
    expect(screen.getByLabelText("Database")).toHaveValue("neondb");
    // The label stays untouched but is suggested from the database name.
    expect(screen.getByLabelText(/connection label/i)).toHaveValue("");
    expect(screen.getByLabelText(/connection label/i)).toHaveAttribute(
      "placeholder",
      "neondb",
    );
    // SSL mode is visible on the SSH / SSL tab...
    await user.click(screen.getByRole("button", { name: /ssh \/ ssl/i }));
    await user.click(screen.getByRole("button", { name: "SSL" }));
    expect(screen.getByRole("button", { name: "SSL Mode" })).toHaveTextContent("Require");
    // ...and reaches the save payload with no extra clicks.
    await user.click(screen.getByText("Save Connection"));
    await waitFor(() => expect(createConnection).toHaveBeenCalledTimes(1));
    expect(createConnection).toHaveBeenCalledWith(
      expect.objectContaining({
        name: "neondb",
        db_type: "postgresql",
        ssl_mode: "require",
        username: "neondb_owner",
        password: "npg_secret",
        database: "neondb",
      }),
    );
  });
  it("a typed label wins over the URL-derived suggestion", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
    await user.type(screen.getByLabelText(/connection uri/i), "postgresql://u:p@localhost:5432/db");
    await user.type(screen.getByLabelText(/connection label/i), "My DB");
    await user.click(screen.getByText("Save Connection"));
    await waitFor(() => expect(createConnection).toHaveBeenCalledTimes(1));
    expect(createConnection).toHaveBeenCalledWith(
      expect.objectContaining({ name: "My DB" }),
    );
  });
  it("clicking a provider tab reveals the form with that db_type", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
@@ -60,6 +114,19 @@ describe("NewConnectionScreen", () => {
    expect(screen.getByLabelText("Port")).toHaveValue(3306);
  });
  it("NeonDB card preselects Require SSL in the save payload", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
    await user.click(screen.getByRole("button", { name: /NeonDB/i }));
    await user.type(screen.getByLabelText(/connection label/i), "Neon prod");
    await user.type(screen.getByLabelText("Host"), "ep-x-pooler.eu.aws.neon.tech");
    await user.click(screen.getByText("Save Connection"));
    await waitFor(() => expect(createConnection).toHaveBeenCalledTimes(1));
    expect(createConnection).toHaveBeenCalledWith(
      expect.objectContaining({ name: "Neon prod", ssl_mode: "require" }),
    );
  });
  it("SQLite tab swaps the URI input for a File Path input", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
@@ -103,6 +170,20 @@ describe("NewConnectionScreen", () => {
    expect(notify).toHaveBeenCalledWith("Connection successful", "success");
  });
  it("tests a pasted URL with its SSL mode", async () => {
    const user = userEvent.setup();
    render(<NewConnectionScreen />);
    await user.type(
      screen.getByLabelText(/connection uri/i),
      "postgresql://u:p@ep-x-pooler.eu.aws.neon.tech/db?sslmode=verify-full",
    );
    await user.click(screen.getByText("Test Connection"));
    await waitFor(() => expect(testConnection).toHaveBeenCalledTimes(1));
    expect(testConnection).toHaveBeenCalledWith(
      expect.objectContaining({ ssl_mode: "verify-full" }),
    );
  });
  it("invokes onCancel when Back is clicked", async () => {
    const user = userEvent.setup();
    const onCancel = vi.fn();
@@ -9,6 +9,8 @@ import { ProviderSetupGuide } from "./ProviderSetupGuide";
 import {
    parseConnectionString,
    detectProviderFromHost,
    suggestConnectionLabel,
    type ParsedConnectionString,
 } from "../../lib/connectionString";
 import { getProviderById, type ProviderId } from "../../lib/providers";
 import { validateConnectionInput } from "../../lib/utils";
@@ -53,6 +55,10 @@ function createEmptyForm(
        database: null,
        use_keychain: true,
        ssh_password: null,
        ssl_mode: null,
        ssl_ca_path: null,
        ssl_cert_path: null,
        ssl_key_path: null,
    };
 }
@@ -64,6 +70,40 @@ function getDefaultPort(dbType: string): number {
    );
 }
 type ManagedPreset = "supabase" | "neon" | "planetscale" | null;
 /** Managed-provider highlight for a parsed URL (Postgres/MySQL hosts only). */
 function providerForParsed(parsed: ParsedConnectionString): ManagedPreset {
    return parsed.db_type === "postgresql" || parsed.db_type === "mysql"
        ? detectProviderFromHost(parsed.host)
        : null;
 }
 /**
 * Everything a pasted connection string can populate, so the connection can be
 * tested and saved with no manual cleanup: connection type, host, port,
 * user/password/database, and the `?sslmode=` TLS mode.
