Summary
heron's agent classifier flags current Claude Code tools (e.g. Glob, TaskOutput) as SuspiciousSignal::UnknownToolName, and when every tool in a call is unrecognized the call's tool_surface becomes Unknown. The cause is a stale, tiny hardcoded tool registry — not anything actually suspicious in the captured traffic.
In the console this shows up as legitimate agent activity tagged "suspicious / unknown_tool_name". It also drives AgentClassifierUnknownCount — the same Unknown-surface path that triggered the prod worker panic in #81.
Root cause
server/h-llm/src/agent_classifier.rs:18-44 — ClassifierConfig::default() seeds only:
cli_tool_allowlist: ["bash", "shell", "exec", "run_command", "ShellExec"]
known_tool_registry: ["Read", "Edit", "Write", "Grep", "Bash", "Task", "WebFetch", "WebSearch"]
Eight tools. Current Claude Code (and Codex CLI) expose far more, so anything outside that list falls through to:
} else {
suspicious.push(SuspiciousSignal::UnknownToolName { name: name.clone() }); // agent_classifier.rs:91
}Missing common Claude Code tools include at least: Glob, TodoWrite, MultiEdit, NotebookEdit, BashOutput, KillShell, ExitPlanMode, SlashCommand, and the task-management family (TaskOutput, TaskCreate, TaskGet, TaskList, TaskStop, TaskUpdate). (prod runs the default seed — its config.toml has no [classifier] override.)
Proposed fix
- Expand
known_tool_registry (and cli_tool_allowlist where appropriate) in the Default seed to the current Claude Code + Codex CLI tool inventory. Keep the list alphabetized and commented with the source CLI so it's maintainable.
- (Consider) whether a genuinely-unknown tool name should be
Suspicious at all, or just Unknown — a new/unrecognized tool isn't inherently suspicious. At minimum, recognized-but-new tools shouldn't trip it. Out of scope if contentious; the registry expansion is the core fix.
Acceptance criteria
Severity
Low/medium — not a crash (post-#82), but it pollutes the console with false "suspicious" signals and inflates the Unknown classification rate for normal agent traffic.
Summary
heron's agent classifier flags current Claude Code tools (e.g.
Glob,TaskOutput) asSuspiciousSignal::UnknownToolName, and when every tool in a call is unrecognized the call'stool_surfacebecomesUnknown. The cause is a stale, tiny hardcoded tool registry — not anything actually suspicious in the captured traffic.In the console this shows up as legitimate agent activity tagged "suspicious / unknown_tool_name". It also drives
AgentClassifierUnknownCount— the sameUnknown-surface path that triggered the prod worker panic in #81.Root cause
server/h-llm/src/agent_classifier.rs:18-44—ClassifierConfig::default()seeds only:Eight tools. Current Claude Code (and Codex CLI) expose far more, so anything outside that list falls through to:
Missing common Claude Code tools include at least:
Glob,TodoWrite,MultiEdit,NotebookEdit,BashOutput,KillShell,ExitPlanMode,SlashCommand, and the task-management family (TaskOutput,TaskCreate,TaskGet,TaskList,TaskStop,TaskUpdate). (prod runs the default seed — its config.toml has no[classifier]override.)Proposed fix
known_tool_registry(andcli_tool_allowlistwhere appropriate) in theDefaultseed to the current Claude Code + Codex CLI tool inventory. Keep the list alphabetized and commented with the source CLI so it's maintainable.Suspiciousat all, or justUnknown— a new/unrecognized tool isn't inherently suspicious. At minimum, recognized-but-new tools shouldn't trip it. Out of scope if contentious; the registry expansion is the core fix.Acceptance criteria
Glob(andTaskOutput,TodoWrite, etc.) classifies with a non-Unknowntool_surfaceand produces noUnknownToolNamesignal.cargo test --workspacegreen.Severity
Low/medium — not a crash (post-#82), but it pollutes the console with false "suspicious" signals and inflates the
Unknownclassification rate for normal agent traffic.