CLI TUI input latency scales with number of configured workspace_roots

Summary

Codex CLI TUI input latency appears to scale with the number of configured permissions.<profile>.workspace_roots entries on Linux. With a clean CODEX_HOME and no large session/log state, a custom permission profile is fast with a minimal root set, but becomes progressively slower as more workspace_roots are configured.

This affects interactive TUI responsiveness: typed input, submit handling, and ctrl-d response can lag by seconds.

Environment

• Codex CLI: 0.143.0
• Install: npm package
• OS: Linux x86_64
• Terminal: terminal emulator
• Profile: clean test profile copied from a known-fast CODEX_HOME, with only auth/config and no old sessions/logs
• Filesystem note: in the original repro, two absolute path prefixes referred to the same project tree through path aliases/symlink/canonicalization variants, e.g. /home/user/work/... and /mnt/storage/work/...

Reproduction

Start from a clean profile with this minimal custom permission profile:

model = "gpt-5.5"
model_reasoning_effort = "high"
default_permissions = "test"

[projects."/home/user/work/project-current"]
trust_level = "trusted"

[permissions.test.filesystem]
glob_scan_max_depth = 2
":minimal" = "read"
":tmpdir" = "write"
":slash_tmp" = "write"

[permissions.test.filesystem.":workspace_roots"]
"." = "write"
".git" = "write"
".git/worktrees" = "write"

[permissions.test.network]
enabled = true

This is fast.

Then add increasing numbers of entries under:

[permissions.test.workspace_roots]
"/home/user/work/project-01" = true
"/home/user/work/project-02" = true
"/home/user/work/project-03" = true
# ...

Observed behavior:

• 1, 4, 8 workspace roots: fast
• 16 workspace roots: noticeable latency, roughly ~0.5s
• 24 workspace roots: more noticeable latency, roughly ~1s
• 31 workspace roots under one path prefix, e.g. /home/user/work/...: intermediate latency
• 61 roots including both path-prefix aliases, e.g. /home/user/work/... and /mnt/storage/work/...: severe latency, originally ~10-15s in the main profile

The slowdown happens before adding broad filesystem grants or explicit .git allowlist entries. It also reproduces when the workspace-relative .env deny globs are removed, so this does not appear to be caused primarily by **/.env* expansion.

Isolation already performed

These did not fix the slow profile:

• Deleting ~/.codex/logs_2.sqlite*
• Moving old ~/.codex/sessions
• Moving/recreating session state for a clean profile
• Disabling plugin/MCP suspects in a test profile

This did fix it:

codex -c 'default_permissions=":workspace"'

Then, with a clean CODEX_HOME, the issue was narrowed to the number of entries in permissions.test.workspace_roots.

Expected behavior

The number of configured workspace roots should not synchronously affect TUI input responsiveness. If root canonicalization/policy matching is expensive, it should be cached, moved off the TUI-critical path, or done lazily.

Actual behavior

TUI input handling becomes increasingly delayed as workspace_roots count increases.

Workaround

Keep permissions.<profile>.workspace_roots small. Do not use it as a global trusted-project registry; keep trusted projects in [projects], and add extra writable roots only per session/profile as needed.