OpenBSD: Codex recursively watches $HOME and keeps one file descriptor open per file/directory - gets stuck on the message "Too many open files" every 5/10 minutes

What version of Codex CLI is running?

codex-cli 0.149.1

What subscription do you have?

Plus

Which model were you using?

gpt-5.5 medium

What platform is your computer?

OpenBSD workstation 8.0 GENERIC.MP#112 amd64

What terminal emulator and version are you using (if applicable)?

XTerm

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1787926944s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.149.1",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "/home/rb/.codex/app-server-control/app-server-control.sock",
        "daemon state dir": "/home/rb/.codex/app-server-daemon",
        "mode": "ephemeral",
        "pid file": "/home/rb/.codex/app-server-daemon/app-server.pid (missing)",
        "settings": "/home/rb/.codex/app-server-daemon/settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "/home/rb/.codex/app-server-daemon/app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "/home/rb/.codex/auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "/home/rb/.codex",
        "config.toml": "/home/rb/.codex/config.toml",
        "config.toml parse": "ok",
        "cwd": "/home/rb",
        "enabled feature flags": "shell_tool, view_image, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, unbounded_connection_retries, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, in_app_chat, in_app_dictation, in_app_updates, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, resize_all_images, item_ids, skill_mcp_dependency_install, skill_search, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, remote_compaction_v2",
        "feature flag overrides": "workspace_dependencies=false",
        "feature flags enabled": "41",
        "log dir": "/home/rb/.codex/log",
        "mcp servers": "0",
        "model": "gpt-5.5",
        "model provider": "openai",
        "sqlite home": "/home/rb/.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.55.0",
      "details": {
        "PATH git #1": "/usr/local/bin/git",
        "PATH git entries": "1",
        "git build options": "git version 2.55.0; cpu: amd64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; rust: disabled; gettext: enabled; libcurl: 8.21.0; OpenSSL: LibreSSL 4.3.0; zlib: 1.3.2; SHA-1: SHA1_DC; SHA-256: SHA256_BLK; default-ref-format: files; default-hash: sha1",
        "git exec path": "/usr/local/libexec/git",
        "git version": "git version 2.55.0",
        "repo detected": "false",
        "selected git": "/usr/local/bin/git"
      },
      "remediation": null,
      "durationMs": 75
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "/usr/local/bin/codex",
        "current executable": "/usr/local/bin/codex",
        "install context": "other",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 8
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "managed proxy": "not configured",
        "proxy env vars": "none",
        "respect system proxy": "disabled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT inference URL": "https://chatgpt.com/backend-api/<redacted> reachable (HTTP 405)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 281
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 1286
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running local build on openbsd-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "/usr/local/bin/codex",
        "install method": "other",
        "platform": "openbsd-x86_64",
        "version": "0.149.1"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (system)",
      "details": {
        "search command": "rg",
        "search command readiness": "ripgrep 15.2.0",
        "search provider": "system"
      },
      "remediation": null,
      "durationMs": 14
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "/home/rb/.codex/tmp/arg0/codex-arg0tnn0Tw/codex-execve-wrapper",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "security.endpoint": {
      "id": "security.endpoint",
      "category": "security",
      "status": "ok",
      "summary": "endpoint protection is not inspected on this platform",
      "details": {
        "endpoint products": "not inspected on this platform"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "/home/rb/.codex (dir)",
        "active rollout files": "46 files, 213560607 total bytes, 4642621 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "/home/rb/.codex/goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "/home/rb/.codex/logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "/home/rb/.codex/log (dir)",
        "memories DB": "/home/rb/.codex/memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "queue DB": "/home/rb/.codex/queue_1.sqlite (file)",
        "queue DB integrity": "ok",
        "sqlite home": "/home/rb/.codex (dir)",
        "state DB": "/home/rb/.codex/state_5.sqlite (file)",
        "state DB integrity": "ok",
        "thread history DB": "/home/rb/.codex/thread_history_1.sqlite (missing)",
        "thread history DB integrity": "skipped (missing)"
      },
      "remediation": null,
      "durationMs": 268
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "46",
        "rollout DB active rows": "46",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=46",
        "rollout DB rows": "46",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=46",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 81
    },
    "system.disk": {
      "id": "system.disk",
      "category": "disk",
      "status": "ok",
      "summary": "sufficient free disk space (63.2 GiB)",
      "details": {
        "CODEX_HOME available": "63.2 GiB",
        "failure threshold": "1.0 GiB",
        "warning threshold": "5.0 GiB",
        "worktree available": "63.2 GiB"
      },
      "remediation": null,
      "durationMs": 0
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language unavailable",
      "details": {
        "EDITOR": "not set",
        "LC_CTYPE": "en_US.UTF-8",
        "VISUAL": "not set",
        "os": "OpenBSD 8.0.0 [64-bit]",
        "os language": "unavailable",
        "os type": "OpenBSD",
        "os version": "8.0.0"
      },
      "remediation": null,
      "durationMs": 7
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "DISPLAY": "present",
        "TERM": "xterm-256color",
        "color output": "disabled (stdout is not a terminal)",
        "effective locale": "en_US.UTF-8",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "false",
        "terminal": "unknown",
        "terminal size": "80x24"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "cwd",
        "terminal title project value": "rb",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "check for update on startup": "false",
        "latest version": "0.150.1",
        "latest version status": "newer version is available",
        "update action": "manual or unknown",
        "version cache": [
          "/home/rb/.codex/version.json",
          "missing"
        ]
      },
      "remediation": null,
      "durationMs": 639
    }
  }
}

