feat: sandbox file injection — docker cp ctx files into sandbox

- setupSandbox returns container name (breaking change to signature)
- injectFilesToSandbox copies --ctx files into sandbox via docker cp
  → Relative paths preserved (/workspace/subdir/file.txt)
  → Absolute paths outside cwd use basename (/workspace/file.txt)
  → Non-existent files logged as warnings, directories skipped
  → Errors on actual docker cp failure
- Wired into run() after sandbox setup, logs 'copied N file(s)'
- Updated all 6 setupSandbox callers (run, serve, repl, subagent, continue, mcp)
- 4 unit tests: file not found, directory skip, empty list, docker cp failure
- 4 E2E tests: basic injection, nested path, absolute path, multiple files
  (all gated by ODEK_E2E=true)

Author: jkyberneees

cmd/odek/main.go

@@ -742,11 +742,22 @@ func run(args []string) error {
 	}
 
 	if resolved.Sandbox {
-		cleanup, err := setupSandbox(tools, sbCfg)
+		var containerName string
+		containerName, sandboxCleanup, err = setupSandbox(tools, sbCfg)
 		if err != nil {
 			return fmt.Errorf("sandbox: %w", err)
 		}
-		sandboxCleanup = cleanup
+
+		// Inject --ctx files into the sandbox container
+		if len(f.Ctx) > 0 {
+			injected, injectErr := injectFilesToSandbox(containerName, f.Ctx, cwd)
+			if injectErr != nil {
+				return fmt.Errorf("sandbox: inject ctx files: %w", injectErr)
+			}
+			if injected > 0 {
+				fmt.Fprintf(os.Stderr, "odek: copied %d file(s) into sandbox\n", injected)
+			}
+		}
 	}
 
 	// Create terminal renderer for colored step-by-step output.
@@ -902,37 +913,37 @@ func run(args []string) error {
 //   - --security-opt no-new-privileges: setuid binaries can't escalate
 //   - --tmpfs /tmp:noexec: no executable files in temp
 //   - --rm: container destroyed on agent exit
-func setupSandbox(tools []odek.Tool, cfg sandboxConfig) (func() error, error) {
+func setupSandbox(tools []odek.Tool, cfg sandboxConfig) (containerName string, cleanup func() error, err error) {
 	// Resolve the Docker image (explicit, Dockerfile.odek, or default)
 	image, err := resolveSandboxImage(cfg)
 	if err != nil {
-		return nil, err
+		return "", nil, err
 	}
 
-	containerName := fmt.Sprintf("odek-%d", os.Getpid())
+	containerName = fmt.Sprintf("odek-%d", os.Getpid())
 	fmt.Fprintf(os.Stderr, "odek: starting sandbox container %s (image: %s)...\n", containerName, image)
 
 	wd, err := os.Getwd()
 	if err != nil {
-		return nil, fmt.Errorf("getwd: %w", err)
+		return "", nil, fmt.Errorf("getwd: %w", err)
 	}
 
 	args := buildSandboxArgs(cfg, containerName, wd, image)
 
 	createCmd := exec.Command("docker", args...)
 	createCmd.Stderr = os.Stderr
 	if err := createCmd.Run(); err != nil {
-		return nil, fmt.Errorf("failed to create container: %w", err)
+		return "", nil, fmt.Errorf("failed to create container: %w", err)
 	}
 
-	cleanup := func() error {
+	cleanup = func() error {
 		fmt.Fprintf(os.Stderr, "odek: destroying sandbox container %s...\n", containerName)
 		return exec.Command("docker", "rm", "-f", containerName).Run()
 	}
 
 	// Wire the shell tool to execute commands inside the sandbox.
 	tools[0].(*shellTool).containerName = containerName
-	return cleanup, nil
+	return containerName, cleanup, nil
 }
 
 // buildSandboxArgs builds the docker run arguments from a sandboxConfig.
@@ -1003,6 +1014,60 @@ func buildSandboxArgs(cfg sandboxConfig, containerName, workdir, image string) [
 	return args
 }
 
