@playdrop/playdrop-cli 0.12.7 → 0.12.8

package/dist/commands/worker.js

@@ -16,9 +16,11 @@ exports.appendWorkerTranscriptChunks = appendWorkerTranscriptChunks;
 exports.readTaskNextStepsFile = readTaskNextStepsFile;
 exports.assertTaskUploadResultMatchesContext = assertTaskUploadResultMatchesContext;
 exports.stageAssignmentWorkspaceFiles = stageAssignmentWorkspaceFiles;
-exports.resolvePlaydropPluginRoot = resolvePlaydropPluginRoot;
 exports.stagePlaydropPluginReferences = stagePlaydropPluginReferences;
+exports.stageCodexTaskSkills = stageCodexTaskSkills;
+exports.assertAssignmentPluginBundleExtractionBounds = assertAssignmentPluginBundleExtractionBounds;
 exports.stageAssignmentPluginBundle = stageAssignmentPluginBundle;
+exports.resolveDevPluginWorkingTree = resolveDevPluginWorkingTree;
 exports.discoverWorkerProjectRoot = discoverWorkerProjectRoot;
 exports.readWorkerTaskState = readWorkerTaskState;
 exports.buildWorkerHealthAlertText = buildWorkerHealthAlertText;
@@ -28,6 +30,7 @@ exports.isWorkerTransientNetworkError = isWorkerTransientNetworkError;
 exports.classifyWorkerHeartbeatError = classifyWorkerHeartbeatError;
 exports.assertWorkerClaimErrorRetryable = assertWorkerClaimErrorRetryable;
 exports.resolvePlaydropAssetRequirementFromText = resolvePlaydropAssetRequirementFromText;
+exports.resolvePlaywrightBrowsersPathFromExecutable = resolvePlaywrightBrowsersPathFromExecutable;
 exports.loadWorkerEnvFile = loadWorkerEnvFile;
 exports.buildWorkerCapabilities = buildWorkerCapabilities;
 exports.buildWorkerClaimBody = buildWorkerClaimBody;
@@ -36,12 +39,22 @@ exports.extractZipArchive = extractZipArchive;
 exports.readWorkerProjectVersion = readWorkerProjectVersion;
 exports.buildCataloguePreviewPayload = buildCataloguePreviewPayload;
 exports.assertWorkerProjectVersionBumped = assertWorkerProjectVersionBumped;
+exports.prepareCodexRunHomes = prepareCodexRunHomes;
+exports.prepareClaudeRunConfig = prepareClaudeRunConfig;
+exports.removeAgentRunCredentials = removeAgentRunCredentials;
+exports.removeStaleAgentRunCredentials = removeStaleAgentRunCredentials;
 exports.buildAgentFailureCode = buildAgentFailureCode;
 exports.describeAgentFailureForEvent = describeAgentFailureForEvent;
 exports.createLocalPlaydropShim = createLocalPlaydropShim;
 exports.parseCodexModelCatalog = parseCodexModelCatalog;
 exports.parseClaudeModelCatalog = parseClaudeModelCatalog;
 exports.buildWorkerSetupActions = buildWorkerSetupActions;
+exports.resolveWorkerStateDir = resolveWorkerStateDir;
+exports.resolveWorkerSupervisorLockFile = resolveWorkerSupervisorLockFile;
+exports.parseLinuxProcessStartIdentity = parseLinuxProcessStartIdentity;
+exports.removeStaleWorkerSupervisorLockIfUnchanged = removeStaleWorkerSupervisorLockIfUnchanged;
+exports.acquireWorkerSupervisorLock = acquireWorkerSupervisorLock;
+exports.releaseWorkerSupervisorLock = releaseWorkerSupervisorLock;
 exports.readActivePersonalWorkerRuntimeState = readActivePersonalWorkerRuntimeState;
 exports.parseLaunchAgentProgramArguments = parseLaunchAgentProgramArguments;
 exports.assertLaunchAgentPlistCompatible = assertLaunchAgentPlistCompatible;
@@ -78,7 +91,6 @@ const config_1 = require("../config");
 const messages_1 = require("../messages");
 const output_1 = require("../output");
 const shellProbe_1 = require("../shellProbe");
-const agents_1 = require("./agents");
 const review_1 = require("./review");
 const upload_1 = require("./upload");
 const runtime_1 = require("./worker/runtime");
@@ -117,9 +129,14 @@ const WORKER_SUPPORTED_KINDS = ['NEW_GAME', 'REMIX_GAME', 'GAME_UPDATE', 'GAME_R
 const PLAYDROP_PLUGIN_MANIFEST_REQUIRED_STARTUP_KINDS = WORKER_SUPPORTED_KINDS;
 const requireFromWorker = (0, node_module_1.createRequire)(__filename);
 const STAGED_PLAYDROP_PLUGIN_ROOT = '.playdrop/plugin';
+const STAGED_CODEX_SKILL_ROOT = '.agents/skills';
 const PLAYDROP_PLUGIN_STAGING_MANIFEST_PATH = 'playdrop-worker-staging.json';
 const ASSIGNMENT_PLUGIN_BUNDLE_MAX_FILES = 1000;
 const ASSIGNMENT_PLUGIN_BUNDLE_MAX_UNCOMPRESSED_BYTES = 20 * 1024 * 1024;
+const ZIP_CENTRAL_DIRECTORY_SIGNATURE = 0x02014b50;
+const ZIP_END_OF_CENTRAL_DIRECTORY_SIGNATURE = 0x06054b50;
+const ZIP_END_OF_CENTRAL_DIRECTORY_MIN_BYTES = 22;
+const ZIP_MAX_COMMENT_BYTES = 0xffff;
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 exports.WORKER_SESSION_EXPIRED_MESSAGE = 'worker session expired: run "playdrop auth login" and start the worker again';
 const WORKER_CONTEXT_ALLOWED_COMMANDS = [
@@ -335,6 +352,9 @@ function resolveWorkerClaimTaskAssignment(claim) {
     const pluginBundle = assignment.pluginBundle && typeof assignment.pluginBundle === 'object' && !Array.isArray(assignment.pluginBundle)
         ? assignment.pluginBundle
         : null;
+    if (!pluginBundle) {
+        throw new Error('agent_task_assignment_plugin_bundle_missing');
+    }
     return {
         taskId,
         taskToken,
@@ -383,7 +403,7 @@ function resolveWorkerHomeDir() {
     return node_path_1.default.join(node_os_1.default.homedir(), 'PlayDropWorker');
 }
 function workerStateFilePath() {
-    return node_path_1.default.join(resolveWorkerHomeDir(), 'state', 'current-task.json');
+    return node_path_1.default.join(resolveWorkerStateDir(), 'current-task.json');
 }
 function workerTaskWorkspaceDirFromAssignment(assignment) {
     return node_path_1.default.join(resolveWorkerHomeDir(), 'tasks', assignment.workspace.folderName);
@@ -828,23 +848,6 @@ async function stageAssignmentWorkspaceFiles(workspaceDir, files) {
         await (0, promises_1.writeFile)(destination, Buffer.from(file.contentBase64, 'base64'));
     }
 }
-function candidateVersionDirectories(root) {
-    if (!(0, node_fs_1.existsSync)(root)) {
-        return [];
-    }
-    return (0, node_fs_1.readdirSync)(root)
-        .filter((name) => name.trim().length > 0)
-        .sort((left, right) => right.localeCompare(left, undefined, { numeric: true }))
-        .map((name) => node_path_1.default.join(root, name));
-}
-function isDirectory(candidatePath) {
-    try {
-        return (0, node_fs_1.statSync)(candidatePath).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
 function isFile(candidatePath) {
     try {
         return (0, node_fs_1.statSync)(candidatePath).isFile();
@@ -853,13 +856,6 @@ function isFile(candidatePath) {
         return false;
     }
 }
-function looksLikePlaydropPluginRoot(pluginRoot) {
-    return isDirectory(pluginRoot) && ((0, node_fs_1.existsSync)(node_path_1.default.join(pluginRoot, PLAYDROP_PLUGIN_STAGING_MANIFEST_PATH))
-        || isDirectory(node_path_1.default.join(pluginRoot, 'skills'))
-        || isFile(node_path_1.default.join(pluginRoot, '.codex-plugin', 'plugin.json'))
-        || isFile(node_path_1.default.join(pluginRoot, '.claude-plugin', 'plugin.json'))
-        || isFile(node_path_1.default.join(pluginRoot, '.cursor-plugin', 'plugin.json')));
-}
 function normalizePlaydropPluginManifestPath(input) {
     if (typeof input.value !== 'string' || input.value.trim().length <= 0) {
         throw new Error(`playdrop_plugin_staging_manifest_incomplete:${input.kind}: file paths must be non-empty strings in ${input.manifestPath}`);
@@ -958,45 +954,6 @@ function readPlaydropPluginStagingManifest(pluginRoot) {
         taskFiles: taskFiles,
     };
 }
-function resolvePlaydropPluginRoot(input = {}) {
-    const homeDir = input.homeDir ?? node_os_1.default.homedir();
-    const env = input.env ?? node_process_1.default.env;
-    const explicitRoot = env.PLAYDROP_WORKER_PLAYDROP_PLUGIN_DIR?.trim();
-    if (explicitRoot) {
-        const resolved = node_path_1.default.resolve(explicitRoot);
-        readPlaydropPluginStagingManifest(resolved);
-        return resolved;
-    }
-    const candidates = [
-        node_path_1.default.join(homeDir, 'Documents', 'playdrop-plugin'),
-        node_path_1.default.join(homeDir, '.claude', 'plugins', 'marketplaces', 'playdrop'),
-        ...candidateVersionDirectories(node_path_1.default.join(homeDir, '.claude', 'plugins', 'cache', 'playdrop', 'playdrop')),
-        node_path_1.default.join(homeDir, '.codex', 'plugins', 'playdrop'),
-        node_path_1.default.join(homeDir, '.codex', 'plugins', 'cache', 'playdrop', 'playdrop'),
-        ...candidateVersionDirectories(node_path_1.default.join(homeDir, '.codex', 'plugins', 'cache', 'playdrop', 'playdrop')),
-        ...candidateVersionDirectories(node_path_1.default.join(homeDir, '.codex', 'plugins', 'cache', 'olivier-local-plugins', 'playdrop')),
-    ];
-    let firstCandidateError = null;
-    for (const candidate of candidates) {
-        if (!looksLikePlaydropPluginRoot(candidate)) {
-            continue;
-        }
-        try {
-            readPlaydropPluginStagingManifest(candidate);
-            return candidate;
-        }
-        catch (error) {
-            firstCandidateError ?? (firstCandidateError = error);
-            continue;
-        }
-    }
-    if (firstCandidateError) {
-        throw firstCandidateError instanceof Error
-            ? firstCandidateError
-            : new Error(String(firstCandidateError));
-    }
-    throw new Error(`playdrop_plugin_staging_manifest_missing: install or update the PlayDrop plugin so ${PLAYDROP_PLUGIN_STAGING_MANIFEST_PATH} is available.`);
-}
 async function stagePlaydropPluginReferences(input) {
     const pluginRoot = node_path_1.default.resolve(input.pluginRoot);
     if (!WORKER_SUPPORTED_KINDS.includes(input.kind)) {
@@ -1017,6 +974,93 @@ async function stagePlaydropPluginReferences(input) {
     }
     return staged;
 }
+async function stageCodexTaskSkills(input) {
+    const skillRoot = node_path_1.default.join(input.workspaceDir, STAGED_CODEX_SKILL_ROOT);
+    await (0, promises_1.rm)(skillRoot, { recursive: true, force: true });
+    const stagedSkills = [];
+    for (const stagedPluginPath of input.stagedPluginPaths) {
+        const normalized = stagedPluginPath.replace(/\\/g, '/');
+        const match = /^\.playdrop\/plugin\/skills\/([^/]+)\/SKILL\.md$/.exec(normalized);
+        if (!match?.[1]) {
+            continue;
+        }
+        const source = resolveWorkspaceFileDestination(input.workspaceDir, normalized);
+        const destinationRelativePath = `${STAGED_CODEX_SKILL_ROOT}/${match[1]}/SKILL.md`;
+        const destination = resolveWorkspaceFileDestination(input.workspaceDir, destinationRelativePath);
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(destination), { recursive: true });
+        await (0, promises_1.copyFile)(source, destination);
+        stagedSkills.push(destinationRelativePath);
+    }
+    if (stagedSkills.length <= 0) {
+        throw new Error('agent_task_codex_skills_missing');
+    }
+    return stagedSkills.sort();
+}
+function assertAssignmentPluginBundleExtractionBounds(buffer) {
+    if (buffer.length < ZIP_END_OF_CENTRAL_DIRECTORY_MIN_BYTES) {
+        throw new Error('agent_task_plugin_bundle_invalid_zip');
+    }
+    const earliestEndRecordOffset = Math.max(0, buffer.length - ZIP_END_OF_CENTRAL_DIRECTORY_MIN_BYTES - ZIP_MAX_COMMENT_BYTES);
+    let endRecordOffset = -1;
+    for (let offset = buffer.length - ZIP_END_OF_CENTRAL_DIRECTORY_MIN_BYTES; offset >= earliestEndRecordOffset; offset -= 1) {
+        if (buffer.readUInt32LE(offset) === ZIP_END_OF_CENTRAL_DIRECTORY_SIGNATURE
+            && offset + ZIP_END_OF_CENTRAL_DIRECTORY_MIN_BYTES + buffer.readUInt16LE(offset + 20) === buffer.length) {
+            endRecordOffset = offset;
+            break;
+        }
+    }
+    if (endRecordOffset < 0) {
+        throw new Error('agent_task_plugin_bundle_invalid_zip');
+    }
+    const diskNumber = buffer.readUInt16LE(endRecordOffset + 4);
+    const centralDirectoryDisk = buffer.readUInt16LE(endRecordOffset + 6);
+    const diskEntryCount = buffer.readUInt16LE(endRecordOffset + 8);
+    const entryCount = buffer.readUInt16LE(endRecordOffset + 10);
+    const centralDirectorySize = buffer.readUInt32LE(endRecordOffset + 12);
+    const centralDirectoryOffset = buffer.readUInt32LE(endRecordOffset + 16);
+    if (diskNumber !== 0
+        || centralDirectoryDisk !== 0
+        || diskEntryCount !== entryCount
+        || entryCount === 0xffff
+        || centralDirectorySize === 0xffffffff
+        || centralDirectoryOffset === 0xffffffff) {
+        throw new Error('agent_task_plugin_bundle_unsupported_zip');
+    }
+    if (entryCount > ASSIGNMENT_PLUGIN_BUNDLE_MAX_FILES) {
+        throw new Error(`agent_task_plugin_bundle_too_many_files:${entryCount}>${ASSIGNMENT_PLUGIN_BUNDLE_MAX_FILES}`);
+    }
+    if (centralDirectoryOffset + centralDirectorySize !== endRecordOffset) {
+        throw new Error('agent_task_plugin_bundle_invalid_zip');
+    }
+    let cursor = centralDirectoryOffset;
+    let uncompressedBytes = 0;
+    for (let entryIndex = 0; entryIndex < entryCount; entryIndex += 1) {
+        if (cursor + 46 > endRecordOffset
+            || buffer.readUInt32LE(cursor) !== ZIP_CENTRAL_DIRECTORY_SIGNATURE) {
+            throw new Error('agent_task_plugin_bundle_invalid_zip');
+        }
+        const compressedSize = buffer.readUInt32LE(cursor + 20);
+        const uncompressedSize = buffer.readUInt32LE(cursor + 24);
+        const fileNameLength = buffer.readUInt16LE(cursor + 28);
+        const extraFieldLength = buffer.readUInt16LE(cursor + 30);
+        const fileCommentLength = buffer.readUInt16LE(cursor + 32);
+        if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff) {
+            throw new Error('agent_task_plugin_bundle_unsupported_zip');
+        }
+        const nextCursor = cursor + 46 + fileNameLength + extraFieldLength + fileCommentLength;
+        if (nextCursor > endRecordOffset) {
+            throw new Error('agent_task_plugin_bundle_invalid_zip');
+        }
+        uncompressedBytes += uncompressedSize;
+        if (uncompressedBytes > ASSIGNMENT_PLUGIN_BUNDLE_MAX_UNCOMPRESSED_BYTES) {
+            throw new Error(`agent_task_plugin_bundle_too_large:${uncompressedBytes}>${ASSIGNMENT_PLUGIN_BUNDLE_MAX_UNCOMPRESSED_BYTES}`);
+        }
+        cursor = nextCursor;
+    }
