fix(documents): default file picker to cwd, not ~/Downloads

The document file picker defaulted to the system Downloads folder
via `xdg.UserDirs.Download`. That's non-deterministic — demos, tapes,
and tutorials would pick up whatever happens to sit at the top of
the recorder's real Downloads, producing non-reproducible captures
and risking PII leaks in committed demo videos.

Default to the current working directory instead. Explicit
`documents.file_picker_dir` / `MICASA_DOCUMENTS_FILE_PICKER_DIR`
still wins. Users who want Downloads as the starting location set
it explicitly.

Author: cpcloud

internal/config/config.go

@@ -256,24 +256,19 @@ type Documents struct {
 	CacheTTL *Duration `toml:"cache_ttl,omitempty" deprecated:"cache_ttl_days" deprecated_transform:"days_to_duration" validate:"omitempty,nonneg_duration"`
 
 	// FilePickerDir is the starting directory for the document file picker.
-	// Default: the system Downloads folder (e.g. ~/Downloads).
+	// Default: the current working directory.
 	FilePickerDir string `toml:"file_picker_dir"`
 }
 
 // ResolvedFilePickerDir returns the starting directory for the file picker.
 // Uses the configured value if set and the directory exists, otherwise falls
-// back to the system Downloads folder, then the current working directory.
+// back to the current working directory.
 func (d Documents) ResolvedFilePickerDir() string {
 	if d.FilePickerDir != "" {
 		if info, err := os.Stat(d.FilePickerDir); err == nil && info.IsDir() {
 			return d.FilePickerDir
 		}
 	}
-	if dir := xdg.UserDirs.Download; dir != "" {
-		if info, err := os.Stat(dir); err == nil && info.IsDir() {
-			return dir
-		}
-	}
 	if dir, err := os.Getwd(); err == nil {
 		return dir
 	}
@@ -829,8 +824,8 @@ model = "` + DefaultModel + `"
 # cache_ttl = "30d"
 
 # Starting directory for the document file picker.
-# Default: system Downloads folder (~/Downloads on most systems).
-# file_picker_dir = "/home/user/Documents"
+# Default: the current working directory.
+# file_picker_dir = "/home/user/Downloads"
 
 [locale]
 # ISO 4217 currency code. Stored in the database on first run; after that the

internal/config/config_test.go

@@ -1064,11 +1064,24 @@ func TestResolvedFilePickerDir_ConfiguredDirMissing(t *testing.T) {
 	assert.NotEmpty(t, result)
 }
 
-func TestResolvedFilePickerDir_EmptyFallsBackToDownloadsOrCwd(t *testing.T) {
-	t.Parallel()
+func TestResolvedFilePickerDir_EmptyFallsBackToCwd(t *testing.T) {
+	// Not parallel: we mutate cwd.
+	cwd := t.TempDir()
+	t.Chdir(cwd)
+
 	d := Documents{}
 	result := d.ResolvedFilePickerDir()
-	assert.NotEmpty(t, result)
+
+	// Resolve symlinks on both sides: macOS returns /private/var/... for
+	// temp dirs via Getwd while t.TempDir reports /var/...
+	wantResolved, err := filepath.EvalSymlinks(cwd)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(result)
+	require.NoError(t, err)
+	assert.Equal(t, wantResolved, gotResolved,
+		"with no config, the picker should default to cwd — not the "+
+			"user's Downloads folder, which varies per machine and "+
+			"leaks into demo recordings")
 }
 
 func TestFilePickerDir_FromTOML(t *testing.T) {