refactor(gateway): replace flat-file import shims with installed package

Install bot_bottle via pip in Dockerfile.gateway instead of COPYing
individual .py files flat under /app/. This eliminates the try/except
import shims in egress_addon_core, dlp_detectors, egress_addon,
supervise, supervise_server, and git_http_backend that existed only
to support the flat-bundle layout.

Adds bot_bottle/constants.py as a single source of truth for
IDENTITY_HEADER and GIT_GATE_TIMEOUT_SECS, removing the duplicated
literal definitions in egress_addon.py, supervise_server.py,
git_http_backend.py, and git_gate_render.py.

Test files updated to match: test_supervise_server.py drops the
sys.path.insert hack in favour of direct package imports; the
egress_addon test shims no longer pre-populate sys.modules with a
bare egress_addon_core alias.

bot_bottle/constants.py

@@ -0,0 +1,17 @@
+"""Shared wire-protocol constants for gateway-bundled modules.
+
+Single source of truth for values that appear across the egress addon,
+git-http backend, supervise server, and git-gate renderer. Importing
+from this module instead of duplicating the literals means a rename is
+a one-line change and is caught by the type checker at the import site."""
+
+# App-layer identity token header. Delivered as proxy credentials
+# (HTTPS_PROXY=http://<bottle_id>:<token>@gw) by launch; the egress
+# addon reads and strips it, the supervise server and git-http backend
+# read it for attribution, and none of them forward it upstream.
+IDENTITY_HEADER = "x-bot-bottle-identity"
+
+# Shared timeout (seconds) for all git-gate subprocess and CGI calls:
+# git daemon (--timeout/--init-timeout), the access-hook subprocess in
+# git_http_backend, and the git http-backend CGI subprocess.
+GIT_GATE_TIMEOUT_SECS = 15

bot_bottle/dlp_detectors.py

@@ -3,9 +3,8 @@
 Pure Python, no mitmproxy dependency. Each detector is a module-level
 function returning `ScanResult | None`.
 
-Ships flat into the gateway image alongside
-`egress_addon_core.py` — both this file and the package source use
-the same try/except import shim pattern.
+Available in the gateway via the installed `bot_bottle` package
+(see `Dockerfile.gateway`).
 """
 
 from __future__ import annotations
@@ -20,10 +19,7 @@ from math import log2
 from collections import Counter
 from urllib.parse import quote as url_quote
 
-try:
-    from egress_addon_core import ScanResult  # type: ignore[import-not-found]
-except ImportError:  # pragma: no cover - host-side path
-    from .egress_addon_core import ScanResult
+from .egress_addon_core import ScanResult
 
 
 # ---------------------------------------------------------------------------

bot_bottle/egress_addon.py

@@ -15,7 +15,9 @@ import typing
 
 from mitmproxy import http  # type: ignore[import-not-found]  # pylint: disable=import-error
 
-from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: disable=import-error
+from bot_bottle.constants import IDENTITY_HEADER
+from bot_bottle.dlp_detectors import redact_tokens, strip_crlf
+from bot_bottle.egress_addon_core import (
     LOG_BLOCKS,
     LOG_FULL,
     DEFAULT_OUTBOUND_ON_MATCH,
@@ -38,24 +40,8 @@ from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: dis
     scan_inbound,
     scan_outbound,
 )
-
-try:
-    from dlp_detectors import redact_tokens, strip_crlf  # type: ignore[import-not-found]
-except ImportError:  # pragma: no cover - host-side path
-    from bot_bottle.dlp_detectors import (  # type: ignore[import-not-found]
-        redact_tokens,
-        strip_crlf,
-    )
-
-try:
-    import supervise as _sv  # type: ignore[import-not-found]
-except ImportError:  # pragma: no cover - host-side path
-    from bot_bottle import supervise as _sv  # type: ignore[import-not-found]
-
-try:
-    from policy_resolver import PolicyResolver  # type: ignore[import-not-found]
-except ImportError:  # pragma: no cover - host-side path
-    from bot_bottle.policy_resolver import PolicyResolver
+from bot_bottle import supervise as _sv
+from bot_bottle.policy_resolver import PolicyResolver
 