+    if (cursor !== endRecordOffset) {
+        throw new Error('agent_task_plugin_bundle_invalid_zip');
+    }
+}
 async function stageAssignmentPluginBundle(input) {
     const sha256 = typeof input.pluginBundle.sha256 === 'string' ? input.pluginBundle.sha256.trim() : '';
     const contentBase64 = typeof input.pluginBundle.contentBase64 === 'string' ? input.pluginBundle.contentBase64.trim() : '';
@@ -1031,6 +1075,7 @@ async function stageAssignmentPluginBundle(input) {
     if (actualSha !== sha256) {
         throw new Error('agent_task_plugin_bundle_sha_mismatch');
     }
+    assertAssignmentPluginBundleExtractionBounds(buffer);
     const pluginRoot = node_path_1.default.join(input.workspaceDir, '.playdrop', 'task-plugin');
     await (0, promises_1.rm)(pluginRoot, { recursive: true, force: true });
     await (0, promises_1.mkdir)(pluginRoot, { recursive: true });
@@ -1065,6 +1110,23 @@ async function stageAssignmentPluginBundle(input) {
     readPlaydropPluginStagingManifest(pluginRoot);
     return pluginRoot;
 }
+function resolveDevPluginWorkingTree(input) {
+    const workingTree = input.workingTree?.trim();
+    if (!workingTree) {
+        return null;
+    }
+    const nodeEnv = input.nodeEnv?.trim().toLowerCase() ?? '';
+    const env = input.env.trim().toLowerCase();
+    if (nodeEnv === 'production' || env === 'prod' || env === 'production') {
+        throw new Error(`worker_dev_plugin_working_tree_refused_in_production:${input.env}:${input.nodeEnv ?? ''}`);
+    }
+    if (env !== 'dev') {
+        throw new Error(`worker_dev_plugin_working_tree_requires_dev_environment:${input.env}`);
+    }
+    const resolved = node_path_1.default.resolve(workingTree);
+    readPlaydropPluginStagingManifest(resolved);
+    return resolved;
+}
 // A PlayDrop project root is the topmost directory holding a catalogue.json,
 // the same marker "playdrop project publish" resolves its target from. Nested
 // catalogue.json files belong to the root above them, so the walk stops at the
@@ -1335,6 +1397,29 @@ function probePlaywrightChromium() {
     }
     return { version, chromiumInstalled: true, executablePath };
 }
+function resolvePlaywrightBrowsersPathFromExecutable(executablePath) {
+    let current = node_path_1.default.resolve(executablePath);
+    while (true) {
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current) {
+            throw new Error(`worker_playwright_cache_root_unresolved:${executablePath}`);
+        }
+        if (/^chromium-\d+$/.test(node_path_1.default.basename(parent))) {
+            return node_path_1.default.dirname(parent);
+        }
+        current = parent;
+    }
+}
+function resolveWorkerPlaywrightBrowsersPath() {
+    let playwrightCore;
+    try {
+        playwrightCore = requireFromWorker('playwright-core');
+    }
+    catch {
+        throw new Error('worker_preflight_playwright_missing: install Playwright before starting the worker.');
+    }
+    return resolvePlaywrightBrowsersPathFromExecutable(playwrightCore.chromium.executablePath());
+}
 function normalizeDiscoveredModels(agent, models) {
     return Array.from(new Set(models.map((model) => (0, types_1.normalizeAgentTaskModel)(agent, model)).filter(Boolean)));
 }
@@ -1785,7 +1870,159 @@ function resolveClaudeRuntimeModel(model) {
     }
     return model;
 }
+async function prepareCodexRunHomes(input) {
+    const runRoot = node_path_1.default.join(input.workspaceDir, '.playdrop', 'codex-run');
+    const homeDir = node_path_1.default.join(runRoot, 'home');
+    const codexHomeDir = node_path_1.default.join(runRoot, 'codex-home');
+    await (0, promises_1.rm)(runRoot, { recursive: true, force: true });
+    await (0, promises_1.mkdir)(runRoot, { recursive: true, mode: 0o700 });
+    await (0, promises_1.chmod)(runRoot, 0o700);
+    await (0, promises_1.mkdir)(homeDir, { mode: 0o700 });
+    await (0, promises_1.mkdir)(codexHomeDir, { mode: 0o700 });
+    const sourceCodexHome = node_path_1.default.resolve(input.sourceCodexHome?.trim()
+        || node_process_1.default.env.CODEX_HOME?.trim()
+        || node_path_1.default.join(node_os_1.default.homedir(), '.codex'));
+    const sourceAuthPath = node_path_1.default.join(sourceCodexHome, 'auth.json');
+    if (!isFile(sourceAuthPath)) {
+        throw new Error(`worker_codex_auth_missing:${sourceAuthPath}`);
+    }
+    const stagedAuthPath = node_path_1.default.join(codexHomeDir, 'auth.json');
+    await (0, promises_1.copyFile)(sourceAuthPath, stagedAuthPath);
+    await (0, promises_1.chmod)(stagedAuthPath, 0o600);
+    await stageWorkerPlaydropSession({
+        homeDir,
+        workerUsername: input.workerUsername,
+        envName: input.envName,
+        playdropConfig: input.playdropConfig,
+    });
+    return { homeDir, codexHomeDir };
+}
+async function stageWorkerPlaydropSession(input) {
+    const workerUsername = input.workerUsername.trim();
+    const envName = input.envName.trim();
+    const config = input.playdropConfig ?? (0, config_1.loadConfig)();
+    const session = config.accounts?.[workerUsername]?.[envName];
+    if (!workerUsername || !envName || !session?.token?.trim()) {
+        throw new Error(`worker_playdrop_session_missing:${workerUsername || 'unknown'}:${envName || 'unknown'}`);
+    }
+    const playdropConfigDir = node_path_1.default.join(input.homeDir, '.playdrop');
+    const playdropConfigPath = node_path_1.default.join(playdropConfigDir, 'config.json');
+    await (0, promises_1.mkdir)(playdropConfigDir, { recursive: true, mode: 0o700 });
+    await (0, promises_1.chmod)(playdropConfigDir, 0o700);
+    await (0, promises_1.writeFile)(playdropConfigPath, JSON.stringify({
+        version: 2,
+        currentAccount: { username: workerUsername, env: envName },
+        accounts: {
+            [workerUsername]: {
+                [envName]: {
+                    token: session.token.trim(),
+                    updatedAt: session.updatedAt,
+                },
+            },
+        },
+    }, null, 2), { mode: 0o600 });
+    await (0, promises_1.chmod)(playdropConfigPath, 0o600);
+}
+async function prepareClaudeRunConfig(input) {
+    const runRoot = node_path_1.default.join(input.workspaceDir, '.playdrop', 'claude-run');
+    const homeDir = node_path_1.default.join(runRoot, 'home');
+    const claudeConfigDir = node_path_1.default.join(runRoot, 'config');
+    await (0, promises_1.rm)(runRoot, { recursive: true, force: true });
+    await (0, promises_1.mkdir)(runRoot, { recursive: true, mode: 0o700 });
+    await (0, promises_1.chmod)(runRoot, 0o700);
+    await (0, promises_1.mkdir)(homeDir, { mode: 0o700 });
+    await (0, promises_1.mkdir)(claudeConfigDir, { mode: 0o700 });
+    const configuredCredentialsPath = input.sourceCredentialsPath?.trim()
+        || node_process_1.default.env.PLAYDROP_WORKER_CLAUDE_CREDENTIALS_FILE?.trim();
+    const defaultCredentialsPath = node_path_1.default.join(node_os_1.default.homedir(), '.claude', '.credentials.json');
+    let rawCredentials;
+    if (configuredCredentialsPath) {
+        const sourceCredentialsPath = node_path_1.default.resolve(configuredCredentialsPath);
+        if (!isFile(sourceCredentialsPath)) {
+            throw new Error(`worker_claude_credentials_missing:${sourceCredentialsPath}`);
+        }
+        rawCredentials = (0, node_fs_1.readFileSync)(sourceCredentialsPath, 'utf8');
+    }
+    else if (isFile(defaultCredentialsPath)) {
+        rawCredentials = (0, node_fs_1.readFileSync)(defaultCredentialsPath, 'utf8');
+    }
+    else if (node_process_1.default.platform === 'darwin') {
+        try {
+            const result = await execFileAsync('security', [
+                'find-generic-password',
+                '-s',
+                'Claude Code-credentials',
+                '-w',
+            ], { maxBuffer: 1024 * 1024 });
+            rawCredentials = result.stdout;
+        }
+        catch {
+            throw new Error('worker_claude_credentials_missing:macos_keychain');
+        }
+    }
+    else {
+        throw new Error(`worker_claude_credentials_missing:${defaultCredentialsPath}`);
+    }
+    let credentials;
+    try {
+        credentials = JSON.parse(rawCredentials);
+    }
+    catch {
+        throw new Error('worker_claude_credentials_invalid_json');
+    }
+    const credentialObject = typeof credentials === 'object' && credentials !== null && !Array.isArray(credentials)
+        ? credentials
+        : null;
+    const oauthValue = credentialObject?.claudeAiOauth;
+    const claudeAiOauth = typeof oauthValue === 'object' && oauthValue !== null && !Array.isArray(oauthValue)
+        ? oauthValue
+        : null;
+    if (!claudeAiOauth
+        || typeof claudeAiOauth.accessToken !== 'string'
+        || !claudeAiOauth.accessToken.trim()
+        || typeof claudeAiOauth.refreshToken !== 'string'
+        || !claudeAiOauth.refreshToken.trim()) {
+        throw new Error('worker_claude_oauth_credentials_missing');
+    }
+    const stagedCredentialsPath = node_path_1.default.join(claudeConfigDir, '.credentials.json');
+    await (0, promises_1.writeFile)(stagedCredentialsPath, `${JSON.stringify({ claudeAiOauth })}\n`, { mode: 0o600 });
+    await (0, promises_1.chmod)(stagedCredentialsPath, 0o600);
+    await stageWorkerPlaydropSession({
+        homeDir,
+        workerUsername: input.workerUsername,
+        envName: input.envName,
+        playdropConfig: input.playdropConfig,
+    });
+    return { homeDir, claudeConfigDir };
+}
+async function removeAgentRunCredentials(workspaceDir) {
+    await Promise.all([
+        (0, promises_1.rm)(node_path_1.default.join(workspaceDir, '.playdrop', 'codex-run'), { recursive: true, force: true }),
+        (0, promises_1.rm)(node_path_1.default.join(workspaceDir, '.playdrop', 'claude-run'), { recursive: true, force: true }),
+    ]);
+}
+async function removeStaleAgentRunCredentials(workerHomeDir = resolveWorkerHomeDir()) {
+    const tasksDir = node_path_1.default.join(workerHomeDir, 'tasks');
+    let entries;
+    try {
+        entries = await (0, promises_1.readdir)(tasksDir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return;
+        }
+        throw error;
+    }
+    await Promise.all(entries
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => removeAgentRunCredentials(node_path_1.default.join(tasksDir, entry.name))));
+}
 async function runCodex(input) {
+    const { homeDir, codexHomeDir } = await prepareCodexRunHomes({
+        workspaceDir: input.workspaceDir,
+        workerUsername: input.workerUsername,
+        envName: input.envName,
+    });
     let observedCodexThreadId = null;
     let codexThreadProbe = '';
     const result = await (0, runtime_1.runLoggedProcess)({
@@ -1805,6 +2042,9 @@ async function runCodex(input) {
             envName: input.envName,
             eventDir: input.eventDir,
             devPort: input.devPort,
+            homeDir,
+            codexHomeDir,
+            playwrightBrowsersPath: resolveWorkerPlaywrightBrowsersPath(),
         }),
         stdin: input.prompt,
         timeoutMs: (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_CODEX_TIMEOUT_MS', runtime_1.DEFAULT_CODEX_TIMEOUT_MS),
@@ -1827,7 +2067,9 @@ async function runCodex(input) {
         }
         return result;
     }
-    const rolloutUsage = await (0, runtime_1.readCodexRolloutTokenUsageForThread)(observedCodexThreadId);
+    const rolloutUsage = await (0, runtime_1.readCodexRolloutTokenUsageForThread)(observedCodexThreadId, {
+        sessionsRoot: node_path_1.default.join(codexHomeDir, 'sessions'),
+    });
     if (rolloutUsage.usageParseError || rolloutUsage.totalTokens === null) {
         if (result.tokenUsage.usageParseError) {
             console.warn(`Codex rollout token usage could not be read for thread ${observedCodexThreadId}: ${rolloutUsage.usageParseError ?? 'unknown_error'}.`);
@@ -1846,6 +2088,11 @@ async function runCodex(input) {
     };
 }
 async function runClaude(input) {
+    const { homeDir, claudeConfigDir } = await prepareClaudeRunConfig({
+        workspaceDir: input.workspaceDir,
+        workerUsername: input.workerUsername,
+        envName: input.envName,
+    });
     const denyReadRoots = resolveClaudeDenyReadRoots(input.workspaceDir);
     const screenshotCollector = input.enableChrome
         ? (0, instrument_evidence_1.createWorkerInstrumentScreenshotCollector)(input.workspaceDir)
@@ -1856,7 +2103,7 @@ async function runClaude(input) {
             ...input.claudeModel,
             workspaceDir: input.workspaceDir,
             denyReadRoots,
-            pluginDir: input.playdropPluginRoot,
+            pluginDir: input.taskPluginRoot,
             chrome: input.enableChrome,
         }),
         cwd: input.workspaceDir,
@@ -1867,6 +2114,9 @@ async function runClaude(input) {
             envName: input.envName,
             eventDir: input.eventDir,
             devPort: input.devPort,
+            homeDir,
+            claudeConfigDir,
+            playwrightBrowsersPath: resolveWorkerPlaywrightBrowsersPath(),
         }),
         stdin: input.prompt,
         timeoutMs: (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_CLAUDE_TIMEOUT_MS', runtime_1.DEFAULT_CODEX_TIMEOUT_MS),
@@ -2229,12 +2479,6 @@ function probeReadyWorkerCapabilities(input) {
         maxParallelTasks: input.maxParallelTasks,
         runningTaskCount: 0,
     });
-    if (input.pluginVersion) {
-        capabilities.pluginVersion = input.pluginVersion;
-        for (const agent of capabilities.agents) {
-            agent.pluginVersion = input.pluginVersion;
-        }
-    }
     if (!capabilities.ready) {
         const reasons = Array.isArray(capabilities.degradedReasons) && capabilities.degradedReasons.length > 0
             ? capabilities.degradedReasons.join(', ')
@@ -2272,21 +2516,6 @@ function errorMessage(error) {
 function errorCode(error) {
     return errorMessage(error).split(':')[0]?.trim() || 'unknown_error';
 }
-function readPlaydropPluginVersion(pluginRoot) {
-    for (const relativePath of ['.codex-plugin/plugin.json', 'plugin.json', 'package.json']) {
