@the-open-engine/zeroshot 6.34.1 → 6.34.3

package/src/agent/agent-task-executor.js

@@ -54,13 +54,24 @@ const {
   validateCompletedResumeIdentity,
 } = require('./provider-session');
 const { extractClaudeVertexModelError } = require('./output-extraction');
+const {
+  extractProviderFailure,
+  redactTerminalFailureForControlPlane,
+} = require('./provider-terminal-failure');
 const {
   createStructuredOutputInvalidError,
   isStructuredOutputInvalidError,
 } = require('./structured-output-error');
 const TASK_TERMINAL_STATUSES = new Set(['completed', 'failed', 'killed', 'stale']);
 const MAX_CONTROL_PLANE_RECORD_BYTES = 1024 * 1024;
+const MAX_CONTROL_PLANE_OUTPUT_BYTES = 2 * 1024 * 1024;
+const MAX_CONTROL_PLANE_OUTPUT_RECORDS = 1024;
+const MAX_LIVE_OUTPUT_BYTES = 512 * 1024;
+const MAX_LIVE_OUTPUT_RECORDS = 512;
+const CONTROL_PLANE_OMISSION_MARKER_BYTES = 1024;
 const LOG_READ_CHUNK_BYTES = 64 * 1024;
+const MAX_FAILURE_ERROR_BYTES = 4096;
+const FAILURE_ERROR_TRUNCATION_SUFFIX = '… [truncated]';
 function runCommandWithTimeout(command, args, options = {}, callback = null) {
   const timeout = options.timeout ?? 30000;
   if (timeout <= 0) {
@@ -170,6 +181,22 @@ function buildClaudeEnv(modelSpec, options = {}) {
 function sanitizeErrorMessage(error) {
   if (!error) return null;
 
+  const original = String(error);
+  const suffixBytes = Buffer.byteLength(FAILURE_ERROR_TRUNCATION_SUFFIX);
+  const contentBudget = MAX_FAILURE_ERROR_BYTES - suffixBytes;
+  let boundedError = original;
+  if (Buffer.byteLength(original) > MAX_FAILURE_ERROR_BYTES) {
+    let bytes = 0;
+    let prefix = '';
+    for (const character of original) {
+      const characterBytes = Buffer.byteLength(character);
+      if (bytes + characterBytes > contentBudget) break;
+      prefix += character;
+      bytes += characterBytes;
+    }
+    boundedError = `${prefix}${FAILURE_ERROR_TRUNCATION_SUFFIX}`;
+  }
+
   // Patterns that look like TypeScript type annotations (not real error messages)
   const typeAnnotationPatterns = [
     /^string\s*\|\s*null$/i,
@@ -182,7 +209,7 @@ function sanitizeErrorMessage(error) {
     /^[A-Z][a-zA-Z]*\s*\|\s*(?:null|undefined)$/, // e.g., "Error | null"
   ];
 
-  const trimmedError = error.trim();
+  const trimmedError = boundedError.trim();
 
   // Check if it's a union type like "string | number | boolean" (ReDoS-safe approach)
   const unionParts = trimmedError.split(/\s*\|\s*/);
@@ -191,14 +218,16 @@ function sanitizeErrorMessage(error) {
   for (const pattern of typeAnnotationPatterns) {
     if (pattern.test(trimmedError) || isUnionType) {
       console.warn(
-        `[agent-task-executor] WARNING: Error message looks like a TypeScript type annotation: "${error}". ` +
+        `[agent-task-executor] WARNING: Error message looks like a TypeScript type annotation: "${boundedError}". ` +
           `This indicates corrupted data. Replacing with generic error.`
       );
-      return `Task failed with corrupted error data (original: "${error}")`;
+      return sanitizeErrorMessage(
+        `Task failed with corrupted error data (original: "${boundedError}")`
+      );
     }
   }
 
-  return error;
+  return boundedError;
 }
 
 function safeTail(text, maxChars) {
@@ -290,6 +319,30 @@ function logNoMessagesReturned({ taskId, output, statusOutput, debug }) {
   console.error('[AgentTaskExecutor] Claude CLI returned no messages', payload);
 }
 