What issue are you seeing?

On OpenBSD, Codex CLI appears to recursively watch the entire $HOME directory, independently of the current workspace.

Files created anywhere under $HOME are opened by the Codex process and the file descriptors remain open. In my tests, a newly created file was still open after 40 seconds of inactivity.

This can result in a very large number of open file descriptors and may eventually lead to "Too many open files".

I also observed unrelated files outside the workspace, including files under ~/.ssh, being opened by the Codex process.

I am not claiming that Codex reads or uploads the contents of those files; only that they are opened and kept open by the process.

What steps can reproduce the bug?

Environment:

• OpenBSD
• OpenAI Codex v0.149.1
• Workspace: /home/durand/MYPROJECT
• Codex binary: /usr/local/bin/codex

To isolate the behavior, I started Codex with a temporary HOME while keeping CODEX_HOME unchanged:

mkdir -p /home/durand/.codex-home-test
cd /home/durand/MYPROJECT

env \
  HOME=/home/durand/.codex-home-test \
  CODEX_HOME=/home/durand/.codex \
  /usr/local/bin/codex

Then, from another shell:

PID=$(pgrep -n codex)

Test 1 - create a file outside the artificial HOME:

touch /home/durand/codex-home-watch-test
INO=$(stat -f '%i' /home/durand/codex-home-watch-test)
fstat -p "$PID" | awk -v ino="$INO" '$6 == ino'

Result: no output.

Test 2 - create a file inside the artificial HOME:

touch /home/durand/.codex-home-test/watched-test
INO=$(stat -f '%i' /home/durand/.codex-home-test/watched-test)
fstat -p "$PID" | awk -v ino="$INO" '$6 == ino'

Result: the file is opened by the Codex process.

I repeated the check after 10 seconds and 40 seconds. The file descriptor was still open.

Test 3 - recursive behavior:

mkdir -p /home/durand/.codex-home-test/a/b/c
touch /home/durand/.codex-home-test/a/b/c/deep-test

INO=$(stat -f '%i' /home/durand/.codex-home-test/a/b/c/deep-test)
fstat -p "$PID" | awk -v ino="$INO" '$6 == ino'

Result: the deeply nested file is also opened by Codex.

Test 4 - file descriptor growth:

Before creating test files:

fstat -p "$PID" | wc -l

Result:

136

Then:

mkdir -p /home/durand/.codex-home-test/fd-test

i=1
while [ "$i" -le 20 ]; do
    touch "/home/durand/.codex-home-test/fd-test/file-$i"
    i=$((i + 1))
done

Afterwards:

fstat -p "$PID" | wc -l

Result:

157

This is an increase of 21 entries after creating 1 directory and 20 files.

This strongly suggests that the recursive filesystem watcher keeps approximately one file descriptor open per watched filesystem object on OpenBSD.

The A/B test also indicates that the behavior follows HOME, not the workspace and not CODEX_HOME.

What is the expected behavior?

Codex should not recursively watch the entire user HOME directory by default.

Filesystem watching should be limited to the active workspace and to any narrowly scoped configuration/state directories that Codex actually needs.

Unrelated files outside the workspace should not be opened simply because they are located under $HOME.

Additional information

With my normal HOME, I also found unrelated files such as:

~/.ssh/authorized_keys
~/.ssh/known_hosts

as well as files under:

~/.cache/chromium/

open by the Codex process.

Again, I have no evidence that Codex reads or uploads their contents; the observation is only that these files are opened as part of what appears to be recursive HOME filesystem watching.

The Chromium cache is also potentially significant from a resource perspective because it can contain a very large number of files, which may greatly increase the number of persistent file descriptors on OpenBSD.

No source file or test is named; begin by reproducing the Codex CLI behavior on OpenBSD and locating the recursive file-watching entry point. Trace how watches and file descriptors are retained under $HOME, then verify that extended use no longer reaches "Too many open files".