-        try {
-            const parsed = JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(pluginRoot, relativePath), 'utf8'));
-            const version = typeof parsed.version === 'string' ? parsed.version.trim() : '';
-            if (version) {
-                return version;
-            }
-        }
-        catch {
-            continue;
-        }
-    }
-    return null;
-}
 function readWorkerTargetUpdateFailure() {
     const failureFile = node_process_1.default.env.PLAYDROP_WORKER_TARGET_UPDATE_FAILURE_FILE?.trim() ?? '';
     if (!failureFile || !(0, node_fs_1.existsSync)(failureFile)) {
@@ -2303,8 +2532,6 @@ function readWorkerTargetUpdateFailure() {
         writtenAt,
         targetCliVersion: typeof parsed.targetCliVersion === 'string' ? parsed.targetCliVersion : null,
         minimumCliVersion: typeof parsed.minimumCliVersion === 'string' ? parsed.minimumCliVersion : null,
-        targetPluginVersion: typeof parsed.targetPluginVersion === 'string' ? parsed.targetPluginVersion : null,
-        minimumPluginVersion: typeof parsed.minimumPluginVersion === 'string' ? parsed.minimumPluginVersion : null,
     };
 }
 function collectWorkerLocalStatus() {
@@ -2316,9 +2543,6 @@ function collectWorkerLocalStatus() {
     let cursorVersion = null;
     let npmVersion = null;
     let playwright = null;
-    let pluginRoot = null;
-    let pluginVersion = null;
-    let pluginError = null;
     let targetUpdateFailure = null;
     try {
         codexVersion = probeCodexInstallation()?.codexVersion ?? null;
@@ -2355,14 +2579,6 @@ function collectWorkerLocalStatus() {
     catch (error) {
         degradedReasons.push(errorCode(error));
     }
-    try {
-        pluginRoot = resolvePlaydropPluginRoot();
-        pluginVersion = readPlaydropPluginVersion(pluginRoot);
-    }
-    catch (error) {
-        pluginError = errorMessage(error);
-        degradedReasons.push(errorCode(error));
-    }
     try {
         targetUpdateFailure = readWorkerTargetUpdateFailure();
     }
@@ -2385,12 +2601,6 @@ function collectWorkerLocalStatus() {
             runningTaskCount: 0,
             maxParallelTasks: (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_MAX_PARALLEL_TASKS', DEFAULT_WORKER_MAX_PARALLEL_TASKS),
         });
-        if (pluginVersion) {
-            capabilities.pluginVersion = pluginVersion;
-            for (const agent of capabilities.agents) {
-                agent.pluginVersion = pluginVersion;
-            }
-        }
         if (targetUpdateFailure) {
             capabilities.targetUpdateFailure = targetUpdateFailure;
         }
@@ -2402,8 +2612,7 @@ function collectWorkerLocalStatus() {
         degradedReasons.push(errorCode(error));
     }
     const uniqueReasons = Array.from(new Set(degradedReasons));
-    const pluginReady = Boolean(pluginRoot && !pluginError);
-    const infrastructureReady = Boolean(npmVersion && playwright?.chromiumInstalled && pluginReady);
+    const infrastructureReady = Boolean(npmVersion && playwright?.chromiumInstalled);
     const ready = Boolean(capabilities?.ready) && infrastructureReady;
     return {
         ready,
@@ -2412,12 +2621,6 @@ function collectWorkerLocalStatus() {
         nodeVersion: node_process_1.default.versions.node,
         npmVersion,
         playwright,
-        plugin: {
-            ready: pluginReady,
-            root: pluginRoot,
-            version: pluginVersion,
-            error: pluginError,
-        },
         agents: capabilities?.agents ?? [],
         capabilities,
         setupActions: buildWorkerSetupActions({
@@ -2467,12 +2670,172 @@ function buildWorkerSetupActions(input) {
     }
     return actions;
 }
-function getWorkerStateDir() {
-    return node_path_1.default.join(node_os_1.default.homedir(), '.playdrop', 'worker');
+function resolveWorkerStateDir() {
+    return node_path_1.default.join(resolveWorkerHomeDir(), 'state');
+}
+function normalizeWorkerSupervisorType(value) {
+    const normalized = value?.trim().toLowerCase() || 'terminal';
+    if (normalized !== 'app' && normalized !== 'terminal') {
+        throw new Error(`worker_supervisor_type_invalid: expected app or terminal, received ${value ?? ''}.`);
+    }
+    return normalized;
+}
+function resolveWorkerSupervisorLockFile(input = {}) {
+    const workerHomeDirectory = input.workerHomeDirectory?.trim();
+    if (workerHomeDirectory && !node_path_1.default.isAbsolute(workerHomeDirectory)) {
+        throw new Error('worker_home_must_be_absolute');
+    }
+    return node_path_1.default.join(workerHomeDirectory || resolveWorkerHomeDir(), 'supervisor.lock');
+}
+function parseLinuxProcessStartIdentity(stat) {
+    const commandEnd = stat.lastIndexOf(')');
+    const fieldsAfterCommand = commandEnd === -1
+        ? []
+        : stat.slice(commandEnd + 1).trim().split(/\s+/);
+    const startTimeTicks = fieldsAfterCommand[19];
+    return /^\d+$/.test(startTimeTicks ?? '') ? `linux:${startTimeTicks}` : null;
+}
+function readProcessStartIdentity(pid) {
+    if (!Number.isInteger(pid) || pid <= 0) {
+        return null;
+    }
+    if (node_process_1.default.platform === 'linux') {
+        try {
+            return parseLinuxProcessStartIdentity((0, node_fs_1.readFileSync)(`/proc/${pid}/stat`, 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+    if (node_process_1.default.platform === 'darwin') {
+        const result = (0, shellProbe_1.runShell)(`ps -o lstart= -p ${pid}`);
+        const identity = result.output.trim().replace(/\s+/g, ' ');
+        return result.exitCode === 0 && identity ? identity : null;
+    }
+    throw new Error(`worker_supervisor_process_identity_unsupported: ${node_process_1.default.platform}`);
+}
+function readWorkerSupervisorLockOwner(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw error;
+        }
+        throw new Error(`worker_supervisor_lock_invalid: ${file} does not contain valid owner metadata.`);
+    }
+    if (parsed.schemaVersion !== 1
+        || (parsed.supervisorType !== 'app' && parsed.supervisorType !== 'terminal')
+        || !Number.isInteger(parsed.pid)
+        || (parsed.pid ?? 0) <= 0
+        || typeof parsed.processStartIdentity !== 'string'
+        || !parsed.processStartIdentity.trim()
+        || typeof parsed.workerName !== 'string'
+        || !parsed.workerName.trim()
+        || typeof parsed.createdAt !== 'string'
+        || !parsed.createdAt.trim()) {
+        throw new Error(`worker_supervisor_lock_invalid: ${file} contains incomplete owner metadata.`);
+    }
+    return parsed;
+}
+function workerSupervisorOwnerIsLive(owner) {
+    if (!isProcessAlive(owner.pid)) {
+        return false;
+    }
+    const currentIdentity = readProcessStartIdentity(owner.pid);
+    if (!currentIdentity) {
+        throw new Error(`worker_supervisor_process_identity_unavailable: cannot verify PID ${owner.pid}.`);
+    }
+    return currentIdentity === owner.processStartIdentity;
+}
+function workerSupervisorHolderDescription(owner) {
+    const supervisor = owner.supervisorType === 'app' ? 'Local Agent app' : 'terminal';
+    return `${supervisor} worker "${owner.workerName}" (PID ${owner.pid})`;
+}
+function workerSupervisorOwnersMatch(left, right) {
+    return left.schemaVersion === right.schemaVersion
+        && left.supervisorType === right.supervisorType
+        && left.pid === right.pid
+        && left.processStartIdentity === right.processStartIdentity
+        && left.workerName === right.workerName
+        && left.createdAt === right.createdAt;
+}
+function removeStaleWorkerSupervisorLockIfUnchanged(file, observedHolder) {
+    let currentHolder;
+    try {
+        currentHolder = readWorkerSupervisorLockOwner(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return false;
+        }
+        throw error;
+    }
+    if (!workerSupervisorOwnersMatch(currentHolder, observedHolder)) {
+        throw new Error(`worker_supervisor_lock_held: ${workerSupervisorHolderDescription(currentHolder)} acquired ${file} during stale-lock recovery.`);
+    }
+    if (workerSupervisorOwnerIsLive(currentHolder)) {
+        throw new Error(`worker_supervisor_lock_held: ${workerSupervisorHolderDescription(currentHolder)} became live during stale-lock recovery.`);
+    }
+    (0, node_fs_1.unlinkSync)(file);
+    return true;
+}
+function acquireWorkerSupervisorLock(input) {
+    const file = input.file ?? resolveWorkerSupervisorLockFile();
+    const processStartIdentity = readProcessStartIdentity(node_process_1.default.pid);
+    if (!processStartIdentity) {
+        throw new Error(`worker_supervisor_process_identity_unavailable: cannot identify current PID ${node_process_1.default.pid}.`);
+    }
+    const owner = {
+        schemaVersion: 1,
+        supervisorType: input.supervisorType,
+        pid: node_process_1.default.pid,
+        processStartIdentity,
+        workerName: input.workerName,
+        createdAt: new Date().toISOString(),
+    };
+    (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(file), { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(node_path_1.default.dirname(file), 0o700);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const candidate = `${file}.${node_process_1.default.pid}.${Date.now()}.${attempt}`;
+        (0, node_fs_1.writeFileSync)(candidate, JSON.stringify(owner, null, 2), { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        try {
+            (0, node_fs_1.linkSync)(candidate, file);
+            return { file, owner };
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST') {
+                throw error;
+            }
+            const holder = readWorkerSupervisorLockOwner(file);
+            if (workerSupervisorOwnerIsLive(holder)) {
+                throw new Error(`worker_supervisor_lock_held: ${workerSupervisorHolderDescription(holder)} already owns ${file}. Stop that worker before starting ${input.supervisorType === 'app' ? 'the Local Agent app worker' : 'a terminal worker'}.`);
+            }
+            removeStaleWorkerSupervisorLockIfUnchanged(file, holder);
+        }
+        finally {
+            (0, node_fs_1.rmSync)(candidate, { force: true });
+        }
+    }
+    const holder = readWorkerSupervisorLockOwner(file);
+    throw new Error(`worker_supervisor_lock_held: ${workerSupervisorHolderDescription(holder)} acquired ${file} during stale-lock recovery.`);
+}
+function releaseWorkerSupervisorLock(lock) {
+    if (!(0, node_fs_1.existsSync)(lock.file)) {
+        return;
+    }
+    const holder = readWorkerSupervisorLockOwner(lock.file);
+    if (holder.pid !== lock.owner.pid
+        || holder.processStartIdentity !== lock.owner.processStartIdentity) {
+        throw new Error(`worker_supervisor_lock_owner_changed: refusing to remove ${lock.file}.`);
+    }
+    (0, node_fs_1.unlinkSync)(lock.file);
 }
 function workerRuntimeStateFilePath(target) {
     const normalizedTarget = target === 'FIRST_PARTY' ? 'first-party' : 'personal';
-    return node_path_1.default.join(getWorkerStateDir(), `${normalizedTarget}-runtime.json`);
+    return node_path_1.default.join(resolveWorkerStateDir(), `${normalizedTarget}-runtime.json`);
 }
 function isProcessAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0) {
@@ -2515,7 +2878,7 @@ function readActivePersonalWorkerRuntimeState() {
     return parsed;
 }
 function getManagedWorkerPolicyFilePath(env, workerKey) {
-    return node_path_1.default.join(getWorkerStateDir(), `update-policy-${env}-${workerKey}.json`);
+    return node_path_1.default.join(resolveWorkerStateDir(), `update-policy-${env}-${workerKey}.json`);
 }
 function writeManagedWorkerUpdatePolicyFile(input) {
     if (!input.updatePolicy) {
@@ -2528,8 +2891,6 @@ function writeManagedWorkerUpdatePolicyFile(input) {
         writtenAt: new Date().toISOString(),
         targetCliVersion: input.updatePolicy.targetCliVersion,
         minimumCliVersion: input.updatePolicy.minimumCliVersion,
-        targetPluginVersion: input.updatePolicy.targetPluginVersion,
-        minimumPluginVersion: input.updatePolicy.minimumPluginVersion,
         requiredWrapperContractVersion: input.updatePolicy.requiredWrapperContractVersion,
     }, null, 2));
 }
@@ -2549,7 +2910,7 @@ function verifyNpmGlobalInstallPreconditions() {
     return { prefix };
 }
 function managedWorkerWrapperPath(env) {
-    return node_path_1.default.join(getWorkerStateDir(), `playdrop-worker-${env}.sh`);
+    return node_path_1.default.join(resolveWorkerStateDir(), `playdrop-worker-${env}.sh`);
 }
 function managedWorkerLaunchAgentLabel(env) {
     return `ai.playdrop.worker.${env}`;
@@ -2677,12 +3038,14 @@ function assertNoSupervisorConflicts(input) {
 async function writeManagedWorkerWrapper(input) {
     const wrapperPath = managedWorkerWrapperPath(input.env);
     const policyFile = getManagedWorkerPolicyFilePath(input.env, input.workerKey);
-    const failureFile = node_path_1.default.join(getWorkerStateDir(), `update-failure-${input.env}-${input.workerKey}.json`);
+    const failureFile = node_path_1.default.join(resolveWorkerStateDir(), `update-failure-${input.env}-${input.workerKey}.json`);
+    const workerHomeDir = resolveWorkerHomeDir();
     await (0, promises_1.mkdir)(node_path_1.default.dirname(wrapperPath), { recursive: true });
     const script = `#!/bin/sh
 set -eu
 
-export PATH="${node_path_1.default.join(node_os_1.default.homedir(), '.playdrop', 'worker', 'bin')}:${node_path_1.default.join(node_os_1.default.homedir(), '.local', 'bin')}:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+export PLAYDROP_WORKER_HOME=${shellQuote(workerHomeDir)}
+export PATH="${node_path_1.default.join(workerHomeDir, 'bin')}:${node_path_1.default.join(node_os_1.default.homedir(), '.local', 'bin')}:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 export PLAYDROP_WORKER_WRAPPER_CONTRACT_VERSION="${WORKER_WRAPPER_CONTRACT_VERSION}"
 POLICY_FILE="${policyFile}"
 FAILURE_FILE="${failureFile}"
@@ -2690,20 +3053,16 @@ export PLAYDROP_WORKER_TARGET_UPDATE_FAILURE_FILE="$FAILURE_FILE"
 BACKOFF_SECONDS="\${PLAYDROP_WORKER_UPDATE_FAILURE_BACKOFF_SECONDS:-30}"
