test(cli): close the eight TTY-gate coverage gaps from PR review

Adds the tests auxesis flagged as missing on #704, each verified against
the implementation:

- resolve-proxy-choice: stdin-piped/stdout-TTY split (the "wrong stream"
  claim) and the --no-proxy (usesProxy:false) short-circuit.
- init chain offer: redirected-stdin skip, and the accept arm that chains
  into `stash plan` (planCommand + early return).
- impl: still runs under CI=1 with --target (plus a --continue-without-plan
  variant), the interactive confirm + decline-aborts path, and the
  no-plan/no-flag reroute into the exit(1) branch.
- impl PTY e2e: real-hang reproducer under a genuine TTY with CI=1/TRUE
  (the headline changeset claim; the unit tests only lock the boolean).

Test-only change; no changeset required.

Author: tobyhede

packages/cli/src/commands/impl/__tests__/impl.test.ts

@@ -2,6 +2,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { CliExit } from '../../../cli/exit.js'
 import { implCommand } from '../index.js'
 import { howToProceedStep } from '../steps/how-to-proceed.js'
 
@@ -172,4 +173,75 @@ describe('implCommand — CI detection with a TTY attached', () => {
     expect(confirmMock).toHaveBeenCalledTimes(1)
     expect(runSpy).toHaveBeenCalledTimes(1)
   })
+
+  it('performs the handoff under CI=1 when --target is given', async () => {
+    // Non-interactive means "don't prompt", not "don't run". A regression
+    // that made the command bail early under CI would keep the not-called
+    // cases above green — this locks the automation happy path.
+    vi.stubEnv('CI', '1')
+    const runSpy = vi
+      .spyOn(howToProceedStep, 'run')
+      .mockResolvedValue({} as never)
+
+    await implCommand({}, { target: 'agents-md' })
+
+    expect(confirmMock).not.toHaveBeenCalled()
+    expect(runSpy).toHaveBeenCalledTimes(1)
+    expect(runSpy.mock.calls[0][0].handoff).toBe('agents-md')
+  })
+
+  it('runs the selected handoff under CI with --continue-without-plan and no plan', async () => {
+    // The specific path the `if (isTTY)` gate at index.ts opened up: flag +
+    // target, no plan on disk — it must run the handoff without re-confirming.
+    vi.stubEnv('CI', '1')
+    fs.rmSync(path.join(tmpDir, '.cipherstash', 'plan.md'))
+    const runSpy = vi
+      .spyOn(howToProceedStep, 'run')
+      .mockResolvedValue({} as never)
+
+    await implCommand(
+      { 'continue-without-plan': true },
+      { target: 'agents-md' },
+    )
+
+    expect(confirmMock).not.toHaveBeenCalled()
+    expect(runSpy).toHaveBeenCalledTimes(1)
+    expect(runSpy.mock.calls[0][0].handoff).toBe('agents-md')
+  })
+
+  it('exits 1 with the plan hint under CI=1 when no plan and no --continue-without-plan', async () => {
+    // CI=1 flips isTTY to false, rerouting a no-plan / no-flag run out of the
+    // interactive `select` and into the `else if (!isTTY)` error + exit(1). It
+    // must fail loudly, not render the "No plan found" select and block.
+    vi.stubEnv('CI', '1')
+    fs.rmSync(path.join(tmpDir, '.cipherstash', 'plan.md'))
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
+      throw new Error('process.exit')
+    }) as never)
+
+    await expect(implCommand({}, {})).rejects.toThrow('process.exit')
+
+    expect(exitSpy).toHaveBeenCalledWith(1)
+    expect(confirmMock).not.toHaveBeenCalled()
+  })
+
+  it('still confirms --continue-without-plan interactively, and declining aborts', async () => {
+    // The honour-the-prompt half of the `if (isTTY)` gate: with a TTY and CI
+    // unset the default-no confirm must still fire, and declining it must abort
+    // (CancelledError → CliExit) rather than fall through to the handoff.
+    vi.stubEnv('CI', '')
+    fs.rmSync(path.join(tmpDir, '.cipherstash', 'plan.md'))
+    confirmMock.mockReset()
+    confirmMock.mockResolvedValue(false)
+    const runSpy = vi
+      .spyOn(howToProceedStep, 'run')
+      .mockResolvedValue({} as never)
+
+    await expect(
+      implCommand({ 'continue-without-plan': true }, {}),
+    ).rejects.toBeInstanceOf(CliExit)
+
+    expect(confirmMock).toHaveBeenCalledTimes(1)
+    expect(runSpy).not.toHaveBeenCalled()
+  })
 })