+// injectFilesToSandbox copies ctx files into a running sandbox container
+// using docker cp. Returns the number of files successfully injected.
+// Files are placed at /workspace/<relative-path-from-cwd> in the container.
+// Absolute-path files are placed at /workspace/<basename>.
+// Skips files that don't exist (logs warning), returns error only on docker failure.
+func injectFilesToSandbox(containerName string, files []string, cwd string) (int, error) {
+	injected := 0
+	for _, f := range files {
+		f = strings.TrimSpace(f)
+		if f == "" {
+			continue
+		}
+
+		// Resolve to absolute path
+		absPath := f
+		if !filepath.IsAbs(absPath) {
+			absPath = filepath.Join(cwd, absPath)
+		}
+		absPath = filepath.Clean(absPath)
+
+		// Verify file exists and is a regular file
+		info, err := os.Stat(absPath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "odek: warning: ctx file %q not found, skipping sandbox injection\n", f)
+			continue
+		}
+		if info.IsDir() {
+			fmt.Fprintf(os.Stderr, "odek: warning: ctx path %q is a directory, skipping sandbox injection\n", f)
+			continue
+		}
+
+		// Determine destination path inside container
+		// For files under cwd: preserve relative path
+		// For files outside cwd: use basename
+		dest := filepath.Base(absPath) // default: just the filename
+		if strings.HasPrefix(absPath, cwd+string(filepath.Separator)) || absPath == cwd {
+			rel, err := filepath.Rel(cwd, absPath)
+			if err == nil {
+				dest = rel
+			}
+		}
+
+		// docker cp into container:/workspace/<dest>
+		containerDest := fmt.Sprintf("%s:/workspace/%s", containerName, dest)
+		cpCmd := exec.Command("docker", "cp", absPath, containerDest)
+		output, err := cpCmd.CombinedOutput()
+		if err != nil {
+			return injected, fmt.Errorf("docker cp %q: %w\n%s", f, err, string(output))
+		}
+		injected++
+	}
+	return injected, nil
+}
+
 func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager, approver danger.Approver, maxConcurrency int) []odek.Tool {
 	tools := []odek.Tool{
 		&shellTool{
@@ -1447,11 +1512,12 @@ func continueCmd(args []string) error {
 			Env:      resolved.SandboxEnv,
 			Volumes:  resolved.SandboxVolumes,
 		}
-		cleanup, err := setupSandbox(tools, sbCfg)
+		var contContainerName string
+		contContainerName, sandboxCleanup, err = setupSandbox(tools, sbCfg)
 		if err != nil {
 			return fmt.Errorf("sandbox: %w", err)
 		}
-		sandboxCleanup = cleanup
+		_ = contContainerName
 	}
 
 	// Renderer

cmd/odek/mcp.go

@@ -95,10 +95,12 @@ Flags:
 	// Sandbox setup (must happen after tools are created)
 	var sandboxCleanup func() error
 	if resolved.Sandbox {
-		cleanup, err := setupSandbox(toolSet, sbCfg)
+		var mcpContainerName string
+		mcpContainerName, cleanup, err := setupSandbox(toolSet, sbCfg)
 		if err != nil {
-			return fmt.Errorf("sandbox: %w", err)
+			return fmt.Errorf("setup sandbox: %w", err)
 		}
+		_ = mcpContainerName
 		sandboxCleanup = cleanup
 		defer sandboxCleanup()
 	}

cmd/odek/repl.go

@@ -100,10 +100,12 @@ func replCmd(args []string) error {
 			Env:      resolved.SandboxEnv,
 			Volumes:  resolved.SandboxVolumes,
 		}
-		cleanup, err := setupSandbox(tools, sbCfg)
+		var replContainerName string
+		replContainerName, cleanup, err := setupSandbox(tools, sbCfg)
 		if err != nil {
 			return fmt.Errorf("sandbox: %w", err)
 		}
+		_ = replContainerName // not used in REPL mode
 		sandboxCleanup = cleanup
 	}
 

