feat: [AG-414] add studio extension to CLI

[dan-arpino]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Adding a new CLI extension for Snyk Studio. This new extension takes the existing hooks and installer that we have in snyk/studio-recipes and embeds them into the CLI, so that you can both install and run your Snyk Studio scripts directly by running CLI commands, as opposed to running random python scripts.

Where should the reviewer start?

Just some package changes adding our new cli-extension

How should this be manually tested?

you should be able to run snyk studio install and install the new hooks. We've added a bunch of comparison tests in our studio-internal repo to confirm working solutions.

Added tests to Studio Internal to test the CLI's extension:
https://github.com/snyk/studio-internal/pull/256
https://github.com/snyk/studio-internal/pull/255
https://github.com/snyk/studio-internal/pull/290

What's the product update that needs to be communicated to CLI users?

This is going in as experimental and not yet GA.

Risk assessment (Low | Medium | High)?

Low - should be isolated to just the new extension. No changes to existing functionality

What are the relevant tickets?

AG-411

---

Note

Low Risk
Additive extension registration only; no changes to existing CLI behavior beyond loading the new module.

Overview
Wires the Snyk Studio CLI extension into the private cliv2 binary so Studio commands (e.g. snyk studio install) are available alongside existing extensions.

The change adds github.com/snyk/cli-extension-studio v1.0.1 to go.mod/go.sum, registers studio.Init via core.WithAdditionalExtensions in main.go, and includes a commented local replace for developing against a sibling cli-extension-studio repo.

^{Reviewed by Cursor Bugbot for commit fa6ea0a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 8 relevant code sections from 6 files (average relevance: 0.93) CLAUDE.md (2 segments, lines 1-65) cliv2/pkg/core/main.go (2 segments, lines 1-188) cliv2/pkg/core/workflows.go (lines 1-61) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) cliv2/cmd/cliv2/main.go (lines 1-15) cliv2-private/cmd/cliv2/main.go (lines 1-24)

🤖 Repository instructions applied (from AGENTS.md)