fix(smolmachines): exclude /tmp+/var/tmp from snapshot; mkdir -p on boot

On resume from a committed snapshot, smolvm's pack process remaps all
file uids to the host uid (501 on macOS). Files in /tmp that were
created during the session (e.g. /tmp/claude-1000 owned by node=uid
1000) get remapped to 501. Claude Code then refuses to use the temp
directory because it's owned by a different uid.

Two-part fix:
- Exclude ./tmp and ./var/tmp from the tar in _exec_tar_to_file.
  Both directories are ephemeral; a resumed VM should start with clean
  temp directories identical to a fresh VM.
- Add mkdir -p /tmp /var/tmp to _init_vm before chown/chmod, so the
  directories are created if the committed snapshot omitted them.

README.md

@@ -5,7 +5,7 @@
 # bot-bottle
 
 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![pylint](https://img.shields.io/badge/pylint-9.92%2F10-brightgreen)](https://github.com/PyCQA/pylint)
+[![pylint](https://img.shields.io/badge/pylint-9.93%2F10-brightgreen)](https://github.com/PyCQA/pylint)
 [![pyright](https://img.shields.io/badge/pyright-0%20errors-brightgreen)](https://github.com/microsoft/pyright)
 
 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.

bot_bottle/agent_provider.py

@@ -240,7 +240,7 @@ class AgentProvider(ABC):
         BottleBackend.provision_workspace against the running bottle."""
         from .log import info
 
-        manifest_bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
+        manifest_bottle = plan.manifest.bottle
         if manifest_bottle.git:
             from .git_gate import GIT_GATE_HOSTNAME, git_gate_render_gitconfig
             gate_host = getattr(plan, "git_gate_insteadof_host", GIT_GATE_HOSTNAME)

bot_bottle/backend/__init__.py

@@ -45,7 +45,7 @@ from ..agent_provider import AgentProvisionPlan, get_provider, build_agent_provi
 from ..egress import EgressPlan
 from ..git_gate import GitGatePlan
 from ..log import die, info
-from ..manifest import Manifest
+from ..manifest import Manifest, ManifestIndex
 from ..supervise import SupervisePlan
 from ..util import expand_tilde
 from ..env import resolve_env, ResolvedEnv
@@ -61,7 +61,7 @@ class BottleSpec:
     Resolved values (image names, container name, scratch paths, runsc
     availability) live on the plan, not the spec."""
 
-    manifest: Manifest
+    manifest: ManifestIndex
     agent_name: str
     copy_cwd: bool
     user_cwd: str
@@ -80,6 +80,7 @@ class BottlePlan(ABC):
     (e.g. DockerBottlePlan) add backend-specific resolved fields."""
 
     spec: BottleSpec
+    manifest: Manifest
     stage_dir: Path
     git_gate_plan: GitGatePlan
 
@@ -112,9 +113,9 @@ class BottlePlan(ABC):
         """Render the y/N preflight summary to stderr."""
         del remote_control
         spec = self.spec
-        manifest = spec.manifest
-        agent = manifest.agents[spec.agent_name]
-        bottle = manifest.bottle_for(spec.agent_name)
+        manifest = self.manifest
+        agent = manifest.agent
+        bottle = manifest.bottle
 
         env_names = visible_agent_env_names(
             sorted(
@@ -131,7 +132,7 @@ class BottlePlan(ABC):
         print_multi("skills          ", list(agent.skills))
         info(f"bottle          : {agent.bottle}")
 
-        identity = manifest.git_identity_summary(spec.agent_name)
+        identity = manifest.git_identity_summary()
         if identity:
             info(f"  git identity  : {identity}")
 
@@ -289,15 +290,14 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
             write_launch_metadata,
         )
 
-        self._validate(spec)
+        manifest = self._validate(spec)
 
         self._preflight()
 
-        manifest = spec.manifest
-        manifest_bottle = manifest.bottle_for(spec.agent_name)
+        manifest_bottle = manifest.bottle
         manifest_agent_provider = manifest_bottle.agent_provider
         agent_provider = get_provider(manifest_agent_provider.template)
-        resolved_env = resolve_env(manifest, spec.agent_name)
+        resolved_env = resolve_env(manifest)
         workspace = workspace_plan(spec, guest_home=agent_provider.guest_home)
 
         slug = mint_slug(spec)
@@ -313,7 +313,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         else:
             agent_dockerfile_path = str(agent_provider.dockerfile)
 
-        agent_dir, prompt_file = prepare_agent_state_dir(slug, spec)
+        agent_dir, prompt_file = prepare_agent_state_dir(slug, manifest)
 
         agent_provision_plan = build_agent_provision_plan(
             template=manifest_agent_provider.template,
@@ -337,6 +337,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
 
         return self._resolve_plan(
             spec,
+            manifest=manifest,
             slug=slug,
             resolved_env=resolved_env,
             agent_provision_plan=agent_provision_plan,
@@ -355,16 +356,18 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         """
         pass
 
-    def _validate(self, spec: BottleSpec) -> None:
-        """Cross-backend pre-launch checks. Confirms the agent exists
-        and the named skills are present on the host. Subclasses with
+    def _validate(self, spec: BottleSpec) -> Manifest:
+        """Cross-backend pre-launch checks. Parses the selected agent and
+        its bottle (raising ManifestError on invalid content), confirms
+        skills are present on the host, and every git IdentityFile resolves.
+
+        Returns the loaded Manifest for the selected agent. Subclasses with
         additional preconditions should override and call
         `super()._validate(spec)` first."""
-        manifest = spec.manifest
-        manifest.require_agent(spec.agent_name)
-        agent = manifest.agents[spec.agent_name]
-        self._validate_skills(agent.skills)
-        self._validate_agent_provider_dockerfile(spec)
+        manifest = spec.manifest.load_for_agent(spec.agent_name)
+        self._validate_skills(manifest.agent.skills)
+        self._validate_agent_provider_dockerfile(spec, manifest)
+        return manifest
 
     def _validate_skills(self, skills: Sequence[str]) -> None:
         """Each named skill must be a directory under the host's
@@ -378,8 +381,8 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
                     f"Create it under ~/.claude/skills/, then re-run."
                 )
 
-    def _validate_agent_provider_dockerfile(self, spec: BottleSpec) -> None:
-        bottle = spec.manifest.bottle_for(spec.agent_name)
+    def _validate_agent_provider_dockerfile(self, spec: BottleSpec, manifest: Manifest) -> None:
+        bottle = manifest.bottle
         dockerfile = bottle.agent_provider.dockerfile
         if not dockerfile:
             return
@@ -389,13 +392,14 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         if not path.is_file():
             die(
                 f"agent_provider.dockerfile for bottle "
-                f"'{spec.manifest.agents[spec.agent_name].bottle}' not found: {path}"
+                f"'{manifest.agent.bottle}' not found: {path}"
             )
 
     @abstractmethod
     def _resolve_plan(self,
                       spec: BottleSpec,
                       *,
+                      manifest: Manifest,
                       slug: str,
                       resolved_env: ResolvedEnv,
                       agent_provision_plan: AgentProvisionPlan,
@@ -522,6 +526,11 @@ from .docker import DockerBottleBackend  # noqa: E402  # pylint: disable=wrong-i
 from .macos_container import MacosContainerBottleBackend  # noqa: E402  # pylint: disable=wrong-import-position
 from .smolmachines import SmolmachinesBottleBackend  # noqa: E402  # pylint: disable=wrong-import-position
 
+# Freezer is imported after the backend classes for the same reason:
+# Freezer.commit_slug constructs ActiveAgent, which must be fully
+# defined first.
+from .freeze import CommitCancelled, Freezer, get_freezer  # noqa: E402  # pylint: disable=wrong-import-position
+
 
 # The dict is heterogeneous: each value is a BottleBackend specialized
 # over its own plan type. Concrete plan types are erased here because
@@ -609,9 +618,12 @@ __all__ = [
     "BottleCleanupPlan",
     "BottlePlan",
     "BottleSpec",
+    "CommitCancelled",
     "ExecResult",
+    "Freezer",
     "enumerate_active_agents",
     "get_bottle_backend",
+    "get_freezer",
     "has_backend",
     "known_backend_names",
 ]

bot_bottle/backend/docker/backend.py

@@ -30,6 +30,7 @@ from ...egress import EgressPlan
 from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
+from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
@@ -63,6 +64,7 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
         self,
         spec: BottleSpec,
         *,
+        manifest: Manifest,
         slug: str,
         resolved_env: ResolvedEnv,
         agent_provision_plan: AgentProvisionPlan,
@@ -73,6 +75,7 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
     ) -> DockerBottlePlan:
         return _resolve_plan.resolve_plan(
             spec,
+            manifest=manifest,
             slug=slug,
             resolved_env=resolved_env,
             agent_provision_plan=agent_provision_plan,

bot_bottle/backend/docker/compose.py

@@ -134,7 +134,7 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
     ep = plan.egress_plan
     volumes.append(_bind(ep.mitmproxy_ca_host_path, EGRESS_CA_IN_CONTAINER))
     if ep.routes:
-        volumes.append(_bind(ep.routes_path, EGRESS_ROUTES_IN_CONTAINER))
+        volumes.append(_bind(ep.routes_path.parent, str(Path(EGRESS_ROUTES_IN_CONTAINER).parent)))
         for token_env in sorted(ep.token_env_map.keys()):
             env.append(token_env)
 

bot_bottle/backend/docker/egress_apply.py

@@ -1,24 +1,21 @@
-"""Host-side helper for egress sidecar inspection (issue #198).
+"""Host-side helper for egress sidecar inspection and live updates.
 
-`_merge_single_route`, `add_route`, and `apply_routes_change` were
-removed when the egress-block MCP tool was dropped. The remaining
-helpers support runtime inspection and validation of the routes file
-without modifying it at runtime.
+The approve path uses this module to validate a proposed routes file,
+write it to the bottle's live egress state dir, and signal the sidecar
+bundle so the mitmproxy addon reloads it.
 """
 
 from __future__ import annotations
 
+import os
 import subprocess
 
 from ...egress import EGRESS_ROUTES_IN_CONTAINER
-from ...egress_addon_core import load_routes
+from ...log import warn
+from ..egress_apply import EgressApplicator, EgressApplyError
 from .sidecar_bundle import sidecar_bundle_container_name
 
 
-class EgressApplyError(RuntimeError):
-    pass
-
-
 def fetch_current_routes(slug: str) -> str:
     container = sidecar_bundle_container_name(slug)
     r = subprocess.run(
@@ -33,17 +30,31 @@ def fetch_current_routes(slug: str) -> str:
     return r.stdout
 
 
-def validate_routes_content(content: str) -> None:
-    try:
-        load_routes(content)
-    except ValueError as e:
-        raise EgressApplyError(
-            f"proposed routes.yaml is not valid: {e}"
-        ) from e
+class DockerEgressApplicator(EgressApplicator):
+    def _signal_bundle_reload(self, slug: str) -> None:
+        container = sidecar_bundle_container_name(slug)
+        result = subprocess.run(
+            ["docker", "kill", "--signal", "HUP", container],
+            capture_output=True, text=True, check=False, env=os.environ,
+        )
+        if result.returncode != 0:
+            last_error = (result.stderr or "").strip() or (result.stdout or "").strip()
+            warn(
+                f"egress: routes updated on disk for {slug}, but bundle reload failed: "
+                f"{last_error or 'docker kill failed'}"
+            )
+            raise EgressApplyError(
+                f"could not reload egress bundle {container}: "
+                f"{last_error or 'docker kill failed'}"
+            )
+
+
+applicator = DockerEgressApplicator()
 
 
 __all__ = [
+    "DockerEgressApplicator",
     "EgressApplyError",
+    "applicator",
     "fetch_current_routes",
-    "validate_routes_content",
 ]

bot_bottle/backend/docker/freezer.py

@@ -0,0 +1,23 @@
+"""DockerFreezer — snapshot a Docker bottle via `docker commit`."""
+
+from __future__ import annotations
+
+from .. import ActiveAgent
+from ..freeze import Freezer
+from .util import commit_container
+from ...log import info
+
+
+class DockerFreezer(Freezer):
+    """Freezes a Docker bottle by running `docker commit`."""
+
+    backend_name = "docker"
+
+    def _freeze(self, agent: ActiveAgent) -> str:
+        container = f"bot-bottle-{agent.slug}"
+        image_tag = f"bot-bottle-committed-{agent.slug}:latest"
+        commit_container(container, image_tag)
+        return image_tag
+
+    def _export_hint(self, slug: str, image_ref: str) -> None:
+        info(f"to export for migration:      docker save {image_ref} -o {slug}.tar")

bot_bottle/backend/docker/launch.py

@@ -76,7 +76,7 @@ def launch(
     Teardown on exit."""
     stack = ExitStack()
 
-    _bottle_for_revoke = plan.spec.manifest.bottle_for(plan.spec.agent_name)
+    _bottle_for_revoke = plan.manifest.bottle
     _git_gate_dir_for_revoke = git_gate_state_dir(plan.slug)
 
     def teardown() -> None:

bot_bottle/backend/docker/resolve_plan.py

@@ -18,6 +18,7 @@ from .. import BottleSpec
 from ...env import ResolvedEnv
 from ...agent_provider import AgentProvisionPlan
 from ...egress import EgressPlan
+from ...manifest import Manifest
 from ...supervise import SupervisePlan
 from ...git_gate import GitGatePlan
 
@@ -31,6 +32,7 @@ def build_guest_env(resolved_env: ResolvedEnv) -> dict[str, str]:
 
 def resolve_plan(
     spec: BottleSpec,
+    manifest: Manifest,
     slug: str,
     resolved_env: ResolvedEnv,
     agent_provision_plan: AgentProvisionPlan,
@@ -48,6 +50,7 @@ def resolve_plan(
 
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage_dir,
         slug=slug,
         forwarded_env=dict(resolved_env.forwarded),

bot_bottle/backend/egress_apply.py

@@ -0,0 +1,50 @@
+"""Shared base class for host-side egress apply across backends.
+
+Each backend subclasses EgressApplicator and overrides _signal_bundle_reload
+with the backend-specific kill command.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from pathlib import Path
+
+from ..bottle_state import egress_state_dir
+from ..egress import EGRESS_ROUTES_FILENAME
+from ..egress_addon_core import load_routes
+
+
+class EgressApplyError(RuntimeError):
+    pass
+
+
+class EgressApplicator(ABC):
+    def apply_routes_change(self, slug: str, content: str) -> tuple[str, str]:
+        """Persist `content` to the live routes file and reload egress."""
+        self.validate_routes_content(content)
+        routes_path = self._routes_path(slug)
+        routes_path.parent.mkdir(parents=True, exist_ok=True)
+        before = routes_path.read_text(encoding="utf-8") if routes_path.exists() else ""
+        routes_path.write_text(content, encoding="utf-8")
+        routes_path.chmod(0o600)
+        self._signal_bundle_reload(slug)
+        return before, content
+
+    @staticmethod
+    def validate_routes_content(content: str) -> None:
+        try:
+            load_routes(content)
+        except ValueError as e:
+            raise EgressApplyError(
+                f"proposed routes.yaml is not valid: {e}"
+            ) from e
+
+    @staticmethod
+    def _routes_path(slug: str) -> Path:
+        return egress_state_dir(slug) / EGRESS_ROUTES_FILENAME
+
+    @abstractmethod
+    def _signal_bundle_reload(self, slug: str) -> None: ...
+
+
+__all__ = ["EgressApplicator", "EgressApplyError"]

bot_bottle/backend/freeze.py

@@ -0,0 +1,100 @@
+"""Freezer — snapshot a running bottle to a resumable artifact.
+
+Follows the same pattern as BottleBackend: a shared base class with
+common post-freeze steps (write committed-image path, mark preserved,
+print resume hint) and backend-specific subclasses in their respective
+backend directories.
+
+Entry points:
+  Freezer.commit(agent)      — freeze by ActiveAgent
+  Freezer.commit_slug(slug)  — convenience wrapper for cmd_commit
+  get_freezer(backend_name)  — factory
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+from . import ActiveAgent
+from ..bottle_state import mark_preserved, write_committed_image
+from ..log import die, info
+
+
+class CommitCancelled(Exception):
+    """Raised by Freezer._freeze when the user declines a confirmation prompt."""
+
+
+class Freezer(ABC):
+    """Freezes a running bottle to a resumable artifact.
+
+    The base class owns the shared post-commit steps:
+      - write_committed_image  — records the artifact path in per-bottle state
+      - mark_preserved         — prevents teardown from removing the state dir
+      - resume hint            — printed to stderr after the snapshot
+
+    Subclasses implement _freeze with the backend-specific snapshot
+    operation and optionally override _export_hint for migration hints.
+    """
+
+    backend_name: str
+
+    def commit(self, agent: ActiveAgent) -> None:
+        """Freeze the bottle for `agent` to a resumable artifact.
+
+        Calls _freeze for the backend-specific snapshot, then writes the
+        committed image reference to per-bottle state and marks the bottle
+        preserved so the next `./cli.py resume` boots from the snapshot.
+
+        Raises CommitCancelled if the user declines an interactive
+        confirmation prompt (e.g. the macos-container stop prompt).
+        """
+        image_ref = self._freeze(agent)
+        write_committed_image(agent.slug, image_ref)
+        mark_preserved(agent.slug)
+        info(f"to resume from this snapshot: ./cli.py resume {agent.slug}")
+        self._export_hint(agent.slug, image_ref)
+
+    @abstractmethod
+    def _freeze(self, agent: ActiveAgent) -> str:
+        """Backend-specific snapshot. Returns the image tag or artifact path
+        stored by write_committed_image. Raises CommitCancelled if the user
+        declines a stop-confirmation prompt."""
+
+    def _export_hint(self, slug: str, image_ref: str) -> None:
+        """Optionally print an export-for-migration hint after committing.
+        Overridden by backends that provide a meaningful export command."""
+
+    def commit_slug(self, slug: str) -> None:
+        """Convenience entry for cmd_commit when only a slug is available."""
+        from ..bottle_state import read_metadata
+        metadata = read_metadata(slug)
+        agent = ActiveAgent(
+            backend_name=self.backend_name,
+            slug=slug,
+            agent_name=metadata.agent_name if metadata else "",
+            started_at=metadata.started_at if metadata else "",
+            services=(),
+        )
+        self.commit(agent)
+
+
+def get_freezer(backend_name: str) -> Freezer:
+    """Return the Freezer for the named backend.
+
+    backend_name "" is treated as "docker" for backward compatibility
+    with state dirs written before the backend field was added."""
+    resolved = backend_name or "docker"
+    if resolved == "docker":
+        from .docker.freezer import DockerFreezer
+        return DockerFreezer()
+    if resolved == "macos-container":
+        from .macos_container.freezer import MacosContainerFreezer
+        return MacosContainerFreezer()
+    if resolved == "smolmachines":
+        from .smolmachines.freezer import SmolmachinesFreezer
+        return SmolmachinesFreezer()
+    die(
+        f"commit is only supported for docker, macos-container, and "
+        f"smolmachines; backend {backend_name!r} has no freezer"
+    )
+    raise AssertionError("unreachable")

bot_bottle/backend/macos_container/backend.py

@@ -11,6 +11,7 @@ from ...egress import EgressPlan
 from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
+from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
@@ -45,6 +46,7 @@ class MacosContainerBottleBackend(
         self,
         spec: BottleSpec,
         *,
+        manifest: Manifest,
         slug: str,
         resolved_env: ResolvedEnv,
         agent_provision_plan: AgentProvisionPlan,
@@ -55,6 +57,7 @@ class MacosContainerBottleBackend(
     ) -> MacosContainerBottlePlan:
         return _resolve_plan.resolve_plan(
             spec,
+            manifest=manifest,
             slug=slug,
             resolved_env=resolved_env,
             agent_provision_plan=agent_provision_plan,

bot_bottle/backend/macos_container/bottle.py

@@ -2,12 +2,41 @@
 
 from __future__ import annotations
 
+import os
 import subprocess
+import sys
 from typing import Callable, cast
 
 from ...agent_provider import PromptMode, prompt_args
 from .. import Bottle, ExecResult
 from ..terminal import exec_shell_script
+from . import pty_forward as _pty_forward
+
+
+_PTY_FORWARD_SCRIPT = _pty_forward.__file__
+_TERMINAL_ENV_NAMES = (
+    "TERM",
+    "COLORTERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "KITTY_WINDOW_ID",
+    "KITTY_PID",
+    "WEZTERM_PANE",
+    "WEZTERM_UNIX_SOCKET",
+    "GHOSTTY_BIN_DIR",
+    "GHOSTTY_RESOURCES_DIR",
+    "ITERM_SESSION_ID",
+    "VTE_VERSION",
+    "KONSOLE_VERSION",
+    "ALACRITTY_WINDOW_ID",
+)
+
+
+def _terminal_env_names() -> tuple[str, ...]:
+    return tuple(
+        name for name in _TERMINAL_ENV_NAMES
+        if name == "TERM" or os.environ.get(name)
+    )
 
 
 class MacosContainerBottle(Bottle):
@@ -44,13 +73,24 @@ class MacosContainerBottle(Bottle):
                 argv=full_argv,
             )
         )
-        cmd = ["container", "exec"]
+        container_exec = ["container", "exec"]
         if tty:
-            cmd.extend(["--interactive", "--tty"])
+            container_exec.extend(["--interactive", "--tty"])
+            # Forward terminal capability hints so TUIs can enable modified-key
+            # protocols. Use bare env names: values stay in the child env, not
+            # on argv, and pty_forward supplies a TERM fallback when needed.
+            for name in _terminal_env_names():
+                container_exec.extend(["--env", name])
         if self.agent_workdir and self.agent_workdir != "/home/node":
-            cmd.extend(["--workdir", self.agent_workdir])
-        cmd.extend([self.name, self.agent_command, *full_argv])
-        return cmd
+            container_exec.extend(["--workdir", self.agent_workdir])
+        container_exec.extend([self.name, self.agent_command, *full_argv])
+        if tty:
+            # Wrap with the raw-mode forwarder: container exec does not put
+            # the host terminal into raw mode itself, so the line discipline
+            # buffers modifier-key sequences until CR.  The wrapper sets raw
+            # mode before exec and restores it on exit.
+            return [sys.executable, _PTY_FORWARD_SCRIPT, "--", *container_exec]
+        return container_exec
 
     def exec_agent(self, argv: list[str], *, tty: bool = True) -> int:
         agent_argv = self.agent_argv(argv, tty=tty)

bot_bottle/backend/macos_container/egress_apply.py

@@ -0,0 +1,39 @@
+"""Host-side egress apply for the macos-container backend.
+
+Uses `container kill --signal HUP` (Apple Container framework) instead
+of `docker kill` to signal the sidecar bundle.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+
+from ...log import warn
+from ..egress_apply import EgressApplicator, EgressApplyError
+from .launch import sidecar_container_name
+
+
+class MacOSContainerEgressApplicator(EgressApplicator):
+    def _signal_bundle_reload(self, slug: str) -> None:
+        container = sidecar_container_name(slug)
+        result = subprocess.run(
+            ["container", "kill", "--signal", "HUP", container],
+            capture_output=True, text=True, check=False, env=os.environ,
+        )
+        if result.returncode != 0:
+            last_error = (result.stderr or "").strip() or (result.stdout or "").strip()
+            warn(
+                f"egress: routes updated on disk for {slug}, but bundle reload failed: "
+                f"{last_error or 'container kill failed'}"
+            )
+            raise EgressApplyError(
+                f"could not reload egress bundle {container}: "
+                f"{last_error or 'container kill failed'}"
+            )
+
+
+applicator = MacOSContainerEgressApplicator()
+
+
+__all__ = ["MacOSContainerEgressApplicator", "EgressApplyError", "applicator"]

bot_bottle/backend/macos_container/freezer.py

@@ -0,0 +1,31 @@
+"""MacosContainerFreezer — snapshot a macOS container bottle.
+
+Apple Container removes containers when they stop, making stop-then-export
+impossible. Instead, commit_container execs into the running container and
+streams the root filesystem via tar. The bottle continues running after commit.
+"""
+
+from __future__ import annotations
+
+from .. import ActiveAgent
+from ..freeze import Freezer
+from .util import commit_container
+from ...log import info
+
+
+class MacosContainerFreezer(Freezer):
+    """Freezes a macOS-container bottle via exec-tar + image rebuild."""
+
+    backend_name = "macos-container"
+
+    def _freeze(self, agent: ActiveAgent) -> str:
+        container = f"bot-bottle-{agent.slug}"
+        image_tag = f"bot-bottle-committed-{agent.slug}:latest"
+        commit_container(container, image_tag)
+        return image_tag
+
+    def _export_hint(self, slug: str, image_ref: str) -> None:
+        info(
+            f"to export for migration:      "
+            f"container image save {image_ref} -o {slug}.tar"
+        )

bot_bottle/backend/macos_container/launch.py

@@ -12,13 +12,16 @@ from __future__ import annotations
 
 import dataclasses
 import os
-import shutil
 import subprocess
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
 