+function extractKnownCliFailure({ fullOutput, taskId, statusOutput, debug }) {
+  if (fullOutput.includes('exceeds maximum allowed size') || fullOutput.includes('256KB')) {
+    return sanitizeErrorMessage(
+      `FILE TOO LARGE (Claude Code 256KB limit). ` +
+        `Use offset and limit parameters when reading large files. ` +
+        `Example: Read tool with offset=0, limit=1000 to read first 1000 lines.`
+    );
+  }
+  if (fullOutput.includes('only prompt commands are supported in streaming mode')) {
+    return sanitizeErrorMessage(
+      `STREAMING MODE ERROR: Agent tried to use interactive tools in streaming mode. ` +
+        `This usually happens with AskUserQuestion or interactive prompts. ` +
+        `Zeroshot agents must run non-interactively.`
+    );
+  }
+  if (fullOutput.includes('No messages returned')) {
+    logNoMessagesReturned({ taskId, output: fullOutput, statusOutput, debug });
+    return sanitizeErrorMessage(
+      `Claude CLI returned no messages. This is usually transient; retry the task or resume the cluster.`
+    );
+  }
+  return null;
+}
+
 /**
  * Extract error context from task output.
  * Shared by both isolated and non-isolated modes.
@@ -302,7 +355,15 @@ function logNoMessagesReturned({ taskId, output, statusOutput, debug }) {
  * @param {Object} [params.debug] - Additional debug context for logging
  * @returns {string|null} Sanitized error context or null if extraction failed
  */
-function extractErrorContext({ output, statusOutput, taskId, isNotFound = false, debug }) {
+function extractErrorContext({
+  output,
+  statusOutput,
+  taskId,
+  isNotFound = false,
+  providerName = getDefaultProviderId(),
+  providerFailure = null,
+  debug,
+}) {
   // Task not found - explicit error
   if (isNotFound) {
     return sanitizeErrorMessage(`Task ${taskId} not found (may have crashed or been killed)`);
@@ -316,37 +377,15 @@ function extractErrorContext({ output, statusOutput, taskId, isNotFound = false,
     }
   }
 
-  // KNOWN CLAUDE CODE LIMITATIONS - detect and provide actionable guidance
-  const fullOutput = output || '';
-
-  // 256KB file limit error
-  if (fullOutput.includes('exceeds maximum allowed size') || fullOutput.includes('256KB')) {
-    return sanitizeErrorMessage(
-      `FILE TOO LARGE (Claude Code 256KB limit). ` +
-        `Use offset and limit parameters when reading large files. ` +
-        `Example: Read tool with offset=0, limit=1000 to read first 1000 lines.`
-    );
-  }
-
-  // Streaming mode error (interactive tools in non-interactive mode)
-  if (fullOutput.includes('only prompt commands are supported in streaming mode')) {
-    return sanitizeErrorMessage(
-      `STREAMING MODE ERROR: Agent tried to use interactive tools in streaming mode. ` +
-        `This usually happens with AskUserQuestion or interactive prompts. ` +
-        `Zeroshot agents must run non-interactively.`
-    );
+  const terminalFailure = providerFailure || extractProviderFailure(output, providerName);
+  if (terminalFailure) {
+    return sanitizeErrorMessage(terminalFailure.error);
   }
 
-  // Claude CLI transient failure: no messages returned
-  if (fullOutput.includes('No messages returned')) {
-    logNoMessagesReturned({ taskId, output: fullOutput, statusOutput, debug });
-    return sanitizeErrorMessage(
-      `Claude CLI returned no messages. This is usually transient; retry the task or resume the cluster.`
-    );
-  }
+  const fullOutput = output || '';
+  const knownFailure = extractKnownCliFailure({ fullOutput, taskId, statusOutput, debug });
+  if (knownFailure) return knownFailure;
 
-  // NEVER TRUNCATE OUTPUT - truncation corrupts structured JSON and causes false "crash" status
-  // If output is too verbose, that's a prompt problem - fix the prompts, not the data
   const trimmedOutput = (output || '').trim();
   if (!trimmedOutput) {
     return sanitizeErrorMessage(
@@ -1222,8 +1261,8 @@ async function waitForTaskReady(agent, taskId, maxRetries = 10, delayMs = 200) {
 const MAX_STATUS_FAILURES = 30;
 
