diff --git a/clients/cli/common.c b/clients/cli/common.c
index 327804fbc6..3e28eee7a9 100644
--- a/clients/cli/common.c
+++ b/clients/cli/common.c
@@ -1753,8 +1753,10 @@ nmc_do_cmd (NmCli *nmc, const NMCCommand cmds[], const char *cmd, int argc, char
 				c->usage ();
 			g_simple_async_result_complete_in_idle (simple);
 			g_object_unref (simple);
-		} else
-			call_cmd (nmc, simple, c, argc-1, argv+1);
+		} else {
+			next_arg (nmc, &argc, &argv);
+			call_cmd (nmc, simple, c, argc, argv);
+		}
 	} else if (cmd) {
 		/* Not a known command. */
 		if (nmc_arg_is_help (cmd) && c->usage) {
diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 2578a4963e..2c7e96954f 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -1713,11 +1713,13 @@ get_connection (NmCli *nmc, int *argc, char ***argv, int *pos, GError **error)
 	    || strcmp (**argv, "uuid") == 0
 	    || strcmp (**argv, "path") == 0) {
 		selector = **argv;
-		if (next_arg (argc, argv) != 0) {
+		if (!*argc) {
 			g_set_error (error, NMCLI_ERROR, NMC_RESULT_ERROR_USER_INPUT,
 			             _("%s argument is missing"), selector);
 			return NULL;
 		}
+		(*argc)--;
+		(*argv)++;
 	}
 
 	connections = nm_client_get_connections (nmc->client);
@@ -1732,7 +1734,7 @@ get_connection (NmCli *nmc, int *argc, char ***argv, int *pos, GError **error)
 	 * don't switch to next argument.
 	 */
 	if (!pos || !*pos)
-		next_arg (argc, argv);
+		next_arg (nmc, argc, argv);
 
 	return connection;
 }
@@ -1744,41 +1746,36 @@ do_connections_show (NmCli *nmc, int argc, char **argv)
 	char *profile_flds = NULL, *active_flds = NULL;
 	GPtrArray *invisibles, *sorted_cons;
 	gboolean active_only = FALSE;
-	gboolean show_secrets = FALSE;
 	GArray *order = NULL;
 	int i;
 
-	/* check connection show options [--active] [--show-secrets] */
-	for (i = 0; i < 3; i++) {
+	/* check connection show options [--active] */
+	while (argc) {
 		if (argc == 1 && nmc->complete) {
-			nmc_complete_strings (*argv, "--active", "--show-secrets",
+			nmc_complete_strings (*argv, "--active",
 			                             "--order", NULL);
 		}
 
 		if (!active_only && nmc_arg_is_option (*argv, "active")) {
 			active_only = TRUE;
-			next_arg (&argc, &argv);
-		} else if (!show_secrets && nmc_arg_is_option (*argv, "show-secrets")) {
-			/* --show-secrets is deprecated in favour of global --show-secrets */
-			/* Keep it here for backwards compatibility */
-			show_secrets = TRUE;
-			next_arg (&argc, &argv);
+			next_arg (nmc, &argc, &argv);
 		} else if (!order && nmc_arg_is_option (*argv, "order")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_set_error_literal (&err, NMCLI_ERROR, 0,
 				                     _("'--order' argument is missing"));
 				goto finish;
 			}
+			argc--;
+			argv++;
 			/* TODO: complete --order */
 			order = parse_preferred_connection_order (*argv, &err);
 			if (err)
 				goto finish;
-			next_arg (&argc, &argv);
+			next_arg (nmc, &argc, &argv);
 		} else {
 			break;
 		}
 	}
-	show_secrets = nmc->show_secrets || show_secrets;
 
 	if (argc == 0) {
 		const GPtrArray *connections;
@@ -1856,7 +1853,7 @@ do_connections_show (NmCli *nmc, int argc, char **argv)
 			    || strcmp (*argv, "path") == 0
 			    || strcmp (*argv, "apath") == 0) {
 				selector = *argv;
-				if (next_arg (&argc, &argv) != 0) {
+				if (!argc) {
 					g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 					nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 					goto finish;
@@ -1891,12 +1888,12 @@ do_connections_show (NmCli *nmc, int argc, char **argv)
 			if (!acon)
 				acon = get_ac_for_connection (active_cons, con);
 			if (active_only && !acon) {
-				next_arg (&argc, &argv);
+				next_arg (nmc, &argc, &argv);
 				continue;
 			}
 
 			if (nmc->complete) {
-				next_arg (&argc, &argv);
+				next_arg (nmc, &argc, &argv);
 				continue;
 			}
 