-from ...bottle_state import egress_state_dir, git_gate_state_dir
+from ...bottle_state import (
+    egress_state_dir,
+    git_gate_state_dir,
+    read_committed_image,
+)
 from ...egress import EGRESS_ROUTES_IN_CONTAINER, egress_resolve_token_values
 from ...git_gate import revoke_git_gate_provisioned_keys
 from ...log import die, info, warn
@@ -68,7 +71,7 @@ def launch(
 ) -> Generator[MacosContainerBottle, None, None]:
     """Build, run, provision, and yield an Apple Container bottle."""
     stack = ExitStack()
-    bottle_for_revoke = plan.spec.manifest.bottle_for(plan.spec.agent_name)
+    bottle_for_revoke = plan.manifest.bottle
     git_gate_dir_for_revoke = git_gate_state_dir(plan.slug)
 
     def teardown() -> None:
@@ -84,7 +87,7 @@ def launch(
 
     try:
         plan = _mint_certs(plan)
-        _build_images(plan)
+        plan = _build_images(plan)
 
         internal_network = internal_network_name(plan.slug)
         egress_network = egress_network_name(plan.slug)
@@ -135,17 +138,28 @@ def _mint_certs(plan: MacosContainerBottlePlan) -> MacosContainerBottlePlan:
     return dataclasses.replace(plan, egress_plan=egress_plan)
 
 
-def _build_images(plan: MacosContainerBottlePlan) -> None:
+def _build_images(plan: MacosContainerBottlePlan) -> MacosContainerBottlePlan:
     container_mod.build_image(
         SIDECAR_BUNDLE_IMAGE,
         _REPO_DIR,
         dockerfile=SIDECAR_BUNDLE_DOCKERFILE,
     )
+    committed = read_committed_image(plan.slug)
+    if committed and container_mod.image_exists(committed):
+        info(f"using committed image {committed!r}")
+        return dataclasses.replace(
+            plan,
+            agent_provision=dataclasses.replace(
+                plan.agent_provision,
+                image=committed,
+            ),
+        )
     container_mod.build_image(
         plan.image,
         _REPO_DIR,
         dockerfile=plan.dockerfile_path,
     )
+    return plan
 
 
 def _create_networks(
@@ -314,7 +328,6 @@ def _agent_run_argv(
         "container", "run",
         "--name", plan.container_name,
         "--detach",
-        "--rm",
         "--network", internal_network,
     ]
     for entry in _agent_env_entries(plan, sidecar_ip):
@@ -364,7 +377,7 @@ def _sidecar_mounts(
     ))
     if ep.routes:
         mounts.append((
-            str(_stage_routes_dir(plan)),
+            str(ep.routes_path.parent),
             str(Path(EGRESS_ROUTES_IN_CONTAINER).parent),
             True,
         ))
@@ -375,17 +388,6 @@ def _sidecar_mounts(
 
     return tuple(mounts)
 
-
-def _stage_routes_dir(plan: MacosContainerBottlePlan) -> Path:
-    routes_dir = plan.stage_dir / "macos-container-egress"
-    routes_dir.mkdir(parents=True, exist_ok=True)
-    shutil.copyfile(
-        plan.egress_plan.routes_path,
-        routes_dir / Path(EGRESS_ROUTES_IN_CONTAINER).name,
-    )
-    return routes_dir
-
-
 def _mount_spec(host_path: str, container_path: str, read_only: bool) -> str:
     spec = f"type=bind,source={host_path},target={container_path}"
     if read_only:

bot_bottle/backend/macos_container/pty_forward.py

@@ -0,0 +1,70 @@
+"""Host-side raw-mode wrapper for `container exec --interactive --tty`.
+
+Apple's `container exec --interactive --tty` does not set the host terminal to
+raw mode before starting its I/O relay.  Without raw mode the kernel line
+discipline buffers modifier-key escape sequences (e.g. Shift+Enter in
+modifyOtherKeys mode produces \\x1b[13;2~) until a carriage-return arrives, so
+they never reach Claude Code inside the container.
+
+This module sets the host terminal to raw mode, spawns the inner argv (the
+container exec command), and restores the original terminal attributes on
+exit.  When stdin is not a TTY (piped invocations, CI) it falls through to a
+bare subprocess.run so callers do not need to special-case non-interactive
+contexts.
+
+Usage (the `--` separator is the API contract — everything after it is the
+inner command):
+
+    python pty_forward.py -- container exec --interactive --tty <name> <cmd>
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import termios
+import tty
+
+
+def _inner_env() -> dict[str, str]:
+    env = dict(os.environ)
+    env.setdefault("TERM", "xterm-256color")
+    return env
+
+
+def _run_inner(inner: list[str]) -> int:
+    return subprocess.run(inner, check=False, env=_inner_env()).returncode
+
+
+def main(argv: list[str]) -> int:
+    """Entry point.  ``argv`` shape: ``-- <inner-argv...>``."""
+    if len(argv) < 2 or argv[0] != "--":
+        sys.stderr.write(
+            "usage: python pty_forward.py -- <container-exec-argv...>\n"
+        )
+        return 2
+    inner = argv[1:]
+
+    try:
+        fd = sys.stdin.fileno()
+    except OSError:
+        return _run_inner(inner)
+
+    if not os.isatty(fd):
+        return _run_inner(inner)
+
+    try:
+        old = termios.tcgetattr(fd)
+    except termios.error:
+        return _run_inner(inner)
+
+    try:
+        tty.setraw(fd)
+        return _run_inner(inner)
+    finally:
+        termios.tcsetattr(fd, termios.TCSADRAIN, old)
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

bot_bottle/backend/macos_container/resolve_plan.py

@@ -9,6 +9,7 @@ from ...egress import EgressPlan
 from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
+from ...manifest import Manifest
 from .. import BottleSpec
 from . import util as container_mod
 from .bottle_plan import MacosContainerBottlePlan
@@ -24,6 +25,7 @@ def build_guest_env(resolved_env: ResolvedEnv) -> dict[str, str]:
 
 def resolve_plan(
     spec: BottleSpec,
+    manifest: Manifest,
     slug: str,
     resolved_env: ResolvedEnv,
     agent_provision_plan: AgentProvisionPlan,
@@ -34,6 +36,7 @@ def resolve_plan(
 ) -> MacosContainerBottlePlan:
     return MacosContainerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage_dir,
         slug=slug,
         forwarded_env=dict(resolved_env.forwarded),

bot_bottle/backend/macos_container/util.py

@@ -8,6 +8,7 @@ import ipaddress
 import platform
 import shutil
 import subprocess
+import tempfile
 import time
 from typing import Iterable
 
@@ -72,6 +73,53 @@ def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     subprocess.run(args, check=True)
 
 
+def commit_container(container_name: str, image_tag: str) -> None:
+    """Snapshot a running Apple Container as a local image.
+
+    `container export` requires a stopped container, but Apple Container
+    removes containers when they stop, making stop-then-export impossible.
+    Instead, exec into the running container as root and stream the root
+    filesystem out via tar, then build a new image from that archive.
+    The bottle continues running after commit.
+    """
+    with tempfile.TemporaryDirectory(prefix="bot-bottle-container-commit.") as tmp:
+        rootfs_tar = os.path.join(tmp, "rootfs.tar")
+        dockerfile = os.path.join(tmp, "Dockerfile")
+        with open(rootfs_tar, "wb") as tar_out:
+            result = subprocess.run(
+                [
+                    _CONTAINER, "exec",
+                    "--user", "root",
+                    container_name,
+                    "tar", "--create",
+                    "--exclude=./proc",
+                    "--exclude=./sys",
+                    "--exclude=./dev",
+                    "--exclude=./run",
+                    "--file=-",
+                    "--directory=/",
+                    ".",
+                ],
+                stdout=tar_out,
+                stderr=subprocess.PIPE,
+                check=False,
+            )
+        if result.returncode != 0:
+            die(
+                f"container exec tar {container_name!r} failed: "
+                f"{(result.stderr or b'').decode().strip() or '<no stderr>'}"
+            )
+        with open(dockerfile, "w", encoding="utf-8") as f:
+            f.write(
+                "FROM scratch\n"
+                "ADD rootfs.tar /\n"
+                "USER node\n"
+                "WORKDIR /home/node\n"
+            )
+        build_image(image_tag, tmp, dockerfile=dockerfile)
+    info(f"committed {container_name!r} → {image_tag!r}")
+
+
 def _ensure_builder_dns() -> None:
     dns = dns_server()
     status = _builder_status()
@@ -218,6 +266,36 @@ def container_exists(name: str) -> bool:
     return name in {line.strip() for line in result.stdout.splitlines()}
 
 
+def container_is_running(name: str) -> bool:
+    """Return True if the named container is currently running.
+
+    `container list` without `--all` lists only running containers."""
+    result = subprocess.run(
+        [_CONTAINER, "list", "--quiet"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return False
+    return name in {line.strip() for line in result.stdout.splitlines()}
+
+
+def stop_container(name: str) -> None:
+    """Stop the named container without deleting it."""
+    result = subprocess.run(
+        [_CONTAINER, "stop", name],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        die(
+            f"container stop {name!r} failed: "
+            f"{(result.stderr or '').strip() or '<no stderr>'}"
+        )
+
+
 def force_remove_container(name: str) -> None:
     if container_exists(name):
         subprocess.run(

bot_bottle/backend/resolve_common.py

@@ -26,7 +26,7 @@ from ..bottle_state import (
 )
 from ..egress import Egress, EgressPlan
 from ..git_gate import GitGate, GitGatePlan
-from ..manifest import ManifestBottle
+from ..manifest import Manifest, ManifestBottle
 from ..supervise import Supervise, SupervisePlan
 from . import BottleSpec
 
@@ -66,11 +66,10 @@ def write_launch_metadata(
     ))
 
 
-def prepare_agent_state_dir(slug: str, spec: BottleSpec) -> tuple[Path, Path]:
+def prepare_agent_state_dir(slug: str, manifest: Manifest) -> tuple[Path, Path]:
     """Create the agent state subdir, write the prompt file.
     Returns (agent_dir, prompt_file)."""
-    manifest = spec.manifest
-    agent = manifest.agents[spec.agent_name]
+    agent = manifest.agent
     agent_dir = agent_state_dir(slug)
     agent_dir.mkdir(parents=True, exist_ok=True)
     prompt_file = agent_dir / "prompt.txt"

bot_bottle/backend/smolmachines/backend.py

@@ -18,6 +18,7 @@ from ...egress import EgressPlan
 from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
+from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
@@ -55,6 +56,7 @@ class SmolmachinesBottleBackend(
         self,
         spec: BottleSpec,
         *,
+        manifest: Manifest,
         slug: str,
         resolved_env: ResolvedEnv,
         agent_provision_plan: AgentProvisionPlan,
@@ -65,6 +67,7 @@ class SmolmachinesBottleBackend(
     ) -> SmolmachinesBottlePlan:
         return _resolve_plan.resolve_plan(
             spec,
+            manifest=manifest,
             slug=slug,
             resolved_env=resolved_env,
             agent_provision_plan=agent_provision_plan,

bot_bottle/backend/smolmachines/bottle.py

@@ -145,7 +145,12 @@ class SmolmachinesBottle(Bottle):
         script = exec_shell_script(agent_argv, self.terminal_title, self.terminal_color) if tty else None
         if script is None:
             return subprocess.run(agent_argv, check=False).returncode
-        return subprocess.run(["sh", "-lc", script], check=False).returncode
+        # Use sh -c (not -lc) so the script inherits PATH from the calling
+        # process. sh -l sources login-shell init files (e.g. /etc/profile)
+        # which may NOT include smolvm's location when it was installed via
+        # homebrew. The calling process (./cli.py) already has smolvm on PATH
+        # (provision steps succeed), so -c is sufficient.
+        return subprocess.run(["sh", "-c", script], check=False).returncode
 
     # smolvm/libkrun can SIGKILL an otherwise-normal exec during
     # early-VM provisioning. Retry once after a short settle so

bot_bottle/backend/smolmachines/egress_apply.py

@@ -0,0 +1,21 @@
+"""Egress apply for the smolmachines backend.
+
+The smolmachines sidecar bundle runs as a host-side Docker container,
+so egress signalling is identical to the docker backend.
+"""
+
+from __future__ import annotations
+
+from ..docker.egress_apply import (  # noqa: F401
+    DockerEgressApplicator,
+    EgressApplyError,
+    applicator,
+    fetch_current_routes,
+)
+
+__all__ = [
+    "DockerEgressApplicator",
+    "EgressApplyError",
+    "applicator",
+    "fetch_current_routes",
+]

bot_bottle/backend/smolmachines/freezer.py

@@ -0,0 +1,145 @@
+"""SmolmachinesFreezer — snapshot a smolmachines bottle.
+
+`smolvm pack create --from-vm` requires the VM to be stopped, and smolvm
+removes VMs when stopped (same issue as Apple Container). Instead, exec
+into the running VM as root to write a gzip-compressed tar of the root
+filesystem to /var/tmp, then copy it to the host with `smolvm machine cp`,
+build a Docker image from the archive, convert it to a smolmachine artifact
+via the existing registry pipeline, and record the sidecar path. The VM
+stays running throughout."""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+from .. import ActiveAgent
+from ..freeze import Freezer
+from ..docker import util as docker_mod
+from .local_registry import crane_push_tarball, ephemeral_registry
+from .smolvm import machine_cp, machine_exec, pack_create
+from ...bottle_state import bottle_state_dir
+from ...log import die, info
+
+
+# Temp file written inside the VM during commit. Lives in /var/tmp
+# (on-disk, unlike tmpfs /tmp) to survive for machine_cp.
+_VM_COMMIT_TAR = "/var/tmp/.bot-bottle-commit.tar.gz"
+
+
+class SmolmachinesFreezer(Freezer):
+    """Freezes a smolmachines bottle via exec-tar + Docker image + smolmachine pack.
+
+    The VM is NOT stopped. We exec into the running VM to write a compressed
+    tar of the root filesystem to /var/tmp, copy it to the host with
+    machine_cp, build a Docker image (Docker's ADD decompresses .tar.gz
+    automatically), then run the same image→registry→pack_create pipeline
+    that _ensure_smolmachine uses for fresh builds."""
+
+    backend_name = "smolmachines"
+
+    def _freeze(self, agent: ActiveAgent) -> str:
+        machine = f"bot-bottle-{agent.slug}"
+        image_ref = f"bot-bottle-committed-{agent.slug}:latest"
+        output_dir = bottle_state_dir(agent.slug)
+        output_dir.mkdir(parents=True, exist_ok=True)
+        binary = output_dir / "committed-smolmachine"
+        sidecar = output_dir / "committed-smolmachine.smolmachine"
+        _snapshot_running_vm(machine, image_ref, binary)
+        return str(sidecar)
+
+    def _export_hint(self, slug: str, image_ref: str) -> None:
+        info(f"to export for migration:      cp {image_ref} {slug}.smolmachine")
+
+
+def _snapshot_running_vm(machine: str, image_ref: str, binary: Path) -> None:
+    """Exec-tar the running VM, build a Docker image, and pack to a smolmachine.
+
+    binary:  destination for the launcher (sibling .smolmachine is the artifact
+             that machine_create --from consumes, same convention as pack_create).
+    """
+    with tempfile.TemporaryDirectory(prefix="bot-bottle-vm-commit.") as tmp:
+        tmp_path = Path(tmp)
+        # Use .tar.gz — Docker ADD decompresses automatically and the
+        # compressed archive fits in the VM's /var/tmp more easily.
+        rootfs_tar_gz = tmp_path / "rootfs.tar.gz"
+        dockerfile = tmp_path / "Dockerfile"
+
+        _exec_tar_to_file(machine, rootfs_tar_gz)
+
+        dockerfile.write_text(
+            "FROM scratch\n"
+            "ADD rootfs.tar.gz /\n"
+            "USER node\n"
+            "WORKDIR /home/node\n"
+        )
+        docker_mod.build_image(image_ref, str(tmp_path), dockerfile=str(dockerfile))
+
+    image_tarball = binary.parent / "committed.image.tar"
+    docker_mod.save(image_ref, str(image_tarball))
+    try:
+        with ephemeral_registry() as handle:
+            digest = docker_mod.image_id(image_ref).split(":", 1)[-1][:16]
+            push_ref = f"{handle.push_endpoint}/bot-bottle-committed:{digest}"
+            pack_ref = f"{handle.pull_endpoint}/bot-bottle-committed:{digest}"
+            crane_push_tarball(handle, str(image_tarball), push_ref)
+            pack_create(pack_ref, binary)
+    finally:
+        image_tarball.unlink(missing_ok=True)
+
+
+def _exec_tar_to_file(machine: str, dest: Path) -> None:
+    """Snapshot the running VM's root filesystem to dest (.tar.gz).
+
+    Writes a gzip-compressed tar to _VM_COMMIT_TAR inside the VM via
+    machine_exec (same mechanism as provisioning), then copies it to the
+    host with machine_cp. This avoids binary-stdout piping through the
+    smolvm exec channel, which does not reliably handle large binary output.
+
+    A connectivity probe (machine_exec true) runs first so a concurrent-exec
+    limitation (smolvm may reject a second exec while -i -t is active) is
+    reported clearly rather than as a silent failure."""
+    # Connectivity probe — if smolvm rejects concurrent exec while an
+    # interactive session is running, fail clearly here.
+    probe = machine_exec(machine, ["true"])
+    if probe.returncode != 0:
+        die(
+            f"smolvm exec is not available for {machine!r} "
+            f"(exit {probe.returncode}: {probe.stderr.strip() or probe.stdout.strip() or '<no output>'}). "
+            f"If an interactive session is active, smolvm may not support concurrent exec."
+        )
+
+    # Create the compressed tar inside the VM.
+    # tar exits 1 when files change during archiving (normal for a live
+    # filesystem); only treat exit > 1 as fatal.
+    tar_result = machine_exec(
+        machine,
+        [
+            "tar", "--create", "--gzip",
+            "--exclude=./proc",
+            "--exclude=./sys",
+            "--exclude=./dev",
+            "--exclude=./run",
+            # /tmp and /var/tmp are ephemeral. Their stale contents
+            # (e.g. /tmp/claude-<uid>) have uid remapped by smolvm's
+            # pack process, causing Claude Code to refuse to use them
+            # on resume. Exclude both; _init_vm recreates them with
+            # mkdir -p + correct ownership on every boot.
+            "--exclude=./tmp",
+            "--exclude=./var/tmp",
+            f"--file={_VM_COMMIT_TAR}",
+            "--directory=/",
+            ".",
+        ],
+    )
+    if tar_result.returncode > 1:
+        die(
+            f"smolvm exec tar {machine!r} failed (exit {tar_result.returncode}): "
+            f"{tar_result.stderr.strip() or tar_result.stdout.strip() or '<no output>'}"
+        )
+
+    # Copy from VM to host, then clean up.
+    try:
+        machine_cp(f"{machine}:{_VM_COMMIT_TAR}", str(dest))
+    finally:
+        machine_exec(machine, ["rm", "-f", _VM_COMMIT_TAR])

bot_bottle/backend/smolmachines/launch.py

@@ -40,8 +40,12 @@ from ..docker.git_gate import (
     GIT_GATE_HOOK_IN_CONTAINER,
 )
 from ...git_gate import revoke_git_gate_provisioned_keys
-from ...log import warn
-from ...bottle_state import egress_state_dir, git_gate_state_dir
+from ...log import info, warn
+from ...bottle_state import (
+    egress_state_dir,
+    git_gate_state_dir,
+    read_committed_image,
+)
 from . import loopback_alias as _loopback
 from . import sidecar_bundle as _bundle
 from . import smolvm as _smolvm
@@ -85,14 +89,7 @@ def launch(
         plan = _start_bundle(plan, network, loopback_ip, stack)
         plan = _discover_urls(plan, loopback_ip)
 
-        # Build the agent image and pack it into a `.smolmachine`
-        # artifact (or hit the per-Dockerfile-digest cache). Runs
-        # here, not in prepare, so the docker-build output doesn't
-        # garble the dashboard's preflight modal.
-        agent_from_path = _ensure_smolmachine(
-            plan.agent_image,
-            dockerfile=plan.agent_dockerfile_path,
-        )
+        agent_from_path = _agent_from_path(plan)
 
         _launch_vm(plan, agent_from_path, loopback_ip, stack)
         _init_vm(plan)
@@ -130,7 +127,7 @@ def _teardown_smolmachines(
     except BaseException as exc:  # noqa: W0718 — teardown must not fail
         teardown_exc = exc
         warn(f"smolmachines teardown failed: {exc!r}")
-    bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
+    bottle = plan.manifest.bottle
     revoke_git_gate_provisioned_keys(bottle, git_gate_state_dir(plan.slug))
     if teardown_exc is not None:
         raise teardown_exc
@@ -217,11 +214,15 @@ def _discover_urls(
         agent_supervise_url = f"http://{loopback_ip}:{supervise_host_port}/"
 
     existing_no_proxy = plan.guest_env.get("NO_PROXY", "localhost,127.0.0.1")
+    no_proxy = f"{existing_no_proxy},{loopback_ip}"
     guest_env = {
         **plan.guest_env,
         "HTTPS_PROXY": agent_proxy_url,
         "HTTP_PROXY":  agent_proxy_url,
-        "NO_PROXY":    f"{existing_no_proxy},{loopback_ip}",
+        "https_proxy": agent_proxy_url,
+        "http_proxy":  agent_proxy_url,
+        "NO_PROXY":    no_proxy,
+        "no_proxy":    no_proxy,
     }
     if agent_git_gate_host:
         guest_env["GIT_GATE_URL"] = f"http://{agent_git_gate_host}"
@@ -275,10 +276,16 @@ def _init_vm(plan: SmolmachinesBottlePlan) -> None:
     All folded into one sh -c to avoid back-to-back exec calls
     immediately after machine_start (libkrun exec-channel race).
 