 function createLogFollowState() {
-  return {
-    output: '',
+  const state = {
+    controlPlaneOutput: createControlPlaneOutputState(),
     logFilePath: null,
     lastSize: 0,
     pollInterval: null,
@@ -1233,6 +1272,175 @@ function createLogFollowState() {
     logDecoder: new StringDecoder('utf8'),
     consecutiveExecFailures: 0,
   };
+  defineControlPlaneOutputAccessor(state, 'output');
+  return state;
+}
+
+function createControlPlaneOutputState(options = {}) {
+  const maxBytes = options.maxBytes || MAX_CONTROL_PLANE_OUTPUT_BYTES;
+  const maxRecords = options.maxRecords || MAX_CONTROL_PLANE_OUTPUT_RECORDS;
+  const liveByteLimit = options.liveByteLimit || MAX_LIVE_OUTPUT_BYTES;
+  const liveRecordLimit = options.liveRecordLimit || MAX_LIVE_OUTPUT_RECORDS;
+  if (maxBytes <= CONTROL_PLANE_OMISSION_MARKER_BYTES || maxRecords < 1) {
+    throw new Error('Control-plane output bounds must retain space for at least one record');
+  }
+  return {
+    records: [],
+    head: 0,
+    byteLength: 0,
+    maxBytes,
+    maxRecords,
+    liveByteLimit,
+    liveRecordLimit,
+    liveBytes: 0,
+    liveRecords: 0,
+    nextSequence: 0,
+    lastLiveSequence: -1,
+    liveSuppressed: false,
+    terminalFlushed: false,
+    omittedBytes: 0,
+    omittedRecords: 0,
+    omittedDigest: createHash('sha256'),
+    prefixOmitted: false,
+  };
+}
+
+function defineControlPlaneOutputAccessor(state, property) {
+  Object.defineProperty(state, property, {
+    configurable: true,
+    enumerable: true,
+    get: () => snapshotControlPlaneOutput(state.controlPlaneOutput),
+  });
+}
+
+function ensureControlPlaneOutputState(state = {}) {
+  if (state.controlPlaneOutput) return state;
+  let existingOutput = '';
+  if (typeof state.output === 'string') {
+    existingOutput = state.output;
+  } else if (typeof state.fullOutput === 'string') {
+    existingOutput = state.fullOutput;
+  }
+  state.controlPlaneOutput = createControlPlaneOutputState();
+  if (Object.hasOwn(state, 'output')) delete state.output;
+  if (Object.hasOwn(state, 'fullOutput')) delete state.fullOutput;
+  defineControlPlaneOutputAccessor(state, 'output');
+  if (existingOutput) {
+    replayCompleteLogContent(existingOutput, (content) =>
+      appendControlPlaneRecord(state.controlPlaneOutput, {
+        content,
+        timestamp: Date.now(),
+        type: isValidJsonLine(content) ? 'json' : 'text',
+      })
+    );
+  }
+  return state;
+}
+
+function retainedControlPlaneRecords(outputState) {
+  return outputState.records.slice(outputState.head);
+}
+
+function compactControlPlaneRecords(outputState) {
+  if (outputState.head >= 64 && outputState.head * 2 >= outputState.records.length) {
+    outputState.records = outputState.records.slice(outputState.head);
+    outputState.head = 0;
+  }
+}
+
+function omitOldestControlPlaneRecord(outputState) {
+  const record = outputState.records[outputState.head++];
+  outputState.byteLength -= record.byteLength;
+  outputState.omittedBytes += record.byteLength;
+  outputState.omittedRecords++;
+  outputState.omittedDigest.update(record.text);
+  compactControlPlaneRecords(outputState);
+}
+
+function appendControlPlaneRecord(outputState, { content, timestamp, type }) {
+  const text = `${content}\n`;
+  const record = {
+    sequence: outputState.nextSequence++,
+    content,
+    timestamp,
+    type,
+    text,
+    byteLength: Buffer.byteLength(text),
+  };
+  outputState.records.push(record);
+  outputState.byteLength += record.byteLength;
+
+  const payloadLimit = outputState.maxBytes - CONTROL_PLANE_OMISSION_MARKER_BYTES;
+  while (
+    outputState.byteLength > payloadLimit ||
+    outputState.records.length - outputState.head > outputState.maxRecords
+  ) {
+    omitOldestControlPlaneRecord(outputState);
+  }
+  return record;
+}
+
+function controlPlaneOmissionRecord(outputState) {
+  if (!outputState.prefixOmitted && outputState.omittedRecords === 0) return null;
+  const digest = outputState.omittedRecords
+    ? `, sha256=${outputState.omittedDigest.copy().digest('hex')}`
+    : '';
+  const known = outputState.omittedRecords
+    ? `records=${outputState.omittedRecords}, byte_length=${outputState.omittedBytes}${digest}`
+    : 'byte_length=unknown';
+  const content =
+    `[ZEROSHOT] Earlier provider output omitted from the bounded control-plane tail (${known}). ` +
+    'Complete output remains in the task log.';
+  return {
+    content,
+    timestamp: Date.now(),
+    type: 'text',
+    text: `${content}\n`,
+    byteLength: Buffer.byteLength(`${content}\n`),
+  };
+}
+
+function snapshotControlPlaneOutput(outputState) {
+  const omission = controlPlaneOmissionRecord(outputState);
+  const records = retainedControlPlaneRecords(outputState);
+  return `${omission ? omission.text : ''}${records.map((record) => record.text).join('')}`;
+}
+
+function resetControlPlaneTail(outputState, { prefixOmitted = false } = {}) {
+  outputState.records = [];
+  outputState.head = 0;
+  outputState.byteLength = 0;
+  outputState.omittedBytes = 0;
+  outputState.omittedRecords = 0;
+  outputState.omittedDigest = createHash('sha256');
+  outputState.prefixOmitted = prefixOmitted;
+}
+
+function publishLiveControlPlaneRecord(outputState, record, publish) {
+  if (
+    outputState.liveSuppressed ||
+    outputState.liveBytes + record.byteLength > outputState.liveByteLimit ||
+    outputState.liveRecords + 1 > outputState.liveRecordLimit
+  ) {
+    outputState.liveSuppressed = true;
+    return;
+  }
+  publish(record);
+  outputState.liveBytes += record.byteLength;
+  outputState.liveRecords++;
+  outputState.lastLiveSequence = record.sequence;
+}
+
+function flushTerminalControlPlaneOutput(outputState, publish) {
+  if (outputState.terminalFlushed) return;
+  outputState.terminalFlushed = true;
+  if (outputState.liveSuppressed) {
+    const omission = controlPlaneOmissionRecord(outputState);
+    if (omission) publish(omission);
+  }
+  for (const record of retainedControlPlaneRecords(outputState)) {
+    if (record.sequence > outputState.lastLiveSequence) publish(record);
+  }
 }
 