cmd/odek/sandbox_e2e_test.go

@@ -0,0 +1,218 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// ─────────────────────────────────────────────────────────────────────
+// E2E Tests: Sandbox file injection
+// ─────────────────────────────────────────────────────────────────────
+//
+// These tests create a real Docker sandbox container and verify that
+// ctx files are correctly injected into it via docker cp.
+//
+// Gated by ODEK_E2E=true.
+// ─────────────────────────────────────────────────────────────────────
+
+// TestE2E_SandboxFileInjection verifies that --ctx files are copied
+// into the sandbox container and accessible via the container's shell.
+func TestE2E_SandboxFileInjection(t *testing.T) {
+	skipIfNoE2E(t)
+
+	// Create temp file to inject
+	workDir := t.TempDir()
+	testContent := "sandbox-injection-test-content"
+	testFile := filepath.Join(workDir, "injected.txt")
+	if err := os.WriteFile(testFile, []byte(testContent), 0644); err != nil {
+		t.Fatalf("write test file: %v", err)
+	}
+
+	// Create a sandbox container using the same machinery as odek run
+	containerName := fmt.Sprintf("odek-test-inject-%d", time.Now().UnixNano())
+	args := buildSandboxArgs(sandboxConfig{
+		Image:   "alpine:latest",
+		Network: "none",
+	}, containerName, workDir, "alpine:latest")
+
+	createCmd := exec.Command("docker", args...)
+	createCmd.Stderr = os.Stderr
+	if err := createCmd.Run(); err != nil {
+		t.Fatalf("create sandbox container: %v", err)
+	}
+	defer func() {
+		exec.Command("docker", "rm", "-f", containerName).Run()
+	}()
+
+	// Wait for container to be ready
+	time.Sleep(500 * time.Millisecond)
+
+	// Inject the file
+	count, err := injectFilesToSandbox(containerName, []string{"injected.txt"}, workDir)
+	if err != nil {
+		t.Fatalf("injectFilesToSandbox: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("expected 1 file injected, got %d", count)
+	}
+
+	// Verify the file exists in the container at /workspace/injected.txt
+	verifyCmd := exec.Command("docker", "exec", "-w", "/workspace", containerName, "cat", "injected.txt")
+	output, err := verifyCmd.Output()
+	if err != nil {
+		t.Fatalf("docker exec cat: %v", err)
+	}
+	if strings.TrimSpace(string(output)) != testContent {
+		t.Errorf("file content = %q, want %q", strings.TrimSpace(string(output)), testContent)
+	}
+}
+
+// TestE2E_SandboxFileInjection_NestedPath verifies that --ctx files
+// in subdirectories preserve their relative path in the container.
+func TestE2E_SandboxFileInjection_NestedPath(t *testing.T) {
+	skipIfNoE2E(t)
+
+	workDir := t.TempDir()
+	subDir := filepath.Join(workDir, "subdir")
+	if err := os.Mkdir(subDir, 0755); err != nil {
+		t.Fatalf("mkdir subdir: %v", err)
+	}
+	testContent := "nested-file-content"
+	nestedFile := filepath.Join(subDir, "nested.txt")
+	if err := os.WriteFile(nestedFile, []byte(testContent), 0644); err != nil {
+		t.Fatalf("write nested file: %v", err)
+	}
+
+	containerName := fmt.Sprintf("odek-test-nested-%d", time.Now().UnixNano())
+	args := buildSandboxArgs(sandboxConfig{
+		Image:   "alpine:latest",
+		Network: "none",
+	}, containerName, workDir, "alpine:latest")
+
+	createCmd := exec.Command("docker", args...)
+	createCmd.Stderr = os.Stderr
+	if err := createCmd.Run(); err != nil {
+		t.Fatalf("create container: %v", err)
+	}
+	defer exec.Command("docker", "rm", "-f", containerName).Run()
+
+	time.Sleep(500 * time.Millisecond)
+
+	// Inject with relative path from cwd: subdir/nested.txt
+	count, err := injectFilesToSandbox(containerName, []string{"subdir/nested.txt"}, workDir)
+	if err != nil {
+		t.Fatalf("injectFilesToSandbox: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("expected 1 file injected, got %d", count)
