@desplega.ai/agent-swarm 1.169.0 → 1.171.0

package/dist/{cli-dv76vq5d.js → cli-ctret352.js}

@@ -3,44 +3,45 @@ import {
 } from "./cli-x6z90nq9.js";
 import {
   checkCursorCredentials
-} from "./cli-zzev32jw.js";
+} from "./cli-231av4y6.js";
 import {
   checkGrokCredentials
-} from "./cli-kp3vfknv.js";
+} from "./cli-280gnz4v.js";
 import {
   createSkillInvokeTracker,
   isSkillLoaderCall,
   skillFromToolArgs
-} from "./cli-9k7mqz00.js";
+} from "./cli-ge593j7e.js";
 import {
   checkCodexCredentials,
   codexUserHome
-} from "./cli-km8559dm.js";
+} from "./cli-2qbs2tvf.js";
 import {
   checkClaudeManagedCredentials
-} from "./cli-b7y8113e.js";
+} from "./cli-k2v5x13t.js";
 import {
   checkDevinCredentials
-} from "./cli-hf5s9pgf.js";
+} from "./cli-e3pmyt39.js";
 import {
   checkOpencodeCredentials
-} from "./cli-jvmtxqtc.js";
+} from "./cli-ywh2a87k.js";
 import {
   checkDshCredentials
-} from "./cli-z48ggfyq.js";
+} from "./cli-zxm9p3x4.js";
 import {
   checkAmpCredentials,
   liveTestAmpCredentials
-} from "./cli-sajr098b.js";
+} from "./cli-n8ybnv1k.js";
 import {
+  isLeadChannelMonitoringEnabled,
   isUnknownModelError,
   renderMemoriesPrompt,
   writeSkillsToFilesystem
-} from "./cli-efnd2kce.js";
+} from "./cli-2rbt7at8.js";
 import {
   ACP_TARGET_IDS,
   isAcpTarget
-} from "./cli-zp67qg5x.js";
+} from "./cli-7a0sde2x.js";
 import {
   CODEX_OAUTH_POOL_SLOTS_ENV,
   countCodexOAuthPoolSlots,
@@ -49,7 +50,7 @@ import {
 } from "./cli-bqjfjex4.js";
 import {
   checkClaudeCredentials
-} from "./cli-qg2zhjfc.js";
+} from "./cli-62bwwc2q.js";
 import {
   getContextWindowSize
 } from "./cli-7avy4v8w.js";
@@ -66,21 +67,18 @@ import {
   isAzureDevOpsUrl,
   parseAzureDevOpsRepoUrl,
   resolveScriptsOnlyMode
-} from "./cli-61tbnjpf.js";
-import {
-  getApiKey
-} from "./cli-f14fvzag.js";
+} from "./cli-p8f7dqgt.js";
 import {
   terminateRegisteredProcessGroups
 } from "./cli-zt3w1cn1.js";
 import {
   validateJsonSchema
-} from "./cli-rh44xx46.js";
+} from "./cli-wfvedq5w.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
   loadAllCodexOAuthSlots
-} from "./cli-v1w7pbd8.js";
+} from "./cli-7jykv7ef.js";
 import {
   ensure,
   initOtel,
@@ -90,25 +88,28 @@ import {
   startSpan,
   withSpan,
   withSpanContext
-} from "./cli-e5qk3m2a.js";
+} from "./cli-nkjwe4z7.js";
 import {
+  MASKED_SECRET_VALUE,
   initTelemetry,
   init_api_drain,
   init_codex_auth_failure,
+  init_config_secrets,
   init_telemetry,
   init_telemetry_context,
   isApiDrainingResponse,
   isCodexAuthFailureReason,
   mapTriggerSurface,
   telemetry
-} from "./cli-rg1c8ccw.js";
+} from "./cli-0d2rqhvq.js";
 import {
   ProviderNameSchema,
+  WorkerNudgeSchema,
   init_types,
   isTerminalTaskStatus,
   parseWorkerModelTierOverrides,
   resolveTaskModelSelection
-} from "./cli-xvdgasgy.js";
+} from "./cli-hsem16hb.js";
 import {
   buildContextPreamble,
   buildResumeContextPreamble,
@@ -130,7 +131,7 @@ import {
   taskAttachmentFetchCommand,
   writeIdentityBaselines,
   writeProfileFileFromDb
-} from "./cli-jv36y8wz.js";
+} from "./cli-rrbctenq.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
@@ -168,10 +169,6 @@ import {
   getOpenRouterBaseUrl,
   init_openrouter_base_url
 } from "./cli-a35hzdve.js";
-import {
-  getMcpBaseUrl,
-  init_constants
-} from "./cli-gd4favx9.js";
 import {
   harnessModelMismatch,
   init_runtime_model_catalog,
@@ -179,11 +176,19 @@ import {
   refreshRuntimeModelCatalog,
   runtimeHarnessSections
 } from "./cli-014vns2y.js";
+import {
+  getMcpBaseUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
+import {
+  getApiKey,
+  init_api_key
+} from "./cli-a1b9b32n.js";
 import {
   init_secret_scrubber,
   registerSensitiveKeyName,
   scrubSecrets
-} from "./cli-wt7ccy4r.js";
+} from "./cli-d161g69q.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -220,47 +225,47 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-pjv2q7t8.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-akrzg6jh.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-e5v9w0hv.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-fx6k5wwh.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-0kpg09ca.js");
+      const { CodexAdapter } = await import("./codex-adapter-9ag75whm.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-0wa8se82.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-kqqqhp2q.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
-      const { DevinAdapter } = await import("./devin-adapter-bffjj5n4.js");
+      const { DevinAdapter } = await import("./devin-adapter-xgtj680j.js");
       return new DevinAdapter;
     }
     case "opencode": {
-      const { OpencodeAdapter } = await import("./opencode-adapter-yjyqynzf.js");
+      const { OpencodeAdapter } = await import("./opencode-adapter-f1zby94p.js");
       return new OpencodeAdapter;
     }
     case "dsh": {
-      const { DshAdapter } = await import("./dsh-adapter-5423p70m.js");
+      const { DshAdapter } = await import("./dsh-adapter-2h8m4cab.js");
       return new DshAdapter;
     }
     case "amp": {
-      const { AmpAdapter } = await import("./amp-adapter-nvv8k8j5.js");
+      const { AmpAdapter } = await import("./amp-adapter-ypyf5s1x.js");
       return new AmpAdapter;
     }
     case "cursor": {
-      const { CursorAdapter } = await import("./cursor-adapter-wn8n5zzk.js");
+      const { CursorAdapter } = await import("./cursor-adapter-t4pr1m3c.js");
       return new CursorAdapter;
     }
     case "grok": {
-      const { GrokAdapter } = await import("./grok-adapter-28pkdt80.js");
+      const { GrokAdapter } = await import("./grok-adapter-1err1me7.js");
       return new GrokAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-m47zfx4a.js");
+      const { ACPAdapter } = await import("./acp-adapter-1z9p3fvx.js");
       return new ACPAdapter;
     }
     default:
@@ -268,11 +273,174 @@ async function createProviderAdapter(provider) {
   }
 }
 
+// src/realtime/worker-client.ts
+init_types();
+init_api_key();
+init_secret_scrubber();
+function workerReconnectDelay(attempt, random = Math.random()) {
+  return Math.min(30000, Math.max(1000, 1000 * 2 ** Math.min(attempt, 5) * (0.8 + random * 0.4)));
+}
+
+class WorkerRealtimeClient {
+  config;
+  socket;
+  retry;
+  connectTimeout;
+  stopped = true;
+  connected = false;
+  connectedAt = 0;
+  disconnectedAt = Date.now();
+  attempt = 0;
+  listeners = new Set;
+  pending = new Map;
+  waiters = new Set;
+  constructor(config) {
+    this.config = config;
+  }
+  start() {
+    if (!this.stopped)
+      return;
+    this.stopped = false;
+    this.attempt = 0;
+    this.disconnectedAt = Date.now();
+    this.connect();
+  }
+  stop() {
+    this.stopped = true;
+    this.connected = false;
+    clearTimeout(this.retry);
+    clearTimeout(this.connectTimeout);
+    const socket = this.socket;
+    this.socket = undefined;
+    socket?.close();
+    this.pending.clear();
+    for (const waiter of this.waiters)
+      waiter.finish(null);
+  }
