codex exec resume overrides persisted cwd when -C is omitted

What version of Codex is running?

Current source at 725b3a44f8d13c8d2f019e1ecbc8ab686466b950; reproduced with standalone Codex 0.149.1.

What happened?

A thread created with an explicit managed-worktree cwd can silently rebind to the caller's current repository workspace when it is resumed without -C.

The app-server protocol already supports the desired behavior: ThreadResumeParams.cwd is optional, and cold resume falls back to the persisted SessionMeta.cwd. However, codex-rs/exec/src/lib.rs currently builds the resume request with:

cwd: Some(config.cwd.to_string_lossy().to_string()),
runtime_workspace_roots: Some(config.workspace_roots.clone()),

After configuration resolution, this no longer distinguishes an explicit -C from the process cwd used as a default. The resume request therefore overrides the persisted checkout even when the user did not request a rebind.

This becomes especially visible after a proxy disconnect or app-server restart, when the thread is cold-resumed from history.

Reproduction

codex exec -C /path/to/managed-worktree "start a task and print pwd"
# Save the thread id, then reconnect or restart app-server.
cd /path/to/repository-workspace
codex exec resume <thread-id> "print pwd"

Expected: the resumed task remains in /path/to/managed-worktree.

Observed: the resume request supplies /path/to/repository-workspace and the task rebinds there.

Suggested correction

Retain whether -C was explicitly supplied when constructing the exec resume request:

• omit ThreadResumeParams.cwd when -C was not supplied;
• omit the implicit runtimeWorkspaceRoots override in the same case;
• preserve explicit -C as an intentional rebind;
• apply the same rule to any Desktop remote-resume request builder.

The remote TUI path already follows this model by omitting cwd unless there is an explicit remote override.

Acceptance coverage

1. Implicit codex exec resume emits no cwd or workspace-root override.
2. Explicit -C emits both and still intentionally rebinds.
3. Cold resume after app-server restart preserves the persisted checkout.
4. Warm reconnect to an idle loaded thread preserves the checkout.
5. Sandboxed Git and built-in apply_patch continue in the original managed worktree after reconnect.

Start in codex-rs/exec/src/lib.rs and trace how configuration resolution constructs the resume request, especially ThreadResumeParams.cwd and runtime_workspace_roots. Compare the remote TUI resume request builder, then exercise implicit and explicit -C resumes across cold and warm reconnects. Done means omitted -C preserves the persisted checkout while explicit -C still rebinds it, including sandboxed Git and apply_patch behavior.