 *
 * The URL's SSL mode wins when present; otherwise the mode the user already
 * picked under SSH / SSL is kept. The label is left blank when the user has not
 * typed one (the derived name is offered as a placeholder and used on save by
 * `buildPayload`), so a suggestion never clobbers or gets appended to.
 */
 function parsedFormPatch(
    parsed: ParsedConnectionString,
    prev: ConnectionFormData,
 ): Partial<ConnectionFormData> {
    return {
        db_type: parsed.db_type,
        host: parsed.host,
        port: parsed.port ?? getDefaultPort(parsed.db_type),
        username: parsed.username,
        password: parsed.password,
        database: parsed.database,
        ssl_mode: parsed.ssl_mode ?? prev.ssl_mode ?? null,
    };
 }
 export function NewConnectionScreen({
    defaultFolderId = null,
    prefilledConnectionString = "",
@@ -73,9 +113,7 @@ export function NewConnectionScreen({
    onCancel,
 }: NewConnectionScreenProps) {
    const [stage, setStage] = useState<Stage>("entry");
-    const [managedPreset, setManagedPreset] = useState<
+    const [managedPreset, setManagedPreset] = useState<ManagedPreset>(null);
        "supabase" | "neon" | "planetscale" | null
    >(null);
    const [form, setForm] = useState<ConnectionFormData>(() =>
        createEmptyForm(
            defaultFolderId,
@@ -86,6 +124,12 @@ export function NewConnectionScreen({
    const [saveLoading, setSaveLoading] = useState(false);
    const createConnection = useConnectionStore((s) => s.createConnection);
    const notify = useNotificationStore((s) => s.notify);
    // Name to use when the label is left blank: derived from the pasted URL
    // (database name, else host/file stem). Shown as the Connection Label's
    // placeholder and applied at save/test time, so a suggestion never
    // clobbers or gets appended to typed text.
    const parsedUri = parseConnectionString(form.connection_string);
    const suggestedName = parsedUri ? suggestConnectionLabel(parsedUri) : "";
    const revealConfigured = useCallback(
        (updates: Partial<ConnectionFormData>) => {
@@ -97,26 +141,17 @@ export function NewConnectionScreen({
    const handleConnectionStringChange = useCallback((value: string) => {
        const parsed = parseConnectionString(value);
-        if (parsed) {
+        if (!parsed) {
-            const provider =
+            setManagedPreset(null);
-                parsed.db_type === "postgresql" || parsed.db_type === "mysql"
+            setForm((prev) => ({ ...prev, connection_string: value }));
-                    ? detectProviderFromHost(parsed.host)
+            return;
-                    : null;
+        }
-            setManagedPreset(provider);
+        setManagedPreset(providerForParsed(parsed));
        setForm((prev) => ({
            ...prev,
            connection_string: value,
-                db_type: parsed.db_type,
+            ...parsedFormPatch(parsed, prev),
                host: parsed.host,
                port: parsed.port ?? getDefaultPort(parsed.db_type),
                username: parsed.username,
                password: parsed.password,
                database: parsed.database,
        }));
        } else {
            setManagedPreset(null);
            setForm((prev) => ({ ...prev, connection_string: value }));
        }
    }, []);
    useEffect(() => {
@@ -150,7 +185,15 @@ export function NewConnectionScreen({
                        ? null
                        : getDefaultPort(provider.dbType),
                ...(provider.dbType === "sqlite" ? { host: "" } : {}),
-                ...(id === "planetscale" ? { ssl_mode: "verify-full" } : {}),
+                // Managed providers refuse plaintext connections. Preselect
                // their documented mode so Test/Save works on the first try.
                // (PlanetScale/MySQL requires identity verification.)
                ...(id === "planetscale"
                    ? { ssl_mode: "verify-full" as const }
                    : {}),
                ...(id === "supabase" || id === "neon"
                    ? { ssl_mode: "require" as const }
                    : {}),
            });
        },
        [revealConfigured],
@@ -166,22 +209,11 @@ export function NewConnectionScreen({
                    const value = updates.connection_string;
                    const parsed = parseConnectionString(value);
                    if (parsed) {
-                        const provider =
+                        setManagedPreset(providerForParsed(parsed));
                            parsed.db_type === "postgresql" || parsed.db_type === "mysql"
                                ? detectProviderFromHost(parsed.host)
                                : null;
                        setManagedPreset(provider);
                        return {
                            ...prev,
                            ...updates,
-                            db_type: parsed.db_type,
+                            ...parsedFormPatch(parsed, prev),
                            host: parsed.host,
                            port:
                                parsed.port ??
