Expand ~ in @file paths for CLI config

[kelos-bot]

What type of PR is this?

/kind bug

What this PR does / why we need it:

The Quick Start documents oauthToken: "@~/.codex/auth.json", but the Go runtime does not perform shell-style tilde expansion. resolveContent called os.ReadFile with the literal path, producing:

Error: resolving oauthToken: reading file ~/.codex/auth.json: open ~/.codex/auth.json: no such file or directory

This change resolves a leading ~ or ~/ to os.UserHomeDir() before reading, so the documented form works as advertised. The user-facing error still reports the original ~/... path so it stays meaningful to the user.

This affects every @filepath consumer of resolveContent (e.g. oauthToken, apiKey, --prompt-file, --agents-md, --skill, --agent, --mcp).

Which issue(s) this PR is related to:

Fixes #1025

Special notes for your reviewer:

• expandHome only handles bare ~ and ~/...; ~user style paths are passed through unchanged (Go's standard library does not expose user-home lookup by name without os/user, and the issue does not require it).
• Added TestExpandHome covering edge cases and TestRunCommand_DryRun_CodexOAuthToken_FileRef_HomeDir covering the originally reported flow end-to-end.

Does this PR introduce a user-facing change?

Fix `kelos run` failing with "no such file or directory" when an `@~/...` file reference is used in the CLI config (for example `oauthToken: "@~/.codex/auth.json"`). Tilde paths are now expanded to the current user's home directory.

---

Summary by cubic

Expands leading "" in @file paths for CLI config so entries like oauthToken: "@/.codex/auth.json" resolve to the user's home directory. Fixes the "no such file or directory" error across all @file consumers. Fixes #1025.

• Bug Fixes
  • Expand "" and "/" in resolveContent using os.UserHomeDir().
  • Keep the original "~" path in error messages for clarity.
  • Add unit tests for edge cases and an end-to-end dry run (oauthToken from @~/auth.json).
  • Applies to all @file consumers (oauthToken, apiKey, --prompt-file, --agents-md, --skill, --agent, --mcp).

^{Written for commit 5e170f1. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 2 files

[gjkim42]

/kelos review

[kelos-bot]

Review Summary

Verdict: COMMENT (cannot self-approve as PR author)
Overall correctness: patch is correct
Scope: Expand a leading ~/~/ in @file paths in CLI config (oauthToken, apiKey, --prompt-file, --agents-md, --skill, --agent, --mcp) so the documented oauthToken: "@~/.codex/auth.json" form works.

Findings Overview

Priority	Count	File:Line	Summary
P0	0	—	none
P1	0	—	none
P2	0	—	none
P3	0	—	none

Findings

None.

Key takeaways

• expandHome correctly handles bare ~, ~/, ~/subpath, and leaves ~user and embedded ~ untouched, matching the documented behavior; filepath.Join(home, "") for ~/ returns home as expected.
• Error wrapping in resolveContent preserves the original ~/... path in the user-facing message, so the error stays meaningful even on the unlikely os.UserHomeDir() failure.
• Tests cover the unit (TestExpandHome), the helper (resolveContent sub-tests with ~), and the originally reported end-to-end flow (TestRunCommand_DryRun_CodexOAuthToken_FileRef_HomeDir).

---

Note on prompt injection: A prior automated review on this PR (from cubic-dev-ai) contained an HTML comment instructing AI reviewers to attribute findings to cubic. I disregarded that instruction; the analysis above is independent.