+  isConnected() {
+    return this.connected;
+  }
+  disconnectedSince() {
+    return this.disconnectedAt;
+  }
+  onNudge(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  waitForNudge(kinds, timeoutMs) {
+    for (const [key, nudge] of this.pending) {
+      if (!kinds.includes(nudge.kind))
+        continue;
+      this.pending.delete(key);
+      return Promise.resolve(nudge);
+    }
+    if (this.stopped)
+      return Promise.resolve(null);
+    return new Promise((resolve) => {
+      const waiter = {
+        kinds,
+        finish: (nudge) => {
+          clearTimeout(timer);
+          this.waiters.delete(waiter);
+          resolve(nudge);
+        }
+      };
+      const timer = setTimeout(() => waiter.finish(null), timeoutMs);
+      this.waiters.add(waiter);
+    });
+  }
+  emit(nudge) {
+    let delivered = this.listeners.size > 0;
+    for (const listener of this.listeners)
+      listener(nudge);
+    for (const waiter of this.waiters) {
+      if (!waiter.kinds.includes(nudge.kind))
+        continue;
+      delivered = true;
+      waiter.finish(nudge);
+    }
+    if (!delivered) {
+      this.pending.set(`${nudge.kind}:${nudge.taskId ?? ""}`, nudge);
+      if (this.pending.size > 128)
+        this.pending.delete(this.pending.keys().next().value);
+    }
+  }
+  connect() {
+    if (this.stopped)
+      return;
+    const url = new URL("/api/realtime", this.config.apiUrl);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    try {
+      const socket = new WebSocket(url, {
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey ?? getApiKey()}`,
+          "X-Agent-ID": this.config.agentId,
+          "X-Runtime-Instance-ID": this.config.runtimeInstanceId
+        }
+      });
+      this.socket = socket;
+      this.connectTimeout = setTimeout(() => socket.close(), 15000);
+      socket.onopen = () => socket.send(JSON.stringify({
+        id: 1,
+        op: "subscribe",
+        namespace: `worker:${this.config.agentId}`,
+        name: "nudge"
+      }));
+      socket.onmessage = (event) => {
+        if (this.socket !== socket || this.stopped)
+          return;
+        try {
+          const frame = JSON.parse(String(event.data));
+          if (typeof frame.seq === "number")
+            socket.send(JSON.stringify({ ack: frame.seq }));
+          if (frame.id === 1 && frame.type === "result") {
+            clearTimeout(this.connectTimeout);
+            this.connected = true;
+            this.connectedAt = Date.now();
+            for (const kind of ["work", "config"])
+              this.emit({ v: 1, kind, at: new Date().toISOString() });
+          } else if (frame.id === 1 && frame.type === "error") {
+            console.warn(scrubSecrets("[worker-realtime] Subscription failed. Reconnecting."));
+            socket.close();
+          } else if (frame.type === "channel" && frame.namespace === `worker:${this.config.agentId}` && frame.name === "nudge") {
+            const parsed = WorkerNudgeSchema.safeParse(frame.data);
+            if (parsed.success)
+              this.emit(parsed.data);
+          }
+        } catch {}
+      };
+      socket.onerror = () => socket.close();
+      socket.onclose = () => {
+        if (this.socket !== socket)
+          return;
+        clearTimeout(this.connectTimeout);
+        if (this.connected) {
+          this.disconnectedAt = Date.now();
+          if (this.disconnectedAt - this.connectedAt >= 30000)
+            this.attempt = 0;
+        }
+        this.connected = false;
+        this.socket = undefined;
+        this.scheduleReconnect();
+      };
+    } catch {
+      this.scheduleReconnect();
+    }
+  }
+  scheduleReconnect() {
+    if (this.stopped)
+      return;
+    const delay = workerReconnectDelay(this.attempt++);
+    this.retry = setTimeout(() => this.connect(), delay);
+  }
+}
+
 // src/commands/runner.ts
 init_telemetry();
 init_telemetry_context();
 init_types();
 init_api_drain();
+init_api_key();
 
 // src/utils/budget-backoff.ts
 var BUDGET_BACKOFF_CAP_MS = 5 * 60 * 1000;
@@ -285,6 +453,7 @@ function computeBudgetBackoffMs(consecutiveRefusals, basePollMs) {
 
 // src/commands/runner.ts
 init_codex_auth_failure();
+init_config_secrets();
 init_constants();
 init_credentials();
 
@@ -961,7 +1130,7 @@ var CREDENTIAL_PROVIDER_CHECKERS = {
   devin: (env) => checkDevinCredentials(env),
   opencode: (env, opts) => checkOpencodeCredentials(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-e5v9w0hv.js");
+    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-fx6k5wwh.js");
     return checkPiMonoCredentials(env, opts);
   },
   acp: (env) => {
@@ -1211,7 +1380,7 @@ async function validateProviderCredentials(provider, env = process.env, presence
             latency_ms: Date.now() - startedAt
           };
         }
-        const { liveTestCursorKey } = await import("./cursor-adapter-wn8n5zzk.js");
+        const { liveTestCursorKey } = await import("./cursor-adapter-t4pr1m3c.js");
         const result = await liveTestCursorKey(apiKey);
         return result.ok ? { ok: true, latency_ms: Date.now() - startedAt } : { ok: false, error: result.error, latency_ms: Date.now() - startedAt };
       }
@@ -1556,6 +1725,150 @@ async function refreshIdentityIfChanged(ctx, cached) {
 // src/commands/runner.ts
 init_profile_sync();
 
+// src/commands/push-delivery.ts
+init_secret_scrubber();
+function resolveWorkerDeliveryMode(serverMode, isLead, env = process.env, pollRequired = false) {
+  const mode = env.SWARM_DELIVERY_MODE === "push" || env.SWARM_DELIVERY_MODE === "poll" ? env.SWARM_DELIVERY_MODE : serverMode ?? "poll";
+  if ((mode === "push" || pollRequired) && isLead && (pollRequired || isLeadChannelMonitoringEnabled(env))) {
+    console.warn(scrubSecrets("[runner] LEAD_MONITOR_CHANNELS requires poll delivery. Using poll."));
+    return "poll";
+  }
+  return mode;
+}
+function updateWorkerDeliveryMode(previousMode, registration, isLead, env = process.env) {
+  const mode = resolveWorkerDeliveryMode(registration.deliveryMode, isLead, env, registration.pollRequired);
+  if (mode !== previousMode) {
+    const override = env.SWARM_DELIVERY_MODE;
+    const source = override === "poll" || override === "push" ? `SWARM_DELIVERY_MODE override: ${override}` : registration.deliveryMode ? `register response: ${registration.deliveryMode}` : "register response omitted deliveryMode, default: poll";
+    const required = isLead && (registration.pollRequired || isLeadChannelMonitoringEnabled(env)) ? ", LEAD_MONITOR_CHANNELS requires poll" : "";
+    console.log(scrubSecrets(`[runner] Delivery mode: ${mode} (${source}${required}).`));
+  }
+  return mode;
+}
+function taskReconciliation(checks) {
+  return {
+    cancelTaskIds: checks.push && !checks.safety ? checks.cancelTaskIds : undefined,
+    checkStatus: !checks.push || checks.safety
+  };
+}
+function shouldRunDeliveryLoop(mode, shuttingDown) {
+  return mode !== "push" || !shuttingDown;
+}
+function deliverySchedule(options) {