                                getDefaultPort(parsed.db_type),
                            username: parsed.username,
                            password: parsed.password,
                            database: parsed.database,
                        };
                    }
                    return { ...prev, ...updates };
@@ -194,7 +226,7 @@ export function NewConnectionScreen({
    const buildPayload = useCallback((): ConnectionInput => {
        return {
-            name: form.name,
+            name: form.name.trim() || suggestedName,
            db_type: form.db_type,
            host: form.host,
            port: form.port,
@@ -213,8 +245,12 @@ export function NewConnectionScreen({
            ssh_private_key_path: form.ssh_private_key ?? null,
            ssh_password: form.ssh_password ?? null,
            ssh_passphrase: form.ssh_passphrase ?? null,
            ssl_mode: form.ssl_mode ?? null,
            ssl_ca_path: form.ssl_ca_path ?? null,
            ssl_cert_path: form.ssl_cert_path ?? null,
            ssl_key_path: form.ssl_key_path ?? null,
        };
-    }, [form]);
+    }, [form, suggestedName]);
    const validate = useCallback((): string | null => {
        const result = validateConnectionInput(buildPayload());
@@ -336,6 +372,7 @@ export function NewConnectionScreen({
                    <DetailedConnectionForm
                        form={form}
                        onChange={updateForm}
                        namePlaceholder={suggestedName || undefined}
                    />
                </>
            )}
@@ -1,5 +1,5 @@
 import { describe, it, expect, vi } from "vitest";
-import { render, screen } from "@testing-library/react";
+import { render, screen, fireEvent } from "@testing-library/react";
 import { SslFields } from "./SslFields";
 const notify = vi.fn();
@@ -35,4 +35,33 @@ describe("SslFields", () => {
    expect(screen.queryByLabelText("Client Certificate")).not.toBeInTheDocument();
    expect(screen.queryByLabelText("Client Key")).not.toBeInTheDocument();
  });
  it("writes certificate paths under the names the backend persists", () => {
    // Regression guard: these used to be ssl_ca_cert / ssl_client_cert /
    // ssl_client_key, which the Rust ConnectionInput silently ignores — the
    // connection was then saved with TLS disabled.
    const onChange = vi.fn();
    render(
      <SslFields
        values={{ ssl_mode: "verify-full", ssl_ca_path: "/tmp/ca.pem" }}
        onChange={onChange}
      />,
    );
    expect(screen.getByLabelText("CA Certificate")).toHaveValue("/tmp/ca.pem");
    fireEvent.change(screen.getByLabelText("CA Certificate"), {
      target: { value: "/tmp/root.pem" },
    });
    expect(onChange).toHaveBeenLastCalledWith({ ssl_ca_path: "/tmp/root.pem" });
    fireEvent.change(screen.getByLabelText("Client Certificate"), {
      target: { value: "/tmp/client.pem" },
    });
    expect(onChange).toHaveBeenLastCalledWith({ ssl_cert_path: "/tmp/client.pem" });
    fireEvent.change(screen.getByLabelText("Client Key"), {
      target: { value: "/tmp/client.key" },
    });
    expect(onChange).toHaveBeenLastCalledWith({ ssl_key_path: "/tmp/client.key" });
  });
 });
@@ -55,14 +55,14 @@ export function SslFields({ values, onChange }: SslFieldsProps) {
            <label className="block text-sm text-text mb-1.5">CA Certificate</label>
            <div className="flex gap-2">
              <Input
-                value={(values.ssl_ca_cert as string) ?? ""}
+                value={(values.ssl_ca_path as string) ?? ""}
-                onChange={(value) => onChange({ ssl_ca_cert: value })}
+                onChange={(value) => onChange({ ssl_ca_path: value })}
                placeholder="/path/to/ca-cert.pem"
                aria-label="CA Certificate"
              />
              <button
                type="button"
-                onClick={() => handlePickFile("ssl_ca_cert")}
+                onClick={() => handlePickFile("ssl_ca_path")}
                className="px-4 py-2 rounded-full bg-surface border border-border text-sm text-text hover:bg-surface-raised transition-colors cursor-pointer"
              >
                Browse
@@ -74,14 +74,14 @@ export function SslFields({ values, onChange }: SslFieldsProps) {
            <label className="block text-sm text-text mb-1.5">Client Certificate</label>
            <div className="flex gap-2">
              <Input
-                value={(values.ssl_client_cert as string) ?? ""}
+                value={(values.ssl_cert_path as string) ?? ""}
-                onChange={(value) => onChange({ ssl_client_cert: value })}
+                onChange={(value) => onChange({ ssl_cert_path: value })}
                placeholder="/path/to/client-cert.pem"
                aria-label="Client Certificate"
              />
              <button
                type="button"
-                onClick={() => handlePickFile("ssl_client_cert")}
+                onClick={() => handlePickFile("ssl_cert_path")}
                className="px-4 py-2 rounded-full bg-surface border border-border text-sm text-text hover:bg-surface-raised transition-colors cursor-pointer"
              >
                Browse
@@ -93,14 +93,14 @@ export function SslFields({ values, onChange }: SslFieldsProps) {
            <label className="block text-sm text-text mb-1.5">Client Key</label>
            <div className="flex gap-2">
              <Input
-                value={(values.ssl_client_key as string) ?? ""}
+                value={(values.ssl_key_path as string) ?? ""}
-                onChange={(value) => onChange({ ssl_client_key: value })}
+                onChange={(value) => onChange({ ssl_key_path: value })}
                placeholder="/path/to/client-key.pem"
                aria-label="Client Key"
              />
              <button
                type="button"
-                onClick={() => handlePickFile("ssl_client_key")}
+                onClick={() => handlePickFile("ssl_key_path")}
                className="px-4 py-2 rounded-full bg-surface border border-border text-sm text-text hover:bg-surface-raised transition-colors cursor-pointer"
              >
                Browse
@@ -1,5 +1,6 @@
 import type { DbType } from "../../lib/types";
 import type { Environment } from "./EnvironmentSelect";
 import type { SslMode } from "../../lib/connectionString";
 export interface ConnectionFormData {
  name: string;
@@ -24,4 +25,13 @@ export interface ConnectionFormData {
  ssh_private_key?: string | null;
  ssh_password: string | null;
  ssh_passphrase?: string | null;
  // SSL/TLS fields. These must live on the form data (and survive into the
  // submit payload) or the SSH/SSL tab's selections are silently dropped — the
  // backend then connects with TLS disabled, which managed providers (Neon,
  // Supabase, PlanetScale) reject with "connection is insecure".