@@ -1908,9 +1905,9 @@ do_connections_show (NmCli *nmc, int argc, char **argv)
 			if (without_fields || profile_flds) {
 				if (con) {
 					nmc->required_fields = profile_flds;
-					if (show_secrets)
+					if (nmc->show_secrets)
 						update_secrets_in_connection (NM_REMOTE_CONNECTION (con), con);
-					res = nmc_connection_profile_details (con, nmc, show_secrets);
+					res = nmc_connection_profile_details (con, nmc, nmc->show_secrets);
 					nmc->required_fields = NULL;
 					if (!res)
 						goto finish;
@@ -1934,7 +1931,7 @@ do_connections_show (NmCli *nmc, int argc, char **argv)
 			 * so process the same argument again.
 			 */
 			if (!pos)
-				next_arg (&argc, &argv);
+				next_arg (nmc, &argc, &argv);
 		}
 	}
 
@@ -2596,31 +2593,37 @@ do_connection_up (NmCli *nmc, int argc, char **argv)
 			nmc_complete_strings (*argv, "ifname", "ap", "passwd-file", NULL);
 
 		if (strcmp (*argv, "ifname") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
 
+			argc--;
+			argv++;
 			ifname = *argv;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_device (nmc->client, ifname, ap != NULL);
 		}
 		else if (strcmp (*argv, "ap") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
 
+			argc--;
+			argv++;
 			ap = *argv;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_bssid (nmc->client, ifname, ap);
 		}
 		else if (strcmp (*argv, "passwd-file") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
 
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc->return_value = NMC_RESULT_COMPLETE_FILE;
 
@@ -2630,8 +2633,7 @@ do_connection_up (NmCli *nmc, int argc, char **argv)
 			g_printerr (_("Unknown parameter: %s\n"), *argv);
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (nmc->complete)
@@ -2787,11 +2789,13 @@ do_connection_down (NmCli *nmc, int argc, char **argv)
 		    || strcmp (*arg_ptr, "apath") == 0) {
 
 			selector = *arg_ptr;
-			if (next_arg (&arg_num, &arg_ptr) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), selector);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 		}
 
 		connections = nm_client_get_connections (nmc->client);
@@ -2811,7 +2815,7 @@ do_connection_down (NmCli *nmc, int argc, char **argv)
 		}
 
 		if (idx == 0)
-			next_arg (&arg_num, &arg_ptr);
+			next_arg (nmc->ask ? NULL : nmc, &arg_num, &arg_ptr);
 	}
 
 	if (!queue) {
@@ -4501,7 +4505,8 @@ get_value (const char **value, int *argc, char ***argv, const char *option, GErr
 	else
 		*value = *argv[0];
 
-	next_arg (argc, argv);
+	(*argc)--;
+	(*argv)++;
 	return TRUE;
 }
 
@@ -4565,7 +4570,8 @@ nmc_read_connection_properties (NmCli *nmc,
 				return FALSE;
 			}
 
-			next_arg (argc, argv);
+			(*argc)--;
+			(*argv)++;
 			if (!get_value (&value, argc, argv, option, error))
 				return FALSE;
 
@@ -4604,7 +4610,8 @@ nmc_read_connection_properties (NmCli *nmc,
 			if (*argc == 1 && nmc->complete)
 				complete_property_name (nmc, connection, modifier, option, NULL);
 
-			next_arg (argc, argv);
+			(*argc)--;
+			(*argv)++;
 			if (!get_value (&value, argc, argv, option, error))
 				return FALSE;
 
@@ -4941,19 +4948,21 @@ read_properties:
 			 * options and properties to be separated with "--" */
 			g_clear_error (&error);
 			seen_dash_dash = TRUE;
-			next_arg (&argc, &argv);
+			next_arg (nmc, &argc, &argv);
 			goto read_properties;
 		} else if (g_strcmp0 (*argv, "save") == 0) {
 			/* It would be better if "save" was a separate argument and not
 			 * mixed with properties, but there's not much we can do about it now. */
 			g_clear_error (&error);
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text,
 				                 _("Error: value for '%s' argument is required."),
 				                "save");
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			if (!nmc_string_to_bool (*argv, &save_bool, &error)) {
 				g_string_printf (nmc->return_text, _("Error: 'save': %s."),
 				                 error->message);
@@ -4961,7 +4970,7 @@ read_properties:
 				g_clear_error (&error);
 				goto finish;
 			}
-			next_arg (&argc, &argv);
+			next_arg (nmc, &argc, &argv);
 			goto read_properties;
 		}
 
