ax CLI consumes global flags after `--`, breaking `ax ssh <task> -- <cmd>`

[sbhrwlr]

Summary

The global flag parser in cmd/ax/main.go does not stop at --. It consumes -a/--atespace, -n/--namespace, --server and --context from the remote command in ax ssh <task> -- <cmd> and applies them to ax itself. The remote command loses those arguments, or the CLI fails before connecting.

First noted by @anzal1 in a comment on #373. Filing separately because #373 is about ax ssh --help, and this bug affects every ax ssh command that uses one of these flags. Seen on AX e09ed1b.

Reproduce

Against a local ax-server + Redis, with a task mytask in atespace default:

$ ax ssh mytask -- ls /workspace
Error: task "mytask" is in phase "Pending" (must be Running to ssh)        # control: task found

$ ax ssh mytask -- ls -a /workspace
Error: fetching task "mytask": rpc error: code = NotFound desc = task "mytask" not found in atespace "/workspace"

$ ax ssh mytask -- tail -n 50 /ax/git-error.log
Error: timeout waiting for kubectl port-forward on context "kind-kind": Error from server (NotFound): namespaces "50" not found

$ ax ssh mytask -- cat --server=x /etc/hosts
Error: fetching task "mytask": rpc error: code = Unavailable desc = name resolver error: produced zero addresses

When a healthy tunnel already exists, -n 50 gets past the port-forward and the remote command runs without the flag and its value (tail /ax/git-error.log). A trailing flag with no value (-- ls -a) is dropped silently.

The help text (ssh <task-name> [-- cmd]) and the README examples use the standard -- separator. The README's ls -al works only because -al is not an ax flag.

Cause

The loop at cmd/ax/main.go:58-93 checks every argument and has no case for --. It adds -- to cleanArgs and keeps matching global flags after it. runSSH splits on -- correctly, but the flags are already gone by then.

Suggested fix

Stop parsing global flags at -- and pass the rest through unchanged:

if arg == "--" {
	cleanArgs = append(cleanArgs, args[i:]...)
	break
} else if arg == "-a" || arg == "--atespace" {

Flags before -- (e.g. ax ssh t -a team -- ls) keep working, and runSSH needs no change. @anzal1's branch linked from #373 also includes a fix.