fix: correct tilde expansion bug for ~/.auths and other paths

.gitignore

@@ -107,7 +107,6 @@ docs/sdk/node/api/
 # === Misc ===
 package-lock.json
 yarn.lock
-pnpm-lock.yaml
 *.code-workspace
 *.iml
 *.sublime-workspace

.pre-commit-config.yaml

@@ -30,7 +30,7 @@ repos:
 
       - id: cargo-clippy
         name: cargo clippy
-        entry: bash -c 'SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings'
+        entry: bash -c 'SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings && CARGO_TARGET_DIR=../../target cargo clippy --manifest-path packages/auths-node/Cargo.toml --all-targets -- -D warnings && CARGO_TARGET_DIR=../../target cargo clippy --manifest-path packages/auths-python/Cargo.toml --all-targets -- -D warnings'
         language: system
         types: [rust]
         pass_filenames: false

crates/auths-cli/src/commands/git.rs

@@ -128,7 +128,7 @@ fn handle_install_hooks(
     }
 
     let auths_repo = if let Some(override_path) = auths_repo_override {
-        override_path
+        expand_tilde(&override_path)?
     } else {
         expand_tilde(&cmd.auths_repo)?
     };
@@ -243,7 +243,7 @@ fn handle_allowed_signers(
     _attestation_blob_name_override: Option<String>,
 ) -> Result<()> {
     let repo_path = if let Some(override_path) = repo_override {
-        override_path
+        expand_tilde(&override_path)?
     } else {
         expand_tilde(&cmd.repo)?
     };
@@ -258,6 +258,13 @@ fn handle_allowed_signers(
     let output = format_allowed_signers_file(&entries);
 
     if let Some(output_path) = cmd.output_file {
+        if let Some(parent) = output_path.parent()
+            && !parent.as_os_str().is_empty()
+            && !parent.exists()
+        {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("Failed to create directory {:?}", parent))?;
+        }
         fs::write(&output_path, &output)
             .with_context(|| format!("Failed to write to {:?}", output_path))?;
         eprintln!("Wrote {} entries to {:?}", entries.len(), output_path);
@@ -349,6 +356,37 @@ mod tests {
         assert!(result.is_ok());
         let expanded = result.unwrap();
         assert!(!expanded.to_string_lossy().contains("~"));
+        assert!(expanded.ends_with(".auths"));
+    }
+
+    #[test]
+    fn test_expand_tilde_bare() {
+        let path = PathBuf::from("~");
+        let result = expand_tilde(&path).unwrap();
+        assert_eq!(result, dirs::home_dir().unwrap());
+    }
+
+    #[test]
+    fn test_expand_tilde_absolute_path_unchanged() {
+        let path = PathBuf::from("/tmp/auths");
+        let result = expand_tilde(&path).unwrap();
+        assert_eq!(result, PathBuf::from("/tmp/auths"));
+    }
+
+    #[test]
+    fn test_expand_tilde_relative_path_unchanged() {
+        let path = PathBuf::from("relative/path");
+        let result = expand_tilde(&path).unwrap();
+        assert_eq!(result, PathBuf::from("relative/path"));
+    }
+
+    #[test]
+    fn test_allowed_signers_default_repo_contains_tilde() {
+        // Verify the clap default is ~/ and that expand_tilde handles it
+        let cmd = AllowedSignersCommand::try_parse_from(["allowed-signers"]).unwrap();
+        assert_eq!(cmd.repo, PathBuf::from("~/.auths"));
+        let expanded = expand_tilde(&cmd.repo).unwrap();
+        assert!(!expanded.to_string_lossy().contains("~"));
     }
 
     #[test]

crates/auths-cli/src/commands/witness.rs

@@ -174,14 +174,30 @@ pub fn handle_witness(cmd: WitnessCommand, repo_opt: Option<PathBuf>) -> Result<
 }
 
 /// Resolve the identity repo path (defaults to ~/.auths).
+///
+/// Expands leading `~/` so paths from clap defaults work correctly.
 fn resolve_repo_path(repo_opt: Option<PathBuf>) -> Result<PathBuf> {
     if let Some(path) = repo_opt {
-        return Ok(path);
+        return expand_tilde(&path);
     }
     let home = dirs::home_dir().ok_or_else(|| anyhow!("Could not determine home directory"))?;
     Ok(home.join(".auths"))
 }
 
