fix(cli): route the two stash init prompts through the shared TTY gate

Both `stash init` prompts gated on `process.stdout.isTTY` and consulted
CI not at all, so a runner with an allocated TTY rendered the prompt and
blocked on /dev/tty forever — strictly more exposed than the `stash impl`
bug, since neither even caught `CI=true`:

- init/index.ts: the confirm offering to chain into `stash plan`
- steps/resolve-proxy-choice.ts: the Proxy-vs-SDK select

Gating on stdout was also the wrong stream: a redirected stdin still
hangs a prompt. Both now use `isInteractive()` from config/tty.ts.

Both files already had correct non-interactive branches, so this is a
condition swap only — no reshaping of the init flow. Non-interactive
init skips the chain offer and prints the `plan --target` hint; the
proxy question defaults to SDK-only, which is what the interactive
prompt defaults to and what cancelling it already produced.

The tests force isTTY on BOTH streams: a CI runner that allocates a TTY
has stdin and stdout both TTYs, and stubbing stdin alone would let the
old stdout gate pass for the wrong reason, since vitest's own stdout is
not a TTY. Verified by reverting both gates — all six CI cases fail.

Author: tobyhede

.changeset/hungry-spoons-shake.md

@@ -2,14 +2,23 @@
 'stash': patch
 ---
 
-Fix `stash impl` hanging on CI runners that set `CI=1` or `CI=TRUE`.
+Fix `stash impl` and `stash init` hanging on CI runners that allocate a TTY.
 
-`stash impl` decided whether to prompt with an inline `process.env.CI !== 'true'`
-check, which only recognised the exact lowercase spelling. On a CI runner that
-sets `CI=1` or `CI=TRUE` and allocates a TTY, the command believed it was
-interactive and blocked forever on the plan-summary confirmation or the
-agent-target picker — a silent hang with no error and no timeout.
+Three prompts decided whether to run interactively without going through the
+shared TTY helper, so on a CI runner with an allocated TTY they rendered a clack
+prompt and blocked forever on `/dev/tty` — a silent hang with no error and no
+timeout:
 
-The gate now uses the shared `isInteractive()` helper, the same one `stash plan`
-already used, which treats `1`/`true` in any case as CI. `stash impl` now takes
-the non-interactive path on those runners, matching `stash plan`.
+- `stash impl` gated on an inline `process.env.CI !== 'true'`, which only
+  recognised the exact lowercase spelling. Runners that set `CI=1` or `CI=TRUE`
+  blocked on the plan-summary confirmation or the agent-target picker.
+- `stash init`'s offer to chain into `stash plan`, and its Proxy-vs-SDK
+  question, gated on `process.stdout.isTTY` and did not consult `CI` at all —
+  so they hung on any CI runner with a TTY, whatever the spelling. Gating on
+  stdout was also the wrong stream: a redirected stdin still hangs a prompt.
+
+All three now use the shared `isInteractive()` helper (stdin is a TTY and `CI`
+is not set to `1`/`true` in any case), matching `stash plan`. Non-interactive
+runs take the path they always should have: `stash init` skips the chain offer
+and prints the `plan --target` hint, the Proxy-vs-SDK question defaults to
+SDK-only, and `stash impl` proceeds without prompting.

