cli: Keep Core selection off pipes and redirected stderr

Connecting before the search made two problems easier to hit. With
damaged input piped to `ms32 correct` and two Core networks running,
the network prompt read the exhausted pipe forever. With stderr
redirected, "Using Bitcoin Core on ..." and a blank line came before
`interactive confirmation required`, which the security model says
must be the only message.

Ask for a network only when stdin is a terminal; a pipe now gets "More
than one local Bitcoin Core network is running." Print Core's messages
only when stderr is a terminal. The gate test's fake now reports like
the real one, so it catches the extra output.

Claude-Session: https://claude.ai/code/session_015CuLXqAvAovfoVcUmmogwa

Author: claude

src/codex32/cli.py

@@ -442,12 +442,14 @@ def _initialize_wallet(
 
 
 def _connected_core(fallback: str | None = None) -> BitcoinCore:
+    # A pipe can't choose a network, and redirected stderr keeps only the gate's error.
     try:
         core = BitcoinCore.connect(
-            lambda prompt: _text(prompt, optional=True),
-            lambda message: _print(message, err=True),
+            (lambda prompt: _text(prompt, optional=True)) if sys.stdin.isatty() else None,
+            (lambda message: _print(message, err=True)) if sys.stderr.isatty() else None,
         )
-        _print("", err=True)
+        if sys.stderr.isatty():
+            _print("", err=True)
         return core
     except KeyboardInterrupt as error:
         raise _CoreSelectionInterrupted from error

tests/test_cli.py

@@ -4,6 +4,7 @@
 import contextlib
 import importlib
 import io
+import json
 import re
 import subprocess
 import sys
@@ -123,6 +124,9 @@ def initialize(
         return "test-wallet"
 
 
+_REAL_CONNECT = BitcoinCore.connect
+
+
 @pytest.fixture(autouse=True)
 def _offline_core(monkeypatch):
     monkeypatch.setattr("codex32.cli.BitcoinCore.connect", lambda *args, **kwargs: _FakeBitcoinCore())
@@ -320,6 +324,30 @@ def test_missing_core_for_wallet_setup_offers_no_fallback(monkeypatch: pytest.Mo
     assert str(failure.value) == "bitcoin-cli was not found.\nThis command gives Bitcoin Core the master key."
 
 
+def test_piped_input_never_answers_the_core_network_choice(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    def run(command: list[str], **_options: object) -> subprocess.CompletedProcess[str]:
+        chain = command[1].removeprefix("-chain=")
+        if chain not in ("main", "signet"):
+            return subprocess.CompletedProcess(command, 1, "", "")
+        response = {"version": 320000} if command[-1] == "getnetworkinfo" else {"chain": chain}
+        return subprocess.CompletedProcess(command, 0, json.dumps(response), "")
+
+    damaged = VECTOR_1["secret_s"].replace("x", "q", 1)
+    reads = iter((damaged,))  # A second read would be the pipe's EOF answering the network prompt.
+    monkeypatch.setattr("codex32._bitcoin_core.shutil.which", lambda _name: "/reviewed/bitcoin-cli")
+    monkeypatch.setattr(subprocess, "run", run)
+    monkeypatch.setattr(BitcoinCore, "connect", _REAL_CONNECT)
+    monkeypatch.setattr(sys, "stdin", io.StringIO(damaged))
+    monkeypatch.setattr("codex32._cli_input._stdin", lambda: next(reads))
+
+    assert ms_main(["correct"]) == 3
+    assert capsys.readouterr().err.startswith(
+        "ms32 correct: More than one local Bitcoin Core network is running.\nThis command uses Bitcoin Core"
+    )
+
+
 def test_check_does_not_derive_wallet_keys(monkeypatch: pytest.MonkeyPatch) -> None:
     cli_module = importlib.import_module("codex32.cli")
 

tests/test_correction_disclosure.py

@@ -97,11 +97,12 @@ def test_public_api_full_checksum_erasure_completion_carries_risk(source, degree
 @pytest.mark.parametrize("entrypoint", (cli.main, cli.ms_main))
 @pytest.mark.parametrize("plain", (False, True))
 def test_noninteractive_gate_emits_only_operational_error(entrypoint, plain):
-    stdout, stderr, connected = io.StringIO(), io.StringIO(), []
+    stdout, stderr = io.StringIO(), io.StringIO()
 
-    def connect(*args):
-        connected.append(_FakeBitcoinCore())
-        return connected[-1]
+    def connect(ask=None, tell=None):
+        if tell is not None:
+            tell("Using Bitcoin Core on signet.")
+        return _FakeBitcoinCore()
 
     with (
         patch.object(sys, "stdin", io.StringIO(VECTOR_1["secret_s"][:-1] + "?")),
@@ -113,8 +114,7 @@ def connect(*args):
         status = entrypoint(["correct", *(["--plain"] if plain else [])])
     prog = "codex32" if entrypoint is cli.main else "ms32"
     assert status == 3 and stdout.getvalue() == ""
-    # ms32 connects to Core before searching; that prints only a blank line.
-    assert stderr.getvalue() == "\n" * len(connected) + f"{prog}: interactive confirmation required\n"
+    assert stderr.getvalue() == f"{prog}: interactive confirmation required\n"
 
 
 @pytest.mark.parametrize("answer", ("y", "Y", "yes", "Yes", "n", "", "other", None))