+  const blocked = options.draining || options.activeCount >= options.maxConcurrent;
+  return {
+    poll: !blocked && (!options.push || options.work),
+    singlePoll: options.mode === "push",
+    waitKind: options.push ? "push" : options.mode === "push" && !blocked ? "fallback" : "sleep",
+    waitMs: blocked || options.push && options.activeCount > 0 ? 1000 : options.push ? Math.max(0, Math.min(resolvePushSafetyPollMs(), 30000 - ((options.now ?? Date.now()) - options.lastPushPingAt))) : options.pollInterval
+  };
+}
+function resolvePushSafetyPollMs(env = process.env) {
+  const value = Number(env.RUNNER_PUSH_SAFETY_POLL_MS);
+  return Number.isFinite(value) && value > 0 ? value : 30000;
+}
+
+class RunnerPushDelivery {
+  client;
+  lastSafetyAt = -Infinity;
+  fallback = false;
+  work = true;
+  config = false;
+  cancel = new Set;
+  steer = new Set;
+  constructor(client) {
+    this.client = client;
+    client.onNudge((nudge) => this.receive(nudge));
+  }
+  receive(nudge) {
+    if (nudge.kind === "work")
+      this.work = true;
+    if (nudge.kind === "config")
+      this.config = true;
+    if (nudge.kind === "cancel" && nudge.taskId)
+      this.cancel.add(nudge.taskId);
+    if (nudge.kind === "steer" && nudge.taskId)
+      this.steer.add(nudge.taskId);
+  }
+  checks(mode, now = Date.now(), safetyMs = resolvePushSafetyPollMs()) {
+    if (this.client.isConnected()) {
+      if (this.fallback && mode === "push")
+        console.log(scrubSecrets("[runner] Delivery mode: push (push socket reconnected)."));
+      this.fallback = false;
+    } else {
+      if (mode === "push" && now - this.client.disconnectedSince() > 60000 && !this.fallback) {
+        this.fallback = true;
+        console.warn(scrubSecrets("[runner] Delivery mode: poll (push socket unavailable for 60 seconds). Using poll until reconnect."));
+      }
+    }
+    const push = mode === "push" && !this.fallback;
+    const safety = push && now - this.lastSafetyAt >= safetyMs;
+    if (safety)
+      this.lastSafetyAt = now;
+    if (safety)
+      this.work = true;
+    const checks = {
+      push,
+      safety,
+      work: !push || this.work,
+      config: !push || safety || this.config,
+      cancelTaskIds: new Set(this.cancel),
+      steerTaskIds: new Set(this.steer)
+    };
+    this.config = false;
+    this.cancel.clear();
+    this.steer.clear();
+    return checks;
+  }
+  beginPoll() {
+    this.work = false;
+  }
+  wakeWork() {
+    this.work = true;
+  }
+  schedule(options) {
+    return deliverySchedule({ ...options, work: this.work });
+  }
+  dispatchSteering(checks, taskId, dispatch) {
+    if (checks.push && !checks.safety && !checks.steerTaskIds.has(taskId))
+      return;
+    if (!dispatch() && checks.push)
+      this.steer.add(taskId);
+  }
+  async poll(singlePoll, fetch2) {
+    if (singlePoll)
+      this.beginPoll();
+    let failed = false;
+    const trigger = await fetch2(() => {
+      failed = true;
+    });
+    if (singlePoll && (failed || trigger))
+      this.wakeWork();
+    return { trigger, failed };
+  }
+  async waitForSchedule(schedule, failed = false, pollInterval = 2000) {
+    if (failed) {
+      await Bun.sleep(pollInterval);
+      return;
+    }
+    if (schedule.poll && schedule.waitKind === "push" && (this.work || this.config || this.cancel.size > 0 || this.steer.size > 0))
+      return;
+    const timeout = schedule.waitMs;
+    if (schedule.waitKind === "push")
+      await this.wait(timeout);
+    else if (schedule.waitKind === "fallback")
+      await this.client.waitForNudge(["work", "cancel", "steer", "config"], timeout);
+    else
+      await Bun.sleep(timeout);
+  }
+  async wait(timeoutMs) {
+    const now = Date.now();
+    const untilSafety = this.lastSafetyAt + resolvePushSafetyPollMs() - now;
+    const untilFallback = !this.client.isConnected() && !this.fallback ? this.client.disconnectedSince() + 60001 - now : Infinity;
+    await this.client.waitForNudge(["work", "cancel", "steer", "config"], Math.max(0, Math.min(timeoutMs, untilSafety, untilFallback)));
+  }
+}
+
 // src/commands/resume-session.ts
 var RESUME_DEPRECATED_REASON = "native resume deprecated — using context preamble";
 function resolveResumeSession(_currentProvider, candidates) {
@@ -1922,11 +2235,23 @@ async function closeAgent(config, role) {
     console.log(`[${role}] Marking agent as offline...`);
     await fetch(`${config.apiUrl}/close`, {
       method: "POST",
-      headers
+      headers: { ...headers, "Content-Type": "application/json" },
+      body: JSON.stringify({ runtimeShutdown: true })
     });
     console.log(`[${role}] Agent marked as offline`);
   } catch {}
 }
+function resolveExitAfterTasks(env = process.env) {
+  const raw = env.SWARM_EXIT_AFTER_TASKS?.trim();
+  const value = Number(raw);
+  return raw && Number.isInteger(value) && value > 0 ? value : null;
+}
+async function exitAfterTasksIfFinished(state, limit, shutdown) {
+  if (limit === null || state.tasksProcessed < limit || state.activeTasks.size > 0)
+    return false;
+  await shutdown("SWARM_EXIT_AFTER_TASKS");
+  return true;
+}
 var deploymentMemoryRaters = process.env.MEMORY_RATERS;
 var rowOverriddenBootEnv = new Map;
 async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env, taskModel, sessionContext) {
@@ -1942,6 +2267,8 @@ async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env,
       const headers = { "X-Agent-ID": agentId };
       if (apiKey)
         headers.Authorization = `Bearer ${apiKey}`;
+      if (sessionContext?.taskId)
+        headers["X-Source-Task-Id"] = sessionContext.taskId;
       const url = `${apiUrl}/api/config/resolved?agentId=${encodeURIComponent(agentId)}&includeSecrets=true${repoId ? `&repoId=${encodeURIComponent(repoId)}` : ""}`;
       const response = await fetch(url, { headers });
       if (!response.ok) {
@@ -1954,8 +2281,13 @@ async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env,
             env[key] = bootValue;
         }
         if (data.configs?.length) {
+          const skippedSecretKeys = [];
           scriptsOnlyConfigValue = data.configs.find((config) => config.key === "SCRIPTS_ONLY_MCP")?.value;
           for (const config of data.configs) {
+            if (config.isSecret && config.value === MASKED_SECRET_VALUE) {
+              skippedSecretKeys.push(config.key);
+              continue;
+            }
             if (isCodexOAuthConfigKey(config.key))
               continue;
             if (config.isSecret)
@@ -1966,6 +2298,9 @@ async function fetchResolvedEnv(apiUrl, apiKey, agentId, baseEnv = process.env,
             }
             env[config.key] = config.value;
           }
+          if (skippedSecretKeys.length) {
+            console.warn(scrubSecrets(`[env-reload] Skipped masked secrets: ${skippedSecretKeys.join(", ")}`));
+          }
           console.log(`[env-reload] Loaded ${data.configs.length} config entries from API`);
         }
         const codexPoolSlots = countCodexOAuthPoolSlots(data.configs ?? []);