packages/cli/src/commands/init/__tests__/init-command.test.ts

@@ -1,5 +1,5 @@
 import * as p from '@clack/prompts'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { CliExit } from '../../../cli/exit.js'
 import { messages } from '../../../messages.js'
 import type { InitState } from '../types.js'
@@ -174,3 +174,64 @@ describe('initCommand — honest summary', () => {
     )
   })
 })
+
+describe('initCommand — CI detection on the `stash plan` chain offer', () => {
+  // Regression: this gate was `process.stdout.isTTY`, which consulted CI not
+  // at all. A CI runner with an allocated TTY reached the confirm and blocked
+  // on /dev/tty forever — a hang, not an error. It also asked about the wrong
+  // stream: a redirected stdin still hangs the prompt. Now `isInteractive()`
+  // (stdin + isCiEnv, which accepts 1/true in any case).
+  const originalStdinIsTTY = process.stdin.isTTY
+  const originalStdoutIsTTY = process.stdout.isTTY
+
+  // Force BOTH streams. A CI runner that allocates a TTY has stdin *and*
+  // stdout as TTYs — that is the configuration this gate used to hang in, and
+  // setting stdin alone would let the old `process.stdout.isTTY` gate pass
+  // these tests for the wrong reason (vitest's own stdout is not a TTY).
+  beforeEach(() => {
+    Object.defineProperty(process.stdin, 'isTTY', {
+      value: true,
+      configurable: true,
+    })
+    Object.defineProperty(process.stdout, 'isTTY', {
+      value: true,
+      configurable: true,
+    })
+  })
+
+  afterEach(() => {
+    Object.defineProperty(process.stdin, 'isTTY', {
+      value: originalStdinIsTTY,
+      configurable: true,
+    })
+    Object.defineProperty(process.stdout, 'isTTY', {
+      value: originalStdoutIsTTY,
+      configurable: true,
+    })
+    vi.unstubAllEnvs()
+  })
+
+  for (const ciValue of ['1', 'TRUE', 'true']) {
+    it(`skips the chain offer under CI=${ciValue} even with a TTY`, async () => {
+      vi.stubEnv('CI', ciValue)
+
+      await expect(initCommand({}, {})).resolves.toBeUndefined()
+
+      // Non-interactive must skip the offer, not fail: init still completes,
+      // and steers the user at `plan --target` instead of blocking.
+      expect(vi.mocked(p.confirm)).not.toHaveBeenCalled()
+      expect(vi.mocked(p.outro)).toHaveBeenCalledWith(
+        expect.stringContaining('--target'),
+      )
+    })
+  }
+
+  it('offers the chain when CI is unset and stdin is a TTY', async () => {
+    vi.stubEnv('CI', '')
+    vi.mocked(p.confirm).mockResolvedValueOnce(false)
+
+    await expect(initCommand({}, {})).resolves.toBeUndefined()
+
+    expect(vi.mocked(p.confirm)).toHaveBeenCalledTimes(1)
+  })
+})

packages/cli/src/commands/init/index.ts

@@ -1,5 +1,6 @@
 import * as p from '@clack/prompts'
 import { CliExit } from '../../cli/exit.js'
+import { isInteractive } from '../../config/tty.js'
 import { messages } from '../../messages.js'
 import { HANDOFF_CHOICES } from '../impl/steps/how-to-proceed.js'
 import { planCommand } from '../plan/index.js'
@@ -165,7 +166,13 @@ export async function initCommand(
     // multi-command flow. Drafting a plan is fast (~1–3 min of agent
     // thinking) and produces a reviewable artifact — `stash impl` is the
     // separate, slower verb that actually mutates code.
-    if (process.stdout.isTTY) {
+    //
+    // Gated on the shared `isInteractive()` (config/tty.ts), the same helper
+    // every other prompt uses. `process.stdout.isTTY` was wrong on both
+    // counts: it ignored CI entirely (a runner with an allocated TTY blocked
+    // here forever, since clack `confirm` reads /dev/tty), and it asked about
+    // the wrong stream — a redirected stdin still hangs the prompt.
+    if (isInteractive()) {
       const proceed = await p.confirm({
         message: `Continue to \`${cli} plan\` now to draft your encryption plan?`,
         initialValue: true,

