vctx: set VAULT_FORMAT from the vault command #3

Merged

benvin merged 3 commits from benvin/vctx-format into main 2026-10-23 22:43:17 +11:00

Conversation 3 Commits 3 Files Changed 3

+185 -44

unkin-agent commented 2026-10-23 21:57:33 +11:00

Member

Copy Link

Copy Source

vault defaults to table output, which is awkward for kv get and dynamic creds. vctx now picks a sensible VAULT_FORMAT per command while leaving explicit choices alone.

• set VAULT_FORMAT=yaml for kv get and paths containing /creds/
• set VAULT_FORMAT=table for kv list; leave it unset otherwise
• skip auto-selection when VAULT_FORMAT is already set or -format/-field precedes --
• add --format flag to force VAULT_FORMAT, overriding the environment
• drop ambient VAULT_ADDR/TOKEN/NAMESPACE/FORMAT before exec so each managed var appears once (Go keeps the first)
• document the rules in docs/vctx.md

vault defaults to table output, which is awkward for `kv get` and dynamic creds. vctx now picks a sensible VAULT_FORMAT per command while leaving explicit choices alone. - set VAULT_FORMAT=yaml for `kv get` and paths containing `/creds/` - set VAULT_FORMAT=table for `kv list`; leave it unset otherwise - skip auto-selection when VAULT_FORMAT is already set or `-format`/`-field` precedes `--` - add `--format` flag to force VAULT_FORMAT, overriding the environment - drop ambient VAULT_ADDR/TOKEN/NAMESPACE/FORMAT before exec so each managed var appears once (Go keeps the first) - document the rules in docs/vctx.md

unkin-agent commented 2026-10-23 21:59:43 +11:00

Author

Member

Copy Link

Copy Source

• nit: vctx/main.go:71, docs/vctx.md:51 — raw is offered/documented as a general --format, but vault rejects VAULT_FORMAT=raw on every command except vault read ("This command does not support the -format=raw option.") → drop raw or document it as read-only
• nit: vctx/main.go:169 — -format/-field after -- still suppress auto-format, but vault stops scanning global flags at -- → stop the loop at --

- nit: vctx/main.go:71, docs/vctx.md:51 — `raw` is offered/documented as a general `--format`, but vault rejects VAULT_FORMAT=raw on every command except `vault read` ("This command does not support the -format=raw option.") → drop `raw` or document it as `read`-only - nit: vctx/main.go:169 — `-format`/`-field` after `--` still suppress auto-format, but vault stops scanning global flags at `--` → stop the loop at `--`

unkin-agent commented 2026-10-23 22:02:40 +11:00

Author

Member

Copy Link

Copy Source

• vctx/main.go:151 — --format is appended after an ambient VAULT_FORMAT; Go (vault) keeps the FIRST duplicate env key after exec, so VAULT_FORMAT=yaml vctx --format json ... runs with yaml (docs/vctx.md:51 "always sets it" is false) → drop existing VAULT_FORMAT= entries from baseEnv before appending (same applies to the VAULT_ADDR/TOKEN/NAMESPACE appends; comment at :110 is wrong)
• vctx/main_test.go:240 — lastVal encodes last-wins, so tests pass on the broken case → add a case with ambient VAULT_FORMAT + flag and assert exactly one VAULT_FORMAT entry

- vctx/main.go:151 — `--format` is appended after an ambient `VAULT_FORMAT`; Go (vault) keeps the FIRST duplicate env key after exec, so `VAULT_FORMAT=yaml vctx --format json ...` runs with yaml (docs/vctx.md:51 "always sets it" is false) → drop existing `VAULT_FORMAT=` entries from baseEnv before appending (same applies to the VAULT_ADDR/TOKEN/NAMESPACE appends; comment at :110 is wrong) - vctx/main_test.go:240 — `lastVal` encodes last-wins, so tests pass on the broken case → add a case with ambient `VAULT_FORMAT` + flag and assert exactly one `VAULT_FORMAT` entry

unkin-agent commented 2026-10-23 22:06:02 +11:00

Author

Member

Copy Link

Copy Source

• nit: vctx/main.go:143 — dropping ambient VAULT_ADDR/TOKEN/NAMESPACE fixes a pre-existing bug (syscall.Exec passes duplicates; vault honours the first, so ambient creds won) unrelated to format selection → split: (1) env dedup fix for ADDR/TOKEN/NAMESPACE, (2) VAULT_FORMAT auto/--format on top.
• nit: vctx/main.go:71 — --format completion omits raw, which docs/vctx.md:51 advertises → add raw to the completion list.

- nit: vctx/main.go:143 — dropping ambient VAULT_ADDR/TOKEN/NAMESPACE fixes a pre-existing bug (syscall.Exec passes duplicates; vault honours the first, so ambient creds won) unrelated to format selection → split: (1) env dedup fix for ADDR/TOKEN/NAMESPACE, (2) VAULT_FORMAT auto/`--format` on top. - nit: vctx/main.go:71 — `--format` completion omits `raw`, which docs/vctx.md:51 advertises → add `raw` to the completion list.

benvin changed target branch from benvin/vcm-rename to main 2026-10-23 22:32:50 +11:00

benvin added 3 commits 2026-10-23 22:32:50 +11:00

Set VAULT_FORMAT in vctx from the vault command 5a64b10b25

Stop vctx format scan at --; limit raw to vault read 718a3a9063

Drop ambient copies of vctx-managed env vars before exec 0d9dd267fc

benvin merged commit ac032216c8 into main 2026-10-23 22:43:17 +11:00

benvin deleted branch benvin/vctx-format 2026-10-23 22:43:17 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-tools#3