  // `null` = unset, which the backend treats as TLS disabled.
  ssl_mode?: SslMode | null;
  ssl_ca_path?: string | null;
  ssl_cert_path?: string | null;
  ssl_key_path?: string | null;
 }
@@ -10,18 +10,23 @@ const { updateConnection, loadAll } = vi.hoisted(() => ({
 }));
 vi.mock("../../stores/connectionStore", () => ({
-  useConnectionStore: (sel: (s: any) => any) =>
+  useConnectionStore: Object.assign(
    (sel: (s: any) => any) =>
      sel({ updateConnection, loadAll, folders: [], tags: [] }),
    { getState: () => ({ getConnectionPassword: async () => "pw" }) },
  ),
 }));
 vi.mock("../../lib/commands", async (importOriginal) => {
  const actual = await importOriginal<typeof import("../../lib/commands")>();
  return {
    ...actual,
    updateConnection: vi.fn(),
-    testConnection: vi.fn(),
+    testConnection: vi.fn().mockResolvedValue({ ok: true }),
    saveConnectionPassword: vi.fn(),
    saveConnectionSshPassword: vi.fn(),
    saveConnectionSshPassphrase: vi.fn(),
    getConnectionSshPassword: vi.fn().mockResolvedValue(null),
    getConnectionSshPassphrase: vi.fn().mockResolvedValue(null),
    deleteConnectionPassword: vi.fn(),
  };
 });
@@ -121,4 +126,62 @@ describe("EditConnectionModal", () => {
    );
    expect(vi.mocked(commands.saveConnectionPassword)).not.toHaveBeenCalled();
  });
  it("persists the existing SSL settings on save", async () => {
    render(
      <EditConnectionModal
        connection={{
          ...baseConn,
          ssl_mode: "verify-full",
          ssl_ca_path: "/tmp/ca.pem",
          ssl_cert_path: "/tmp/client.pem",
          ssl_key_path: "/tmp/client.key",
        }}
        open={true}
        onClose={() => {}}
        onSaved={() => {}}
      />
    );
    fireEvent.click(screen.getByRole("button", { name: /^save$/i }));
    await waitFor(() => expect(vi.mocked(commands.updateConnection)).toHaveBeenCalled());
    expect(vi.mocked(commands.updateConnection)).toHaveBeenCalledWith(
      "c1",
      expect.objectContaining({
        ssl_mode: "verify-full",
        ssl_ca_path: "/tmp/ca.pem",
        ssl_cert_path: "/tmp/client.pem",
        ssl_key_path: "/tmp/client.key",
      }),
    );
  });
  it("tests with the same SSL + SSH config it would save", async () => {
    render(
      <EditConnectionModal
        connection={{
          ...baseConn,
          ssl_mode: "require",
          ssh_host: "jump.example.com",
          ssh_port: 22,
          ssh_user: "tunnel",
          ssh_auth_method: "key",
          ssh_private_key_path: "/tmp/id_ed25519",
        }}
        open={true}
        onClose={() => {}}
        onSaved={() => {}}
      />
    );
    fireEvent.click(screen.getByRole("button", { name: /^test$/i }));
    await waitFor(() => expect(vi.mocked(commands.testConnection)).toHaveBeenCalled());
    expect(vi.mocked(commands.testConnection)).toHaveBeenCalledWith(
      expect.objectContaining({
        ssl_mode: "require",
        ssh_host: "jump.example.com",
        ssh_user: "tunnel",
        ssh_auth_method: "key",
        ssh_private_key_path: "/tmp/id_ed25519",
      }),
    );
  });
 });
@@ -4,9 +4,9 @@ import { Button } from "../ui/Button";
 import { DetailedConnectionForm } from "../connections/DetailedConnectionForm";
 import { useConnectionStore } from "../../stores/connectionStore";
 import { useNotificationStore } from "../../stores/notificationStore";
-import { updateConnection, testConnection, saveConnectionSshPassword, saveConnectionSshPassphrase } from "../../lib/commands";
+import { updateConnection, testConnection, saveConnectionSshPassword, saveConnectionSshPassphrase, getConnectionSshPassword, getConnectionSshPassphrase } from "../../lib/commands";
 import { persistDbPassword } from "../../lib/keychain";
-import { detectProviderFromHost } from "../../lib/connectionString";
+import { detectProviderFromHost, type SslMode } from "../../lib/connectionString";
 import type { Connection, ConnectionInput } from "../../lib/types";