+    mkdir -p guards: when booting from a committed snapshot, /tmp and
+    /var/tmp are excluded from the archive (they're ephemeral and their
+    stale contents would have wrong uid after smolvm's uid remap). The
+    directories must be created before chown/chmod can set permissions.
+
     wait_exec_ready polls until the exec channel is ready for the
     subsequent provision calls, replacing the empirical sleep."""
     _smolvm.machine_exec(plan.machine_name, [
         "sh", "-c",
+        "mkdir -p /tmp /var/tmp && "
         "chown -R node:node /home/node && "
         "chown root:root /tmp /var/tmp && "
         "chmod 1777 /tmp /var/tmp",
@@ -308,7 +315,7 @@ def _bundle_launch_spec(
     ep = plan.egress_plan
     volumes.append((str(ep.mitmproxy_ca_host_path), EGRESS_CA_IN_CONTAINER, True))
     if ep.routes:
-        volumes.append((str(ep.routes_path), EGRESS_ROUTES_IN_CONTAINER, True))
+        volumes.append((str(ep.routes_path.parent), str(Path(EGRESS_ROUTES_IN_CONTAINER).parent), True))
         # Bare-name entries for upstream-token slots. Their values
         # come from the docker-run subprocess env (inherited from
         # the operator's shell), never landing on argv.
@@ -382,6 +389,30 @@ def _resolve_token_env(
     return egress_resolve_token_values(plan.egress_plan.token_env_map, effective_env)
 
 
+def _agent_from_path(plan: SmolmachinesBottlePlan) -> Path:
+    """Return the `.smolmachine` artifact used for `machine create --from`.
+
+    Prefer a committed VM artifact when one is recorded and still
+    present. If the file was removed, fall back to the normal image
+    build + pack cache path.
+    """
+    committed = read_committed_image(plan.slug)
+    if committed:
+        committed_path = Path(committed)
+        if committed_path.is_file():
+            info(f"using committed smolmachine {str(committed_path)!r}")
+            return committed_path
+
+    # Build the agent image and pack it into a `.smolmachine`
+    # artifact (or hit the per-Dockerfile-digest cache). Runs here,
+    # not in prepare, so the docker-build output doesn't garble the
+    # dashboard's preflight modal.
+    return _ensure_smolmachine(
+        plan.agent_image,
+        dockerfile=plan.agent_dockerfile_path,
+    )
+
+
 def _ensure_smolmachine(image_ref: str, *, dockerfile: str = "") -> Path:
     """Build the agent docker image and convert it into a
     `.smolmachine` artifact, caching the result under

bot_bottle/backend/smolmachines/resolve_plan.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 from pathlib import Path
 
 from .. import BottleSpec
+from ...manifest import Manifest
 from ...env import ResolvedEnv
 from ...agent_provider import AgentProvisionPlan
 from ...egress import EgressPlan
@@ -46,6 +47,7 @@ def build_guest_env(resolved_env: ResolvedEnv) -> dict[str, str]:
 
 def resolve_plan(
     spec: BottleSpec,
+    manifest: Manifest,
     slug: str,
     resolved_env: ResolvedEnv,
     agent_provision_plan: AgentProvisionPlan,
@@ -67,6 +69,7 @@ def resolve_plan(
 
     return SmolmachinesBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage_dir,
         slug=slug,
         bundle_subnet=subnet,

bot_bottle/backend/smolmachines/smolvm.py

@@ -25,6 +25,7 @@ smolvm binary."""
 
 from __future__ import annotations
 
+import json
 import shutil
 import subprocess
 import time
@@ -94,6 +95,16 @@ def pack_create(image: str, output: Path) -> None:
     _smolvm("pack", "create", "--image", image, "-o", str(output))
 
 
+def pack_create_from_vm(name: str, output: Path) -> None:
+    """`smolvm pack create --from-vm <name> -o <output>`.
+
+    Snapshots an existing persistent VM into a pack artifact. As
+    with `pack_create`, smolvm writes a launcher at `output` and the
+    bootable sidecar at `output.smolmachine`.
+    """
+    _smolvm("pack", "create", "--from-vm", name, "-o", str(output))
+
+
 # --- Machine lifecycle ---------------------------------------------------
 
 
@@ -143,6 +154,21 @@ def machine_create(
     _smolvm(*args)
 
 
+def machine_is_running(name: str) -> bool:
+    """Return True if the named VM is in the 'running' state."""
+    result = _smolvm("machine", "ls", "--json", check=False)
+    if result.returncode != 0:
+        return False
+    try:
+        machines = json.loads(result.stdout or "[]")
+    except ValueError:
+        return False
+    return any(
+        isinstance(m, dict) and m.get("name") == name and m.get("state") == "running"
+        for m in machines
+    )
+
+
 def machine_start(name: str) -> None:
     """`smolvm machine start --name NAME`."""
     _smolvm("machine", "start", "--name", name)

bot_bottle/cli/commit.py

@@ -1,12 +1,11 @@
-"""commit: freeze a running Docker bottle's container state to a local image.
+"""commit: freeze a running bottle's state to a resumable artifact.
 
-Runs `docker commit <container> <image-tag>` on the active agent
-container and stores the image tag in per-bottle state so the next
-`./cli.py resume <slug>` boots from that snapshot instead of
-rebuilding from the Dockerfile.
-
-Only the Docker backend is supported. Smolmachines VMs have no
-container-level commit API in the current smolvm CLI surface.
+Docker bottles are committed to a local Docker image. Macos-container
+bottles are exported and rebuilt as a local Apple Container image.
+Smolmachines bottles are packed from the running VM into a
+`.smolmachine` artifact. The resulting reference is stored in
+per-bottle state so the next `./cli.py resume <slug>` boots from the
+snapshot instead of rebuilding from the Dockerfile.
 """
 
 from __future__ import annotations
@@ -14,25 +13,13 @@ from __future__ import annotations
 import argparse
 
 from ..backend import enumerate_active_agents
-from ..backend.docker.util import commit_container
-from ..bottle_state import mark_preserved, read_metadata, write_committed_image
-from ..log import die, info
+from ..backend.freeze import CommitCancelled, get_freezer
+from ..bottle_state import read_metadata
+from ..log import die
 from ._common import PROG
 from . import tui
 
 
-_COMMITTED_IMAGE_PREFIX = "bot-bottle-committed-"
-_DOCKER_BACKENDS = {"docker", ""}
-
-
-def _committed_image_tag(slug: str) -> str:
-    return f"{_COMMITTED_IMAGE_PREFIX}{slug}:latest"
-
-
-def _agent_container_name(slug: str) -> str:
-    return f"bot-bottle-{slug}"
-
-
 def cmd_commit(argv: list[str]) -> int:
     parser = argparse.ArgumentParser(prog=f"{PROG} commit", add_help=True)
     parser.add_argument(
@@ -58,18 +45,9 @@ def cmd_commit(argv: list[str]) -> int:
 
     metadata = read_metadata(slug)
     backend = metadata.backend if metadata else ""
-    if backend not in _DOCKER_BACKENDS:
-        die(
-            f"commit is only supported for the docker backend; "
-            f"bottle {slug!r} uses {backend!r}"
-        )
 
-    container = _agent_container_name(slug)
-    image_tag = _committed_image_tag(slug)
-
-    commit_container(container, image_tag)
-    write_committed_image(slug, image_tag)
-    mark_preserved(slug)
-    info(f"to resume from this snapshot: ./cli.py resume {slug}")
-    info(f"to export for migration:      docker save {image_tag} -o {slug}.tar")
+    try:
+        get_freezer(backend).commit_slug(slug)
+    except CommitCancelled:
+        return 0
     return 0

bot_bottle/cli/info.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import argparse
 
 from ..log import info
-from ..manifest import Manifest
+from ..manifest import ManifestIndex
 from ._common import PROG, USER_CWD
 
 
@@ -14,11 +14,12 @@ def cmd_info(argv: list[str]) -> int:
     parser.add_argument("name", help="agent name defined in bot-bottle.json")
     args = parser.parse_args(argv)
 
-    manifest = Manifest.resolve(USER_CWD)
-    manifest.require_agent(args.name)
+    names = ManifestIndex.resolve(USER_CWD)
+    names.require_agent(args.name)
+    manifest = names.load_for_agent(args.name)
 
-    agent = manifest.agents[args.name]
-    bottle = manifest.bottle_for(args.name)
+    agent = manifest.agent
+    bottle = manifest.bottle
     env_names = list(bottle.env.keys())
     prompt_first_line = agent.prompt.splitlines()[0] if agent.prompt else ""
 
@@ -31,7 +32,7 @@ def cmd_info(argv: list[str]) -> int:
         f"first line: {prompt_first_line or '(empty)'}"
     )
     info(f"bottle             : {agent.bottle}")
-    identity = manifest.git_identity_summary(args.name)
+    identity = manifest.git_identity_summary()
     if identity:
         info(f"  git identity  : {identity}")
     if bottle.git:

bot_bottle/cli/list.py

@@ -7,7 +7,7 @@ import os
 import sys
 
 from ..backend import enumerate_active_agents
-from ..manifest import Manifest
+from ..manifest import ManifestIndex
 from ._common import PROG, USER_CWD
 
 _ANSI_COLOR_CODES: dict[str, str] = {
@@ -40,8 +40,8 @@ def cmd_list(argv: list[str]) -> int:
     args = parser.parse_args(argv)
 
     if args.scope == "available":
-        manifest = Manifest.resolve(USER_CWD)
-        for name in manifest.agents.keys():
+        manifest = ManifestIndex.resolve(USER_CWD)
+        for name in manifest.all_agent_names:
             print(name)
         return 0
 

bot_bottle/cli/resume.py

@@ -20,7 +20,7 @@ import argparse
 from ..backend import BottleSpec
 from ..bottle_state import read_metadata
 from ..log import die
-from ..manifest import Manifest
+from ..manifest import ManifestIndex
 from ._common import PROG, USER_CWD
 from .start import _launch_bottle
 
@@ -42,7 +42,7 @@ def cmd_resume(argv: list[str]) -> int:
             f"check ~/.bot-bottle/state/ or run `cli.py start` to create a new bottle"
         )
 
-    manifest = Manifest.resolve(USER_CWD)
+    manifest = ManifestIndex.resolve(USER_CWD)
     manifest.require_agent(metadata.agent_name)
 
     spec = BottleSpec(

bot_bottle/cli/start.py

@@ -33,7 +33,7 @@ from ..bottle_state import (
 )
 # from ..backend.docker.capability_apply import snapshot_transcript
 from ..log import info
-from ..manifest import Manifest
+from ..manifest import ManifestIndex
 from ._common import PROG, USER_CWD, read_tty_line
 from . import tui
 
@@ -62,12 +62,12 @@ def cmd_start(argv: list[str]) -> int:
 
     dry_run = args.dry_run or os.environ.get("BOT_BOTTLE_DRY_RUN") == "1"
 
-    manifest = Manifest.resolve(USER_CWD)
+    manifest = ManifestIndex.resolve(USER_CWD)
 
     agent_name: str | None = args.name
     if agent_name is None:
         agent_name = tui.filter_select(
-            sorted(manifest.agents.keys()),
+            manifest.all_agent_names,
             title="Select agent",
         )
         if agent_name is None:

bot_bottle/cli/supervise.py

@@ -3,7 +3,8 @@ act on them (approve / modify / reject).
 
 Curses-based TUI; modify-then-approve shells out to $EDITOR. The
 approval handler wires to PRD 0016 (capability-block), which rebuilds
-the bottle Dockerfile. The egress-block tool was removed in issue #198.
+the bottle Dockerfile. Egress proposals are queued for operator review
+as full routes.yaml updates.
 """
 
 from __future__ import annotations
@@ -20,11 +21,21 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from .. import supervise as _supervise
-# from ..bottle_state import read_metadata
+from ..bottle_state import read_metadata
 # from ..backend.docker.capability_apply import (
 #     CapabilityApplyError,
 #     apply_capability_change,
 # )
+from ..backend.docker.egress_apply import (
+    EgressApplyError,
+    applicator as _docker_applicator,
+)
+from ..backend.macos_container.egress_apply import (
+    applicator as _macos_applicator,
+)
+from ..backend.smolmachines.egress_apply import (
+    applicator as _smolmachines_applicator,
+)
 from ..log import Die, error, info
 
 
@@ -40,6 +51,8 @@ from ..supervise import (
     STATUS_MODIFIED,
     STATUS_REJECTED,
     TOOL_CAPABILITY_BLOCK,
+    TOOL_ALLOW,
+    TOOL_EGRESS_BLOCK,
     archive_proposal,
     list_pending_proposals,
     render_diff,
@@ -63,7 +76,17 @@ class QueuedProposal:
 # Errors any remediation engine may raise. Caught by the TUI key
 # handlers and surfaced in the status line so a failed apply keeps
 # the proposal pending rather than crashing curses.
-ApplyError = (CapabilityApplyError,)
+ApplyError = (CapabilityApplyError, EgressApplyError)
+
+
+def apply_routes_change(slug: str, content: str) -> tuple[str, str]:
+    meta = read_metadata(slug)
+    backend = meta.backend if meta is not None else ""
+    if backend == "macos-container":
+        return _macos_applicator.apply_routes_change(slug, content)
+    if backend == "smolmachines":
+        return _smolmachines_applicator.apply_routes_change(slug, content)
+    return _docker_applicator.apply_routes_change(slug, content)
 
 
 def discover_pending() -> list[QueuedProposal]:
@@ -115,6 +138,8 @@ def _detail_lines(
 def _suffix_for_tool(tool: str) -> str:
     if tool == TOOL_CAPABILITY_BLOCK:
         return ".dockerfile"
+    if tool in (TOOL_ALLOW, TOOL_EGRESS_BLOCK):
+        return ".yaml"
     return ".txt"
 
 
@@ -129,6 +154,7 @@ def approve(
 ) -> None:
     """Apply the proposal, write the waiting response, and audit it."""
     status = STATUS_MODIFIED if final_file is not None else STATUS_APPROVED
+    file_to_apply = final_file if final_file is not None else qp.proposal.proposed_file
 
     diff_before, diff_after = "", ""
     # if qp.proposal.tool == TOOL_CAPABILITY_BLOCK:
@@ -142,6 +168,11 @@ def approve(
     #     diff_before, diff_after = apply_capability_change(
     #         qp.proposal.bottle_slug, file_to_apply,
     #     )
+    if qp.proposal.tool in (TOOL_ALLOW, TOOL_EGRESS_BLOCK):
+        diff_before, diff_after = apply_routes_change(
+            qp.proposal.bottle_slug,
+            file_to_apply,
+        )
 
     response = Response(
         proposal_id=qp.proposal.id,

bot_bottle/contrib/claude/agent_provider.py

@@ -211,7 +211,7 @@ class ClaudeAgentProvider(AgentProvider):
         when the agent has no skills."""
         from ...backend.util import host_skill_dir
 
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        agent = plan.manifest.agent
         if not agent.skills:
             return
         skills_dir = _skills_dir(plan.guest_home)
@@ -240,7 +240,7 @@ class ClaudeAgentProvider(AgentProvider):
             f"chown node:node {prompt_path} && chmod 600 {prompt_path}",
             user="root",
         )
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        agent = plan.manifest.agent
         return prompt_path if plan.agent_provision.has_prompt or agent.prompt else None
 
     def provision(self, plan: "BottlePlan", bottle: "Bottle") -> None:

bot_bottle/contrib/codex/agent_provider.py

@@ -177,7 +177,7 @@ class CodexAgentProvider(AgentProvider):
         skills."""
         from ...backend.util import host_skill_dir
 
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        agent = plan.manifest.agent
         if not agent.skills:
             return
         skills_dir = _skills_dir(plan.guest_home)
@@ -206,7 +206,7 @@ class CodexAgentProvider(AgentProvider):
             f"chown node:node {prompt_path} && chmod 600 {prompt_path}",
             user="root",
         )
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        agent = plan.manifest.agent
         return prompt_path if plan.agent_provision.has_prompt or agent.prompt else None
 
     def provision(self, plan: "BottlePlan", bottle: "Bottle") -> None:
@@ -261,8 +261,8 @@ class CodexAgentProvider(AgentProvider):
             return
         info(f"registering supervise MCP server in agent codex config → {supervise_url}")
         r = bottle.exec(
-            f"codex mcp add --transport http "
-            f"{_SUPERVISE_MCP_NAME} {supervise_url}",
+            f"codex mcp add {_SUPERVISE_MCP_NAME} --url "
+            f"{shlex.quote(supervise_url)}",
             user="node",
         )
         if r.returncode != 0:
@@ -270,7 +270,7 @@ class CodexAgentProvider(AgentProvider):
                 f"`codex mcp add supervise` failed (exit {r.returncode}): "
                 f"{(r.stderr or r.stdout or '').strip()}. Inside the bottle, "
                 f"register manually with: "
-                f"codex mcp add --transport http supervise {supervise_url}"
+                f"codex mcp add supervise --url {shlex.quote(supervise_url)}"
             )
 
 

bot_bottle/contrib/pi/agent_provider.py

@@ -232,7 +232,7 @@ class PiAgentProvider(AgentProvider):
     def provision_skills(self, plan: "BottlePlan", bottle: "Bottle") -> None:
         from ...backend.util import host_skill_dir
 
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
+        agent = plan.manifest.agent
         if not agent.skills:
             return
         skills_dir = _skills_dir(plan.guest_home)

bot_bottle/egress.py

@@ -31,6 +31,7 @@ CODEX_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CODEX_HOST_ACCESS_TOKEN"
 EGRESS_HOSTNAME = "egress"
 
 EGRESS_ROUTES_IN_CONTAINER = "/etc/egress/routes.yaml"
+EGRESS_ROUTES_FILENAME = Path(EGRESS_ROUTES_IN_CONTAINER).name
 
 
 @dataclass(frozen=True)
@@ -295,7 +296,7 @@ class Egress(ABC):
     ) -> EgressPlan:
         routes = egress_routes_for_bottle(bottle, provider_routes)
         log = bottle.egress.Log
-        routes_path = stage_dir / "egress_routes.yaml"
+        routes_path = stage_dir / EGRESS_ROUTES_FILENAME
         routes_path.write_text(egress_render_routes(routes, log=log))
         routes_path.chmod(0o600)
         return EgressPlan(
@@ -309,6 +310,7 @@ class Egress(ABC):
 __all__ = [
     "CODEX_HOST_CREDENTIAL_TOKEN_REF",
     "EGRESS_HOSTNAME",
+    "EGRESS_ROUTES_FILENAME",
     "EGRESS_ROUTES_IN_CONTAINER",
     "Egress",
     "EgressPlan",

bot_bottle/egress_addon.py

@@ -5,7 +5,6 @@ egress container."""
 
