Release 2.1.160 (2026-07-23)

Bug fixes

• mask host venv on cache-build path too (#2495) (#2496) The T2 venv mask (#2486) was applied to only the run mount in container.py, not the cache-build create mount in container_cache.py. Cache builds fire on cache-miss (cold rebuilds), whose setup step corrupts the bind-mounted host .venv — exactly the failure T4 (#2488) caught.

Extract a shared workspace_mount_args(repo_root) helper in container.py returning the -v {repo_root}:/workspace, -w /workspace, and the Python-gated -v /workspace/.venv mask together, and call it from BOTH build_container_args and the cache-build create args. One source of truth so a future mount site can't silently reintroduce the corruption. The cache-build create args are refactored into a named create_args local so they are unit-testable.

CI Evidence: All gates passed — full audit bundle available. Download →