packages/cli/src/commands/init/steps/__tests__/resolve-proxy-choice.test.ts

@@ -0,0 +1,118 @@
+import * as p from '@clack/prompts'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { InitProvider, InitState } from '../../types.js'
+import { resolveProxyChoiceStep } from '../resolve-proxy-choice.js'
+
+vi.mock('@clack/prompts', () => ({
+  select: vi.fn(),
+  isCancel: vi.fn(() => false),
+  log: { info: vi.fn(), success: vi.fn(), warn: vi.fn(), error: vi.fn() },
+}))
+
+const provider = {} as InitProvider
+const baseState = {} as InitState
+
+const originalStdinIsTTY = process.stdin.isTTY
+const originalStdoutIsTTY = process.stdout.isTTY
+
+/**
+ * Force BOTH streams. A CI runner that allocates a TTY has stdin *and* stdout
+ * as TTYs — that is the configuration this gate used to hang in, and setting
+ * stdin alone would let the old `process.stdout.isTTY` gate pass these tests
+ * for the wrong reason (vitest's own stdout is not a TTY).
+ */
+function setTty(value: boolean) {
+  Object.defineProperty(process.stdin, 'isTTY', { value, configurable: true })
+  Object.defineProperty(process.stdout, 'isTTY', { value, configurable: true })
+}
+
+function restoreTty() {
+  Object.defineProperty(process.stdin, 'isTTY', {
+    value: originalStdinIsTTY,
+    configurable: true,
+  })
+  Object.defineProperty(process.stdout, 'isTTY', {
+    value: originalStdoutIsTTY,
+    configurable: true,
+  })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+afterEach(() => {
+  restoreTty()
+  vi.unstubAllEnvs()
+})
+
+describe('resolveProxyChoiceStep — flag short-circuit', () => {
+  it('returns state untouched when --proxy/--no-proxy already set it', async () => {
+    setTty(true)
+    vi.stubEnv('CI', '')
+
+    const state = { ...baseState, usesProxy: true }
+    await expect(resolveProxyChoiceStep.run(state, provider)).resolves.toEqual(
+      state,
+    )
+    expect(vi.mocked(p.select)).not.toHaveBeenCalled()
+  })
+})
+
+describe('resolveProxyChoiceStep — CI detection with a TTY attached', () => {
+  // Regression: this gate was `process.stdout.isTTY`, which consulted CI not
+  // at all. On a CI runner with an allocated TTY the clack `select` rendered
+  // and blocked on /dev/tty forever — a hang, not an error. `isInteractive()`
+  // gates on stdin and treats CI=1/TRUE/true alike.
+  beforeEach(() => {
+    setTty(true)
+  })
+
+  for (const ciValue of ['1', 'TRUE', 'true']) {
+    it(`defaults to SDK-only under CI=${ciValue} without prompting`, async () => {
+      vi.stubEnv('CI', ciValue)
+
+      const result = await resolveProxyChoiceStep.run(baseState, provider)
+
+      // Non-interactive proceeds with the safe default rather than failing:
+      // SDK-only is what the flagless interactive prompt defaults to anyway.
+      expect(vi.mocked(p.select)).not.toHaveBeenCalled()
+      expect(result.usesProxy).toBe(false)
+      expect(vi.mocked(p.log.info)).toHaveBeenCalledWith(
+        expect.stringContaining('defaulting to SDK-only mode'),
+      )
+    })
+  }
+
+  it('prompts when CI is unset and stdin is a TTY', async () => {
+    vi.stubEnv('CI', '')
+    vi.mocked(p.select).mockResolvedValueOnce(true)
+
+    const result = await resolveProxyChoiceStep.run(baseState, provider)
+
+    expect(vi.mocked(p.select)).toHaveBeenCalledTimes(1)
+    expect(result.usesProxy).toBe(true)
+  })
+
+  it('falls back to SDK-only when the interactive prompt is cancelled', async () => {
+    vi.stubEnv('CI', '')
+    vi.mocked(p.select).mockResolvedValueOnce(Symbol('cancel'))
+    vi.mocked(p.isCancel).mockReturnValueOnce(true)
+
+    const result = await resolveProxyChoiceStep.run(baseState, provider)
+
+    expect(result.usesProxy).toBe(false)
+  })
+})
+
+describe('resolveProxyChoiceStep — no TTY', () => {
+  it('defaults to SDK-only when stdin is not a TTY, CI unset', async () => {
+    setTty(false)
+    vi.stubEnv('CI', '')
+
+    const result = await resolveProxyChoiceStep.run(baseState, provider)
+
+    expect(vi.mocked(p.select)).not.toHaveBeenCalled()
+    expect(result.usesProxy).toBe(false)
+  })
+})

packages/cli/src/commands/init/steps/resolve-proxy-choice.ts

@@ -1,4 +1,5 @@
 import * as p from '@clack/prompts'
+import { isInteractive } from '../../../config/tty.js'
 import type { InitProvider, InitState, InitStep } from '../types.js'
 
 /**
@@ -7,8 +8,8 @@ import type { InitProvider, InitState, InitStep } from '../types.js'
  * interactive prompt, and stored on state.usesProxy.
  *
  * The prompt is non-blocking: cancellation falls back to false (SDK-only,
- * the default). In non-TTY contexts without a flag, defaults to false and
- * logs an info message.
+ * the default). In non-interactive contexts without a flag, defaults to false
+ * and logs an info message.
  */
 export const resolveProxyChoiceStep: InitStep = {
   id: 'resolve-proxy-choice',
@@ -19,8 +20,13 @@ export const resolveProxyChoiceStep: InitStep = {
       return state
     }
 
-    // In TTY mode, prompt the user
-    if (process.stdout.isTTY) {
+    // Prompt only when it's safe to: stdin is a real TTY and we're not in CI.
+    // Via the shared `isInteractive()` (config/tty.ts) so this gate matches
+    // every other prompt gate. Keying off `process.stdout.isTTY` was wrong on
+    // both counts — it ignored CI entirely (a runner with an allocated TTY
+    // blocked here forever), and a redirected stdin still hangs clack `select`,
+    // which reads from /dev/tty.
+    if (isInteractive()) {
       const choice = await p.select({
         message:
           'Are you planning to query encrypted data via CipherStash Proxy, or directly via the SDK?',
@@ -48,7 +54,7 @@ export const resolveProxyChoiceStep: InitStep = {
       return { ...state, usesProxy: choice }
     }
 
-    // Non-TTY: default to false and log
+    // Non-interactive: default to false and log
     p.log.info(
       'No --proxy flag set; defaulting to SDK-only mode (no `stash db push` in default flows).',
     )