 TARGET_CLI_VERSION=""
 MINIMUM_CLI_VERSION=""
-TARGET_PLUGIN_VERSION=""
-MINIMUM_PLUGIN_VERSION=""
 TARGET_UPDATE_FAILED=0
 
 record_failure() {
-  node - "$FAILURE_FILE" "$1" "$TARGET_CLI_VERSION" "$MINIMUM_CLI_VERSION" "$TARGET_PLUGIN_VERSION" "$MINIMUM_PLUGIN_VERSION" <<'NODE'
+  node - "$FAILURE_FILE" "$1" "$TARGET_CLI_VERSION" "$MINIMUM_CLI_VERSION" <<'NODE'
 const fs = require("fs");
 const path = require("path");
 const file = process.argv[2];
 const error = process.argv[3] || "worker_update_install_failed";
 const targetCliVersion = process.argv[4] || null;
 const minimumCliVersion = process.argv[5] || null;
-const targetPluginVersion = process.argv[6] || null;
-const minimumPluginVersion = process.argv[7] || null;
 fs.mkdirSync(path.dirname(file), { recursive: true });
 fs.writeFileSync(file, JSON.stringify({
   schemaVersion: 1,
@@ -2711,8 +3070,6 @@ fs.writeFileSync(file, JSON.stringify({
   error,
   targetCliVersion,
   minimumCliVersion,
-  targetPluginVersion,
-  minimumPluginVersion,
 }, null, 2));
 NODE
 }
@@ -2793,64 +3150,9 @@ process.exit(0);
 NODE
 }
 
-check_plugin_versions() {
-  node - "$1" "$2" <<'NODE'
-const childProcess = require("child_process");
-const requiredVersion = String(process.argv[2] || "").trim();
-const mode = String(process.argv[3] || "").trim();
-if (!requiredVersion) {
-  process.exit(0);
-}
-function parse(version) {
-  const match = version.match(/^(\\d+)\\.(\\d+)\\.(\\d+)(?:[-+][0-9A-Za-z.-]+)?$/);
-  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
-}
-function meetsMinimum(current, minimum) {
-  const parsedCurrent = parse(current);
-  const parsedMinimum = parse(minimum);
-  if (!parsedCurrent || !parsedMinimum) {
-    return current === minimum;
-  }
-  for (let index = 0; index < 3; index += 1) {
-    if (parsedCurrent[index] > parsedMinimum[index]) {
-      return true;
-    }
-    if (parsedCurrent[index] < parsedMinimum[index]) {
-      return false;
-    }
-  }
-  return true;
-}
-const result = childProcess.spawnSync("playdrop", ["agents", "status", "--json"], { encoding: "utf8" });
-if (result.status !== 0) {
-  process.exit(1);
-}
-let parsed;
-try {
-  parsed = JSON.parse(result.stdout);
-} catch {
-  process.exit(1);
-}
-const agents = Array.isArray(parsed && parsed.agents) ? parsed.agents : [];
-const checked = agents.filter((agent) => agent && agent.id !== "cursor" && agent.cli && agent.cli.installed);
-for (const agent of checked) {
-  const version = agent && agent.plugin && typeof agent.plugin.version === "string" ? agent.plugin.version.trim() : "";
-  if (mode === "target") {
-    if (version !== requiredVersion) {
-      process.exit(1);
-    }
-  } else if (!meetsMinimum(version, requiredVersion)) {
-    process.exit(1);
-  }
-}
-NODE
-}
-
 validate_policy_file
 TARGET_CLI_VERSION="$(read_policy_value targetCliVersion)"
 MINIMUM_CLI_VERSION="$(read_policy_value minimumCliVersion)"
-TARGET_PLUGIN_VERSION="$(read_policy_value targetPluginVersion)"
-MINIMUM_PLUGIN_VERSION="$(read_policy_value minimumPluginVersion)"
 
 if [ -n "$TARGET_CLI_VERSION" ]; then
   if npm install -g --no-audit --no-fund "@playdrop/playdrop-cli@$TARGET_CLI_VERSION"; then
@@ -2863,25 +3165,11 @@ if [ -n "$TARGET_CLI_VERSION" ]; then
   fi
 fi
 
-if [ -n "$TARGET_PLUGIN_VERSION" ]; then
-  if command -v codex >/dev/null 2>&1; then
-    playdrop agents update-plugin codex || record_target_failure "worker_update_plugin_install_failed:codex"
-  fi
-  if command -v claude >/dev/null 2>&1; then
-    playdrop agents update-plugin claude || record_target_failure "worker_update_plugin_install_failed:claude"
-  fi
-  check_plugin_versions "$TARGET_PLUGIN_VERSION" target || record_target_failure "worker_update_plugin_version_mismatch"
-fi
-
 if [ -n "$MINIMUM_CLI_VERSION" ]; then
   CURRENT_CLI_VERSION="$(current_cli_version)" || fail_converge "$?" "worker_update_cli_below_minimum"
   version_meets "$CURRENT_CLI_VERSION" "$MINIMUM_CLI_VERSION" || fail_converge "$?" "worker_update_cli_below_minimum"
 fi
 
-if [ -n "$MINIMUM_PLUGIN_VERSION" ]; then
-  check_plugin_versions "$MINIMUM_PLUGIN_VERSION" minimum || fail_converge "$?" "worker_update_plugin_below_minimum"
-fi
-
 if [ "$TARGET_UPDATE_FAILED" -eq 0 ]; then
   rm -f "$FAILURE_FILE"
 fi
@@ -2898,7 +3186,7 @@ async function writeManagedWorkerLaunchAgent(input) {
     }
     const label = managedWorkerLaunchAgentLabel(input.env);
     const plistPath = managedWorkerLaunchAgentPath(input.env);
-    const logDir = node_path_1.default.join(getWorkerStateDir(), 'logs');
+    const logDir = node_path_1.default.join(resolveWorkerStateDir(), 'logs');
     assertNoSupervisorConflicts({
         env: input.env,
         workerName: input.workerName,
@@ -2952,34 +3240,6 @@ function launchManagedWorker(label, plistPath) {
         throw new Error(`worker_setup_launchagent_start_failed: launchctl kickstart exited with code ${kickstart.exitCode}. ${kickstart.output.slice(0, 300)}`);
     }
 }
-async function runPluginSetupAction(action, agent) {
-    const previousExitCode = node_process_1.default.exitCode;
-    node_process_1.default.exitCode = undefined;
-    try {
-        if (action === 'install') {
-            await (0, agents_1.installPlugin)(agent);
-        }
-        else {
-            await (0, agents_1.updatePlugin)(agent);
-        }
-        if (node_process_1.default.exitCode && node_process_1.default.exitCode !== 0) {
-            throw new Error(`worker_setup_plugin_${action}_failed:${agent}`);
-        }
-    }
-    finally {
-        node_process_1.default.exitCode = previousExitCode;
-    }
-}
-async function ensurePlaydropPluginsForSetup(local) {
-    for (const agent of local.agents) {
-        if (agent.agent === 'CODEX') {
-            await runPluginSetupAction(local.plugin.ready ? 'update' : 'install', 'codex');
-        }
-        else if (agent.agent === 'CLAUDE_CODE') {
-            await runPluginSetupAction(local.plugin.ready ? 'update' : 'install', 'claude');
-        }
-    }
-}
 async function resolveWorkerStatusPayload(options = {}) {
     loadWorkerEnvFile(options.env);
     const local = collectWorkerLocalStatus();
@@ -3019,6 +3279,7 @@ async function resolveWorkerStatusPayload(options = {}) {
     try {
         const workers = await ctx.client.listMyAgentWorkers();
         server.reachable = true;
+        server.updatePolicy = workers.updatePolicy;
         server.worker = workerKey
             ? workers.workers.find((worker) => worker.workerKey === workerKey) ?? null
             : null;
@@ -3038,7 +3299,6 @@ function printWorkerStatus(payload) {
     console.log(`  CLI: ${payload.local.cliVersion}`);
     console.log(`  Node: ${payload.local.nodeVersion}`);
     console.log(`  npm: ${payload.local.npmVersion ?? 'missing'}`);
-    console.log(`  PlayDrop plugin: ${payload.local.plugin.ready ? payload.local.plugin.version ?? payload.local.plugin.root ?? 'installed' : 'missing'}`);
     if (payload.local.agents.length > 0) {
         for (const agent of payload.local.agents) {
             console.log(`  ${agent.agent}: ${agent.ready ? 'ready' : 'degraded'} ${agent.cliVersion ?? ''}`.trimEnd());
@@ -3098,11 +3358,6 @@ async function setupWorker(options = {}) {
         if (!baseRuntimeReady) {
             throw new Error(`worker_setup_preflight_failed: ${local.degradedReasons.join(', ') || 'local worker runtime is not ready'}`);
         }
-        await ensurePlaydropPluginsForSetup(local);
-        const postPluginLocal = collectWorkerLocalStatus();
-        if (!postPluginLocal.plugin.ready) {
-            throw new Error(`worker_setup_plugin_unavailable: ${postPluginLocal.plugin.error ?? 'PlayDrop plugin could not be verified after setup'}`);
-        }
         if (target !== 'FIRST_PARTY') {
             (0, output_1.printSuccess)('Personal worker setup complete.', [
                 'Run: playdrop worker start --supervise-stdin',
@@ -3311,6 +3566,14 @@ function throwWorkerRuntimeError(error) {
 async function startWorker(options = {}) {
     loadWorkerEnvFile(options.env);
     await (0, commandContext_1.withEnvironment)('worker start', 'Starting the PlayDrop worker', async ({ client, env }) => {
+        const devPluginWorkingTree = resolveDevPluginWorkingTree({
+            workingTree: options.devPluginWorkingTree,
+            env,
+            nodeEnv: node_process_1.default.env.NODE_ENV,
+        });
+        if (devPluginWorkingTree) {
+            console.warn(`[worker] explicit dev plugin working tree enabled: ${devPluginWorkingTree}`);
+        }
         let me;
         try {
             me = await client.me();
@@ -3326,784 +3589,821 @@ async function startWorker(options = {}) {
             throw new Error('worker_session_invalid: the stored session did not resolve to a user. Run "playdrop auth login" and retry.');
         }
         const target = resolveWorkerExecutionTargetFromRole(me.user.role);
-        const npmVersion = probeNpmVersion();
-        const playwright = probePlaywrightChromium();
-        const playdropPluginRoot = resolvePlaydropPluginRoot();
-        const playdropPluginVersion = readPlaydropPluginVersion(playdropPluginRoot);
-        const workerKey = (0, config_1.getOrCreateWorkerKey)();
+        const initialWorkerPolicy = (await client.listMyAgentWorkers()).updatePolicy;
+        if (initialWorkerPolicy.executionTarget !== target) {
+            throw new Error(`worker_update_policy_target_mismatch: expected ${target}, received ${initialWorkerPolicy.executionTarget}.`);
+        }
         const workerName = options.name?.trim() || `${username} - ${node_os_1.default.hostname()}`;
-        const maxParallelTasks = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_MAX_PARALLEL_TASKS', DEFAULT_WORKER_MAX_PARALLEL_TASKS);
-        let capabilities = probeReadyWorkerCapabilities({
-            npmVersion,
-            playwright,
-            maxParallelTasks,
-            pluginVersion: playdropPluginVersion,
-        });
-        let lastCapabilityRefreshAt = Date.now();
-        writeWorkerRuntimeState({
-            env,
-            workerKey,
-            workerName,
-            target,
-        });
-        const activeTaskIds = new Set();
-        const activeTaskRuns = new Map();
-        const activeTerminators = new Map();
-        const activeDevPorts = new Set();
-        const workerDevPortBase = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_DEV_PORT_BASE', DEFAULT_WORKER_DEV_PORT_BASE);
-        let sessionExpired = false;
-        let shuttingDown = false;
-        let quiescingForUpdate = false;
-        let shutdownSignal = null;
-        let crashed = false;
-        let fatalTaskError = null;
-        let presenceTimer = null;
-        const firstActiveTaskId = () => activeTaskIds.values().next().value ?? null;
-        const terminateActiveTasks = () => {
-            for (const terminate of activeTerminators.values()) {
-                terminate();
-            }
-        };
-        const currentCapabilities = () => ({
-            ...capabilities,
-            runningTaskCount: activeTaskRuns.size,
-        });
-        const presenceBody = () => ({
-            workerKey,
-            name: workerName,
-            environment: env,
-            capabilities: currentCapabilities(),
-            lifecycleState: quiescingForUpdate ? 'QUIESCING' : 'READY',
-            updateState: quiescingForUpdate ? 'UPDATE_REQUIRED' : 'CURRENT',
-            ready: capabilities.ready,
-            activeTaskCount: activeTaskRuns.size,
-            cliVersion: (0, clientInfo_1.getCliVersion)(),
-            pluginVersion: capabilities.pluginVersion,
-        });
-        const recordFatalTaskError = (error) => {
-            if (!fatalTaskError) {
-                fatalTaskError = error instanceof Error ? error : new Error(String(error));
-            }
-            shuttingDown = true;
-            terminateActiveTasks();
-        };
-        const handleWorkerAction = (response) => {
-            const requiredWrapperVersion = response?.updatePolicy?.requiredWrapperContractVersion;
-            if (typeof requiredWrapperVersion === 'number'
-                && requiredWrapperVersion > WORKER_WRAPPER_CONTRACT_VERSION) {
-                recordFatalTaskError(new Error(`worker_wrapper_update_required: run "playdrop worker setup --env ${env}" to install wrapper contract ${requiredWrapperVersion}.`));
-                return;
-            }
-            if (response?.action !== 'quiesce_for_update' || quiescingForUpdate) {
-                return;
-            }
-            writeManagedWorkerUpdatePolicyFile({
+        const supervisorType = normalizeWorkerSupervisorType(options.supervisor);
+        const supervisorLock = acquireWorkerSupervisorLock({ supervisorType, workerName });
+        try {
+            await removeStaleAgentRunCredentials();
+            const npmVersion = probeNpmVersion();
+            const playwright = probePlaywrightChromium();
+            const workerKey = (0, config_1.getOrCreateWorkerKey)();
+            const maxParallelTasks = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_MAX_PARALLEL_TASKS', DEFAULT_WORKER_MAX_PARALLEL_TASKS);
+            let capabilities = probeReadyWorkerCapabilities({
+                npmVersion,
+                playwright,
+                maxParallelTasks,
+            });
+            let lastCapabilityRefreshAt = Date.now();
+            writeWorkerRuntimeState({
                 env,
                 workerKey,
-                updatePolicy: response.updatePolicy,
+                workerName,
+                target,
             });
-            quiescingForUpdate = true;
-            console.log('Worker entering QUIESCING for managed update. No new tasks will be claimed.');
-        };
-        const signalHandler = (signal) => {
-            shutdownSignal = signal;
-            if (shuttingDown) {
-                return;
-            }
-            shuttingDown = true;
-            // Task runs finish their own lifecycle (flush, fail, clean) before exit.
