Repeated home-directory resolution makes filesystem metadata requests slow

What version of Codex CLI is running?

codex-cli 0.153.2

What subscription do you have?

API

Which model were you using?

No response

What platform is your computer?

No response

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

What issue are you seeing?

Summary

with_local_policy_context eagerly resolves ~ on every call:

let user_home_dir = PathUri::from_host_native_path("~").ok();

The exec-server filesystem helper does not pass HOME through its environment allowlist. As a result, home-directory resolution falls back to getpwuid/NSS each time. Writable-root projection calls can_write_path_with_cwd repeatedly, so a single fs/getMetadata request can perform thousands of redundant home-directory lookups.

Reproduction and measurements

I reproduced this with an fs/getMetadata request whose restricted filesystem policy contains 121 entries: 30 writable roots, three read-only metadata paths under each root, and one root read entry.

On current HEAD, five runs took:

1.149s  1.127s  1.100s  1.098s  1.088s
median: 1.100s

With only the eager home-directory lookup removed, five runs took:

0.515s  0.496s  0.496s  0.495s  0.494s
median: 0.496s

That is about a 55% reduction in latency for this repro.

Possible fixes

1. Do not resolve the home directory in with_local_policy_context (preferred)

Set user_home_dir to None in this context and remove the eager lookup:

let context = FileSystemSandboxPolicyContext {
    cwd: &cwd,
    workspace_roots: std::slice::from_ref(&cwd),
    user_home_dir: None,
    temporary_directories: Some(&temporary_directories),
};

This is preferable because with_local_policy_context is used for direct access and write checks, which do not consume user_home_dir. Home expansion for ~/... deny globs is handled separately when the deny matcher is built, so that behavior remains intact. It also avoids broadening the helper process environment.

2. Allow HOME in the filesystem helper environment allowlist

Passing HOME to the helper would let dirs::home_dir use the environment instead of repeatedly falling back to NSS.

What steps can reproduce the bug?

see above

What is the expected behavior?

No response

Additional information

No response

Locate with_local_policy_context and inspect its FileSystemSandboxPolicyContext construction, focusing on the eager PathUri::from_host_native_path("~") lookup. Set user_home_dir to None there, then reproduce the 121-entry fs/getMetadata case and confirm that writable-root checks no longer trigger repeated home-directory resolution while ~/... deny-glob expansion remains separate.