fix: skip authentication for non-interactive commands

main.go

@@ -141,10 +141,9 @@ func main() {
 		kong.BindTo(reader, (*io.Reader)(nil)),
 	)
 
-	apiClientRequired := !noAPIClientRequired(strings.Join(os.Args[1:], " "))
 	predictors := append([]completion.Option{
 		completion.WithPredictor("file", complete.PredictFiles("*")),
-	}, clientPredictors(ctx, apiClientRequired)...)
+	}, clientPredictors(ctx)...)
 	completion.Register(parser, predictors...)
 
 	kongCtx, err := parser.Parse(os.Args[1:])
@@ -172,7 +171,9 @@ func main() {
 		kong.BindTo(writer, (*io.Writer)(nil)),
 		kong.BindTo(reader, (*io.Reader)(nil)),
 	}
-	if apiClientRequired {
+	// Kong exits during Parse for --help and --version, so those cases
+	// never reach here. Only auth and completions commands remain.
+	if !noAPIClientRequired(kongCtx.Command()) {
 		client, err := api.New(
 			ctx,
 			cmd.APICluster,
@@ -217,7 +218,7 @@ func main() {
 	}
 }
 
-func clientPredictors(ctx context.Context, apiClientRequired bool) []completion.Option {
+func clientPredictors(ctx context.Context) []completion.Option {
 	// complete needs all used predictors to be defined, so we just use
 	// [complete.PredictNothing] for those that would require an API client.
 	nothing := []completion.Option{
@@ -227,7 +228,10 @@ func clientPredictors(ctx context.Context, apiClientRequired bool) []completion.
 		completion.WithPredictor("mysql_databases", complete.PredictNothing),
 	}
 
-	if !apiClientRequired {
+	// During completion for commands that don't need an API client (auth,
+	// completions), this still attempts a kubeconfig read. The cost is
+	// negligible and the predictors are never invoked for those commands.
+	if os.Getenv("COMP_LINE") == "" {
 		return nothing
 	}
 
@@ -247,7 +251,8 @@ func clientPredictors(ctx context.Context, apiClientRequired bool) []completion.
 }
 
 // noAPIClientRequired returns true if the command does not need to (or can't)
-// require an API client.
+// require an API client. The command parameter is the resolved command path
+// from [kong.Context.Command].
 func noAPIClientRequired(command string) bool {
 	return matchCommand(command, auth.CmdName, format.LoginCommand) ||
 		matchCommand(command, auth.CmdName, format.LogoutCommand) ||

main_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -16,3 +17,33 @@ func TestKongVars(t *testing.T) {
 	is.NoError(err)
 	is.NotEmpty(vars)
 }
+
+func TestNoAPIClientRequired(t *testing.T) {
+	t.Parallel()
+	is := assert.New(t)
+
+	// Commands use the resolved format from kong.Context.Command().
+	// --help and --version are not tested here because Kong exits
+	// during Parse before noAPIClientRequired is called.
+	tests := []struct {
+		command  string
+		expected bool
+	}{
+		{"auth login", true},
+		{"auth login <organization>", true},
+		{"auth logout", true},
+		{"auth oidc", true},
+		{"auth client-credentials", true},
+		{"completions", true},
+		{"completions bash", true},
+		{"get", false},
+		{"get application", false},
+		{"get application <name>", false},
+		{"create application <name>", false},
+		{"exec application <name>", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		is.Equal(tt.expected, noAPIClientRequired(tt.command), "command: %q", tt.command)
+	}
+}