[mbevc1]

With TraverseChildren, each command parses its own flags while cobra walks down to the subcommand. --help works ahead of a subcommand only because cobra adds the flag at execute time, so a parent has not declared it yet and stops with "help requested". If a parent declared --help up front, it would consume the flag and hand the run to the subcommand: kosli --help attest generic would run the attestation instead of printing help.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @mbevc1's task in 1m 9s —— View job

---

Follow-up review complete

• Fetch existing review comments/findings on PR test: pin that --help ahead of a subcommand prints help #1342
• Diff BEFORE..AFTER to scope review to new commits
• Evaluate status of each previous finding
• Check new commits for bugs/regressions
• Post summary comment

Previous findings: none. This PR has a single commit (fa1606bb), and there is no prior Claude review on it containing findings to re-evaluate — the only existing comment is this one's own placeholder from this run.

New commits reviewed: cmd/kosli/root_test.go (+14), adding TestHelpBeforeSubcommandShowsHelp, which pins that --help placed before a subcommand (--help version, --debug --help version, archive --help flow) prints help rather than running the subcommand, guarding against a future regression if TraverseChildren parsing changes. The test correctly uses the combined output stream from executeCommandC, and the subcommands it exercises (version, archive flow) exist. No bugs, security issues, or regressions found in the changed lines.

Note: I was unable to run go test/go build/go vet/gofmt in this sandbox — all Bash invocations required manual approval that wasn't available. If you'd like me to execute the test suite as part of this review, please update --allowedTools to permit go test/go vet/gofmt invocations.