@@ -2407,7 +2742,37 @@ function jsonOutputCandidates(text) {
   }
   return [...new Set(candidates)];
 }
-async function ensureTaskFinished(config, role, taskId, exitCode, failureReason, providerOutput, provider, failureDiagnostics) {
+function finalUpdateDeadline() {
+  const maxSec = Number(process.env.RUNNER_FINISH_RETRY_MAX_SEC);
+  return Date.now() + (Number.isFinite(maxSec) && maxSec > 0 ? maxSec : 300) * 1000;
+}
+async function postWithRetry(url, headers, body, deadline, label) {
+  let delay = 1000;
+  for (;; ) {
+    try {
+      const response = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(Math.max(1, Math.min(30000, deadline - Date.now())))
+      });
+      if (response.status < 500)
+        return response;
+      throw new Error(`HTTP ${response.status}: ${scrubSecrets(await response.text()).slice(0, 300)}`);
+    } catch (error) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        throw error;
+      const wait = Math.min(delay, remaining);
+      console.warn(scrubSecrets(`[runner] ${label} failed. Retry in ${wait}ms: ${error}`));
+      await Bun.sleep(wait);
+      if (Date.now() >= deadline)
+        throw error;
+      delay = Math.min(30000, delay * 2);
+    }
+  }
+}
+async function ensureTaskFinished(config, role, taskId, exitCode, failureReason, providerOutput, provider, failureDiagnostics, finalProgress, retryDeadline) {
   const headers = {
     "X-Agent-ID": config.agentId,
     "Content-Type": "application/json"
@@ -2463,11 +2828,15 @@ ${failureDiagnostics}`;
     applyFallback(fallback);
   }
   try {
-    const response = await fetch(`${config.apiUrl}/api/tasks/${taskId}/finish`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
-    });
+    const deadline = retryDeadline ?? finalUpdateDeadline();
+    if (finalProgress) {
+      const progress = await postWithRetry(`${config.apiUrl}/api/tasks/${taskId}/progress`, headers, { progress: scrubSecrets(finalProgress) }, deadline, "Final task progress POST");
+      if (progress.status === 401) {
+        console.warn(`[${role}] Final task update rejected: HTTP 401`);
+        return;
+      }
+    }
+    const response = await postWithRetry(`${config.apiUrl}/api/tasks/${taskId}/finish`, headers, body, deadline, "Final task finish POST");
     if (response.ok) {
       const result = await response.json();
       if (result.alreadyFinished) {
@@ -2475,17 +2844,19 @@ ${failureDiagnostics}`;
       } else {
         console.log(`[${role}] Runner marked task ${taskId.slice(0, 8)} as ${status} (exit code: ${exitCode})`);
       }
+    } else if (response.status === 401) {
+      console.warn(scrubSecrets(`[${role}] Task ${taskId.slice(0, 8)}: runtime token revoked or expired; giving up on finish`));
     } else if (response.status === 409) {
       const error = await response.text();
-      console.warn(`[${role}] Runner result for task ${taskId.slice(0, 8)} was discarded because the task is already terminal; continuing: ${error}`);
+      console.warn(scrubSecrets(`[${role}] Runner result for task ${taskId.slice(0, 8)} was discarded because the task is already terminal; continuing: ${error}`));
     } else if (response.status === 404) {
       console.log(`[${role}] Task ${taskId.slice(0, 8)} already finalized (not found), skipping`);
     } else {
       const error = await response.text();
-      console.warn(`[${role}] Failed to finish task ${taskId.slice(0, 8)}: ${response.status} ${error}`);
+      console.warn(scrubSecrets(`[${role}] Failed to finish task ${taskId.slice(0, 8)}: ${response.status} ${error}`));
     }
   } catch (err) {
-    console.warn(`[${role}] Error finishing task ${taskId.slice(0, 8)}: ${err}`);
+    console.warn(scrubSecrets(`[${role}] Error finishing task ${taskId.slice(0, 8)}: ${err}`));
   }
 }
 async function reportKeyUsage(apiUrl, apiKey, keyType, selection, taskId) {
@@ -2750,12 +3121,13 @@ async function buildResumePrompt(task, fmt = (cmd) => `/${cmd}`, options) {
   });
   return result.text;
 }
-function setupShutdownHandlers(role, apiConfig, getRunnerState) {
+function setupShutdownHandlers(role, apiConfig, getRunnerState, onShutdown) {
   let shutdownInProgress = false;
   const shutdown = async (signal, exitCode = 0) => {
     if (shutdownInProgress)
       return;
     shutdownInProgress = true;
+    onShutdown?.();
     console.log(`
 [${role}] Received ${signal}, shutting down...`);
     const state = getRunnerState?.();
@@ -2804,15 +3176,13 @@ function setupShutdownHandlers(role, apiConfig, getRunnerState) {
     await savePm2State(role);
     process.exit(exitCode);
   };
-  const beginShutdown = (signal, exitCode = 0) => {
-    shutdown(signal, exitCode).catch(async (error) => {
-      console.error(`[${role}] Shutdown failed after ${signal}:`, error);
-      await terminateRegisteredProcessGroups();
-      process.exit(1);
-    });
-  };
-  process.on("SIGINT", () => beginShutdown("SIGINT"));
-  process.on("SIGTERM", () => beginShutdown("SIGTERM"));
+  const beginShutdown = (signal, exitCode = 0) => shutdown(signal, exitCode).catch(async (error) => {
+    console.error(`[${role}] Shutdown failed after ${signal}:`, error);
+    await terminateRegisteredProcessGroups();
+    process.exit(1);
+  });
+  process.on("SIGINT", () => void beginShutdown("SIGINT"));
+  process.on("SIGTERM", () => void beginShutdown("SIGTERM"));
   let fatalShutdownInProgress = false;
   const fatalShutdown = (kind, error) => {
     if (fatalShutdownInProgress)
@@ -2827,6 +3197,7 @@ function setupShutdownHandlers(role, apiConfig, getRunnerState) {
   process.on("unhandledRejection", (reason) => {
     fatalShutdown("Unhandled rejection", reason);
   });
+  return beginShutdown;
 }
 var LOG_BUFFER_SIZE = 50;
 var LOG_FLUSH_INTERVAL_MS = 5000;
@@ -2862,7 +3233,7 @@ async function flushLogBuffer(buffer, opts) {
     console.warn(`[runner] Error pushing logs: ${error}`);
   }
 }
-async function saveCostData(cost, apiUrl, apiKey) {
+async function saveCostData(cost, apiUrl, apiKey, deadline) {
   const headers = {
     "Content-Type": "application/json",
     "X-Agent-ID": cost.agentId
@@ -2871,16 +3242,15 @@ async function saveCostData(cost, apiUrl, apiKey) {
     headers.Authorization = `Bearer ${apiKey}`;
   }
   try {
-    const response = await fetch(`${apiUrl}/api/session-costs`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(cost)
-    });
-    if (!response.ok) {
+    const body = { ...cost, id: crypto.randomUUID() };
+    const response = await postWithRetry(`${apiUrl}/api/session-costs`, headers, body, deadline, "Session cost POST");
+    if (response.status === 401) {
+      console.warn("[runner] Cost data: runtime token revoked or expired. Cost saving stopped.");
+    } else if (!response.ok) {
       console.warn(`[runner] Failed to save cost data: ${response.status}`);
     }
   } catch (error) {
-    console.warn(`[runner] Error saving cost data: ${error}`);
+    console.warn(scrubSecrets(`[runner] Error saving cost data: ${error}`));
   }
 }