@@ -8088,7 +8097,7 @@ do_connection_modify (NmCli *nmc,
 		if (nmc->complete)
 			goto finish;
 		temporary = TRUE;
-		next_arg (&argc, &argv);
+		next_arg (nmc, &argc, &argv);
 	}
 
 	connection = get_connection (nmc, &argc, &argv, NULL, &error);
@@ -8197,7 +8206,7 @@ do_connection_clone (NmCli *nmc, int argc, char **argv)
 		argc_ptr = &arg_num;
 	} else if (nmc_arg_is_option (*argv, "temporary")) {
 		temporary = TRUE;
-		next_arg (&argc, &argv);
+		next_arg (nmc, &argc, &argv);
 	}
 
 	connection = get_connection (nmc, argc_ptr, argv_ptr, NULL, &error);
@@ -8220,7 +8229,7 @@ do_connection_clone (NmCli *nmc, int argc, char **argv)
 		goto finish;
 	}
 
-	if (next_arg (argc_ptr, argv_ptr) == 0) {
+	if (next_arg (nmc->ask ? NULL : nmc, argc_ptr, argv_ptr) == 0) {
 		g_string_printf (nmc->return_text, _("Error: unknown extra argument: '%s'."), *argv);
 		nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 		goto finish;
@@ -8582,16 +8591,18 @@ do_connection_import (NmCli *nmc, int argc, char **argv)
 			nmc_complete_strings (*argv, "temporary", "type", "file", NULL);
 		if (nmc_arg_is_option (*argv, "temporary")) {
 			temporary = TRUE;
-			next_arg (&argc, &argv);
+			next_arg (nmc, &argc, &argv);
 		}
 
 		if (strcmp (*argv, "type") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
 
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_vpn_service (*argv);
 
@@ -8601,11 +8612,13 @@ do_connection_import (NmCli *nmc, int argc, char **argv)
 				g_printerr (_("Warning: 'type' already specified, ignoring extra one.\n"));
 
 		} else if (strcmp (*argv, "file") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc->return_value = NMC_RESULT_COMPLETE_FILE;
 			if (!filename)
@@ -8618,8 +8631,7 @@ do_connection_import (NmCli *nmc, int argc, char **argv)
 			goto finish;
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (nmc->complete)
@@ -8721,17 +8733,21 @@ do_connection_export (NmCli *nmc, int argc, char **argv)
 	if (nmc->complete)
 		return nmc->return_value;
 
-	if (next_arg (&argc, &argv) == 0)
+	if (argc) {
 		out_name = *argv;
-	else if (nmc->ask)
-		out_name = out_name_ask = nmc_readline (_("Output file name: "));
+		argc--;
+		argv++;
+	}
 
-	if (next_arg (argc_ptr, argv_ptr) == 0) {
+	if (next_arg (nmc->ask ? NULL : nmc, argc_ptr, argv_ptr) == 0) {
 		g_string_printf (nmc->return_text, _("Error: unknown extra argument: '%s'."), *argv);
 		nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 		goto finish;
 	}
 
+	if (out_name == NULL && nmc->ask)
+		out_name = out_name_ask = nmc_readline (_("Output file name: "));
+
 	type = nm_connection_get_connection_type (connection);
 	if (g_strcmp0 (type, NM_SETTING_VPN_SETTING_NAME) != 0) {
 		g_string_printf (nmc->return_text, _("Error: the connection is not VPN."));
diff --git a/clients/cli/devices.c b/clients/cli/devices.c
index b1677ef49d..25d0e983d7 100644
--- a/clients/cli/devices.c
+++ b/clients/cli/devices.c
@@ -613,7 +613,7 @@ get_device_list (NmCli *nmc, int argc, char **argv)
 		}
 
 		/* Take next argument */
-		next_arg (&arg_num, &arg_ptr);
+		next_arg (nmc->ask ? NULL : nmc, &arg_num, &arg_ptr);
 	}
 	g_free (devices);
 
