diff --git a/scripts/podx-tools.sh b/scripts/podx-tools.sh
index b4a097d..47e624e 100755
--- a/scripts/podx-tools.sh
+++ b/scripts/podx-tools.sh
@@ -5,6 +5,16 @@
 
 set -euo pipefail
 
+# Writable temp dir (override with PODX_TMP or TMPDIR); default to repo tmp/
+: "${PODX_TMP:=${TMPDIR:-$ROOT_DIR/tmp}}"
+mkdir -p "$PODX_TMP"
+
+# Portable mktemp helper that always writes inside $PODX_TMP (macOS/GNU compatible)
+_mktemp() {
+  # mktemp on macOS doesn't support -p; use path template instead
+  mktemp "$PODX_TMP/podx.XXXXXX"
+}
+
 # ---------- Pretty-print JSON (no jq required) ----------
 ppjson() {
   if command -v python3 >/dev/null 2>&1; then
@@ -212,6 +222,9 @@ print(f\"Indexed {n} document(s).\")"
     ;;
 
   # ---- OpenWebUI ----
+  # (debug) show resolved OpenWebUI URL for host-side calls
+  # echo "Using OWUI URL: $(_owui_url)" >&2
+
   owui-health)
     _require "OPENWEBUI_URL" "$OPENWEBUI_URL"
     curl -sS -o /dev/null -w "%{http_code}\n" "$(_owui_url)/api/health"
@@ -239,15 +252,30 @@ print(f\"Indexed {n} document(s).\")"
     if [ -z "$file" ] || [ ! -f "$file" ]; then echo "Usage: owui-upload </abs/path/file>" >&2; exit 1; fi
     _require "OPENWEBUI_URL" "$OPENWEBUI_URL"
     _require "OPENWEBUI_API_KEY" "$OPENWEBUI_API_KEY"
-    tmp="$(mktemp)"
+    tmp="$(_mktemp)"
     code="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" \
       -F "file=@$file" \
       -w "%{http_code}" --output "$tmp" \
-      "$(_owui_url)/api/v1/files/" || true)"
-    cat "$tmp" | ppjson
+      "$(_owui_url)/api/v1/files/"; echo $?)"
+    # If curl failed to write (e.g., (23)), fall back to capturing to a variable
+    curl_exit="${code##*$'\n'}"; http_code="$(echo "$code" | head -n1)"
+    if [ "$curl_exit" != "0" ]; then
+      RESP="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -F "file=@$file" "$(_owui_url)/api/v1/files/")"
+      echo "$RESP" | ppjson
+      echo "Upload: curl exited with code $curl_exit" >&2
+      # Try to read an HTTP code if present
+      http_code="$(python3 -c 'import sys,json; import sys
+try:
+  d=json.load(sys.stdin)
+  print(200)
+except Exception:
+  print(0)' <<<"$RESP")"
+    else
+      cat "$tmp" | ppjson
+    fi
     rm -f "$tmp"
-    if [ "$code" != "200" ]; then
-      echo "Upload failed (HTTP $code)" >&2
+    if [ "$http_code" != "200" ]; then
+      echo "Upload failed (HTTP $http_code)" >&2
       exit 1
     fi
     ;;
@@ -260,12 +288,18 @@ print(f\"Indexed {n} document(s).\")"
     fi
     _require "OPENWEBUI_URL" "$OPENWEBUI_URL"
     _require "OPENWEBUI_API_KEY" "$OPENWEBUI_API_KEY"
-    tmp_up="$(mktemp)"
-    code_up="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" \
+    tmp_up="$(_mktemp)"
+    code_up_raw="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" \
       -F "file=@$file" \
       -w "%{http_code}" --output "$tmp_up" \
-      "$(_owui_url)/api/v1/files/" || true)"
-    FILE_JSON="$(cat "$tmp_up")"
+      "$(_owui_url)/api/v1/files/"; echo $?)"
+    curl_up_exit="${code_up_raw##*$'\n'}"; code_up="$(echo "$code_up_raw" | head -n1)"
+    if [ "$curl_up_exit" != "0" ]; then
+      FILE_JSON="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -F "file=@$file" "$(_owui_url)/api/v1/files/")"
+      echo "Upload: curl exited with code $curl_up_exit" >&2
+    else
+      FILE_JSON="$(cat "$tmp_up")"
+    fi
     rm -f "$tmp_up"
     if [ "$code_up" != "200" ]; then
       echo "Upload failed (HTTP $code_up)" >&2
@@ -276,12 +310,20 @@ print(f\"Indexed {n} document(s).\")"
     if [ -z "$FILE_ID" ]; then echo "Upload failed (no file id)"; echo "$FILE_JSON" | ppjson; exit 1; fi
