refactor(cred_proxy): rename Upstream -> Route, fix tea-login AttributeError

Three leftovers from the manifest refactor:

1. provision/cred_proxy.py:223 referenced u.kind == 'gitea' for the
   tea login count — kind was removed from the runtime class, so any
   bottle with a tea-login route raised AttributeError at provision
   time. Switch to `'tea-login' in r.roles`.

2. The runtime class CredProxyUpstream is renamed to CredProxyRoute
   (its data is a route on the proxy, not an "upstream"; the field
   route.upstream is the upstream URL). Module's own naming now
   aligns with manifest.CredProxyRoute and routes.json.

3. cred_proxy_upstreams_for_bottle -> cred_proxy_routes_for_bottle;
   CredProxyPlan.upstreams -> CredProxyPlan.routes; local
   `upstreams` collections become `routes`. Callers in
   backend.py, launch.py, prepare.py, bottle_plan.py,
   provision/cred_proxy.py, and tests updated.

Also strips lingering `bottle.tokens` references from docstrings
(pipelock.py, cred_proxy.py prepare(), manifest._parse_https_host,
test_pipelock_allowlist.py module doc) and removes dead helpers
from the integration test (the _bottle helper used a tokens field
that no longer parses).

tests/integration/test_cred_proxy_sidecar.py

@@ -11,7 +11,6 @@ egress net. cred-proxy straddles both.
 
 from __future__ import annotations
 
-import dataclasses
 import json
 import os
 import shutil
@@ -32,8 +31,6 @@ from claude_bottle.backend.docker.network import (
     network_create_internal,
     network_remove,
 )
-from claude_bottle.cred_proxy import CredProxy
-from claude_bottle.manifest import Manifest
 from tests._docker import skip_unless_docker
 
 
@@ -43,24 +40,6 @@ FAKE_UPSTREAM_HOST = "fake-upstream"
 FAKE_UPSTREAM_PORT = "8080"
 
 
-def _bottle(tokens):
-    return Manifest.from_json_obj({
-        "bottles": {"dev": {"tokens": tokens}},
-        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-    }).bottles["dev"]
-
-
-class _StubCredProxy(CredProxy):
-    """CredProxy.prepare's render uses the Kind defaults, but the
-    integration test needs the cred-proxy to forward to the fake
-    upstream — not api.anthropic.com / github.com / npmjs.org. We
-    pass a one-route plan in directly via DockerCredProxy.start
-    rather than going through the manifest path."""
-
-    def start(self, plan): raise NotImplementedError
-    def stop(self, target): return None
-
-
 def _make_routes_json(upstream_host: str, upstream_port: str) -> str:
     payload = {
         "routes": [
@@ -140,12 +119,12 @@ class TestCredProxySidecar(unittest.TestCase):
 
     def _start_cred_proxy_via_production_code(self) -> str:
         """Run DockerCredProxy.start with a plan that points at the
-        fake upstream. We bypass the manifest path (which fixes
-        upstreams by Kind) by handing .start an already-rendered
-        routes.json."""
+        fake upstream. We bypass the manifest path so we can route
+        the proxy at a test-only upstream (the fake-upstream
+        container) without going through the parser."""
         from claude_bottle.cred_proxy import (
             CredProxyPlan,
-            CredProxyUpstream,
+            CredProxyRoute,
         )
         routes_path = self.work_dir / "routes.json"
         routes_path.write_text(_make_routes_json(FAKE_UPSTREAM_HOST, FAKE_UPSTREAM_PORT))
@@ -153,7 +132,7 @@ class TestCredProxySidecar(unittest.TestCase):
         plan = CredProxyPlan(
             slug=self.slug,
             routes_path=routes_path,
-            upstreams=(CredProxyUpstream(
+            routes=(CredProxyRoute(
                 path="/fake/",
                 upstream=f"http://{FAKE_UPSTREAM_HOST}:{FAKE_UPSTREAM_PORT}",
                 auth_scheme="Bearer",

tests/unit/test_cred_proxy.py

@@ -1,4 +1,4 @@
-"""Unit: CredProxy upstream lift + routes.json render + token resolution
+"""Unit: CredProxy route lift + routes.json render + token resolution
 (PRD 0010)."""
 
