fix: use sandboxed paths for Mac App Store build

PolyPilot.Tests/PolyPilot.Tests.csproj

@@ -34,6 +34,7 @@
     <Compile Include="../PolyPilot/Models/BridgeMessages.cs" Link="Shared/BridgeMessages.cs" />
     <Compile Include="../PolyPilot/Models/ConnectionSettings.cs" Link="Shared/ConnectionSettings.cs" />
     <Compile Include="../PolyPilot/Models/PlatformHelper.cs" Link="Shared/PlatformHelper.cs" />
+    <Compile Include="../PolyPilot/Models/PlatformPaths.cs" Link="Shared/PlatformPaths.cs" />
     <Compile Include="../PolyPilot/Models/SessionOrganization.cs" Link="Shared/SessionOrganization.cs" />
     <Compile Include="../PolyPilot/Models/FiestaModels.cs" Link="Shared/FiestaModels.cs" />
     <Compile Include="../PolyPilot/Models/ModelHelper.cs" Link="Shared/ModelHelper.cs" />

PolyPilot.Tests/TestSetup.cs

@@ -16,8 +16,9 @@ namespace PolyPilot.Tests;
 /// If you add new file paths to CopilotService or any service that persists state,
 /// you MUST also redirect them in Initialize() or they will leak to the real filesystem.
 ///
-/// Currently isolated: CopilotService BaseDir/CaptureDir, RepoManager, AuditLogService,
-/// PromptLibraryService, FiestaService state file, ConnectionSettings settings file.
+/// Currently isolated: CopilotService BaseDir/CaptureDir, PlatformPaths, RepoManager,
+/// AuditLogService, PromptLibraryService, FiestaService state file, ConnectionSettings
+/// settings file, PluginLoader plugins dir, ShowImageTool images dir.
 /// </summary>
 internal static class TestSetup
 {
@@ -30,6 +31,7 @@ internal static void Initialize()
         Directory.CreateDirectory(TestBaseDir);
         CopilotService.SetBaseDirForTesting(TestBaseDir);
         CopilotService.SetCaptureDirForTesting(Path.Combine(TestBaseDir, "zero-idle-captures"));
+        PlatformPaths.SetForTesting(TestBaseDir);
         RepoManager.SetBaseDirForTesting(TestBaseDir);
         AuditLogService.SetLogDirForTesting(Path.Combine(TestBaseDir, "audit_logs"));
         PromptLibraryService.SetUserPromptsDirForTesting(Path.Combine(TestBaseDir, "prompts"));

PolyPilot/App.xaml.cs

@@ -1,3 +1,4 @@
+using PolyPilot.Models;
 using PolyPilot.Services;
 
 namespace PolyPilot;
@@ -72,9 +73,12 @@ private void CheckPendingNavigation()
 	{
 		try
 		{
-			var navPath = Path.Combine(
-				Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-				".polypilot", "pending-navigation.json");
+			var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+			var baseDir = sandboxPath
+				?? Path.Combine(
+					Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+					".polypilot");
+			var navPath = Path.Combine(baseDir, "pending-navigation.json");
 
 			if (!File.Exists(navPath))
 				return;

PolyPilot/MauiProgram.cs

@@ -25,6 +25,10 @@ private static string GetCrashLogPath()
 	{
 		try
 		{
+			var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+			if (sandboxPath != null)
+				return Path.Combine(sandboxPath, "crash.log");
+
 #if ANDROID || IOS
 			return Path.Combine(FileSystem.AppDataDirectory, ".polypilot", "crash.log");
 #else

PolyPilot/Models/ConnectionSettings.cs

@@ -228,6 +228,9 @@ internal static Dictionary<string, string> BuildDirectQrPayload(
 
     private static string GetPolyPilotDir()
     {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return sandboxPath;
+
 #if IOS || ANDROID
         try
         {

