fix(cli): gate the --continue-without-plan confirm on the TTY check

The flag-consent path was the one prompt on `stash impl` that never went
through `isInteractive()`. With no plan on disk and `--continue-without-plan`
passed, a CI runner still reached `p.confirm`, which reads /dev/tty — the same
hang the rest of this branch closes. Worse if the prompt did resolve: the
confirm is `initialValue: false`, so a non-interactive run would cancel work
the flag had explicitly authorised.

The flag is the consent. Take it as given when non-interactive; keep the
interactive confirmation unchanged.

Author: tobyhede

.changeset/hungry-spoons-shake.md

@@ -4,7 +4,7 @@
 
 Fix `stash impl` and `stash init` hanging on CI runners that allocate a TTY.
 
-Three prompts decided whether to run interactively without going through the
+Four prompts decided whether to run interactively without going through the
 shared TTY helper, so on a CI runner with an allocated TTY they rendered a clack
 prompt and blocked forever on `/dev/tty` — a silent hang with no error and no
 timeout:
@@ -16,8 +16,12 @@ timeout:
   question, gated on `process.stdout.isTTY` and did not consult `CI` at all —
   so they hung on any CI runner with a TTY, whatever the spelling. Gating on
   stdout was also the wrong stream: a redirected stdin still hangs a prompt.
+- `stash impl --continue-without-plan` confirmed the flag with a second prompt
+  that was not gated at all, so a CI run with no plan on disk blocked there even
+  though the flag had already granted consent. The flag is now taken as consent
+  in non-interactive runs and only re-confirmed interactively.
 
-All three now use the shared `isInteractive()` helper (stdin is a TTY and `CI`
+All four now use the shared `isInteractive()` helper (stdin is a TTY and `CI`
 is not set to `1`/`true` in any case), matching `stash plan`. Non-interactive
 runs take the path they always should have: `stash init` skips the chain offer
 and prints the `plan --target` hint, the Proxy-vs-SDK question defaults to

packages/cli/src/commands/impl/__tests__/impl.test.ts

@@ -143,6 +143,24 @@ describe('implCommand — CI detection with a TTY attached', () => {
     })
   }
 
+  it('does not re-confirm --continue-without-plan under CI when no plan exists', async () => {
+    // The flag is the consent. Prompting again under CI blocks on /dev/tty,
+    // and the confirm is default-no, so a resolved prompt would cancel a run
+    // the user explicitly asked for.
+    vi.stubEnv('CI', '1')
+    fs.rmSync(path.join(tmpDir, '.cipherstash', 'plan.md'))
+    const runSpy = vi
+      .spyOn(howToProceedStep, 'run')
+      .mockResolvedValue({} as never)
+
+    await expect(
+      implCommand({ 'continue-without-plan': true }, {}),
+    ).resolves.toBeUndefined()
+
+    expect(confirmMock).not.toHaveBeenCalled()
+    expect(runSpy).not.toHaveBeenCalled()
+  })
+
   it('is interactive when CI is unset and stdin is a TTY', async () => {
     vi.stubEnv('CI', '')
     const runSpy = vi

packages/cli/src/commands/impl/index.ts

@@ -230,7 +230,13 @@ export async function implCommand(
     } else {
       // No plan on disk. Branch on flag / TTY / interactive.
       if (continueWithoutPlan) {
-        await confirmContinueWithoutPlan()
+        // The flag *is* the consent. Re-prompting for it non-interactively
+        // is the same hang this gate exists to close (clack `confirm` reads
+        // /dev/tty), and `confirmContinueWithoutPlan` is default-no, so a
+        // prompt that did resolve would cancel a run the user asked for.
+        if (isTTY) {
+          await confirmContinueWithoutPlan()
+        }
       } else if (!isTTY) {
         p.log.error(
           `No plan at \`${PLAN_REL_PATH}\`. Run \`${cli} plan\` first, or pass --continue-without-plan to skip planning.`,