Summary

Once #595 ships and Netclaw tracks a session CWD in WorkingContext, the next step is making path-taking tools (shell, file_read, file_write, file_edit, and any future tool that takes a path argument) resolve relative paths against the session CWD rather than the daemon's working directory.

This is the bigger blast-radius change — every path-taking tool needs to participate. Ships after #595 so the informational version of CWD tracking can be validated first.

Reference implementations

• OpenCode uses CWD via InstanceState.context passed through the assistant-message path stamp (packages/opencode/src/session/message-v2.ts:429-432); shell tools spawn with cwd: set from that state.
• Claude Code shell_execute is cwd-scoped to the session per the public docs — the agent observes its own working directory and the shell tool respects it.

Acceptance criteria

• shell_execute spawns child process with cwd = session CWD.
• file_read / file_write / file_edit resolve relative paths against session CWD. Absolute paths continue to work unchanged.
• A cd <path> operation (or equivalent API — TBD in design) updates session CWD persistently for the remainder of the session.
• Tools fall back to daemon CWD if session CWD is not set (backward compat for sessions that existed before Track session CWD in WorkingContext and emit as [working-context] + [project-instructions] #595 landed).
• Regression tests per tool: given a session with CWD=X, a relative path resolves against X.
• Path safety: cd cannot escape approved roots (interaction with existing tool access policy / security model — needs design).

Design questions (resolve before implementation)

• Does cd come from a dedicated CLI-style tool, or is it a side effect of a shell command execution (detecting cd in shell invocation)?
• Do we allow cd outside the daemon's configured working tree? Probably not — security boundary.
• How does the session CWD interact with sub-agent spawn? Sub-agents inherit parent CWD by default?
• Symbolic links and realpath resolution — how do we present CWD to the model (cosmetic path vs real path)?

Background

Filed as a follow-up to the compaction architecture rework. Sequenced after #595 because it has a much larger implementation surface (every path-taking tool) and deserves its own review cycle.