@@ -642,7 +642,7 @@ get_device (NmCli *nmc, int *argc, char ***argv, GError **error)
 		}
 	} else {
 		ifname = **argv;
-		next_arg (argc, argv);
+		next_arg (nmc, argc, argv);
 	}
 
 	devices = nmc_get_devices_sorted (nmc->client);
@@ -1496,8 +1496,7 @@ do_devices_status (NmCli *nmc, int argc, char **argv)
 
 	while (argc > 0) {
 		g_printerr (_("Unknown parameter: %s\n"), *argv);
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (!nmc->required_fields || strcasecmp (nmc->required_fields, "common") == 0)
@@ -2290,8 +2289,7 @@ do_device_set (NmCli *nmc, int argc, char **argv)
 	gs_free_error GError *error = NULL;
 
 	if (argc >= 1 && g_strcmp0 (*argv, "ifname") == 0) {
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	device = get_device (nmc, &argc, &argv, &error);
@@ -2313,10 +2311,12 @@ do_device_set (NmCli *nmc, int argc, char **argv)
 			nmc_complete_strings (*argv, "managed", "autoconnect", NULL);
 
 		if (matches (*argv, "managed")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: '%s' argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_bool (*argv);
 			if (!nmc_string_to_bool (*argv, &flag, &error)) {
@@ -2328,10 +2328,12 @@ do_device_set (NmCli *nmc, int argc, char **argv)
 			values[DEV_SET_MANAGED].value = flag;
 		}
 		else if (matches (*argv, "autoconnect")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: '%s' argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_bool (*argv);
 			if (!nmc_string_to_bool (*argv, &flag, &error)) {
@@ -2346,7 +2348,7 @@ do_device_set (NmCli *nmc, int argc, char **argv)
 			g_string_printf (nmc->return_text, _("Error: property '%s' is not known."), *argv);
 			return NMC_RESULT_ERROR_USER_INPUT;
 		}
-	} while (next_arg (&argc, &argv) == 0);
+	} while (next_arg (nmc, &argc, &argv) == 0);
 
 	if (nmc->complete)
 		return nmc->return_value;
@@ -2632,18 +2634,22 @@ do_device_wifi_list (NmCli *nmc, int argc, char **argv)
 			nmc_complete_strings (*argv, "ifname", "bssid", NULL);
 
 		if (strcmp (*argv, "ifname") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			ifname = *argv;
 			complete_device (devices, ifname, TRUE);
 		} else if (strcmp (*argv, "bssid") == 0 || strcmp (*argv, "hwaddr") == 0) {
 			/* hwaddr is deprecated and will be removed later */
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			bssid_user = *argv;
 			if (argc == 1 && nmc->complete)
 				complete_aps (devices, NULL, bssid_user, NULL);
@@ -2651,8 +2657,7 @@ do_device_wifi_list (NmCli *nmc, int argc, char **argv)
 			g_printerr (_("Unknown parameter: %s\n"), *argv);
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (!nmc->required_fields || strcasecmp (nmc->required_fields, "common") == 0)
@@ -2849,8 +2854,7 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 		if (argc == 1 && nmc->complete)
 			complete_aps (devices, NULL, param_user, param_user);
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	} else {
 		/* nmc_do_cmd() should not call this with argc=0. */
 		g_assert (!nmc->complete);
@@ -2875,7 +2879,7 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 		}
 
 		if (strcmp (*argv, "ifname") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
@@ -2883,11 +2887,13 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 			ifname = *argv;
 			complete_device (devices, ifname, TRUE);
 		} else if (strcmp (*argv, "bssid") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			bssid = *argv;
 			if (argc == 1 && nmc->complete)
 				complete_aps (devices, NULL, bssid, NULL);
@@ -2899,18 +2905,22 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 				goto finish;
 			}
 		} else if (strcmp (*argv, "password") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			password = *argv;
 		} else if (strcmp (*argv, "wep-key-type") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_strings (*argv, "key", "phrase", NULL);
 			if (strcmp (*argv, "key") == 0)
@@ -2925,19 +2935,23 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 				goto finish;
 			}
 		} else if (strcmp (*argv, "name") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			con_name = *argv;
 		} else if (strcmp (*argv, "private") == 0) {
 			GError *err_tmp = NULL;
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_bool (*argv);
 			if (!nmc_string_to_bool (*argv, &private, &err_tmp)) {
@@ -2948,11 +2962,13 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 			}
 		} else if (strcmp (*argv, "hidden") == 0) {
 			GError *err_tmp = NULL;
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_bool (*argv);
 			if (!nmc_string_to_bool (*argv, &hidden, &err_tmp)) {
@@ -2965,8 +2981,7 @@ do_device_wifi_connect_network (NmCli *nmc, int argc, char **argv)
 			g_printerr (_("Unknown parameter: %s\n"), *argv);
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (nmc->complete)
@@ -3324,34 +3339,42 @@ do_device_wifi_hotspot (NmCli *nmc, int argc, char **argv)
 		}
 