 from __future__ import annotations
 
-import dataclasses
 import json
 import os
 import signal
@@ -27,6 +26,7 @@ from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: dis
     load_config,
     match_route,
     outbound_scan_headers,
+    route_to_yaml_dict,
     scan_inbound,
     scan_outbound,
 )
@@ -82,7 +82,7 @@ class EgressAddon:
     def _serve_introspection(self, flow: http.HTTPFlow, path: str) -> None:
         if path == "/allowlist":
             payload = json.dumps(
-                {"routes": [dataclasses.asdict(r) for r in self.config.routes]},
+                {"routes": [route_to_yaml_dict(r) for r in self.config.routes]},
                 indent=2,
             ).encode("utf-8")
             flow.response = http.Response.make(

bot_bottle/egress_addon_core.py

@@ -359,6 +359,56 @@ def _parse_one(idx: int, raw: object) -> Route:
     )
 
 
+def _path_match_to_dict(pm: PathMatch) -> dict[str, object]:
+    d: dict[str, object] = {"value": pm.value}
+    if pm.type != "prefix":
+        d["type"] = pm.type
+    return d
+
+
+def _header_match_to_dict(hm: HeaderMatch) -> dict[str, object]:
+    d: dict[str, object] = {"name": hm.name, "value": hm.value}
+    if hm.type != "exact":
+        d["type"] = hm.type
+    return d
+
+
+def _match_entry_to_dict(me: MatchEntry) -> dict[str, object]:
+    d: dict[str, object] = {}
+    if me.paths:
+        d["paths"] = [_path_match_to_dict(p) for p in me.paths]
+    if me.methods:
+        d["methods"] = list(me.methods)
+    if me.headers:
+        d["headers"] = [_header_match_to_dict(h) for h in me.headers]
+    return d
+
+
+def route_to_yaml_dict(r: Route) -> dict[str, object]:
+    """Serialize a Route to YAML-schema-compatible dict.
+
+    Uses the same field names the YAML parser accepts, so the output
+    can be round-tripped directly into an `allow` or `egress-block`
+    proposal without translation. Fields that are empty/default are
+    omitted so the agent doesn't copy irrelevant keys."""
+    d: dict[str, object] = {"host": r.host}
+    if r.auth_scheme:
+        d["auth_scheme"] = r.auth_scheme
+        d["token_env"] = r.token_env
+    if r.matches:
+        d["matches"] = [_match_entry_to_dict(m) for m in r.matches]
+    if r.git_fetch:
+        d["git"] = {"fetch": True}
+    dlp: dict[str, object] = {}
+    if r.outbound_detectors is not None:
+        dlp["outbound_detectors"] = list(r.outbound_detectors)
+    if r.inbound_detectors is not None:
+        dlp["inbound_detectors"] = list(r.inbound_detectors)
+    if dlp:
+        d["dlp"] = dlp
+    return d
+
+
 def load_routes(text: str) -> tuple[Route, ...]:
     """Parse YAML text → routes."""
     try:
@@ -698,6 +748,7 @@ def scan_inbound(
 
 __all__ = [
     "LOG_BLOCKS",
+    "route_to_yaml_dict",
     "LOG_FULL",
     "LOG_OFF",
     "Config",

bot_bottle/env.py

@@ -114,7 +114,7 @@ def _read_secret_silent(name: str, prompt_body: str) -> str:
     return value
 
 
-def resolve_env(manifest: Manifest, agent: str) -> ResolvedEnv:
+def resolve_env(manifest: Manifest) -> ResolvedEnv:
     """Iterate the agent's env entries:
       - secret:       prompt at runtime; carry value in forwarded
       - interpolated: read $HOST_VAR from os.environ; carry value in forwarded
@@ -124,7 +124,7 @@ def resolve_env(manifest: Manifest, agent: str) -> ResolvedEnv:
     backend injects forwarded values via its launcher's env parameter."""
     forwarded: dict[str, str] = {}
     literals: dict[str, str] = {}
-    bottle = manifest.bottle_for(agent)
+    bottle = manifest.bottle
     for name, raw in bottle.env.items():
         if not name:
             continue

bot_bottle/manifest.py

@@ -36,10 +36,23 @@ Bottles can ONLY live under $HOME. A bottles/ dir under $CWD is a
 warn at load time and contributes nothing. The trust boundary is
 expressed as filesystem layout rather than resolver logic.
 
-Validation runs once at load. Manifest.from_json_obj is preserved
-as a programmatic entry point (used by tests) that takes a dict
-with the same field names — useful for building manifests without
-on-disk files.
+Two types are exported:
+
+  ManifestIndex  — the multi-agent/bottle collection returned by
+                   resolve() and from_json_obj(). Used for agent
+                   selection (all_agent_names), validation
+                   (require_agent), and lazy loading (load_for_agent).
+                   This is the pre-preflight form.
+
+  Manifest       — a single-agent/bottle value type holding exactly
+                   one agent: ManifestAgent and one bottle:
+                   ManifestBottle (with the agent's git-gate.user
+                   already overlaid). Returned by load_for_agent().
+                   This is the post-preflight form passed to backends.
+
+ManifestIndex.from_json_obj is preserved as a programmatic entry
+point (used by tests) that takes a dict with the same field names —
+useful for building manifests without on-disk files.
 """
 
 from __future__ import annotations
@@ -71,6 +84,7 @@ __all__ = [
     "ManifestEgressConfig",
     "ManifestAgent",
     "ManifestBottle",
+    "ManifestIndex",
     "Manifest",
 ]
 
@@ -189,14 +203,64 @@ class ManifestBottle:
         )
 
 
+def _merge_git_user(
+    agent_user: ManifestGitUser, base_user: ManifestGitUser
+) -> ManifestGitUser:
+    """Merge the agent's git.user over the bottle's, agent-wins-on-non-empty."""
+    if agent_user.is_empty():
+        return base_user
+    return ManifestGitUser(
+        name=agent_user.name or base_user.name,
+        email=agent_user.email or base_user.email,
+    )
+
+
 @dataclass(frozen=True)
 class Manifest:
+    """Single-agent/bottle value type. Returned by ManifestIndex.load_for_agent().
+
+    `bottle` is the effective bottle with the agent's git-gate.user already
+    overlaid per-field (agent wins on non-empty). Backends and provisioners
+    use this directly — no agent_name lookup needed."""
+
+    agent: ManifestAgent
+    bottle: ManifestBottle
+
+    def git_identity_summary(self) -> str | None:
+        """One-line effective git identity with per-field provenance, e.g.
+        `name=claude (agent), email=eric@dideric.is (bottle)`.
+        Returns None when neither agent nor bottle sets an identity."""
+        over = self.agent.git_user        # agent's declared git_user (pre-merge)
+        merged = self.bottle.git_user     # effective git_user (post-merge)
+        if merged.is_empty():
+            return None
+        parts: list[str] = []
+        if merged.name:
+            parts.append(f"name={merged.name} ({'agent' if over.name else 'bottle'})")
+        if merged.email:
+            parts.append(f"email={merged.email} ({'agent' if over.email else 'bottle'})")
+        return ", ".join(parts)
+
+
+@dataclass(frozen=True)
+class ManifestIndex:
+    """Multi-agent/bottle collection. The pre-preflight form.
+
+    In lazy mode (from resolve()/from_md_dirs()) only filenames are scanned;
+    no file content is read. In eager mode (from from_json_obj()) all agents
+    and bottles are pre-parsed. Call load_for_agent() to get a single-value
+    Manifest ready for backend use."""
+
     bottles: Mapping[str, ManifestBottle]
     agents: Mapping[str, ManifestAgent]
+    # Set by from_md_dirs; None in from_json_obj (test/programmatic) mode.
+    # Stores the manifest root dirs so load_for_agent can locate files later.
+    home_md: Path | None = field(default=None)
+    cwd_md: Path | None = field(default=None)
 
     @classmethod
-    def resolve(cls, cwd: str, *, missing_ok: bool = False) -> "Manifest":
-        """Walk the per-file manifest tree and build a Manifest.
+    def resolve(cls, cwd: str, *, missing_ok: bool = False) -> "ManifestIndex":
+        """Walk the per-file manifest tree and build a ManifestIndex.
 
         Layout (PRD 0011):
           $HOME/.bot-bottle/bottles/<name>.md  — bottles (home-only)
@@ -209,7 +273,7 @@ class Manifest:
         boundary.
 
         If `missing_ok` is true, a missing `$HOME/.bot-bottle/`
-        returns an empty manifest instead of dying. This is for
+        returns an empty index instead of dying. This is for
         passive UI surfaces like the dashboard, which can still
         monitor already-running agents without launch config.
 
@@ -248,25 +312,16 @@ class Manifest:
         cls,
         home_dir: Path,
         cwd_dir: Path | None,
-    ) -> "Manifest":
-        """Programmatic entry point. Loads bottles from
-        `<home_dir>/bottles/`, home agents from `<home_dir>/agents/`,
-        and (if `cwd_dir` is passed) cwd agents from
-        `<cwd_dir>/agents/`. Cwd agents override home agents on
-        name collision. A `bottles/` subdir under `cwd_dir` is
-        logged as a warning and ignored.
+    ) -> "ManifestIndex":
+        """Return a names-only ManifestIndex. No file content is read; only
+        filenames are scanned for the agent selector.  Full parsing happens
+        later, per-agent, via `load_for_agent`.
 
-        Used by tests to build a Manifest from fixture directories
+        A `bottles/` subdir under `cwd_dir` is logged as a warning and
+        ignored — the filesystem layout IS the trust boundary.
+
+        Used by tests to build a ManifestIndex from fixture directories
         without touching `os.environ`."""
-        bottles_dir = home_dir / "bottles"
-        from .manifest_loader import load_agents_from_dir, load_bottles_from_dir
-
-        bottles = load_bottles_from_dir(bottles_dir)
-
-        bottle_names = set(bottles.keys())
-        agents_dir = home_dir / "agents"
-        agents = load_agents_from_dir(agents_dir, bottle_names, source="$HOME")
-
         if cwd_dir is not None:
             stale_bottles = cwd_dir / "bottles"
             if stale_bottles.is_dir():
@@ -280,17 +335,11 @@ class Manifest:
                         f"live under $HOME/.bot-bottle/bottles/ "
                         f"(PRD 0011). Move them or delete."
                     )
-            cwd_agents_dir = cwd_dir / "agents"
-            cwd_agents = load_agents_from_dir(
-                cwd_agents_dir, bottle_names, source="$CWD"
-            )
-            agents = {**agents, **cwd_agents}
-
-        return cls(bottles=bottles, agents=agents)
+        return cls(bottles={}, agents={}, home_md=home_dir, cwd_md=cwd_dir)
 
     @classmethod
-    def from_json_obj(cls, obj: object) -> "Manifest":
-        """Validate and build a Manifest from a raw JSON-like dict."""
+    def from_json_obj(cls, obj: object) -> "ManifestIndex":
+        """Validate and build a ManifestIndex from a raw JSON-like dict."""
         d = as_json_object(obj, "manifest")
         raw_bottles_obj = _section_dict(d.get("bottles"), "manifest 'bottles'")
         raw_agents = _section_dict(d.get("agents"), "manifest 'agents'")
@@ -311,75 +360,121 @@ class Manifest:
         }
         return cls(bottles=bottles, agents=agents)
 
+    @property
+    def all_agent_names(self) -> list[str]:
+        """Sorted list of all discoverable agent names.
+
+        In names-only mode (from resolve/from_md_dirs) this scans agent
+        filenames without reading their content. In eager mode (from
+        from_json_obj) it returns the pre-parsed agents' names."""
+        if self.home_md is not None:
+            from .manifest_loader import scan_agent_names
+            home_names = set(scan_agent_names(self.home_md / "agents").keys())
+            cwd_names: set[str] = set()
+            if self.cwd_md is not None:
+                cwd_names = set(scan_agent_names(self.cwd_md / "agents").keys())
+            return sorted(home_names | cwd_names)
+        return sorted(self.agents.keys())
+
+    def load_for_agent(self, agent_name: str) -> "Manifest":
+        """Parse the named agent and its bottle; return a single-value Manifest.
+
+        In lazy mode (from resolve/from_md_dirs) the agent file and its
+        bottle chain are read from disk for the first time here.  In eager
+        mode (from_json_obj) the data is already parsed; this just filters
+        down to the requested agent and its bottle.
+
+        The returned Manifest.bottle has the agent's git-gate.user already
+        overlaid (agent wins on non-empty, per-field).
+
+        Always raises ManifestError if the agent is unknown or invalid.
+        Backends call this at preflight inside _validate."""
+        if self.home_md is None:
+            # Eager manifest (from_json_obj): data already parsed; filter to
+            # the one requested agent and its bottle so the returned Manifest
+            # always holds exactly one agent and one bottle regardless of path.
+            if agent_name not in self.agents:
+                available = ", ".join(sorted(self.agents.keys())) or "(none)"
+                raise ManifestError(
+                    f"agent '{agent_name}' not defined. Available: {available}"
+                )
+            agent = self.agents[agent_name]
+            raw_bottle = self.bottles[agent.bottle]
+            merged = _merge_git_user(agent.git_user, raw_bottle.git_user)
+            bottle = raw_bottle if merged == raw_bottle.git_user else replace(raw_bottle, git_user=merged)
+            return Manifest(agent=agent, bottle=bottle)
+
+        from .manifest_loader import load_bottle_chain_from_dir, scan_agent_names
+        from .manifest_schema import validate_agent_frontmatter_keys
+        from .yaml_subset import YamlSubsetError, parse_frontmatter
+
+        # Locate the agent file; cwd wins over home on name collision.
+        home_agents = scan_agent_names(self.home_md / "agents")
+        cwd_agents: dict[str, Path] = {}
+        if self.cwd_md is not None:
+            cwd_agents = scan_agent_names(self.cwd_md / "agents")
+        merged_agents = {**home_agents, **cwd_agents}
+
+        if agent_name not in merged_agents:
+            available = ", ".join(sorted(merged_agents.keys())) or "(none)"
+            raise ManifestError(
+                f"agent '{agent_name}' not defined. Available: {available}"
+            )
+
+        agent_path = merged_agents[agent_name]
+        try:
+            fm, body = parse_frontmatter(agent_path.read_text())
+        except OSError as e:
+            raise ManifestError(f"could not read {agent_path}: {e}") from e
+        except YamlSubsetError as e:
+            raise ManifestError(f"{agent_path}: {e}") from e
+
+        validate_agent_frontmatter_keys(agent_path, fm.keys())
+
+        bottle_name = fm.get("bottle")
+        if not isinstance(bottle_name, str) or not bottle_name:
+            raise ManifestError(
+                f"agent '{agent_name}' must declare a 'bottle' field "
+                f"naming a defined bottle"
+            )
+
+        # Load the bottle chain (may raise ManifestError).
+        bottles_dir = self.home_md / "bottles"
+        raw_bottle = load_bottle_chain_from_dir(bottle_name, bottles_dir)
+
+        # Build and validate the full ManifestAgent.
+        agent_dict: dict[str, object] = {
+            "bottle": bottle_name,
+            "skills": fm.get("skills", []),
+            "prompt": body.strip(),
+        }
+        if "git-gate" in fm:
+            agent_dict["git-gate"] = fm["git-gate"]
+        agent = ManifestAgent.from_dict(agent_name, agent_dict, {bottle_name})
+
+        merged_user = _merge_git_user(agent.git_user, raw_bottle.git_user)
+        bottle = raw_bottle if merged_user == raw_bottle.git_user else replace(raw_bottle, git_user=merged_user)
+        return Manifest(agent=agent, bottle=bottle)
+
     def has_agent(self, name: str) -> bool:
         return name in self.agents
 
     def require_agent(self, name: str) -> None:
+        """Check that `name` is a discoverable agent. In names-only mode
+        this checks whether the .md file exists; in eager mode it checks
+        the pre-parsed agents dict. Does NOT parse file content."""
         if self.has_agent(name):
             return
-        available = ", ".join(self.agents.keys())
-        if available:
-            msg = f"agent '{name}' not defined in bot-bottle.json. Available: {available}"
-            raise ManifestError(msg)
-        raise ManifestError(
-            f"agent '{name}' not defined in bot-bottle.json (manifest is empty)."
-        )
-
-    def has_bottle(self, name: str) -> bool:
-        return name in self.bottles
-
-    def require_bottle(self, name: str) -> None:
-        if self.has_bottle(name):
-            return
-        available = ", ".join(self.bottles.keys())
-        if available:
-            raise ManifestError(
-                f"bottle '{name}' not defined in bot-bottle.json. "
-                f"Available bottles: {available}"
+        if self.home_md is not None:
+            # Names-only mode: check file existence without parsing.
+            home_path = self.home_md / "agents" / f"{name}.md"
+            cwd_path = (
+                self.cwd_md / "agents" / f"{name}.md"
+                if self.cwd_md else None
             )
-        raise ManifestError(f"bottle '{name}' not defined in bot-bottle.json (no bottles defined).")
-
-    def _effective_git_user(self, agent_name: str) -> ManifestGitUser:
-        """Merge the agent's git.user over the referenced bottle's,
-        per-field, agent-wins-on-non-empty (issue #94). Same overlay
-        the `extends:` resolver applies between bottles
-        (`_merge_bottles`)."""
-        agent = self.agents[agent_name]
-        base = self.bottles[agent.bottle].git_user
-        over = agent.git_user
-        if over.is_empty():
-            return base
-        return ManifestGitUser(
-            name=over.name or base.name,
-            email=over.email or base.email,
+            if home_path.is_file() or (cwd_path and cwd_path.is_file()):
+                return
+        available = ", ".join(self.all_agent_names) or "(none)"
+        raise ManifestError(
+            f"agent '{name}' not defined. Available: {available}"
         )
-
-    def bottle_for(self, agent_name: str) -> ManifestBottle:
-        """Resolve the Bottle the named agent references, with the
-        agent's git.user overlaid on top. The validator guarantees both
-        lookups succeed for a manifest built via from_json_obj.
-
-        The overlay lives here, the single point both backends call to
-        resolve an agent's bottle, so the docker / smolmachines git
-        provisioners pick up the merged identity unchanged."""
-        bottle = self.bottles[self.agents[agent_name].bottle]
-        merged = self._effective_git_user(agent_name)
-        if merged == bottle.git_user:
-            return bottle
-        return replace(bottle, git_user=merged)
-
-    def git_identity_summary(self, agent_name: str) -> str | None:
-        """One-line effective git identity with per-field provenance
-        for launch summaries, e.g.
-        `name=claude (agent), email=eric@dideric.is (bottle)`.
-        Returns None when neither agent nor bottle sets an identity."""
-        over = self.agents[agent_name].git_user
-        merged = self._effective_git_user(agent_name)
-        if merged.is_empty():
-            return None
-        parts: list[str] = []
-        if merged.name:
-            parts.append(f"name={merged.name} ({'agent' if over.name else 'bottle'})")
-        if merged.email:
-            parts.append(f"email={merged.email} ({'agent' if over.email else 'bottle'})")
-        return ", ".join(parts)

bot_bottle/manifest_loader.py

@@ -8,21 +8,19 @@ from typing import TYPE_CHECKING
 from .log import warn
 from .manifest_schema import (
     entity_name_from_path,
-    validate_agent_frontmatter_keys,
     validate_bottle_frontmatter_keys,
 )
+from .manifest_util import ManifestError
 from .yaml_subset import YamlSubsetError, parse_frontmatter
 
 if TYPE_CHECKING:
-    from .manifest import ManifestAgent, ManifestBottle
+    from .manifest import ManifestBottle
 
 
 def check_stale_json(dir_path: Path, md_dir: Path, label: str) -> None:
     """Die if `<dir_path>/bot-bottle.json` exists but `md_dir` does
     not. The manifest format changed in PRD 0011 and we do not want
     to silently leave the JSON content unused."""
-    from .manifest import ManifestError
-
     legacy = dir_path / "bot-bottle.json"
     if legacy.is_file() and not md_dir.exists():
         raise ManifestError(
@@ -34,48 +32,13 @@ def check_stale_json(dir_path: Path, md_dir: Path, label: str) -> None:
         )
 
 
-def load_bottles_from_dir(bottles_dir: Path) -> dict[str, ManifestBottle]:
-    """Walk `<bottles_dir>/*.md`, parse each as a bottle, and return
-    `{name: Bottle}`. Missing dir returns an empty dict."""
-    from .manifest import ManifestError
-    from .manifest_extends import resolve_bottles
+def scan_agent_names(agents_dir: Path) -> dict[str, Path]:
+    """Scan `<agents_dir>/*.md` for valid filenames and return `{name: path}`.
 
