From d7b166f0ad298c91e3476b490a09fa233a2360ca Mon Sep 17 00:00:00 2001
From: starr-openai <starr@openai.com>
Date: Mon, 20 Apr 2026 15:51:14 -0700
Subject: [PATCH] Use parsed apply_patch cwd for shell intercepts

Co-authored-by: Codex <noreply@openai.com>
---
 .../core/src/tools/handlers/apply_patch.rs    | 29 ++++++++++++++-----
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/codex-rs/core/src/tools/handlers/apply_patch.rs b/codex-rs/core/src/tools/handlers/apply_patch.rs
index c6c32e00bf..2de1a99e7a 100644
--- a/codex-rs/core/src/tools/handlers/apply_patch.rs
+++ b/codex-rs/core/src/tools/handlers/apply_patch.rs
@@ -402,12 +402,18 @@ impl ToolHandler for ApplyPatchHandler {
         .await
         {
             codex_apply_patch::MaybeApplyPatchVerified::Body(changes) => {
+                let action_cwd = changes.cwd.clone();
                 let (file_paths, effective_additional_permissions, file_system_sandbox_policy) =
-                    effective_patch_permissions(session.as_ref(), turn.as_ref(), &cwd, &changes)
-                        .await;
+                    effective_patch_permissions(
+                        session.as_ref(),
+                        turn.as_ref(),
+                        &action_cwd,
+                        &changes,
+                    )
+                    .await;
                 match apply_patch::apply_patch(
                     turn.as_ref(),
-                    &cwd,
+                    &action_cwd,
                     &file_system_sandbox_policy,
                     changes,
                 )
@@ -432,7 +438,7 @@ impl ToolHandler for ApplyPatchHandler {
                         let req = ApplyPatchRequest {
                             environment_id: tool_environment.environment_id.clone(),
                             environment: tool_environment.environment,
-                            cwd,
+                            cwd: action_cwd,
                             action: apply.action,
                             file_paths,
                             changes,
@@ -514,6 +520,7 @@ pub(crate) async fn intercept_apply_patch(
         .await
     {
         codex_apply_patch::MaybeApplyPatchVerified::Body(changes) => {
+            let action_cwd = changes.cwd.clone();
             session
                 .record_model_warning(
                     format!(
@@ -523,9 +530,15 @@ pub(crate) async fn intercept_apply_patch(
                 )
                 .await;
             let (approval_keys, effective_additional_permissions, file_system_sandbox_policy) =
-                effective_patch_permissions(session.as_ref(), turn.as_ref(), cwd, &changes).await;
-            match apply_patch::apply_patch(turn.as_ref(), cwd, &file_system_sandbox_policy, changes)
-                .await
+                effective_patch_permissions(session.as_ref(), turn.as_ref(), &action_cwd, &changes)
+                    .await;
+            match apply_patch::apply_patch(
+                turn.as_ref(),
+                &action_cwd,
+                &file_system_sandbox_policy,
+                changes,
+            )
+            .await
             {
                 InternalApplyPatchInvocation::Output(item) => {
                     let content = item?;
@@ -554,7 +567,7 @@ pub(crate) async fn intercept_apply_patch(
                                     "apply_patch is unavailable in this session".to_string(),
                                 )
                             })?,
-                        cwd: cwd.clone(),
+                        cwd: action_cwd,
                         action: apply.action,
                         file_paths: approval_keys,
                         changes,