 		if (strcmp (*argv, "ifname") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			ifname = *argv;
 			if (argc == 1 && nmc->complete)
 				complete_device (devices, ifname, TRUE);
 		} else if (strcmp (*argv, "con-name") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			con_name = *argv;
 		} else if (strcmp (*argv, "ssid") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			ssid = *argv;
 			if (strlen (ssid) > 32) {
 				g_string_printf (nmc->return_text, _("Error: ssid is too long."));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
 		} else if (strcmp (*argv, "band") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			band = *argv;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_strings (band, "a", "bg", NULL);
@@ -3361,16 +3384,20 @@ do_device_wifi_hotspot (NmCli *nmc, int argc, char **argv)
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
 		} else if (strcmp (*argv, "channel") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			channel = *argv;
 		} else if (strcmp (*argv, "password") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 			password = *argv;
 		/* --show-password is deprecated in favour of global --show-secrets option */
 		/* Keep it here for backwards compatibility */
@@ -3381,8 +3408,7 @@ do_device_wifi_hotspot (NmCli *nmc, int argc, char **argv)
 			return NMC_RESULT_ERROR_USER_INPUT;
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 	show_password = nmc->show_secrets || show_password;
 
@@ -3539,26 +3565,29 @@ do_device_wifi_rescan (NmCli *nmc, int argc, char **argv)
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			ifname = *argv;
 			if (argc == 1 && nmc->complete)
 				complete_device (devices, ifname, TRUE);
 		} else if (strcmp (*argv, "ssid") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				goto finish;
 			}
+			argc--;
+			argv++;
 			g_ptr_array_add (ssids, *argv);
 		} else if (!nmc->complete)
 			g_printerr (_("Unknown parameter: %s\n"), *argv);
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (nmc->complete)
@@ -3715,10 +3744,12 @@ do_device_lldp_list (NmCli *nmc, int argc, char **argv)
 			nmc_complete_strings (*argv, "ifname", NULL);
 
 		if (strcmp (*argv, "ifname") == 0) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: %s argument is missing."), *(argv-1));
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
+			argc--;
+			argv++;
 
 			device = get_device (nmc, &argc, &argv, &error);
 			if (!device) {
@@ -3730,8 +3761,7 @@ do_device_lldp_list (NmCli *nmc, int argc, char **argv)
 			return NMC_RESULT_ERROR_USER_INPUT;
 		}
 
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	if (!nmc->required_fields || strcasecmp (nmc->required_fields, "common") == 0)
diff --git a/clients/cli/general.c b/clients/cli/general.c
index c11697350a..9810c37957 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -655,20 +655,24 @@ do_general_logging (NmCli *nmc, int argc, char **argv)
 				nmc_complete_strings (*argv, "level", "domains", NULL);
 
 			if (matches (*argv, "level")) {
-				if (next_arg (&argc, &argv) != 0) {
+				if (!argc) {
 					g_string_printf (nmc->return_text, _("Error: '%s' argument is missing."), *(argv-1));
 					return NMC_RESULT_ERROR_USER_INPUT;
 				}
+				argc--;
+				argv++;
 				if (argc == 1 && nmc->complete) {
 					nmc_complete_strings_nocase (*argv, "TRACE", "DEBUG", "INFO", "WARN",
 					                             "ERR", "OFF", "KEEP", NULL);
 				}
 				level = *argv;
 			} else if (matches (*argv, "domains")) {
-				if (next_arg (&argc, &argv) != 0) {
+				if (!argc) {
 					g_string_printf (nmc->return_text, _("Error: '%s' argument is missing."), *(argv-1));
 					return NMC_RESULT_ERROR_USER_INPUT;
 				}
+				argc--;
+				argv++;
 				if (argc == 1 && nmc->complete) {
 					nmc_complete_strings_nocase (*argv, "PLATFORM", "RFKILL", "ETHER", "WIFI", "BT",
 					                             "MB", "DHCP4", "DHCP6", "PPP", "WIFI_SCAN", "IP4",
@@ -683,7 +687,7 @@ do_general_logging (NmCli *nmc, int argc, char **argv)
 				g_string_printf (nmc->return_text, _("Error: property '%s' is not known."), *argv);
 				return NMC_RESULT_ERROR_USER_INPUT;
 			}
-		} while (next_arg (&argc, &argv) == 0);
+		} while (next_arg (nmc, &argc, &argv) == 0);
 
