apply_patch ignores active worktree context / lacks workdir, causing patches to land in the wrong Git worktree

What issue are you seeing?

Component
OpenAI Codex tooling: apply_patch tool / workspace routing

Severity
Medium-high. Can silently modify the wrong checkout in multi-worktree workflows.

Environment
Windows / PowerShell
Repo: D:\source\TradeTrack2
Primary checkout: D:\source\TradeTrack2
Isolated worktree: D:\source\TradeTrack2\.worktrees\codex-quoteservice-composition-test

What Happened
During an isolated-worktree task, shell commands were consistently executed with:
workdir = D:\source\TradeTrack2\.worktrees\codex-quoteservice-composition-test

However, an apply_patch call using a relative path:
tests/PortfolioAnalyzer.QuoteService.Tests/QuoteServiceCompositionRootSmokeTests.cs

modified the same path in the primary checkout:
D:\source\TradeTrack2\tests\PortfolioAnalyzer.QuoteService.Tests\QuoteServiceCompositionRootSmokeTests.cs

instead of the active worktree:
D:\source\TradeTrack2\.worktrees\codex-quoteservice-composition-test\tests\PortfolioAnalyzer.QuoteService.Tests\QuoteServiceCompositionRootSmokeTests.cs

Expected Behavior
apply_patch should either:

1. Accept and honor a workdir parameter like shell_command does, or
2. Honor the current task/worktree context, or
3. Require absolute paths when multiple worktrees are present, or
4. Warn/refuse when a relative patch would apply outside the active working directory.

Actual Behavior
apply_patch applied the patch relative to the original checkout without indicating that target root. This caused an accidental edit in the wrong worktree.

Impact
In a dirty repo or shared main checkout, this can:

• modify unrelated local work,
• create misleading test results,
• cause accidental commits from the wrong checkout,
• violate the user’s explicit “work in a separate worktree” instruction.

Reproduction

1. Start in repo: D:\source\myapp2
2. Create worktree: D:\source\myapp2\.worktrees\example
3. Run shell commands with workdir set to the worktree.
4. Call apply_patch with a relative path that exists in both checkouts.
5. Observe patch lands in the primary checkout rather than the shell workdir/worktree.

Suggested Fix
Add a workdir field to apply_patch and require Codex to pass it, matching shell_command behavior.

Additional safeguards:

• Display resolved absolute target paths before applying.
• Reject relative paths when more than one Git worktree for the repo exists unless workdir is explicit.
• Emit a warning if the resolved target path is outside the most recent shell_command workdir.
• Include the resolved patch root in tool output.

Workaround
Use path-qualified patch targets such as:
.worktrees/codex-quoteservice-composition-test/tests/...

or avoid apply_patch for worktree-relative edits until the tool supports workdir.

What steps can reproduce the bug?

Reproduction

1. Start in repo: D:\source\myapp2
2. Create worktree: D:\source\myapp2\.worktrees\example
3. Run shell commands with workdir set to the worktree.
4. Call apply_patch with a relative path that exists in both checkouts.
5. Observe patch lands in the primary checkout rather than the shell workdir/worktree.

What is the expected behavior?

write to the active worktree the agent is working in

Additional information

_No response_