fix: report save location

src/edgewalker/core/config.py

@@ -38,6 +38,16 @@ def get_cache_dir() -> Path:
     return Path(os.environ.get("EW_CACHE_DIR", user_cache_dir("edgewalker")))
 
 
+def get_data_dir() -> Path:
+    """Return the user-facing data directory for scan results.
+
+    Defaults to ~/.edgewalker so results are easy to find and separate
+    from the application config in Library/Application Support (macOS)
+    or ~/.config (Linux).  Override with EW_DATA_DIR.
+    """
+    return Path(os.environ.get("EW_DATA_DIR", Path.home() / ".edgewalker"))
+
+
 # Legacy constants for backward compatibility (evaluated at load time)
 # Note: Tests should use EW_CONFIG_DIR/EW_CACHE_DIR env vars BEFORE importing this module
 # or we need to ensure they are used dynamically.
@@ -128,7 +138,7 @@ def validate_urls(cls, v: str, info: ValidationInfo) -> str:
     def handle_demo_mode(cls, v: Path) -> Path:
         """Ensure output_dir points to demo_scans when in demo mode."""
         if os.environ.get("EW_DEMO_MODE") == "1":
-            return v.parent / "demo_scans"
+            return get_data_dir() / "demo_scans"
         return v
 
     api_timeout: int = Field(
@@ -287,11 +297,11 @@ def handle_demo_mode(cls, v: Path) -> Path:
     )
     output_dir: Path = Field(
         default_factory=lambda: (
-            get_config_dir() / "demo_scans"
+            get_data_dir() / "demo_scans"
             if os.environ.get("EW_DEMO_MODE") == "1"
-            else get_config_dir() / "scans"
+            else get_data_dir() / "scans"
         ),
-        description="Output directory",
+        description="Output directory for scan results (~/.edgewalker/scans by default)",
     )
     creds_file: Path = Field(
         default=Path(__file__).parent.parent / "data" / "creds.csv",

tests/test_config.py

@@ -144,3 +144,30 @@ def test_update_setting_readonly():
 
     with pytest.raises(AttributeError, match="read-only"):
         update_setting("device_id", "new-id")
+
+
+def test_default_output_dir_is_not_inside_config_dir(tmp_path):
+    """output_dir default must not nest inside the config/Application Support directory."""
+    with patch.dict(os.environ, {"EW_CONFIG_DIR": str(tmp_path)}):
+        # First Party
+        from edgewalker.core.config import Settings, get_config_dir, get_data_dir
+
+        s = Settings()
+        config_dir = get_config_dir()
+        data_dir = get_data_dir()
+        # output_dir must live under data_dir, not config_dir
+        assert str(s.output_dir).startswith(str(data_dir)), (
+            f"output_dir ({s.output_dir}) should be under data_dir ({data_dir})"
+        )
+        assert not str(s.output_dir).startswith(str(config_dir)), (
+            f"output_dir ({s.output_dir}) must not be inside config_dir ({config_dir})"
+        )
+
+
+def test_get_data_dir_respects_env_override():
+    """EW_DATA_DIR env var overrides the data directory."""
+    # First Party
+    from edgewalker.core.config import get_data_dir
+
+    with patch.dict(os.environ, {"EW_DATA_DIR": "/tmp/ew_data"}):
+        assert str(get_data_dir()) == "/tmp/ew_data"