Detach non-interactive subprocesses from stdin (#34612)

## What changed

Redirect stdin to null when launching:

- `codex doctor --json` for uploaded diagnostic reports
- Git commands used by `codex doctor`
- ripgrep searches over rollout files
- the Windows sandbox setup refresh helper

This keeps these non-interactive subprocesses from reading Codex's inherited
input stream.

GitOrigin-RevId: 063d191b0b1b849d74b55a7d6ff2f0b3d5212c86

codex-rs/app-server/src/request_processors/feedback_doctor_report.rs

@@ -8,6 +8,7 @@
 //! attaching exactly the same JSON a user could copy from the CLI.
 
 use std::collections::BTreeMap;
+use std::process::Stdio;
 use std::time::Duration;
 
 use codex_core::config::Config;
@@ -42,6 +43,7 @@ pub(crate) async fn doctor_feedback_report(config: &Config) -> Option<DoctorFeed
 
     let mut command = Command::new(&executable);
     command.arg("doctor").arg("--json");
+    command.stdin(Stdio::null());
     command.kill_on_drop(/*kill_on_drop*/ true);
     let output = match timeout(DOCTOR_FEEDBACK_REPORT_TIMEOUT, command.output()).await {
         Ok(Ok(output)) => output,

codex-rs/cli/src/doctor/git.rs

@@ -2,6 +2,7 @@ use std::collections::BTreeSet;
 use std::path::Path;
 use std::path::PathBuf;
 use std::process::Output;
+use std::process::Stdio;
 use std::time::Duration;
 
 use codex_git_utils::get_git_repo_root;
@@ -195,6 +196,7 @@ async fn git_output(git_path: &Path, cwd: &Path, args: &[&str]) -> Option<String
         .env("GIT_OPTIONAL_LOCKS", "0")
         .args(args)
         .current_dir(cwd)
+        .stdin(Stdio::null())
         .kill_on_drop(true);
     let output = timeout(GIT_COMMAND_TIMEOUT, command.output())
         .await

codex-rs/rollout/src/search.rs

@@ -3,6 +3,7 @@ use std::collections::HashSet;
 use std::io;
 use std::path::Path;
 use std::path::PathBuf;
+use std::process::Stdio;
 
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ResponseItem;
@@ -80,6 +81,7 @@ async fn ripgrep_rollout_paths(
         .arg("--")
         .arg(search_term)
         .arg(root)
+        .stdin(Stdio::null())
         .output()
         .await
     {

codex-rs/tui/src/tui.rs

@@ -313,7 +313,7 @@ pub(super) fn reapply_raw_mode_after_resume() -> Result<()> {
 
 /// Restore the terminal after Codex is exiting.
 ///
-/// Uses a stronger keyboard reset than [`restore`] so the parent shell recovers even if a
+/// Uses a stronger keyboard reset than `restore` so the parent shell recovers even if a
 /// terminal missed the stack pop that normally pairs with [`set_modes`].
 pub fn restore_after_exit() -> Result<()> {
     let mut first_error =

codex-rs/windows-sandbox-rs/src/setup.rs

@@ -345,7 +345,10 @@ fn run_setup_refresh_payload(b64: &str, codex_home: &Path) -> Result<()> {
     };
     // Refresh should never request elevation; ensure verb isn't set and we don't trigger UAC.
     let mut cmd = Command::new(&exe);
-    cmd.arg(b64).stdout(Stdio::null()).stderr(Stdio::null());
+    cmd.arg(b64)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
     let cwd = std::env::current_dir().unwrap_or_else(|_| codex_home.to_path_buf());
     log_note(
         &format!(