feat(core): let bots copy a thread's files into the sandbox

[davemooreuws]

Sixth of the chat attachments PRs, stacked on #403: a bot that uses the sandbox can copy a file from the chat into it, to work on with commands.

• A new sandbox tool, copy_file_to_sandbox({ file }), copies one file in the thread, such as one a person attached, to attachments/<file id>/<safe name> in the thread's folder, and returns that path. The bot copies what it needs, when it needs it.
• A file already copied is left as it is, with any changes to it, and the result says alreadyCopied. A file in the thread never changes and the thread's bots share the folder, so copying again could only undo work. To start fresh, the bot removes the copy and copies again.
• The file is looked up before the sandbox opens, so a wrong id never starts it. The copy is written under a temporary name and moved into place, so no command sees it half written.
• For a bot that uses the sandbox, each attachment line names the tool next to read_thread_file, which can't read files that are neither text nor images.
• Names are made safe as one file name: no folders, hidden files or options, no control or reordering characters, at most 255 bytes, keeping the extension.
• read_thread_file and the new tool now give the same refusals, and log them the same way, for a file that can't be read.

The pod's bots share its sandbox, so one can read a copy made in another of the pod's chats. Everyone who can see one of a pod's chats can see them all, so no person sees more than before.

Part of SUGA-1825

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	sugabots-website	2e98164	Oct 16 2026, 06:45 AM

[tjholm]

The intent here is to proactively copy all of a threads files into the sandbox?

It feels like this should be a toolcall and left at the agents discretion instead.

[tjholm]

Need to think about this one, but I think copying attachments should be an on-demand thing at the agents discretion not a passive copy of files

[davemooreuws]

Need to think about this one, but I think copying attachments should be an on-demand thing at the agents discretion not a passive copy of files

Fair point, and I think you're right for sugabots. Because the sandbox is shared by the whole pod, copying everything passively puts every chat's files where every bot in the pod can read them, and it costs a copy on every turn that opens the sandbox even when the files aren't needed. I'll change it to a tool the bot calls to copy one attachment in, with the attachment line naming the tool so it knows how.

changes applied