CLI

The vault binary is a CLI built with hashicorp/cli. Every subcommand is a struct in the command package; command/commands.go wires them all into a single map. The CLI talks to a server via the api package, which uses Go's net/http under the hood.

Purpose

Provide a complete administrative and end-user interface to a Vault server. Every API endpoint Vault exposes has at least one CLI command (and most have two — a verb form like kv put and a generic write form).

Directory layout

command/
├── main.go                # Run() — top-level cli.CLI dispatch
├── commands.go            # the giant map of subcommand factories
├── commands_full.go       # extra subcommands enabled in full builds
├── commands_min.go        # minimal builds
├── base.go, base_flags.go, base_helpers.go, base_predict.go
├── format.go              # output formatting (table, json, yaml, raw)
├── audit*.go              # audit subcommands
├── auth*.go               # auth subcommands
├── kv*.go                 # kv read/write/delete/destroy/patch/list/metadata
├── lease*.go              # lease lookup/renew/revoke
├── login.go               # vault login
├── namespace*.go          # namespace CRUD
├── operator*.go           # operator init/unseal/seal/rekey/raft/migrate/...
├── plugin*.go             # plugin register/info/list/reload/runtime
├── pki*.go                # pki helpers (issue, list-intermediates, verify-sign)
├── policy*.go             # policy read/write/delete/fmt
├── secrets*.go, auth*.go  # secrets enable/disable/list/move/tune
├── server.go              # the server daemon (a "subcommand" too)
├── ssh.go, transform*.go, transit*.go
├── token*.go              # token capabilities/create/lookup/renew/revoke
├── debug.go               # vault debug bundle
└── healthcheck/, server/, agentproxyshared/, proxy/, agent/  # subdirs

Key abstractions

Symbol	File	Description
Run	command/main.go	Entry point. Sets up cli.CLI, error trapping, autocompletion.
BaseCommand	command/base.go	Shared flags (-address, -token, -format, -tls-…) and an api.Client factory.
initCommands	command/commands.go	Returns the map[string]cli.CommandFactory listing every subcommand.
OutputData, OutputSecret	command/format.go	Format helpers used by every subcommand.
PredictVaultFiles, PredictVaultPaths	command/base_predict.go	Tab-completion helpers.
RunOptions	command/main.go	Plumbs the global UI, address, and token-helper into every command.

Subcommand families

| Family | Highlights | | ---------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------ | ------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------- | ------------- | ---------- | ------------------------------------------------------------ | ------- | ----- | --------------------------------- | | Token / login | vault login, vault token create | lookup | renew | revoke | capabilities, vault print token | | KV (v1 + v2) | vault kv put | get | list | delete | destroy | patch | undelete | metadata, vault kv enable-versioning, vault kv rollback | | Auth methods | vault auth list | enable | disable | move | tune | help | | Secret engines | vault secrets list | enable | disable | move | tune | | Operator | vault operator init | unseal | seal | rekey | generate-root | step-down | members | key-status | migrate | usage | utilizationplusoperator raft … | | Plugin | vault plugin register | deregister | info | list | reload | reload-status | runtime … | | Policy | vault policy read | write | delete | list | fmt | | Namespace (Enterprise) | vault namespace list | lookup | create | patch | delete | lock | unlock | | PKI helpers | vault pki issue | list-intermediates | reissue | verify-sign | health-check | | Audit | vault audit list | enable | disable | | Lease | vault lease lookup | renew | revoke | | Transit / transform | vault transit import-key | import-key-version, vault transform import-key | import-key-version | | Diagnostics | vault status, vault read | write | list | delete, vault path-help, vault debug, vault monitor, vault events subscribe, vault operator diagnose | | Daemons | vault server, vault agent, vault agent generate-config, vault proxy, vault ssh |

Output formats

-format=table|json|yaml is implemented in command/format.go (24k lines). Most commands also accept -field=<name> for shell-friendly extraction. JSON output is the only stable contract — operators using table output should not script against it.

Tab-completion

command/base_predict.go (15k lines) wires posener/complete into every command, including dynamic predictions like "policies on this server" and "files in secret/". vault -autocomplete-install writes the appropriate shell hook.

Token helpers

api/tokenhelper/ and command/token/ define the contract for external token storage (helpers can be configured via ~/.vault). The default internalTokenHelper writes to ~/.vault-token.

Integration points

• Talks to the server through api.Client (in api/client.go, 56k lines).
• Reads token helper config from api/cliconfig/.
• Uses command/healthcheck/ for the in-process logic behind vault pki health-check.
• Shares plumbing with the agent and proxy via command/agentproxyshared/.

Entry points for modification

• Add a new subcommand: create command/<verb>_<noun>.go, satisfy cli.Command (Help, Synopsis, Run, Flags), and register it in initCommands (command/commands.go).
• Add a new global flag: extend BaseCommand and flagSet in command/base_flags.go.
• Add a new output format: extend the switch in command/format.go and unit tests in command/format_test.go.
• Add tab-completion: provide a Predict* function in command/base_predict.go.

See server for the daemon side and agent/proxy for the long-running client daemons.