PolyPilot/Models/PlatformPaths.cs

@@ -0,0 +1,46 @@
+namespace PolyPilot.Models;
+
+/// <summary>
+/// Platform-specific path resolution and test isolation for file paths.
+/// 
+/// On Mac App Store (MACCATALYST sandbox):
+///   The sandbox remaps HOME (UserProfile) into ~/Library/Containers/&lt;bundle-id&gt;/Data/,
+///   so both ~/.polypilot/ and ~/.copilot/ resolve inside the container automatically.
+///   No override is needed — callers use their existing UserProfile-based logic unchanged.
+/// 
+/// On all other platforms: returns null (callers use their existing logic unchanged).
+/// 
+/// The primary value of this class is providing a centralized test override via
+/// <see cref="SetForTesting"/> so tests never touch the real filesystem.
+/// </summary>
+public static class PlatformPaths
+{
+    private static string? _testPolyPilotDir;
+
+    /// <summary>
+    /// Test-only: override returned path to prevent tests from touching real filesystem.
+    /// Also clears static caches in services that use <c>??=</c> patterns (PluginLoader, ShowImageTool)
+    /// so the override takes effect even if the cache was previously populated.
+    /// </summary>
+    internal static void SetForTesting(string? polyPilotDir)
+    {
+        _testPolyPilotDir = polyPilotDir;
+        // Clear static caches that use ??= so the override takes effect
+        Services.PluginLoader.ResetCachedPathForTesting();
+        Services.ShowImageTool.ResetCachedPathForTesting();
+    }
+
+    /// <summary>
+    /// Get the PolyPilot configuration directory (~/.polypilot/) override for the current platform.
+    /// Returns a test override if set, otherwise null on all platforms.
+    /// On MACCATALYST the sandbox remaps UserProfile into the container, so the
+    /// existing UserProfile-based paths resolve correctly without an override.
+    /// </summary>
+    public static string? GetPolyPilotDirOverride()
+    {
+        if (_testPolyPilotDir != null) return _testPolyPilotDir;
+        // Mac Catalyst sandbox remaps HOME (UserProfile) into the container.
+        // ~/.polypilot/ already resolves inside the sandbox. No override needed.
+        return null;
+    }
+}

PolyPilot/Platforms/MacCatalyst/NotificationManagerService.cs

@@ -76,10 +76,18 @@ internal void OnNotificationTapped(string? sessionId)
         NotificationTapped?.Invoke(this, new NotificationTappedEventArgs { SessionId = sessionId });
     }
 
-    private static string PendingNavigationPath =>
-        Path.Combine(
-            Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-            ".polypilot", "pending-navigation.json");
+    private static string PendingNavigationPath
+    {
+        get
+        {
+            var sandboxPath = PolyPilot.Models.PlatformPaths.GetPolyPilotDirOverride();
+            var baseDir = sandboxPath
+                ?? Path.Combine(
+                    Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+                    ".polypilot");
+            return Path.Combine(baseDir, "pending-navigation.json");
+        }
+    }
 
     private static void WritePendingNavigation(string sessionId)
     {

PolyPilot/Platforms/MacCatalyst/Program.cs

@@ -29,9 +29,11 @@ static bool TryAcquireInstanceLock()
 	{
 		try
 		{
-			var lockDir = Path.Combine(
-				Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-				".polypilot");
+			var sandboxPath = PolyPilot.Models.PlatformPaths.GetPolyPilotDirOverride();
+			var lockDir = sandboxPath
+				?? Path.Combine(
+					Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+					".polypilot");
 			Directory.CreateDirectory(lockDir);
 			var lockPath = Path.Combine(lockDir, "instance.lock");
 
@@ -69,9 +71,11 @@ static void ActivateExistingInstance(string[] args)
 			{
 				try
 				{
-					var navDir = Path.Combine(
-						Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-						".polypilot");
+					var sandboxPath = PolyPilot.Models.PlatformPaths.GetPolyPilotDirOverride();
+					var navDir = sandboxPath
+						?? Path.Combine(
+							Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+							".polypilot");
 					Directory.CreateDirectory(navDir);
 					var navPath = Path.Combine(navDir, "pending-navigation.json");
 					// Include writtenAt so the 30s TTL in CheckPendingNavigation applies if the

PolyPilot/Services/AuditLogService.cs

@@ -44,6 +44,10 @@ private static string ComputeAuditLogDir()
     {
         try
         {
+            var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+            if (sandboxPath != null)
+                return Path.Combine(sandboxPath, LogDirName);
+
 #if IOS || ANDROID
             return Path.Combine(FileSystem.AppDataDirectory, ".polypilot", LogDirName);
 #else

PolyPilot/Services/ChatDatabase.cs

@@ -102,6 +102,10 @@ private static string GetDbPath()
     {
         try
         {
+            var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+            if (sandboxPath != null)
+                return Path.Combine(sandboxPath, "chat_history.db");
+
             var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
             if (string.IsNullOrEmpty(home))
                 home = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);

