[BUG] Tab completion executes actual API commands after trailing `--`

[ab]

Bug Description

Under certain conditions, the spacectl CLI tab completion may hang or execute unexpected Spacelift commands.

If you attempt to tab complete after a trailing --, then spacectl will execute the command up to that point, rather than generating shell completions.

For example, if you type spacectl profile login --<tab> (where <tab> is the tab key ↹) it will actually run the command as though the user had executed spacectl profile login. This opens a browser window, even though the user never pressed enter.

Under the hood, the completion function appears to be appending --generate-shell-completion to the command line so far and then executing it. But the -- is treated as the POSIX special flag to end option parsing. That means the option to generate shell completion is ignored, and instead spacectl runs the actual command inside the bash completion function, which swallows any output.

This results in various unexpected behavior in different commands:

• spacectl profile login --<tab> — opens a browser window on the API token consent page
• spacectl stack lock --<tab> — hangs waiting for user input on an invisible prompt for which stack to choose

And it has potentially very dangerous outcomes if SPACECTL_SKIP_STACK_PROMPT=true bypassing the interactive prompt.

• spacectl stack lock --<tab> — actually locks the stack, invisibly with no output!
• spacectl stack delete --skip-confirmation --<tab> — actually deletes the stack, invisibly with no output ⚠️

Steps to Reproduce

Type any spacectl command and end it by typing - - <tab>

Expected Behavior

It should print shell completions.

Actual Behavior

It executes the command up to the --, silently swallowing any output.

Environment

• spacectl version: 1.17.0
• shell: bash 5.3.8(1)-release

Additional Context

I'm not sure if this is an upstream bug with urfave/cli or with spacectl itself.

[ab]

It looks like this is a bug in urfave/cli: urfave/cli#1993