@erclx/canon 5.54.0 → 5.55.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [5.55.0](https://github.com/erclx/canon/compare/v5.54.0...v5.55.0) (2026-10-21)
+
+
+### Features
+
+* **cli:** decide headless from a missing terminal on stdin ([#2600](https://github.com/erclx/canon/issues/2600)) ([63e9af6](https://github.com/erclx/canon/commit/63e9af6fcd2b23c1aa4abe45e0fb818519b0e314))
+* **cli:** quiet stderr on --json runs and drop the frame off a terminal ([#2599](https://github.com/erclx/canon/issues/2599)) ([824861b](https://github.com/erclx/canon/commit/824861b55ce9a1c92227b3b8c96f541684d2da8b))
+
 ## [5.54.0](https://github.com/erclx/canon/compare/v5.53.0...v5.54.0) (2026-10-21)
 
 

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.54.0",
+  "version": "5.55.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/create-skill/SKILL.md

@@ -42,7 +42,7 @@ Read these in the same pass:
 3. Draft the sibling `REQUIREMENT.md` from what the skill is for, in the shape the requirement standard states.
    - Write the gaps from the user's description rather than from the drafted body, since a requirement derived from the body records whatever the draft overfitted to.
 4. Confirm the skill name and both files with the user before writing, when a person can answer.
-   - Skip the confirmation when `CANON_NON_INTERACTIVE=1` is set or another skill's run invoked this one, such as `auto-ship` or a dispatched worker.
+   - Skip the confirmation when another skill's run invoked this one, such as `auto-ship`, or when a dispatched worker runs it.
    - Then put the three Step 1 answers and the two drafted paths in the output and continue to Step 5, since a question nobody reads parks the chain.
 
 ### Write and check

package/claude/skills/document-health/SKILL.md

@@ -15,7 +15,7 @@ Three axes carry the report. Two answer from a verb and the third answers from a
 
 - `canon` absent from the path: stop. `❌ canon is not on PATH, so neither measured axis can be read.`
 - `git ls-files '*.md'` listing nothing: stop. `❌ No tracked markdown here, so there is no corpus to read.`
-- Run every command under `CANON_NON_INTERACTIVE=1` and prompt at no point. A caller reaching this from a rollout wave has nobody present to answer.
+- Prompt at no point, since a caller reaching this from a rollout wave has nobody present to answer. A call with no terminal on stdin already runs headless, so no command takes a prefix.
 - Branch on each record's own fields rather than on an exit status, since a shell profile may wrap `canon` in a function whose trailing command reports every refusal as success
 - Repair nothing, write no file in the project, and open no pull request. Whoever read the report decides what to fix.
 
@@ -30,8 +30,8 @@ Drop what nobody hand-authors before reporting a finding against it: a generated
 Run these from the project root, in parallel:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon markdown audit --json
-CANON_NON_INTERACTIVE=1 canon context audit --json
+canon markdown audit --json
+canon context audit --json
 ```
 
 The first answers length, carrying the bullet, paragraph, and depth checkpoints and the per-file weights read against them. The second answers placement for the folders it resolves, carrying entry length, reference form, and index drift.
@@ -39,8 +39,8 @@ The first answers length, carrying the bullet, paragraph, and depth checkpoints
 Then read which classifier would run, and deepen placement with the verdicts per section:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon context classifier show
-CANON_NON_INTERACTIVE=1 canon context classify sweep --json
+canon context classifier show
+canon context classify sweep --json
 ```
 
