feat(cliv2): enable CaptureEngine billing lifecycle [IANDT-240]

[brettgurman-snyk]

Summary

Minimal cliv2 host adapter for IANDT-240 lazy-open contributor billing. Registers GAF failure-cleanup hook and calls FinishCommand at tearDown. Capture session opens inside GAF middleware on first billable HTTP — not at command start.

Requires GAF stack: #664 → #671 → #681 (pinned pre-release below).

Lazy-open flow

snyk monitor
  → SetCommand("monitor") via existing analytics        # no billing setup at start
  → first billable HTTP → GAF middleware opens session  # #671
  → tearDown → FinishCommand(success)                   # this PR
       → CloseCommandSession + EmitFromCapture → POST contributing_devs

Removed from earlier draft: BeginCommand, WithContributorBillingCapture(), syncActiveBillingCommand / config-key approach.

Diff vs main

File	Change
cliv2/pkg/core/main.go	EnableIfConfigured at engine creation; FinishCommand in tearDown; removed BeginCommand and WithContributorBillingCapture()
cliv2/go.mod / go.sum	Pin GAF lazy-open stack (v0.10.1-0.20260806080023-f868e847d10f); local replace commented out for CI

No contributor_billing.go — lifecycle helpers live in GAF pkg/clibilling.

cliv2 wiring

globalEngine = clibilling.EnableIfConfigured(app.CreateAppEngineWithOptions(...))

globalEngine.GetAnalytics().SetCommand(name)   // cobra + legacy paths — unchanged
err = runWorkflowAndProcessData(globalContext, globalEngine, globalLogger, name)

// tearDown:
clibilling.FinishCommand(teardownCtx, globalEngine, globalConfiguration, exitCode == 0)

Build locally with -tags application (go build -tags application -o ~/bin/snyk-billing ./cmd/cliv2).

Test plan

• make lint + make test in cliv2
• Lazy-open E2E validated locally (snyk monitor → mitmweb shows ingest POST at tearDown)
• CI security check (known failure — tracked separately)
• Production E2E after GAF stack merges to main

Merge order

GAF #664 → #671 → #681 → this PR → E2E

[snyk-io]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	2	0	0	2 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[refactor(cliv2): call clibilling BeginCommand/FinishCommand directly IANDT-240](https://api.github.com/repos/snyk/cli/git/commits/e0fbc5f8e328410326ee627306fd6ce96965be4f)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[feat(cliv2): attach capture bag and finish billing in teardown IANDT-240](https://api.github.com/repos/snyk/cli/git/commits/e2e960204fc28fb04dfc66e85aa085f448192d17)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against e0fbc5f

[cursor]

Verification results

Auto-approval check: this PR is not limited to a dependency bump. Besides the cliv2/go.mod/cliv2/go.sum version bump for go-application-framework, it also changes real logic in cliv2/pkg/core/main.go (wires clibilling.EnableIfConfigured into engine creation, adds clibilling.FinishCommand to teardown, and adds workflow.WithContext(globalContext) to the legacy-CLI invocation). Per policy, only pure dependency-bump PRs are auto-approved, so this one is not being auto-approved. I'm also not requesting changes (per policy this automation never sets a CHANGES_REQUESTED status) — see the findings below for the maintainers to weigh.

Four independent review passes (semantic analysis, adversarial review, security scan, code review) converged on the same core issue, so I'm confident in flagging it even though I'm not blocking the PR.

Critical

• cliv2/pkg/core/main.go:549 — clibilling.FinishCommand(teardownCtx, globalEngine, globalConfiguration, exitCode == 0) uses the process exit code as the billing-success signal. But exitCode also encodes "scan found issues" (e.g. iac test --report — one of the two commands clibilling.IsBillableCommand returns true for — exits non-zero on its normal, expected outcome). finalizeContributorBilling skips emission whenever success is false, so a successful, billable scan that merely reports findings has its captured billing session silently discarded — defeating the PR's own purpose for its headline use case.
• cliv2/pkg/core/main.go:549 — The wait for pending billing emits scales as numRecords * 5s and is not bounded by teardownCtx's own 5s deadline (the wait is a raw time.Duration, decoupled from the context). Any command capturing more than one billing record can make CLI process exit hang well past the 5s budget that teardownCtx/teardownTimeout was explicitly introduced to guarantee.
• Related: clibilling.EnableIfConfigured registers a GAF post-invoke hook that closes/discards the capture bag on any top-level Invoke error. WORKFLOWID_REPORT_ANALYTICS (via sendInstrumentation) and WORKFLOWID_GLOBAL_CLEANUP, both invoked earlier in the same tearDown, are not exempted from this hook — so a transient analytics/cleanup failure before FinishCommand runs can discard billing data for an otherwise fully successful command.

Should Fix

• cliv2/pkg/core/main.go:549 — FinishCommand's bool return value (whether emission completed before the wait budget elapsed) is discarded. Every sibling teardown step in this function logs its outcome; this one fails silently, hiding exactly the failure mode above.
• No test coverage was added for the new wiring (EnableIfConfigured ordering before Init(), or FinishCommand's derived success value across exit-code cases).

Suggestion

• cliv2/go.mod:25 — Pinned to a pre-release pseudo-version corresponding to an upstream PR (go-application-framework#681) that is still in draft. Already flagged by the PR's own comment/description as needing a re-pin before merge — just noting it renders here as well.
• GitHub's security check on this head commit reports "Open Source Security: 2 High", but since no dependency other than the go-application-framework self-reference changed in go.sum, these findings (if genuine) most likely predate this diff rather than being introduced by it. Could not verify details without authenticated Snyk access — worth a human look.

Build, go vet, and go test ./pkg/core/... all pass against the pinned pre-release, and go mod tidy shows no drift, so the dependency bump itself is mechanically clean — the concerns above are all about the new main.go wiring logic.

  

_{Sent by Cursor Automation: Automatic PR verification}