fix(cli): prevent handled errors from producing duplicate output [CLI-1765]

[bdemeo12]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable) — none
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___) — n/a, no user-facing docs change
• Includes product update to be announced in the next stable release notes

What does this PR do?

Fixes:

json output being unparseable because an extra error was printed after the result. This happens when the CLI receives an error (aside from exit status 1), it prints it — so once teardown joins the exit error together with the handled network errors, the result is no longer exit status 1 and gets printed after the real output.

Also pins snyk-docker-plugin to 9.20.0 so CI exercises the failure being fixed. (Original PR: #7047 + discussion: https://snyksec.atlassian.net/servicedesk/customer/portal/64/CLIA-1576)

Where should the reviewer start?

cliv2/pkg/core/main.go — shouldSuppressDisplay and the third return value from processError, then the guarded displayError call in tearDown.

Then cliv2/pkg/core/main_test.go for the two new cases in Test_processError and the new Test_shouldSuppressDisplay.

How should this be manually tested?

Against an image whose provenance fetch fails (SDP version 9.20.0 +):

snyk container test <image> --json > out.json
jq . out.json

The container.spec.ts acceptance job is the automated equivalent — it fails on 9.20.0 without this fix, which is why the pin is included here.

What's the product update that needs to be communicated to CLI users?

n/a

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[bdemeo12]

This PR originates from: #7047

[bdemeo12]

An exit code below SNYK_EXIT_CODE_ERROR means the command worked and anything alongside it is noise

[CatalinSnyk]

I found a second reproduction after this PR was opened: running snyk code test can successfully return findings while an auxiliary organization-slug lookup returns 403. The scan returns ErrorWithExitCode{1}, which is then joined with the captured Forbidden error and printed after the results.

This implementation appears to fix the Container case (exec.ExitError{1}), but not this Code case because the early suppression only checks exec.ExitError. Could we determine suppression from the original command error before joining, covering both error types?

[bdemeo12]

All errors are combined here:

cli/cliv2/pkg/core/main.go

Line 771 in cbc275e

resultErrorList = append([]error{resultError}, resultErrorList...)

shouldSuppressDisplay returns true when there's nothing to show:

cli/cliv2/pkg/core/main.go

Line 504 in cbc275e

if shouldSuppressDisplay(err) {

Previously displayError checked the error's type directly. it didnt account for a combined error, so it fell through to the printing code and emitted a second JSON object.:

cli/cliv2/pkg/core/main.go

Line 462 in 26f0543

if isExitError || isErrorWithCode || errorHasBeenShown(err) {

Now this check suppresses the display err by returning early, before the printing

[CatalinSnyk]

The Code reproduction also makes me think the original error is the better place to make this decision. Before processError, we know whether the command returned exec.ExitError or ErrorWithExitCode; after joining, we have to infer that recursively and risk suppressing unrelated sibling errors.

[CatalinSnyk]

I think we could calculate suppression from the original error in tearDown func, before processError joins anything?

suppressDisplay := shouldSuppressDisplay(err)
if err != nil {
    allErrors, outputError = processError(err, errorList)
    // If processError selected a different error, such as maintenance or the
    // captured cause of TS_CLI_TERMINATED, that error still needs displaying.
    suppressDisplay = suppressDisplay && errors.Is(outputError, err)
}
if !suppressDisplay {
    displayError(outputError, ...)
}

shouldSuppressDisplay could then retain the simple direct checks for exec.ExitError, ErrorWithExitCode, and already-displayed errors. This covers both cases while avoiding recursive unwrapping.

[bdemeo12]

bumped SDP to use as an acceptance test

[bdemeo12]

#7047

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[fix(cli): prevent handled errors from producing duplicate output CLI-1765](#7130)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[fix(cli): decide error suppression from the original exit code CLI-1765](https://api.github.com/repos/snyk/cli/git/commits/e0ef82686807ad624443322b8ab6ed86fae5f447)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 1319e14

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Tight Suppression Coupling 🟡 [minor] The check errors.Is(outputError, err) in tearDown ensures suppression only occurs if the error processed by processError is semantically equivalent to the input error. If processError wraps the error in a way that errors.Is returns false (e.g. if it uses a wrapper that doesn't properly unwrap), the suppression logic will be bypassed, leading to the duplicate output this PR intends to fix. Given processError isn't visible in the diff but is known to aggregate errors, ensure it uses errors.Join or similar standard wrapping. suppressDisplay = shouldSuppressDisplay(err) && errors.Is(outputError, err)

📚 Repository Context Analyzed This review considered 9 relevant code sections from 6 files (average relevance: 0.88) cliv2/pkg/core/exitcode.go (lines 1-197) cliv2/pkg/core/errorhandling.go (lines 1-110) cliv2/pkg/core/main.go (4 segments, lines 1-188) package.json (lines 1-236) src/cli/main.ts (lines 1-236) package-lock.json (lines 6-266)

🤖 Repository instructions applied (from AGENTS.md)