fix: return non-zero exit for unrecognized commands

[mbevc1]

Cobra's TraverseChildren routing (set on the root command) hands an unrecognized command token to the nearest group command with no error; that non-runnable command then prints help and returns nil, so the CLI exits 0. A typo'd command such as kosli garbage list flows therefore silently reports success (issue #1043).

Add findUnknownCommand, called from innerMain before ExecuteC. It resolves the args with cobra's Traverse on a throwaway command tree (so the real command's flag state is untouched) and returns an error when resolution lands on a non-runnable group command while an unconsumed non-flag token that names no subcommand remains. Real commands, group commands invoked with no leftover (e.g. kosli list), and the existing unknown-flag path are all left unchanged.

Example output:

$ ./kosli garbage ls
Error: unknown command: garbage
available subcommands are: allow | archive | assert | attach-policy | attest | begin | completion | config | create | delete | detach-policy | diff | disable | enable | evaluate | fingerprint | get | join | list | log | rename | report | rotate | search | snapshot | status | tag | unarchive | update | version

Closes #1043

Checklist

• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed
• Docs are autogenerated from CLI help — make sure the help text reflects your changes

[claude]

Claude finished @mbevc1's task in 2m 36s —— View job

---

Re-review after commit d615c323

• Read updated main.go / root_test.go and prior review context
• Static analysis (go build ./..., go vet ./cmd/kosli/ — both clean)
• Verify the two prior review fixes
• Fresh pass for remaining issues

---

Verdict: both prior issues are correctly resolved ✅

🔴 Global corruption (prior High) — fixed. saved := global; defer func() { global = saved }() (main.go:81-82) correctly restores the package variable. I confirmed newRootCmd's only package-level mutation is global = new(GlobalOpts) (root.go:382) — the args parameter is never used inside the function body, so nothing else leaks from the probe. TestInnerMainPreservesGlobalAfterProbe is a genuine regression guard: it drives a real command through innerMain (which the golden harness bypasses) and asserts global.Host/global.ApiToken survive — this fails without the defer and passes with it.

🟡 Normalization mismatch (prior Medium) — fixed. The probe now resolves normalizeBoolFlagArgs(probe, args) (main.go:91), and the list --debug false negative case locks it in.

The core logic reads cleanly: Traverse on a throwaway tree, bail on err/Runnable(), find the first non-flag leftover, and defer to cobra when that token is actually a known subcommand/alias so the existing flag diagnostics still fire. The doc comment accurately describes each early-return.

Minor / non-blocking

1. Duplicated unknown-command reporting (already noted as a follow-up by the author). The availableSubcommands construction and the unknown command: … / available subcommands are: … message now exist in both findUnknownCommand (main.go:119-126) and the unknown-flag block (main.go:183-189). Worth extracting a small helper (e.g. unknownCommandError(c, token)) in a later cleanup so the two paths can't drift. Fix this →

2. Edge case (out of scope, just flagging): the check is !c.Runnable(). A command that is both runnable and has subcommands (RunE + AddCommand) would still short-circuit to nil, so a bogus positional there could reach a lenient Args validator and exit 0 — the same class as Bug: an unrecognized command token is ignored, and the CLI exits 0 #1043. I don't think kosli currently has such a command, so this is fine today; a one-line test asserting the assumption (or a comment) would future-proof it.

3. Tiny perf: findUnknownCommand builds the full command tree a second time via newRootCmd. Negligible for a CLI startup path — no action needed, noting for completeness.

Nice work

• Restoring global with defer right next to the newRootCmd call, with a comment explaining why, is exactly the right shape.
• The two new tests each target the precise failure mode (global survival through innerMain; normalized bool flag not misread), and the author verified they fail without the fix — good red/green discipline per the repo's TDD guidance.

Looks ready to merge from my side; the items above are optional.

[mbevc1]

Addressed the review in 68c1089:

🔴 High — probe corrupted the package-level global. Confirmed real. findUnknownCommand now saves and restores global around the newRootCmd probe (saved := global; defer func() { global = saved }()), so the real command's persistent-flag bindings stay intact.

🟡 Medium — normalization mismatch. The probe now resolves normalizeBoolFlagArgs(probe, args) instead of the raw args, so kosli list --debug false no longer misreads false as an unknown command.

🟢 Tests. Added TestInnerMainPreservesGlobalAfterProbe (drives a successful fingerprint … --host … --api-token … through innerMain and asserts global.Host/global.ApiToken survive) plus a list --debug false negative case in TestFindUnknownCommand. I verified both fail without their respective fix and pass with it.

Verified with a real binary (the sandbox does allow execution here):

• kosli garbage / garbage list flows / list garbage → exit 1, unknown command: …
• kosli list --debug false → exit 0, prints list group help
• kosli list flows --host https://example.kosli.com --org demo → request goes to https://example.kosli.com/api/v2/flows/demo (i.e. --host is honored — the exact global regression, now fixed)
• kosli list → exit 0; kosli --badflag list flows → missing subcommand (existing path unchanged)

The duplication between findUnknownCommand and the existing unknown-flag block is left as a noted follow-up.