 		if (nmc->complete)
 			return nmc->return_value;
@@ -733,7 +737,7 @@ do_general_hostname (NmCli *nmc, int argc, char **argv)
 		/* hostname provided -> set it */
 		const char *hostname = *argv;
 
-		if (next_arg (&argc, &argv) == 0)
+		if (next_arg (nmc, &argc, &argv) == 0)
 			g_print ("Warning: ignoring extra garbage after '%s' hostname\n", hostname);
 
 		nmc->should_wait++;
diff --git a/clients/cli/nmcli.c b/clients/cli/nmcli.c
index f19914979e..ac8ae9a22e 100644
--- a/clients/cli/nmcli.c
+++ b/clients/cli/nmcli.c
@@ -219,9 +219,9 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 	if (argc > 1 && nm_streq (argv[1], "--complete-args")) {
 		nmc->complete = TRUE;
 		argv[1] = argv[0];
-		argc--; argv++;
+		next_arg (nmc, &argc, &argv);
 	}
-	argc--; argv++;
+	next_arg (nmc, &argc, &argv);
 
 	/* parse options */
 	while (argc) {
@@ -231,15 +231,15 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 
 		if (argc == 1 && nmc->complete) {
 			nmc_complete_strings (opt, "--terse", "--pretty", "--mode", "--colors", "--escape",
-			                           "--fields", "--nocheck", "--ask", "--show-secrets",
-			                           "--get-values", "--wait", "--version", "--help", NULL);
+			                           "--fields", "--nocheck", "--get-values",
+			                            "--wait", "--version", "--help", NULL);
 		}
 
 		if (opt[1] == '-') {
 			opt++;
 			/* '--' ends options */
 			if (opt[1] == '\0') {
-				argc--; argv++;
+				next_arg (nmc, &argc, &argv);
 				break;
 			}
 		}
@@ -272,11 +272,13 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 				nmc->print_output = NMC_PRINT_PRETTY;
 		} else if (matches (opt, "-mode")) {
 			nmc->mode_specified = TRUE;
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: missing argument for '%s' option."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_strings (argv[0], "tabular", "multiline", NULL);
 			if (matches (argv[0], "tabular"))
@@ -289,11 +291,13 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 				return FALSE;
 			}
 		} else if (matches (opt, "-colors")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: missing argument for '%s' option."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_strings (argv[0], "yes", "no", "auto", NULL);
 			if (matches (argv[0], "auto"))
@@ -308,11 +312,13 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 				return FALSE;
 			}
 		} else if (matches (opt, "-escape")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: missing argument for '%s' option."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				nmc_complete_strings (argv[0], "yes", "no", NULL);
 			if (matches (argv[0], "yes"))
@@ -325,20 +331,24 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 				return FALSE;
 			}
 		} else if (matches (opt, "-fields")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: fields for '%s' options are missing."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				complete_fields (argv[0]);
 			nmc->required_fields = g_strdup (argv[0]);
 		} else if (matches (opt, "-get-values")) {
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: fields for '%s' options are missing."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (argc == 1 && nmc->complete)
 				complete_fields (argv[0]);
 			nmc->required_fields = g_strdup (argv[0]);
@@ -350,17 +360,15 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 			nmc->mode_specified = TRUE;
 		} else if (matches (opt, "-nocheck")) {
 			/* ignore for backward compatibility */
-		} else if (matches (opt, "-ask")) {
-			nmc->ask = TRUE;
-		} else if (matches (opt, "-show-secrets")) {
-			nmc->show_secrets = TRUE;
 		} else if (matches (opt, "-wait")) {
 			unsigned long timeout;
-			if (next_arg (&argc, &argv) != 0) {
+			if (!argc) {
 				g_string_printf (nmc->return_text, _("Error: missing argument for '%s' option."), opt);
 				nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 				return FALSE;
 			}
+			argc--;
+			argv++;
 			if (!nmc_string_to_uint (argv[0], TRUE, 0, G_MAXINT, &timeout)) {
 				g_string_printf (nmc->return_text, _("Error: '%s' is not a valid timeout for '%s' option."),
 						 argv[0], opt);
@@ -381,8 +389,7 @@ process_command_line (NmCli *nmc, int argc, char **argv)
 			nmc->return_value = NMC_RESULT_ERROR_USER_INPUT;
 			return FALSE;
 		}
-		argc--;
-		argv++;
+		next_arg (nmc, &argc, &argv);
 	}
 