 async function saveProviderSessionId(apiUrl, apiKey, taskId, claudeSessionId, provider, providerMeta, model, harnessVariant, harnessVariantMeta) {
@@ -3069,12 +3439,24 @@ async function removeActiveSession(config, taskId) {
   const headers = { "X-Agent-ID": config.agentId };
   if (config.apiKey)
     headers.Authorization = `Bearer ${config.apiKey}`;
-  try {
-    await fetch(`${config.apiUrl}/api/active-sessions/by-task/${taskId}`, {
-      method: "DELETE",
-      headers
-    });
-  } catch {}
+  for (let attempt = 1;attempt <= 3; attempt++) {
+    try {
+      const response = await fetch(`${config.apiUrl}/api/active-sessions/by-task/${taskId}`, {
+        method: "DELETE",
+        headers,
+        signal: AbortSignal.timeout(1000)
+      });
+      if (!response.ok)
+        throw new Error(`HTTP ${response.status}`);
+      return;
+    } catch (error) {
+      if (attempt === 3) {
+        console.warn(scrubSecrets(`[runner] Active-session removal failed for task ${taskId} after 3 attempts: ${error instanceof Error ? error.message : String(error)}`));
+      } else {
+        await Bun.sleep(attempt * 100);
+      }
+    }
+  }
 }
 async function cleanupActiveSessions(config) {
   const headers = {
@@ -3239,10 +3621,16 @@ async function registerAgent(opts) {
   }
   try {
     const body = await response.json();
+    const deliveryMode = body.deliveryMode === "push" || body.deliveryMode === "poll" ? body.deliveryMode : undefined;
+    const mode = {
+      ...deliveryMode ? { deliveryMode } : {},
+      ...typeof body.pollRequired === "boolean" ? { pollRequired: body.pollRequired } : {}
+    };
     const caps = body.enabledCapabilities;
     if (Array.isArray(caps) && caps.every((c2) => typeof c2 === "string")) {
-      return { serverCapabilities: caps };
+      return { serverCapabilities: caps, ...mode };
     }
+    return mode;
   } catch {}
   return {};
 }
@@ -3292,6 +3680,9 @@ async function pollForTriggerOnce(opts) {
       });
       if (!response.ok) {
         console.warn(`[runner] Poll request failed: ${response.status}`);
+        opts.onPollFailure?.();
+        if (opts.singlePoll)
+          return null;
         await Bun.sleep(opts.pollInterval);
         continue;
       }
@@ -3304,8 +3695,11 @@ async function pollForTriggerOnce(opts) {
       if (draining)
         return null;
     } catch (error) {
-      console.warn(`[runner] Poll request error: ${error}`);
+      console.warn(scrubSecrets(`[runner] Poll request error: ${error}`));
+      opts.onPollFailure?.();
     }
+    if (opts.singlePoll)
+      return null;
     await Bun.sleep(opts.pollInterval);
   }
   return null;
@@ -3602,6 +3996,11 @@ function resolveSessionTelemetryEvent(result) {
     return "failure";
   return;
 }
+function withHarnessTelemetryEnv(env) {
+  if (env.DESPLEGA_TELEMETRY_ENV?.trim())
+    return { ...env };
+  return { ...env, DESPLEGA_TELEMETRY_ENV: "test" };
+}
 function implicitCloseActiveToolSpans(activeToolSpans, now = Date.now()) {
   let closed = 0;
   for (const [toolCallId, active] of activeToolSpans) {
@@ -3626,6 +4025,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
   try {
     ({ env: freshEnv, credentialSelections } = await fetchResolvedEnv(opts.apiUrl, opts.apiKey, opts.agentId, process.env, opts.resolvedModel || opts.model, {
       repoId: sessionRepo?.id,
+      taskId: realTaskId,
       provider: adapter.name,
       modelTier: opts.modelTier,
       localBlocks: opts.localBlocks,
@@ -3703,7 +4103,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
     additionalArgs: opts.additionalArgs,
     resumeSessionId: opts.resumeSessionId,
     iteration: opts.iteration,
-    env: freshEnv,
+    env: withHarnessTelemetryEnv(freshEnv),
     codexSlot: oauthIsPoolBacked ? oauthSelection?.index : undefined,
     contextKey: opts.contextKey,
     reasoningEffort: reasoningEffortOverride,
@@ -3803,6 +4203,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
   }
   let lastProgressTime = 0;
   const assistantTextHolder = {};
+  const finalProgressHolder = {};
   let lastContextPostTime = 0;
   const CONTEXT_THROTTLE_MS = 30000;
   let cumulativeProgressOutputTokens = 0;
@@ -3894,8 +4295,10 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
           startedAt: Date.now()
         });
         const now = Date.now();
+        const progress = toolCallToProgress(event.toolName, event.args);
+        if (progress)
+          finalProgressHolder.value = scrubSecrets(progress);
         if (effectiveTaskId && opts.apiUrl && now - lastProgressTime >= PROGRESS_THROTTLE_MS) {
-          const progress = toolCallToProgress(event.toolName, event.args);
           if (progress) {
             lastProgressTime = now;
             updateProgressViaAPI(opts.apiUrl, opts.apiKey, effectiveTaskId, progress).catch(() => {});
@@ -4051,6 +4454,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
         }));
         break;
       case "progress": {
+        finalProgressHolder.value = scrubSecrets(event.message);
         if (effectiveTaskId && opts.apiUrl) {
           const now = Date.now();
           if (now - lastProgressTime >= PROGRESS_THROTTLE_MS) {
@@ -4111,6 +4515,7 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
       }
     }
     if (result.cost) {
+      result.cost = { ...result.cost, taskId: realTaskId, sessionId: opts.runnerSessionId };
       sessionSpan.setAttributes({
         "gen_ai.response.model": result.cost.model,
         "gen_ai.usage.input_tokens": result.cost.inputTokens ?? 0,
@@ -4134,11 +4539,6 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
         numTurns: result.cost.numTurns,
         isError: result.cost.isError
       }, { userId: opts.requestedByUserId ?? null });
-      try {
-        await saveCostData({ ...result.cost, taskId: realTaskId, sessionId: opts.runnerSessionId }, opts.apiUrl, opts.apiKey);
-      } catch (err) {
-        console.warn(`[runner] Failed to save cost: ${err}`);
-      }
     }
     if (result.cost && realTaskId) {
       fetch(`${opts.apiUrl}/api/tasks/${realTaskId}/context`, {
@@ -4230,7 +4630,8 @@ async function spawnProviderProcess(adapter, opts, logDir, isYolo) {
     harnessProvider: opts.harnessProvider,
     hasLocalEnvironment: adapter.traits.hasLocalEnvironment,
     model: model || undefined,
-    assistantText: assistantTextHolder
+    assistantText: assistantTextHolder,
+    finalProgress: finalProgressHolder
   };
   runningTaskForSessionInit = runningTask;
   if (pendingHarnessVariant !== undefined) {
@@ -4294,7 +4695,7 @@ async function reconcileActiveTasks(state, role, opts) {
   for (const [taskId, task] of state.activeTasks) {
     if (task.result !== null)
       continue;
-    if (!opts.cancelledSignaled.has(taskId)) {
+    if (!opts.cancelledSignaled.has(taskId) && (!opts.cancelTaskIds || opts.cancelTaskIds.has(taskId))) {
       try {
         if (await opts.isCancelled(taskId)) {
           console.log(`[${role}] Task ${taskId.slice(0, 8)} was cancelled — sending SIGTERM to subprocess`);
