diff --git a/src/roots.test.ts b/src/roots.test.ts
index 90bdaa243..69cfb5be0 100644
--- a/src/roots.test.ts
+++ b/src/roots.test.ts
@@ -21,8 +21,43 @@ assert.equal(
 );
 
 assert.equal(
-  resolveAllowedPath("~/file.txt", "/workspace", ["/workspace"]),
-  resolve("/workspace", "~/file.txt"),
+  resolveAllowedPath("~/personal/devspace", "/some/other/cwd", [join(home, "personal")]),
+  resolve(home, "personal", "devspace"),
+);
+
+assert.equal(
+  resolveAllowedPath("~/personal/devspace", home, [join(home, "personal")]),
+  resolve(home, "personal", "devspace"),
+);
+
+assert.equal(
+  resolveAllowedPath("~/personal/devspace", "/some/other/cwd", ["~/personal"]),
+  resolve(home, "personal", "devspace"),
+);
+
+assert.throws(
+  () => resolveAllowedPath("~/outside", home, [join(home, "personal")]),
+  /Path is outside allowed roots/,
+);
+
+assert.throws(
+  () => resolveAllowedPath("~/file.txt", "/workspace", ["/workspace"]),
+  /Path is outside allowed roots/,
+);
+
+assert.equal(
+  resolveAllowedPath("relative/path", "/workspace", ["/workspace"]),
+  resolve("/workspace", "relative/path"),
+);
+
+assert.equal(
+  resolveAllowedPath("./file.txt", join(home, "personal"), [join(home, "personal")]),
+  resolve(home, "personal", "file.txt"),
+);
+
+assert.throws(
+  () => resolveAllowedPath("../outside", join(home, "personal"), [join(home, "personal")]),
+  /Path is outside allowed roots/,
 );
 
 if (process.platform === "win32") {
diff --git a/src/roots.ts b/src/roots.ts
index 284726f49..28118f2c9 100644
--- a/src/roots.ts
+++ b/src/roots.ts
@@ -42,7 +42,8 @@ export function assertAllowedPath(path: string, allowedRoots: string[]): string
 }
 
 export function resolveAllowedPath(inputPath: string, cwd: string, allowedRoots: string[]): string {
-  const absolutePath = resolve(cwd, inputPath);
+  const expanded = expandHomePath(inputPath);
+  const absolutePath = isAbsolute(expanded) ? resolve(expanded) : resolve(cwd, expanded);
   return assertAllowedPath(absolutePath, allowedRoots);
 }