 
 INTROSPECT_HOST = "_egress.local"
@@ -66,13 +52,6 @@ INTROSPECT_HOST = "_egress.local"
 # back to — so an unset value is a fatal misconfiguration (see __init__).
 ORCHESTRATOR_URL_ENV = "BOT_BOTTLE_ORCHESTRATOR_URL"
 
-# App-layer identity token. Delivered as proxy credentials
-# (`HTTPS_PROXY=http://<bottle_id>:<token>@gw`): clients honor it as part of
-# the proxy protocol without app changes, and the addon reads + strips it so
-# it never leaks upstream. The legacy `x-bot-bottle-identity` request header
-# is still stripped defensively (git-http uses that header on its own port).
-IDENTITY_HEADER = "x-bot-bottle-identity"
-
 # Per-flow key under which `request()` stashes the resolved (Config, supervise
 # slug, env) so the later `response()` and `websocket_message()` hooks scan
 # against the *calling bottle's* policy — the same one the request was decided

bot_bottle/egress_addon_core.py

@@ -6,9 +6,9 @@ exercise the parse + decision functions without depending on the
 `mitmproxy.http.HTTPFlow` API and is loaded inside the gateway
 container.
 
-Imports: stdlib + `yaml_subset` (which is itself stdlib-only and
-ships flat into the gateway image alongside this file —
-see `Dockerfile.gateway`)."""
+Imports: stdlib + sibling package modules (`yaml_subset`,
+`egress_dlp_config`). Available in the gateway via the installed
+`bot_bottle` package (see `Dockerfile.gateway`)."""
 
 from __future__ import annotations
 
@@ -16,36 +16,20 @@ import re
 import typing
 from dataclasses import dataclass
 
-try:
-    from yaml_subset import YamlSubsetError, parse_yaml_subset  # type: ignore[import-not-found]
-except ImportError:  # pragma: no cover - host-side path
-    from .yaml_subset import YamlSubsetError, parse_yaml_subset
+from .yaml_subset import YamlSubsetError, parse_yaml_subset
 
-# DLP detector-config parsing lives in a sibling module (also flat-bundled
-# into the gateway — see Dockerfile.gateway). Re-exported below so existing
-# `from egress_addon_core import ON_MATCH_*` callers keep working.
-try:
-    from egress_dlp_config import (  # type: ignore[import-not-found]
-        DEFAULT_OUTBOUND_ON_MATCH,
-        INBOUND_DETECTOR_NAMES,
-        ON_MATCH_BLOCK,
-        ON_MATCH_REDACT,
-        ON_MATCH_SUPERVISE,
-        OUTBOUND_DETECTOR_NAMES,
-        OUTBOUND_ON_MATCH_VALUES,
-        parse_dlp_block,
-    )
-except ImportError:  # pragma: no cover - host-side path
-    from .egress_dlp_config import (
-        DEFAULT_OUTBOUND_ON_MATCH,
-        INBOUND_DETECTOR_NAMES,
-        ON_MATCH_BLOCK,
-        ON_MATCH_REDACT,
-        ON_MATCH_SUPERVISE,
-        OUTBOUND_DETECTOR_NAMES,
-        OUTBOUND_ON_MATCH_VALUES,
-        parse_dlp_block,
-    )
+# DLP detector-config parsing lives in a sibling module. Re-exported below
+# so existing `from egress_addon_core import ON_MATCH_*` callers keep working.
+from .egress_dlp_config import (
+    DEFAULT_OUTBOUND_ON_MATCH,
+    INBOUND_DETECTOR_NAMES,
+    ON_MATCH_BLOCK,
+    ON_MATCH_REDACT,
+    ON_MATCH_SUPERVISE,
+    OUTBOUND_DETECTOR_NAMES,
+    OUTBOUND_ON_MATCH_VALUES,
+    parse_dlp_block,
+)
 