 import type { ConnectionFormData } from "../connections/connectionFormData";
@@ -47,6 +47,10 @@ export function EditConnectionModal({
    ssh_private_key: connection.ssh_private_key_path ?? null,
    ssh_password: null,
    ssh_passphrase: null,
    ssl_mode: (connection.ssl_mode as SslMode | null | undefined) ?? null,
    ssl_ca_path: connection.ssl_ca_path ?? null,
    ssl_cert_path: connection.ssl_cert_path ?? null,
    ssl_key_path: connection.ssl_key_path ?? null,
  }));
  const [saving, setSaving] = useState(false);
  const [testing, setTesting] = useState(false);
@@ -75,6 +79,10 @@ export function EditConnectionModal({
        ssh_private_key_path: form.ssh_private_key ?? null,
        ssh_password: form.ssh_password ?? null,
        ssh_passphrase: form.ssh_passphrase ?? null,
        ssl_mode: form.ssl_mode ?? null,
        ssl_ca_path: form.ssl_ca_path ?? null,
        ssl_cert_path: form.ssl_cert_path ?? null,
        ssl_key_path: form.ssl_key_path ?? null,
      };
      const updated = await updateConnection(connection.id, input);
      await persistDbPassword(connection.id, form.use_keychain, form.password).catch(() => {});
@@ -104,6 +112,18 @@ export function EditConnectionModal({
      if (!password) {
        password = await useConnectionStore.getState().getConnectionPassword(connection.id).catch(() => null);
      }
      // SSH secrets live in the keychain only, so a tunneled connection can be
      // tested without re-entering them.
      const sshPassword =
        form.ssh_password ??
        (form.ssh_host
          ? await getConnectionSshPassword(connection.id).catch(() => null)
          : null);
      const sshPassphrase =
        form.ssh_passphrase ??
        (form.ssh_host
          ? await getConnectionSshPassphrase(connection.id).catch(() => null)
          : null);
      const result = await testConnection({
        name: form.name,
@@ -116,7 +136,19 @@ export function EditConnectionModal({
        folder_id: form.folder_id,
        environment: form.environment,
        tag_ids: form.tag_ids,
-        ssh_password: form.ssh_password ?? null,
+        // Test the same config Save would persist — a tunneled/SSL connection
        // must be probed through its tunnel and TLS mode.
        ssh_host: form.ssh_host ?? null,
        ssh_port: form.ssh_port ?? null,
        ssh_user: form.ssh_user ?? null,
        ssh_auth_method: form.ssh_auth_method ?? null,
        ssh_private_key_path: form.ssh_private_key ?? null,
        ssh_password: sshPassword,
        ssh_passphrase: sshPassphrase,
        ssl_mode: form.ssl_mode ?? null,
        ssl_ca_path: form.ssl_ca_path ?? null,
        ssl_cert_path: form.ssl_cert_path ?? null,
        ssl_key_path: form.ssl_key_path ?? null,
      });
      if (result.ok) {
        notify("Connection successful", "success");
@@ -1,11 +1,11 @@
 import { describe, it, expect } from "vitest";
 import tauriConf from "../../src-tauri/tauri.conf.json";
-describe("tauri bundle config (v0.8.0)", () => {
+describe("tauri bundle config (v0.8.1)", () => {
  it("declares bundled pg_tools resources", () => {
    expect(tauriConf.bundle.resources).toContain("resources/pg_tools/*");
  });
-  it("version is 0.8.0", () => {
+  it("version is 0.8.1", () => {
-    expect(tauriConf.version).toBe("0.8.0");
+    expect(tauriConf.version).toBe("0.8.1");
  });
 });
@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { parseConnectionString, looksLikeConnectionString, detectProviderFromHost, buildConnectionUrl } from "./connectionString";
+import { parseConnectionString, looksLikeConnectionString, detectProviderFromHost, buildConnectionUrl, suggestConnectionLabel } from "./connectionString";
 import type { Connection } from "./types";
 function makeConn(overrides: Partial<Connection> = {}): Connection {
@@ -30,6 +30,7 @@ describe("parseConnectionString", () => {
      username: "user",
      password: "pass",
      database: "mydb",
      ssl_mode: null,
    });
  });
@@ -42,6 +43,7 @@ describe("parseConnectionString", () => {
