`@`-attaching a local image silently becomes a plain-text path when the session cwd differs from the process working directory

What version of Codex CLI is running?

0.155.0

What subscription do you have?

DeepSeek

Which model were you using?

No response

What platform is your computer?

Windows 10.0.20348 (Windows Server 2022)

What terminal emulator and version are you using (if applicable)?

Windows Terminal / ConPTY

Codex doctor report

What issue are you seeing?

In the TUI, selecting an image via the @ file picker becomes a real attachment ([Image #1]) only when the
OS process working directory happens to be the directory that contains the image. If the session working
directory has been changed (/cd <dir>, or codex was launched as codex -C <dir> from another directory), the
picker still lists the image and the selection “succeeds”, but the composer inserts the raw file name as plain
text (e.g. snap4.png) and the image is never sent to the model. No warning or error is shown.

What steps can reproduce the bug?

1. Put an image in a directory, e.g. C:\proj\snap4.png.
2. Launch the session such that the session cwd differs from the process cwd:
   • cd C:\Users\me then codex -C C:\proj, or
   • launch codex anywhere and run /cd C:\proj in the TUI.
     (The picker/search root and the session cwd become C:\proj; the process cwd stays C:\Users\me.)
3. Type @ followed by a few letters so the picker lists snap4.png.
4. Press Enter to select it.

What is the expected behavior?

composer shows an image attachment placeholder ([Image #1]), and the submitted turn includes the
image (input_image).

Additional information

No response

Start by reproducing the issue with the @ file picker after /cd or codex -C changes the session working directory, then trace how selection reaches the composer and becomes an input_image. Done means selecting the image shows [Image #1] and the submitted turn includes the image instead of the raw path.