-            terminateActiveTasks();
-        };
-        const stdinShutdownHandler = () => {
-            shutdownSignal = 'SIGTERM';
-            if (shuttingDown) {
-                return;
-            }
-            shuttingDown = true;
-            terminateActiveTasks();
-        };
-        node_process_1.default.once('SIGINT', signalHandler);
-        node_process_1.default.once('SIGTERM', signalHandler);
-        if (options.superviseStdin) {
-            node_process_1.default.stdin.once('end', stdinShutdownHandler);
-            node_process_1.default.stdin.once('close', stdinShutdownHandler);
-            node_process_1.default.stdin.resume();
-        }
-        console.log(`PlayDrop Worker started as "${workerName}" (${target}).`);
-        await sendWorkerHealthAlertSafely({ state: 'started', env, workerName });
-        // Marks the session expired, kills any in-flight agent child, and lets the
-        // run loop finish the task lifecycle before the worker stops non-zero.
-        const handleSessionExpiry = () => {
-            if (sessionExpired) {
-                return;
-            }
-            sessionExpired = true;
-            console.error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
-            terminateActiveTasks();
-        };
-        try {
-            handleWorkerAction(await client.workerPresence(presenceBody()));
-        }
-        catch (error) {
-            if (isWorkerAuthFailureError(error)) {
-                throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
-            }
-            throw error;
-        }
-        presenceTimer = setInterval(() => {
-            client.workerPresence(presenceBody()).then(handleWorkerAction).catch((error) => {
-                if (isWorkerAuthFailureError(error)) {
-                    handleSessionExpiry();
-                    return;
+            const activeTaskIds = new Set();
+            const activeTaskRuns = new Map();
+            const activeTerminators = new Map();
+            const activeDevPorts = new Set();
+            const workerDevPortBase = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_DEV_PORT_BASE', DEFAULT_WORKER_DEV_PORT_BASE);
+            let sessionExpired = false;
+            let shuttingDown = false;
+            let quiescingForUpdate = false;
+            let shutdownSignal = null;
+            let crashed = false;
+            let fatalTaskError = null;
+            let presenceTimer = null;
+            let currentWorkerPolicy = initialWorkerPolicy;
+            const firstActiveTaskId = () => activeTaskIds.values().next().value ?? null;
+            const terminateActiveTasks = () => {
+                for (const terminate of activeTerminators.values()) {
+                    terminate();
                 }
-                console.error(`Worker presence heartbeat failed: ${error instanceof Error ? error.message : String(error)}`);
+            };
+            const currentCapabilities = () => ({
+                ...capabilities,
+                runningTaskCount: activeTaskRuns.size,
             });
-        }, HEARTBEAT_INTERVAL_MS);
-        const runClaimedTask = async (claim, devPort) => {
-            const task = claim.task;
-            if (!task) {
-                throw new Error('agent_task_claim_missing_task');
-            }
-            const leaseToken = claim.leaseToken?.trim();
-            if (!leaseToken) {
-                throw new Error('agent_task_claim_missing_lease_token');
-            }
-            // The lease token lives only in supervisor memory, never in the task
-            // workspace, on-disk worker state, or the agent child environment.
-            let heartbeatTimer = null;
-            let eventDrainTimer = null;
-            let eventDrainPromise = Promise.resolve();
-            let fenced = false;
-            let heartbeatObservedFinalizedTask = false;
-            let retainWorkspace = false;
-            let workspaceDir = null;
-            let availableSkillPaths = [];
-            const observedSkillPaths = new Set();
-            let assignment = null;
-            let resolvedRuntimeModel = task.model;
-            let reasoningEffort = null;
-            let agentStartedAt = null;
-            let agentCompletedAt = null;
-            let agentResult = null;
-            let telemetryReported = false;
-            let heartbeatTransientFailures = 0;
-            const reportTelemetry = async (status, setupError) => {
-                if (!assignment) {
+            const presenceBody = () => ({
+                workerKey,
+                name: workerName,
+                environment: env,
+                capabilities: currentCapabilities(),
+                lifecycleState: quiescingForUpdate ? 'QUIESCING' : 'READY',
+                updateState: quiescingForUpdate ? 'UPDATE_REQUIRED' : 'CURRENT',
+                ready: !quiescingForUpdate && capabilities.ready,
+                activeTaskCount: activeTaskRuns.size,
+                cliVersion: (0, clientInfo_1.getCliVersion)(),
+                targetCliVersion: currentWorkerPolicy.targetCliVersion,
+            });
+            const recordFatalTaskError = (error) => {
+                if (!fatalTaskError) {
+                    fatalTaskError = error instanceof Error ? error : new Error(String(error));
+                }
+                shuttingDown = true;
+                terminateActiveTasks();
+            };
+            const handleWorkerAction = (response) => {
+                if (response?.updatePolicy) {
+                    if (response.updatePolicy.executionTarget !== target) {
+                        recordFatalTaskError(new Error(`worker_update_policy_target_mismatch: expected ${target}, received ${response.updatePolicy.executionTarget}.`));
+                        return;
+                    }
+                    currentWorkerPolicy = response.updatePolicy;
+                }
+                const requiredWrapperVersion = response?.updatePolicy?.requiredWrapperContractVersion;
+                if (typeof requiredWrapperVersion === 'number'
+                    && requiredWrapperVersion > WORKER_WRAPPER_CONTRACT_VERSION) {
+                    recordFatalTaskError(new Error(`worker_wrapper_update_required: run "playdrop worker setup --env ${env}" to install wrapper contract ${requiredWrapperVersion}.`));
+                    return;
+                }
+                if (response?.action !== 'quiesce_for_update' || quiescingForUpdate) {
                     return;
                 }
-                const completedAt = agentCompletedAt ?? new Date();
-                await recordAgentRunTelemetry({
-                    client,
-                    task,
-                    assignment,
+                writeManagedWorkerUpdatePolicyFile({
+                    env,
                     workerKey,
-                    leaseToken,
-                    result: agentResult ?? buildSupervisorFailureRunResult(setupError ?? 'worker_setup_failed'),
-                    status,
-                    resolvedRuntimeModel,
-                    reasoningEffort,
-                    availableSkillPaths,
-                    observedSkillPaths: [...observedSkillPaths],
-                    startedAt: agentStartedAt ?? completedAt,
-                    completedAt,
+                    updatePolicy: response.updatePolicy,
                 });
-                telemetryReported = true;
+                quiescingForUpdate = true;
+                console.log('Worker entering QUIESCING for managed update. No new tasks will be claimed.');
+            };
+            const signalHandler = (signal) => {
+                shutdownSignal = signal;
+                if (shuttingDown) {
+                    return;
+                }
+                shuttingDown = true;
+                // Task runs finish their own lifecycle (flush, fail, clean) before exit.
+                terminateActiveTasks();
+            };
+            const stdinShutdownHandler = () => {
+                shutdownSignal = 'SIGTERM';
+                if (shuttingDown) {
+                    return;
+                }
+                shuttingDown = true;
+                terminateActiveTasks();
+            };
+            node_process_1.default.once('SIGINT', signalHandler);
+            node_process_1.default.once('SIGTERM', signalHandler);
+            if (options.superviseStdin) {
+                node_process_1.default.stdin.once('end', stdinShutdownHandler);
+                node_process_1.default.stdin.once('close', stdinShutdownHandler);
+                node_process_1.default.stdin.resume();
+            }
+            console.log(`PlayDrop Worker started as "${workerName}" (${target}).`);
+            await sendWorkerHealthAlertSafely({ state: 'started', env, workerName });
+            // Marks the session expired, kills any in-flight agent child, and lets the
+            // run loop finish the task lifecycle before the worker stops non-zero.
+            const handleSessionExpiry = () => {
+                if (sessionExpired) {
+                    return;
+                }
+                sessionExpired = true;
+                console.error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
+                terminateActiveTasks();
             };
             try {
-                assignment = resolveWorkerClaimTaskAssignment(claim);
-                if (!assignment) {
-                    throw new Error('agent_task_claim_missing_task_assignment');
+                handleWorkerAction(await client.workerPresence(presenceBody()));
+            }
+            catch (error) {
+                if (isWorkerAuthFailureError(error)) {
+                    throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
                 }
-                const codexModel = assignment.agent === 'CODEX' ? resolveCodexModel(assignment.model) : null;
-                const claudeModel = assignment.agent === 'CLAUDE_CODE' ? resolveClaudeModel(assignment.model) : null;
-                resolvedRuntimeModel = codexModel?.model ?? claudeModel?.model ?? assignment.model;
-                reasoningEffort = codexModel?.reasoningEffort ?? claudeModel?.effort ?? null;
-                const taskContext = buildWorkerTaskContext(claim, assignment);
-                workspaceDir = workerTaskWorkspaceDirFromAssignment(assignment);
-                await (0, promises_1.rm)(workspaceDir, { recursive: true, force: true });
-                await (0, promises_1.mkdir)(workspaceDir, { recursive: true });
-                const eventDir = node_path_1.default.join(workspaceDir, '.playdrop-task-events');
-                await (0, promises_1.mkdir)(eventDir, { recursive: true });
-                await stageWorkerTaskContext({
-                    workspaceDir,
-                    env,
-                    devPort,
-                    taskContext,
-                });
-                const binDir = await createLocalPlaydropShim({
-                    workspaceDir,
-                    taskId: taskContext.taskId,
-                    attempt: taskContext.attempt,
-                    devPort,
-                });
-                const handleEventDrainFailure = (error) => {
-                    const classification = classifyWorkerEventDrainError(error);
-                    if (classification === 'session_expired') {
+                throw error;
+            }
+            presenceTimer = setInterval(() => {
+                client.workerPresence(presenceBody()).then(handleWorkerAction).catch((error) => {
+                    if (isWorkerAuthFailureError(error)) {
                         handleSessionExpiry();
                         return;
                     }
-                    if (classification === 'lease_invalid') {
-                        fenced = true;
-                        activeTerminators.get(task.id)?.();
-                        return;
-                    }
-                    console.error(`Agent task event drain failed: ${error instanceof Error ? error.message : String(error)}`);
-                };
-                const queueEventDrain = () => {
-                    eventDrainPromise = eventDrainPromise.then(() => drainWorkerEventQueue({ eventDir, client, taskId: task.id, workerKey, leaseToken }), () => drainWorkerEventQueue({ eventDir, client, taskId: task.id, workerKey, leaseToken }));
-                    return eventDrainPromise;
-                };
-                const appendObservedSkillPathsFromTranscript = (chunks) => {
-                    if (availableSkillPaths.length <= 0) {
+                    console.error(`Worker presence heartbeat failed: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            }, HEARTBEAT_INTERVAL_MS);
+            const runClaimedTask = async (claim, devPort) => {
+                const task = claim.task;
+                if (!task) {
+                    throw new Error('agent_task_claim_missing_task');
+                }
+                const leaseToken = claim.leaseToken?.trim();
+                if (!leaseToken) {
+                    throw new Error('agent_task_claim_missing_lease_token');
+                }
+                // The lease token lives only in supervisor memory, never in the task
+                // workspace, on-disk worker state, or the agent child environment.