     KB_ID="$(_kb_id_by_name "$kb_name")"
     if [ -z "$KB_ID" ]; then echo "KB '$kb_name' not found"; exit 1; fi
-    tmp_att="$(mktemp)"
-    code_att="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
+    tmp_att="$(_mktemp)"
+    code_att_raw="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
       -d "{\"file_id\":\"$FILE_ID\"}" \
       -w "%{http_code}" --output "$tmp_att" \
-      "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add" || true)"
-    RESP="$(cat "$tmp_att")"
+      "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add"; echo $?)"
+    curl_att_exit="${code_att_raw##*$'\n'}"; code_att="$(echo "$code_att_raw" | head -n1)"
+    if [ "$curl_att_exit" != "0" ]; then
+      RESP="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
+        -d "{\"file_id\":\"$FILE_ID\"}" \
+        "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add")"
+      echo "Attach: curl exited with code $curl_att_exit" >&2
+    else
+      RESP="$(cat "$tmp_att")"
+    fi
     rm -f "$tmp_att"
     echo "$RESP" | ppjson
     if [ "$code_att" != "200" ]; then
@@ -318,12 +360,18 @@ print(f\"Indexed {n} document(s).\")"
     if [ ${#matched[@]} -eq 0 ]; then echo "No files match: $glob_pat"; exit 1; fi
     for f in "${matched[@]}"; do
       echo "[owui] uploading: $f"
-      tmp_up="$(mktemp)"
-      code_up="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" \
+      tmp_up="$(_mktemp)"
+      code_up_raw="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" \
         -F "file=@$f" \
         -w "%{http_code}" --output "$tmp_up" \
-        "$(_owui_url)/api/v1/files/" || true)"
-      FILE_JSON="$(cat "$tmp_up")"
+        "$(_owui_url)/api/v1/files/"; echo $?)"
+      curl_up_exit="${code_up_raw##*$'\n'}"; code_up="$(echo "$code_up_raw" | head -n1)"
+      if [ "$curl_up_exit" != "0" ]; then
+        FILE_JSON="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -F "file=@$f" "$(_owui_url)/api/v1/files/")"
+        echo "  upload: curl exited with code $curl_up_exit" >&2
+      else
+        FILE_JSON="$(cat "$tmp_up")"
+      fi
       rm -f "$tmp_up"
       if [ "$code_up" != "200" ]; then
         echo "  upload failed (HTTP $code_up), skipping"
@@ -332,12 +380,20 @@ print(f\"Indexed {n} document(s).\")"
       fi
       FILE_ID="$(python3 -c 'import sys,json; d=json.loads(sys.stdin.read()); print(d.get("id") or (d.get("data") or {}).get("id",""))' <<<"$FILE_JSON")"
       if [ -z "$FILE_ID" ]; then echo "  upload failed (no id), skipping"; echo "$FILE_JSON" | ppjson; continue; fi
-      tmp_att="$(mktemp)"
-      code_att="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
+      tmp_att="$(_mktemp)"
+      code_att_raw="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
         -d "{\"file_id\":\"$FILE_ID\"}" \
         -w "%{http_code}" --output "$tmp_att" \
-        "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add" || true)"
-      RESP="$(cat "$tmp_att")"
+        "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add"; echo $?)"
+      curl_att_exit="${code_att_raw##*$'\n'}"; code_att="$(echo "$code_att_raw" | head -n1)"
+      if [ "$curl_att_exit" != "0" ]; then
+        RESP="$(curl -sS -H "Authorization: Bearer $OPENWEBUI_API_KEY" -H "Content-Type: application/json" \
+          -d "{\"file_id\":\"$FILE_ID\"}" \
+          "$(_owui_url)/api/v1/knowledge/$KB_ID/file/add")"
+        echo "  attach: curl exited with code $curl_att_exit" >&2
+      else
+        RESP="$(cat "$tmp_att")"
+      fi
       rm -f "$tmp_att"
       echo "$RESP" | ppjson
       if [ "$code_att" != "200" ]; then