[roodboi]

Root cause

hack env unset KEY with stdin/stdout not a TTY and without HACK_NO_INTERACTIVE=1 never returned and burned a full CPU core (measured 99% CPU, 3.1 s CPU in 3 s wall, killed only by an external timeout).

confirmSafe in src/lib/interactivity.ts only consulted the explicit opt-out (--no-interactive / HACK_NO_INTERACTIVE). A TTY-less run without that opt-out fell into the "legacy clack behavior" branch and entered @clack/prompts confirm, whose Prompt.prompt() opens a readline interface with terminal: true over stdin and waits for keypress events. On a piped stdin that loop never settles and re-renders continuously.

canPrompt() (TTY on both streams plus the opt-outs) already existed and the raw text/password/select sites in env.ts were guarded with it; the shared confirm helper was the one path that was not.

Fix

• confirmSafe gates on canPrompt(). Whenever prompting is disallowed (no TTY on stdin or stdout, HACK_NO_INTERACTIVE, --no-interactive) the declared policy resolves the answer within milliseconds: accept-default applies the documented default, decline answers no, fail throws E_INTERACTIVE_REQUIRED with the scriptable hint. The clack prompt is never entered without a TTY (documented as an invariant on the helper).
• doctorConfirm prints its "skipped destructive step" note on the same condition (!canPrompt()), not only under the explicit opt-out.
• Audit of every @clack/prompts call site (confirm/select/text/password/multiselect/autocompleteMultiselect and doctorConfirm); sites with the same latent loop are routed through the convention:
  • secrets: name prompt, value prompt and delete confirmation (now confirmSafe with fail) refuse closed without a TTY, before the keychain is touched.
  • session: the default picker and the attached-workspace choice refuse with E_INTERACTIVE_REQUIRED naming hack session list / hack session attach <name> / --new.
  • mcp: target selection refuses, naming --all / --cursor / --claude / --codex.
  • update: the install confirmation checks canPrompt() (stdin as well as stdout; the previous process.stdout.isTTY check let a piped stdin spin).
  • agent: the client picker uses canPrompt() (already short-circuited on raw isTTY; now also honors the opt-outs).
  • Already guarded and left as they are: env.ts raw prompts, project.ts init prompts (behind the io.canPrompt() seam), setup.ts, init-agent-integrations.ts (interactive flag), native-domain-dns-authorization.ts (uses confirmSafe).
• docs/cli.md (agent/scripted ergonomics): documents that a run whose stdin or stdout is not a TTY resolves every prompt by its non-interactive policy, with env unset and doctor --fix as examples of safe defaults and update --yes / mcp --all / session attach <name> as examples of closed refusals.

No CLI options or help text changed, so docs/reference/cli.md and the agent plugin bundle are unchanged.

Tests

• tests/interactivity.test.ts: three new cases stub stdin.isTTY=false (stdout true, no opt-out) and assert accept-default returns the default within 1 s, decline returns false, and fail throws E_INTERACTIVE_REQUIRED mentioning "no TTY" and the hint. Each is bounded by a 2 s test timeout.
• tests/env-unset-no-tty-cli.test.ts (new): spawns the real CLI with piped stdin, no HACK_NO_INTERACTIVE, private HOME/HACK_HOME/DOCKER_CONFIG, the env layer file written first, HACK_SECRETS_DISABLE_KEYCHAIN_FALLBACK=1, and a 5 s SIGKILL bound. Asserts env unset exits 0, removes the key, prints no prompt and never prints the value (canary), with wall time < 5 s and CPU time < 3 s (proc.resourceUsage()); and that secrets delete <name> (a fail-policy site) exits 1 with E_INTERACTIVE_REQUIRED naming the way out, before any keychain access.
• Mutation proof: restoring the old gate (!isExplicitlyNonInteractive()) makes all five new tests fail (the three unit cases time out at 2 s; both e2e cases are SIGKILLed at ~5.0 s with the key still present). Re-running tests/global-command.macos.test.ts under that mutation passes 31/31, which proves the 12 failures it showed under the fix came from the fix, not a pre-existing flake.
• tests/global-command.macos.test.ts: its clack confirm mock stands in for an interactive user, and bun test has no TTY, so the file now stubs both streams' isTTY to true per test (restored in afterEach, reusing its restoreIsTty helper). The one test that exercises the non-interactive sudo -n fallback pins stdin back to non-TTY.

Evidence

• Bun 1.4.2 (mise x bun@1.4.2), bun install --frozen-lockfile, no bun.lock change.
• Local (this Mac, worktree at f0c217a1): bun run --cwd packages/cli typecheck 0 errors; root bun run check (includes privacy:check) 2/2 tasks successful, 0 errors (34 pre-existing warnings); focused run of 17 test files covering every touched command and every file that mocks clack: 188 pass, 0 fail (191 tests, 3 skipped) after the test-fixture adjustments above.
• gitleaks 8.30.1 over the exported origin/next..HEAD range: no leaks.
• Reproduction before/after: echo "" | bun index.ts env unset DOOMED in a temp project: before, killed at 5 s with the prompt rendered and the key still present; after, exit 0 in 0.21 s wall / 0.27 s CPU with the key removed.
• Full suite on the M3 at this exact commit: pending, result appended below.

Gaps

• src/commands/ssh.ts and src/commands/node.ts still call clack select/text/confirm without a canPrompt() guard. Both are unsupported remote/node surfaces per AGENTS.md, so they were left untouched; reported as findings.
• The non-TTY behavior for env unset is the documented default (the key is removed, matching HACK_NO_INTERACTIVE=1), not a refusal; there is no --yes/--force on env unset and none was added.
• The e2e CPU bound uses Bun.Subprocess.resourceUsage() and is skipped if the runtime returns undefined; the wall-time and signal assertions still fail a regressed prompt path.

Refs HACK-1385

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[linear-code]

HACK-1385