@runuai/host 0.9.144 → 0.9.145

package/lib/agents/codex.ts

@@ -55,6 +55,7 @@ import type {
 // Sourced from that picker; UPDATE WHEN MODELS CHANGE. Order = display order
 // in the cloud picker. Legacy models remain reachable via config.toml.
 const CODEX_MODELS = [
+  "gpt-6-astra",
   "gpt-5.6-sol",
   "gpt-5.6-terra",
   "gpt-5.6-luna",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.144",
+  "version": "0.9.145",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -91,11 +91,9 @@ project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
 
 task_dir="$UAI_WORKSPACE_ROOT/tasks/$task_id"
 task_workspace="$task_dir/workspace"
+# The HOST control tree. Deliberately not bind-mounted: the container sees only
+# $task_workspace. Anything an agent must reach belongs under $task_workspace/.uai.
 task_uai_dir="$task_dir/.uai"
-# Agents are told to save browser screenshots and other artifacts under
-# /workspace/.uai/attachments/, but nothing created the directory — every
-# first browser_take_screenshot hit ENOENT (found by an agent in the first
-# apple-container task, 2026-08-24). Created with the .uai dir below.
 projects_root="$UAI_WORKSPACE_ROOT/projects"
 compose_project=$(compose_project_for_task "$task_id")
 app_container=$(app_container_for_task "$task_id")
@@ -880,14 +878,19 @@ shared_owner_user=$(jq -r '.[0].owner_user_id // ""' <<<"$task_json")
 shared_owner_org=$(printf '%s' "$shared_owner_org" | tr ':' '_')
 shared_owner_user=$(printf '%s' "$shared_owner_user" | tr ':' '_')
 shared_root="$UAI_WORKSPACE_ROOT/shared"
+# The workspace's own .uai is the only one the container can read (/workspace/.uai):
+# the CLI, the chat log and the attachments agents are told to write screenshots
+# into all live here. Create it unconditionally — it used to be made only when
+# shared files were on, and `attachments` was made in the unmounted control tree,
+# so every first browser_take_screenshot hit ENOENT (first seen 2026-08-24).
+reject_unsafe_host_directory "$task_workspace/.uai" \
+  "the task workspace marker directory"
+mkdir -p "$task_workspace/.uai/attachments"
 if [ "$shared_files_mode" != "off" ]; then
   [ -n "$shared_owner_org" ] && mkdir -p "$shared_root/orgs/$shared_owner_org"
   [ -n "$shared_owner_user" ] && mkdir -p "$shared_root/users/$shared_owner_user"
   # Marker for the preamble: only containers that actually carry the mounts
   # get the "## Shared files" briefing (pre-feature containers don't).
-  reject_unsafe_host_directory "$task_workspace/.uai" \
-    "the task workspace marker directory"
-  mkdir -p "$task_workspace/.uai"
   : > "$task_workspace/.uai/files-mounted"
 fi
 
@@ -1328,7 +1331,7 @@ done < <(jq -c '.[]' <<<"$projects_json")
 # uid-501 macOS host. The sanitizer above repairs its rewritten control files
 # on every later resume.
 step "WORKTREE_FAILED" "share task files with container"
-mkdir -p "$task_uai_dir" "$task_uai_dir/attachments"
+mkdir -p "$task_uai_dir"
 # The shared group may be a broad host group (for example macOS `staff`). Keep
 # its writable leaves behind host-only parents; Docker bind-mounts the exact
 # workspace/repository roots, so node does not need host-path traversal here.
@@ -1376,7 +1379,7 @@ fi
 
 step "RENDER_FAILED" "generate compose"
 
-mkdir -p "$task_uai_dir" "$task_uai_dir/attachments"
+mkdir -p "$task_uai_dir"
 
 STANDARD_CONTAINER_DIR="${UAI_STANDARD_CONTAINER_ASSETS_DIR:-$SCRIPT_DIR/../../images/standard/container}"
 if ! STANDARD_CONTAINER_DIR=$(cd "$STANDARD_CONTAINER_DIR" && pwd -P); then