fix: file tree attachment fails on non-home paths in packaged app

- Remove homedir-only restriction from /api/files/raw (desktop app
  doesn't need this sandbox, projects can be anywhere)
- Add console.warn on fetch failure instead of silent swallow
- Fix filename extraction for Windows backslash paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/app/api/files/raw/route.ts

@@ -1,8 +1,6 @@
 import { NextRequest } from 'next/server';
 import fs from 'fs/promises';
 import path from 'path';
-import os from 'os';
-import { isPathSafe } from '@/lib/files';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
@@ -94,16 +92,8 @@ export async function GET(request: NextRequest) {
     });
   }
 
-  const homeDir = os.homedir();
   const resolved = path.resolve(filePath);
 
-  if (!isPathSafe(homeDir, resolved)) {
-    return new Response(JSON.stringify({ error: 'Access denied' }), {
-      status: 403,
-      headers: { 'Content-Type': 'application/json' },
-    });
-  }
-
   try {
     await fs.access(resolved);
   } catch {

src/components/chat/MessageInput.tsx

@@ -270,13 +270,17 @@ function FileTreeAttachmentBridge() {
 
       try {
         const res = await fetch(`/api/files/raw?path=${encodeURIComponent(filePath)}`);
-        if (!res.ok) return;
+        if (!res.ok) {
+          console.warn(`[FileTreeAttachment] Failed to fetch file: ${res.status} ${res.statusText}`, filePath);
+          return;
+        }
         const blob = await res.blob();
-        const filename = filePath.split('/').pop() || 'file';
+        // Handle both Unix (/) and Windows (\) path separators
+        const filename = filePath.split(/[/\\]/).pop() || 'file';
         const file = new File([blob], filename, { type: blob.type || 'application/octet-stream' });
         attachmentsRef.current.add([file]);
-      } catch {
-        // Silently fail if file fetch fails
+      } catch (err) {
+        console.warn('[FileTreeAttachment] Error attaching file:', filePath, err);
       }
     };