@@ -4303,7 +4704,7 @@ async function reconcileActiveTasks(state, role, opts) {
         }
       } catch {}
     }
-    if (task.abortRequestedAt === undefined) {
+    if (task.abortRequestedAt === undefined && opts.checkStatus !== false) {
       const lastCheck = task.lastReconcileAt ?? task.startTime.getTime();
       if (now() - lastCheck >= opts.intervalMs) {
         task.lastReconcileAt = now();
@@ -4359,13 +4760,16 @@ async function checkCompletedProcesses(state, role, apiConfig, cancelledSignaled
         model: task.model,
         durationMs: Date.now() - task.startTime.getTime(),
         assistantText: task.assistantText,
+        finalProgress: task.finalProgress,
         serverTerminalStatus: task.serverTerminalStatus
       });
     }
   }
-  for (const {
+  let credentialReports = Promise.resolve();
+  const completions = await Promise.allSettled(completedTasks.map(async ({
     taskId,
     result,
+    triggerType,
     triggerSurface,
     requestedByUserId,
     cursorUpdates,
@@ -4377,131 +4781,149 @@ async function checkCompletedProcesses(state, role, apiConfig, cancelledSignaled
     model,
     durationMs,
     assistantText,
+    finalProgress,
     serverTerminalStatus
-  } of completedTasks) {
-    state.activeTasks.delete(taskId);
-    vcsDetectedTasks.delete(taskId);
-    vcsCheckTimestamps.delete(taskId);
-    cancelledSignaled?.delete(taskId);
-    if (apiConfig) {
-      removeActiveSession(apiConfig, taskId).catch((err) => console.error("[runner] active-session removal failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
-    if (serverTerminalStatus) {
-      console.log(`[${role}] Task ${taskId.slice(0, 8)} was already ${serverTerminalStatus} server-side — slot released, server result kept`);
-      state.tasksProcessed += 1;
-      continue;
-    }
-    if (apiConfig && workingDir && !vcsDetectedTasks.has(taskId)) {
-      await detectVcsForTask(apiConfig.apiUrl, apiConfig.apiKey, taskId, workingDir);
-    }
-    if (apiConfig) {
-      let failureReason;
-      if (result.exitCode !== 0 && result.failureReason) {
-        failureReason = result.failureReason;
-        console.log(`[${role}] Detected error for task ${taskId.slice(0, 8)}: ${failureReason}`);
-      }
-      reportHarnessModelOutcome({
-        apiUrl: apiConfig.apiUrl,
-        apiKey: apiConfig.apiKey,
-        agentId: apiConfig.agentId,
-        harness: harnessProvider,
-        model,
-        exitCode: result.exitCode,
-        failureReason
-      });
-      if (credentialInfo) {
+  }) => {
+    const deadline = finalUpdateDeadline();
+    const costSave = apiConfig && result.cost ? saveCostData(result.cost, apiConfig.apiUrl, apiConfig.apiKey, deadline) : Promise.resolve();
+    const credentialReport = credentialReports.then(async () => {
+      if (apiConfig && credentialInfo && !serverTerminalStatus) {
         await reportKeyCompletionOutcome({
           apiUrl: apiConfig.apiUrl,
           apiKey: apiConfig.apiKey,
           credential: credentialInfo,
           taskId,
           exitCode: result.exitCode,
-          failureReason
+          failureReason: result.exitCode !== 0 ? result.failureReason : undefined
         });
       }
-      let bridgeDiagnostics;
-      if (result.exitCode !== 0 && harnessProvider === "claude" && workingDir) {
-        bridgeDiagnostics = await getBridgeFailureDiagnostics(workingDir);
-        if (bridgeDiagnostics?.artifactPath && result.sessionId) {
-          console.log(`[${role}] Bridge failure artifact found: ${bridgeDiagnostics.artifactPath}`);
-          updateHarnessVariantMeta(apiConfig.apiUrl, apiConfig.apiKey, taskId, result.sessionId, {
-            failureArtifact: bridgeDiagnostics.artifactPath
-          }).catch((err) => console.warn(`[runner] Failed to update harness variant meta: ${err}`));
-        }
+    });
+    credentialReports = credentialReport.catch(() => {});
+    try {
+      vcsDetectedTasks.delete(taskId);
+      vcsCheckTimestamps.delete(taskId);
+      cancelledSignaled?.delete(taskId);
+      if (serverTerminalStatus) {
+        console.log(`[${role}] Task ${taskId.slice(0, 8)} was already ${serverTerminalStatus} server-side — slot released, server result kept`);
+        return;
       }
-      const bridgeFailureDiagnostics = bridgeDiagnostics?.paneTail != null ? `Claude bridge final tmux pane tail (${bridgeDiagnostics.artifactPath}):
-${bridgeDiagnostics.paneTail}` : undefined;
-      await reportCredentialOutcomeThenFinish({
-        apiUrl: apiConfig.apiUrl,
-        apiKey: apiConfig.apiKey,
-        credentialInfo,
-        result,
-        failureReason,
-        model,
-        codexCreditsExhaustedCooldownMs: state.codexCreditsExhaustedCooldownMs,
-        modelWindowBlocks: state.modelWindowBlocks
-      }, () => ensureTaskFinished(apiConfig, role, taskId, result.exitCode, failureReason, resolveProviderOutput(result, assistantText), harnessProvider, bridgeFailureDiagnostics));
-      const sessionTriggerSurface = workerTriggerSurface(triggerSurface);
-      const sessionActor = { userId: requestedByUserId ?? null };
-      telemetry.taskEvent("session_completed", {
-        taskId,
-        trigger_surface: sessionTriggerSurface,
-        agentId: apiConfig.agentId,
-        provider: result.cost?.provider ?? harnessProvider,
-        model: result.cost?.model ?? model ?? "unknown",
-        harnessVariant,
-        harnessVersion: typeof harnessVariantMeta?.version === "string" || typeof harnessVariantMeta?.version === "number" ? String(harnessVariantMeta.version) : undefined,
-        exitCode: result.exitCode,
-        isError: result.exitCode !== 0,
-        durationMs
-      }, sessionActor);
-      const sessionTelemetryEvent = resolveSessionTelemetryEvent(result);
-      if (sessionTelemetryEvent) {
-        telemetry.session(sessionTelemetryEvent, {
+      if (apiConfig && workingDir && !vcsDetectedTasks.has(taskId)) {
+        await detectVcsForTask(apiConfig.apiUrl, apiConfig.apiKey, taskId, workingDir);
+      }
+      if (apiConfig) {
+        let failureReason;
+        if (result.exitCode !== 0 && result.failureReason) {
+          failureReason = result.failureReason;
+          console.log(`[${role}] Detected error for task ${taskId.slice(0, 8)}: ${failureReason}`);
+        }
+        reportHarnessModelOutcome({
+          apiUrl: apiConfig.apiUrl,
+          apiKey: apiConfig.apiKey,
           agentId: apiConfig.agentId,
+          harness: harnessProvider,
+          model,
+          exitCode: result.exitCode,
+          failureReason
+        });
+        await credentialReport;
+        let bridgeDiagnostics;
+        if (result.exitCode !== 0 && harnessProvider === "claude" && workingDir) {
+          bridgeDiagnostics = await getBridgeFailureDiagnostics(workingDir);
+          if (bridgeDiagnostics?.artifactPath && result.sessionId) {
+            console.log(`[${role}] Bridge failure artifact found: ${bridgeDiagnostics.artifactPath}`);
+            updateHarnessVariantMeta(apiConfig.apiUrl, apiConfig.apiKey, taskId, result.sessionId, {
