Observed against the live local add-on on 2026-03-11.

Repro:

• Installed add-on reports GET http://127.0.0.1:23119/version -> version: 3.2.0
• Create a real temp PDF on disk, e.g. /tmp/attach-issue-XXXX.pdf
• POST to http://127.0.0.1:23119/attach via the client payload:

  {
    "item_key": "<real top-level item key>",
    "file_path": "/tmp/attach-issue-8enzlt16.pdf",
    "title": "Issue Repro PDF"
  }

Observed result:

• HTTP 500 / structured failure
• Error: Component returned failure code: 0x80520012 (NS_ERROR_FILE_NOT_FOUND) [nsIFile.copyToFollowingLinks]
• Response body from the add-on:

  {
    "success": false,
    "operation": "attach_file_to_item",
    "stage": "attach_endpoint",
    "error": "Component returned failure code: 0x80520012 (NS_ERROR_FILE_NOT_FOUND) [nsIFile.copyToFollowingLinks]",
    "details": {
      "request": {
        "item_key": "7ZQPF9M4",
        "file_path": "/tmp/attach-issue-8enzlt16.pdf",
        "title": "Issue Repro PDF"
      }
    },
    "version": "3.2.0"
  }

Notes:

• The file existed before and after the request.
• The same failure was also observed from the opencode-zotero-plugin integration tests.
• The current add-on source still allows /tmp and /var/tmp, so this does not appear to be a client-side path policy violation.

Expected:

• /attach should create a stored PDF attachment for a real file under an allowed temp directory.