chore: render CLI errors as TOON by octavian-snyk · Pull Request #7239 · snyk/cli

octavian-snyk · 2026-09-08T07:24:19Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___)
Includes product update to be announced in the next stable release notes

What does this PR do?

Adds TOON-encoded error output when --toon is selected.

Normal command errors are written to stdout using a structured document containing
error, ok, and path. The existing JSON error behavior is preserved.

The PR also makes --toon, --json, --sarif, and --html mutually exclusive.
Selecting more than one output format fails before command execution with
SNYK-CLI-0024. Format-selection and rendering diagnostics are written to stderr
so they do not corrupt structured stdout.

The implementation does not add a TOON encoder dependency. It formats the small
error document locally, including the quoting and escaping required for TOON values.

Where should the reviewer start?

Start with cliv2/cmd/cliv2/behavior/output.go, which contains output-format
validation and structured error rendering. Then review the integration in
cliv2/pkg/core/main.go.

The corresponding tests are in:

cliv2/cmd/cliv2/behavior/output_test.go
cliv2/pkg/core/main_test.go

How should this be manually tested?

Run a command that returns a catalog error with --toon.
Verify stdout is a TOON document containing error, ok: false, and path.
Redirect stdout and stderr separately and confirm that normal TOON errors remain
parseable on stdout.
Combine --toon with each of --json, --sarif, and --html.
Verify each combination exits with SNYK-CLI-0024, writes the diagnostic to
stderr, and leaves stdout empty.
Run the equivalent command with --json and confirm its existing structured
error output is unchanged.

What's the product update that needs to be communicated to CLI users?

CLI errors can now be rendered as TOON by passing --toon.

The --toon, --json, --sarif, and --html output options are mutually
exclusive. Combining them returns SNYK-CLI-0024 before the command runs.

Risk assessment (Medium)

This changes error formatting and stream selection for structured-output consumers.
Default human-readable output remains unchanged, and the existing JSON error shape
is preserved.

Breaking API changes

None.

What are the relevant tickets?

CLI-1828

Note

Medium Risk
Changes structured error shape/stream routing for --toon/--json consumers and adds pre-run rejection of conflicting output flags; default human output is largely unchanged.

Overview
Adds TOON structured error output when --toon is set, alongside existing JSON (error / ok / path), with local TOON quoting/escaping and no new encoder dependency.

Centralizes output behavior in behavior/output.go: rejects more than one of --toon, --json, --sarif, and --html before the command runs (including conflicts from config/env), while allowing SARIF/JSON alias pairs registered via AddAlternativeKeys. Validation is skipped when SNYK_FORCE_LEGACY_CLI is set.

Wires this into main.go: persistent --toon flag, pre-run validation, displayError uses RenderStructuredError and writes structured failures to stdout; human/diagnostic errors go to the stream chosen by SelectErrorOutputWriter (fixes CLI-1828 so redirects like --html do not mix errors into the redirected file). Data-rendering catalog errors stay on stderr even with TOON/JSON.

^{Reviewed by Cursor Bugbot for commit 7ce6f53. Bugbot is set up for automated code reviews on this repo. Configure here.}

snyk-io · 2026-09-08T07:24:52Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

cursor

Stale Bugbot comment from a previous run.

robertolopezlopez · 2026-09-08T09:48:05Z

product update: probably you may add the conflicting flags validation. In such case, the error will be shown as standard output. (From the pitch)

robertolopezlopez

Hi,

It looks good to me. The change is tight. I have also done manual validation and it does what it should. Just one not blocking observation.

Approved

cursor

Stale Bugbot comment from a previous run.

cursor

Stale Bugbot comment from a previous run.

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-09-09T08:40:58Z

+func validateOutputFormatSelection(config configuration.Configuration, cmd *cobra.Command) error {
+	if config.GetBool(constants.SNYK_FORCE_LEGACY_CLI_ENV) {
+		return nil
+	}


Legacy force env unwired

Low Severity

validateOutputFormatSelection skips format checks when config.GetBool(constants.SNYK_FORCE_LEGACY_CLI_ENV) is true, but this PR only adds the SNYK_FORCE_LEGACY_CLI config key constant without registering it in initApplicationConfiguration or supported env wiring. Setting the homonymous environment variable may not disable validation.

Additional Locations (1)

cliv2/internal/constants/constants.go#L26-L27

^{Reviewed by Cursor Bugbot for commit 79e329d. Configure here.}

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7ce6f53. Configure here.}

cursor · 2026-09-09T11:01:57Z

+				displayError(tt.err, console, config, t.Context(), false)
+
+				expected := fmt.Sprintf("error: %s\nok: false\npath: /workspace\n", getErrorMessage(tt.err))
+				assert.Equal(t, expected, stdout.String())


TOON test expects extra newline

Low Severity

The TOON catalog-error test expects stdout to end with a newline after the path line, but renderTOONError formats the document without a trailing newline. That mismatch with the approved fixture test (which compares trimmed output) can fail CI or confuse consumers about the canonical TOON error shape.

Additional Locations (1)

cliv2/cmd/cliv2/behavior/output.go#L102-L110

^{Reviewed by Cursor Bugbot for commit 7ce6f53. Configure here.}

snyk-pr-review-bot · 2026-09-09T11:03:36Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed This review considered 25 relevant code sections from 12 files (average relevance: 0.97) cliv2/pkg/core/errorhandling.go (lines 1-100) cliv2/pkg/core/exitcode.go (lines 1-100) cliv2/internal/cliv2/cliv2.go (2 segments, lines 1-100) cliv2/pkg/core/main.go (lines 1-190) cliv2/pkg/core/logheaderfooter.go (lines 1-100) cliv2/pkg/basic_workflows/legacycli.go (lines 1-100) CLAUDE.md (3 segments, lines 65-152) ... and 5 more file(s)
🤖 Repository instructions applied (from `AGENTS.md`)

PeterSchafer · 2026-09-09T11:29:34Z

@@ -0,0 +1,3 @@
+error: No supported files found
+ok: false


question: does ok false or true have any meaning for an agent?

PeterSchafer · 2026-09-09T12:11:23Z

 const SNYK_OAUTH_ACCESS_TOKEN_ENV = "SNYK_OAUTH_TOKEN"
 const SNYK_API_TOKEN_ENV = "SNYK_TOKEN"
 const SNYK_ANALYTICS_DISABLED_ENV = "SNYK_DISABLE_ANALYTICS"
+const SNYK_FORCE_LEGACY_CLI_ENV = "SNYK_FORCE_LEGACY_CLI"


Question: Where is this Env Var coming from.

PeterSchafer

I don't think this is ready yet.

octavian-snyk requested a review from a team as a code owner September 8, 2026 07:24