From 718a3a9063c2f897ab7bbb666138aa77a477b037 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:00:31 +1100
Subject: [PATCH] Stop vctx format scan at --; limit raw to vault read

---
 docs/vctx.md      | 2 +-
 vctx/main.go      | 8 ++++++--
 vctx/main_test.go | 1 +
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/docs/vctx.md b/docs/vctx.md
index 66afc25..02f113f 100644
--- a/docs/vctx.md
+++ b/docs/vctx.md
@@ -48,7 +48,7 @@ Without `--format`, `vctx` sets `VAULT_FORMAT` from the vault command:
 
 It is left alone when `VAULT_FORMAT` is already set in the environment or the
 vault args include `-format` or `-field`. `--format` (`table`, `json`, `yaml`,
-`pretty`, `raw`) always sets it.
+`pretty`; `raw` for `vault read` only) always sets it.
 
 ## Flags
 
diff --git a/vctx/main.go b/vctx/main.go
index e6358da..5b8ad6e 100644
--- a/vctx/main.go
+++ b/vctx/main.go
@@ -68,7 +68,7 @@ func newRootCmd() *cobra.Command {
 	})
 	root.Flags().StringVar(&format, "format", "", "VAULT_FORMAT for this call (default: picked from the vault command)")
 	_ = root.RegisterFlagCompletionFunc("format", cobra.FixedCompletions(
-		[]string{"table", "json", "yaml", "pretty", "raw"}, cobra.ShellCompDirectiveNoFileComp))
+		[]string{"table", "json", "yaml", "pretty"}, cobra.ShellCompDirectiveNoFileComp))
 
 	root.AddCommand(&cobra.Command{
 		Use:          "version",
@@ -166,7 +166,11 @@ func autoFormat(args, baseEnv []string) string {
 		}
 	}
 	var pos []string
-	for _, a := range args {
+	for i, a := range args {
+		if a == "--" {
+			pos = append(pos, args[i+1:]...)
+			break
+		}
 		name, _, _ := strings.Cut(strings.TrimLeft(a, "-"), "=")
 		switch {
 		case !strings.HasPrefix(a, "-"):
diff --git a/vctx/main_test.go b/vctx/main_test.go
index f8612ea..7613fe2 100644
--- a/vctx/main_test.go
+++ b/vctx/main_test.go
@@ -214,6 +214,7 @@ func TestAutoFormat(t *testing.T) {
 		{[]string{"kv", "get", "-format=json", "kv/foo"}, nil, ""},
 		{[]string{"read", "--format", "json", "aws/creds/role"}, nil, ""},
 		{[]string{"kv", "get", "-field=password", "kv/foo"}, nil, ""},
+		{[]string{"kv", "get", "--", "-format=json"}, nil, "yaml"},
 		{[]string{"kv", "get", "kv/foo"}, []string{"VAULT_FORMAT=json"}, ""},
 		{[]string{"kv", "get", "kv/foo"}, []string{"VAULT_FORMAT="}, "yaml"},
 	}