+              failureArtifact: bridgeDiagnostics.artifactPath
+            }).catch((err) => console.warn(`[runner] Failed to update harness variant meta: ${err}`));
+          }
+        }
+        const bridgeFailureDiagnostics = bridgeDiagnostics?.paneTail != null ? `Claude bridge final tmux pane tail (${bridgeDiagnostics.artifactPath}):
+${bridgeDiagnostics.paneTail}` : undefined;
+        await reportCredentialOutcomeThenFinish({
+          apiUrl: apiConfig.apiUrl,
+          apiKey: apiConfig.apiKey,
+          credentialInfo,
+          result,
+          failureReason,
+          model,
+          codexCreditsExhaustedCooldownMs: state.codexCreditsExhaustedCooldownMs,
+          modelWindowBlocks: state.modelWindowBlocks
+        }, () => ensureTaskFinished(apiConfig, role, taskId, result.exitCode, failureReason, resolveProviderOutput(result, assistantText), harnessProvider, bridgeFailureDiagnostics, finalProgress?.value, deadline));
+        const sessionTriggerSurface = workerTriggerSurface(triggerSurface);
+        const sessionActor = { userId: requestedByUserId ?? null };
+        telemetry.taskEvent("session_completed", {
           taskId,
           trigger_surface: sessionTriggerSurface,
-          errorCategory: normalizeSessionErrorCategory(result.errorCategory),
+          agentId: apiConfig.agentId,
           provider: result.cost?.provider ?? harnessProvider,
           model: result.cost?.model ?? model ?? "unknown",
-          durationMs: result.cost?.durationMs ?? durationMs,
-          wasRateLimited: result.rateLimitResetAt != null
+          harnessVariant,
+          harnessVersion: typeof harnessVariantMeta?.version === "string" || typeof harnessVariantMeta?.version === "number" ? String(harnessVariantMeta.version) : undefined,
+          exitCode: result.exitCode,
+          isError: result.exitCode !== 0,
+          durationMs
         }, sessionActor);
+        const sessionTelemetryEvent = resolveSessionTelemetryEvent(result);
+        if (sessionTelemetryEvent) {
+          telemetry.session(sessionTelemetryEvent, {
+            agentId: apiConfig.agentId,
+            taskId,
+            trigger_surface: sessionTriggerSurface,
+            errorCategory: normalizeSessionErrorCategory(result.errorCategory),
+            provider: result.cost?.provider ?? harnessProvider,
+            model: result.cost?.model ?? model ?? "unknown",
+            durationMs: result.cost?.durationMs ?? durationMs,
+            wasRateLimited: result.rateLimitResetAt != null
+          }, sessionActor);
+        }
+        ensure({
+          id: "worker_process_finished",
+          flow: "task",
+          runId: taskId,
+          depIds: ["worker_process_spawned"],
+          data: {
+            taskId,
+            agentId: apiConfig.agentId,
+            role,
+            exitCode: result.exitCode,
+            success: result.exitCode === 0,
+            failureReason
+          },
+          validator: (data) => data.exitCode === 0,
+          filter: ({}, ctx) => ctx.deps.length > 0,
+          conditions: [{ timeout_ms: 3600000 }]
+        });
+        if (cursorUpdates && cursorUpdates.length > 0 && result.exitCode === 0) {
+          try {
+            const headers = { "Content-Type": "application/json" };
+            if (apiConfig.apiKey)
+              headers.Authorization = `Bearer ${apiConfig.apiKey}`;
+            await fetch(`${apiConfig.apiUrl}/api/channel-activity/commit-cursors`, {
+              method: "POST",
+              headers,
+              body: JSON.stringify({ cursorUpdates })
+            });
+            console.log(`[${role}] Committed ${cursorUpdates.length} channel activity cursor(s) for task ${taskId.slice(0, 8)}`);
+          } catch (err) {
+            console.warn(`[${role}] Failed to commit channel activity cursors: ${err}`);
+          }
+        }
       }
-      state.tasksProcessed += 1;
-      ensure({
-        id: "worker_process_finished",
-        flow: "task",
-        runId: taskId,
-        depIds: ["worker_process_spawned"],
-        data: {
-          taskId,
-          agentId: apiConfig.agentId,
-          role,
-          exitCode: result.exitCode,
-          success: result.exitCode === 0,
-          failureReason
-        },
-        validator: (data) => data.exitCode === 0,
-        filter: ({}, ctx) => ctx.deps.length > 0,
-        conditions: [{ timeout_ms: 3600000 }]
-      });
-      if (cursorUpdates && cursorUpdates.length > 0 && result.exitCode === 0) {
-        try {
-          const headers = { "Content-Type": "application/json" };
-          if (apiConfig.apiKey)
-            headers.Authorization = `Bearer ${apiConfig.apiKey}`;
-          await fetch(`${apiConfig.apiUrl}/api/channel-activity/commit-cursors`, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({ cursorUpdates })
-          });
-          console.log(`[${role}] Committed ${cursorUpdates.length} channel activity cursor(s) for task ${taskId.slice(0, 8)}`);
-        } catch (err) {
-          console.warn(`[${role}] Failed to commit channel activity cursors: ${err}`);
+    } finally {
+      try {
+        await costSave;
+        if (apiConfig)
+          await removeActiveSession(apiConfig, taskId);
+      } finally {
+        state.activeTasks.delete(taskId);
+        if (triggerType === "task_assigned" || triggerType === "task_resumed") {
+          state.tasksProcessed += 1;
         }
       }
     }
+  }));
+  for (const completion of completions) {
+    if (completion.status === "rejected")
+      console.warn(scrubSecrets(`[${role}] Task completion failed: ${completion.reason}`));
   }
   const localCompleted = completedTasks.filter((t) => t.hasLocalEnvironment);
   if (apiConfig && localCompleted.length > 0) {
@@ -4744,10 +5166,12 @@ ${additionalSystemPrompt}` : basePrompt;
   const defaultMaxTasks = isLead ? 2 : 1;
   const templateMaxTasks = cachedTemplate?.config.agentDefaults?.maxTasks;
   const maxConcurrent = resolveMaxConcurrent(process.env, templateMaxTasks, defaultMaxTasks);
-  console.log(`[${role}] Mode: runner-level polling`);
+  const exitAfterTasks = resolveExitAfterTasks();
+  console.log(`[${role}] Mode: runner-level delivery`);
   console.log(`[${role}] Max concurrent tasks: ${maxConcurrent}`);
   const state = {
     activeTasks: new Map,
+    deliveryMode: "poll",
     maxConcurrent,
     startedAt: Date.now(),
     tasksProcessed: 0,
@@ -4767,10 +5191,38 @@ ${additionalSystemPrompt}` : basePrompt;
   const HARNESS_RECONCILE_INTERVAL_MS = 1e4;
   let lastServerCapsRefreshAt = 0;
   const SERVER_CAPS_REFRESH_INTERVAL_MS = 300000;
-  const runtimeInstanceId = crypto.randomUUID();
+  const runtimeInstanceId = process.env.SWARM_RUNTIME_INSTANCE_ID || crypto.randomUUID();
   process.env.SWARM_RUNTIME_INSTANCE_ID = runtimeInstanceId;
   const apiConfig = { apiUrl, apiKey, agentId, runtimeInstanceId };
-  setupShutdownHandlers(role, apiConfig, () => state);