+                let heartbeatTimer = null;
+                let eventDrainTimer = null;
+                let eventDrainPromise = Promise.resolve();
+                let fenced = false;
+                let heartbeatObservedFinalizedTask = false;
+                let retainWorkspace = false;
+                let workspaceDir = null;
+                let availableSkillPaths = [];
+                const observedSkillPaths = new Set();
+                let assignment = null;
+                let resolvedRuntimeModel = task.model;
+                let reasoningEffort = null;
+                let agentStartedAt = null;
+                let agentCompletedAt = null;
+                let agentResult = null;
+                let telemetryReported = false;
+                let heartbeatTransientFailures = 0;
+                const reportTelemetry = async (status, setupError) => {
+                    if (!assignment) {
                         return;
                     }
-                    for (const chunk of chunks) {
-                        for (const observedPath of collectObservedPlaydropSkillPaths(chunk.content, availableSkillPaths)) {
-                            observedSkillPaths.add(observedPath);
-                        }
-                    }
-                };
-                const appendTranscriptChunks = async (chunks) => {
-                    appendObservedSkillPathsFromTranscript(chunks);
-                    await appendWorkerTranscriptChunks({ client, taskId: task.id, workerKey, leaseToken, chunks });
-                };
-                await client.workerCreateAgentTaskEvent(task.id, {
-                    workerKey,
-                    leaseToken,
-                    kind: 'progress',
-                    phase: 'setup',
-                    message: 'Preparing worker workspace',
-                    pct: 2,
-                });
-                const assignmentPluginRoot = assignment.pluginBundle
-                    ? await stageAssignmentPluginBundle({ workspaceDir, pluginBundle: assignment.pluginBundle })
-                    : playdropPluginRoot;
-                availableSkillPaths = normalizeTelemetrySkillPaths(await stagePlaydropPluginReferences({ workspaceDir, pluginRoot: assignmentPluginRoot, kind: task.kind }));
-                await client.workerCreateAgentTaskEvent(task.id, {
-                    workerKey,
-                    leaseToken,
-                    kind: 'progress',
-                    phase: 'setup',
-                    message: 'Staged PlayDrop plugin references',
-                    pct: 3,
-                });
-                if (assignment.workspace.files.length > 0) {
-                    await client.workerCreateAgentTaskEvent(task.id, {
+                    const completedAt = agentCompletedAt ?? new Date();
+                    await recordAgentRunTelemetry({
+                        client,
+                        task,
+                        assignment,
                         workerKey,
                         leaseToken,
-                        kind: 'progress',
-                        phase: 'setup',
-                        message: `Staging ${assignment.workspace.files.length} server-provided workspace file${assignment.workspace.files.length === 1 ? '' : 's'}`,
-                        pct: 3,
+                        result: agentResult ?? buildSupervisorFailureRunResult(setupError ?? 'worker_setup_failed'),
+                        status,
+                        resolvedRuntimeModel,
+                        reasoningEffort,
+                        availableSkillPaths,
+                        observedSkillPaths: [...observedSkillPaths],
+                        startedAt: agentStartedAt ?? completedAt,
+                        completedAt,
                     });
-                    await stageAssignmentWorkspaceFiles(workspaceDir, assignment.workspace.files);
-                }
-                heartbeatTimer = setInterval(() => {
-                    client.workerHeartbeatAgentTask(task.id, { workerKey, leaseToken })
-                        .then((heartbeat) => {
-                        heartbeatTransientFailures = 0;
-                        if (heartbeat.action === 'abort') {
-                            fenced = true;
-                            activeTerminators.get(task.id)?.();
-                        }
-                    })
-                        .catch((error) => {
-                        const classification = classifyWorkerHeartbeatError(error);
+                    telemetryReported = true;
+                };
+                try {
+                    assignment = resolveWorkerClaimTaskAssignment(claim);
+                    if (!assignment) {
+                        throw new Error('agent_task_claim_missing_task_assignment');
+                    }
+                    const codexModel = assignment.agent === 'CODEX' ? resolveCodexModel(assignment.model) : null;
+                    const claudeModel = assignment.agent === 'CLAUDE_CODE' ? resolveClaudeModel(assignment.model) : null;
+                    resolvedRuntimeModel = codexModel?.model ?? claudeModel?.model ?? assignment.model;
+                    reasoningEffort = codexModel?.reasoningEffort ?? claudeModel?.effort ?? null;
+                    const taskContext = buildWorkerTaskContext(claim, assignment);
+                    workspaceDir = workerTaskWorkspaceDirFromAssignment(assignment);
+                    await (0, promises_1.rm)(workspaceDir, { recursive: true, force: true });
+                    await (0, promises_1.mkdir)(workspaceDir, { recursive: true });
+                    const eventDir = node_path_1.default.join(workspaceDir, '.playdrop-task-events');
+                    await (0, promises_1.mkdir)(eventDir, { recursive: true });
+                    await stageWorkerTaskContext({
+                        workspaceDir,
+                        env,
+                        devPort,
+                        taskContext,
+                    });
+                    const binDir = await createLocalPlaydropShim({
+                        workspaceDir,
+                        taskId: taskContext.taskId,
+                        attempt: taskContext.attempt,
+                        devPort,
+                    });
+                    const handleEventDrainFailure = (error) => {
+                        const classification = classifyWorkerEventDrainError(error);
                         if (classification === 'session_expired') {
                             handleSessionExpiry();
                             return;
                         }
                         if (classification === 'lease_invalid') {
-                            void (async () => {
-                                const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
-                                if (refreshed?.task.status === 'DONE') {
-                                    fenced = true;
-                                    if (!heartbeatObservedFinalizedTask) {
-                                        heartbeatObservedFinalizedTask = true;
-                                        console.error(`Agent task ${task.id} lease ended after task completed as DONE; waiting for agent exit.`);
-                                    }
-                                    return;
-                                }
-                                if (refreshed && refreshed.task.status !== 'RUNNING' && refreshed.task.status !== 'QUEUED') {
-                                    console.error(`Agent task ${task.id} lease ended after task finalized as ${refreshed.task.status}; terminating agent child.`);
-                                }
-                                fenced = true;
-                                activeTerminators.get(task.id)?.();
-                            })().catch((heartbeatError) => {
-                                fenced = true;
-                                activeTerminators.get(task.id)?.();
-                                console.error(`Agent task lease check failed: ${heartbeatError instanceof Error ? heartbeatError.message : String(heartbeatError)}`);
-                            });
+                            fenced = true;
+                            activeTerminators.get(task.id)?.();
                             return;
                         }
-                        if (classification === 'transient_network') {
-                            heartbeatTransientFailures += 1;
-                            console.error(`Agent task heartbeat transient failure ${heartbeatTransientFailures}/${TASK_HEARTBEAT_TRANSIENT_FAILURE_LIMIT}: ${error instanceof Error ? error.message : String(error)}`);
-                            if (heartbeatTransientFailures >= TASK_HEARTBEAT_TRANSIENT_FAILURE_LIMIT) {
-                                fenced = true;
-                                activeTerminators.get(task.id)?.();
-                                console.error(`Agent task ${task.id} heartbeat could not reach the API; terminating agent child.`);
-                            }
+                        console.error(`Agent task event drain failed: ${error instanceof Error ? error.message : String(error)}`);
+                    };
+                    const queueEventDrain = () => {
+                        eventDrainPromise = eventDrainPromise.then(() => drainWorkerEventQueue({ eventDir, client, taskId: task.id, workerKey, leaseToken }), () => drainWorkerEventQueue({ eventDir, client, taskId: task.id, workerKey, leaseToken }));
+                        return eventDrainPromise;
+                    };
+                    const appendObservedSkillPathsFromTranscript = (chunks) => {
+                        if (availableSkillPaths.length <= 0) {
                             return;
                         }
-                        console.error(`Agent task heartbeat failed: ${error instanceof Error ? error.message : String(error)}`);
-                    });
-                }, task.kind === 'GAME_REVIEW' || task.kind === 'GAME_EVAL'
-                    ? INSTRUMENT_HEARTBEAT_INTERVAL_MS
-                    : HEARTBEAT_INTERVAL_MS);
-                eventDrainTimer = setInterval(() => {
-                    queueEventDrain().catch((error) => {
-                        handleEventDrainFailure(error);
-                    });
-                }, 1000);
-                const prompt = assignment.prompt;
-                if (task.kind === 'GAME_UPDATE') {
-                    const baseSourcePayload = assignment.inputs.baseSource;
-                    const baseSource = resolveWorkerBaseSource(baseSourcePayload);
+                        for (const chunk of chunks) {
+                            for (const observedPath of collectObservedPlaydropSkillPaths(chunk.content, availableSkillPaths)) {
+                                observedSkillPaths.add(observedPath);
+                            }
+                        }
+                    };
+                    const appendTranscriptChunks = async (chunks) => {
+                        appendObservedSkillPathsFromTranscript(chunks);
+                        await appendWorkerTranscriptChunks({ client, taskId: task.id, workerKey, leaseToken, chunks });
+                    };
                     await client.workerCreateAgentTaskEvent(task.id, {
                         workerKey,
                         leaseToken,
                         kind: 'progress',
                         phase: 'setup',
-                        message: `Staging base source ${baseSource.appName} version ${baseSource.version} into the workspace`,
-                        pct: 4,
-                    });
-                    await stageWorkerBaseAppSource({
-                        client,
-                        workspaceDir,
-                        creatorUsername: baseSourcePayload.creatorUsername,
-                        baseApp: baseSource,
+                        message: 'Preparing worker workspace',
+                        pct: 2,
                     });
-                }
-                else if (task.kind === 'NEW_GAME' || task.kind === 'REMIX_GAME') {
-                    if (assignment.inputs.baseSource !== null) {
-                        throw new Error('agent_task_assignment_unexpected_base_source');
-                    }
-                    if (task.kind === 'REMIX_GAME' && !assignment.inputs.remixSource) {
-                        throw new Error('agent_task_assignment_remix_source_missing');
-                    }
-                }
-                else if (task.kind === 'GAME_REVIEW') {
-                    if (assignment.inputs.baseSource !== null) {
-                        throw new Error('agent_task_assignment_unexpected_base_source');
-                    }
-                    if (!assignment.inputs.reviewTarget) {
-                        throw new Error('agent_task_assignment_review_target_missing');
-                    }
-                }
-                else if (task.kind === 'GAME_EVAL') {
-                    if (assignment.inputs.baseSource !== null) {
-                        throw new Error('agent_task_assignment_unexpected_base_source');
-                    }
-                    if (!assignment.inputs.evalTarget) {
-                        throw new Error('agent_task_assignment_eval_target_missing');
-                    }
-                }
-                else {
-                    throw new Error(`unsupported_agent_task_kind:${task.kind}`);
-                }
-                if (shuttingDown) {
-                    throw new Error('worker_shutdown');
-                }
-                agentStartedAt = new Date();
-                if (assignment.agent === 'CODEX') {
-                    agentResult = await runCodex({
+                    const assignmentPluginRoot = devPluginWorkingTree ?? await stageAssignmentPluginBundle({
                         workspaceDir,
-                        binDir,
-                        eventDir,
-                        prompt,
-                        envName: env,
-                        taskId: task.id,
-                        attempt: taskContext.attempt,
-                        devPort,
-                        codexModel: codexModel ?? resolveCodexModel(assignment.model),
-                        onTranscriptChunks: async (chunks) => {
-                            await appendTranscriptChunks(chunks);
-                        },
-                        onChild: (controls) => {
-                            activeTerminators.set(task.id, controls.terminate);
-                        },
+                        pluginBundle: assignment.pluginBundle,
                     });
-                }
-                else if (assignment.agent === 'CLAUDE_CODE') {
-                    agentResult = await runClaude({
+                    const stagedPluginPaths = await stagePlaydropPluginReferences({
                         workspaceDir,
-                        binDir,
-                        eventDir,
-                        prompt,
-                        enableChrome: task.kind === 'GAME_REVIEW' || task.kind === 'GAME_EVAL',
-                        envName: env,
-                        taskId: task.id,
-                        attempt: taskContext.attempt,
-                        devPort,
-                        claudeModel: claudeModel ?? resolveClaudeModel(assignment.model),
-                        playdropPluginRoot: assignmentPluginRoot,
-                        onTranscriptChunks: async (chunks) => {
-                            await appendTranscriptChunks(chunks);
-                        },
-                        onChild: (controls) => {
-                            activeTerminators.set(task.id, controls.terminate);
-                        },
+                        pluginRoot: assignmentPluginRoot,
+                        kind: task.kind,
                     });
-                }
-                else if (assignment.agent === 'CURSOR_COMPOSER') {
-                    const assignmentAgent = assignment.agent;
-                    const assignmentModel = assignment.model;
-                    const plannedAttemptIndex = assignment.attemptPlan?.options.findIndex((option) => option.agent === assignmentAgent && option.model === assignmentModel);
-                    const attemptIndex = typeof plannedAttemptIndex === 'number' && plannedAttemptIndex >= 0
-                        ? plannedAttemptIndex
-                        : 0;
-                    await client.workerRecordAgentTaskAttemptUnavailable(task.id, {
-                        workerKey,
-                        leaseToken,
-                        attemptIndex,
-                        reason: 'unavailable_runtime',
-                        message: 'Cursor Composer noninteractive worker execution is not configured on this worker.',
-                    });
-                    fenced = true;
-                    throw new Error('worker_cursor_composer_runner_not_configured');
-                }
-                else {
-                    throw new Error(`unsupported_worker_agent:${assignment.agent}`);
-                }
-                agentCompletedAt = new Date();
-                await queueEventDrain().catch((error) => {
-                    handleEventDrainFailure(error);
-                });
-                const completedAgentResult = agentResult;
-                const agentRunResult = buildAgentRunResult(completedAgentResult);
-                if (fenced) {
-                    const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
-                    if (refreshed && refreshed.task.status !== 'RUNNING' && refreshed.task.status !== 'QUEUED') {
-                        retainWorkspace = refreshed.task.status === 'FAILED';
-                        console.error(`Agent task ${task.id} was finalized by the server as ${refreshed.task.status}.`);
-                        await reportTelemetry(refreshed.task.status);
-                    }
-                    else {
-                        console.error(`Agent task ${task.id} was aborted by the server; cleaning up without reporting failure.`);
+                    if (assignment.agent === 'CODEX') {
+                        await stageCodexTaskSkills({ workspaceDir, stagedPluginPaths });
                     }
-                }
-                else if (sessionExpired) {
-                    // Best effort: the session is already invalid, so this fail call
-                    // likely 401s too; failTaskWithRetry logs loudly after the retry.
