[security-guidance] Commit-review findings replaced by "claude.ai connectors are disabled" warning in the rewake notice

Summary

When the security-guidance commit review finds a vulnerability, the asyncRewake notice the agent receives often contains only an unrelated warning instead of the findings:

Background security review of commit — address or acknowledge the findings below, …: ⚠ claude.ai connectors are disabled because ANTHROPIC_API_KEY or another auth source is set and takes precedence over your claude.ai login · Unset it to load your organization's connectors
⚠ claude.ai connectors are disabled because …

The one-line rewakeSummary gets through (e.g. "Commit security review found: Command Injection in app.py"), but the details never reach the agent.

Environment

• security-guidance 2.0.8 (claude-plugins-official)
• Claude Code 2.1.286 in the Claude desktop app (Code tab), macOS 26.5.1
• First-party auth (Claude subscription login)

What's happening

1. For PostToolUse commit reviews, emit_metrics puts the findings only in the stdout JSON, at hookSpecificOutput.additionalContext.
2. The asyncRewake body is taken from the hook's stderr when it is non-empty, otherwise its raw stdout. The plugin's own comment in emit_metrics describes this as "stderr || stdout". The structured additionalContext field isn't read for the rewake body.
3. In the failing runs, stderr held the "claude.ai connectors are disabled…" line, twice. It is most likely printed by the inner claude that the agentic review starts: the agentic ClaudeAgentOptions don't pass a stderr callback, unlike the 3P single-turn path. Because stderr was non-empty, it became the notice and the findings were dropped.

Evidence

• On one machine, every commit-review notice that had findings (3 of 3, across different sessions) arrived with only the warning. Stop-hook reviews in the same sessions arrived intact (that path writes its guidance to stderr).
• Re-running the same commit review outside Claude Code, with stdout and stderr captured separately, returned the full findings in hookSpecificOutput.additionalContext.
• When stderr is empty, the rewake body is the raw stdout JSON (metrics and all), not the findings text. Observed by running the hook through a wrapper that strips the warning from stderr. Writing the findings text to stderr produced a correct, readable notice.

Repro

1. In a desktop-app session with the plugin enabled, commit a file with an obvious issue, e.g.:

```python
from flask import Flask, request
import subprocess
app = Flask(__name__)

@app.route("/run")
def run():
return subprocess.check_output(request.args["cmd"], shell=True)
```

1. Wait for the commit-review rewake. When the agentic review answers, the body is the connectors warning, not the findings.

Suggested fix

• For PostToolUse asyncRewake, also write the findings text to stderr (as the Stop path already does), so the body is the findings whatever stdout holds.
• Pass a stderr callback to the agentic ClaudeAgentOptions (as the 3P path does), so the inner CLI's startup warnings can't leak into the hook's stderr.