+	}
+
+	// Verify file exists at /workspace/subdir/nested.txt
+	verifyCmd := exec.Command("docker", "exec", "-w", "/workspace", containerName, "cat", "subdir/nested.txt")
+	output, err := verifyCmd.Output()
+	if err != nil {
+		t.Fatalf("docker exec cat nested: %v", err)
+	}
+	if strings.TrimSpace(string(output)) != testContent {
+		t.Errorf("nested file content = %q, want %q", strings.TrimSpace(string(output)), testContent)
+	}
+}
+
+// TestE2E_SandboxFileInjection_AbsolutePath verifies that absolute
+// path files outside cwd are injected by basename into /workspace/.
+func TestE2E_SandboxFileInjection_AbsolutePath(t *testing.T) {
+	skipIfNoE2E(t)
+
+	// Create a file outside the working directory
+	externalDir := t.TempDir()
+	absContent := "absolute-path-content"
+	absFile := filepath.Join(externalDir, "external.txt")
+	if err := os.WriteFile(absFile, []byte(absContent), 0644); err != nil {
+		t.Fatalf("write external file: %v", err)
+	}
+
+	workDir := t.TempDir()
+
+	containerName := fmt.Sprintf("odek-test-abs-%d", time.Now().UnixNano())
+	args := buildSandboxArgs(sandboxConfig{
+		Image:   "alpine:latest",
+		Network: "none",
+	}, containerName, workDir, "alpine:latest")
+
+	createCmd := exec.Command("docker", args...)
+	createCmd.Stderr = os.Stderr
+	if err := createCmd.Run(); err != nil {
+		t.Fatalf("create container: %v", err)
+	}
+	defer exec.Command("docker", "rm", "-f", containerName).Run()
+
+	time.Sleep(500 * time.Millisecond)
+
+	// Inject with absolute path (outside cwd) — should use basename
+	count, err := injectFilesToSandbox(containerName, []string{absFile}, workDir)
+	if err != nil {
+		t.Fatalf("injectFilesToSandbox: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("expected 1 file injected, got %d", count)
+	}
+
+	// Should exist at /workspace/external.txt (basename)
+	verifyCmd := exec.Command("docker", "exec", "-w", "/workspace", containerName, "cat", "external.txt")
+	output, err := verifyCmd.Output()
+	if err != nil {
+		t.Fatalf("docker exec cat external: %v", err)
+	}
+	if strings.TrimSpace(string(output)) != absContent {
+		t.Errorf("external file content = %q, want %q", strings.TrimSpace(string(output)), absContent)
+	}
+}
+
+// TestE2E_SandboxFileInjection_MultipleFiles verifies injecting
+// multiple files at once.
+func TestE2E_SandboxFileInjection_MultipleFiles(t *testing.T) {
+	skipIfNoE2E(t)
+
+	workDir := t.TempDir()
+	os.WriteFile(filepath.Join(workDir, "a.txt"), []byte("file A"), 0644)
+	os.WriteFile(filepath.Join(workDir, "b.txt"), []byte("file B"), 0644)
+
+	containerName := fmt.Sprintf("odek-test-multi-%d", time.Now().UnixNano())
+	args := buildSandboxArgs(sandboxConfig{
+		Image:   "alpine:latest",
+		Network: "none",
+	}, containerName, workDir, "alpine:latest")
+
+	createCmd := exec.Command("docker", args...)
+	createCmd.Stderr = os.Stderr
+	if err := createCmd.Run(); err != nil {
+		t.Fatalf("create container: %v", err)
+	}
+	defer exec.Command("docker", "rm", "-f", containerName).Run()
+
+	time.Sleep(500 * time.Millisecond)
+
+	count, err := injectFilesToSandbox(containerName, []string{"a.txt", "b.txt"}, workDir)
+	if err != nil {
+		t.Fatalf("injectFilesToSandbox: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("expected 2 files injected, got %d", count)
+	}
+
+	// Verify both files
+	for _, name := range []string{"a.txt", "b.txt"} {
+		out, err := exec.Command("docker", "exec", "-w", "/workspace", containerName, "cat", name).Output()
+		if err != nil {
+			t.Errorf("cat %s: %v", name, err)
+		}
+		if strings.TrimSpace(string(out)) == "" {
+			t.Errorf("file %s is empty", name)
+		}
+	}
+}