Adding an answer for others who come across this.
Unpopular opinion: Don't do it, because you can't do it.
Methods based on the assumption that code size of zero reliably implies that the caller must be an EOA will probably introduce a security risk. This is because a constructor can make such a call the constructor's address will return length 0 because no code is deployed there, yet.
Is that automatically a tragic defect? Not necessarily, but probably.
Let's break it down.
- Let us assume that one is doing this for a reason. There must be some valid concern or else this attempt at discrimination would needlessly complicate matters.
- But, there is a way to circumvent the effort.
- The check, itself, points right at the section of code the author is concerned about, so whatever vulnerability might exist there should be easy to spot.
- A requirement to deploy a special contract to exploit the vulnerability is trivial.
All in all, it seems like a bad idea to patch over another bad idea. Whatever the concern is, work on eliminating it. Accepting other contracts as full participants has advantages and fighting it will probably lead to trouble.
To the best of my knowledge @AnAllergyToAnalogy was first to point out the problem with the code size strategy.
How does a contract find out if another address is a contract?
Hope it helps.