refactor(backend): introduce BottleProvisioner ABC + DockerBottleProvisioner

Lift the file-copying-into-the-running-container step out of
DockerBottleBackend._provision_container into its own class. The
backend now holds a DockerBottleProvisioner instance and delegates
the post-launch provisioning to it.

  - BottleProvisioner (abstract) in backend/__init__.py with a
    `provision(plan, target) -> str | None` method.
  - DockerBottleProvisioner (concrete) in backend/docker/provisioner.py
    inheriting from the base, narrowing plan to DockerBottlePlan via
    isinstance, and carrying the prompt/skills/SSH/.git copy logic
    unchanged.
  - DockerBottleBackend keeps a class-level DockerBottleProvisioner()
    and calls self._provisioner.provision(plan, container) from launch.
    _provision_container method removed.

No behavior change.

claude_bottle/backend/__init__.py

@@ -104,6 +104,22 @@ class Bottle(ABC):
     def close(self) -> None: ...
 
 
+class BottleProvisioner(ABC):
+    """Copies host-side files (prompt, skills, SSH keys, .git) into a
+    running bottle after the container/machine is up. Owned by a
+    BottleBackend; called from its launch step before yielding the
+    Bottle handle."""
+
+    @abstractmethod
+    def provision(self, plan: BottlePlan, target: str) -> str | None:
+        """Provision the running bottle described by `plan`. `target`
+        identifies the running instance in backend-specific terms
+        (Docker: resolved container name; fly: machine id). Returns the
+        in-container prompt path if a prompt was provisioned, else
+        None — the Bottle handle uses it to decide whether to add
+        --append-system-prompt-file to claude's argv."""
+
+
 class BottleBackend(ABC):
     """Abstract base for selectable bottle backends. Concrete subclasses
     (e.g. DockerBottleBackend) own their own prepare/launch impls.
@@ -162,6 +178,7 @@ __all__ = [
     "BottleBackend",
     "BottleCleanupPlan",
     "BottlePlan",
+    "BottleProvisioner",
     "BottleSpec",
     "get_bottle_backend",
 ]

claude_bottle/backend/docker/__init__.py

@@ -7,6 +7,7 @@ The bulk of the implementation lives in sibling modules:
   - bottle_plan:          DockerBottlePlan
   - bottle_cleanup_plan:  DockerBottleCleanupPlan
   - bottle:               DockerBottle handle
+  - provisioner:          DockerBottleProvisioner
   - backend:              DockerBottleBackend
 
 This file only re-exports the public names so
@@ -20,10 +21,12 @@ from .backend import DockerBottleBackend
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
+from .provisioner import DockerBottleProvisioner
 
 __all__ = [
     "DockerBottle",
     "DockerBottleBackend",
     "DockerBottleCleanupPlan",
     "DockerBottlePlan",
+    "DockerBottleProvisioner",
 ]

claude_bottle/backend/docker/backend.py

@@ -28,6 +28,7 @@ from . import util as docker_mod
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
+from .provisioner import DockerBottleProvisioner
 
 
 # Where the repo root lives, for `docker build` context. Computed once.
@@ -39,6 +40,7 @@ class DockerBottleBackend(BottleBackend):
     (default)."""
 
     name = "docker"
+    _provisioner: DockerBottleProvisioner = DockerBottleProvisioner()
 
     def prepare(self, spec: BottleSpec, *, stage_dir: Path) -> DockerBottlePlan:
         """Resolve names, validate, write scratch files. No Docker
@@ -185,7 +187,7 @@ class DockerBottleBackend(BottleBackend):
             container = self._run_agent_container(plan, state["internal_network"])
             state["container"] = container
 
-            prompt_path = self._provision_container(plan, container)
+            prompt_path = self._provisioner.provision(plan, container)
 
             bottle = DockerBottle(container, teardown, prompt_path)
             yield bottle
@@ -258,60 +260,6 @@ class DockerBottleBackend(BottleBackend):
             docker_args[name_idx] = container
             info(f"name conflict; retrying as {container}")
 