 function createLogRecordBuffer() {
@@ -1289,31 +1497,16 @@ function isValidJsonLine(content) {
   }
 }
 
-function broadcastAgentLine({ agent, providerName, state, line }) {
-  if (!line.trim()) return;
-
-  const { timestamp, content } = parseTimestampedLine(line);
-  if (shouldSkipLogLine(content)) {
-    return;
-  }
-
-  const isValidJson = isValidJsonLine(content);
-  state.output += content + '\n';
-
-  if (!state.nested) {
-    agent.lastOutputTime = Date.now();
-  }
-
+function publishAgentOutputRecord(agent, providerName, record) {
   agent._publish({
     topic: 'AGENT_OUTPUT',
     receiver: 'broadcast',
     metadata: buildRawLogOnlyMetadata(),
-    timestamp,
+    timestamp: record.timestamp,
     content: {
-      text: content,
       data: {
-        type: isValidJson ? 'json' : 'text',
-        line: content,
+        type: record.type,
+        line: record.content,
         agent: agent.id,
         role: agent.role,
         iteration: agent.iteration,
@@ -1323,6 +1516,43 @@ function broadcastAgentLine({ agent, providerName, state, line }) {
   });
 }
 
+function broadcastAgentLine({ agent, providerName, state, line }) {
+  const followerState = ensureControlPlaneOutputState(state);
+  if (!line.trim()) return;
+
+  const { timestamp, content } = parseTimestampedLine(line);
+  if (shouldSkipLogLine(content)) {
+    return;
+  }
+  const controlPlaneContent = redactTerminalFailureForControlPlane(
+    followerState,
+    providerName,
+    content
+  );
+
+  const isValidJson = isValidJsonLine(controlPlaneContent);
+  const record = appendControlPlaneRecord(followerState.controlPlaneOutput, {
+    content: controlPlaneContent,
+    timestamp,
+    type: isValidJson ? 'json' : 'text',
+  });
+
+  if (!followerState.nested) {
+    agent.lastOutputTime = Date.now();
+  }
+
+  publishLiveControlPlaneRecord(followerState.controlPlaneOutput, record, (item) =>
+    publishAgentOutputRecord(agent, providerName, item)
+  );
+}
+
+function flushAgentOutput(agent, providerName, state) {
+  const followerState = ensureControlPlaneOutputState(state);
+  flushTerminalControlPlaneOutput(followerState.controlPlaneOutput, (record) =>
+    publishAgentOutputRecord(agent, providerName, record)
+  );
+}
+
 function appendLogRecordFragment(buffer, fragment) {
   const fragmentBytes = Buffer.byteLength(fragment);
   buffer.byteLength += fragmentBytes;
@@ -1512,11 +1742,13 @@ async function evaluateStructuredSuccess({ agent, taskId, state, success, allowR
   }
 }
 
-function buildFailureContext({ agent, taskId, providerName, state, stdout }) {
+function buildFailureContext({ agent, taskId, providerName, state, stdout, providerFailure }) {
   return extractErrorContext({
     output: state.output,
     statusOutput: stdout,
     taskId,
+    providerName,
+    providerFailure,
     debug: {
       agentId: agent.id,
       providerName,
@@ -1529,6 +1761,19 @@ function buildFailureContext({ agent, taskId, providerName, state, stdout }) {
   });
 }
 
