Home Directory (`~`) Expansion in Unix Socket Paths

What variant of Codex are you using?

App / CLI / IDE (local)

What feature would you like to see?

In developing a set of enterprise-managed permissions profile, we've run into a limitation with our ability to define unix sockets. For example, in an attempt to enable GPG signing of git commits, we would have wanted to do something like this:

# requirements.toml
[permissions.profile_name.network.unix_sockets]
"~/.gnupg/S.gpg-agent" = "allow"
"~/.gnupg/S.gpg-agent.extra" = "allow"
# or [experimental_network.unix_sockets] ...

But this is rejected, as the unix socket config seems to be expecting an absolute path:

$ codex resume
Error: Failed to resume session from [...]: thread/resume failed during TUI bootstrap:
thread/resume failed: error resuming thread: Fatal error: Failed to initialize session:
failed to start managed network proxy: failed to build network proxy state:
invalid network.allow_unix_sockets[0] (code -32603)

And for an enterprise-managed profile, needing to work across a variety of (potentially multi-user) systems, workarounds like moving/symlinking the socket to a hard-coded absolute path don't seem tenable.

Special-casing the expansion of a leading ~ in unix_socket paths would solve this specific issue. A more general solution might be supporting environment expansion in Codex configs, such as proposed in #2680.

Additional information

_No response_