-    def _provision_container(self, plan: DockerBottlePlan, container: str) -> str | None:
-        """Copy prompt, skills, ssh keys, and (optionally) .git into the
-        running container. Returns the in-container prompt path if a
-        prompt was provisioned, else None — the Bottle handle uses it
-        to decide whether to add --append-system-prompt-file to
-        claude's argv."""
-        container_home = os.environ.get("CLAUDE_BOTTLE_CONTAINER_HOME", "/home/node")
-        in_container_prompt_path = f"{container_home}/.claude-bottle-prompt.txt"
-
-        subprocess.run(
-            ["docker", "cp", str(plan.prompt_file), f"{container}:{in_container_prompt_path}"],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-        # `docker cp` preserves host UID; re-own/mode as root so node
-        # can read its own mode-600 prompt regardless of host UID.
-        subprocess.run(
-            ["docker", "exec", "-u", "0", container, "chown", "node:node", in_container_prompt_path],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-        subprocess.run(
-            ["docker", "exec", "-u", "0", container, "chmod", "600", in_container_prompt_path],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
-        if agent.skills:
-            skills_mod.skills_copy_into(container, list(agent.skills))
-
-        bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
-        if bottle.ssh:
-            proxy_host_port = pipelock.pipelock_proxy_host_port(plan.slug)
-            ssh_mod.ssh_setup(container, plan.stage_dir, proxy_host_port, bottle.ssh)
-
-        if plan.spec.copy_cwd and Path(plan.spec.user_cwd, ".git").is_dir():
-            info(f"copying {plan.spec.user_cwd}/.git -> {container}:/home/node/workspace/.git")
-            subprocess.run(
-                ["docker", "cp", f"{plan.spec.user_cwd}/.git", f"{container}:/home/node/workspace/.git"],
-                stdout=subprocess.DEVNULL,
-                check=True,
-            )
-            subprocess.run(
-                [
-                    "docker", "exec", "-u", "0", container,
-                    "chown", "-R", "node:node", "/home/node/workspace/.git",
-                ],
-                stdout=subprocess.DEVNULL,
-                check=True,
-            )
-
-        return in_container_prompt_path if agent.prompt else None
-
     # --- Cleanup ---
 
     def prepare_cleanup(self) -> DockerBottleCleanupPlan:

claude_bottle/backend/docker/provisioner.py

@@ -0,0 +1,79 @@
+"""DockerBottleProvisioner — copies prompt, skills, SSH keys, and
+.git into a running Docker container.
+
+Called by DockerBottleBackend.launch after the agent container is up
+but before the DockerBottle handle is yielded. The returned in-
+container prompt path tells the handle whether to add
+--append-system-prompt-file to claude's argv.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+from ... import pipelock
+from ... import skills as skills_mod
+from ... import ssh as ssh_mod
+from ...log import info
+from .. import BottlePlan, BottleProvisioner
+from .bottle_plan import DockerBottlePlan
+
+
+class DockerBottleProvisioner(BottleProvisioner):
+    """Docker implementation of BottleProvisioner."""
+
+    def provision(self, plan: BottlePlan, target: str) -> str | None:
+        assert isinstance(plan, DockerBottlePlan), (
+            f"DockerBottleProvisioner.provision expects DockerBottlePlan, "
+            f"got {type(plan).__name__}"
+        )
+        container = target
+        container_home = os.environ.get("CLAUDE_BOTTLE_CONTAINER_HOME", "/home/node")
+        in_container_prompt_path = f"{container_home}/.claude-bottle-prompt.txt"
+
+        subprocess.run(
+            ["docker", "cp", str(plan.prompt_file), f"{container}:{in_container_prompt_path}"],
+            stdout=subprocess.DEVNULL,
+            check=True,
+        )
+        # `docker cp` preserves host UID; re-own/mode as root so node
+        # can read its own mode-600 prompt regardless of host UID.
+        subprocess.run(
+            ["docker", "exec", "-u", "0", container, "chown", "node:node", in_container_prompt_path],
+            stdout=subprocess.DEVNULL,
+            check=True,
+        )
+        subprocess.run(
+            ["docker", "exec", "-u", "0", container, "chmod", "600", in_container_prompt_path],
+            stdout=subprocess.DEVNULL,
+            check=True,
+        )
+
+        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        if agent.skills:
+            skills_mod.skills_copy_into(container, list(agent.skills))
+
+        bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
+        if bottle.ssh:
+            proxy_host_port = pipelock.pipelock_proxy_host_port(plan.slug)
+            ssh_mod.ssh_setup(container, plan.stage_dir, proxy_host_port, bottle.ssh)
+
+        if plan.spec.copy_cwd and Path(plan.spec.user_cwd, ".git").is_dir():
+            info(f"copying {plan.spec.user_cwd}/.git -> {container}:/home/node/workspace/.git")
+            subprocess.run(
+                ["docker", "cp", f"{plan.spec.user_cwd}/.git", f"{container}:/home/node/workspace/.git"],
+                stdout=subprocess.DEVNULL,
+                check=True,
+            )
+            subprocess.run(
+                [
+                    "docker", "exec", "-u", "0", container,
+                    "chown", "-R", "node:node", "/home/node/workspace/.git",
+                ],
+                stdout=subprocess.DEVNULL,
+                check=True,
+            )
+
+        return in_container_prompt_path if agent.prompt else None