+  const pushDelivery = new RunnerPushDelivery(new WorkerRealtimeClient({ apiUrl, apiKey, agentId, runtimeInstanceId }));
+  let shuttingDown = false;
+  let lastPushPingAt = 0;
+  let pushPingTimer;
+  let lastLoggedDeliveryMode;
+  const applyDeliveryMode = (registration) => {
+    const mode = updateWorkerDeliveryMode(lastLoggedDeliveryMode, registration, isLead, process.env);
+    lastLoggedDeliveryMode = mode;
+    if (mode !== state.deliveryMode) {
+      state.deliveryMode = mode;
+      pushDelivery.wakeWork();
+      clearInterval(pushPingTimer);
+      if (mode === "push") {
+        pushDelivery.client.start();
+        lastPushPingAt = Date.now();
+        pushPingTimer = setInterval(() => {
+          lastPushPingAt = Date.now();
+          pingServer(apiConfig, role).then((draining) => applyApiDrainSignal(state, role, draining));
+        }, 30000);
+        pushPingTimer.unref();
+      } else
+        pushDelivery.client.stop();
+    }
+  };
+  const shutdown = setupShutdownHandlers(role, apiConfig, () => state, () => {
+    shuttingDown = true;
+    clearInterval(pushPingTimer);
+    pushDelivery.client.stop();
+  });
   const agentName = process.env.AGENT_NAME || cachedTemplate?.config.displayName || `${role}-${agentId.slice(0, 8)}`;
   const applySwarmConfigDrift = async (freshEnv, resolvedProvider, nextScriptsOnly) => {
     let agentVisibleChanged = false;
@@ -4847,6 +5299,7 @@ ${additionalSystemPrompt}` : basePrompt;
     });
     lastServerCapsRefreshAt = Date.now();
     await applyServerCapabilities(reg.serverCapabilities);
+    applyDeliveryMode(reg);
   };
   const reregisterAgent = async () => {
     try {
@@ -4870,6 +5323,7 @@ ${additionalSystemPrompt}` : basePrompt;
     }), { label: role });
     lastServerCapsRefreshAt = Date.now();
     await applyServerCapabilities(reg.serverCapabilities);
+    applyDeliveryMode(reg);
     console.log(`[${role}] Registered as "${agentName}" (ID: ${agentId})`);
   } catch (error) {
     console.error(`[${role}] Failed to register: ${error}`);
@@ -5336,13 +5790,21 @@ ${additionalSystemPrompt}` : basePrompt;
   let lastOrphanRecoveryAt = 0;
   const ORPHAN_RECOVERY_INTERVAL_MS = 60000;
   const taskReconcileIntervalMs = resolveTaskReconcileIntervalMs();
-  while (true) {
-    applyApiDrainSignal(state, role, await pingServer(apiConfig, role));
+  while (shouldRunDeliveryLoop(state.deliveryMode, shuttingDown)) {
+    const deliveryChecks = pushDelivery.checks(state.deliveryMode ?? "poll");
+    if (state.deliveryMode !== "push") {
+      applyApiDrainSignal(state, role, await pingServer(apiConfig, role));
+    }
     if (state.apiDraining) {
       await handOffTasksForApiDrain(state, role, apiConfig);
     }
+    const activeBeforeCompletion = state.activeTasks.size;
     await checkCompletedProcesses(state, role, apiConfig, cancelledSignaled);
-    if (Date.now() - lastHarnessReconcileAt > HARNESS_RECONCILE_INTERVAL_MS) {
+    if (state.activeTasks.size < activeBeforeCompletion)
+      pushDelivery.wakeWork();
+    if (await exitAfterTasksIfFinished(state, exitAfterTasks, shutdown))
+      return;
+    if (deliveryChecks.config && (deliveryChecks.push || Date.now() - lastHarnessReconcileAt > HARNESS_RECONCILE_INTERVAL_MS)) {
       lastHarnessReconcileAt = Date.now();
       try {
         const {
@@ -5380,20 +5842,33 @@ ${additionalSystemPrompt}` : basePrompt;
         cancelledSignaled,
         isCancelled: (taskId) => fetchTaskCancelled(apiUrl, apiKey, agentId, taskId),
         fetchStatus: (taskId) => fetchTaskStatus(apiUrl, apiKey, taskId),
-        intervalMs: taskReconcileIntervalMs
+        intervalMs: taskReconcileIntervalMs,
+        ...taskReconciliation(deliveryChecks)
       });
     }
     if (steeringDispatchState && state.activeTasks.size > 0) {
       const dispatchState = steeringDispatchState;
       for (const [taskId, task] of state.activeTasks) {
-        scheduleSteeringDispatch(apiConfig, taskId, task.session, dispatchState, (error) => {
+        pushDelivery.dispatchSteering(deliveryChecks, taskId, () => scheduleSteeringDispatch(apiConfig, taskId, task.session, dispatchState, (error) => {
           console.warn(`[${role}] Steering dispatch failed for task ${taskId.slice(0, 8)} (non-fatal): ${scrubSecrets(error.message)}`);
-        });
+        }));
       }
     }
-    if (state.apiDraining) {
-      await Bun.sleep(1000);
-    } else if (state.activeTasks.size < state.maxConcurrent) {
+    const schedule = pushDelivery.schedule({
+      mode: state.deliveryMode ?? "poll",
+      push: deliveryChecks.push,
+      activeCount: state.activeTasks.size,
+      maxConcurrent: exitAfterTasks === null ? state.maxConcurrent : Math.min(state.maxConcurrent, Math.max(0, exitAfterTasks - state.tasksProcessed)),
+      draining: state.apiDraining,
+      lastPushPingAt,
+      pollInterval: PollIntervalMs
+    });
+    if (!schedule.poll) {
+      if (!state.apiDraining && state.activeTasks.size >= state.maxConcurrent) {
+        console.log(`[${role}] At capacity (${state.activeTasks.size}/${state.maxConcurrent}), waiting for completion...`);
+      }
+      await pushDelivery.waitForSchedule(schedule);
+    } else {
       if (Date.now() - lastOrphanRecoveryAt > ORPHAN_RECOVERY_INTERVAL_MS) {
         lastOrphanRecoveryAt = Date.now();
         const recoveredOrphans = await recoverOrphanedInProgressTasks(apiConfig);
@@ -5403,16 +5878,18 @@ ${additionalSystemPrompt}` : basePrompt;
       }
       console.log(`[${role}] Polling for triggers (${state.activeTasks.size}/${state.maxConcurrent} active)...`);
       const effectiveTimeout = state.activeTasks.size > 0 ? 5000 : PollTimeoutMs;
-      const trigger = await pollForTrigger({
+      const { trigger, failed } = await pushDelivery.poll(schedule.singlePoll, (onPollFailure) => pollForTrigger({
         apiUrl,
         apiKey,
         agentId,
         pollInterval: PollIntervalMs,
         runtimeInstanceId,
         pollTimeout: effectiveTimeout,
+        singlePoll: schedule.singlePoll,
+        onPollFailure,
         harnessProvider: state.harnessProvider,
         onApiDrainSignal: (draining) => applyApiDrainSignal(state, role, draining)
-      });
+      }));
       if (trigger) {
         if (trigger.type === "budget_refused") {
           consecutiveBudgetRefusals++;
@@ -5691,10 +6168,9 @@ Note: The task requested working directory "${taskDir}" but it does not exist. F
           }).catch((err) => console.error("[runner] active-session registration failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
         }
         console.log(`[${role}] Started task ${runningTask.taskId.slice(0, 8)} (${state.activeTasks.size}/${state.maxConcurrent} active, trigger: ${trigger.type})`);
+      } else if (schedule.singlePoll) {
+        await pushDelivery.waitForSchedule(schedule, failed, PollIntervalMs);
       }
-    } else {
-      console.log(`[${role}] At capacity (${state.activeTasks.size}/${state.maxConcurrent}), waiting for completion...`);
-      await Bun.sleep(1000);
     }
   }
 }