Fixed in c3893b2e2 — good catch. `askAI` now spawns with `env: { ...process.env, PWD: sandboxDir, OLDPWD: sandboxDir }`, so the child's cwd-context vars point at the throwaway sandbox, not the reviewer app dir from start.sh. Added a regression test (`scrubs PWD/OLDPWD to the sandbox so env cannot point back at the bot cwd`) asserting `env.PWD === cwd`, `env.OLDPWD === cwd`, and that neither equals `process.cwd()`/parent `PWD`.