packages/cli/src/commands/init/__tests__/init-command.test.ts

@@ -234,4 +234,46 @@ describe('initCommand — CI detection on the `stash plan` chain offer', () => {
 
     expect(vi.mocked(p.confirm)).toHaveBeenCalledTimes(1)
   })
+
+  it('skips the chain offer when stdin is redirected even if stdout is a TTY', async () => {
+    // The gate keys off stdin, not stdout: `stash init < /dev/null` from a
+    // terminal (stdin piped, stdout still a TTY) must not reach the confirm.
+    // Reinstating `process.stdout.isTTY` would keep the CI loop above green,
+    // so only this stdin/stdout split pins the correct stream.
+    vi.stubEnv('CI', '')
+    Object.defineProperty(process.stdin, 'isTTY', {
+      value: false,
+      configurable: true,
+    })
+    Object.defineProperty(process.stdout, 'isTTY', {
+      value: true,
+      configurable: true,
+    })
+
+    await expect(initCommand({}, {})).resolves.toBeUndefined()
+
+    expect(vi.mocked(p.confirm)).not.toHaveBeenCalled()
+    expect(vi.mocked(p.outro)).toHaveBeenCalledWith(
+      expect.stringContaining('--target'),
+    )
+  })
+
+  it('chains into `stash plan` when the offer is accepted', async () => {
+    // The accept arm (outro + planCommand() + early return) is what the gate
+    // change made reachable; the only other confirm test resolves `false`.
+    vi.stubEnv('CI', '')
+    vi.mocked(p.confirm).mockResolvedValueOnce(true)
+    const { planCommand } = await import('../../plan/index.js')
+
+    await expect(initCommand({}, {})).resolves.toBeUndefined()
+
+    expect(vi.mocked(planCommand)).toHaveBeenCalledTimes(1)
+    expect(vi.mocked(p.outro)).toHaveBeenCalledWith(
+      expect.stringContaining('handing off to `stash plan`'),
+    )
+    // The accept path returns early — it must not also print the --target hint.
+    expect(vi.mocked(p.outro)).not.toHaveBeenCalledWith(
+      expect.stringContaining('--target'),
+    )
+  })
 })

packages/cli/src/commands/init/steps/__tests__/resolve-proxy-choice.test.ts

@@ -57,6 +57,23 @@ describe('resolveProxyChoiceStep — flag short-circuit', () => {
     )
     expect(vi.mocked(p.select)).not.toHaveBeenCalled()
   })
+
+  it('returns state untouched when --no-proxy set usesProxy to false', async () => {
+    // The guard is `state.usesProxy !== undefined`; `false` is the value that
+    // distinguishes it from a truthiness check. Rewriting it as
+    // `if (state.usesProxy)` would silently re-prompt for --no-proxy (and log
+    // the misleading "No --proxy flag set" notice non-interactively).
+    setTty(true)
+    vi.stubEnv('CI', '')
+
+    const state = { ...baseState, usesProxy: false }
+    await expect(resolveProxyChoiceStep.run(state, provider)).resolves.toEqual(
+      state,
+    )
+    expect(vi.mocked(p.select)).not.toHaveBeenCalled()
+    // An explicit --no-proxy is not "no flag set" — don't log the default notice.
+    expect(vi.mocked(p.log.info)).not.toHaveBeenCalled()
+  })
 })
 