+function resolveCompletionFailure({ classified, agent, taskId, providerName, state, stdout }) {
+  if (classified.success) return { providerFailure: null, errorContext: classified.error };
+  const providerFailure =
+    state.providerFailure || extractProviderFailure(state.output, providerName);
+  return {
+    providerFailure,
+    errorContext:
+      providerFailure?.error ||
+      classified.error ||
+      buildFailureContext({ agent, taskId, providerName, state, stdout, providerFailure }),
+  };
+}
+
 async function buildCompletionResult({
   agent,
   taskId,
@@ -1562,10 +1807,14 @@ async function buildCompletionResult({
   if (vertexModelError) {
     classified.success = false;
   }
-  let errorContext = classified.error;
-  if (!errorContext && !classified.success) {
-    errorContext = buildFailureContext({ agent, taskId, providerName, state, stdout });
-  }
+  const { providerFailure, errorContext } = resolveCompletionFailure({
+    classified,
+    agent,
+    taskId,
+    providerName,
+    state,
+    stdout,
+  });
 
   return {
     success: classified.success,
@@ -1581,6 +1830,7 @@ async function buildCompletionResult({
       taskInfo,
       logicalSuccess: classified.success,
     }),
+    providerFailure,
     vertexModelError,
   };
 }
@@ -1616,7 +1866,29 @@ function finalizeLogFollow(agent, state) {
   }
 }
 
-function handleStatusExecError({ agent, state, ctPath, taskId, error, stderr, resolve }) {
+function settleHostStatusFailure({ agent, providerName, state, resolve, text, data, error }) {
+  if (state.resolved) return;
+  state.resolved = true;
+  finalizeLogFollow(agent, state);
+  flushAgentOutput(agent, providerName, state);
+  agent._publish({
+    topic: 'AGENT_ERROR',
+    receiver: 'broadcast',
+    content: { text, data },
+  });
+  resolve({ success: false, output: state.output, error });
+}
+
+function handleStatusExecError({
+  agent,
+  providerName,
+  state,
+  ctPath,
+  taskId,
+  error,
+  stderr,
+  resolve,
+}) {
   if (!error) {
     return false;
   }
@@ -1641,30 +1913,20 @@ function handleStatusExecError({ agent, state, ctPath, taskId, error, stderr, re
       `[Agent ${agent.id}] ⚠️ Task ${taskId} not found - will restart to ensure completion`
     );
 
-    if (!state.resolved) {
-      state.resolved = true;
-      finalizeLogFollow(agent, state);
-
-      agent._publish({
-        topic: 'AGENT_ERROR',
-        receiver: 'broadcast',
-        content: {
-          text: `Task ${taskId} not found - restarting for safety`,
-          data: {
-            taskId,
-            error: 'task_not_found',
-            role: agent.role,
-            iteration: agent.iteration,
-          },
-        },
-      });
-
-      resolve({
-        success: false,
-        output: state.output,
-        error: `Task not found - restarting for safety`,
-      });
-    }
+    settleHostStatusFailure({
+      agent,
+      providerName,
+      state,
+      resolve,
+      text: `Task ${taskId} not found - restarting for safety`,
+      data: {
+        taskId,
+        error: 'task_not_found',
+        role: agent.role,
+        iteration: agent.iteration,
+      },
+      error: 'Task not found - restarting for safety',
+    });
 
     return true;
   }
@@ -1682,31 +1944,21 @@ function handleStatusExecError({ agent, state, ctPath, taskId, error, stderr, re
   console.error(`  Stderr: ${stderr || 'none'}`);
   console.error(`  This may indicate zeroshot is not in PATH or task storage is corrupted.`);
 
-  if (!state.resolved) {
-    state.resolved = true;
-    finalizeLogFollow(agent, state);
-
-    agent._publish({
-      topic: 'AGENT_ERROR',
-      receiver: 'broadcast',
-      content: {
-        text: `Task ${taskId} polling failed after ${MAX_STATUS_FAILURES} consecutive failures`,
-        data: {
-          taskId,
-          error: 'polling_timeout',
-          attempts: state.consecutiveExecFailures,
-          role: agent.role,
-          iteration: agent.iteration,
-        },
-      },
-    });
-
-    resolve({
-      success: false,
-      output: state.output,
-      error: `Status polling failed ${MAX_STATUS_FAILURES} times - task may not exist`,
-    });
-  }
+  settleHostStatusFailure({
+    agent,
+    providerName,
+    state,
+    resolve,
+    text: `Task ${taskId} polling failed after ${MAX_STATUS_FAILURES} consecutive failures`,
+    data: {
+      taskId,
+      error: 'polling_timeout',
+      attempts: state.consecutiveExecFailures,
+      role: agent.role,
+      iteration: agent.iteration,
+    },
+    error: `Status polling failed ${MAX_STATUS_FAILURES} times - task may not exist`,
+  });
 
   return true;
 }
@@ -1761,6 +2013,7 @@ function handleStatusCompletion({
     state.resolved = true;
 
     finalizeLogFollow(agent, state);
+    flushAgentOutput(agent, providerName, state);
 
     buildCompletionResult({
       agent,
@@ -1783,6 +2036,7 @@ function buildKillHandler({ agent, taskId, state, providerName, resolve }) {
       if (state.resolved) return;
       state.resolved = true;
       finalizeLogFollow(agent, state);
+      flushAgentOutput(agent, providerName, state);
       if (!state.nested) {
         agent._stopLivenessCheck();
       }
@@ -1842,7 +2096,18 @@ function createLogFollower({
         (error, stdout, stderr) => {
           if (state.resolved) return;
 
