fix(seatbelt): Apply the cwd to the spawn_open (in-terminal) launch path.

[Elliot (theelliotm)]

📖 Description

spawn_open never applied process.cwd. open hands the launch to Terminal,
which starts the helper in its own directory (normally $HOME), so the
resolved working directory was silently discarded — only spawn_exec set it.

The generated helper script now does what spawn_exec does before the sandbox
is applied: cd into resolve_working_directory(request) and export PWD to
it. The cd is guarded (|| exit 1) — a bare one would leave the workload
running in Terminal's directory. A directory that doesn't exist is rejected
before Terminal launches, matching the exec path's spawn failure, since
open -W reports its own status and not the helper's.

🔗 References

None.

🔍 Validation

• 5 new unit tests in seatbelt_runner: cd + PWD emitted, abort guard
  ordering, PWD assigned after caller env, single-quote escaping, and parity
  with the exec path's resolution.

• cargo test -p seatbelt_common — 106 passed.

• cargo fmt --all -- --check, cargo clippy -p seatbelt_common -p mxc_darwin --all-targets -- -D warnings — clean.

• Manual, macOS 26.6.2, against the real generated profile with cwd granted in readwritePaths:

  probe	before	after
  pwd	/Users/agos	/tmp/mxc611_work
  cat f.txt (relative)	No such file or directory	hello

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Fixes Seatbelt’s Terminal-based launch path to honor the requested working directory.

Changes:

• Resolves, validates, and applies cwd in open mode.
• Extracts shell escaping/helper generation and adds unit tests.
• Documents Seatbelt working-directory access requirements.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/backends/seatbelt/common/src/seatbelt_runner.rs	Applies cwd in the generated helper and adds tests.
docs/seatbelt/seatbelt-backend.md	Documents profile access requirements for cwd.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/backends/seatbelt/common/src/seatbelt_runner.rs:348

• is_dir() verifies only the file type, not whether this user can enter the directory. For example, metadata can identify a directory whose execute/search permission is denied; this check then passes, the helper's cd fails, and open -W still reports a clean run without executing the workload. Use a preflight child with Command::current_dir(&cwd) (or propagate the helper's status back) so an unusable cwd is reported like the exec path.

    if !Path::new(&cwd).is_dir() {

[Copilot]

🟡 Changes recommended

The preflight accepts directories lacking the search permission required by cd, allowing hidden launch failures.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

The implementation matches the exec-path semantics and includes comprehensive edge-case coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.