 The first names the backend, the model, and the source that decided both. Report which layer answered, since a project with the model layer off reads from the regex layer alone and the sweep says nothing about which one it used.
@@ -65,7 +65,7 @@ Mark every staleness finding as a reading. It is this session's judgment rather
 When the scope reaches `canon/REQUIREMENTS.md`, read it for identity drift as well as for stale paths, and take the review point from the verb:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon records stale canonical --json
+canon records stale canonical --json
 ```
 
 The doc in the record carries `reviewed` and `releasesSince`. `${CLAUDE_SKILL_DIR}/references/axes.md` holds the identity claim shapes to test and how the record reads. Skip both the read and the verb when the scope excludes the doc.

package/claude/skills/document-repair/SKILL.md

@@ -16,14 +16,14 @@ The CLI holds every number. `canon markdown audit` measures, and `canon markdown
 - `canon` absent from the path: stop. `❌ canon is not on PATH, so nothing can be measured or gated.`
 - The audit refusing: stop and name its `reason`. A `malformed-config` refusal names the file to fix by hand, since the verb will not append to a file it cannot read.
 - `gated add` refusing with `canon-checkout`: stop. Canon's own checkout gates through a constant in its source, which a code change edits.
-- Run every command under `CANON_NON_INTERACTIVE=1`, and branch on each record's own fields rather than on an exit status a shell wrapper can flatten
+- Branch on each record's own fields rather than on an exit status a shell wrapper can flatten. A call with no terminal on stdin already runs headless, so no command takes a prefix.
 
 ## Step 1: read the audit
 
 Run the audit over the whole tree and take the density and reference shape findings from its record:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon markdown audit --json
+canon markdown audit --json
 ```
 
 Take the candidate folders from the order table in `${CLAUDE_SKILL_DIR}/references/batches.md` rather than from the findings, since a clean folder carries no finding and would never be gated. Drop every folder `canon/config/markdown.toml` already lists, since a listed folder already gates.
@@ -41,7 +41,7 @@ Load `markdown-craft` and `write-human`, then rewrite each failing block by its
 Re-run the audit on the folder alone after each file:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon markdown audit <prefix> --json
+canon markdown audit <prefix> --json
 ```
 
 Read `${CLAUDE_SKILL_DIR}/references/batches.md` for what a rewrite may cut. A stated reason survives every rewrite, and the audit reaching zero cannot see one that went missing.
@@ -49,7 +49,7 @@ Read `${CLAUDE_SKILL_DIR}/references/batches.md` for what a rewrite may cut. A s
 ## Step 4: gate the folder
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon markdown gated add <prefix> --json
+canon markdown gated add <prefix> --json
 ```
 
 Pass the prefix exactly as the batch named it: a folder with its one trailing slash, such as `docs/`, and a file by its bare path, such as `README.md`. The verb refuses a doubled slash and a slash after a file, since either matches nothing and would gate nothing.
@@ -61,7 +61,7 @@ Branch on the record. `action: appended` or `present` means the folder gates now
 A skill's `REQUIREMENT.md` gates only on its own path, never through a folder prefix, so gating `.claude/skills/` leaves each requirement reporting. Gate each one that reaches zero by its path:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon markdown gated add .claude/skills/<name>/REQUIREMENT.md --json
+canon markdown gated add .claude/skills/<name>/REQUIREMENT.md --json
 ```
 
 ## Output

package/claude/skills/target-check/SKILL.md

@@ -17,7 +17,7 @@ Six domains carry the report. Five answer from a verb that already exists and th
 - No `.claude/` directory at the working root: stop. `❌ No .claude/ here, so nothing is installed to check. Run canon init first.`
 - A `claude/skills/` folder at the root, no leading dot: stop. `❌ This is the toolkit itself rather than a target. Ask the orchestrator for a worker per repository to take a change out to the targets.`
   - A target receives skills at `.claude/skills/` and authors none, so the spelling without the dot separates the source from what it installs into
-- Run every command under `CANON_NON_INTERACTIVE=1` and prompt at no point, since every caller is a dispatched worker with nobody to answer
+- Prompt at no point, since every caller is a dispatched worker with nobody to answer. A call with no terminal on stdin already runs headless, so no command takes a prefix.
 - Branch on each record's own fields rather than on an exit status. A shell function wrapping `canon` can report every refusal as success.
 
 ## Step 1: read the reports
@@ -25,25 +25,23 @@ Six domains carry the report. Five answer from a verb that already exists and th
 Run these from the target root, in parallel:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon sync --check . --json
-CANON_NON_INTERACTIVE=1 canon context audit --json
+canon sync --check . --json
+canon context audit --json
 ```
 
 The first answers five domains from one read, being `skew`, `domains`, `seeds`, `tooling`, and the layout fields `unmigrated`, `superseded`, `unmovedSurfaces`, and `reverse`. The second deepens a domain that first read only counts.
 