 	/* Now run the requested command */
diff --git a/clients/cli/utils.c b/clients/cli/utils.c
index 03c7716727..a6f18c5f0e 100644
--- a/clients/cli/utils.c
+++ b/clients/cli/utils.c
@@ -28,6 +28,7 @@
 #include <arpa/inet.h>
 
 #include "utils.h"
+#include "common.h"
 
 gboolean
 matches (const char *cmd, const char *pattern)
@@ -38,17 +39,34 @@ matches (const char *cmd, const char *pattern)
 	return memcmp (pattern, cmd, len) == 0;
 }
 
+static gboolean
+parse_global_arg (NmCli *nmc, const char *arg)
+{
+	if (nmc_arg_is_option (arg, "ask"))
+		nmc->ask = TRUE;
+	else if (nmc_arg_is_option (arg, "show-secrets"))
+		nmc->show_secrets = TRUE;
+	else
+		return FALSE;
+
+	return TRUE;
+}
+
 int
-next_arg (int *argc, char ***argv)
+next_arg (NmCli *nmc, int *argc, char ***argv)
 {
 	int arg_num = *argc;
 
-	if (arg_num > 0) {
-		(*argc)--;
-		(*argv)++;
-	}
-	if (arg_num <= 1)
-		return -1;
+	do {
+		if (arg_num > 0) {
+			(*argc)--;
+			(*argv)++;
+		}
+		if (nmc && nmc->complete && *argc == 1 && ***argv == '-')
+			nmc_complete_strings (**argv, "--ask", "--show-secrets", NULL);
+		if (arg_num <= 1)
+			return -1;
+	} while (nmc && parse_global_arg (nmc, **argv));
 
 	return 0;
 }
@@ -82,7 +100,6 @@ nmc_arg_is_option (const char *str, const char *opt_name)
 	return (*p ? matches (p, opt_name) : FALSE);
 }
 
-
 /*
  * Helper function to parse command-line arguments.
  * arg_arr: description of arguments to look for
@@ -117,11 +134,13 @@ nmc_parse_args (nmc_arg_t *arg_arr, gboolean last, int *argc, char ***argv, GErr
 				}
 
 				if (p->has_value) {
-					if (next_arg (argc, argv) != 0) {
+					if (!argc) {
 						g_set_error (error, NMCLI_ERROR, NMC_RESULT_ERROR_USER_INPUT,
 						             _("Error: value for '%s' argument is required."), *(*argv-1));
 						return FALSE;
 					}
+					argc--;
+					argv++;
 					*(p->value) = **argv;
 				}
 				p->found = TRUE;
@@ -151,7 +170,7 @@ nmc_parse_args (nmc_arg_t *arg_arr, gboolean last, int *argc, char ***argv, GErr
 			return FALSE;
 		}
 
-		next_arg (argc, argv);
+		next_arg (NULL, argc, argv);
 	}
 
 	return TRUE;
diff --git a/clients/cli/utils.h b/clients/cli/utils.h
index b48b86ce39..d889962df7 100644
--- a/clients/cli/utils.h
+++ b/clients/cli/utils.h
@@ -40,7 +40,7 @@ typedef enum {
 
 /* === Functions === */
 gboolean matches (const char *cmd, const char *pattern);
-int next_arg (int *argc, char ***argv);
+int next_arg (NmCli *nmc, int *argc, char ***argv);
 gboolean nmc_arg_is_help (const char *arg);
 gboolean nmc_arg_is_option (const char *arg, const char *opt_name);
 gboolean nmc_parse_args (nmc_arg_t *arg_arr, gboolean last, int *argc, char ***argv, GError **error);