-                    await failTaskWithRetry(client, task.id, {
-                        workerKey,
-                        leaseToken,
-                        error: 'worker_session_expired',
-                        result: agentRunResult,
-                    });
-                }
-                else if (shuttingDown) {
-                    await failTaskWithRetry(client, task.id, {
+                    availableSkillPaths = normalizeTelemetrySkillPaths(stagedPluginPaths);
+                    await client.workerCreateAgentTaskEvent(task.id, {
                         workerKey,
                         leaseToken,
-                        error: 'worker_shutdown',
-                        result: agentRunResult,
+                        kind: 'progress',
+                        phase: 'setup',
+                        message: devPluginWorkingTree
+                            ? 'Staged PlayDrop plugin references from explicit dev working tree'
+                            : 'Staged PlayDrop plugin references from server task bundle',
+                        pct: 3,
+                        payload: {
+                            pluginSource: devPluginWorkingTree ? 'DEV_WORKING_TREE' : 'SERVER_TASK_BUNDLE',
+                            bundleSha: assignment.pluginBundle.sha256,
+                        },
                     });
-                    await reportTelemetry('FAILED');
-                }
-                else if (completedAgentResult.timedOut || completedAgentResult.exitCode !== 0 || completedAgentResult.signal) {
-                    const refreshed = await fetchTaskDetail(client, target, task.id);
-                    if (refreshed.task.status !== 'RUNNING') {
-                        retainWorkspace = refreshed.task.status === 'FAILED';
-                        console.error(`Agent task ${task.id} was finalized by the agent as ${refreshed.task.status}.`);
-                        await reportTelemetry(refreshed.task.status);
-                    }
-                    else if (hasAgentTaskUploadedArtifact(refreshed.task)) {
-                        retainWorkspace = true;
-                        console.error(`Agent task ${task.id} already uploaded an artifact but exited before task completion. Leaving it for manual completion repair.`);
+                    if (assignment.workspace.files.length > 0) {
                         await client.workerCreateAgentTaskEvent(task.id, {
                             workerKey,
                             leaseToken,
                             kind: 'progress',
-                            phase: 'upload',
-                            message: 'Agent exited after upload before task done; manual completion repair required.',
+                            phase: 'setup',
+                            message: `Staging ${assignment.workspace.files.length} server-provided workspace file${assignment.workspace.files.length === 1 ? '' : 's'}`,
+                            pct: 3,
                         });
-                        await reportTelemetry('RUNNING');
+                        await stageAssignmentWorkspaceFiles(workspaceDir, assignment.workspace.files);
                     }
-                    else {
-                        retainWorkspace = true;
-                        const failureCode = buildAgentFailureCode(assignment.agent, completedAgentResult);
+                    heartbeatTimer = setInterval(() => {
+                        client.workerHeartbeatAgentTask(task.id, { workerKey, leaseToken })
+                            .then((heartbeat) => {
+                            heartbeatTransientFailures = 0;
+                            if (heartbeat.action === 'abort') {
+                                fenced = true;
+                                activeTerminators.get(task.id)?.();
+                            }
+                        })
+                            .catch((error) => {
+                            const classification = classifyWorkerHeartbeatError(error);
+                            if (classification === 'session_expired') {
+                                handleSessionExpiry();
+                                return;
+                            }
+                            if (classification === 'lease_invalid') {
+                                void (async () => {
+                                    const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
+                                    if (refreshed?.task.status === 'DONE') {
+                                        fenced = true;
+                                        if (!heartbeatObservedFinalizedTask) {
+                                            heartbeatObservedFinalizedTask = true;
+                                            console.error(`Agent task ${task.id} lease ended after task completed as DONE; waiting for agent exit.`);
+                                        }
+                                        return;
+                                    }
+                                    if (refreshed && refreshed.task.status !== 'RUNNING' && refreshed.task.status !== 'QUEUED') {
+                                        console.error(`Agent task ${task.id} lease ended after task finalized as ${refreshed.task.status}; terminating agent child.`);
+                                    }
+                                    fenced = true;
+                                    activeTerminators.get(task.id)?.();
+                                })().catch((heartbeatError) => {
+                                    fenced = true;
+                                    activeTerminators.get(task.id)?.();
+                                    console.error(`Agent task lease check failed: ${heartbeatError instanceof Error ? heartbeatError.message : String(heartbeatError)}`);
+                                });
+                                return;
+                            }
+                            if (classification === 'transient_network') {
+                                heartbeatTransientFailures += 1;
+                                console.error(`Agent task heartbeat transient failure ${heartbeatTransientFailures}/${TASK_HEARTBEAT_TRANSIENT_FAILURE_LIMIT}: ${error instanceof Error ? error.message : String(error)}`);
+                                if (heartbeatTransientFailures >= TASK_HEARTBEAT_TRANSIENT_FAILURE_LIMIT) {
+                                    fenced = true;
+                                    activeTerminators.get(task.id)?.();
+                                    console.error(`Agent task ${task.id} heartbeat could not reach the API; terminating agent child.`);
+                                }
+                                return;
+                            }
+                            console.error(`Agent task heartbeat failed: ${error instanceof Error ? error.message : String(error)}`);
+                        });
+                    }, task.kind === 'GAME_REVIEW' || task.kind === 'GAME_EVAL'
+                        ? INSTRUMENT_HEARTBEAT_INTERVAL_MS
+                        : HEARTBEAT_INTERVAL_MS);
+                    eventDrainTimer = setInterval(() => {
+                        queueEventDrain().catch((error) => {
+                            handleEventDrainFailure(error);
+                        });
+                    }, 1000);
+                    const prompt = assignment.prompt;
+                    if (task.kind === 'GAME_UPDATE') {
+                        const baseSourcePayload = assignment.inputs.baseSource;
+                        const baseSource = resolveWorkerBaseSource(baseSourcePayload);
                         await client.workerCreateAgentTaskEvent(task.id, {
                             workerKey,
                             leaseToken,
                             kind: 'progress',
-                            phase: 'failed',
-                            message: describeAgentFailureForEvent(failureCode),
-                            pct: null,
-                            payload: { error: failureCode },
+                            phase: 'setup',
+                            message: `Staging base source ${baseSource.appName} version ${baseSource.version} into the workspace`,
+                            pct: 4,
+                        });
+                        await stageWorkerBaseAppSource({
+                            client,
+                            workspaceDir,
+                            creatorUsername: baseSourcePayload.creatorUsername,
+                            baseApp: baseSource,
+                        });
+                    }
+                    else if (task.kind === 'NEW_GAME' || task.kind === 'REMIX_GAME') {
+                        if (assignment.inputs.baseSource !== null) {
+                            throw new Error('agent_task_assignment_unexpected_base_source');
+                        }
+                        if (task.kind === 'REMIX_GAME' && !assignment.inputs.remixSource) {
+                            throw new Error('agent_task_assignment_remix_source_missing');
+                        }
+                    }
+                    else if (task.kind === 'GAME_REVIEW') {
+                        if (assignment.inputs.baseSource !== null) {
+                            throw new Error('agent_task_assignment_unexpected_base_source');
+                        }
+                        if (!assignment.inputs.reviewTarget) {
+                            throw new Error('agent_task_assignment_review_target_missing');
+                        }
+                    }
+                    else if (task.kind === 'GAME_EVAL') {
+                        if (assignment.inputs.baseSource !== null) {
+                            throw new Error('agent_task_assignment_unexpected_base_source');
+                        }
+                        if (!assignment.inputs.evalTarget) {
+                            throw new Error('agent_task_assignment_eval_target_missing');
+                        }
+                    }
+                    else {
+                        throw new Error(`unsupported_agent_task_kind:${task.kind}`);
+                    }
+                    if (shuttingDown) {
+                        throw new Error('worker_shutdown');
+                    }
+                    agentStartedAt = new Date();
+                    if (assignment.agent === 'CODEX') {
+                        agentResult = await runCodex({
+                            workspaceDir,
+                            binDir,
+                            eventDir,
+                            prompt,
+                            envName: env,
+                            workerUsername: username,
+                            taskId: task.id,
+                            attempt: taskContext.attempt,
+                            devPort,
+                            codexModel: codexModel ?? resolveCodexModel(assignment.model),
+                            onTranscriptChunks: async (chunks) => {
+                                await appendTranscriptChunks(chunks);
+                            },
+                            onChild: (controls) => {
+                                activeTerminators.set(task.id, controls.terminate);
+                            },
+                        });
+                    }
+                    else if (assignment.agent === 'CLAUDE_CODE') {
+                        agentResult = await runClaude({
+                            workspaceDir,
+                            binDir,
+                            eventDir,
+                            prompt,
+                            enableChrome: task.kind === 'GAME_REVIEW' || task.kind === 'GAME_EVAL',
+                            envName: env,
+                            workerUsername: username,
+                            taskId: task.id,
+                            attempt: taskContext.attempt,
+                            devPort,
+                            claudeModel: claudeModel ?? resolveClaudeModel(assignment.model),
+                            taskPluginRoot: assignmentPluginRoot,
+                            onTranscriptChunks: async (chunks) => {
+                                await appendTranscriptChunks(chunks);
+                            },
+                            onChild: (controls) => {
+                                activeTerminators.set(task.id, controls.terminate);
+                            },
+                        });
+                    }
+                    else if (assignment.agent === 'CURSOR_COMPOSER') {
+                        const assignmentAgent = assignment.agent;
+                        const assignmentModel = assignment.model;
+                        const plannedAttemptIndex = assignment.attemptPlan?.options.findIndex((option) => option.agent === assignmentAgent && option.model === assignmentModel);
+                        const attemptIndex = typeof plannedAttemptIndex === 'number' && plannedAttemptIndex >= 0
+                            ? plannedAttemptIndex
+                            : 0;
+                        await client.workerRecordAgentTaskAttemptUnavailable(task.id, {
+                            workerKey,
+                            leaseToken,
+                            attemptIndex,
+                            reason: 'unavailable_runtime',
+                            message: 'Cursor Composer noninteractive worker execution is not configured on this worker.',
                         });
+                        fenced = true;
+                        throw new Error('worker_cursor_composer_runner_not_configured');
+                    }
+                    else {
+                        throw new Error(`unsupported_worker_agent:${assignment.agent}`);
+                    }
+                    agentCompletedAt = new Date();
+                    await queueEventDrain().catch((error) => {
+                        handleEventDrainFailure(error);
+                    });
+                    const completedAgentResult = agentResult;
+                    const agentRunResult = buildAgentRunResult(completedAgentResult);
+                    if (fenced) {
+                        const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
+                        if (refreshed && refreshed.task.status !== 'RUNNING' && refreshed.task.status !== 'QUEUED') {
+                            retainWorkspace = refreshed.task.status === 'FAILED';
+                            console.error(`Agent task ${task.id} was finalized by the server as ${refreshed.task.status}.`);
+                            await reportTelemetry(refreshed.task.status);
+                        }
+                        else {
+                            console.error(`Agent task ${task.id} was aborted by the server; cleaning up without reporting failure.`);
+                        }
+                    }
+                    else if (sessionExpired) {
+                        // Best effort: the session is already invalid, so this fail call
+                        // likely 401s too; failTaskWithRetry logs loudly after the retry.
                         await failTaskWithRetry(client, task.id, {
                             workerKey,
                             leaseToken,
-                            error: failureCode,
+                            error: 'worker_session_expired',
                             result: agentRunResult,
                         });
-                        await reportTelemetry('FAILED');
                     }
-                }
-                else {
-                    const refreshed = await fetchTaskDetail(client, target, task.id);
-                    if (refreshed.task.status !== 'RUNNING') {
-                        retainWorkspace = refreshed.task.status === 'FAILED';
-                        console.error(`Agent task ${task.id} was finalized by the agent as ${refreshed.task.status}.`);
-                        await reportTelemetry(refreshed.task.status);
-                    }
-                    else if (hasAgentTaskUploadedArtifact(refreshed.task)) {
-                        retainWorkspace = true;
-                        console.error(`Agent task ${task.id} already uploaded an artifact but exited before task completion. Leaving it for manual completion repair.`);
-                        await client.workerCreateAgentTaskEvent(task.id, {
+                    else if (shuttingDown) {
+                        await failTaskWithRetry(client, task.id, {
                             workerKey,
                             leaseToken,
-                            kind: 'progress',
-                            phase: 'upload',
-                            message: 'Agent exited after upload before task done; manual completion repair required.',
+                            error: 'worker_shutdown',
+                            result: agentRunResult,
                         });
-                        await reportTelemetry('RUNNING');
+                        await reportTelemetry('FAILED');
                     }
-                    else {
-                        const tokenCap = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_TOKEN_CAP', runtime_1.DEFAULT_WORKER_TOKEN_CAP);
-                        let tokenUsageKnown = true;
-                        try {
-                            tokenUsageKnown = (0, runtime_1.assertWorkerTokenUsageWithinCap)({
-                                tokensUsed: agentResult.tokensUsed,
-                                tokenCap,
+                    else if (completedAgentResult.timedOut || completedAgentResult.exitCode !== 0 || completedAgentResult.signal) {
+                        const refreshed = await fetchTaskDetail(client, target, task.id);
+                        if (refreshed.task.status !== 'RUNNING') {
+                            retainWorkspace = refreshed.task.status === 'FAILED';
+                            console.error(`Agent task ${task.id} was finalized by the agent as ${refreshed.task.status}.`);
+                            await reportTelemetry(refreshed.task.status);
+                        }
+                        else if (hasAgentTaskUploadedArtifact(refreshed.task)) {
+                            retainWorkspace = true;
+                            console.error(`Agent task ${task.id} already uploaded an artifact but exited before task completion. Leaving it for manual completion repair.`);
+                            await client.workerCreateAgentTaskEvent(task.id, {
+                                workerKey,
+                                leaseToken,
+                                kind: 'progress',
+                                phase: 'upload',
+                                message: 'Agent exited after upload before task done; manual completion repair required.',
                             });
+                            await reportTelemetry('RUNNING');
                         }
-                        catch (error) {
+                        else {
+                            retainWorkspace = true;
+                            const failureCode = buildAgentFailureCode(assignment.agent, completedAgentResult);
                             await client.workerCreateAgentTaskEvent(task.id, {
                                 workerKey,
                                 leaseToken,
                                 kind: 'progress',
-                                message: `Token usage ${completedAgentResult.tokensUsed} exceeded the worker token cap of ${tokenCap}.`,
+                                phase: 'failed',
+                                message: describeAgentFailureForEvent(failureCode),
+                                pct: null,
+                                payload: { error: failureCode },
+                            });
+                            await failTaskWithRetry(client, task.id, {
+                                workerKey,
+                                leaseToken,
+                                error: failureCode,
+                                result: agentRunResult,
                             });
                             await reportTelemetry('FAILED');
-                            throw error;
                         }
-                        if (!tokenUsageKnown) {
+                    }
+                    else {
+                        const refreshed = await fetchTaskDetail(client, target, task.id);
+                        if (refreshed.task.status !== 'RUNNING') {
+                            retainWorkspace = refreshed.task.status === 'FAILED';
+                            console.error(`Agent task ${task.id} was finalized by the agent as ${refreshed.task.status}.`);
+                            await reportTelemetry(refreshed.task.status);
+                        }
+                        else if (hasAgentTaskUploadedArtifact(refreshed.task)) {
+                            retainWorkspace = true;
+                            console.error(`Agent task ${task.id} already uploaded an artifact but exited before task completion. Leaving it for manual completion repair.`);
                             await client.workerCreateAgentTaskEvent(task.id, {
                                 workerKey,
                                 leaseToken,
                                 kind: 'progress',
-                                message: 'Token usage parse failed: the agent output did not contain a recognizable total token count.',
+                                phase: 'upload',
+                                message: 'Agent exited after upload before task done; manual completion repair required.',
