fix(fs)!: default macOS config dir to Application Support

cli-engine/docs/auth.md

@@ -237,7 +237,7 @@ Tokens are persisted through the injectable `CredentialStorage` trait rather tha
 
 - **`keyring`** (`KeyringStorage`, default) — system keychain only (macOS Keychain, Linux Secret Service, Windows Credential Manager). A keychain failure is a hard error; no file is written.
 - **`auto`** (`AutoStorage`) — try the keychain, and transparently fall back to an unencrypted file when the keychain backend is unavailable.
-- **`file`** (`FileStorage`) — never contact the keychain. Tokens are written as **unencrypted JSON** to `<config-base>/<app_id>/credentials/<provider>-<env>.json` (`0600` on Unix), where `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/.config`, or `%APPDATA%`.
+- **`file`** (`FileStorage`) — never contact the keychain. Tokens are written as **unencrypted JSON** to `<config-base>/<app_id>/credentials/<provider>-<env>.json` (`0600` on Unix), where `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/Library/Application Support` (macOS), `$HOME/.config` (other Unix), or `%APPDATA%` (Windows).
 
 ### Selecting a mode
 

cli-engine/docs/concepts.md

@@ -360,7 +360,7 @@ where `${PREFIX}` is the app id uppercased with non-alphanumerics replaced by `_
 
 ## Configuration File
 
-cli-engine provides a single per-application TOML config file that **consumer CLIs share with the engine**. It lives at `<config-base>/<app_id>/config.toml`, where `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/.config`, or `%APPDATA%`. Loading is best-effort: a missing/unreadable/malformed file yields an empty config (a warning is logged for malformed) rather than failing the
+cli-engine provides a single per-application TOML config file that **consumer CLIs share with the engine**. It lives at `<config-base>/<app_id>/config.toml`, where `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/Library/Application Support` (macOS), `$HOME/.config` (other Unix), or `%APPDATA%` (Windows). Loading is best-effort: a missing/unreadable/malformed file yields an empty config (a warning is logged for malformed) rather than failing the
 command.
 
 Engine-reserved settings live in documented top-level tables (today `[credentials]` and `[output]`); the consumer CLI owns **every other top-level table**:

cli-engine/src/auth/pkce.rs

@@ -14,7 +14,8 @@
 //!   keychain backend is unavailable.
 //! - `File`: never contact the keychain; store unencrypted JSON under
 //!   `<config-base>/<app>/credentials/<provider>-<env>.json`, where
-//!   `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/.config`, or `%APPDATA%`.
+//!   `<config-base>` is `$XDG_CONFIG_HOME`, `$HOME/Library/Application
+//!   Support` (macOS), `$HOME/.config` (other Unix), or `%APPDATA%` (Windows).
 //!
 //! See [`CredentialStore`](crate::config::CredentialStore). A backend can also be
 //! injected directly with

cli-engine/src/cli.rs

@@ -967,6 +967,10 @@ impl Cli {
 
         let mut middleware = Middleware::new();
         middleware.app_id = config.app_id.clone();
+        // One-time, macOS-only: move any pre-existing $HOME/.config/<app_id>
+        // contents to $HOME/Library/Application Support/<app_id> before the
+        // config file below is loaded from its (possibly new) location.
+        crate::fs::migrate_macos_config_dir(&config.app_id);
         // Load the per-application config file once at startup; cloned into each
         // per-run middleware so handlers and module registration share it.
         middleware.config = Arc::new(crate::config::ConfigFile::load(&config.app_id));

cli-engine/src/config.rs

@@ -2,7 +2,8 @@
 //!
 //! cli-engine reads an optional per-application TOML config file at
 //! `<config-base>/<app_id>/config.toml`, where `<config-base>` is
-//! `$XDG_CONFIG_HOME`, `$HOME/.config`, or `%APPDATA%` (see
+//! `$XDG_CONFIG_HOME`, `$HOME/Library/Application Support` (macOS),
+//! `$HOME/.config` (other Unix), or `%APPDATA%` (Windows) (see
 //! [`config_base_dir`](crate::fs::config_base_dir)).
 //! Loading is best-effort: a missing file yields defaults, and a malformed file
 //! logs a warning and falls back to defaults rather than failing the command.