-Then run `CANON_NON_INTERACTIVE=1 canon records validate <kind> --json` once per record folder the target carries, taking `<kind>` from what is present under the record root rather than from a list held here.
+Then run `canon records validate <kind> --json` once per record folder the target carries, taking `<kind>` from what is present under the record root rather than from a list held here.
 
 ### The tooling read takes a stack, always
 
 The tooling comparison runs last, because it needs a value the first read returns. Take `<stack>` from the first name in the report's `tooling.chain`, which records the stack nearest the target, and pass it:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon tooling sync --check <stack>
+canon tooling sync --check <stack>
 ```
 
-Refuse the domain and report it unread when `chain` names nothing, rather than running the command bare. A bare call reaches the stack prompt, which the non-interactive variable resolves to the catalog's first option instead of refusing.
-
-Every target would then be compared against whichever stack sorts first, on every run, and the drift reported would be an artifact of the wrong comparison rather than anything the target did.
+Refuse the domain and report it unread when `chain` names nothing, rather than running the command bare. A bare call reaches the stack prompt, which refuses a headless caller, so it would report nothing about the domain.
 
 ### Domains come from the report
 

package/claude/skills/target-check/references/domains.md

@@ -72,10 +72,7 @@ Read the `tooling` block off the report first, because the comparison command ne
 
 ### The comparison
 
-On a measured report, take `<stack>` from the first name in `chain` and run `canon tooling sync --check <stack>`. Never run it bare.
-
-- Omitting the stack reaches a prompt the non-interactive variable resolves to the catalog's first entry rather than refusing
-- That compares the target against a stack it does not use and reports the difference as drift
+On a measured report, take `<stack>` from the first name in `chain` and run `canon tooling sync --check <stack>`. Never run it bare, since omitting the stack reaches a prompt that refuses a headless caller and compares nothing.
 
 ### Verdicts
 

package/claude/skills/target-setup/SKILL.md

@@ -33,9 +33,9 @@ rather than a step within it, so the full chain never runs it separately.
 
 ## Non-interactive path
 
-Every phase runs under `CANON_NON_INTERACTIVE=1` with no TTY. Three phases
-otherwise pause, and each takes an argument that answers its prompt ahead of
-time:
+Every phase runs headless with no prefix, since a call with no terminal on
+stdin is already headless. Three phases otherwise pause, and each takes an
+argument that answers its prompt ahead of time:
 
 | Phase               | Pauses to                                  | Answered ahead by                                          | With neither and no TTY                               |
 | ------------------- | ------------------------------------------ | ---------------------------------------------------------- | ----------------------------------------------------- |
@@ -91,7 +91,7 @@ target project's current directory. Do not cd into the toolkit source tree. The
 Step 1: `canon init` installs base tooling, claude seeds, and governance rules.
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon init \
+canon init \
   --stack <stack> \
   --add <rules> \
   <target>
@@ -106,7 +106,7 @@ Step 2: `canon tooling sync <tooling-stack> --write` installs stack deps, script
 - A fresh target has nothing to lose, so pass `--write` directly rather than reading a report first
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon tooling sync <tooling-stack> <target> --write
+canon tooling sync <tooling-stack> <target> --write
 ```
 
 ### Monorepo with multiple language roots
@@ -114,8 +114,8 @@ CANON_NON_INTERACTIVE=1 canon tooling sync <tooling-stack> <target> --write
 Run `canon init` once at the repo root so `base` (husky, oxfmt, commitlint, CI) lands once, then sync each subtree with `--skip base`. Take the subtree commands from the preview's per-root rows rather than picking folders by hand.
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon tooling sync vite-react ./frontend --skip base --write
-CANON_NON_INTERACTIVE=1 canon tooling sync python ./backend --skip base --write
+canon tooling sync vite-react ./frontend --skip base --write
+canon tooling sync python ./backend --skip base --write
 ```
 
 - Without `--skip base`, each subtree re-drops husky, and git honors only one `core.hooksPath`, so the extra hook dirs silently break
@@ -139,7 +139,7 @@ Resolve exactly as the detect reference states, confirm the proposed extras
 there, then run:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon gov install <stack> --add <extras> <target>
+canon gov install <stack> --add <extras> <target>
 ```
 
 Report the rule count installed, the target path, and any rules that failed to

package/claude/skills/target-update/SKILL.md

@@ -24,7 +24,7 @@ Stop with the line beside each state.
 