      username: "root",
      password: null,
      database: "app",
      ssl_mode: null,
    });
  });
@@ -54,6 +56,7 @@ describe("parseConnectionString", () => {
      username: "user",
      password: "pass",
      database: "0",
      ssl_mode: null,
    });
  });
@@ -66,6 +69,7 @@ describe("parseConnectionString", () => {
      username: null,
      password: null,
      database: null,
      ssl_mode: null,
    });
  });
@@ -78,6 +82,7 @@ describe("parseConnectionString", () => {
      username: null,
      password: null,
      database: null,
      ssl_mode: null,
    });
  });
@@ -90,6 +95,7 @@ describe("parseConnectionString", () => {
      username: "user",
      password: null,
      database: "db",
      ssl_mode: null,
    });
  });
@@ -102,12 +108,51 @@ describe("parseConnectionString", () => {
      username: "user",
      password: null,
      database: "db",
      ssl_mode: "require",
    });
  });
  it("returns null for an empty string", () => {
    expect(parseConnectionString("")).toBeNull();
  });
  it("lifts sslmode from a Neon-style URL (extra params ignored)", () => {
    const result = parseConnectionString(
      "postgresql://neondb_owner:pw@ep-hidden-star-b3hqtp4x-pooler.c-4.ap-southeast-1.aws.neon.tech/neondb?sslmode=require&channel_binding=require",
    );
    expect(result).toMatchObject({
      db_type: "postgresql",
      host: "ep-hidden-star-b3hqtp4x-pooler.c-4.ap-southeast-1.aws.neon.tech",
      username: "neondb_owner",
      password: "pw",
      database: "neondb",
      ssl_mode: "require",
    });
  });
  it("lifts every supported sslmode value", () => {
    const mode = (q: string) => parseConnectionString(`postgresql://u@h/db?sslmode=${q}`)?.ssl_mode;
    expect(mode("disable")).toBe("disable");
    expect(mode("require")).toBe("require");
    expect(mode("verify-ca")).toBe("verify-ca");
    expect(mode("verify-full")).toBe("verify-full");
    expect(mode("VERIFY-FULL")).toBe("verify-full");
    expect(mode("verify_full")).toBe("verify-full");
  });
  it("ignores unsupported sslmode values instead of downgrading to plaintext", () => {
    expect(parseConnectionString("postgresql://u@h/db?sslmode=allow")?.ssl_mode).toBeNull();
    expect(parseConnectionString("postgresql://u@h/db?sslmode=prefer")?.ssl_mode).toBeNull();
    expect(parseConnectionString("postgresql://u@h/db?sslmode=bogus")?.ssl_mode).toBeNull();
  });
  it("lifts MySQL's ssl-mode vocabulary and skips TLS for non-SQL db types", () => {
    expect(parseConnectionString("mysql://u@h/db?ssl-mode=REQUIRED")?.ssl_mode).toBe("require");
    expect(parseConnectionString("mysql://u@h/db?ssl-mode=verify-full")?.ssl_mode).toBe("verify-full");
    expect(parseConnectionString("mysql://u@h/db?ssl-mode=VERIFY_IDENTITY")?.ssl_mode).toBe("verify-full");
    expect(parseConnectionString("mysql://u@h/db?ssl-mode=PREFERRED")?.ssl_mode).toBeNull();
    expect(parseConnectionString("redis://u@h?sslmode=require")?.ssl_mode).toBeNull();
    expect(parseConnectionString("sqlite:///tmp/a.db?sslmode=require")?.ssl_mode).toBeNull();
  });
  it("returns null for a non-URL string", () => {
    expect(parseConnectionString("hello world")).toBeNull();
@@ -122,6 +167,7 @@ describe("parseConnectionString", () => {
      username: "user",
      password: null,
      database: "db",
      ssl_mode: null,
    });
  });
@@ -134,6 +180,7 @@ describe("parseConnectionString", () => {
      username: "root",
      password: "pw",
      database: "app",
      ssl_mode: null,
    });
  });
@@ -146,6 +193,7 @@ describe("parseConnectionString", () => {
      username: "root",
      password: "pw",
      database: "app",
      ssl_mode: null,
    });
  });
@@ -158,6 +206,7 @@ describe("parseConnectionString", () => {
      username: null,
      password: null,
      database: null,
      ssl_mode: null,
    });
  });
 });
@@ -180,6 +229,33 @@ describe("looksLikeConnectionString", () => {
  });
 });
 describe("suggestConnectionLabel", () => {
  const label = (url: string) => {
