fix(cli): expand ~ in path arguments outside scan

[rohanpoudel2]

Fixes #57

Problem

codex-security scan expands a leading ~ in its path arguments, but every other subcommand called bare resolve() on user-supplied paths, so ~ was treated as a literal directory segment:

$ codex-security bulk-scan repos.csv --output-dir ~/security-scans

writes to ./~/security-scans and leaves a stray directory named ~ in the working directory. Beyond writing to the wrong place, resuming a bulk scan from a different working directory then fails to find the earlier ledger, because the literal ~ path does not resolve consistently.

This affects any shell that does not pre-expand ~ in a program's arguments, which is how the issue was hit on Windows.

Change

A small wrapper next to the existing helper, as suggested in the issue:

function resolveCliPath(directory: string, value: string): string {
  return resolve(directory, expandHome(value));
}

applied at the call sites that genuinely lacked expansion:

• scans list <repository> and --scan-root (two sites)
• install-hook <repository>
• bulk-scan <input-csv> and --output-dir
• export <scan-dir>, --output, --source-root
• the interactive bulk-scan wizard's output-directory prompt, in src/bulk-scan-discovery.ts

Sites deliberately left unchanged

I checked every reported site against the code rather than taking the list as given:

• scan's repository and --path arguments already expand, through expandHome in src/targets.ts.
• --output-dir (for scan), --plugin-path and --python already expand deeper in src/runtime.ts, in validateOutputDir, resolvePluginPath and usablePython. Expanding them again in the CLI would be redundant.
• validate and patch take a positional argument that is either literal finding text or a file path, and a stat miss safely falls back to treating it as text. It is not in the reported list and has no stray-directory failure mode, so I left it alone rather than widening scope.

src/bulk-scan-discovery.ts imports expandHome from ./runtime.js directly; runtime.ts does not depend on the CLI or on the discovery module, so this adds no import cycle.

Verification

Five regression tests across cli.test.ts, cli-workbench.test.ts, cli-export.test.ts and bulk-scan-discovery.test.ts. Before the fix all five failed with the exact symptom — resolved paths like /current/repository/~/project instead of <home>/project, and install-hook/bulk-scan exiting 2 instead of 0. After the fix all five pass.

The tests stub node:os with mock.module rather than mutating process.env.HOME, because os.homedir() does not re-read a live-mutated HOME in-process under Bun. That mirrors the existing mock.module usage in tests-ts/api.test.ts.

Full suite: 722 pass / 5 skip / 0 fail (717 baseline plus the 5 new tests, no regressions). pnpm run types and pnpm run format are clean.

[mldangelo-oai]

@codex review exact head 25349d1

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 25349d19b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Expand bulk-scan knowledge-base paths too

When a shell passes ~ literally, bulk-scan ... --knowledge-base ~/docs still forwards the option unchanged as knowledgeBasePaths. prepareKnowledgeBase() subsequently calls resolve(requested) without home expansion, so it looks for <cwd>/~/docs and the repository scans fail even though the CSV and output-directory arguments now resolve correctly. Apply the same home expansion to each bulk-scan knowledge-base path before invoking runMultiscan.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 25349d19b2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.