                             });
+                            await reportTelemetry('RUNNING');
+                        }
+                        else {
+                            const tokenCap = (0, runtime_1.readPositiveEnvInt)('PLAYDROP_WORKER_TOKEN_CAP', runtime_1.DEFAULT_WORKER_TOKEN_CAP);
+                            let tokenUsageKnown = true;
+                            try {
+                                tokenUsageKnown = (0, runtime_1.assertWorkerTokenUsageWithinCap)({
+                                    tokensUsed: agentResult.tokensUsed,
+                                    tokenCap,
+                                });
+                            }
+                            catch (error) {
+                                await client.workerCreateAgentTaskEvent(task.id, {
+                                    workerKey,
+                                    leaseToken,
+                                    kind: 'progress',
+                                    message: `Token usage ${completedAgentResult.tokensUsed} exceeded the worker token cap of ${tokenCap}.`,
+                                });
+                                await reportTelemetry('FAILED');
+                                throw error;
+                            }
+                            if (!tokenUsageKnown) {
+                                await client.workerCreateAgentTaskEvent(task.id, {
+                                    workerKey,
+                                    leaseToken,
+                                    kind: 'progress',
+                                    message: 'Token usage parse failed: the agent output did not contain a recognizable total token count.',
+                                });
+                            }
+                            await client.workerCreateAgentTaskEvent(task.id, {
+                                workerKey,
+                                leaseToken,
+                                kind: 'progress',
+                                phase: 'failed',
+                                message: 'Agent exited before running playdrop task done',
+                            });
+                            retainWorkspace = true;
+                            await failTaskWithRetry(client, task.id, {
+                                workerKey,
+                                leaseToken,
+                                error: 'agent_exited_without_task_done',
+                                result: agentRunResult,
+                            });
+                            await reportTelemetry('FAILED');
                         }
-                        await client.workerCreateAgentTaskEvent(task.id, {
-                            workerKey,
-                            leaseToken,
-                            kind: 'progress',
-                            phase: 'failed',
-                            message: 'Agent exited before running playdrop task done',
-                        });
-                        retainWorkspace = true;
-                        await failTaskWithRetry(client, task.id, {
-                            workerKey,
-                            leaseToken,
-                            error: 'agent_exited_without_task_done',
-                            result: agentRunResult,
-                        });
-                        await reportTelemetry('FAILED');
                     }
                 }
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                if (isAgentTaskNotRunningError(error)) {
-                    const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
-                    retainWorkspace = refreshed?.task.status === 'FAILED';
-                    console.error(`Agent task ${task.id} was already finalized${refreshed ? ` as ${refreshed.task.status}` : ''}.`);
-                }
-                else {
-                    retainWorkspace = true;
-                    console.error(`Agent task ${task.id} failed in the worker: ${message}`);
-                }
-                if (!fenced && !isAgentTaskNotRunningError(error)) {
-                    try {
-                        await failTaskWithRetry(client, task.id, {
-                            workerKey,
-                            leaseToken,
-                            error: normalizeWorkerFailureErrorCode(message),
-                            result: { workerError: message },
-                        });
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (isAgentTaskNotRunningError(error)) {
+                        const refreshed = await fetchTaskDetail(client, target, task.id).catch(() => null);
+                        retainWorkspace = refreshed?.task.status === 'FAILED';
+                        console.error(`Agent task ${task.id} was already finalized${refreshed ? ` as ${refreshed.task.status}` : ''}.`);
                     }
-                    finally {
-                        if (!telemetryReported) {
-                            try {
-                                await reportTelemetry('FAILED', message);
-                            }
-                            catch (telemetryError) {
-                                console.error(`Agent task telemetry failed: ${telemetryError instanceof Error ? telemetryError.message : String(telemetryError)}`);
+                    else {
+                        retainWorkspace = true;
+                        console.error(`Agent task ${task.id} failed in the worker: ${message}`);
+                    }
+                    if (!fenced && !isAgentTaskNotRunningError(error)) {
+                        try {
+                            await failTaskWithRetry(client, task.id, {
+                                workerKey,
+                                leaseToken,
+                                error: normalizeWorkerFailureErrorCode(message),
+                                result: { workerError: message },
+                            });
+                        }
+                        finally {
+                            if (!telemetryReported) {
+                                try {
+                                    await reportTelemetry('FAILED', message);
+                                }
+                                catch (telemetryError) {
+                                    console.error(`Agent task telemetry failed: ${telemetryError instanceof Error ? telemetryError.message : String(telemetryError)}`);
+                                }
                             }
                         }
                     }
                 }
-            }
-            finally {
-                if (heartbeatTimer) {
-                    clearInterval(heartbeatTimer);
+                finally {
+                    if (heartbeatTimer) {
+                        clearInterval(heartbeatTimer);
+                    }
+                    if (eventDrainTimer) {
+                        clearInterval(eventDrainTimer);
+                    }
+                    if (assignment
+                        && agentStartedAt
+                        && (assignment.kind === 'GAME_REVIEW' || assignment.kind === 'GAME_EVAL')) {
+                        try {
+                            const hygiene = await enforceInstrumentBrowserHygiene(assignment);
+                            console.log(`Agent task ${task.id} browser hygiene passed: ${hygiene.remainingTaskTabs} task tabs, ${hygiene.blankWindows} blank window(s).`);
+                        }
+                        catch (hygieneError) {
+                            const error = hygieneError instanceof Error ? hygieneError : new Error(String(hygieneError));
+                            console.error(`Agent task ${task.id} browser hygiene failed: ${error.message}`);
+                            retainWorkspace = true;
+                            recordFatalTaskError(error);
+                        }
+                    }
+                    activeTerminators.delete(task.id);
+                    if (workspaceDir) {
+                        await removeAgentRunCredentials(workspaceDir);
+                    }
+                    if (retainWorkspace && (0, runtime_1.readEnvBoolean)('PLAYDROP_WORKER_RETAIN_FAILED_WORKSPACE', true)) {
+                        console.error(`Retained failed task workspace for debugging: ${workspaceDir ?? '(not created)'}`);
+                    }
+                    else if (workspaceDir) {
+                        await (0, promises_1.rm)(workspaceDir, { recursive: true, force: true });
+                    }
                 }
-                if (eventDrainTimer) {
-                    clearInterval(eventDrainTimer);
+                if (sessionExpired) {
+                    throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
                 }
-                if (assignment
-                    && agentStartedAt
-                    && (assignment.kind === 'GAME_REVIEW' || assignment.kind === 'GAME_EVAL')) {
+            };
+            try {
+                let claimBackoffMs = CLAIM_BACKOFF_BASE_MS;
+                while (!shuttingDown && !quiescingForUpdate) {
+                    if (fatalTaskError) {
+                        throwWorkerRuntimeError(fatalTaskError);
+                    }
+                    if (sessionExpired) {
+                        throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
+                    }
+                    if (activeTaskRuns.size === 0
+                        && Date.now() - lastCapabilityRefreshAt >= WORKER_CAPABILITY_REFRESH_INTERVAL_MS) {
+                        capabilities = probeReadyWorkerCapabilities({
+                            npmVersion,
+                            playwright,
+                            maxParallelTasks,
+                        });
+                        lastCapabilityRefreshAt = Date.now();
+                        console.log('Worker refreshed installed agent CLI versions and model catalogs.');
+                    }
+                    if (activeTaskRuns.size >= maxParallelTasks) {
+                        await sleep(DEFAULT_POLL_INTERVAL_MS);
+                        continue;
+                    }
+                    const devPort = allocateWorkerDevPort({
+                        activePorts: activeDevPorts,
+                        basePort: workerDevPortBase,
+                        maxParallelTasks,
+                    });
+                    let claim;
                     try {
-                        const hygiene = await enforceInstrumentBrowserHygiene(assignment);
-                        console.log(`Agent task ${task.id} browser hygiene passed: ${hygiene.remainingTaskTabs} task tabs, ${hygiene.blankWindows} blank window(s).`);
+                        claim = await client.workerClaimAgentTask(buildWorkerClaimBody({
+                            workerKey,
+                            capabilities,
+                            runningTaskCount: activeTaskRuns.size,
+                        }));
+                        handleWorkerAction(claim);
+                        claimBackoffMs = CLAIM_BACKOFF_BASE_MS;
                     }
-                    catch (hygieneError) {
-                        const error = hygieneError instanceof Error ? hygieneError : new Error(String(hygieneError));
-                        console.error(`Agent task ${task.id} browser hygiene failed: ${error.message}`);
-                        retainWorkspace = true;
+                    catch (error) {
+                        // Auth (401) and forbidden (403) claim errors stop the worker; only
+                        // transient errors reach the backoff below.
+                        assertWorkerClaimErrorRetryable(error);
+                        console.error(`Agent task claim failed: ${error instanceof Error ? error.message : String(error)}`);
+                        await sleep(claimBackoffDelayMs(claimBackoffMs));
+                        claimBackoffMs = nextClaimBackoffMs(claimBackoffMs);
+                        continue;
+                    }
+                    const task = claim.task;
+                    if (!task) {
+                        if (shuttingDown || quiescingForUpdate) {
+                            break;
+                        }
+                        if (options.once) {
+                            return;
+                        }
+                        await sleep(DEFAULT_POLL_INTERVAL_MS);
+                        continue;
+                    }
+                    activeTaskIds.add(task.id);
+                    activeDevPorts.add(devPort);
+                    const taskRun = runClaimedTask(claim, devPort)
+                        .catch((error) => {
                         recordFatalTaskError(error);
+                    })
+                        .finally(() => {
+                        activeTaskRuns.delete(task.id);
+                        activeTaskIds.delete(task.id);
+                        activeDevPorts.delete(devPort);
+                    });
+                    activeTaskRuns.set(task.id, taskRun);
+                    if (options.once) {
+                        await taskRun;
+                        if (fatalTaskError) {
+                            throwWorkerRuntimeError(fatalTaskError);
+                        }
+                        return;
                     }
                 }
-                activeTerminators.delete(task.id);
-                if (retainWorkspace && (0, runtime_1.readEnvBoolean)('PLAYDROP_WORKER_RETAIN_FAILED_WORKSPACE', true)) {
-                    console.error(`Retained failed task workspace for debugging: ${workspaceDir ?? '(not created)'}`);
-                }
-                else if (workspaceDir) {
-                    await (0, promises_1.rm)(workspaceDir, { recursive: true, force: true });
+                if (activeTaskRuns.size > 0) {
+                    await Promise.allSettled(Array.from(activeTaskRuns.values()));
                 }
-            }
-            if (sessionExpired) {
-                throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
-            }
-        };
-        try {
-            let claimBackoffMs = CLAIM_BACKOFF_BASE_MS;
-            while (!shuttingDown && !quiescingForUpdate) {
                 if (fatalTaskError) {
                     throwWorkerRuntimeError(fatalTaskError);
                 }
                 if (sessionExpired) {
                     throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
                 }
-                if (activeTaskRuns.size === 0
-                    && Date.now() - lastCapabilityRefreshAt >= WORKER_CAPABILITY_REFRESH_INTERVAL_MS) {
-                    capabilities = probeReadyWorkerCapabilities({
-                        npmVersion,
-                        playwright,
-                        maxParallelTasks,
-                        pluginVersion: playdropPluginVersion,
-                    });
-                    lastCapabilityRefreshAt = Date.now();
-                    console.log('Worker refreshed installed agent CLI versions and model catalogs.');
-                }
-                if (activeTaskRuns.size >= maxParallelTasks) {
-                    await sleep(DEFAULT_POLL_INTERVAL_MS);
-                    continue;
-                }
-                const devPort = allocateWorkerDevPort({
-                    activePorts: activeDevPorts,
-                    basePort: workerDevPortBase,
-                    maxParallelTasks,
-                });
-                let claim;
-                try {
-                    claim = await client.workerClaimAgentTask(buildWorkerClaimBody({
-                        workerKey,
-                        capabilities,
-                        runningTaskCount: activeTaskRuns.size,
-                    }));
-                    handleWorkerAction(claim);
-                    claimBackoffMs = CLAIM_BACKOFF_BASE_MS;
-                }
-                catch (error) {
-                    // Auth (401) and forbidden (403) claim errors stop the worker; only
-                    // transient errors reach the backoff below.
-                    assertWorkerClaimErrorRetryable(error);
-                    console.error(`Agent task claim failed: ${error instanceof Error ? error.message : String(error)}`);
-                    await sleep(claimBackoffDelayMs(claimBackoffMs));
-                    claimBackoffMs = nextClaimBackoffMs(claimBackoffMs);
-                    continue;
-                }
-                const task = claim.task;
-                if (!task) {
-                    if (shuttingDown || quiescingForUpdate) {
-                        break;
-                    }
-                    if (options.once) {
-                        return;
-                    }
-                    await sleep(DEFAULT_POLL_INTERVAL_MS);
-                    continue;
+                if (quiescingForUpdate) {
+                    console.log('Worker quiesced for managed update. Exiting for supervisor restart.');
+                    return;
                 }
-                activeTaskIds.add(task.id);
-                activeDevPorts.add(devPort);
-                const taskRun = runClaimedTask(claim, devPort)
-                    .catch((error) => {
-                    recordFatalTaskError(error);
-                })
-                    .finally(() => {
-                    activeTaskRuns.delete(task.id);
-                    activeTaskIds.delete(task.id);
-                    activeDevPorts.delete(devPort);
-                });
-                activeTaskRuns.set(task.id, taskRun);
-                if (options.once) {
-                    await taskRun;
-                    if (fatalTaskError) {
-                        throwWorkerRuntimeError(fatalTaskError);
-                    }
+                if (shuttingDown) {
+                    await sendWorkerHealthAlertSafely({
+                        state: 'stopped',
+                        env,
+                        workerName,
+                        taskId: firstActiveTaskId(),
+                        detail: shutdownSignal,
+                    });
+                    node_process_1.default.exitCode = shutdownSignal === 'SIGINT' ? 130 : 143;
                     return;
                 }
             }
-            if (activeTaskRuns.size > 0) {
-                await Promise.allSettled(Array.from(activeTaskRuns.values()));
-            }
-            if (fatalTaskError) {
-                throwWorkerRuntimeError(fatalTaskError);
-            }
-            if (sessionExpired) {
-                throw new Error(exports.WORKER_SESSION_EXPIRED_MESSAGE);
-            }
-            if (quiescingForUpdate) {
-                console.log('Worker quiesced for managed update. Exiting for supervisor restart.');
-                return;
-            }
-            if (shuttingDown) {
+            catch (error) {
+                crashed = true;
                 await sendWorkerHealthAlertSafely({
-                    state: 'stopped',
+                    state: 'crashed',
                     env,
                     workerName,
                     taskId: firstActiveTaskId(),
-                    detail: shutdownSignal,
+                    detail: error instanceof Error ? error.message : String(error),
                 });
-                node_process_1.default.exit(shutdownSignal === 'SIGINT' ? 130 : 143);
+                throw error;
+            }
+            finally {
+                if (presenceTimer) {
+                    clearInterval(presenceTimer);
+                }
+                node_process_1.default.off('SIGINT', signalHandler);
+                node_process_1.default.off('SIGTERM', signalHandler);
+                if (options.superviseStdin) {
+                    node_process_1.default.stdin.off('end', stdinShutdownHandler);
+                    node_process_1.default.stdin.off('close', stdinShutdownHandler);
+                }
+                if (!crashed) {
+                    await sendWorkerHealthAlertSafely({
+                        state: 'stopped',
+                        env,
+                        workerName,
+                        taskId: firstActiveTaskId(),
+                    });
+                }
+                clearWorkerRuntimeState(target);
             }
-        }
-        catch (error) {
-            crashed = true;
-            await sendWorkerHealthAlertSafely({
-                state: 'crashed',
-                env,
-                workerName,
-                taskId: firstActiveTaskId(),
-                detail: error instanceof Error ? error.message : String(error),
-            });
-            throw error;
         }
         finally {
-            if (presenceTimer) {
-                clearInterval(presenceTimer);
-            }
-            node_process_1.default.off('SIGINT', signalHandler);
-            node_process_1.default.off('SIGTERM', signalHandler);
-            if (options.superviseStdin) {
-                node_process_1.default.stdin.off('end', stdinShutdownHandler);
-                node_process_1.default.stdin.off('close', stdinShutdownHandler);
-            }
-            if (!crashed) {
-                await sendWorkerHealthAlertSafely({
-                    state: 'stopped',
-                    env,
-                    workerName,
-                    taskId: firstActiveTaskId(),
-                });
-            }
-            clearWorkerRuntimeState(target);
+            releaseWorkerSupervisorLock(supervisorLock);
         }
     }, { env: options.env });
 }