-          if (handleStatusExecError({ agent, state, ctPath, taskId, error, stderr, resolve })) {
+          if (
+            handleStatusExecError({
+              agent,
+              providerName,
+              state,
+              ctPath,
+              taskId,
+              error,
+              stderr,
+              resolve,
+            })
+          ) {
             return;
           }
 
@@ -2283,7 +2548,7 @@ async function spawnClaudeTaskIsolatedExecution(agent, context, options = {}) {
  * - Result: 10-20% overall latency reduction
  */
 function createIsolatedLogState(skipStructuredResultCheck = false, nested = false) {
-  return {
+  const state = {
     taskExited: false,
     resolved: false,
     terminationPromise: null,
@@ -2291,8 +2556,10 @@ function createIsolatedLogState(skipStructuredResultCheck = false, nested = fals
     durableTaskStatus: null,
     lifecycleHandle: null,
     logFilePath: null,
-    fullOutput: '',
+    controlPlaneOutput: createControlPlaneOutputState(),
     tailProcess: null,
+    rawBytesSeen: 0,
+    ignoreTailOutput: false,
     statusCheckInterval: null,
     timeoutTimer: null,
     lineBuffer: createLogRecordBuffer(),
@@ -2300,6 +2567,9 @@ function createIsolatedLogState(skipStructuredResultCheck = false, nested = fals
     skipStructuredResultCheck,
     nested,
   };
+  defineControlPlaneOutputAccessor(state, 'output');
+  defineControlPlaneOutputAccessor(state, 'fullOutput');
+  return state;
 }
 
 function buildIsolatedCleanup(state) {
@@ -2422,6 +2692,89 @@ async function resolveIsolatedLogFilePath(manager, clusterId, taskId, state) {
   return state.logFilePath;
 }
 
+async function captureIsolatedFinalOutputTail(
+  manager,
+  clusterId,
+  logFilePath,
+  state,
+  providerName
+) {
+  stopIsolatedTailForSettlement(state);
+  const sizeResult = await manager.execInContainer(clusterId, [
+    'sh',
+    '-c',
+    `wc -c < "${logFilePath}" 2>/dev/null || echo 0`,
+  ]);
+  const fileSize = Number.parseInt(sizeResult.stdout.trim(), 10);
+  const missingBytes = Number.isSafeInteger(fileSize)
+    ? Math.max(0, fileSize - state.rawBytesSeen)
+    : 0;
+
+  if (missingBytes > 0) {
+    const readBytes = Math.min(missingBytes, MAX_CONTROL_PLANE_OUTPUT_BYTES);
+    const finalReadResult = await manager.execInContainer(clusterId, [
+      'sh',
+      '-c',
+      `tail -c ${readBytes} "${logFilePath}" 2>/dev/null || echo ""`,
+    ]);
+    if (finalReadResult.code === 0 && finalReadResult.stdout) {
+      if (missingBytes > readBytes) {
+        resetControlPlaneTail(state.controlPlaneOutput, { prefixOmitted: true });
+        state.lineBuffer = createLogRecordBuffer();
+      }
+      appendIsolatedContent(state, finalReadResult.stdout, (line) =>
+        retainIsolatedLine(state, providerName, line)
+      );
+    }
+  }
+
+  if (state.lineBuffer.byteLength > 0) {
+    completeLogRecord(
+      state.lineBuffer,
+      (line) => retainIsolatedLine(state, providerName, line),
+      true
+    );
+  }
+}
+
+function resolveIsolatedFailure({
+  success,
+  structuredError,
+  agent,
+  taskId,
+  providerName,
+  state,
+  status,
+  isNotFound,
+  clusterId,
+  logFilePath,
+}) {
+  if (success) return { providerFailure: null, errorContext: structuredError };
+  const providerFailure =
+    state.providerFailure || extractProviderFailure(state.fullOutput, providerName);
+  const errorContext =
+    providerFailure?.error ||
+    structuredError ||
+    extractErrorContext({
+      output: state.fullOutput,
+      statusOutput: status ? `Status: ${status}` : '',
+      taskId,
+      isNotFound,
+      providerName,
+      debug: {
+        agentId: agent.id,
+        providerName,
+        pid: agent.processPid,
+        cwd: agent.config.cwd || process.cwd(),
+        worktreePath: agent.worktree?.path || null,
+        isolation: true,
+        clusterId,
+        logFilePath,
+      },
+    });
+  return { providerFailure, errorContext };
+}
+
 function settleIsolatedTerminalStatus({
   agent,
   manager,
@@ -2434,7 +2787,6 @@ function settleIsolatedTerminalStatus({
   cleanup,
   resolve,
   reject,
-  onLine,
 }) {
   if (state.resolved) return Promise.resolve();
   if (state.terminalSettlementPromise) return state.terminalSettlementPromise;
@@ -2448,17 +2800,9 @@ function settleIsolatedTerminalStatus({
     const logFilePath = await resolveIsolatedLogFilePath(manager, clusterId, taskId, state);
     await new Promise((settle) => setTimeout(settle, 200));
     if (state.resolved) return;
-    const finalReadResult = await manager.execInContainer(clusterId, [
-      'sh',
-      '-c',
-      `cat "${logFilePath}" 2>/dev/null || echo ""`,
-    ]);
+    await captureIsolatedFinalOutputTail(manager, clusterId, logFilePath, state, providerName);
     if (state.resolved) return;
-
-    if (finalReadResult.code === 0 && finalReadResult.stdout) {
-      state.fullOutput = finalReadResult.stdout;
-      replayCompleteLogContent(state.fullOutput, onLine);
-    }
+    flushIsolatedOutput(agent, providerName, taskId, state);
 
