CM-64462: redirect stdin explicitly in Copilot report-mode hooks

Copilot's bash hook field runs under bash, which reattaches a backgrounded
command's stdin to /dev/null (POSIX behavior with job control off) - the scan
read an empty payload and silently no-oped without reaching the backend.
An explicit <&0 disables that default and keeps the payload flowing.

Cursor/Codex keep the bare '&' - their runners were verified to deliver
stdin to backgrounded scans (zsh keeps it; bash/sh do not).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Ilanlido

cycode/cli/apps/ai_guardrails/ides/base.py

@@ -28,6 +28,11 @@
 def shell_background_suffix(async_mode: bool) -> str:
     """`' &'` when backgrounding is requested and the platform's shell supports it.
 
+    Only valid for hooks whose runner is stdin-safe under backgrounding (zsh keeps
+    a backgrounded command's stdin; verified for Cursor/Codex). bash/sh reattach it
+    to /dev/null, silently emptying the payload — hooks that run under bash (e.g.
+    Copilot's `bash` field) must add an explicit `<&0` redirect instead.
+
     Windows gets no suffix: depending on the IDE, hooks may run under cmd (where a
     trailing `&` is a no-op separator) or Windows PowerShell (where it's a parse
     error that would fail the hook). Until the CLI can self-detach in report mode,

cycode/cli/apps/ai_guardrails/ides/copilot.py

@@ -317,11 +317,13 @@ def settings_path(self, scope: str, repo_path: Optional[Path] = None) -> Path:
     def render_hooks_config(self, async_mode: bool = False) -> dict:
         def entry(command: str) -> dict:
             if async_mode:
-                # Copilot has no async hook flag; background via shell on unix.
+                # Copilot has no async hook flag; background via shell on unix. The
+                # explicit <&0 keeps the payload flowing: a bare `cmd &` gets its stdin
+                # reattached to /dev/null by the shell (job control is off in hooks).
                 # Windows PowerShell has no trailing-& operator, so it stays sync.
                 return {
                     'type': 'command',
-                    'bash': f'{command} &',
+                    'bash': f'{command} <&0 &',
                     'powershell': command,
                     'timeoutSec': _HOOK_TIMEOUT_SEC,
                 }