feat(core): let the model change working directory

[fcoury-oai]

Why

Long-running Codex tasks can move beyond the directory where the session started. The model may need to continue from another checkout, repository, generated workspace, or other directory, but tool resolution remains pinned to the original cwd. Changing cwd outside the current workspace must also update the session-scoped permission boundary coherently because every later tool call inherits the new location.

The immediate use case that motivated this PR was my sibling Git worktree workflow: Codex can create the worktree, but the active session cannot continue naturally inside it and keeps resolving tools against the original checkout. This PR adds the smallest model-facing API needed to change the active cwd, without exposing a separate general-purpose workspace-root mutation tool or app-server API.

The new tool also exposed an existing Guardian failure mode. With approvals_reviewer = "auto_review", requesting access to a sibling worktree starts a nested Guardian session on a dedicated thread. The default macOS pthread stack can overflow while that session materializes its turn context, aborting Codex with SIGABRT before the user can grant permission. This PR incorporates the focused fix from #26663 so the workflow is usable with automatic approval review.

What changed

• Add a direct-model-only set_working_directory(path) tool for sessions with exactly one execution environment.
• Reuse SessionSettingsUpdate so cwd changes retain the existing implicit workspace-root retargeting behavior.
• Request session-scoped filesystem access when the target is outside the current sandbox, then canonicalize and validate the directory through the selected environment filesystem.
• Mark session-scoped permission requests explicitly in Guardian's planned action. Guardian approvals inherit that requested scope, while ordinary permission approvals remain turn-scoped.
• Persist the updated turn context and make path-sensitive tools read the current runtime cwd and permission profile.
• Treat cwd changes as ordered tool barriers. Earlier calls finish first, later calls observe the new cwd, and suffix calls are cancelled when the change fails.
• Run Guardian approval reviews on a named thread with a 4 MiB stack. This keeps the nested review session above the default macOS pthread stack while preserving fail-closed behavior when thread creation fails.

How to Test

1. Start Codex with approvals_reviewer = "auto_review", on-request approvals, and workspace-write permissions.
2. Ask Codex to create a sibling Git worktree and continue working there.
3. Confirm that automatic approval review completes without a SIGABRT and approves the requested session scope.
4. Confirm that a subsequent pwd, shell command, patch, or image read in the same model response resolves from the new worktree.
5. Repeat with user approval review and grant only turn-scoped access. Confirm that the cwd remains unchanged and later calls from that response are not executed against the old directory.

Targeted tests:

• just test -p codex-core set_working_directory_auto_review_updates_same_batch_shell_cwd
• just test -p codex-core request_permissions_routes_to_guardian_when_reviewer_is_enabled
• just test -p codex-core environment_count_controls_environment_backed_tools

Local validation:

• just test -p codex-core set_working_directory_auto_review_updates_same_batch_shell_cwd passed.
• just test -p codex-core request_permissions_routes_to_guardian_when_reviewer_is_enabled passed.
• just test -p codex-core environment_count_controls_environment_backed_tools passed after rebasing onto current main.
• just fix -p codex-core
• just test -p codex-core compiled successfully and passed 2,725 tests. The run did not complete cleanly because this checkout's shell startup error contaminated subprocess-output assertions, two abort tests timed out, and one Guardian integration test timed out.
• The argument-comment lint source runner was blocked because its pinned Rust 1.92 nightly cannot compile the workspace's sqlx 0.9, which requires Rust 1.94. The touched Rust callsites were inspected manually.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4ebf65be2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.