@runuai/host 0.9.143 → 0.9.145

package/lib/agents/codex.ts

@@ -55,6 +55,7 @@ import type {
 // Sourced from that picker; UPDATE WHEN MODELS CHANGE. Order = display order
 // in the cloud picker. Legacy models remain reachable via config.toml.
 const CODEX_MODELS = [
+  "gpt-6-astra",
   "gpt-5.6-sol",
   "gpt-5.6-terra",
   "gpt-5.6-luna",

package/lib/orchestrator.ts

@@ -137,6 +137,7 @@ import type {
   HostEvent,
 } from "../src/protocol";
 import {
+  type DeliveryOrigin,
   type TaskStartStage,
   HOST_ACCOUNT_SCOPE,
   MAX_AGENT_ID_CHARS,
@@ -2333,6 +2334,9 @@ export class Orchestrator {
     taskId: string,
     agentId: string,
     text: string,
+    /** ADR-141 rung 1: only a human turn is shadow-routed. An older cloud
+     *  sends nothing, which reads as "not human" and keeps the pass off. */
+    origin?: DeliveryOrigin,
   ): Promise<{ ok: true } | { ok: false; error: string }> {
     // Slash command: re-run GitHub auth setup for this task (ADR-027). Handled
     // before sessions so it works even when an agent isn't ready.
@@ -2372,8 +2376,11 @@ export class Orchestrator {
     }
     // ADR-141 rung 1: after the turn is on its way, ask what Auto would have
     // done and report it. Fire-and-forget by design — it must never delay or
-    // fail a delivery, so every error ends here.
-    if (channel.routingShadow) {
+    // fail a delivery, so every error ends here. HUMAN turns only: idle
+    // nudges, secretary dispatches to crew and wake redeliveries all arrive
+    // through this same command, and classifying them would poison the very
+    // data the shadow pass exists to collect.
+    if (channel.routingShadow && origin === "human") {
         void this.shadowRouteDelivery(channel, agentId, text).catch((err) => {
         console.warn(
           `[routing] shadow pass failed for ${channel.taskId}/${agentId}: ${

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.143",
+  "version": "0.9.145",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -91,11 +91,9 @@ project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
 
 task_dir="$UAI_WORKSPACE_ROOT/tasks/$task_id"
 task_workspace="$task_dir/workspace"
+# The HOST control tree. Deliberately not bind-mounted: the container sees only
+# $task_workspace. Anything an agent must reach belongs under $task_workspace/.uai.
 task_uai_dir="$task_dir/.uai"
-# Agents are told to save browser screenshots and other artifacts under
-# /workspace/.uai/attachments/, but nothing created the directory — every
-# first browser_take_screenshot hit ENOENT (found by an agent in the first
-# apple-container task, 2026-08-24). Created with the .uai dir below.
 projects_root="$UAI_WORKSPACE_ROOT/projects"
 compose_project=$(compose_project_for_task "$task_id")
 app_container=$(app_container_for_task "$task_id")
@@ -880,14 +878,19 @@ shared_owner_user=$(jq -r '.[0].owner_user_id // ""' <<<"$task_json")
 shared_owner_org=$(printf '%s' "$shared_owner_org" | tr ':' '_')
 shared_owner_user=$(printf '%s' "$shared_owner_user" | tr ':' '_')
 shared_root="$UAI_WORKSPACE_ROOT/shared"
+# The workspace's own .uai is the only one the container can read (/workspace/.uai):
+# the CLI, the chat log and the attachments agents are told to write screenshots
+# into all live here. Create it unconditionally — it used to be made only when
+# shared files were on, and `attachments` was made in the unmounted control tree,
+# so every first browser_take_screenshot hit ENOENT (first seen 2026-08-24).
+reject_unsafe_host_directory "$task_workspace/.uai" \
+  "the task workspace marker directory"
+mkdir -p "$task_workspace/.uai/attachments"
 if [ "$shared_files_mode" != "off" ]; then
   [ -n "$shared_owner_org" ] && mkdir -p "$shared_root/orgs/$shared_owner_org"
   [ -n "$shared_owner_user" ] && mkdir -p "$shared_root/users/$shared_owner_user"
   # Marker for the preamble: only containers that actually carry the mounts
   # get the "## Shared files" briefing (pre-feature containers don't).
-  reject_unsafe_host_directory "$task_workspace/.uai" \
-    "the task workspace marker directory"
-  mkdir -p "$task_workspace/.uai"
   : > "$task_workspace/.uai/files-mounted"
 fi
 
@@ -1328,7 +1331,7 @@ done < <(jq -c '.[]' <<<"$projects_json")
 # uid-501 macOS host. The sanitizer above repairs its rewritten control files
 # on every later resume.
 step "WORKTREE_FAILED" "share task files with container"
-mkdir -p "$task_uai_dir" "$task_uai_dir/attachments"
+mkdir -p "$task_uai_dir"
 # The shared group may be a broad host group (for example macOS `staff`). Keep
 # its writable leaves behind host-only parents; Docker bind-mounts the exact
 # workspace/repository roots, so node does not need host-path traversal here.
@@ -1376,7 +1379,7 @@ fi
 
 step "RENDER_FAILED" "generate compose"
 
-mkdir -p "$task_uai_dir" "$task_uai_dir/attachments"
+mkdir -p "$task_uai_dir"
 
 STANDARD_CONTAINER_DIR="${UAI_STANDARD_CONTAINER_ASSETS_DIR:-$SCRIPT_DIR/../../images/standard/container}"
 if ! STANDARD_CONTAINER_DIR=$(cd "$STANDARD_CONTAINER_DIR" && pwd -P); then

package/src/index.ts

@@ -1198,7 +1198,7 @@ export const hostCommands: HostCommands = {
     });
   },
 
-  async channelDeliver(ctx, taskId, agentId, text) {
+  async channelDeliver(ctx, taskId, agentId, text, origin) {
     logCommand(ctx, "channelDeliver", taskId, agentId);
     const runtimeFailure = runtimeUnavailable();
     if (runtimeFailure) return runtimeFailure;
@@ -1206,7 +1206,7 @@ export const hostCommands: HostCommands = {
       // An inbound turn is activity: the idle veto must cover the gap between
       // this delivery landing and the agent's first output event.
       getOrchestrator().markChannelActivity(taskId);
-      const result = await getOrchestrator().deliver(taskId, agentId, text);
+      const result = await getOrchestrator().deliver(taskId, agentId, text, origin);
       if (!result.ok) {
         return {
           ok: false,

package/src/protocol.ts

@@ -1467,6 +1467,11 @@ export interface HostCommands {
     taskId: string,
     agentId: string,
     text: string,
+    /** ADR-141 rung 1: who authored this delivery. Only "human" turns are
+     *  shadow-routed — nudges, secretary dispatches to crew and wake
+     *  redeliveries are not messages a router would ever classify. Absent
+     *  from an older cloud, which the host reads as "not a human turn". */
+    origin?: DeliveryOrigin,
   ): Promise<HostCommandResult<void>>;
   channelResolvePermission(
     ctx: CommandContext,
@@ -1717,6 +1722,9 @@ export type CloudToHost =
   | { kind: "lease.grant"; opId: string; lease: TaskLease }
   | { kind: "lease.deny"; opId: string; error: string };
 
+/** ADR-141: provenance of a channelDeliver. */
+export type DeliveryOrigin = "human" | "agent" | "system";
+
 /** One MCP-connection operation (ADR-057), executed by the host. */
 /**
  * ADR-133: the short-lived AWS credentials a task machine runs on — an STS