     const vertexModelError =
       providerName === 'claude'
@@ -2483,26 +2827,18 @@ function settleIsolatedTerminalStatus({
       success = evaluated.success;
       structuredError = evaluated.error;
     }
-    const errorContext =
-      structuredError ||
-      (!success
-        ? extractErrorContext({
-            output: state.fullOutput,
-            statusOutput: status ? `Status: ${status}` : '',
-            taskId,
-            isNotFound,
-            debug: {
-              agentId: agent.id,
-              providerName,
-              pid: agent.processPid,
-              cwd: agent.config.cwd || process.cwd(),
-              worktreePath: agent.worktree?.path || null,
-              isolation: true,
-              clusterId,
-              logFilePath,
-            },
-          })
-        : null);
+    const { providerFailure, errorContext } = resolveIsolatedFailure({
+      success,
+      structuredError,
+      agent,
+      taskId,
+      providerName,
+      state,
+      status,
+      isNotFound,
+      clusterId,
+      logFilePath,
+    });
     let parsedResult = null;
     if (success && !state.skipStructuredResultCheck && !vertexModelError) {
       parsedResult = staleCandidate
@@ -2522,6 +2858,7 @@ function settleIsolatedTerminalStatus({
         parsedResult,
         error: errorContext,
         tokenUsage: extractTokenUsage(state.fullOutput, providerName),
+        providerFailure,
         vertexModelError,
       },
     });
@@ -2542,9 +2879,9 @@ function buildIsolatedLifecycleHandle({
   cleanup,
   resolve,
   reject,
-  onLine,
 }) {
-  const settleCancellation = (reason, details) =>
+  const settleCancellation = (reason, details) => {
+    flushIsolatedOutput(agent, providerName, taskId, state);
     settleIsolatedFollower({
       agent,
       state,
@@ -2559,6 +2896,7 @@ function buildIsolatedLifecycleHandle({
         tokenUsage: extractTokenUsage(state.fullOutput, providerName),
       },
     });
+  };
   const terminate = (reason = 'Task killed', details = {}) => {
     if (state.durableTaskTerminal) {
       if (state.nested) settleCancellation(reason, details);
@@ -2590,7 +2928,6 @@ function buildIsolatedLifecycleHandle({
           cleanup,
           resolve,
           reject,
-          onLine,
         });
         return termination;
       }
@@ -2618,11 +2955,14 @@ function buildIsolatedLifecycleHandle({
   };
 }
 
-function broadcastIsolatedLine({ agent, providerName, taskId, state, line }) {
+function parseIsolatedLogLine(line) {
   const timestampMatch = line.match(/^\[(\d{4}-\d{2}-\d{2}T[^\]]+)\]\s*(.*)$/);
   const timestamp = timestampMatch ? new Date(timestampMatch[1]).getTime() : Date.now();
   const content = timestampMatch ? timestampMatch[2] : line;
+  return { timestamp, content };
+}
 
