Keeping Error Streams Visible: VS Code Copilot and 2>&1

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is running a build script that produces noisy stderr output. To clean up the console, it redirects stderr into stdout and discards it:

make build 2>&1 > /dev/null

SSG blocks the redirect — silencing error streams means build failures and agent errors become invisible.

# illustrative sample output
[BLOCK] bash › make build 2>&1 > /dev/null — rule: no-stderr-redirect-devnull

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule no-stderr-redirect-devnull {
  enabled true
  priority 80
  severity warning
  DENY execution
  IF command CONTAINS "2>&1"
  AND command CONTAINS "/dev/null"
  MESSAGE "Redirecting stderr to /dev/null hides errors. Use 2>> error.log to preserve output."
}

Optional context

Also block stderr-only suppression:

rule no-stderr-devnull {
  enabled true
  priority 80
  severity warning
  DENY execution
  IF command CONTAINS "2>/dev/null"
  MESSAGE "Suppressing stderr hides errors. Redirect to a log file instead."
}

What SSG does

SSG intercepts the command before the shell sets up the file descriptor redirect. All output streams remain intact — errors are visible in the terminal and log files.

Ask the agent to log errors instead

stderr redirect to /dev/null was blocked. Preserve error output:
  make build 2>> build-errors.log    # append stderr to a log file
  make build 2>&1 | tee build.log    # capture all output, show in terminal
  make build 2>&1 | grep -v "^$"    # filter blank lines only
Suppressing stderr makes diagnosing agent failures significantly harder.

When stderr suppression is legitimate

Some commands produce expected stderr output (e.g., curl progress bars). Use targeted suppression with a higher-priority ALLOW:

rule allow-curl-progress-suppress {
  enabled true
  priority 200
  severity info
  ALLOW execution
  IF command STARTS_WITH "curl"
  AND command CONTAINS "2>/dev/null"
  MESSAGE "curl progress output may be suppressed."
}

Pair with structured logging

For agent workflows, redirect to structured log files with timestamps rather than suppressing:

make build 2> >(while read line; do echo "$(date -u +%FT%TZ) ERROR: $line"; done >> build.log)

This preserves all error context for post-incident review.