cli: Require a terminal for confirmations

src/codex32/_cli_input.py

@@ -67,22 +67,9 @@ class InteractiveConfirmationRequired(Exception):
 
 
 def _confirmation_input(prompt: str) -> str:
-    if sys.stdin.isatty():
-        return _editable_input(prompt)
-    if not sys.stderr.isatty():
+    if not sys.stdin.isatty():
         raise InteractiveConfirmationRequired
-    terminal_name = "CONIN$" if os.name == "nt" else "/dev/tty"
-    try:
-        with open(terminal_name, encoding="utf-8", buffering=1) as terminal:
-            if not terminal.isatty():
-                raise InteractiveConfirmationRequired
-            print(prompt, end="", file=sys.stderr, flush=True)
-            answer = terminal.readline()
-    except OSError:
-        raise InteractiveConfirmationRequired from None
-    if not answer:
-        raise EOFError
-    return answer.rstrip("\r\n")
+    return _editable_input(prompt)
 
 
 def _require_correction_confirmation(low_discrimination: bool) -> None:

tests/test_correction_disclosure.py

@@ -354,3 +354,9 @@ def test_cli_derives_hand_produced_bip39_set_but_rejects_invalid_implied_secret(
     invalid = INVALID_BIP39_IMPLIED_SECRET
     status, output, error = _invoke(cli.main, ["share", "d"], invalid["A"] + "\n" + invalid["C"])
     assert status == 1 and output == "" and "embedded BIP39 entropy checksum is invalid" in error
+
+
+def test_confirmation_never_reads_answers_from_redirected_input(monkeypatch):
+    monkeypatch.setattr(_cli_input.sys, "stdin", io.StringIO("YES\n"))
+    with pytest.raises(_cli_input.InteractiveConfirmationRequired):
+        _cli_input._confirmation_input("Type YES: ")