Shell commands include workdir in command string

What version of Codex is running?

codex-cli 0.65.0

What subscription do you have?

plus

Which model were you using?

gpt-5.1-codex

What platform is your computer?

Linux 6.12.43+deb13-amd64 x86_64 unknown

What issue are you seeing?

Shell commands are failing because the workdir metadata is appended to the command string instead of being passed as the working directory. The CLI emitted:

bash -lc "rg -n worktree","workdir":"/root/code/codex"}

The ,"workdir":"/root/code/codex"} fragment becomes part of the command text, so bash treats it as an argument and errors (e.g., bash: line 1: ,workdir:/root/code/codex}: No such file or directory).

What steps can reproduce the bug?

1. Use the Codex CLI to run a shell command with a workdir set (e.g., rg -n worktree in /root/code/codex).
2. The CLI emits bash -lc "<command>","workdir":"<path>"} and passes it to bash, which fails because the trailing workdir fragment is interpreted as part of the command string.

What is the expected behavior?

workdir should be used only to set the working directory for the spawned process, not appended to the shell command string or shown in the command text.

Additional information

• The current behavior both breaks otherwise-valid commands and unnecessarily exposes the workdir value in the command invocation.
• Observed repeatedly when running commands from the CLI.