fix(cli): gate auto-upgrade on sys.stdin.isatty

[cmeans-claude-dev]

Summary

• Closes security(cli): auto-upgrade fires from scheduler paths without interactive gating #43 (P3, security/code-review). do_auto_upgrade in src/yt_dont_recommend/cli.py now returns early with an INFO log when sys.stdin.isatty() is False, so scheduled runs (cron / launchd / --heartbeat) notify-only instead of silently installing whatever PyPI publishes.
• Narrows the supply-chain blast radius. The Playwright browser-profile session cookies live one directory away from the install root, so a compromised release would have immediate access to the YouTube session if it landed silently. Interactive sessions still auto-upgrade as before — the user is present and can --revert if something goes wrong.
• README "Auto-upgrade" section now documents the trust model and points users at --check-update (manual trigger) and --revert (rollback).

Test plan

• pytest tests/test_cli.py::TestDoAutoUpgrade -v — 5/5 pass:
  • 4 existing tests (uv path, pipx path, unknown installer, subprocess failure) updated to stub sys.stdin.isatty to True so they still exercise the upgrade path
  • 1 new test test_non_tty_session_skips_upgrade_without_invoking_subprocess asserts the gate: subprocess.run is never called, return is False, and an INFO log mentions "non-interactive"
• Full suite: pytest tests/ — 486/486 pass
• ruff check src/ tests/ clean

Notes

The issue suggested two independent knobs (interactive-only gate + delayed auto-upgrade). This PR ships only the first — the smallest behavior change with the largest practical effect. The delayed-auto-upgrade option could land later if helpful, but with the isatty gate in place a malicious release no longer ships from a scheduled run, which was the failure mode that mattered.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

LGTM

[cmeans]

Adding QA Active — starting review of the isatty gate fix at HEAD 1c32a75.

[cmeans]

QA review — round 1

Verdict: Ready for QA Signoff (one observation, addressed by follow-up).
HEAD: `1c32a751`
Tests: 486/486 pass (no skips, no deselects, no xfails). `TestDoAutoUpgrade`: 5/5 pass. `ruff check src/ tests/`: clean.

Verification

• Gate placement: `sys.stdin.isatty()` check sits inside `do_auto_upgrade` itself (cli.py:150), covering all call sites. The only call site in `main()` is cli.py:722 inside the post-`check_for_update` block.
• `--heartbeat` path: `scheduler.heartbeat()` (scheduler.py:136) does not call `do_auto_upgrade` directly. It spawns the work in a subprocess via `subprocess.Popen(cmd)` (scheduler.py:228), which inherits the cron/launchd parent's non-TTY stdin — so the gate correctly fires in the spawned process.
• `--check-update` path (cli.py:568-582): doesn't invoke `do_auto_upgrade`; just prints upgrade instructions. Correctly unaffected.
• Existing 4 `TestDoAutoUpgrade` tests updated to stub `sys.stdin.isatty` to True via `_force_tty` helper, preserving the upgrade-path coverage.
• New `test_non_tty_session_skips_upgrade_without_invoking_subprocess` asserts the three correct properties: `subprocess.run` never called (`run_called["count"] == 0`), return value is `False`, INFO log mentions "non-interactive".
• README "Auto-upgrade" section adds a clean trust-model paragraph at line 538, well-placed after the enable/disable example and pointing at `--check-update` and `--revert`.
• CHANGELOG entry under `## [Unreleased]` → `### Security` follows the file's existing convention.

Findings

#	Type	Finding
1	observation	PR closes #43 with only knob 1 of the two suggested in the issue body. PR body acknowledges the scope cut. Filed #55 as P3 nice-to-have follow-up so knob 2 (delayed auto-upgrade) is not lost from tracking.

Knob 1 addresses the primary failure mode (silent install from scheduled runs). Knob 2 is genuine defense-in-depth against the "interactive-but-fast" attack but does not block this PR.

Test plan checkboxes

All three boxes were pre-checked by Dev and re-verified in this session.

CI: all 7 checks SUCCESS (test ubuntu, test macos, smoke-macos, on-push, on-label, qa-approved, on-unlabel SKIPPED). `QA Gate` StatusContext PENDING — expected until `QA Approved` lands.

Awaiting maintainer to apply `QA Approved`.

[cmeans]

Applying Ready for QA Signoff — all verification commands re-run green in current session, gate placement covers all call sites including the heartbeat-spawned subprocess, one observation tracked in #55 (P3 follow-up). No remaining QA work.