 Then hold two rules for every verb this body runs.
 
-- Run it under `CANON_NON_INTERACTIVE=1` from the target root
+- Run it from the target root with no prefix, since a call with no terminal on stdin already runs headless
 - Branch on its record's fields rather than its exit, which a shell function wrapping `canon` can flatten
 
 ## Step 1: bring the binary and plugin forward
@@ -38,12 +38,12 @@ Both write to the machine rather than the target, and the preview needs the verb
 Run these in parallel from the target root:
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon changelog --json
-CANON_NON_INTERACTIVE=1 canon migrate status --json
-CANON_NON_INTERACTIVE=1 canon sync --check . --json
+canon changelog --json
+canon migrate status --json
+canon sync --check . --json
 ```
 
-Then take `<stack>` from the first name in the report's `tooling.chain` and run `canon tooling diff <stack> . --json`. Never run it bare, since the stack prompt resolves to the catalog's first entry under the non-interactive variable. Report tooling unmeasured when `tooling.measured` is false or `chain` names nothing.
+Then take `<stack>` from the first name in the report's `tooling.chain` and run `canon tooling diff <stack> . --json`. Never run it bare, since the stack prompt refuses a headless caller. Report tooling unmeasured when `tooling.measured` is false or `chain` names nothing.
 
 ### When a read refuses
 

package/docs/agents/install-and-sync.md

@@ -15,8 +15,8 @@ Any flag skips the confirmation prompt, but the `base` default of `--stack` does
 
 ## Governance install
 
-- `canon gov install <stack> [target]` needs the stack under `CANON_NON_INTERACTIVE=1`, else lists the valid names on stderr and exits 1
-- `--yes` answers the install confirm with no TTY and no env var. Without it, a headless call refuses and the message names `--yes`. It does not pick a stack.
+- `canon gov install <stack> [target]` needs the stack on a call with no terminal, else lists the valid names on stderr and exits 1
+- A headless call takes Yes at the install confirm, and `--yes` answers it at a terminal too. Neither picks a stack.
 - It refuses the toolkit root and a missing path
 - `--add <rules>` with no stack installs into the one positional, or the current directory, keeping the recorded chain. Pass `./node` for a target named like a stack.
 

package/docs/agents/output-shape.md

@@ -22,18 +22,19 @@ Data goes to stdout. UI and logs go to stderr. Help is the exception and prints
 - `└` closes the frame on stderr
 - An error renders as `│ ✗ message` inside the frame, never as a lone line
 - Help skips the banner and puts `Usage:` directly on `├`
+- A stderr that is not a terminal gets plain lines instead, with the banner and section titles bare and each item behind its mark alone
 
 A help request naming an unknown subcommand, under a group taking no operand, writes its refusal to stderr and exits 1.
 
 ## JSON and names modes
 
-`--json` and `--names` keep stdout pure data. The frame still renders on stderr, and diagnostics reach stderr in every mode. A JSON refusal carries an action and a reason, so branch on the record rather than on stderr.
+`--json` and `--names` keep stdout pure data. A `--json` run writes no progress to stderr, only its warnings and errors, since diagnostics reach stderr in every mode. A JSON refusal carries an action and a reason, so branch on the record rather than on stderr.
 
 A shell profile may wrap `canon` in a function that takes its status from a later command. Where a verb documents a record field, read the field rather than the exit.
 
 ## Color
 
-Escape sequences reach a destination that renders them and nowhere else, decided per stream. `NO_COLOR` set to any non-empty value turns color off, and so does a destination that is not a terminal. The frame glyphs and the `✓ ! + - ✗` marks survive both.
+Escape sequences reach a destination that renders them and nowhere else, decided per stream. `NO_COLOR` set to any non-empty value turns color off, and so does a destination that is not a terminal. The `✓ ! + - ✗` marks survive both. The frame glyphs need a terminal.
 
 ## Exit discipline
 
@@ -59,16 +60,16 @@ Discover names at runtime rather than hardcoding them.
 
 ## Headless invocation
 
-Set `CANON_NON_INTERACTIVE=1` to refuse every prompt.
+A call with no terminal on stdin is headless and needs no prefix. Each prompt takes its documented default or refuses and names the flag to pass.
 
