What changed
Open WebUI 0.13.3 lets automations select a coding agent, terminal and working folder, then validates that context before a scheduled run. Chats can switch terminal and folder after starting, while fixes keep Files tabs aligned and prevent terminal agents from leaking into unsupported model selectors.
Why it matters
Scheduled coding agents turn terminal identity and directory scope into durable automation state. Validating the saved context and narrowing where terminal agents appear reduce ambiguity, but stale credentials, moved folders and duplicated scheduled actions remain operational risks.
What to do
Back up the database, schedule a disposable agent in a least-privilege folder, move or revoke that terminal before launch and switch folders mid-chat. Verify the run stops safely, files follow the visible scope and no unsupported selector can retain the agent.
Caveat
The signed release notes are maintainer evidence and do not prove containment across every terminal, agent or multi-instance deployment. Scheduled runs can still modify real files or services if the saved environment has broad authority.