-    raws: dict[str, dict[str, object]] = {}
-    if not bottles_dir.is_dir():
-        return {}
-    for path in sorted(bottles_dir.glob("*.md")):
-        name = entity_name_from_path(path)
-        if name is None:
-            warn(
-                f"skipping {path}: filename must match "
-                f"[a-z][a-z0-9-]*.md (got {path.name!r})"
-            )
-            continue
-        try:
-            fm, _body = parse_frontmatter(path.read_text())
-        except OSError as e:
-            raise ManifestError(f"could not read {path}: {e}") from e
-        except YamlSubsetError as e:
-            raise ManifestError(f"{path}: {e}") from e
-        validate_bottle_frontmatter_keys(path, fm.keys())
-        raws[name] = fm
-    return resolve_bottles(raws)
-
-
-def load_agents_from_dir(
-    agents_dir: Path,
-    bottle_names: set[str],
-    *,
-    source: str,  # noqa: F841 — unused, but required by interface
-) -> dict[str, ManifestAgent]:
-    """Walk `<agents_dir>/*.md`, parse each as an agent, and return
-    `{name: Agent}`. The Markdown body becomes the agent's prompt.
-    Missing dir returns an empty dict."""
-    from .manifest import ManifestAgent, ManifestError
-
-    out: dict[str, ManifestAgent] = {}
+    No file content is read. Invalid filenames are skipped with a warning."""
+    result: dict[str, Path] = {}
     if not agents_dir.is_dir():
-        return out
+        return result
     for path in sorted(agents_dir.glob("*.md")):
         name = entity_name_from_path(path)
         if name is None:
@@ -84,22 +47,45 @@ def load_agents_from_dir(
                 f"[a-z][a-z0-9-]*.md (got {path.name!r})"
             )
             continue
+        result[name] = path
+    return result
+
+
+def load_bottle_chain_from_dir(
+    bottle_name: str, bottles_dir: Path
+) -> ManifestBottle:
+    """Load `bottle_name` and its full `extends:` chain from `bottles_dir`,
+    returning the resolved ManifestBottle.
+
+    Only the files in the extends chain are read — unrelated bottle files
+    are never touched. Raises ManifestError on parse or validation failure."""
+    from .manifest_extends import resolve_bottles
+
+    raws: dict[str, dict[str, object]] = {}
+    to_load = [bottle_name]
+    while to_load:
+        name = to_load.pop()
+        if name in raws:
+            continue
+        path = bottles_dir / f"{name}.md"
+        if not path.is_file():
+            avail = ", ".join(
+                p.stem for p in sorted(bottles_dir.glob("*.md")) if p.is_file()
+            ) or "(none)"
+            raise ManifestError(
+                f"bottle '{name}' not found at {path}. "
+                f"Available: {avail}"
+            )
         try:
-            fm, body = parse_frontmatter(path.read_text())
+            fm, _body = parse_frontmatter(path.read_text())
         except OSError as e:
             raise ManifestError(f"could not read {path}: {e}") from e
         except YamlSubsetError as e:
             raise ManifestError(f"{path}: {e}") from e
-        validate_agent_frontmatter_keys(path, fm.keys())
-        # Build the dict Agent.from_dict expects. The body becomes
-        # prompt; Claude Code passthrough fields stay in fm and get
-        # ignored by Agent.from_dict (reads bottle/skills/git-gate/prompt).
-        agent_dict: dict[str, object] = {
-            "bottle": fm.get("bottle"),
-            "skills": fm.get("skills", []),
-            "prompt": body.strip(),
-        }
-        if "git-gate" in fm:
-            agent_dict["git-gate"] = fm["git-gate"]
-        out[name] = ManifestAgent.from_dict(name, agent_dict, bottle_names)
-    return out
+        validate_bottle_frontmatter_keys(path, fm.keys())
+        raws[name] = dict(fm)
+        parent = fm.get("extends")
+        if isinstance(parent, str):
+            to_load.append(parent)
+
+    return resolve_bottles(raws)[bottle_name]

bot_bottle/supervise.py

@@ -5,7 +5,7 @@ queue/audit support. The sidecar (bot_bottle.supervise_server)
 sits on the bottle's internal network and exposes three MCP tools the
 agent calls when it hits a stuck-recovery category:
 
-  * egress-block — agent proposes a new routes.yaml
+  * egress-block / allow — agent proposes a new routes.yaml
   * capability-block — agent proposes a new agent Dockerfile
 
 Each tool call: the agent passes the full proposed file plus a
@@ -49,27 +49,34 @@ SUPERVISE_HOSTNAME = "supervise"
 SUPERVISE_PORT = 9100
 
 TOOL_CAPABILITY_BLOCK = "capability-block"
+TOOL_EGRESS_BLOCK = "egress-block"
+TOOL_ALLOW = "allow"
 TOOL_LIST_EGRESS_ROUTES = "list-egress-routes"
 TOOLS: tuple[str, ...] = (
+    TOOL_ALLOW,
     TOOL_CAPABILITY_BLOCK,
+    TOOL_EGRESS_BLOCK,
     TOOL_LIST_EGRESS_ROUTES,
 )
 
 # The supervise sidecar uses these to query egress's
 # introspection endpoint for the `list-egress-routes` MCP
 # tool. The hostname + port match egress's docker network
-# alias + listen port (see bot_bottle.egress.EGRESS_HOSTNAME
-# and backend.docker.egress.EGRESS_PORT — the values
-# are inlined here so the in-container supervise_server doesn't
-# need to import the egress package).
-EGRESS_FORWARD_PROXY = "http://egress:9099"
+# listen port (see backend.docker.egress.EGRESS_PORT). The supervise
+# daemon runs inside the sidecar bundle alongside egress, so loopback
+# is the stable address across docker, smolmachines, and Apple
+# Container backends.
+EGRESS_FORWARD_PROXY = "http://127.0.0.1:9099"
 EGRESS_INTROSPECT_URL = "http://_egress.local/allowlist"
 
 # capability-block has no on-disk config the operator edits in place
 # (the Dockerfile is rebuilt, not patched), so it has no audit log
-# here — those changes are captured by git history + the rebuild
-# record laid down in PRD 0016. egress-block was removed in issue #198.
-COMPONENT_FOR_TOOL: dict[str, str] = {}
+# here — those changes are captured by git history + the rebuild record
+# laid down in PRD 0016.
+COMPONENT_FOR_TOOL: dict[str, str] = {
+    TOOL_ALLOW: "egress",
+    TOOL_EGRESS_BLOCK: "egress",
+}
 
 STATUS_APPROVED = "approved"
 STATUS_MODIFIED = "modified"
@@ -431,9 +438,9 @@ def sha256_hex(content: str) -> str:
 # Dockerfile and propose modifications.
 #
 # routes.yaml + allowlist used to live here too; PRD 0017 chunk 3
-# moved them behind the `list-egress-routes` MCP tool (live
-# state from egress's introspection endpoint) so the agent
-# always sees current data rather than a launch-time snapshot.
+# moved them behind the `list-egress-routes` MCP tool (live state
+# from egress's introspection endpoint) so the agent always sees
+# current data rather than a launch-time snapshot.
 CURRENT_CONFIG_DOCKERFILE = "Dockerfile"
 
 

bot_bottle/supervise_server.py

@@ -1,8 +1,8 @@
 """Supervise sidecar HTTP server (PRD 0013).
 
 Per-bottle MCP server exposing tools the agent calls to propose config
-changes when stuck. The egress-block tool was removed in issue #198;
-the remaining tools are `capability-block` and `list-egress-routes`.
+changes when stuck. The tools are `allow`, `egress-block`,
+`capability-block`, and `list-egress-routes`.
 
 Each queued tool call:
 
@@ -44,9 +44,15 @@ import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
 
-# Same-directory import inside the bundle container; `supervise.py`
-# is COPYed alongside this file by Dockerfile.sidecars.
-import supervise as _sv
+try:
+    # Same-directory imports inside the bundle container; these files are
+    # COPYed flat under /app by Dockerfile.sidecars.
+    from egress_addon_core import load_routes
+    import supervise as _sv
+except ModuleNotFoundError:
+    # Package imports for host-side tests and tooling.
+    from .egress_addon_core import load_routes
+    from . import supervise as _sv
 
 
 # --- JSON-RPC / MCP plumbing ----------------------------------------------
@@ -142,8 +148,9 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
             "allowlist. Returns JSON with one entry per allowed host, "
             "each carrying its matches rules (if any) and whether "
             "the proxy injects Authorization for the route. Use this "
-            "before composing an `egress-block` proposal so the new "
-            "routes file extends the live one rather than replacing it."
+            "before composing an `allow` or `egress-block` proposal so "
+            "the new routes file extends the live one rather than "
+            "replacing it."
         ),
         "inputSchema": {
             "type": "object",
@@ -151,6 +158,88 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
             "additionalProperties": False,
         },
     },
+    {
+        "name": _sv.TOOL_ALLOW,
+        "description": (
+            "Request operator approval to change the bottle's egress "
+            "allowlist. Pass the full proposed routes.yaml content, not "
+            "just the new host, plus a justification. Use "
+            "`list-egress-routes` first so the proposal preserves existing "
+            "routes."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "routes_yaml": {
+                    "type": "string",
+                    "description": (
+                        "Full proposed /etc/egress/routes.yaml content. "
+                        "Each route entry accepts these keys:\n"
+                        "  host: <hostname>  (required)\n"
+                        "  auth_scheme: Bearer|token  (must pair with token_env)\n"
+                        "  token_env: <ENV_VAR_NAME>  (must pair with auth_scheme)\n"
+                        "  matches:  (optional list of match entries)\n"
+                        "    - paths: [{type: prefix|exact|regex, value: /...}]\n"
+                        "      methods: [GET, POST, ...]\n"
+                        "      headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
+                        "  git:  (optional; omit to block git clone/fetch)\n"
+                        "    fetch: true\n"
+                        "  dlp:  (optional DLP scanner overrides)\n"
+                        "    outbound_detectors: [token_patterns, known_secrets]\n"
+                        "    inbound_detectors: [naive_injection_detection]\n"
+                        "Omit any key that should use its default. "
+                        "`list-egress-routes` returns routes in this same format."
+                    ),
+                },
+                "justification": {
+                    "type": "string",
+                    "description": "Why this egress route is needed.",
+                },
+            },
+            "required": ["routes_yaml", "justification"],
+        },
+    },
+    {
+        "name": _sv.TOOL_EGRESS_BLOCK,
+        "description": (
+            "Request operator approval to change the bottle's egress "
+            "allowlist after a blocked outbound request. Pass the full "
+            "proposed routes.yaml content plus a justification. Use "
+            "`list-egress-routes` first so the proposal preserves existing "
+            "routes."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "routes_yaml": {
+                    "type": "string",
+                    "description": (
+                        "Full proposed /etc/egress/routes.yaml content. "
+                        "Each route entry accepts these keys:\n"
+                        "  host: <hostname>  (required)\n"
+                        "  auth_scheme: Bearer|token  (must pair with token_env)\n"
+                        "  token_env: <ENV_VAR_NAME>  (must pair with auth_scheme)\n"
+                        "  matches:  (optional list of match entries)\n"
+                        "    - paths: [{type: prefix|exact|regex, value: /...}]\n"
+                        "      methods: [GET, POST, ...]\n"
+                        "      headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
+                        "  git:  (optional; omit to block git clone/fetch)\n"
+                        "    fetch: true\n"
+                        "  dlp:  (optional DLP scanner overrides)\n"
+                        "    outbound_detectors: [token_patterns, known_secrets]\n"
+                        "    inbound_detectors: [naive_injection_detection]\n"
+                        "Omit any key that should use its default. "
+                        "`list-egress-routes` returns routes in this same format."
+                    ),
+                },
+                "justification": {
+                    "type": "string",
+                    "description": "Why this egress route is needed.",
+                },
+            },
+            "required": ["routes_yaml", "justification"],
+        },
+    },
     {
         "name": _sv.TOOL_CAPABILITY_BLOCK,
         "description": (
@@ -182,11 +271,12 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
 ]
 
 
-# Map each non-egress tool to the input field that carries the agent's
-# payload (stored in Proposal.proposed_file). egress-block builds its
-# payload from structured input fields in `handle_egress_block`.
+# Map each proposal tool to the input field that carries the agent's
+# payload (stored in Proposal.proposed_file).
 PROPOSED_FILE_FIELD: dict[str, str] = {
+    _sv.TOOL_ALLOW: "routes_yaml",
     _sv.TOOL_CAPABILITY_BLOCK: "dockerfile",
+    _sv.TOOL_EGRESS_BLOCK: "routes_yaml",
 }
 
 
@@ -203,6 +293,14 @@ def validate_proposed_file(tool: str, content: str) -> None:
         # Dockerfiles are too varied to validate syntactically beyond
         # non-empty. The operator reads the diff in the TUI.
         pass
+    elif tool in (_sv.TOOL_ALLOW, _sv.TOOL_EGRESS_BLOCK):
+        try:
+            load_routes(content)
+        except ValueError as e:
+            raise _RpcError(
+                ERR_INVALID_PARAMS,
+                f"{tool}: proposed routes.yaml is not valid: {e}",
+            ) from e
     else:
         raise _RpcError(ERR_INVALID_PARAMS, f"unknown tool {tool!r}")
 

docs/prds/prd-new-commit-bottle-state.md

@@ -7,10 +7,11 @@
 
 ## Summary
 
-Add a `commit` CLI command that freezes a running Docker bottle's
-container state to a named Docker image. Operators can then resume the
-bottle from that exact filesystem snapshot, or export the image with
-`docker save` to migrate work to a different host.
+Add a `commit` CLI command that freezes a running bottle's state to a
+resumable local artifact. Docker bottles are stored as Docker images;
+smolmachines bottles are stored as `.smolmachine` artifacts. Operators
+can then resume the bottle from that exact filesystem snapshot, or
+export the artifact to migrate work to a different host.
 
 ## Problem
 
@@ -29,30 +30,29 @@ snapshot before a planned host reboot or hardware migration.
 
 ## Goals / Success Criteria
 
-- `./cli.py commit [<slug>]` takes a snapshot of the running Docker
-  agent container and stores it as a local Docker image.
+- `./cli.py commit [<slug>]` takes a snapshot of the running agent and
+  stores it as a local artifact.
 - Without a slug argument the command shows the same interactive picker
   as `start` (the list of active slugs).
-- The committed image tag is stored in per-bottle state so that the next
-  `./cli.py resume <slug>` automatically uses the committed image instead
-  of rebuilding from the Dockerfile.
+- The committed artifact reference is stored in per-bottle state so
+  that the next `./cli.py resume <slug>` automatically uses the
+  snapshot instead of rebuilding from the Dockerfile.
 - `mark_preserved` is called so the state dir survives the normal
   session-end cleanup.
-- A `docker save` hint is printed so operators know how to export the
-  image for migration.
-- The command errors clearly on non-Docker backends (smolmachines does
-  not expose a container-level commit API in its current CLI surface).
+- A backend-specific export hint is printed so operators know how to
+  migrate the snapshot.
+- The command errors clearly on unsupported backends.
 
 ## Non-goals
 
-- Smolmachines or macOS-container backend support.
+- macOS-container backend support.
 - Automatic commit on agent exit.
 - Image push to a remote registry.
 - Storing the image tag in the manifest or sharing it between operators.
 
 ## Design
 
-### Image tag
+### Docker image tag
 
 `bot-bottle-committed-<slug>:latest` — namespaced under `bot-bottle-`
 to match existing image naming conventions; `committed` distinguishes it
@@ -68,13 +68,15 @@ directory:
 ~/.bot-bottle/state/<identity>/
     metadata.json
     Dockerfile            (capability-block override; optional)
-    committed-image       (committed image tag; optional)
+    committed-image       (committed artifact reference; optional)
     transcript/
 ```
 
 `bottle_state.committed_image_path(identity)` returns the path.
 `write_committed_image` / `read_committed_image` are the read/write
-helpers, matching the existing `per_bottle_dockerfile` pattern.
+helpers, matching the existing `per_bottle_dockerfile` pattern. Docker
+stores a Docker tag in this file; smolmachines stores the absolute path
+to the committed `.smolmachine` artifact.
 
 ### `commit` command
 
@@ -83,14 +85,15 @@ helpers, matching the existing `per_bottle_dockerfile` pattern.
 ```
 
 1. Resolve slug (arg or interactive picker from `enumerate_active_agents`).
-2. Check metadata: if `backend` is set and is not `docker`, die with a
-   clear "not supported" error.
-3. Derive container name: `bot-bottle-<slug>` (matches the agent
-   provision plan's `instance_name` convention).
-4. Run `docker commit <container> bot-bottle-committed-<slug>:latest`.
-5. Write the image tag to `~/.bot-bottle/state/<slug>/committed-image`.
+2. Check metadata and branch by backend.
+3. For Docker, derive container name `bot-bottle-<slug>` and run
+   `docker commit <container> bot-bottle-committed-<slug>:latest`.
+4. For smolmachines, derive machine name `bot-bottle-<slug>` and run
+   `smolvm pack create --from-vm <machine> -o ~/.bot-bottle/state/<slug>/committed-smolmachine`.
+5. Write the Docker image tag or smolmachine artifact path to
+   `~/.bot-bottle/state/<slug>/committed-image`.
 6. Call `mark_preserved(<slug>)` so the state dir survives session-end.
-7. Print the resume hint and a `docker save` export example.
+7. Print the resume hint and a backend-specific export example.
 
 ### Resume from committed image
 
@@ -120,6 +123,22 @@ If the committed image has been deleted from the local daemon (e.g.
 after `docker rmi` or a `docker system prune`), the launch falls back
 to a normal Dockerfile build, matching the pre-commit behavior.
 
+### Resume from committed smolmachine
+
+`bot_bottle/backend/smolmachines/launch.py` checks the committed
+reference before the normal Docker build -> pack cache path:
+
+```python
+committed = read_committed_image(plan.slug)
+if committed and Path(committed).is_file():
+    return Path(committed)
+return _ensure_smolmachine(plan.agent_image, dockerfile=plan.agent_dockerfile_path)
+```
+
+The returned path is passed to `smolvm machine create --from`, so the
+resumed VM boots from the committed snapshot. If the artifact has been
+deleted, launch falls back to the normal build and pack flow.
+
 ## Testing strategy
 
 - Unit tests for `write_committed_image` / `read_committed_image` in
@@ -127,10 +146,14 @@ to a normal Dockerfile build, matching the pre-commit behavior.
   pattern.
 - Unit tests for `commit_container` in `tests/unit/test_docker_util_image.py`,
   mocking `subprocess.run` and asserting on the `docker commit` argv.
-- Unit tests for `cmd_commit` argument parsing and the "unsupported
-  backend" error path, mocking `enumerate_active_agents` and
-  `commit_container`.
+- Unit tests for `cmd_commit` argument parsing, Docker commit,
+  smolmachines pack, and the unsupported backend error path, mocking
+  `enumerate_active_agents`, `commit_container`, and
+  `pack_create_from_vm`.
 - Unit tests for the launch-step committed-image branch: patch
   `read_committed_image` to return a tag, patch `image_exists` to return
   True, and assert that `build_image` is not called and `plan.image` is
   overridden.
+- Unit tests for the smolmachines launch-step committed-artifact branch:
+  patch `read_committed_image` to return an existing path and assert the
+  normal `_ensure_smolmachine` path is skipped.

tests/fixtures.py

@@ -10,7 +10,7 @@ import tempfile
 from pathlib import Path
 from typing import Any, Callable
 
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
 def fixture_minimal_dict() -> dict[str, Any]:
@@ -62,16 +62,16 @@ def fixture_with_git_dict() -> dict[str, Any]:
     }
 
 
-def fixture_minimal() -> Manifest:
-    return Manifest.from_json_obj(fixture_minimal_dict())
+def fixture_minimal() -> ManifestIndex:
+    return ManifestIndex.from_json_obj(fixture_minimal_dict())
 
 
-def fixture_with_egress() -> Manifest:
-    return Manifest.from_json_obj(fixture_with_egress_dict())
+def fixture_with_egress() -> ManifestIndex:
+    return ManifestIndex.from_json_obj(fixture_with_egress_dict())
 
 
-def fixture_with_git() -> Manifest:
-    return Manifest.from_json_obj(fixture_with_git_dict())
+def fixture_with_git() -> ManifestIndex:
+    return ManifestIndex.from_json_obj(fixture_with_git_dict())
 
 
 def write_fixture(fn: Callable[[], dict[str, Any]]) -> Path:

tests/integration/test_macos_container_launch.py

@@ -29,7 +29,7 @@ from bot_bottle.backend.macos_container.util import (
     dns_server as _container_dns_server,
     is_available as _container_available,
 )
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
 _AGENT_PROMPT = "You are a launch smoke-test agent. Be brief."
@@ -52,8 +52,8 @@ def _minimal_agent_dockerfile(path: Path) -> None:
     )
 
 
-def _minimal_manifest(dockerfile: Path) -> Manifest:
-    return Manifest.from_json_obj({
+def _minimal_manifest(dockerfile: Path) -> ManifestIndex:
+    return ManifestIndex.from_json_obj({
         "bottles": {
             "dev": {
                 "agent_provider": {

tests/integration/test_sandbox_escape.py

@@ -31,7 +31,7 @@ from pathlib import Path
 
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from bot_bottle.bottle_state import cleanup_state
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from tests._docker import skip_unless_docker
 
 
@@ -101,7 +101,7 @@ class TestSandboxEscape(unittest.TestCase):
         cls._key_path.write_text("placeholder\n")
         cls._key_path.chmod(0o600)
 
-        manifest = Manifest.from_json_obj({
+        manifest = ManifestIndex.from_json_obj({
             "bottles": {
                 "dev": {
                     # Three fake secrets — different shapes — land

tests/integration/test_sidecar_bundle_compose.py

@@ -22,15 +22,15 @@ from pathlib import Path
 from unittest.mock import patch
 
 from bot_bottle.backend import BottleSpec, get_bottle_backend
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from tests._docker import skip_unless_docker
 
 
-def _manifest() -> Manifest:
+def _manifest() -> ManifestIndex:
     """Bottle with supervise on so the bundle exercises egress +
     supervise. Git is off because a meaningful git-gate test needs
     a real upstream and SSH keys — out of scope for a bundle smoke."""
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {
             "dev": {
                 "supervise": True,

tests/integration/test_smolmachines_launch.py

@@ -35,15 +35,15 @@ from pathlib import Path
 
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from bot_bottle.backend.smolmachines.smolvm import is_available as _smolvm_available
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from tests._docker import skip_unless_docker
 
 
 _AGENT_PROMPT = "You are demo. Be brief."
 