PolyPilot/Services/CopilotService.cs

@@ -167,6 +167,10 @@ private static string GetPolyPilotBaseDir()
     {
         try
         {
+            // Mac App Store sandbox: use app container
+            var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+            if (sandboxPath != null) return sandboxPath;
+
 #if ANDROID
             var home = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
             if (string.IsNullOrEmpty(home))

PolyPilot/Services/PluginFileLogger.cs

@@ -1,3 +1,4 @@
+using PolyPilot.Models;
 using PolyPilot.Provider;
 
 namespace PolyPilot.Services;
@@ -16,8 +17,16 @@ public class PluginFileLogger : IPluginLogger
 	public PluginFileLogger(string pluginName)
 	{
 		_pluginName = pluginName;
-		var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
-		var dir = Path.Combine(home, ".polypilot", "logs", "plugins", pluginName);
+		string baseDir;
+		var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+		if (sandboxPath != null)
+			baseDir = sandboxPath;
+		else
+		{
+			var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+			baseDir = Path.Combine(home, ".polypilot");
+		}
+		var dir = Path.Combine(baseDir, "logs", "plugins", pluginName);
 		Directory.CreateDirectory(dir);
 		_logPath = Path.Combine(dir, "plugin.log");
 	}

PolyPilot/Services/PluginLoader.cs

@@ -20,8 +20,18 @@ namespace PolyPilot.Services;
 public static class PluginLoader
 {
     private static string? _pluginsDir;
-    private static string PluginsDir => _pluginsDir ??= Path.Combine(
-        Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".polypilot", "plugins");
+    private static string PluginsDir => _pluginsDir ??= ComputePluginsDir();
+
+    private static string ComputePluginsDir()
+    {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return Path.Combine(sandboxPath, "plugins");
+        return Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".polypilot", "plugins");
+    }
+
+    /// <summary>Test-only: clear the cached path so <see cref="PlatformPaths.SetForTesting"/> takes effect.</summary>
+    internal static void ResetCachedPathForTesting() => _pluginsDir = null;
 
     /// <summary>
     /// Scans the plugins directory for subdirectories containing a plugin.json manifest.

PolyPilot/Services/PromptLibraryService.cs

@@ -31,6 +31,9 @@ public class PromptLibraryService
 
     private static string GetPolyPilotDir()
     {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return sandboxPath;
+
 #if IOS || ANDROID
         try
         {

PolyPilot/Services/RepoManager.cs

@@ -91,6 +91,9 @@ private static string GetBaseDir()
         if (over != null) return over;
         try
         {
+            var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+            if (sandboxPath != null) return sandboxPath;
+
             var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
             if (string.IsNullOrEmpty(home))
                 home = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);

PolyPilot/Services/ScheduledTaskService.cs

@@ -627,6 +627,9 @@ private static bool IsSuccessfulCompletionSummary(string? summary)
 
     private static string GetPolyPilotDir()
     {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return sandboxPath;
+
 #if IOS || ANDROID
         try
         {

PolyPilot/Services/ServerManager.cs

@@ -13,6 +13,9 @@ public class ServerManager : IServerManager
 
     private static string GetPolyPilotDir()
     {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return sandboxPath;
+
         var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
         if (string.IsNullOrEmpty(home))
             home = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);

PolyPilot/Services/ShowImageTool.cs

@@ -1,6 +1,7 @@
 using System.ComponentModel;
 using System.Text.Json;
 using Microsoft.Extensions.AI;
+using PolyPilot.Models;
 
 namespace PolyPilot.Services;
 
@@ -15,8 +16,18 @@ public static class ShowImageTool
     private static readonly string[] SupportedExtensions = { ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".tiff", ".svg" };
 
     private static string? _imagesDir;
-    private static string ImagesDir => _imagesDir ??= Path.Combine(
-        Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".polypilot", "images");
+    private static string ImagesDir => _imagesDir ??= ComputeImagesDir();
+
+    private static string ComputeImagesDir()
+    {
+        var sandboxPath = PlatformPaths.GetPolyPilotDirOverride();
+        if (sandboxPath != null) return Path.Combine(sandboxPath, "images");
+        return Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".polypilot", "images");
+    }
+
+    /// <summary>Test-only: clear the cached path so <see cref="PlatformPaths.SetForTesting"/> takes effect.</summary>
+    internal static void ResetCachedPathForTesting() => _imagesDir = null;
 
     /// <summary>Returns the images directory path. Used by FetchImage validation.</summary>
     public static string GetImagesDir() => ImagesDir;