 describe('resolveProxyChoiceStep — CI detection with a TTY attached', () => {
@@ -115,4 +132,26 @@ describe('resolveProxyChoiceStep — no TTY', () => {
     expect(vi.mocked(p.select)).not.toHaveBeenCalled()
     expect(result.usesProxy).toBe(false)
   })
+
+  it('does not prompt when stdin is piped even though stdout is a TTY', async () => {
+    // setTty() can't express this — it moves both streams together. The fix
+    // gates on stdin, so a redirected stdin (`stash init < /dev/null` from a
+    // terminal) must not reach the prompt even while stdout is still a TTY.
+    // This is the case that verifies the changeset's "wrong stream" claim;
+    // only the CI axis distinguishes old from new anywhere else.
+    Object.defineProperty(process.stdin, 'isTTY', {
+      value: false,
+      configurable: true,
+    })
+    Object.defineProperty(process.stdout, 'isTTY', {
+      value: true,
+      configurable: true,
+    })
+    vi.stubEnv('CI', '')
+
+    const result = await resolveProxyChoiceStep.run(baseState, provider)
+
+    expect(vi.mocked(p.select)).not.toHaveBeenCalled()
+    expect(result.usesProxy).toBe(false)
+  })
 })

packages/cli/tests/e2e/impl-pty-ci.e2e.test.ts

@@ -0,0 +1,58 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { render } from '../helpers/pty.js'
+
+/**
+ * E2E: the real-hang reproducer. Under a genuine PTY (`process.stdin.isTTY`
+ * is true) with `CI` set to a non-`'true'` spelling, the pre-fix inline
+ * `CI !== 'true'` gate treated the run as interactive and blocked on the
+ * plan-summary confirm forever — a hang, not an error.
+ *
+ * The unit suites mock `@clack/prompts` and assert the gate's boolean; only a
+ * real PTY proves the process terminates. `pty.ts` `render()` defaults
+ * `env.CI` to `'true'`, which is exactly why that regression never surfaced
+ * here before — overriding to `1` / `TRUE` is the precise reproducer.
+ * `impl-non-tty.e2e.test.ts` uses `runPiped`, which gives `isTTY === false`
+ * by construction and cannot reach this path.
+ */
+describe('stash impl — PTY + CI (real-hang reproducer)', () => {
+  let tmpDir: string
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'stash-impl-pty-ci-e2e-'))
+    fs.mkdirSync(path.join(tmpDir, '.cipherstash'))
+    fs.writeFileSync(
+      path.join(tmpDir, '.cipherstash', 'context.json'),
+      JSON.stringify({
+        integration: 'postgresql',
+        packageManager: 'npm',
+        schemas: [],
+      }),
+    )
+    // A plan on disk is what makes the pre-fix code reach the plan-summary
+    // confirm (the prompt that hung); without one it exits earlier.
+    fs.writeFileSync(path.join(tmpDir, '.cipherstash', 'plan.md'), '# Plan')
+  })
+
+  afterEach(() => {
+    if (tmpDir && fs.existsSync(tmpDir)) {
+      fs.rmSync(tmpDir, { recursive: true, force: true })
+    }
+  })
+
+  for (const ciValue of ['1', 'TRUE']) {
+    it(`exits instead of hanging under a PTY with CI=${ciValue}`, async () => {
+      const r = render(['impl'], { cwd: tmpDir, env: { CI: ciValue } })
+      // A regression re-opens the hang; the kill is the backstop so the suite
+      // fails on timeout instead of blocking. The fix exits in ~100ms.
+      const timer = setTimeout(() => r.kill('SIGKILL'), 10_000)
+      const { exitCode } = await r.exit
+      clearTimeout(timer)
+
+      expect(exitCode).toBe(0)
+      expect(r.output).not.toContain('Proceed with implementation')
+    })
+  }
+})