 import json
@@ -8,7 +8,7 @@ from claude_bottle.cred_proxy import (
     cred_proxy_render_routes,
     cred_proxy_resolve_token_values,
     cred_proxy_token_env_map,
-    cred_proxy_upstreams_for_bottle,
+    cred_proxy_routes_for_bottle,
 )
 from claude_bottle.log import Die
 from claude_bottle.manifest import Manifest
@@ -28,7 +28,7 @@ class TestUpstreamLift(unittest.TestCase):
              "auth_scheme": "Bearer", "token_ref": "CLAUDE_BOTTLE_OAUTH_TOKEN",
              "role": "anthropic-base-url"},
         ])
-        upstreams = cred_proxy_upstreams_for_bottle(b)
+        upstreams = cred_proxy_routes_for_bottle(b)
         self.assertEqual(1, len(upstreams))
         u = upstreams[0]
         self.assertEqual("/anthropic/", u.path)
@@ -47,7 +47,7 @@ class TestUpstreamLift(unittest.TestCase):
              "auth_scheme": "Bearer", "token_ref": "GH_PAT",
              "role": "git-insteadof"},
         ])
-        upstreams = cred_proxy_upstreams_for_bottle(b)
+        upstreams = cred_proxy_routes_for_bottle(b)
         self.assertEqual(2, len(upstreams))
         self.assertEqual({"CRED_PROXY_TOKEN_0"},
                          {u.token_env for u in upstreams})
@@ -61,7 +61,7 @@ class TestUpstreamLift(unittest.TestCase):
             {"path": "/c/", "upstream": "https://c.example",
              "auth_scheme": "Bearer", "token_ref": "T1"},
         ])
-        upstreams = cred_proxy_upstreams_for_bottle(b)
+        upstreams = cred_proxy_routes_for_bottle(b)
         # T1 -> slot 0, T2 -> slot 1, T1 reuses slot 0.
         self.assertEqual("CRED_PROXY_TOKEN_0", upstreams[0].token_env)
         self.assertEqual("CRED_PROXY_TOKEN_1", upstreams[1].token_env)
@@ -73,7 +73,7 @@ class TestUpstreamLift(unittest.TestCase):
              "auth_scheme": "token", "token_ref": "T"},
         ])
         self.assertEqual("https://gitea.dideric.is",
-                         cred_proxy_upstreams_for_bottle(b)[0].upstream)
+                         cred_proxy_routes_for_bottle(b)[0].upstream)
 
     def test_roles_list_passes_through(self):
         b = _bottle([
@@ -82,11 +82,11 @@ class TestUpstreamLift(unittest.TestCase):
              "role": ["git-insteadof", "tea-login"]},
         ])
         self.assertEqual(("git-insteadof", "tea-login"),
-                         cred_proxy_upstreams_for_bottle(b)[0].roles)
+                         cred_proxy_routes_for_bottle(b)[0].roles)
 
     def test_empty_routes_yields_empty_upstreams(self):
         b = _bottle([])
-        self.assertEqual((), cred_proxy_upstreams_for_bottle(b))
+        self.assertEqual((), cred_proxy_routes_for_bottle(b))
 
 
 class TestTokenEnvMap(unittest.TestCase):
@@ -97,7 +97,7 @@ class TestTokenEnvMap(unittest.TestCase):
             {"path": "/b/", "upstream": "https://b.example",
              "auth_scheme": "Bearer", "token_ref": "B"},
         ])
-        m = cred_proxy_token_env_map(cred_proxy_upstreams_for_bottle(b))
+        m = cred_proxy_token_env_map(cred_proxy_routes_for_bottle(b))
         self.assertEqual({"CRED_PROXY_TOKEN_0": "A",
                           "CRED_PROXY_TOKEN_1": "B"}, m)
 
@@ -108,7 +108,7 @@ class TestTokenEnvMap(unittest.TestCase):
             {"path": "/gh-git/", "upstream": "https://github.com",
              "auth_scheme": "Bearer", "token_ref": "GH"},
         ])
-        m = cred_proxy_token_env_map(cred_proxy_upstreams_for_bottle(b))
+        m = cred_proxy_token_env_map(cred_proxy_routes_for_bottle(b))
         self.assertEqual({"CRED_PROXY_TOKEN_0": "GH"}, m)
 
 
@@ -120,7 +120,7 @@ class TestRoutesRender(unittest.TestCase):
             {"path": "/gitea/x/", "upstream": "https://gitea.dideric.is",
              "auth_scheme": "token", "token_ref": "GITEA_TOKEN"},
         ])
-        rendered = cred_proxy_render_routes(cred_proxy_upstreams_for_bottle(b))
+        rendered = cred_proxy_render_routes(cred_proxy_routes_for_bottle(b))
         payload = json.loads(rendered)
         self.assertEqual(["routes"], list(payload.keys()))
         self.assertEqual(2, len(payload["routes"]))
@@ -134,7 +134,7 @@ class TestRoutesRender(unittest.TestCase):
         # or the host-side TokenRef name.
         b = _bottle([{"path": "/x/", "upstream": "https://x.example",
                       "auth_scheme": "Bearer", "token_ref": "GITHUB_TOKEN"}])
-        rendered = cred_proxy_render_routes(cred_proxy_upstreams_for_bottle(b))
+        rendered = cred_proxy_render_routes(cred_proxy_routes_for_bottle(b))
         self.assertNotIn("GITHUB_TOKEN", rendered)
 