 
-def _minimal_manifest() -> Manifest:
-    return Manifest.from_json_obj({
+def _minimal_manifest() -> ManifestIndex:
+    return ManifestIndex.from_json_obj({
         "bottles": {
             "dev": {
                 "egress": {

tests/unit/test_backend_freezer.py

@@ -0,0 +1,216 @@
+"""Unit: Freezer class hierarchy."""
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from bot_bottle import supervise, bottle_state
+from bot_bottle.backend import ActiveAgent
+from bot_bottle.backend.freeze import get_freezer
+from bot_bottle.backend.docker.freezer import DockerFreezer
+from bot_bottle.backend.macos_container.freezer import MacosContainerFreezer
+from bot_bottle.backend.smolmachines.freezer import SmolmachinesFreezer
+
+
+class _FakeHomeMixin:
+    def _setup_fake_home(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="freezer-test.")
+        original = supervise.bot_bottle_root
+
+        def fake_root() -> Path:
+            return Path(self._tmp.name) / ".bot-bottle"
+
+        supervise.bot_bottle_root = fake_root  # type: ignore[assignment]
+        self._restore = lambda: setattr(supervise, "bot_bottle_root", original)
+
+    def _teardown_fake_home(self):
+        self._restore()
+        self._tmp.cleanup()
+
+
+def _make_agent(slug: str, backend: str = "docker") -> ActiveAgent:
+    return ActiveAgent(
+        backend_name=backend,
+        slug=slug,
+        agent_name="dev",
+        started_at="t",
+        services=(),
+    )
+
+
+class TestGetFreezer(unittest.TestCase):
+    def test_docker(self):
+        self.assertIsInstance(get_freezer("docker"), DockerFreezer)
+
+    def test_empty_backend_gives_docker(self):
+        self.assertIsInstance(get_freezer(""), DockerFreezer)
+
+    def test_macos_container(self):
+        self.assertIsInstance(get_freezer("macos-container"), MacosContainerFreezer)
+
+    def test_smolmachines(self):
+        self.assertIsInstance(get_freezer("smolmachines"), SmolmachinesFreezer)
+
+    def test_unknown_backend_dies(self):
+        with patch("bot_bottle.backend.freeze.die", side_effect=SystemExit("die")):
+            with self.assertRaises(SystemExit):
+                get_freezer("unknown-backend")
+
+
+class TestFreezerBaseCommit(_FakeHomeMixin, unittest.TestCase):
+    """The base Freezer.commit() owns the shared post-freeze steps."""
+
+    def setUp(self):
+        self._setup_fake_home()
+
+    def tearDown(self):
+        self._teardown_fake_home()
+
+    def test_writes_committed_image_and_marks_preserved(self):
+        slug = "dev-abc12"
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend="docker",
+        ))
+        freezer = get_freezer("docker")
+        agent = _make_agent(slug)
+
+        with patch.object(freezer, "_freeze", return_value="bot-bottle-committed-dev-abc12:latest"), \
+             patch("bot_bottle.backend.freeze.info"):
+            freezer.commit(agent)
+
+        self.assertEqual(
+            "bot-bottle-committed-dev-abc12:latest",
+            bottle_state.read_committed_image(slug),
+        )
+        self.assertTrue(bottle_state.is_preserved(slug))
+
+    def test_commit_slug_passes_correct_slug_to_freeze(self):
+        slug = "dev-abc12"
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend="docker",
+        ))
+        freezer = get_freezer("docker")
+        captured = {}
+
+        def capture_freeze(agent: ActiveAgent) -> str:
+            captured["slug"] = agent.slug
+            return "some-ref"
+
+        with patch.object(freezer, "_freeze", side_effect=capture_freeze), \
+             patch("bot_bottle.backend.freeze.info"):
+            freezer.commit_slug(slug)
+
+        self.assertEqual(slug, captured["slug"])
+
+
+class TestDockerFreezer(_FakeHomeMixin, unittest.TestCase):
+    def setUp(self):
+        self._setup_fake_home()
+
+    def tearDown(self):
+        self._teardown_fake_home()
+
+    def test_commits_container_and_records_image(self):
+        slug = "dev-abc12"
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend="docker",
+        ))
+        freezer = DockerFreezer()
+        agent = _make_agent(slug)
+
+        with patch("bot_bottle.backend.docker.freezer.commit_container") as mock_commit, \
+             patch("bot_bottle.backend.freeze.info"), \
+             patch("bot_bottle.backend.docker.freezer.info"):
+            freezer.commit(agent)
+
+        mock_commit.assert_called_once_with(
+            f"bot-bottle-{slug}",
+            f"bot-bottle-committed-{slug}:latest",
+        )
+        self.assertEqual(
+            f"bot-bottle-committed-{slug}:latest",
+            bottle_state.read_committed_image(slug),
+        )
+        self.assertTrue(bottle_state.is_preserved(slug))
+
+
+class TestMacosContainerFreezer(_FakeHomeMixin, unittest.TestCase):
+    def setUp(self):
+        self._setup_fake_home()
+
+    def tearDown(self):
+        self._teardown_fake_home()
+
+    def _write_meta(self, slug: str) -> None:
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend="macos-container",
+        ))
+
+    def test_commits_running_container_without_stopping(self):
+        """Commit should exec-tar the running container, not stop it."""
+        slug = "dev-abc12"
+        self._write_meta(slug)
+        freezer = MacosContainerFreezer()
+        agent = _make_agent(slug, "macos-container")
+
+        with patch("bot_bottle.backend.macos_container.freezer.commit_container") as mock_commit, \
+             patch("bot_bottle.backend.freeze.info"), \
+             patch("bot_bottle.backend.macos_container.freezer.info"):
+            freezer.commit(agent)
+
+        mock_commit.assert_called_once_with(
+            f"bot-bottle-{slug}",
+            f"bot-bottle-committed-{slug}:latest",
+        )
+        self.assertEqual(
+            f"bot-bottle-committed-{slug}:latest",
+            bottle_state.read_committed_image(slug),
+        )
+        self.assertTrue(bottle_state.is_preserved(slug))
+
+
+class TestSmolmachinesFreezer(_FakeHomeMixin, unittest.TestCase):
+    def setUp(self):
+        self._setup_fake_home()
+
+    def tearDown(self):
+        self._teardown_fake_home()
+
+    def _write_meta(self, slug: str) -> None:
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend="smolmachines",
+        ))
+
+    def test_snapshots_running_vm_without_stopping(self):
+        """Commit should exec-tar the running VM, not stop it."""
+        slug = "dev-abc12"
+        self._write_meta(slug)
+        freezer = SmolmachinesFreezer()
+        agent = _make_agent(slug, "smolmachines")
+
+        with patch("bot_bottle.backend.smolmachines.freezer._snapshot_running_vm") as mock_snap, \
+             patch("bot_bottle.backend.freeze.info"), \
+             patch("bot_bottle.backend.smolmachines.freezer.info"):
+            freezer.commit(agent)
+
+        expected_binary = bottle_state.bottle_state_dir(slug) / "committed-smolmachine"
+        mock_snap.assert_called_once_with(
+            f"bot-bottle-{slug}",
+            f"bot-bottle-committed-{slug}:latest",
+            expected_binary,
+        )
+        expected_sidecar = str(expected_binary.with_suffix(".smolmachine"))
+        self.assertEqual(expected_sidecar, bottle_state.read_committed_image(slug))
+        self.assertTrue(bottle_state.is_preserved(slug))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_backend_prepare.py

@@ -18,11 +18,11 @@ from bot_bottle.backend import BottleSpec
 from bot_bottle.backend.docker import DockerBottleBackend
 from bot_bottle.backend.resolve_common import mint_slug
 from bot_bottle.backend.smolmachines import SmolmachinesBottleBackend
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
-def _manifest() -> Manifest:
-    return Manifest.from_json_obj({
+def _manifest() -> ManifestIndex:
+    return ManifestIndex.from_json_obj({
         "bottles": {
             "dev": {
                 "env": {

tests/unit/test_backend_workspace.py

@@ -17,11 +17,11 @@ from bot_bottle import supervise
 from bot_bottle.backend import Bottle, BottleSpec, ExecResult
 from bot_bottle.backend.docker import DockerBottleBackend
 from bot_bottle.backend.smolmachines import SmolmachinesBottleBackend
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
-def _manifest() -> Manifest:
-    return Manifest.from_json_obj({
+def _manifest() -> ManifestIndex:
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": {}},
         "agents": {
             "demo": {

tests/unit/test_cli_commit.py

@@ -5,11 +5,12 @@ from __future__ import annotations
 import tempfile
 import unittest
 from pathlib import Path
-from unittest.mock import MagicMock, call, patch
+from unittest.mock import MagicMock, patch
 
-from bot_bottle.cli.commit import cmd_commit, _committed_image_tag, _agent_container_name
+from bot_bottle.cli.commit import cmd_commit
 from bot_bottle import supervise
 from bot_bottle import bottle_state
+from bot_bottle.backend.freeze import CommitCancelled
 
 
 class _FakeHomeMixin:
@@ -28,22 +29,8 @@ class _FakeHomeMixin:
         self._tmp.cleanup()
 
 
-class TestCommitHelpers(unittest.TestCase):
-    def test_committed_image_tag(self):
-        self.assertEqual(
-            "bot-bottle-committed-dev-abc12:latest",
-            _committed_image_tag("dev-abc12"),
-        )
-
-    def test_agent_container_name(self):
-        self.assertEqual(
-            "bot-bottle-dev-abc12",
-            _agent_container_name("dev-abc12"),
-        )
-
-
 class TestCmdCommitSlugArg(_FakeHomeMixin, unittest.TestCase):
-    """cmd_commit with an explicit slug bypasses the TUI picker."""
+    """cmd_commit with an explicit slug delegates to get_freezer."""
 
     def setUp(self):
         self._setup_fake_home()
@@ -51,110 +38,74 @@ class TestCmdCommitSlugArg(_FakeHomeMixin, unittest.TestCase):
     def tearDown(self):
         self._teardown_fake_home()
 
+    def _write_meta(self, slug: str, backend: str) -> None:
+        bottle_state.write_metadata(bottle_state.BottleMetadata(
+            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
+            started_at="t", backend=backend,
+        ))
+
     def test_commits_docker_bottle(self):
         slug = "dev-abc12"
-        # Write metadata saying this is a docker bottle.
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="docker",
-        ))
+        self._write_meta(slug, "docker")
 
-        with patch(
-            "bot_bottle.cli.commit.commit_container",
-        ) as mock_commit, patch(
-            "bot_bottle.cli.commit.info",
-        ):
+        with patch("bot_bottle.cli.commit.get_freezer") as mock_gf:
+            mock_freezer = MagicMock()
+            mock_gf.return_value = mock_freezer
             rc = cmd_commit([slug])
 
         self.assertEqual(0, rc)
-        mock_commit.assert_called_once_with(
-            f"bot-bottle-{slug}",
-            f"bot-bottle-committed-{slug}:latest",
-        )
+        mock_gf.assert_called_once_with("docker")
+        mock_freezer.commit_slug.assert_called_once_with(slug)
 
-    def test_writes_committed_image_to_state(self):
+    def test_empty_backend_passed_to_get_freezer(self):
+        """Old state dirs without a backend field pass '' to get_freezer."""
         slug = "dev-abc12"
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="docker",
-        ))
+        self._write_meta(slug, "")
 
-        with patch("bot_bottle.cli.commit.commit_container"), \
-             patch("bot_bottle.cli.commit.info"):
-            cmd_commit([slug])
-
-        self.assertEqual(
-            f"bot-bottle-committed-{slug}:latest",
-            bottle_state.read_committed_image(slug),
-        )
-
-    def test_marks_bottle_preserved(self):
-        slug = "dev-abc12"
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="docker",
-        ))
-
-        with patch("bot_bottle.cli.commit.commit_container"), \
-             patch("bot_bottle.cli.commit.info"):
-            cmd_commit([slug])
-
-        self.assertTrue(bottle_state.is_preserved(slug))
-
-    def test_empty_backend_treated_as_docker(self):
-        """Old state dirs without a backend field should be treated as docker."""
-        slug = "dev-abc12"
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="",
-        ))
-
-        with patch("bot_bottle.cli.commit.commit_container") as mock_commit, \
-             patch("bot_bottle.cli.commit.info"):
+        with patch("bot_bottle.cli.commit.get_freezer") as mock_gf:
+            mock_freezer = MagicMock()
+            mock_gf.return_value = mock_freezer
             rc = cmd_commit([slug])
 
         self.assertEqual(0, rc)
-        mock_commit.assert_called_once()
+        mock_gf.assert_called_once_with("")
 
-
-class TestCmdCommitNonDockerBackend(_FakeHomeMixin, unittest.TestCase):
-    def setUp(self):
-        self._setup_fake_home()
-
-    def tearDown(self):
-        self._teardown_fake_home()
-
-    def test_dies_for_smolmachines_backend(self):
+    def test_commits_macos_container_bottle(self):
         slug = "dev-abc12"
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="smolmachines",
-        ))
+        self._write_meta(slug, "macos-container")
 
-        with patch(
-            "bot_bottle.cli.commit.die", side_effect=SystemExit("die"),
-        ) as mock_die:
-            with self.assertRaises(SystemExit):
-                cmd_commit([slug])
+        with patch("bot_bottle.cli.commit.get_freezer") as mock_gf:
+            mock_freezer = MagicMock()
+            mock_gf.return_value = mock_freezer
+            rc = cmd_commit([slug])
 
-        mock_die.assert_called_once()
-        self.assertIn("smolmachines", mock_die.call_args.args[0])
+        self.assertEqual(0, rc)
+        mock_gf.assert_called_once_with("macos-container")
+        mock_freezer.commit_slug.assert_called_once_with(slug)
 
-    def test_dies_for_macos_container_backend(self):
+    def test_commits_smolmachines_bottle(self):
         slug = "dev-abc12"
-        bottle_state.write_metadata(bottle_state.BottleMetadata(
-            identity=slug, agent_name="dev", cwd="", copy_cwd=False,
-            started_at="t", backend="macos-container",
-        ))
+        self._write_meta(slug, "smolmachines")
 
-        with patch(
-            "bot_bottle.cli.commit.die", side_effect=SystemExit("die"),
-        ) as mock_die:
-            with self.assertRaises(SystemExit):
-                cmd_commit([slug])
+        with patch("bot_bottle.cli.commit.get_freezer") as mock_gf:
+            mock_freezer = MagicMock()
+            mock_gf.return_value = mock_freezer
+            rc = cmd_commit([slug])
 
-        mock_die.assert_called_once()
-        self.assertIn("macos-container", mock_die.call_args.args[0])
+        self.assertEqual(0, rc)
+        mock_gf.assert_called_once_with("smolmachines")
+
+    def test_returns_zero_on_commit_cancelled(self):
+        slug = "dev-abc12"
+        self._write_meta(slug, "macos-container")
+
+        with patch("bot_bottle.cli.commit.get_freezer") as mock_gf:
+            mock_freezer = MagicMock()
+            mock_freezer.commit_slug.side_effect = CommitCancelled
+            mock_gf.return_value = mock_freezer
+            rc = cmd_commit([slug])
+
+        self.assertEqual(0, rc)
 
 
 class TestCmdCommitNoActiveBottles(_FakeHomeMixin, unittest.TestCase):

tests/unit/test_cli_start_selector.py

@@ -20,6 +20,7 @@ from bot_bottle.backend import ActiveAgent
 def _make_manifest(agent_names: list[str]):
     manifest = MagicMock()
     manifest.agents = {name: MagicMock() for name in agent_names}
+    manifest.all_agent_names = sorted(agent_names)
     return manifest
 
 
@@ -30,7 +31,7 @@ class TestCmdStartSelector(unittest.TestCase):
         # Stub Manifest.resolve so no on-disk manifest is needed.
         self._manifest = _make_manifest(["researcher", "implementer"])
         self._resolve_patch = patch(
-            "bot_bottle.cli.start.Manifest.resolve",
+            "bot_bottle.cli.start.ManifestIndex.resolve",
             return_value=self._manifest,
         )
         self._resolve_patch.start()
@@ -149,7 +150,7 @@ class TestCmdStartLabelCollision(unittest.TestCase):
 
     def setUp(self):
         self._manifest = _make_manifest(["researcher"])
-        patch("bot_bottle.cli.start.Manifest.resolve", return_value=self._manifest).start()
+        patch("bot_bottle.cli.start.ManifestIndex.resolve", return_value=self._manifest).start()
         self._launch_mock = patch(
             "bot_bottle.cli.start._launch_bottle", return_value=0,
         ).start()

tests/unit/test_compose.py

@@ -31,7 +31,7 @@ from bot_bottle.egress import (
     EgressRoute,
 )
 from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from bot_bottle.supervise import SupervisePlan
 
 
@@ -40,7 +40,7 @@ STAGE = Path("/tmp/cb-stage")
 STATE = Path("/tmp/cb-state")
 
 
-def _manifest(*, supervise: bool, with_git: bool, with_egress: bool) -> Manifest:
+def _manifest(*, supervise: bool, with_git: bool, with_egress: bool) -> ManifestIndex:
     """Minimal manifest with the toggles the chunk-1 matrix needs.
     The renderer only reads from the plan, not the manifest, so this
     is just here to back BottleSpec."""
@@ -61,22 +61,12 @@ def _manifest(*, supervise: bool, with_git: bool, with_egress: bool) -> Manifest
                 "auth": {"scheme": "Bearer", "token_ref": "TOK"},
             }],
         }
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     })
 
 
-def _spec(*, supervise: bool, with_git: bool, with_egress: bool) -> BottleSpec:
-    return BottleSpec(
-        manifest=_manifest(
-            supervise=supervise, with_git=with_git, with_egress=with_egress,
-        ),
-        agent_name="demo",
-        copy_cwd=False,
-        user_cwd="/tmp/x",
-    )
-
 
 def _git_gate_plan(upstreams: tuple[GitGateUpstream, ...] = ()) -> GitGatePlan:
     return GitGatePlan(
@@ -146,9 +136,16 @@ def _plan(
             roles=(),
         ),)
 
-    spec = _spec(supervise=supervise, with_git=with_git, with_egress=with_egress)
+    index = _manifest(supervise=supervise, with_git=with_git, with_egress=with_egress)
+    spec = BottleSpec(
+        manifest=index,
+        agent_name="demo",
+        copy_cwd=False,
+        user_cwd="/tmp/x",
+    )
     return DockerBottlePlan(
         spec=spec,
+        manifest=index.load_for_agent("demo"),
         stage_dir=STAGE,
         slug=SLUG,
         forwarded_env={"CLAUDE_CODE_OAUTH_TOKEN": "x"},
@@ -395,7 +392,7 @@ class TestSidecarBundleShape(unittest.TestCase):
             "services"]["sidecars"]
         targets = {v["target"] for v in sc["volumes"]}
         self.assertIn("/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem", targets)
-        self.assertIn("/etc/egress/routes.yaml", targets)
+        self.assertIn("/etc/egress", targets)
         self.assertIn("/git-gate-entrypoint.sh", targets)
         self.assertIn("/git-gate/creds/upstream-known_hosts", targets)
         self.assertTrue(any("supervise/queue" in t or t.startswith("/run/supervise")

tests/unit/test_contrib_claude_provider.py

@@ -24,7 +24,7 @@ from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.contrib.claude.agent_provider import ClaudeAgentProvider
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from bot_bottle.supervise import SupervisePlan
 
 
@@ -55,7 +55,7 @@ def _plan(
     bottle_json: dict = {"agent_provider": {"template": "claude"}}  # type: ignore
     if supervise:
         bottle_json["supervise"] = True
-    manifest = Manifest.from_json_obj({
+    index = ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle_json},
         "agents": {
             "demo": {
@@ -65,8 +65,9 @@ def _plan(
             },
         },
     })
+    manifest = index.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest, agent_name="demo",
+        manifest=index, agent_name="demo",
         copy_cwd=False, user_cwd="/tmp/x",
     )
     supervise_plan = None
@@ -78,6 +79,7 @@ def _plan(
         )
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=Path("/tmp/stage"),
         slug="demo-abc12",
         forwarded_env={},

tests/unit/test_contrib_codex_provider.py

@@ -24,7 +24,7 @@ from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.contrib.codex.agent_provider import CodexAgentProvider
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from bot_bottle.supervise import SupervisePlan
 
 
@@ -55,7 +55,7 @@ def _plan(
     bottle_json: dict = {"agent_provider": {"template": "codex"}}  # type: ignore
     if supervise:
         bottle_json["supervise"] = True
-    manifest = Manifest.from_json_obj({
+    index = ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle_json},
         "agents": {
             "demo": {
@@ -65,8 +65,9 @@ def _plan(
             },
         },
     })
+    manifest = index.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest, agent_name="demo",
+        manifest=index, agent_name="demo",
         copy_cwd=False, user_cwd="/tmp/x",
     )
     supervise_plan = None
@@ -78,6 +79,7 @@ def _plan(
         )
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=Path("/tmp/stage"),
         slug="demo-abc12",
         forwarded_env={},
@@ -290,10 +292,10 @@ class TestCodexSuperviseMcp(unittest.TestCase):
         bottle.exec.assert_called_once()
         script = bottle.exec.call_args.args[0]
         self.assertEqual("node", bottle.exec.call_args.kwargs.get("user"))
-        self.assertIn("codex mcp add", script)
-        self.assertIn("--transport http", script)
-        self.assertIn("supervise", script)
-        self.assertIn(_URL, script)
+        self.assertEqual(
+            f"codex mcp add supervise --url {_URL}",
+            script,
+        )
 
     def test_logs_warning_on_failure_but_does_not_raise(self):
         bottle = _make_bottle(

tests/unit/test_contrib_pi_provider.py

@@ -16,7 +16,7 @@ from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.contrib.pi.agent_provider import PiAgentProvider
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
 _URL = "http://supervise:9100/"
@@ -43,7 +43,7 @@ def _plan(
     skills: list[str] | None = None,
     agent_provision: AgentProvisionPlan | None = None,
 ) -> DockerBottlePlan:
-    manifest = Manifest.from_json_obj({
+    index = ManifestIndex.from_json_obj({
         "bottles": {"dev": {"agent_provider": {"template": "pi"}}},
         "agents": {
             "demo": {
@@ -53,12 +53,14 @@ def _plan(
             },
         },
     })
+    manifest = index.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest, agent_name="demo",
+        manifest=index, agent_name="demo",
         copy_cwd=False, user_cwd="/tmp/x",
     )
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=Path("/tmp/stage"),
         slug="demo-abc12",
         forwarded_env={},

tests/unit/test_docker_launch_committed_image.py

@@ -7,6 +7,7 @@ import io
 import tempfile
 import unittest
 from pathlib import Path
+from typing import Any
 from unittest import mock
 
 from bot_bottle.agent_provider import AgentProvisionPlan
@@ -15,25 +16,23 @@ from bot_bottle.backend.docker import launch as launch_mod
 from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
 _SLUG = "dev-abc12"
 _COMMITTED_TAG = f"bot-bottle-committed-{_SLUG}:latest"
 _DEFAULT_IMAGE = "bot-bottle-claude:latest"
 
-
-def _manifest() -> Manifest:
-    return Manifest.from_json_obj({
-        "bottles": {"dev": {}},
-        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-    })
+_IDX = ManifestIndex.from_json_obj({
+    "bottles": {"dev": {}},
+    "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+})
 
 
 def _plan(tmp: str) -> DockerBottlePlan:
     stage = Path(tmp)
     spec = BottleSpec(
-        manifest=_manifest(),
+        manifest=_IDX,
         agent_name="demo",
         copy_cwd=False,
         user_cwd=tmp,
@@ -41,6 +40,7 @@ def _plan(tmp: str) -> DockerBottlePlan:
     )
     return DockerBottlePlan(
         spec=spec,
+        manifest=_IDX.load_for_agent("demo"),
         stage_dir=stage,
         git_gate_plan=GitGatePlan(
             slug=_SLUG,
@@ -73,36 +73,28 @@ def _plan(tmp: str) -> DockerBottlePlan:
     )
 
 
-def _std_mocks(test, plan):
-    """Context manager providing the standard launch-step mocks needed to
-    get through the non-image parts of `launch()` without real Docker."""
-    return mock.patch.multiple(
-        launch_mod,
-        egress_tls_init=mock.DEFAULT,
-        network_mod=mock.DEFAULT,
-        bottle_plan_to_compose=mock.DEFAULT,
-        write_compose_file=mock.DEFAULT,
-        compose_up=mock.DEFAULT,
-        compose_dump_logs=mock.DEFAULT,
-        compose_down=mock.DEFAULT,
-    )
-
-
 class TestLaunchCommittedImage(unittest.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         self._tmp = tempfile.mkdtemp(prefix="launch-committed-test.")
 
