refactor(codex): derive trusted paths from guest home

bot_bottle/backend/smolmachines/provision/provider_auth.py

@@ -11,18 +11,15 @@ from ..bottle_plan import SmolmachinesBottlePlan
 
 
 _DEFAULT_GUEST_HOME = "/home/node"
-_CODEX_HOME_PROJECT = "/home/node"
-_CODEX_WORKSPACE = "/home/node/workspace"
 
 
 def provision_provider_auth(plan: SmolmachinesBottlePlan, target: str) -> None:
     """Prepare Codex home state inside the smolmachine.
 
     Every Codex bottle gets a minimal config.toml that trusts the
-    in-guest launch directory and workspace path. When host credentials
-    are forwarded, the real host access token remains in the egress
-    bundle env; auth.json only selects Codex's user/device auth code
-    path.
+    in-guest launch directory. When host credentials are forwarded,
+    the real host access token remains in the egress bundle env;
+    auth.json only selects Codex's user/device auth code path.
     """
     if plan.agent_provider_template != "codex":
         return
@@ -72,10 +69,7 @@ def provision_provider_auth(plan: SmolmachinesBottlePlan, target: str) -> None:
 
     config_path = f"{auth_dir}/config.toml"
     config = (
-        f'[projects."{_CODEX_HOME_PROJECT}"]\n'
-        'trust_level = "trusted"\n'
-        "\n"
-        f'[projects."{_CODEX_WORKSPACE}"]\n'
+        f'[projects."{guest_home}"]\n'
         'trust_level = "trusted"\n'
     )
     result = _smolvm.machine_exec(