Skip to content

fix(anomaly): classify [stderr] output as AnomalyOutcome::Error#1474

Merged
bug-ops merged 2 commits intomainfrom
anomaly-detector-stderr
Mar 9, 2026
Merged

fix(anomaly): classify [stderr] output as AnomalyOutcome::Error#1474
bug-ops merged 2 commits intomainfrom
anomaly-detector-stderr

Conversation

@bug-ops
Copy link
Owner

@bug-ops bug-ops commented Mar 9, 2026

Fixes #1453.

Changes

  • crates/zeph-core/src/agent/tool_execution.rs: replace dead-code [exit code pattern with [stderr] in anomaly outcome classification. The [exit code string was never emitted by any executor; [stderr] is the actual prefix used by ShellExecutor for failed child process output.
  • crates/zeph-tools/src/shell.rs: apply the same fix to audit classification — add || out.contains("[stderr]") to the AuditResult::Error branch.

Tests

  • Renamed handle_tool_result_error_prefix_triggers_anomaly_error (was testing dead [exit code pattern, now correctly tests [error])
  • Added handle_tool_result_stderr_prefix_triggers_anomaly_error regression test
  • Added stderr_output_logged_as_audit_error end-to-end audit test in zeph-tools

Total: 4901 passed, 0 failed.

ShellExecutor prefixes failed command output with [stderr] but the anomaly
detector only checked for [error] and [exit code]. The latter pattern was
dead code that never matched any executor output.

Replace [exit code with [stderr] in the anomaly classification condition in
tool_execution.rs and apply the same fix to the audit classification in
shell.rs. Add regression tests for both paths.
@github-actions github-actions bot added documentation Improvements or additions to documentation rust Rust code changes bug Something isn't working core zeph-core crate size/M Medium PR (51-200 lines) labels Mar 9, 2026
@bug-ops bug-ops enabled auto-merge (squash) March 9, 2026 18:30
@bug-ops bug-ops merged commit 51d2071 into main Mar 9, 2026
18 checks passed
@bug-ops bug-ops deleted the anomaly-detector-stderr branch March 9, 2026 18:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working core zeph-core crate documentation Improvements or additions to documentation rust Rust code changes size/M Medium PR (51-200 lines)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Anomaly detector misses shell errors with [stderr] format

1 participant