Affected Component
Core Services (Frontend UI/Backend API)
Describe the bug
During a recent pentest Pentagi pivoted to leverage discovered credentials against a 3rd party service. When we went back to review the logs to confirm what happened there was a 2.5 hour logging gap during the time when the credentials were discovered and used. After dumping the database tables and reviewing the logs and the pentagi code using claude the AI suggested that the most likely cause of the logging gap was that the LLM updated its tasking flow which triggered a cascading database delete to cleanup the terminal logs and and other associated logs related to the deleted task.
AI Response
The strongest explanation is that subtask replanning deleted the original audit records. I confirmed that mechanism in the source, but the CSV alone cannot prove it happened to flow 16.
Plan changes can erase execution history. The assistant’s plan-patching code (pentagi-main/backend/pkg/providers/assistant.go:625) can delete an active/waiting subtask and recreate it—even when modifying or reordering it. The database defines terminal-log references with ON DELETE CASCADE (pentagi-main/backend/migrations/sql/20260129_120000_add_tracking_fields.sql:46). Deleting that subtask consequently deletes its terminal logs. Tool calls and message histories have similar cascades. Downloaded files remain in the container, explaining how artifacts can survive after their execution evidence disappears. A separate defect drops command output on errors. In pentagi-main/backend/pkg/tools/terminal.go:277, output is buffered and saved only after completion and successful Docker inspection. Timeout, cancellation, or inspection errors bypass that write. This leaves the input command but loses its output.
Steps to Reproduce
see above
System Configuration
Docker compose Using anthropic opus 4.6 for all agents
Logs and Artifacts
No response
Screenshots or Recordings
No response
Verification
- I have checked that this issue hasn't been already reported
- I have provided all relevant configuration files (with sensitive data removed)
- I have included relevant logs and error messages
- I am running the latest version of PentAGI
Hey @try-catch-try , I would like to work on this issue. Before raising any PRs I will actually share the proposed detail plan and solution approaches to you, so that you could review them. I would love to work on this issue. Could you please assign this to me so that I can actually start investigating this issue that was raised. Thank you :))