    const parsed = parseConnectionString(url)!;
    return suggestConnectionLabel(parsed);
  };
  it("prefers the database name", () => {
    expect(
      label("postgresql://neondb_owner:pw@ep-x-pooler.c-4.ap-southeast-1.aws.neon.tech/neondb?sslmode=require"),
    ).toBe("neondb");
  });
  it("falls back to the host when there is no database", () => {
    expect(label("postgresql://u@db.example.com:5432")).toBe("db.example.com");
  });
  it("uses the file stem for SQLite paths", () => {
    expect(label("sqlite:///Users/me/data/app-demo.sqlite")).toBe("app-demo");
    expect(label("file:///tmp/notes.db")).toBe("notes");
  });
  it("caps the label at the 100-char validation limit", () => {
    const host = `${"a".repeat(120)}.example.com`;
    expect(label(`postgresql://u@${host}/`).length).toBe(100);
  });
 });
 describe("detectProviderFromHost", () => {
    it("detects Supabase by host suffix", () => {
      expect(detectProviderFromHost("db.abcdefghijklmnopqrst.supabase.co")).toBe("supabase");
@@ -291,6 +367,7 @@ describe("buildConnectionUrl", () => {
      username: "user",
      password: "pass",
      database: "mydb",
      ssl_mode: null,
    });
  });
 });
@@ -7,6 +7,53 @@ export interface ParsedConnectionString {
  username: string | null;
  password: string | null;
  database: string | null;
  /** SSL mode lifted from the URL's `sslmode` / `ssl-mode` query param, or
   *  `null` when absent/unsupported. Keeps managed-PostgreSQL URLs (Neon,
   *  Supabase, …) working — they ship with `?sslmode=require` and the server
   *  rejects a plaintext connection with "connection is insecure". */
  ssl_mode: SslMode | null;
 }
 /** SSL modes the backend understands (mirrors `DbConfig.ssl_mode`). */
 export type SslMode = "disable" | "require" | "verify-ca" | "verify-full";
 /** Alternate spellings used by other clients, mapped onto our four modes:
 *  MySQL's `ssl-mode` vocabulary (`REQUIRED`, `VERIFY_IDENTITY`, …) and
 *  plural forms. `allow` / `prefer` are intentionally absent — they permit a
 *  plaintext fallback, which our mode set cannot express, so they return
 *  `null` and the caller keeps its current/default mode. */
 const SSL_MODE_ALIASES: Record<string, SslMode> = {
  disable: "disable",
  disabled: "disable",
  require: "require",
  required: "require",
  "verify-ca": "verify-ca",
  "verify-full": "verify-full",
  // MySQL's strongest mode: chain + hostname verification.
  "verify-identity": "verify-full",
 };
 /**
 * Extract the TLS mode from a connection URL's query string.
 *
 * Accepts libpq's `sslmode` (PostgreSQL) and MySQL's `ssl-mode` spelling,
 * case-insensitively and hyphen/underscore-insensitively (`verify-full`,
 * `verify_full`, `VERIFY-FULL`, …). Unsupported values (`allow`, `prefer`)
 * return `null` so the caller keeps its current/default mode rather than
 * silently downgrading to plaintext.
 */
 function parseSslMode(url: URL): SslMode | null {
  let raw: string | null = null;
  for (const [key, value] of url.searchParams) {
    const k = key.toLowerCase();
    if (k === "sslmode" || k === "ssl-mode") {
      raw = value;
      break;
    }
  }
  if (!raw) return null;
  const normalized = raw.trim().toLowerCase().replace(/_/g, "-");
  return SSL_MODE_ALIASES[normalized] ?? null;
 }
 const DB_PROTOCOLS: Record<string, DbType> = {
@@ -68,6 +115,9 @@ export function parseConnectionString(input: string): ParsedConnectionString | n
    username,
    password,
    database,
    ssl_mode: db_type === "postgresql" || db_type === "mysql" || db_type === "mariadb"
      ? parseSslMode(url)
      : null,
  };
 }
@@ -95,6 +145,25 @@ export function detectProviderFromHost(
  return null;
 }
 /**
 * Suggest a connection label for a freshly pasted connection string, so the
 * connection can be saved without typing a name first.
 *
 * Preference order: the database name, then (for SQLite) the file stem, then
 * the host. Capped at 100 chars to satisfy `validateConnectionInput`, which
 * rejects longer names.