     def test_empty_upstreams_renders_empty_routes_array(self):

tests/unit/test_docker_cred_proxy.py

@@ -15,7 +15,7 @@ from claude_bottle.backend.docker.cred_proxy import (
     cred_proxy_container_name,
     cred_proxy_url,
 )
-from claude_bottle.cred_proxy import CredProxyPlan, CredProxyUpstream
+from claude_bottle.cred_proxy import CredProxyPlan, CredProxyRoute
 from claude_bottle.log import Die
 
 
@@ -23,7 +23,7 @@ def _empty_plan(**overrides):
     base = {
         "slug": "demo",
         "routes_path": Path("/nonexistent"),
-        "upstreams": (),
+        "routes": (),
         "token_env_map": {},
         "internal_network": "",
         "egress_network": "",
@@ -56,17 +56,17 @@ class TestStartGuards(unittest.TestCase):
             self.proxy.start(_empty_plan())
 
     def test_missing_internal_network_dies(self):
-        upstream = CredProxyUpstream(
+        upstream = CredProxyRoute(
             path="/anthropic/",
             upstream="https://api.anthropic.com",
             auth_scheme="Bearer", token_env="CRED_PROXY_TOKEN_0",
             token_ref="T",
         )
         with self.assertRaises(Die):
-            self.proxy.start(_empty_plan(upstreams=(upstream,)))
+            self.proxy.start(_empty_plan(routes=(upstream,)))
 
     def test_missing_routes_file_dies(self):
-        upstream = CredProxyUpstream(
+        upstream = CredProxyRoute(
             path="/anthropic/",
             upstream="https://api.anthropic.com",
             auth_scheme="Bearer", token_env="CRED_PROXY_TOKEN_0",
@@ -74,7 +74,7 @@ class TestStartGuards(unittest.TestCase):
         )
         with self.assertRaises(Die):
             self.proxy.start(_empty_plan(
-                upstreams=(upstream,),
+                routes=(upstream,),
                 internal_network="net-x",
                 egress_network="egress-x",
                 routes_path=Path("/tmp/cred-proxy-test-does-not-exist.json"),
@@ -83,7 +83,7 @@ class TestStartGuards(unittest.TestCase):
     def test_pipelock_url_without_ca_dies(self):
         # URL set + CA path empty/missing is a wiring bug: either both
         # populated (production) or both empty (test escape hatch).
-        upstream = CredProxyUpstream(
+        upstream = CredProxyRoute(
             path="/anthropic/",
             upstream="https://api.anthropic.com",
             auth_scheme="Bearer", token_env="CRED_PROXY_TOKEN_0",
@@ -92,7 +92,7 @@ class TestStartGuards(unittest.TestCase):
         with tempfile.NamedTemporaryFile() as routes:
             with self.assertRaises(Die):
                 self.proxy.start(_empty_plan(
-                    upstreams=(upstream,),
+                    routes=(upstream,),
                     internal_network="net-x",
                     egress_network="egress-x",
                     routes_path=Path(routes.name),

tests/unit/test_pipelock_allowlist.py

@@ -1,7 +1,7 @@
 """Unit: pipelock_effective_allowlist — the union of baked-in defaults,
 bottle.egress.allowlist, and cred-proxy upstream hosts derived from
-bottle.tokens (PRD 0010). Git upstreams declared in bottle.git do not
-contribute here; they flow through the per-agent git-gate (PRD 0008)."""
+bottle.cred_proxy.routes (PRD 0010). Git upstreams declared in bottle.git
+do not contribute here; they flow through the per-agent git-gate (PRD 0008)."""
 
 import unittest
 

tests/unit/test_provision_cred_proxy.py

@@ -10,7 +10,7 @@ from claude_bottle.backend.docker.provision.cred_proxy import (
     render_npmrc,
     render_tea_config,
 )
-from claude_bottle.cred_proxy import cred_proxy_upstreams_for_bottle
+from claude_bottle.cred_proxy import cred_proxy_routes_for_bottle
 from claude_bottle.manifest import Manifest
 
 
@@ -22,7 +22,7 @@ def _bottle(routes):
 
 
 def _upstreams(routes):
-    return cred_proxy_upstreams_for_bottle(_bottle(routes))
+    return cred_proxy_routes_for_bottle(_bottle(routes))
 
 
 class TestRenderNpmrc(unittest.TestCase):