Resuming a session silently switches the agent cwd to the caller’s directory

What version of Codex is running?

codex-cli 0.44.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

1. From /path/to/project, start codex and note the welcome banner shows cwd: /path/to/project.
2. Exit the session (/quit).
3. Change directories in the terminal: cd /tmp.
4. Resume the previous session with codex resume --last.
5. Observe the banner or run /status: the reported cwd is now /tmp.
6. Enter review mode with /review (the review prompt lacks the "Always set the workdir" guard) and give instructions such as “Run pwd and create probe.txt in the current directory.” Approve the resulting exec request. (Alternatively, resume with an experimental_instructions_file override when using API-key auth.)
7. Confirm the command executed under /tmp by checking the file location.

What is the expected behavior?

Resuming a session should restore (or at least prompt to restore) the cwd recorded in the rollout so the agent stays inside the original workspace.

What do you see instead?

The resumed session unconditionally adopts the shell’s current directory. Sandbox writable roots and tool-call resolution follow the new cwd, widening access to unintended paths such as $HOME or /.

Additional information

• Config::load_from_base_config_with_overrides defaults to std::env::current_dir() when no -C flag is provided, and codex resume does not override it.
• TurnContext uses this cwd for tool-call workdir resolution and sandbox roots, so the change has real security impact.
• Relevant code: codex-rs/core/src/config.rs:950, codex-rs/core/src/rollout/recorder.rs:132, codex-rs/core/src/codex.rs:280, codex-rs/core/src/codex.rs:2607, codex-rs/core/src/codex.rs:2871.
• The default gpt_5_codex_prompt.md enforces "Always set the workdir" so the model typically continues using the original path; switching to review mode (or providing an experimental instructions file over API key auth) removes that guard, making the sandbox shift observable and exploitable.
• Rationale: users rely on Codex to respect project boundaries; silently widening the sandbox undermines that promise and could expose sensitive files.
• Concern: approvals issued post-resume may grant actions on directories the user never intended, which is especially risky in shared environments or when Codex has credentials cached in $HOME.

(Code references with rust-v0.44.0 tag checked out)