 ```bash
-CANON_NON_INTERACTIVE=1 canon init --stack node --skip records /path/to/project
-CANON_NON_INTERACTIVE=1 canon sync /path/to/project
-CANON_NON_INTERACTIVE=1 canon gov install node --add astro,shadcn /path/to/project
-CANON_NON_INTERACTIVE=1 canon gov sync /path/to/project
-CANON_NON_INTERACTIVE=1 canon gov build /path/to/project
-CANON_NON_INTERACTIVE=1 canon tooling diff astro /path/to/project
-CANON_NON_INTERACTIVE=1 canon tooling sync astro /path/to/project --write
+canon init --stack node --skip records /path/to/project
+canon sync /path/to/project
+canon gov install node --add astro,shadcn /path/to/project
+canon gov sync /path/to/project
+canon gov build /path/to/project
+canon tooling diff astro /path/to/project
+canon tooling sync astro /path/to/project --write
 canon tooling inject base /path/to/project --configs --seeds
 canon tooling prune-gitignore base /path/to/project
 canon tooling verify vite-react

package/docs/target/sync.md

@@ -51,4 +51,4 @@ Try a scenario from [sandbox](../../canon/context/development/sandbox.md) before
 
 ## Running sync from an agent session
 
-`canon sync .` applies every domain sync, then offers a commit and pull request that needs a terminal. Under `CANON_NON_INTERACTIVE=1` the syncs apply, the git step is refused, and the command exits 0. Commit yourself. Sync refuses a dirty working tree, and `canon sync --check .` does not.
+`canon sync .` applies every domain sync, then offers a commit and pull request that needs a terminal. With no terminal on stdin the syncs apply, the git step is refused, and the command exits 0. Commit yourself. Sync refuses a dirty working tree, and `canon sync --check .` does not.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.54.0",
+  "version": "5.55.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {

package/scripts/core/install-check.sh

@@ -88,7 +88,7 @@ mkdir -p "$TARGET_DIR"
 log_info "Initialized git in $TARGET_DIR"
 
 log_step "Run canon init"
-(cd "$TARGET_DIR" && CANON_NON_INTERACTIVE=1 bun run "$EXTRACT_DIR/src/cli.ts" init --stack base 2>&1 | pipe_output) || log_error "canon init failed"
+(cd "$TARGET_DIR" && bun run "$EXTRACT_DIR/src/cli.ts" init --stack base </dev/null 2>&1 | pipe_output) || log_error "canon init failed"
 log_info "canon init completed"
 
 log_step "Assert scaffold"

package/scripts/lib/ui.sh

@@ -6,93 +6,40 @@ if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
   exit 1
 fi
 
-# `NO_COLOR` follows the published convention, where any non-empty value turns
-# color off whatever the value says.
-supports_color() {
-  [ -z "${NO_COLOR:-}" ] && [ -t "$1" ]
-}
-
-# Assigns the six palette names for one file descriptor. The blank palette keeps
-# every frame character and drops only the escapes, so a captured run still
-# reads as one block.
-#
-# Bash returns a string and nothing richer, so the palette arrives through the
-# caller's own scope. A writer declaring all six `local` before calling this
-# keeps the assignment to itself, which is what leaves the source-time answer
-# below standing for anything that sources this file.
-set_palette() {
-  if supports_color "$1"; then
-    GREEN='\033[0;32m'
-    RED='\033[0;31m'
-    YELLOW='\033[0;33m'
-    WHITE='\033[1;37m'
-    GREY='\033[0;90m'
-    NC='\033[0m'
-  else
-    GREEN=''
-    RED=''
-    YELLOW=''
-    WHITE=''
-    GREY=''
-    NC=''
-  fi
-}
-
-# Every writer below frames to stderr and asks about that stream at write time,
-# so no answer is frozen before a caller's redirect is in place. This one answers
-# for stdout instead, because it is read by a sourcing script writing its own
-# frame with a bare `echo`, and that is the stream a bare `echo` reaches.
-set_palette 1
+# The frame writes no color. The scripts left on it run as setup and gate steps,
+# where a pipe or a log reads the output more often than a terminal does.
 