 */
 export function suggestConnectionLabel(parsed: ParsedConnectionString): string {
  let label: string;
  if (parsed.db_type === "sqlite") {
    const file = parsed.host.split(/[\\/]/).pop() ?? "";
    label = file.replace(/\.(sqlite3?|db)$/i, "") || file;
  } else {
    label = parsed.database?.replace(/^\/+/, "") || parsed.host;
  }
  return label.trim().slice(0, 100);
 }
 /**
 * Build a connection URL string from a saved connection, for copying into
 * env vars / other tools. `password` is the decrypted keychain value (or
@@ -5,7 +5,7 @@ import agents from "../../../AGENTS.md?raw";
 import readme from "../../../README.md?raw";
 import landing from "../../../www/public/landing.js?raw";
-describe("v0.8.0 docs coverage", () => {
+describe("v0.8.1 docs coverage", () => {
  it("AGENTS.md marks inline cell editing complete", () => {
    expect(agents).toContain("Inline cell editing");
    expect(agents).toMatch(/Inline cell editing \| ✅/);
@@ -25,8 +25,8 @@ describe("v0.8.0 docs coverage", () => {
    expect(agents).toMatch(/Connection status indicator on cards \| ✅/);
    expect(agents).toMatch(/Move-to-folder bulk action \| ✅/);
  });
-  it("README declares v0.8.0", () => {
+  it("README declares v0.8.1", () => {
-    expect(readme).toContain("0.8.0");
+    expect(readme).toContain("0.8.1");
  });
  it("AGENTS.md marks schema CRUD complete", () => {
    expect(agents).toMatch(/Schema CRUD \| ✅/);
@@ -65,12 +65,12 @@ describe("v0.8.0 docs coverage", () => {
    expect(agents).toMatch(/Cancel long-running queries \| ✅/);
    expect(agents).toMatch(/Settings export\/import \| ✅/);
  });
-  it("README links to v0.8.0 assets in both download tables", () => {
+  it("README links to v0.8.1 assets in both download tables", () => {
-    expect(readme).toContain("releases/download/v0.8.0/");
+    expect(readme).toContain("releases/download/v0.8.1/");
-    expect(readme).toContain("Gridline_0.8.0_aarch64.dmg");
+    expect(readme).toContain("Gridline_0.8.1_aarch64.dmg");
-    expect(readme).toContain("Gridline-0.8.0-1.x86_64.rpm");
+    expect(readme).toContain("Gridline-0.8.1-1.x86_64.rpm");
  });
-  it("landing.js platform download links point to v0.8.0", () => {
+  it("landing.js platform download links point to v0.8.1", () => {
-    expect(landing).toContain('const version = "0.8.0"');
+    expect(landing).toContain('const version = "0.8.1"');
  });
 });
@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import pkg from "../../package.json";
 describe("version", () => {
-  it("declares v0.8.0 across the app shell", () => {
+  it("declares v0.8.1 across the app shell", () => {
-    expect(pkg.version).toBe("0.8.0");
+    expect(pkg.version).toBe("0.8.1");
  });
 });
@@ -60,7 +60,7 @@
    const keepLabel = downloadBtn.hasAttribute("data-download-label");
    const releasesUrl = "https://github.com/AdrianBonpin/gridline/releases";
-    const version = "0.8.0";
+    const version = "0.8.1";
    if (isMobile) {
      downloadBtn.href = releasesUrl;
@@ -5,6 +5,15 @@ export interface ChangelogEntry {
 }
 export const changelogEntries: ChangelogEntry[] = [
  {
    version: "0.8.1",
    date: "2026-09-24",
    highlights: [
      "Managed-provider connections fixed — pasting a Neon / Supabase / PlanetScale connection string now carries its `?sslmode=` into the saved connection (it was silently dropped, so TLS stayed off and Neon answered `connection is insecure (try using sslmode=require)`). The SSH / SSL tab's mode and certificate paths are now persisted on create *and* edit, and the managed presets pre-select their TLS mode (Supabase / Neon → Require, PlanetScale → Verify Full). As a safety net, hosts under `*.neon.tech` / `*.supabase.co` / `*.psdb.cloud` default to `require` when a connection has no stored mode, so connections saved before this fix keep working.",
      "Pasting a connection URI fills every setting it can — type, host, port, user, password, database and TLS mode — and suggests a name from the URL (database name, else host), which Test and Save use when the label is left blank. A pasted URL can now be tested and saved with no retyping.",
      "macOS keychain prompts now self-heal — an item whose ACL still points at an older binary path (the pre-monorepo `src-tauri/` layout, a reinstalled app, an ad-hoc dev build) made macOS ask for your keychain password on *every* access, once per secret, with no way to make it stick. The app now checks the item's ACL (silently) before reading and repairs it when needed, so you authorize a secret once and it stays silent afterwards.",
    ],
  },
  {
    version: "0.8.0",
    date: "2026-09-09",
@@ -15,7 +15,7 @@ import queryEditor from "../assets/screenshots/query-editor.png";
 import erDiagram from "../assets/screenshots/er-diagram.png";
 import home from "../assets/screenshots/home.png";
 import dataGrid from "../assets/screenshots/data-grid.png";
-const version = "0.8.0";
+const version = "0.8.1";
 const site = "https://getgridline.app";
 const jsonLd = [
  buildSoftwareApplicationJsonLd({