-    def tearDown(self):
+    def tearDown(self) -> None:
         import shutil
         shutil.rmtree(self._tmp, ignore_errors=True)
 
-    def _run_launch(self, plan, *, committed_tag=None, image_present=True):
+    def _run_launch(
+        self,
+        plan: DockerBottlePlan,
+        *,
+        committed_tag: str | None = None,
+        image_present: bool = True,
+    ) -> list[str]:
         """Drive launch() through its full sequence with the committed-image
         behaviour controlled by the arguments. Returns the images that were
         passed to `build_image` (empty list if it was never called)."""
-        built = []
+        built: list[str] = []
 
-        def fake_build(image, ctx, *, dockerfile=""):
+        def fake_build(image: str, ctx: str, *, dockerfile: str = "") -> None:
+            del ctx, dockerfile
             built.append(image)
 
         with mock.patch.object(
@@ -136,19 +128,19 @@ class TestLaunchCommittedImage(unittest.TestCase):
 
         return built
 
-    def test_skips_build_when_committed_image_present(self):
+    def test_skips_build_when_committed_image_present(self) -> None:
         plan = _plan(self._tmp)
         built = self._run_launch(plan, committed_tag=_COMMITTED_TAG, image_present=True)
         self.assertEqual([], built, "build_image should not be called when committed image exists")
 
-    def test_uses_committed_image_in_compose_spec(self):
+    def test_uses_committed_image_in_compose_spec(self) -> None:
         """The compose spec renderer receives the committed image tag via
         plan.image — captured here by checking what bottle_plan_to_compose
         was called with."""
         plan = _plan(self._tmp)
-        captured_plans = []
+        captured_plans: list[DockerBottlePlan] = []
 
-        def fake_compose(p):
+        def fake_compose(p: DockerBottlePlan) -> dict[str, Any]:
             captured_plans.append(p)
             return {"services": {"agent": {}}}
 
@@ -183,12 +175,12 @@ class TestLaunchCommittedImage(unittest.TestCase):
         self.assertEqual(1, len(captured_plans))
         self.assertEqual(_COMMITTED_TAG, captured_plans[0].image)
 
-    def test_falls_back_to_build_when_no_committed_image(self):
+    def test_falls_back_to_build_when_no_committed_image(self) -> None:
         plan = _plan(self._tmp)
         built = self._run_launch(plan, committed_tag=None)
         self.assertEqual([_DEFAULT_IMAGE], built)
 
-    def test_falls_back_to_build_when_committed_image_missing_from_daemon(self):
+    def test_falls_back_to_build_when_committed_image_missing_from_daemon(self) -> None:
         plan = _plan(self._tmp)
         built = self._run_launch(
             plan, committed_tag=_COMMITTED_TAG, image_present=False,

tests/unit/test_docker_launch_teardown.py

@@ -21,21 +21,19 @@ from bot_bottle.backend.docker import launch as launch_mod
 from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
-
-def _manifest() -> Manifest:
-    return Manifest.from_json_obj({
-        "bottles": {"dev": {}},
-        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-    })
+_INDEX = ManifestIndex.from_json_obj({
+    "bottles": {"dev": {}},
+    "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+})
 
 
 def _plan(tmp: str) -> DockerBottlePlan:
     stage = Path(tmp)
-    manifest = _manifest()
+    manifest = _INDEX.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest,
+        manifest=_INDEX,
         agent_name="demo",
         copy_cwd=False,
         user_cwd=tmp,
@@ -43,6 +41,7 @@ def _plan(tmp: str) -> DockerBottlePlan:
     )
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage,
         git_gate_plan=GitGatePlan(
             slug="test-teardown-00001",

tests/unit/test_docker_provision_git_user.py

@@ -21,7 +21,7 @@ from bot_bottle.backend import Bottle, BottleSpec, ExecResult
 from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 
 
 class _Provider(AgentProvider):
@@ -51,16 +51,18 @@ def _plan(*, git_user: dict | None = None,  # type: ignore
     bottle_json: dict = {}  # type: ignore
     if git_user is not None:
         bottle_json["git-gate"] = {"user": git_user}
-    manifest = Manifest.from_json_obj({
+    index = ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle_json},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     })
+    manifest = index.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest, agent_name="demo",
+        manifest=index, agent_name="demo",
         copy_cwd=copy_cwd, user_cwd=user_cwd,
     )
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage_dir or Path("/tmp/stage"),
         slug="demo-abc12",
         forwarded_env={},

tests/unit/test_egress.py

@@ -13,12 +13,12 @@ from bot_bottle.egress import (
     egress_token_env_map,
 )
 from bot_bottle.log import Die
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from bot_bottle.yaml_subset import parse_yaml_subset
 
 
 def _bottle(routes):  # type: ignore
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": {"egress": {"routes": routes}}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     }).bottles["dev"]
@@ -362,9 +362,9 @@ class TestRenderRoutes(unittest.TestCase):
         self.assertEqual("x.example", cfg.routes[0].host)
 
     def test_log_via_manifest_flows_to_render(self):
-        from bot_bottle.manifest import Manifest
+        from bot_bottle.manifest import ManifestIndex
         from bot_bottle.egress_addon_core import load_config, LOG_BLOCKS
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"egress": {
                 "log": 1,
                 "routes": [{"host": "x.example"}],

tests/unit/test_egress_apply.py

@@ -2,12 +2,15 @@
 add_route removed; docker exec / cp / kill paths are covered by the
 integration test)."""
 
+import tempfile
 import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
 
-from bot_bottle.backend.docker.egress_apply import (
-    EgressApplyError,
-    validate_routes_content,
-)
+from bot_bottle import supervise
+from bot_bottle.backend.egress_apply import EgressApplyError
+from bot_bottle.backend.docker.egress_apply import applicator
 
 
 _ROUTES_EMPTY = "routes: []\n"
@@ -16,11 +19,11 @@ _ROUTES_ONE = 'routes:\n  - host: "api.anthropic.com"\n'
 
 class TestValidateRoutesContent(unittest.TestCase):
     def test_accepts_minimal_route_table(self):
-        validate_routes_content(_ROUTES_EMPTY)
-        validate_routes_content(_ROUTES_ONE)
+        applicator.validate_routes_content(_ROUTES_EMPTY)
+        applicator.validate_routes_content(_ROUTES_ONE)
 
     def test_accepts_full_route_with_matches(self):
-        validate_routes_content(
+        applicator.validate_routes_content(
             'routes:\n'
             '  - host: "api.github.com"\n'
             '    auth_scheme: "Bearer"\n'
@@ -32,25 +35,65 @@ class TestValidateRoutesContent(unittest.TestCase):
 
     def test_rejects_bad_yaml(self):
         with self.assertRaises(EgressApplyError) as cm:
-            validate_routes_content("routes:\n\t- host: x\n")
+            applicator.validate_routes_content("routes:\n\t- host: x\n")
         self.assertIn("not valid", str(cm.exception))
 
     def test_rejects_missing_routes_key(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content("other: []\n")
+            applicator.validate_routes_content("other: []\n")
 
     def test_rejects_non_list_routes(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content('routes: "not a list"\n')
+            applicator.validate_routes_content('routes: "not a list"\n')
 
     def test_rejects_partial_auth_pair(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content(
+            applicator.validate_routes_content(
                 'routes:\n'
                 '  - host: "x.example"\n'
                 '    auth_scheme: "Bearer"\n'
             )
 
 
+class TestApplyRoutesChange(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="egress-apply-test.")
+        original = supervise.bot_bottle_root
+
+        def fake_root() -> Path:
+            return Path(self._tmp.name) / ".bot-bottle"
+
+        supervise.bot_bottle_root = fake_root  # type: ignore[assignment]
+        self.addCleanup(lambda: setattr(supervise, "bot_bottle_root", original))
+        self.addCleanup(self._tmp.cleanup)
+
+    def test_writes_live_routes_and_signals_reload(self):
+        calls: list[list[str]] = []
+
+        def fake_run(argv: list[str], **kwargs: object) -> SimpleNamespace:
+            calls.append(list(argv))
+            return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+        with patch(
+            "bot_bottle.backend.docker.egress_apply.subprocess.run",
+            side_effect=fake_run,
+        ):
+            before, after = applicator.apply_routes_change(
+                "dev",
+                "routes:\n  - host: google.com\n",
+            )
+
+        self.assertEqual("", before)
+        self.assertEqual("routes:\n  - host: google.com\n", after)
+        self.assertEqual(
+            "routes:\n  - host: google.com\n",
+            (Path(self._tmp.name) / ".bot-bottle/state/dev/egress/routes.yaml").read_text(encoding="utf-8"),
+        )
+        self.assertEqual(
+            ["docker", "kill", "--signal", "HUP", "bot-bottle-sidecars-dev"],
+            calls[0],
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_git_gate.py

@@ -15,7 +15,7 @@ from bot_bottle.git_gate import (
     git_gate_render_hook,
     git_gate_upstreams_for_bottle,
 )
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from tests.fixtures import fixture_minimal, fixture_with_git
 
 
@@ -280,7 +280,7 @@ class TestPrepare(unittest.TestCase):
         self.assertEqual(0o600, os.stat(upstream.known_hosts_file).st_mode & 0o777)
 
     def test_prepare_skips_known_hosts_file_when_key_missing(self):
-        manifest = Manifest.from_json_obj({
+        manifest = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"git-gate": {"repos": {
                 "foo": {
                     "url": "ssh://git@github.com/didericis/foo.git",

tests/unit/test_macos_container_bottle.py

@@ -2,26 +2,32 @@
 
 from __future__ import annotations
 
+import sys
 import unittest
 from unittest.mock import patch
 
-from bot_bottle.backend.macos_container.bottle import MacosContainerBottle
+from bot_bottle.backend.macos_container import bottle as bottle_mod
+from bot_bottle.backend.macos_container.bottle import MacosContainerBottle, _PTY_FORWARD_SCRIPT
 
 
 class TestMacosContainerBottle(unittest.TestCase):
-    def test_agent_argv_uses_container_exec(self):
+    def test_agent_argv_uses_pty_forward_and_container_exec(self):
         bottle = MacosContainerBottle(
             "bot-bottle-dev-abc",
             lambda: None,
             None,
             agent_command="codex",
         )
+        with patch.dict(bottle_mod.os.environ, {}, clear=True):
+            argv = bottle.agent_argv(["run"])
         self.assertEqual(
             [
+                sys.executable, _PTY_FORWARD_SCRIPT, "--",
                 "container", "exec", "--interactive", "--tty",
+                "--env", "TERM",
                 "bot-bottle-dev-abc", "codex", "run",
             ],
-            bottle.agent_argv(["run"]),
+            argv,
         )
 
     def test_agent_argv_includes_workdir(self):
@@ -31,15 +37,54 @@ class TestMacosContainerBottle(unittest.TestCase):
             None,
             agent_workdir="/home/node/workspace",
         )
+        with patch.dict(bottle_mod.os.environ, {}, clear=True):
+            argv = bottle.agent_argv([])
         self.assertEqual(
             [
+                sys.executable, _PTY_FORWARD_SCRIPT, "--",
                 "container", "exec", "--interactive", "--tty",
+                "--env", "TERM",
                 "--workdir", "/home/node/workspace",
                 "bot-bottle-dev-abc", "claude",
             ],
-            bottle.agent_argv([]),
+            argv,
         )
 
+    def test_agent_argv_forwards_terminal_env_names_without_values(self):
+        bottle = MacosContainerBottle("bot-bottle-dev-abc", lambda: None, None)
+        with patch.dict(
+            bottle_mod.os.environ,
+            {
+                "TERM": "screen-256color",
+                "TERM_PROGRAM": "WezTerm",
+                "WEZTERM_PANE": "pane-id",
+                "SHELL": "/bin/zsh",
+            },
+            clear=True,
+        ):
+            argv = bottle.agent_argv([])
+        self.assertIn("TERM", argv)
+        self.assertIn("TERM_PROGRAM", argv)
+        self.assertIn("WEZTERM_PANE", argv)
+        self.assertNotIn("SHELL", argv)
+        self.assertNotIn("TERM=screen-256color", argv)
+        self.assertNotIn("TERM_PROGRAM=WezTerm", argv)
+        self.assertNotIn("WEZTERM_PANE=pane-id", argv)
+
+    def test_agent_argv_always_forwards_term_name(self):
+        bottle = MacosContainerBottle("bot-bottle-dev-abc", lambda: None, None)
+        with patch.dict(bottle_mod.os.environ, {}, clear=True):
+            argv = bottle.agent_argv([])
+        self.assertIn("TERM", argv)
+
+    def test_agent_argv_no_tty_omits_wrapper_and_tty_flags(self):
+        bottle = MacosContainerBottle("bot-bottle-dev-abc", lambda: None, None)
+        argv = bottle.agent_argv([], tty=False)
+        self.assertNotIn("--tty", argv)
+        self.assertNotIn("--env", argv)
+        self.assertNotIn(_PTY_FORWARD_SCRIPT, argv)
+        self.assertEqual(["container", "exec", "bot-bottle-dev-abc", "claude"], argv)
+
     def test_exec_pipes_script_to_shell(self):
         bottle = MacosContainerBottle("bot-bottle-dev-abc", lambda: None, None)
         with patch("bot_bottle.backend.macos_container.bottle.subprocess.run") as run:

tests/unit/test_macos_container_launch.py

@@ -9,8 +9,18 @@ from types import SimpleNamespace
 from typing import cast
 from unittest.mock import patch
 
+from bot_bottle.agent_provider import AgentProvisionPlan
+from bot_bottle.backend import BottleSpec
 from bot_bottle.backend.macos_container import launch
 from bot_bottle.backend.macos_container.bottle_plan import MacosContainerBottlePlan
+from bot_bottle.egress import EgressPlan
+from bot_bottle.git_gate import GitGatePlan
+from bot_bottle.manifest import ManifestIndex
+
+_MANIFEST = ManifestIndex.from_json_obj({
+    "bottles": {"dev": {}},
+    "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+}).load_for_agent("demo")
 
 
 def _plan(
@@ -21,7 +31,7 @@ def _plan(
     agent_git_gate_url: str = "",
     agent_supervise_url: str = "",
 ) -> MacosContainerBottlePlan:
-    routes_path = stage_dir / "source-routes.yaml"
+    routes_path = stage_dir / "routes.yaml"
     routes_path.write_text("routes: []\n", encoding="utf-8")
     ca_dir = stage_dir / "egress-ca"
     ca_dir.mkdir(exist_ok=True)
@@ -67,6 +77,7 @@ def _plan(
     )
     return cast(MacosContainerBottlePlan, SimpleNamespace(
         spec=SimpleNamespace(),
+        manifest=_MANIFEST,
         stage_dir=stage_dir,
         slug="dev-abc",
         container_name="bot-bottle-dev-abc",
@@ -118,15 +129,10 @@ class TestMacosContainerLaunchArgv(unittest.TestCase):
             f"type=bind,source={self.stage_dir / 'egress-ca'},target=/home/mitmproxy/.mitmproxy",
             argv,
         )
-        routes_dir = self.stage_dir / "macos-container-egress"
         self.assertIn(
-            f"type=bind,source={routes_dir},target=/etc/egress,readonly",
+            f"type=bind,source={self.stage_dir},target=/etc/egress,readonly",
             argv,
         )
-        self.assertEqual(
-            "routes: []\n",
-            (routes_dir / "routes.yaml").read_text(encoding="utf-8"),
-        )
         self.assertIn(
             "type=bind,source=/state/supervise/queue,target=/run/supervise/queue",
             argv,
@@ -193,6 +199,7 @@ class TestMacosContainerLaunchArgv(unittest.TestCase):
         )
         plan = MacosContainerBottlePlan(
             spec=base.spec,
+            manifest=base.manifest,
             stage_dir=base.stage_dir,
             git_gate_plan=base.git_gate_plan,
             egress_plan=base.egress_plan,
@@ -258,5 +265,80 @@ class TestMacosContainerLaunchArgv(unittest.TestCase):
         )
 
 
+def _build_plan(stage_dir: Path) -> MacosContainerBottlePlan:
+    return MacosContainerBottlePlan(
+        spec=cast(BottleSpec, SimpleNamespace()),
+        manifest=_MANIFEST,
+        stage_dir=stage_dir,
+        git_gate_plan=cast(GitGatePlan, SimpleNamespace(upstreams=())),
+        egress_plan=cast(EgressPlan, SimpleNamespace()),
+        supervise_plan=None,
+        agent_provision=AgentProvisionPlan(
+            template="claude",
+            command="claude",
+            prompt_mode="append_file",
+            image="bot-bottle-agent:latest",
+            dockerfile="/repo/Dockerfile",
+            guest_home="/home/node",
+            instance_name="bot-bottle-dev-abc",
+            prompt_file=stage_dir / "prompt.txt",
+            guest_env={},
+        ),
+        slug="dev-abc",
+        forwarded_env={},
+    )
+
+
+class TestMacosContainerLaunchCommittedImage(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.stage_dir = Path(self._tmp.name)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_build_images_uses_committed_image_when_present(self):
+        plan = _build_plan(self.stage_dir)
+        calls = []
+
+        def fake_build(image: str, context: str, *, dockerfile: str = "") -> None:
+            calls.append((image, context, dockerfile))
+
+        with patch.object(
+            launch, "read_committed_image",
+            return_value="bot-bottle-committed-dev-abc:latest",
+        ), patch.object(
+            launch.container_mod, "image_exists", return_value=True,
+        ), patch.object(
+            launch.container_mod, "build_image", side_effect=fake_build,
+        ), patch.object(launch, "info"):
+            updated = launch._build_images(plan)
+
+        self.assertEqual("bot-bottle-committed-dev-abc:latest", updated.image)
+        self.assertEqual(1, len(calls))
+        self.assertEqual(launch.SIDECAR_BUNDLE_IMAGE, calls[0][0])
+
+    def test_build_images_builds_agent_when_committed_image_missing(self):
+        plan = _build_plan(self.stage_dir)
+        calls = []
+
+        def fake_build(image: str, context: str, *, dockerfile: str = "") -> None:
+            calls.append((image, context, dockerfile))
+
+        with patch.object(
+            launch, "read_committed_image",
+            return_value="bot-bottle-committed-dev-abc:latest",
+        ), patch.object(
+            launch.container_mod, "image_exists", return_value=False,
+        ), patch.object(
+            launch.container_mod, "build_image", side_effect=fake_build,
+        ):
+            updated = launch._build_images(plan)
+
+        self.assertEqual("bot-bottle-agent:latest", updated.image)
+        self.assertEqual(2, len(calls))
+        self.assertEqual("bot-bottle-agent:latest", calls[1][0])
+
+
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_macos_container_pty_forward.py

