refactor(smolmachines): inline sidecar proxy host

bot_bottle/backend/smolmachines/launch.py

@@ -92,7 +92,7 @@ def launch(
     try:
         loopback_ip, network = _allocate_resources(plan, stack)
         plan = _mint_certs(plan)
-        proxy_host = _proxy_host(plan, loopback_ip)
+        proxy_host = loopback_ip
         plan = _start_bundle(plan, network, proxy_host, stack)
 
         agent_from_path = _agent_from_path(plan)
@@ -287,14 +287,13 @@ def _launch_vm(
 ) -> None:
     """Create, patch, and start the smolvm VM; register teardown.
 
-    --allow-cidr is `proxy_host/32` — the per-bottle loopback alias
+    --allow-cidr is `proxy_host/32` — the per-bottle loopback alias.
-    on macOS or the bridge gateway on Linux (see `_proxy_host`). This
+    This ensures the guest can only reach sidecar forwarders published
-    ensures the guest can only reach bundle ports published on that IP,
+    on that IP, not host localhost or another bottle's alias.
-    not the container IP directly. force_allowlist confirms the
+    force_allowlist confirms the allowlist persisted (patching smolvm
-    allowlist persisted (patching smolvm 0.8.0's silent-drop of
+    0.8.0's silent-drop of --allow-cidr when combined with --from) and
-    --allow-cidr when combined with --from) and fails closed if it
+    fails closed if it can't. Smolfile isn't usable here — smolvm 0.8.0
-    can't. Smolfile isn't usable here — smolvm 0.8.0 makes --from
+    makes --from and --smolfile mutually exclusive."""
-    and --smolfile mutually exclusive."""
     tsi_cidr = f"{proxy_host}/32"
     _smolvm.machine_create(
         plan.machine_name,
@@ -341,12 +340,6 @@ def _init_vm(plan: SmolmachinesBottlePlan) -> None:
     _smolvm.wait_exec_ready(plan.machine_name)
 
 
-def _proxy_host(plan: SmolmachinesBottlePlan, loopback_ip: str) -> str:
-    """Return the per-bottle host address used for TSI and forwarders."""
-    del plan
-    return loopback_ip
-
-
 def _label_for_port(port: int) -> str:
     if port == _EGRESS_PORT:
         return "egress"

tests/unit/test_smolmachines_provision.py

@@ -503,15 +503,6 @@ class TestProvisionGitUser(unittest.TestCase):
         self.assertIn("bot@example.com", calls[0][0])
 
 
-class TestProxyHost(unittest.TestCase):
-    """_proxy_host returns the per-bottle address used by the forwarder."""
-
-    def test_returns_loopback_alias(self):
-        plan = _plan()
-        result = _launch._proxy_host(plan, "127.0.0.16")
-        self.assertEqual("127.0.0.16", result)
-
-
 class TestLaunchResourceWiring(unittest.TestCase):
     def test_allocate_resources_uses_loopback_alias_and_bundle_name(self):
         plan = _plan()