 log_info() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1" >&2
+  echo -e "│ ✓ $1" >&2
 }
 log_warn() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC} ${YELLOW}!${NC} $1" >&2
+  echo -e "│ ! $1" >&2
 }
 log_error() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC} ${RED}✗${NC} $1" >&2
+  echo -e "│ ✗ $1" >&2
   exit 1
 }
 log_step() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}" >&2
+  echo -e "│\n├ $1" >&2
 }
 log_add() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC} ${GREEN}+${NC} $1" >&2
+  echo -e "│ + $1" >&2
 }
 log_rem() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}│${NC} ${RED}-${NC} $1" >&2
+  echo -e "│ - $1" >&2
 }
 
 pipe_output() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  while IFS= read -r line; do echo -e "${GREY}│${NC}  $line" >&2; done
+  while IFS= read -r line; do echo -e "│  $line" >&2; done
 }
 
 open_timeline() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}┌${NC}" >&2
+  echo -e "┌" >&2
   if [ -n "${1:-}" ]; then
-    echo -e "${GREY}│${NC} ${WHITE}$1${NC}" >&2
+    echo -e "│ $1" >&2
   fi
 }
 
 close_timeline() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  echo -e "${GREY}└${NC}" >&2
+  echo -e "└" >&2
 }

package/src/audits/run.ts

@@ -74,7 +74,7 @@ export function spawnAudit(root: string): Spawn {
       // extending it. Spreading `process.env` alongside would put back the very
       // variables it strips, and a hook's `GIT_DIR` would then point every
       // history-reading verb at a repository nobody asked about.
-      env: { ...gitEnv(), CANON_NON_INTERACTIVE: '1' },
+      env: gitEnv(),
       extendEnv: false,
     })
 

package/src/claude/routing.ts

@@ -9,7 +9,7 @@ const TOKEN = /`([^`\s]+)`/g
 
 /**
  * A path a reader could open. Admits no `$`, `*`, or `=`, so an assignment
- * (`CANON_NON_INTERACTIVE=1`) and a variable are both excluded.
+ * (`NAME=value`) and a variable are both excluded.
  */
 const PATH_TOKEN = /^[.A-Za-z0-9_][A-Za-z0-9._/-]*$/
 

package/src/cli/run.ts

@@ -2,7 +2,7 @@ import { join } from 'node:path'
 import { execa } from 'execa'
 
 export interface CliRunOptions {
-  /** Sets `CANON_NON_INTERACTIVE=1` for the child. Defaults to false. */
+  /** Closes the child's stdin, which makes it headless. Defaults to false. */
   readonly nonInteractive?: boolean
   /** Defaults to `inherit`, so a child prompt still reaches the operator. */
   readonly stdin?: 'ignore' | 'inherit'
@@ -28,13 +28,12 @@ export function cliRun(
   options: CliRunOptions = {},
 ): () => Promise<boolean> {
   return async () => {
-    const env = options.nonInteractive
-      ? { ...process.env, CANON_NON_INTERACTIVE: '1' }
-      : process.env
+    const stdin = options.nonInteractive
+      ? 'ignore'
+      : (options.stdin ?? 'inherit')
 
     const result = await execa('bun', [path, ...args], {
-      stdio: [options.stdin ?? 'inherit', 'inherit', 'inherit'],
-      env,
+      stdio: [stdin, 'inherit', 'inherit'],
       reject: false,
     })