vctx: colourise json/yaml output #6

Merged

benvin merged 5 commits from benvin/vctx-colour into main 2026-10-24 16:25:01 +11:00

Conversation 3 Commits 5 Files Changed 3

+318 -12

unkin-agent commented 2026-10-23 23:06:51 +11:00

Member

Copy Link

Copy Source

vctx sets VAULT_FORMAT to yaml/json for reads but execs vault directly, so output is never highlighted the way jq/yq output is.

• add --color auto|always|never (auto honours TTY, NO_COLOR, TERM=dumb)
• run vault as a child and colourise stdout via golib/colour when the effective format is json or yaml; forward SIGTERM/SIGHUP and propagate the exit code (128+n on signal)
• keep the exec path for other formats, non-TTY output, and streaming or prompting commands (monitor, debug, events, ssh, agent, proxy, server, login, operator, write, patch)
• document --color in docs/vctx.md

vctx sets VAULT_FORMAT to yaml/json for reads but execs vault directly, so output is never highlighted the way jq/yq output is. - add `--color auto|always|never` (auto honours TTY, NO_COLOR, TERM=dumb) - run vault as a child and colourise stdout via golib/colour when the effective format is json or yaml; forward SIGTERM/SIGHUP and propagate the exit code (128+n on signal) - keep the exec path for other formats, non-TTY output, and streaming or prompting commands (monitor, debug, events, ssh, agent, proxy, server, login, operator, write, patch) - document `--color` in docs/vctx.md

unkin-agent added 1 commit 2026-10-23 23:06:51 +11:00

vctx: colourise json/yaml output with --color f151902e43

unkin-agent commented 2026-10-23 23:11:14 +11:00

Author

Member

Copy Link

Copy Source

• vctx/main.go:40 — commands that print their interactive prompt to stdout are captured, so the prompt only appears after the user has already answered it (json/yaml on a TTY): operator unseal, operator generate-root, operator rekey (key prompt via GetWriterFromUI = stdout), and login MFA passcode (UI.AskSecret writes to stdout) → exec these too (match operator unseal|generate-root|rekey and login), and add them to TestColourFormat.
• nit: vctx/main_test.go:299 — nothing tests SIGINT/SIGTERM forwarding in runChild; dropping the forwarding goroutine still passes the tests → add a case that signals the vctx process while a fake vault traps the signal and checks it arrived.

- vctx/main.go:40 — commands that print their interactive prompt to stdout are captured, so the prompt only appears after the user has already answered it (json/yaml on a TTY): `operator unseal`, `operator generate-root`, `operator rekey` (key prompt via GetWriterFromUI = stdout), and `login` MFA passcode (`UI.AskSecret` writes to stdout) → exec these too (match `operator unseal|generate-root|rekey` and `login`), and add them to TestColourFormat. - nit: vctx/main_test.go:299 — nothing tests SIGINT/SIGTERM forwarding in runChild; dropping the forwarding goroutine still passes the tests → add a case that signals the vctx process while a fake vault traps the signal and checks it arrived.

unkin-agent added 1 commit 2026-10-23 23:12:36 +11:00

vctx: exec login and operator commands uncoloured; test signal forwarding 92223ce33d

unkin-agent commented 2026-10-23 23:16:03 +11:00

Author

Member

Copy Link

Copy Source

• vctx/main.go:41 — vault write auth/<method>/login/... runs interactive MFA (command/client/write.go:164 → base.ValidateMFA → UI.AskSecret, prompt goes to stdout) when stdin is a TTY; with -format=json|yaml or VAULT_FORMAT set the passcode prompt is buffered, so the user sees nothing and vault blocks on stdin → exec write when a positional arg starts with auth/ (and add a TestColourFormat case).
• nit: vctx/main.go:288 — on a TTY Ctrl-C already reaches the child via the foreground process group; forwarding SIGINT too delivers it twice (verified: child trap counts 2 vs 1 on exec path) → forward only SIGTERM, ignore SIGINT in vctx while the child runs.

- vctx/main.go:41 — `vault write auth/<method>/login/...` runs interactive MFA (command/client/write.go:164 → base.ValidateMFA → UI.AskSecret, prompt goes to stdout) when stdin is a TTY; with `-format=json|yaml` or `VAULT_FORMAT` set the passcode prompt is buffered, so the user sees nothing and vault blocks on stdin → exec `write` when a positional arg starts with `auth/` (and add a TestColourFormat case). - nit: vctx/main.go:288 — on a TTY Ctrl-C already reaches the child via the foreground process group; forwarding SIGINT too delivers it twice (verified: child trap counts 2 vs 1 on exec path) → forward only SIGTERM, ignore SIGINT in vctx while the child runs.

unkin-agent added 1 commit 2026-10-23 23:17:43 +11:00

vctx: exec auth/ writes uncoloured; stop forwarding SIGINT to vault 1cedcbde19

unkin-agent added 1 commit 2026-10-23 23:20:58 +11:00

Merge main cb1e048e0f

unkin-agent commented 2026-10-23 23:21:12 +11:00

Author

Member

Copy Link

Copy Source

• vctx/main.go:278 — isAuthPath misses namespace-prefixed login paths (write ns1/auth/userpass/login/bob), so the MFA passcode prompt is buffered and the command hangs silently → match an auth/ segment anywhere (e.g. strings.Contains("/"+strings.TrimPrefix(p, "/"), "/auth/")) and add a test case.
• nit: vctx/main.go:271 — vault patch shares write's MFA prompt path (handleWriteSecretOutput) → apply the auth-path check to patch too.

- vctx/main.go:278 — `isAuthPath` misses namespace-prefixed login paths (`write ns1/auth/userpass/login/bob`), so the MFA passcode prompt is buffered and the command hangs silently → match an `auth/` segment anywhere (e.g. `strings.Contains("/"+strings.TrimPrefix(p, "/"), "/auth/")`) and add a test case. - nit: vctx/main.go:271 — `vault patch` shares write's MFA prompt path (`handleWriteSecretOutput`) → apply the auth-path check to `patch` too.

unkin-agent added 1 commit 2026-10-24 16:16:22 +11:00

vctx: always exec write and patch (MFA prompt on stdout) 7540cbc9a4

benvin merged commit 7a6a3f559a into main 2026-10-24 16:25:01 +11:00

benvin deleted branch benvin/vctx-colour 2026-10-24 16:25:01 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-tools#6