+fn expand_tilde(path: &std::path::Path) -> Result<PathBuf> {
+    let s = path.to_string_lossy();
+    if s.starts_with("~/") || s == "~" {
+        let home = dirs::home_dir().ok_or_else(|| anyhow!("Could not determine home directory"))?;
+        if s == "~" {
+            Ok(home)
+        } else {
+            Ok(home.join(&s[2..]))
+        }
+    } else {
+        Ok(path.to_path_buf())
+    }
+}
+
 /// Load witness config from identity metadata.
 fn load_witness_config(repo_path: &Path) -> Result<WitnessConfig> {
     let storage = RegistryIdentityStorage::new(repo_path.to_path_buf());

crates/auths-id/src/storage/layout.rs

@@ -260,10 +260,14 @@ pub fn sanitize_did_for_ref(did: &str) -> String {
 }
 
 /// Determines the actual repository path from an optional `--repo` argument.
+///
+/// Expands leading `~/` to the user's home directory so that paths like
+/// `~/.auths` work correctly (the shell does not expand tildes when they
+/// arrive via clap default values or programmatic callers).
 #[cfg(feature = "git-storage")]
 pub fn resolve_repo_path(repo_arg: Option<PathBuf>) -> Result<PathBuf, StorageError> {
     match repo_arg {
-        Some(pathbuf) if !pathbuf.as_os_str().is_empty() => Ok(pathbuf),
+        Some(pathbuf) if !pathbuf.as_os_str().is_empty() => Ok(expand_tilde(&pathbuf)?),
         _ => {
             let home = dirs::home_dir()
                 .ok_or_else(|| StorageError::NotFound("Could not find HOME directory".into()))?;
@@ -272,6 +276,23 @@ pub fn resolve_repo_path(repo_arg: Option<PathBuf>) -> Result<PathBuf, StorageEr
     }
 }
 
+/// Expand a leading `~/` or bare `~` to the user's home directory.
+#[cfg(feature = "git-storage")]
+fn expand_tilde(path: &std::path::Path) -> Result<PathBuf, StorageError> {
+    let s = path.to_string_lossy();
+    if s.starts_with("~/") || s == "~" {
+        let home = dirs::home_dir()
+            .ok_or_else(|| StorageError::NotFound("Could not find HOME directory".into()))?;
+        if s == "~" {
+            Ok(home)
+        } else {
+            Ok(home.join(&s[2..]))
+        }
+    } else {
+        Ok(path.to_path_buf())
+    }
+}
+
 /// Creates a Git namespace prefix string for a given DID.
 pub fn device_namespace_prefix(did: &str) -> String {
     format!("refs/namespaces/{}", did_to_nid(did))
@@ -362,4 +383,61 @@ mod tests {
         let parsed: StorageLayoutConfig = serde_json::from_str(&json).unwrap();
         assert_eq!(config, parsed);
     }
+
+    #[cfg(feature = "git-storage")]
+    mod tilde_expansion {
+        use super::super::*;
+        use std::path::PathBuf;
+
+        #[test]
+        fn expand_tilde_expands_home_prefix() {
+            let path = PathBuf::from("~/.auths");
+            let result = expand_tilde(&path).unwrap();
+            let home = dirs::home_dir().unwrap();
+            assert_eq!(result, home.join(".auths"));
+            assert!(!result.to_string_lossy().contains('~'));
+        }
+
+        #[test]
+        fn expand_tilde_expands_bare_tilde() {
+            let path = PathBuf::from("~");
+            let result = expand_tilde(&path).unwrap();
+            let home = dirs::home_dir().unwrap();
+            assert_eq!(result, home);
+        }
+
+        #[test]
+        fn expand_tilde_leaves_absolute_paths_unchanged() {
+            let path = PathBuf::from("/tmp/auths");
+            let result = expand_tilde(&path).unwrap();
+            assert_eq!(result, PathBuf::from("/tmp/auths"));
+        }
+
+        #[test]
+        fn expand_tilde_leaves_relative_paths_unchanged() {
+            let path = PathBuf::from("some/relative/path");
+            let result = expand_tilde(&path).unwrap();
+            assert_eq!(result, PathBuf::from("some/relative/path"));
+        }
+
+        #[test]
+        fn resolve_repo_path_expands_tilde_in_override() {
+            let result = resolve_repo_path(Some(PathBuf::from("~/.auths"))).unwrap();
+            let home = dirs::home_dir().unwrap();
+            assert_eq!(result, home.join(".auths"));
+        }
+
+        #[test]
+        fn resolve_repo_path_defaults_to_home_auths() {
+            let result = resolve_repo_path(None).unwrap();
+            let home = dirs::home_dir().unwrap();
+            assert_eq!(result, home.join(".auths"));
+        }
+
+        #[test]
+        fn resolve_repo_path_preserves_absolute_override() {
+            let result = resolve_repo_path(Some(PathBuf::from("/tmp/custom-auths"))).unwrap();
+            assert_eq!(result, PathBuf::from("/tmp/custom-auths"));
+        }
+    }
 }