Desktop preview pane can't render SendUserFile attachments outside the session worktree — misleading "deleted or moved" error

Summary

In the macOS desktop app, tapping an HTML file the agent delivered as an attachment chip (SendUserFile with display: "render") shows "Couldn't preview this file. It may have been deleted or moved." — even though the file exists on disk with normal permissions. This worked as recently as 2026-07-02 and is broken as of mid-July.

A/B testing shows the real cause is that the preview pane can now only read files inside the session's worktree/folder — the error message about deletion is misleading.

Environment

• Claude Code desktop app (macOS): 1.21459.0
• CLI: 2.1.206
• macOS 26.5.1 (Darwin 25.5.0)
• Session running in a git worktree under <repo>/.claude/worktrees/<name>

Reproduction

1. Have the agent write a self-contained HTML file (ours was a ~800 KB page with base64-embedded PNGs, but size doesn't matter).
2. Have the agent deliver it via SendUserFile with display: "render" from various paths.
3. Tap the attachment chip in chat.

Results with the identical file copied to four locations (all -rw-r--r--, same user):

| Location | Preview result |
|---|---|
| Session scratchpad /private/tmp/claude-501/<project>/<session-id>/scratchpad/… | ❌ "Couldn't preview this file. It may have been deleted or moved." |
| ~/.claude/projects/<project>/deliverables/… | ❌ same error |
| ~/Downloads/… | ❌ same error |
| Inside the session worktree <worktree>/preview-test.html | ✅ renders fine |

In every failing case the path shown in the error is correct and the file is present and readable at that exact path (ls -la verified before and after tapping).

Expected behavior

Either of:

• Files the agent itself delivered via SendUserFile should be previewable regardless of which local path they live at (the agent explicitly chose to send them — that seems like reasonable consent to read them), or
• If preview reads are intentionally scoped to the session folder for security-hardening reasons, the error should say so (e.g. "This file is outside the session folder and can't be previewed") and the scoping should be documented so agents know to place render-destined deliverables inside the session folder. The current "deleted or moved" message sent us debugging entirely wrong causes (we suspected tmp-cleaners, sandbox entitlements, and file permissions before isolating it).

Note the session scratchpad directory (/private/tmp/claude-501/<project>/<session-id>/scratchpad) is what the harness itself tells agents to use for generated files — yet files there are NOT previewable, which is a particularly confusing combination.

Possibly related

• #58302 — file-preview pane error text ends with "…or it lives outside the session folder", which matches the scoping behavior observed here (that fuller error text would already have helped; the chip-preview variant truncates it to just "deleted or moved")
• #51312 — preview server cannot read ~/Desktop on macOS despite Full Disk Access