fix: keep tool child stdin closed and run tool commands non-interactively - #42854

Hey! Your PR title Fix tool interactive stdin doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

AI code review — automated review for reference; please use your judgment.

Review of the non-interactive tool execution fix:

1. packages/core/src/cross-spawn-spawner.ts:119 — the default stdin flips from pipe to ignore for every caller that does not pass opts.stdin — any call site relying on the old implicitly-writable pipe (e.g. feeding data or credentials to a child) now gets an instantly-closed stdin and can fail or hang confusingly — audit internal callers for stdin writes, make the new expectation explicit at those sites, and call the semantic change out in release notes.
2. packages/core/src/tool/bash.ts:162 and packages/opencode/src/tool/shell.ts:294 — the non-interactive env quartet (CI, npm_config_yes, GIT_TERMINAL_PROMPT, NONINTERACTIVE) is defined twice across two packages — duplicate literals drift apart the first time one copy gains DEBIAN_FRONTEND=noninteractive and the other does not — extract a shared exported constant (e.g. from core) and import it in both places.
3. packages/core/src/tool/bash.ts:162 and packages/opencode/src/tool/shell.ts:298 — npm_config_yes=true makes package installs auto-confirm inside agent-executed shells — it prevents hangs, but it also silently removes the confirmation step for actions like npm install -g that the model initiates — document this contract in the bash/shell tool descriptions, or scope auto-yes to non-global installs.
4. packages/opencode/src/tool/shell.ts:297-308 — nonInteractiveEnv is spread last, so it overrides explicitly provided env — sessions that deliberately set CI=0 or a custom GIT_TERMINAL_PROMPT are silently clobbered — either let per-command env take precedence over the defaults or add a comment marking the override as intentional hardening.
5. Test coverage — neither behavior change ships with tests — add cases asserting a spawned child sees immediate EOF on stdin and that all four env vars are present on both the POSIX and win32 code paths.
6. packages/core/src/cross-spawn-spawner.ts:119 — encoding: "utf-8" is retained next to stream: "ignore" — dead config that misleads readers into thinking output transcoding still applies — drop it for the ignore case or comment why it stays.

this one's important too man

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.