 
 # ---------------------------------------------------------------------------

bot_bottle/git_gate_render.py

@@ -14,18 +14,12 @@ import shlex
 from dataclasses import dataclass
 from pathlib import Path
 
+from .constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
 from .manifest import ManifestBottle, ManifestGitEntry
 
 # Short network alias for git-gate inside the gateway. The
 # agent's `.gitconfig` insteadOf rewrites resolve through this name.
 GIT_GATE_HOSTNAME = "git-gate"
-# App-layer identity token header the agent's git sends to git-http and the
-# gateway validates (mirrors egress_addon / git_http_backend IDENTITY_HEADER).
-IDENTITY_HEADER = "x-bot-bottle-identity"
-# Shared timeout (seconds) for all git-gate subprocess and CGI calls:
-# git daemon (--timeout/--init-timeout), the access-hook subprocess in
-# git_http_backend, and the git http-backend CGI subprocess.
-GIT_GATE_TIMEOUT_SECS = 15
 
 
 @dataclass(frozen=True)

bot_bottle/git_http_backend.py

@@ -26,16 +26,8 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from urllib.parse import urlsplit
 
-# policy_resolver ships flat alongside this file in the gateway
-# image (see Dockerfile.gateway); the bot_bottle.* fallback is the
-# host-side / test path. Mirrors egress_addon's import shape.
-try:
-    from policy_resolver import (  # type: ignore[import-not-found]
-        PolicyResolveError,
-        PolicyResolver,
-    )
-except ImportError:  # pragma: no cover - host-side path
-    from bot_bottle.policy_resolver import PolicyResolveError, PolicyResolver
+from bot_bottle.constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
+from bot_bottle.policy_resolver import PolicyResolveError, PolicyResolver
 
 
 DEFAULT_PORT = 9420
@@ -46,12 +38,6 @@ DEFAULT_PORT = 9420
 # repo-root fallback.
 ORCHESTRATOR_URL_ENV = "BOT_BOTTLE_ORCHESTRATOR_URL"
 
-# App-layer identity token (defense-in-depth over the source-IP invariant);
-# the agent injects it, the backend reads it for attribution and never
-# forwards it to `git http-backend`. Mirrors egress_addon.IDENTITY_HEADER
-# (duplicated, not imported: egress_addon pulls in mitmproxy).
-IDENTITY_HEADER = "x-bot-bottle-identity"
-
 # The base under which each bottle's `<bottle_id>` repo namespace is nested.
 DEFAULT_REPO_ROOT = "/git"
 
@@ -89,13 +75,6 @@ def resolve_sandbox_root(
         return None  # bottle_id tried to escape the root → deny
     return namespace
 
-# Mirrors git_gate_render.GIT_GATE_TIMEOUT_SECS. Duplicated rather than
-# imported: this module ships as a flat top-level sibling in the gateway
-# bundle image (see Dockerfile.gateway), not as part of the bot_bottle
-# package, so `bot_bottle.git_gate` and its dependency chain aren't
-# available at runtime.
-GIT_GATE_TIMEOUT_SECS = 15
-
 # Bound memory use while still allowing ordinary git push packfiles.
 MAX_BODY_BYTES = 100 * 1024 * 1024
 

bot_bottle/policy_resolver.py

@@ -22,8 +22,7 @@ closed too rather than silently serving stale or empty policy.
 
