fix: use --add-dir flag for granting Claude read access to uploads

cli/src/claude/claudeLocal.ts

@@ -7,6 +7,7 @@ import { appendMcpConfigArg } from "./utils/mcpConfig";
 import { systemPrompt } from "./utils/systemPrompt";
 import { withBunRuntimeEnv } from "@/utils/bunRuntime";
 import { spawnWithAbort } from "@/utils/spawnWithAbort";
+import { getHapiBlobsDir } from "@/constants/uploadPaths";
 
 export async function claudeLocal(opts: {
     abort: AbortSignal,
@@ -68,6 +69,10 @@ export async function claudeLocal(opts: {
     args.push('--settings', opts.hookSettingsPath);
     logger.debug(`[ClaudeLocal] Using hook settings: ${opts.hookSettingsPath}`);
 
+    // Add blobs directory for file upload access
+    args.push('--add-dir', getHapiBlobsDir());
+    logger.debug(`[ClaudeLocal] Adding blobs directory: ${getHapiBlobsDir()}`);
+
     // Prepare environment variables
     // Note: Local mode uses global Claude installation
     const env = {

cli/src/claude/claudeRemote.ts

@@ -9,6 +9,7 @@ import { getProjectPath } from "./utils/path";
 import { awaitFileExist } from "@/modules/watcher/awaitFileExist";
 import { systemPrompt } from "./utils/systemPrompt";
 import { PermissionResult } from "./sdk/types";
+import { getHapiBlobsDir } from "@/constants/uploadPaths";
 
 export async function claudeRemote(opts: {
 
@@ -123,6 +124,7 @@ export async function claudeRemote(opts: {
         abort: opts.signal,
         pathToClaudeCodeExecutable: 'claude',
         settingsPath: opts.hookSettingsPath,
+        additionalDirectories: [getHapiBlobsDir()],
     }
 
     // Track thinking state

cli/src/claude/sdk/query.ts

@@ -260,6 +260,7 @@ export function query(config: {
     const {
         prompt,
         options: {
+            additionalDirectories = [],
             allowedTools = [],
             appendSystemPrompt,
             customSystemPrompt,
@@ -303,6 +304,7 @@ export function query(config: {
     if (settingsPath) args.push('--settings', settingsPath)
     if (allowedTools.length > 0) args.push('--allowedTools', allowedTools.join(','))
     if (disallowedTools.length > 0) args.push('--disallowedTools', disallowedTools.join(','))
+    if (additionalDirectories.length > 0) args.push('--add-dir', ...additionalDirectories)
     if (strictMcpConfig) args.push('--strict-mcp-config')
     if (permissionMode) args.push('--permission-mode', permissionMode)
 

cli/src/claude/sdk/types.ts

@@ -157,6 +157,7 @@ export interface CanCallToolCallback {
  */
 export interface QueryOptions {
     abort?: AbortSignal
+    additionalDirectories?: string[]
     allowedTools?: string[]
     appendSystemPrompt?: string
     customSystemPrompt?: string

cli/src/constants/uploadPaths.ts

@@ -0,0 +1,8 @@
+import { join } from 'path'
+import { tmpdir } from 'os'
+
+export const HAPI_BLOBS_DIR_NAME = 'hapi-blobs'
+
+export function getHapiBlobsDir(): string {
+    return join(tmpdir(), HAPI_BLOBS_DIR_NAME)
+}

cli/src/modules/common/handlers/uploads.ts

@@ -1,10 +1,10 @@
 import { logger } from '@/ui/logger'
-import { mkdtemp, rm, writeFile } from 'fs/promises'
+import { mkdir, mkdtemp, rm, writeFile } from 'fs/promises'
 import { join, resolve, sep } from 'path'
-import { tmpdir } from 'os'
 import { rmSync } from 'node:fs'
 import type { RpcHandlerManager } from '@/api/rpc/RpcHandlerManager'
 import { getErrorMessage, rpcError } from '../rpcResponses'
+import { getHapiBlobsDir } from '@/constants/uploadPaths'
 
 interface UploadFileRequest {
     sessionId?: string
@@ -74,7 +74,9 @@ async function getOrCreateUploadDir(sessionId?: string): Promise<string> {
     const safeKey = sanitizeFilename(sessionKey)
     const creation = (async () => {
         try {
-            const dir = await mkdtemp(join(tmpdir(), `hapi-uploads-${safeKey}-`))
+            const blobsDir = getHapiBlobsDir()
+            await mkdir(blobsDir, { recursive: true })
+            const dir = await mkdtemp(join(blobsDir, `${safeKey}-`))
             if (uploadDirCleanupRequested.has(sessionKey)) {
                 try {
                     await rm(dir, { recursive: true, force: true })
@@ -151,7 +153,7 @@ function isPathWithinUploadDir(path: string, sessionId?: string): boolean {
     }
 
     const safeKey = sanitizeFilename(sessionKey)
-    const resolvedPrefix = resolve(tmpdir(), `hapi-uploads-${safeKey}-`)
+    const resolvedPrefix = resolve(getHapiBlobsDir(), `${safeKey}-`)
     return resolvedPath.startsWith(resolvedPrefix)
 }