+function publishIsolatedOutputRecord(agent, providerName, taskId, record) {
   agent.messageBus.publish({
     cluster_id: agent.cluster.id,
     topic: 'AGENT_OUTPUT',
@@ -2630,31 +2970,67 @@ function broadcastIsolatedLine({ agent, providerName, taskId, state, line }) {
     metadata: buildRawLogOnlyMetadata(),
     content: {
       data: {
-        line: content,
+        line: record.content,
         taskId,
         iteration: agent.iteration,
         provider: providerName,
       },
     },
+    timestamp: record.timestamp,
+  });
+}
+
+function retainIsolatedLine(state, providerName, line) {
+  const { timestamp, content } = parseIsolatedLogLine(line);
+  const controlPlaneContent = redactTerminalFailureForControlPlane(state, providerName, content);
+  return appendControlPlaneRecord(state.controlPlaneOutput, {
+    content: controlPlaneContent,
     timestamp,
+    type: isValidJsonLine(controlPlaneContent) ? 'json' : 'text',
   });
+}
 
-  if (!state?.nested) {
+function broadcastIsolatedLine({ agent, providerName, taskId, state, line }) {
+  const followerState = ensureControlPlaneOutputState(state);
+  const record = retainIsolatedLine(followerState, providerName, line);
+  publishLiveControlPlaneRecord(followerState.controlPlaneOutput, record, (item) =>
+    publishIsolatedOutputRecord(agent, providerName, taskId, item)
+  );
+
+  if (!followerState.nested) {
     agent.lastOutputTime = Date.now();
   }
 }
 
+function flushIsolatedOutput(agent, providerName, taskId, state) {
+  const followerState = ensureControlPlaneOutputState(state);
+  flushTerminalControlPlaneOutput(followerState.controlPlaneOutput, (record) =>
+    publishIsolatedOutputRecord(agent, providerName, taskId, record)
+  );
+}
+
 function appendIsolatedContent(state, content, onLine) {
   appendContentToBuffer(state, content, onLine, true);
 }
 
 function consumeIsolatedTailChunk(state, data, onLine) {
   const chunk = typeof data === 'string' ? data : state.tailDecoder.write(data);
-  if (!chunk) return;
-  state.fullOutput += chunk;
+  if (!chunk || state.ignoreTailOutput) return;
+  state.rawBytesSeen += Buffer.byteLength(chunk);
   appendIsolatedContent(state, chunk, onLine);
 }
 
+function stopIsolatedTailForSettlement(state) {
+  state.ignoreTailOutput = true;
+  if (!state.tailProcess) return;
+  try {
+    state.tailProcess.kill('SIGTERM');
+  } catch {
+    // Ignore - process may already be dead.
+  }
+  state.tailProcess = null;
+}
+
 function startIsolatedTail({ agent, manager, clusterId, logFilePath, state, onLine }) {
   state.tailProcess = manager.spawnInContainer(clusterId, [
     'sh',
@@ -2696,7 +3072,6 @@ async function checkIsolatedStatus({
   cleanup,
   resolve,
   reject,
-  onLine,
 }) {
   if (state.taskExited) return;
 
@@ -2749,7 +3124,6 @@ async function checkIsolatedStatus({
     cleanup,
     resolve,
     reject,
-    onLine,
   });
 }
 
@@ -2764,7 +3138,6 @@ function startIsolatedStatusChecks({
   cleanup,
   resolve,
   reject,
-  onLine,
 }) {
   state.statusCheckInterval = setInterval(() => {
     checkIsolatedStatus({
@@ -2778,7 +3151,6 @@ function startIsolatedStatusChecks({
       cleanup,
       resolve,
       reject,
-      onLine,
     }).catch((statusErr) => {
       agent._log(`[${agent.id}] Status check error (will retry): ${statusErr.message}`);
     });
@@ -2812,7 +3184,6 @@ function followClaudeTaskLogsIsolated(agent, taskId, options = {}) {
       cleanup,
       resolve,
       reject,
-      onLine,
     });
     // Only register the lifecycle handle on the agent for top-level tasks.
     if (!options.nested) {
@@ -2883,7 +3254,6 @@ function followClaudeTaskLogsIsolated(agent, taskId, options = {}) {
           cleanup,
           resolve,
           reject,
-          onLine,
         });
 
         if (agent.timeout > 0 && !agent.enableLivenessCheck && !options.nested) {
@@ -3167,7 +3537,19 @@ module.exports = {
   buildTaskRunArgs,
   rebuildProviderSessionAfterCommit,
   killTask,
+  createLogFollowState,
+  createIsolatedLogState,
+  createControlPlaneOutputState,
+  appendControlPlaneRecord,
   createLogRecordBuffer,
   appendContentToBuffer,
   consumeIsolatedTailChunk,
+  flushAgentOutput,
+  flushIsolatedOutput,
+  CONTROL_PLANE_OUTPUT_LIMITS: Object.freeze({
+    maxBytes: MAX_CONTROL_PLANE_OUTPUT_BYTES,
+    maxRecords: MAX_CONTROL_PLANE_OUTPUT_RECORDS,
+    liveBytes: MAX_LIVE_OUTPUT_BYTES,
+    liveRecords: MAX_LIVE_OUTPUT_RECORDS,
+  }),
 };