[Juliusolsson05]

Summary

• The Codex provider's listSessions was ignoring its cwd argument (registry.main.ts:23 previously read (_cwd, limit) => listCodexSessions({ limit })), so the resume picker — PathPickerModal, CommandPalette, and ⌘⇧R — silently returned every Codex session globally instead of the user's current project.
• Picking what looked like a "this project" session could land on a rollout recorded in a different cwd. cc-shell would then spawn codex --resume <foreign-id> with the user's current cwd, codex would notice the mismatch, open its upstream cwd_prompt modal, and the next bracketed-paste submission was eaten by the modal's paste-discarding event loop. The user saw an optimistic prompt in the feed and a streamPhase that never left 'submitting'.
• Plumb cwd through to listCodexSessions, normalize via path.resolve (so trailing slashes / .. segments compare equal), and drop rollouts whose session_meta.cwd doesn't match. The unfiltered global path stays for the session:list-all rendering harness.
• Submodule bump on packages/codex-headless to fix/list-sessions-cwd-filter (companion PR: https://github.com/Juliusolsson05/codex-headless/pull/new/fix/list-sessions-cwd-filter).

Test plan

• npx tsx packages/codex-headless/src/testing/regression-list-sessions-cwd-filter.ts — passes (covers filtered, unfiltered, trailing slash, .. segments, and unknown-cwd cases).
• npm run build — clean.
• In-app: ⌘⇧R while focused on a cc-shell pane shows only Codex rollouts whose session_meta.cwd is cc-shell.
• In-app: ⌘⇧R while focused on a different worktree shows only that worktree's Codex rollouts.
• In-app: a fresh resume in the same project completes a turn end-to-end (no stuck 'submitting').

Not in this PR

The upstream cwd_prompt modal is still undetected. If a session ever gets resumed across cwds via a different path (e.g. a stale persisted cwd in workspace.json that disagrees with the rollout — exactly the case the original debug bundle showed), the eat-the-prompt failure is still reachable. Follow-ups worth doing:

1. Detect cwd_prompt in packages/codex-headless (twin of TrustDialogParser) and either render it as a modal or auto-respond.
2. Peek session_meta.cwd at spawn time and refuse / warn when it disagrees with the renderer-supplied cwd.
3. Watchdog: revert streamPhase = 'submitting' after ~30s with no semantic event, with a toast, so any future unknown modal can't silently brick a pane.

🤖 Generated with Claude Code