fix(input-json): only read stdin with explicit --input-json -

[rafa-thayto]

Summary

In agent mode the program-level --input-json expander consumed any non-TTY stdin and parsed it as the options payload, even when --input-json was never passed. That broke two common patterns:

# shell loops — the clerk process swallows the rest of the worklist
while read -r app ins; do clerk config patch --app "$app" --instance "$ins" --json '…' --yes; done < worklist.tsv

# commands that read their own stdin
cat payload.json | clerk api /users   # body was pre-empted and parsed as --input-json

Non-JSON stdin then failed with invalid_json before the command ran. This makes stdin read only with an explicit --input-json -; piped stdin is otherwise left untouched.

Test plan

• bun test src/lib/input-json.test.ts and src/test/integration/input-json.test.ts pass
• Updated unit tests assert piped stdin is ignored without --input-json -

Fixes #333

[changeset-bot]

🦋 Changeset detected

Latest commit: e8a1e1b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 50e37c26-587d-4ba6-98e3-384aa09cbafa

📥 Commits

Reviewing files that changed from the base of the PR and between 4240dd5 and e8a1e1b.

📒 Files selected for processing (4)

• .changeset/input-json-explicit-stdin.md
• packages/cli-core/src/commands/users/README.md
• packages/cli-core/src/lib/input-json.test.ts
• packages/cli-core/src/lib/input-json.ts

---

📝 Walkthrough

Walkthrough

expandInputJson in input-json.ts is changed to early-return the original argv array when the --input-json flag is absent, removing any implicit stdin consumption. The readOptionalStdin helper that previously read piped stdin unconditionally is deleted. Stdin is now read only when the explicit value --input-json - is present. The test suite drops prior assertions that piped stdin auto-triggered expansion and adds new assertions that piped input (JSON object, non-JSON, JSON array) produces no change to argv without the flag. The users command README and a new changeset entry document the updated behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: restricting stdin reading to explicit --input-json - flag.
Description check	✅ Passed	The description clearly explains the issue, provides concrete examples of breaking patterns, and describes the fix with context for understanding the motivation.
Linked Issues check	✅ Passed	The PR fully addresses issue #333 by implementing stdin reading only with explicit --input-json -, restoring compatibility with shell loops and piped commands.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the stdin consumption behavior: documentation updates, test updates, and implementation changes are all in scope for the issue.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}