 The resolved value is the policy blob the orchestrator stores verbatim; the
 consumer parses it (e.g. the egress addon's `load_config`). This module is
-stdlib-only and free of bot-bottle imports so it can be COPYed flat into
-the gateway.
+stdlib-only and free of bot-bottle imports.
 """
 
 from __future__ import annotations

bot_bottle/supervise.py

@@ -37,40 +37,22 @@ from abc import ABC
 from dataclasses import dataclass
 from pathlib import Path
 
-try:
-    from .supervise_types import (
-        ACTION_OPERATOR_EDIT,
-        AuditEntry,
-        Proposal,
-        Response,
-        STATUSES,
-        STATUS_APPROVED,
-        STATUS_MODIFIED,
-        STATUS_REJECTED,
-        TOOLS,
-        TOOL_EGRESS_ALLOW,
-        TOOL_EGRESS_BLOCK,
-        TOOL_EGRESS_TOKEN_ALLOW,
-        TOOL_GITLEAKS_ALLOW,
-        TOOL_LIST_EGRESS_ROUTES,
-    )
-except ImportError:
-    from supervise_types import (  # type: ignore[import-not-found,no-redef]  # pylint: disable=import-error,no-name-in-module
-        ACTION_OPERATOR_EDIT,
-        AuditEntry,
-        Proposal,
-        Response,
-        STATUSES,
-        STATUS_APPROVED,
-        STATUS_MODIFIED,
-        STATUS_REJECTED,
-        TOOLS,
-        TOOL_EGRESS_ALLOW,
-        TOOL_EGRESS_BLOCK,
-        TOOL_EGRESS_TOKEN_ALLOW,
-        TOOL_GITLEAKS_ALLOW,
-        TOOL_LIST_EGRESS_ROUTES,
-    )
+from .supervise_types import (
+    ACTION_OPERATOR_EDIT,
+    AuditEntry,
+    Proposal,
+    Response,
+    STATUSES,
+    STATUS_APPROVED,
+    STATUS_MODIFIED,
+    STATUS_REJECTED,
+    TOOLS,
+    TOOL_EGRESS_ALLOW,
+    TOOL_EGRESS_BLOCK,
+    TOOL_EGRESS_TOKEN_ALLOW,
+    TOOL_GITLEAKS_ALLOW,
+    TOOL_LIST_EGRESS_ROUTES,
+)
 
 
 try:

bot_bottle/supervise_server.py

@@ -26,9 +26,8 @@ Speaks MCP over HTTP+JSON-RPC. Methods handled:
 
 Everything else returns JSON-RPC error -32601 (method not found).
 
-Stdlib-only. The Dockerfile copies this file + bot_bottle/supervise.py
-into the image; the server imports `supervise` for the queue / Proposal
-plumbing.
+The Dockerfile copies this script to /app/supervise_server.py and installs
+the bot_bottle package so its `from bot_bottle.*` imports resolve.
 """
 
 from __future__ import annotations
@@ -42,29 +41,18 @@ import time
 import typing
 from dataclasses import dataclass, replace
 
-try:
-    # Same-directory imports inside the bundle container; these files are
-    # COPYed flat under /app by Dockerfile.gateway.
-    from egress_addon_core import (
-        LOG_OFF, load_config, resolve_client_context, route_to_yaml_dict,
-    )
-    from policy_resolver import PolicyResolveError, PolicyResolver
-    import supervise as _sv
-except ModuleNotFoundError:
-    # Package imports for host-side tests and tooling.
-    from .egress_addon_core import (
-        LOG_OFF, load_config, resolve_client_context, route_to_yaml_dict,
-    )
-    from .policy_resolver import PolicyResolveError, PolicyResolver
-    from . import supervise as _sv
+from bot_bottle.constants import IDENTITY_HEADER
+from bot_bottle.egress_addon_core import (
+    LOG_OFF, load_config, resolve_client_context, route_to_yaml_dict,
+)
+from bot_bottle.policy_resolver import PolicyResolveError, PolicyResolver
+from bot_bottle import supervise as _sv
 
 
 # --- JSON-RPC / MCP plumbing ----------------------------------------------
 
 
 MCP_PROTOCOL_VERSION = "2024-11-05"
-# App-layer identity token header (mirrors egress_addon / git_http_backend).
-IDENTITY_HEADER = "x-bot-bottle-identity"
 SERVER_NAME = "bot-bottle-supervise"
 SERVER_VERSION = "0.1.0"