refactor(manifest): raise ManifestError instead of die()

Review feedback on #102: a manifest that can't be read should raise an
exception, not call die() (a SystemExit). That SystemExit was the whole
reason the dashboard had to special-case Die.

manifest.py now raises ManifestError (a plain Exception) for every
validation failure. The CLI dispatcher catches it and prints+exits 1
(same UX as before); the dashboard catches it with a normal
`except ManifestError` and degrades to a status-line warning. Manifest
tests assert on ManifestError + its message.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/cli/__init__.py

@@ -7,7 +7,8 @@ from __future__ import annotations
 
 import sys
 
-from ..log import Die, die
+from ..log import Die, die, error
+from ..manifest import ManifestError
 from ._common import PROG
 from . import list as _list_mod
 from .cleanup import cmd_cleanup
@@ -63,6 +64,11 @@ def main(argv: list[str] | None = None) -> int:
         die(f"unknown command: {command}")
     try:
         return handler(rest) or 0
+    except ManifestError as e:
+        # Manifest/config problems surface as a catchable exception;
+        # print the reason and exit non-zero (same UX die() used to give).
+        error(str(e))
+        return 1
     except Die as e:
         return e.code if isinstance(e.code, int) else 1
     except KeyboardInterrupt:

bot_bottle/cli/dashboard.py

@@ -54,7 +54,7 @@ from ..backend.docker.pipelock_apply import (
     render_allowlist_content,
 )
 from ..log import Die, error, info
-from ..manifest import Manifest
+from ..manifest import Manifest, ManifestError
 from ..supervise import (
     ACTION_OPERATOR_EDIT,
     COMPONENT_FOR_TOOL,
@@ -1458,14 +1458,12 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:
         return manifest_cache[0]
     # A malformed manifest must not take the whole dashboard down — the
     # operator may just be watching running bottles. Degrade to a
-    # status-line warning. Die is a SystemExit (not an Exception), so it
-    # has to be caught explicitly or it escapes the loop and crashes.
+    # status-line warning instead. (Any non-config error propagates to
+    # cmd_dashboard's crash handler.)
     try:
         _loaded = _get_manifest()
-    except Die as e:
-        status_line = f"config error: {e.message or 'malformed manifest'}"
-    except Exception as e:
-        status_line = f"config load failed: {e}"
+    except ManifestError as e:
+        status_line = f"config error: {e}"
     else:
         if not _loaded.bottles and not _loaded.agents:
             status_line = "warning: no bot-bottle config/agents found; new-agent picker is empty"
@@ -1554,10 +1552,8 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:
             # bottle running.
             try:
                 manifest = _get_manifest()
-            except Die as e:
-                # Config error (Die is a SystemExit, missed by the
-                # except-Exception below). Surface the reason inline.
-                status_line = f"config error: {e.message or 'malformed manifest'}"
+            except ManifestError as e:
+                status_line = f"config error: {e}"
                 continue
             except Exception as e:
                 status_line = f"manifest load failed: {e}"