Bug: `directory` parameter in CreateSessionRequest is not used when spawning agent processes

[glishijie]

Description

The directory field in CreateSessionRequest is accepted by the API and stored in SessionState, but it's never passed to the agent process. This means agents always run in sandbox-agent's current working directory instead of the requested directory.

Current Behavior

When creating a session via POST /v1/sessions/{session_id} with a directory parameter:

curl -X POST http://localhost:2468/v1/sessions/my-session \
  -H "Content-Type: application/json" \
  -d '{
    "agent": "claude",
    "directory": "/path/to/project"
  }'

The agent process ignores the directory and runs in std::env::current_dir() (the directory where sandbox-agent was started).

Expected Behavior

The agent should execute with its working directory set to the requested directory path.

Root Cause

The directory field is lost during the conversion from SessionState to SessionSnapshot:

1. ✅ CreateSessionRequest.directory is received (router.rs:4701)
2. ✅ Stored in SessionState.directory (router.rs:504)
3. ❌ Not included in SessionSnapshot struct (router.rs:8129-8137)
4. ❌ Not set in SpawnOptions.working_dir by build_spawn_options() (router.rs:5711-5765)
5. Falls back to default in agent-management (agents.rs:207-212)

Code Locations

1. SessionSnapshot missing directory field:

// server/packages/sandbox-agent/src/router.rs:8129-8137
#[derive(Clone, Debug)]
struct SessionSnapshot {
    session_id: String,
    agent: AgentId,
    agent_mode: String,
    permission_mode: String,
    model: Option<String>,
    variant: Option<String>,
    native_session_id: Option<String>,
    // ❌ Missing: directory: Option<String>,
}

2. From implementation doesn't copy directory:

// server/packages/sandbox-agent/src/router.rs:8139-8151
impl From<&SessionState> for SessionSnapshot {
    fn from(session: &SessionState) -> Self {
        Self {
            // ...
            native_session_id: session.native_session_id.clone(),
            // ❌ Missing: directory: session.directory.clone(),
        }
    }
}

3. build_spawn_options doesn't set working_dir:

// server/packages/sandbox-agent/src/router.rs:5711-5765
fn build_spawn_options(
    session: &SessionSnapshot,
    prompt: String,
    credentials: ExtractedCredentials,
) -> SpawnOptions {
    let mut options = SpawnOptions::new(prompt);
    options.model = session.model.clone();
    options.variant = session.variant.clone();
    // ...
    // ❌ Missing: options.working_dir = session.directory.as_ref().map(PathBuf::from);
    options
}

Proposed Fix

Add directory to the data flow:

1. Add directory: Option<String> field to SessionSnapshot struct
2. Copy directory in From<&SessionState> for SessionSnapshot implementation
3. Set options.working_dir in build_spawn_options():

   options.working_dir = session.directory.as_ref().map(PathBuf::from);

Impact

• Affects all agents (Claude, Codex, OpenCode, Amp)
• Breaks use cases where users need agents to run in specific project directories
• API accepts the parameter but silently ignores it (surprising behavior)

Workaround

Currently, users must start sandbox-agent in the desired working directory, which doesn't work for multi-session scenarios with different directories.

[linear]

RVT-5904

[ridafkih]

@NathanFlurry Once I have the go-ahead you're okay moving forward on this, I can go ahead and take it as well

[NathanFlurry]

this seems pretty serious, will take look first thing in the morning. thx