`cwd` in `UnifiedExecApprovalKey` makes `ApprovedForSession` grants silently directory-scoped

🤖

What happens

when you approve a shell command "for this session," codex asks again the next time the model runs the same command from a different working directory. the session is still alive — no restart, no rotation — but the grant is effectively directory-scoped, not command-scoped.

Root cause

UnifiedExecApprovalKey (codex-rs/core/src/tools/runtimes/unified_exec.rs ~line 86) includes a cwd field:

pub struct UnifiedExecApprovalKey {
    pub environment_id: String,
    pub command: Vec<String>,
    pub cwd: PathUri,          // <-- this
    pub tty: bool,
    pub sandbox_permissions: SandboxPermissions,
    pub additional_permissions: Option<AdditionalPermissionProfile>,
}

with_cached_approval looks up approval decisions by this full key. so if the model runs cd some/subdir mid-turn and then issues the same shell command, the cwd in the key differs from the one recorded at approval time — cache miss, re-ask.

"allow for session" stores ReviewDecision::ApprovedForSession in SessionServices.tool_approvals (session.rs, initialized at Session::new). because the session itself is stable (same process, same ACP session id, no rotation), the grant is present — the lookup just misses it every time the directory changes.

Minimal repro

1. start a codex session
2. ask the model to run any shell command (e.g. ls)
3. approve it "for this session"
4. ask the model to cd somewhere and then run the same ls again
5. codex asks for approval again

What i checked / ruled out

• session rotation — i logged ACP session ids across turns; the session id is stable between the first approval and the re-ask. no session/new fires between them.
• store reset — ApprovalStore is only initialized at Session::new; there's no code path that clears it mid-session.
• "allow commands starting with…" — this option writes to ~/.codex/rules/default.rules via exec_policy.append_amendment_and_update, which is disk-persistent and cwd-independent. it works correctly across directory changes. the bug is specific to ApprovedForSession.

Proposed fix

for session-scoped grants specifically, cwd should not be part of the lookup key. the user is saying "i trust this command for the rest of this session," not "i trust this command from this directory for the rest of this session." two options i can think of:

1. when storing / looking up a ApprovedForSession decision, use a reduced key — {environment_id, command} only — and ignore cwd, tty, sandbox_permissions.
2. store session grants in a separate map keyed on just {environment_id, command}, checked before the full-key map.

happy to look at a PR if the fix shape is agreed on.