{"record":{"id":"a347b72efdfa7eeb","repo":"chenhg5/cc-connect","slug":"probe-exec-failed-w-stderr-s","errorCode":null,"errorMessage":"probe exec failed: %w (stderr: %s)","messagePattern":"probe exec failed: %w \\(stderr: (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/runas_audit.go","lineNumber":210,"sourceCode":"\t\tshellQuote(cfg.Supervisor),\n\t)\n\tfullScript := append([]byte(header), script...)\n\n\t// We invoke `sudo -n -iu <user> -- /bin/sh -s` and pipe the script on\n\t// stdin. Using -s + stdin avoids argv-length limits and avoids ever\n\t// putting the script body on the command line.\n\tcmd := exec.CommandContext(probeCtx, \"sudo\",\n\t\t\"-n\", \"-iu\", cfg.RunAsUser, \"--\", \"/bin/sh\", \"-s\")\n\tcmd.Stdin = bytes.NewReader(fullScript)\n\tvar stdout, stderr bytes.Buffer\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\tif err := cmd.Run(); err != nil {\n\t\t// Still try to parse anything that made it out. Return the err\n\t\t// so callers can tell the probe didn't complete cleanly.\n\t\treport.RawOutput = stdout.String()\n\t\tparseProbeOutput(&report, stdout.String())\n\t\treturn report, fmt.Errorf(\"probe exec failed: %w (stderr: %s)\", err, strings.TrimSpace(stderr.String()))\n\t}\n\tparseProbeOutput(&report, stdout.String())\n\treport.Fatal = computeAuditFatal(report)\n\t// RawOutput bloats the on-disk report — only keep it when something\n\t// went wrong so an operator can inspect what the probe actually saw.\n\tif report.HasFatal() {\n\t\treport.RawOutput = stdout.String()\n\t}\n\treturn report, nil\n}\n\n// parseProbeOutput fills report in place. Unknown tags are ignored for\n// forward compatibility with newer probe scripts.\nfunc parseProbeOutput(report *IsolationReport, out string) {\n\tscanner := bufio.NewScanner(strings.NewReader(out))\n\tscanner.Buffer(make([]byte, 64*1024), 1024*1024)\n\tfor scanner.Scan() {\n\t\tline := scanner.Text()","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/core/runas_audit.go#L192-L228","documentation":"RunIsolationProbe (core/runas_audit.go:210) fails when the probe command itself cannot be executed — cmd.Run() returns an error before/while producing output (binary missing, exec format error, permission problem, non-zero probe exit). Any parseable stdout is still attached to the report, and the raw error plus stderr are wrapped into this message.","triggerScenarios":"The audit probe binary doesn't exist at the expected path, lacks execute permission, was built for another platform/arch, crashes, or exits non-zero. Raised via runDoctorOne or the doctor's anonymous goroutine.","commonSituations":"Probe not built/installed after checkout (missing make step); PATH differences under systemd vs interactive shell; running the doctor on a machine with a different architecture; probe crashing due to missing runtime deps.","solutions":["Read the stderr embedded in the error to identify the exec failure (not found / permission / exit code)","Build or install the isolation probe binary (rebuild the project so the probe is present)","Check the probe path's permissions (chmod +x) and that it matches the platform/arch","Run the probe manually with the same arguments to reproduce and debug","If the probe exited non-zero by design, inspect the parsed report (report.RawOutput) for the audit findings it did emit"],"exampleFix":"// before: probe missing\n_, err := RunIsolationProbe(ctx) // probe exec failed: fork/exec /usr/local/lib/cc-connect/probe: no such file or directory\n// after: rebuild to install the probe, then re-run\n// make build && cc-connect doctor","handlingStrategy":"fallback","validationCode":"probePath := \"/usr/local/lib/cc-connect/probe\"\nif fi, err := os.Stat(probePath); err != nil || fi.IsDir() || fi.Mode()&0o111 == 0 {\n\treturn fmt.Errorf(\"probe missing or not executable at %s — rebuild the project\", probePath)\n}","typeGuard":null,"tryCatchPattern":"report, err := core.RunIsolationProbe(ctx)\nif err != nil {\n\tlog.Warn(\"probe did not complete cleanly; using partial report\", \"err\", err)\n\tif report != nil && len(report.Fatal) > 0 { /* still surface parsed findings */ }\n\treturn err\n}","preventionTips":["Build/install the probe binary as part of make build / package install","Verify probe presence and exec bit after deployment","Keep probe and cc-connect versions in sync (same release artifact)","Capture stderr on failure — it names the exec problem (not found, permission, exit code)"],"tags":["exec","probe","audit","isolation"],"backgroundTag":"command-not-found","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}