@@ -0,0 +1,159 @@
+"""Unit: macos-container pty_forward raw-mode wrapper (issue #245).
+
+Tests argument parsing, non-TTY fallback, and the raw-mode
+setup/restore sequence without requiring a real terminal.
+"""
+
+from __future__ import annotations
+
+import io
+import termios
+import unittest
+from unittest.mock import ANY, MagicMock, patch
+
+from bot_bottle.backend.macos_container import pty_forward
+
+
+def _fake_stdin(fd: int = 0) -> MagicMock:
+    """Return a mock stdin whose fileno() returns *fd*."""
+    m = MagicMock()
+    m.fileno.return_value = fd
+    return m
+
+
+class TestArgvParsing(unittest.TestCase):
+    def test_missing_separator_returns_error_exit_code(self):
+        with patch.object(pty_forward.sys, "stderr", new=io.StringIO()) as err:
+            rc = pty_forward.main(["container", "exec"])
+        self.assertEqual(2, rc)
+        self.assertIn("usage:", err.getvalue())
+
+    def test_too_few_args_returns_error_exit_code(self):
+        with patch.object(pty_forward.sys, "stderr", new=io.StringIO()):
+            self.assertEqual(2, pty_forward.main([]))
+            self.assertEqual(2, pty_forward.main(["--"]))
+
+    def test_separator_at_start_with_inner_is_valid(self):
+        with (
+            patch.object(pty_forward.sys, "stdin", _fake_stdin()),
+            patch.object(pty_forward.os, "isatty", return_value=False),
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 0
+            rc = pty_forward.main(["--", "container", "exec"])
+        self.assertEqual(0, rc)
+        run.assert_called_once()
+        self.assertEqual(["container", "exec"], run.call_args.args[0])
+        self.assertFalse(run.call_args.kwargs["check"])
+
+
+class TestNonTtyFallback(unittest.TestCase):
+    def test_non_tty_stdin_runs_inner_directly(self):
+        with (
+            patch.object(pty_forward.sys, "stdin", _fake_stdin()),
+            patch.object(pty_forward.os, "isatty", return_value=False),
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 42
+            rc = pty_forward.main(
+                ["--", "container", "exec", "--interactive", "--tty", "c", "claude"]
+            )
+        self.assertEqual(42, rc)
+        run.assert_called_once()
+        self.assertEqual(
+            ["container", "exec", "--interactive", "--tty", "c", "claude"],
+            run.call_args.args[0],
+        )
+        self.assertFalse(run.call_args.kwargs["check"])
+
+    def test_fileno_error_runs_inner_directly(self):
+        bad_stdin = MagicMock()
+        bad_stdin.fileno.side_effect = OSError("pseudofile")
+        with (
+            patch.object(pty_forward.sys, "stdin", bad_stdin),
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 0
+            rc = pty_forward.main(["--", "container", "exec"])
+        run.assert_called_once()
+        self.assertEqual(["container", "exec"], run.call_args.args[0])
+        self.assertFalse(run.call_args.kwargs["check"])
+        self.assertEqual(0, rc)
+
+
+class TestRawModeSetupAndRestore(unittest.TestCase):
+    def test_tty_stdin_sets_raw_mode_and_restores_on_exit(self):
+        saved_attrs = object()
+        with (
+            patch.object(pty_forward.sys, "stdin", _fake_stdin()),
+            patch.object(pty_forward.os, "isatty", return_value=True),
+            patch.object(pty_forward.termios, "tcgetattr", return_value=saved_attrs),
+            patch.object(pty_forward.tty, "setraw") as setraw,
+            patch.object(pty_forward.termios, "tcsetattr") as tcsetattr,
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 0
+            rc = pty_forward.main(["--", "container", "exec"])
+
+        self.assertEqual(0, rc)
+        setraw.assert_called_once()
+        tcsetattr.assert_called_once_with(
+            ANY, termios.TCSADRAIN, saved_attrs,
+        )
+
+    def test_tty_restores_on_subprocess_nonzero_exit(self):
+        saved_attrs = object()
+        with (
+            patch.object(pty_forward.sys, "stdin", _fake_stdin()),
+            patch.object(pty_forward.os, "isatty", return_value=True),
+            patch.object(pty_forward.termios, "tcgetattr", return_value=saved_attrs),
+            patch.object(pty_forward.tty, "setraw"),
+            patch.object(pty_forward.termios, "tcsetattr") as tcsetattr,
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 1
+            rc = pty_forward.main(["--", "container", "exec"])
+
+        self.assertEqual(1, rc)
+        tcsetattr.assert_called_once_with(
+            ANY, termios.TCSADRAIN, saved_attrs,
+        )
+
+    def test_tcgetattr_error_falls_back_to_bare_run(self):
+        with (
+            patch.object(pty_forward.sys, "stdin", _fake_stdin()),
+            patch.object(pty_forward.os, "isatty", return_value=True),
+            patch.object(
+                pty_forward.termios, "tcgetattr",
+                side_effect=termios.error("not a tty"),
+            ),
+            patch.object(pty_forward.tty, "setraw") as setraw,
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 0
+            rc = pty_forward.main(["--", "container", "exec"])
+
+        setraw.assert_not_called()
+        run.assert_called_once()
+        self.assertEqual(["container", "exec"], run.call_args.args[0])
+        self.assertFalse(run.call_args.kwargs["check"])
+        self.assertEqual(0, rc)
+
+    def test_inner_run_sets_term_default_without_mutating_process_env(self):
+        with (
+            patch.dict(pty_forward.os.environ, {}, clear=True),
+            patch.object(pty_forward.subprocess, "run") as run,
+        ):
+            run.return_value.returncode = 0
+            rc = pty_forward._run_inner(["container", "exec"])
+
+            self.assertNotIn("TERM", pty_forward.os.environ)
+
+        self.assertEqual(0, rc)
+        child_env = run.call_args.kwargs["env"]
+        self.assertEqual(["TERM"], sorted(child_env.keys()))
+        self.assertEqual("xterm-256color", child_env["TERM"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_macos_container_util.py

@@ -73,6 +73,53 @@ resolver #2
         )
         self.assertTrue(run.call_args_list[-1].kwargs["check"])
 
+    def test_commit_container_execs_tar_and_builds_image(self):
+        # stderr is bytes because subprocess.run uses stderr=PIPE without text=True
+        completed = util.subprocess.CompletedProcess(
+            args=[], returncode=0, stdout=b"", stderr=b"",
+        )
+        dockerfile_text = ""
+
+        def fake_build_image(image_tag: str, context: str, *, dockerfile: str = "") -> None:
+            nonlocal dockerfile_text
+            with open(dockerfile, encoding="utf-8") as f:
+                dockerfile_text = f.read()
+
+        with patch.object(util.subprocess, "run", return_value=completed) as run, \
+             patch.object(util, "build_image", side_effect=fake_build_image) as build_image, \
+             patch.object(util, "info"):
+            util.commit_container(
+                "bot-bottle-dev-abc12",
+                "bot-bottle-committed-dev-abc12:latest",
+            )
+
+        argv = run.call_args.args[0]
+        self.assertEqual("container", argv[0])
+        self.assertEqual("exec", argv[1])
+        self.assertIn("bot-bottle-dev-abc12", argv)
+        self.assertIn("tar", argv)
+        self.assertIn("--directory=/", argv)
+        build_image.assert_called_once()
+        self.assertEqual(
+            "bot-bottle-committed-dev-abc12:latest",
+            build_image.call_args.args[0],
+        )
+        self.assertIn("ADD rootfs.tar /\n", dockerfile_text)
+        self.assertIn("USER node\n", dockerfile_text)
+        self.assertIn("WORKDIR /home/node\n", dockerfile_text)
+
+    def test_commit_container_dies_on_exec_tar_failure(self):
+        failed = util.subprocess.CompletedProcess(
+            args=[], returncode=1, stdout=b"", stderr=b"No such container",
+        )
+        with patch.object(util.subprocess, "run", return_value=failed), \
+             patch.object(util, "die", side_effect=SystemExit("die")) as die:
+            with self.assertRaises(SystemExit):
+                util.commit_container("missing-container", "some:tag")
+
+        die.assert_called_once()
+        self.assertIn("missing-container", die.call_args.args[0])
+
     def test_build_image_restarts_builder_when_dns_mismatches(self):
         status = util.subprocess.CompletedProcess(
             args=[],

tests/unit/test_manifest_agent_git_user.py

@@ -1,14 +1,14 @@
 """Unit: agent-level git-gate.user overlay + provenance (PRD 0027, PRD 0047).
 
 An agent file may declare `git-gate.user` (name/email). At
-`Manifest.bottle_for()` it overlays the referenced bottle's
+`ManifestIndex.load_for_agent()` it overlays the referenced bottle's
 `git-gate.user` per-field, agent-wins-on-non-empty. `git-gate.repos` is
 rejected on agents. `Manifest.git_identity_summary()` reports the
 effective identity with per-field `(agent)`/`(bottle)` provenance.
 
-The `from_json_obj` path drives `Agent.from_dict` + `bottle_for`;
-a temp-dir case locks the md loader (the `_AGENT_KEYS` allow + the
-`git-gate` threading into `agent_dict`)."""
+The `from_json_obj` path drives `Agent.from_dict` + the overlay in
+load_for_agent; a temp-dir case locks the md loader (the `_AGENT_KEYS`
+allow + the `git-gate` threading into `agent_dict`)."""
 
 from __future__ import annotations
 
@@ -19,7 +19,7 @@ import textwrap
 import unittest
 from pathlib import Path
 
-from bot_bottle.manifest import ManifestError, Manifest
+from bot_bottle.manifest import ManifestError, Manifest, ManifestIndex
 
 
 def _error_message(callable_, *args, **kwargs) -> str:  # type: ignore
@@ -32,13 +32,28 @@ def _error_message(callable_, *args, **kwargs) -> str:  # type: ignore
 
 
 def _manifest(*, bottle_user=None, agent_git=None) -> Manifest:  # type: ignore
+    """Build an index with one agent 'impl' and load it, returning a Manifest."""
     bottle: dict = {}  # type: ignore
     if bottle_user is not None:
         bottle = {"git-gate": {"user": bottle_user}}
     agent: dict = {"skills": [], "prompt": "", "bottle": "dev"}  # type: ignore
     if agent_git is not None:
         agent["git-gate"] = agent_git
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
+        "bottles": {"dev": bottle},
+        "agents": {"impl": agent},
+    }).load_for_agent("impl")
+
+
+def _index(*, bottle_user: dict[str, object] | None = None, agent_git: dict[str, object] | None = None) -> ManifestIndex:
+    """Build an index with one agent 'impl' without loading it."""
+    bottle: dict = {}  # type: ignore
+    if bottle_user is not None:
+        bottle = {"git-gate": {"user": bottle_user}}
+    agent: dict = {"skills": [], "prompt": "", "bottle": "dev"}  # type: ignore
+    if agent_git is not None:
+        agent["git-gate"] = agent_git
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle},
         "agents": {"impl": agent},
     })
@@ -47,7 +62,7 @@ def _manifest(*, bottle_user=None, agent_git=None) -> Manifest:  # type: ignore
 class TestAgentGitUserOverlay(unittest.TestCase):
     def test_agent_supplies_both_fields(self):
         m = _manifest(agent_git={"user": {"name": "a", "email": "a@b"}})
-        u = m.bottle_for("impl").git_user
+        u = m.bottle.git_user
         self.assertEqual("a", u.name)
         self.assertEqual("a@b", u.email)
 
@@ -56,7 +71,7 @@ class TestAgentGitUserOverlay(unittest.TestCase):
             bottle_user={"name": "B", "email": "b@c"},
             agent_git={"user": {"name": "a"}},
         )
-        u = m.bottle_for("impl").git_user
+        u = m.bottle.git_user
         self.assertEqual("a", u.name)       # agent wins
         self.assertEqual("b@c", u.email)    # bottle falls through
 
@@ -65,34 +80,40 @@ class TestAgentGitUserOverlay(unittest.TestCase):
             bottle_user={"name": "B", "email": "b@c"},
             agent_git={"user": {"email": "a@b"}},
         )
-        u = m.bottle_for("impl").git_user
+        u = m.bottle.git_user
         self.assertEqual("B", u.name)
         self.assertEqual("a@b", u.email)
 
     def test_agent_identity_with_bottle_declaring_none(self):
-        m = _manifest(agent_git={"user": {"name": "a", "email": "a@b"}})
-        self.assertTrue(m.bottles["dev"].git_user.is_empty())
-        self.assertFalse(m.bottle_for("impl").git_user.is_empty())
+        idx = _index(agent_git={"user": {"name": "a", "email": "a@b"}})
+        # Raw bottle has no git_user; loaded manifest has merged git_user from agent
+        self.assertTrue(idx.bottles["dev"].git_user.is_empty())
+        m = idx.load_for_agent("impl")
+        self.assertFalse(m.bottle.git_user.is_empty())
 
     def test_bottle_only_identity_preserved_when_agent_silent(self):
         m = _manifest(bottle_user={"name": "B", "email": "b@c"})
-        u = m.bottle_for("impl").git_user
+        u = m.bottle.git_user
         self.assertEqual("B", u.name)
         self.assertEqual("b@c", u.email)
 
-    def test_bottle_for_returns_same_instance_when_no_overlay(self):
-        m = _manifest(bottle_user={"name": "B"})
-        self.assertIs(m.bottles["dev"], m.bottle_for("impl"))
+    def test_no_overlay_uses_bottle_instance_directly(self):
+        idx = _index(bottle_user={"name": "B"})
+        m = idx.load_for_agent("impl")
+        # Agent has no git_user — bottle instance should be the same object
+        self.assertIs(idx.bottles["dev"], m.bottle)
 
-    def test_bottle_for_returns_same_instance_when_overlay_is_noop(self):
-        m = _manifest(
+    def test_noop_overlay_uses_bottle_instance_directly(self):
+        idx = _index(
             bottle_user={"name": "B", "email": "b@c"},
             agent_git={"user": {"name": "B", "email": "b@c"}},
         )
-        self.assertIs(m.bottles["dev"], m.bottle_for("impl"))
+        m = idx.load_for_agent("impl")
+        # Agent git_user == bottle git_user — no replace needed
+        self.assertEqual(idx.bottles["dev"].git_user, m.bottle.git_user)
 
     def test_other_bottle_fields_untouched_by_overlay(self):
-        m = Manifest.from_json_obj({
+        idx = ManifestIndex.from_json_obj({
             "bottles": {"dev": {
                 "env": {"FOO": "bar"},
                 "supervise": True,
@@ -103,7 +124,7 @@ class TestAgentGitUserOverlay(unittest.TestCase):
                 "git-gate": {"user": {"name": "a"}},
             }},
         })
-        b = m.bottle_for("impl")
+        b = idx.load_for_agent("impl").bottle
         self.assertEqual("a", b.git_user.name)
         self.assertEqual({"FOO": "bar"}, dict(b.env))
         self.assertTrue(b.supervise)
@@ -131,7 +152,7 @@ class TestGitIdentitySummary(unittest.TestCase):
         m = _manifest(agent_git={"user": {"name": "a", "email": "a@b"}})
         self.assertEqual(
             "name=a (agent), email=a@b (agent)",
-            m.git_identity_summary("impl"),
+            m.git_identity_summary(),
         )
 
     def test_mixed_provenance(self):
@@ -141,19 +162,19 @@ class TestGitIdentitySummary(unittest.TestCase):
         )
         self.assertEqual(
             "name=a (agent), email=b@c (bottle)",
-            m.git_identity_summary("impl"),
+            m.git_identity_summary(),
         )
 
     def test_bottle_only(self):
         m = _manifest(bottle_user={"name": "B", "email": "b@c"})
         self.assertEqual(
             "name=B (bottle), email=b@c (bottle)",
-            m.git_identity_summary("impl"),
+            m.git_identity_summary(),
         )
 
     def test_none_when_unset_anywhere(self):
         m = _manifest()
-        self.assertIsNone(m.git_identity_summary("impl"))
+        self.assertIsNone(m.git_identity_summary())
 
 
 _BOTTLE_DEV = """
@@ -217,19 +238,26 @@ class TestAgentGitUserMdLoader(unittest.TestCase):
     def test_md_agent_git_user_overlays_bottle(self):
         self._write("bottles/dev.md", _BOTTLE_DEV)
         self._write("agents/impl.md", _AGENT_WITH_GIT)
-        m = Manifest.resolve(str(self.home))
-        u = m.bottle_for("impl").git_user
+        m = ManifestIndex.resolve(str(self.home)).load_for_agent("impl")
+        u = m.bottle.git_user
         self.assertEqual("agent-name", u.name)
         self.assertEqual("bottle@example.com", u.email)
         self.assertEqual(
             "name=agent-name (agent), email=bottle@example.com (bottle)",
-            m.git_identity_summary("impl"),
+            m.git_identity_summary(),
         )
 
-    def test_md_agent_repos_dies(self):
+    def test_md_agent_repos_fails_at_preflight(self):
+        """git-gate.repos on an agent is an error; resolve() still succeeds
+        so other agents remain accessible, but load_for_agent raises."""
         self._write("bottles/dev.md", _BOTTLE_DEV)
         self._write("agents/impl.md", _AGENT_WITH_REPOS)
-        msg = _error_message(Manifest.resolve, str(self.home))
+        from bot_bottle.manifest import ManifestError
+        names = ManifestIndex.resolve(str(self.home))
+        self.assertIn("impl", names.all_agent_names)
+        with self.assertRaises(ManifestError) as ctx:
+            names.load_for_agent("impl")
+        msg = str(ctx.exception)
         self.assertIn("git-gate.repos", msg)
         self.assertIn("bottle-only", msg)
 

tests/unit/test_manifest_egress.py

@@ -9,18 +9,18 @@ partial `auth` is an error, auth omission means unauthenticated."""
 
 import unittest
 
-from bot_bottle.manifest import ManifestError, Manifest
+from bot_bottle.manifest import ManifestError, ManifestIndex
 
 
 def _bottle(routes):  # type: ignore
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": {"egress": {"routes": routes}}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     }).bottles["dev"]
 
 
 def _provider_bottle(provider, routes):  # type: ignore
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {
             "dev": {
                 "agent_provider": {"template": provider},
@@ -32,7 +32,7 @@ def _provider_bottle(provider, routes):  # type: ignore
 
 
 def _provider_config_bottle(agent_provider):  # type: ignore
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": {"dev": {"agent_provider": agent_provider}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     }).bottles["dev"]
@@ -433,7 +433,7 @@ class TestRouteValidation(unittest.TestCase):
         self.assertEqual((), b.egress.routes)
 
     def test_no_egress_block_means_empty(self):
-        b = Manifest.from_json_obj({
+        b = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         }).bottles["dev"]
@@ -443,7 +443,7 @@ class TestRouteValidation(unittest.TestCase):
 class TestConfigShape(unittest.TestCase):
     def test_unknown_egress_key_rejected(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"egress": {"wat": []}}},
                 "agents": {"demo": {"skills": [], "prompt": "",
                                      "bottle": "dev"}},
@@ -454,14 +454,14 @@ class TestConfigShape(unittest.TestCase):
         self.assertEqual(0, b.egress.Log)
 
     def test_log_level_1_accepted(self):
-        b = Manifest.from_json_obj({
+        b = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"egress": {"log": 1, "routes": []}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         }).bottles["dev"]
         self.assertEqual(1, b.egress.Log)
 
     def test_log_level_2_accepted(self):
-        b = Manifest.from_json_obj({
+        b = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"egress": {"log": 2, "routes": []}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         }).bottles["dev"]
@@ -469,7 +469,7 @@ class TestConfigShape(unittest.TestCase):
 
     def test_log_invalid_level_rejected(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"egress": {"log": 3}}},
                 "agents": {"demo": {"skills": [], "prompt": "",
                                      "bottle": "dev"}},
@@ -477,7 +477,7 @@ class TestConfigShape(unittest.TestCase):
 
     def test_log_bool_rejected(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"egress": {"log": True}}},
                 "agents": {"demo": {"skills": [], "prompt": "",
                                      "bottle": "dev"}},
@@ -485,7 +485,7 @@ class TestConfigShape(unittest.TestCase):
 
     def test_log_string_rejected(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"egress": {"log": "full"}}},
                 "agents": {"demo": {"skills": [], "prompt": "",
                                      "bottle": "dev"}},

tests/unit/test_manifest_extends.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 
 import unittest
 
-from bot_bottle.manifest import ManifestError, Manifest
+from bot_bottle.manifest import ManifestError, ManifestIndex
 
 
 def _error_message(callable_, *args, **kwargs) -> str:  # type: ignore
@@ -28,7 +28,7 @@ def _build(**bottles) -> Manifest:  # type: ignore
     """Build a manifest with the given bottles and one trivial agent
     referencing the first bottle (so the manifest is valid)."""
     first = next(iter(bottles))
-    return Manifest.from_json_obj({
+    return ManifestIndex.from_json_obj({
         "bottles": bottles,
         "agents": {
             "demo": {"skills": [], "prompt": "", "bottle": first},

tests/unit/test_manifest_git.py

@@ -2,7 +2,7 @@
 
 import unittest
 
-from bot_bottle.manifest import ManifestError, Manifest
+from bot_bottle.manifest import ManifestError, ManifestIndex
 
 
 def _manifest(repos: dict) -> dict:  # type: ignore
@@ -14,7 +14,7 @@ def _manifest(repos: dict) -> dict:  # type: ignore
 
 class TestGitEntryParsing(unittest.TestCase):
     def test_parses_minimal_entry(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "bot-bottle": {
                 "url": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -30,7 +30,7 @@ class TestGitEntryParsing(unittest.TestCase):
         self.assertEqual("didericis/bot-bottle.git", e.UpstreamPath)
 
     def test_default_port_is_22(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "foo": {
                 "url": "ssh://git@github.com/didericis/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -41,7 +41,7 @@ class TestGitEntryParsing(unittest.TestCase):
         self.assertEqual("github.com", e.UpstreamHost)
 
     def test_host_key_optional(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "foo": {
                 "url": "ssh://git@github.com/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -50,7 +50,7 @@ class TestGitEntryParsing(unittest.TestCase):
         self.assertEqual("", m.bottles["dev"].git[0].KnownHostKey)
 
     def test_host_key_stored(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "foo": {
                 "url": "ssh://git@github.com/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -60,7 +60,7 @@ class TestGitEntryParsing(unittest.TestCase):
         self.assertEqual("ssh-ed25519 AAAA", m.bottles["dev"].git[0].KnownHostKey)
 
     def test_repo_name_becomes_Name(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "my-repo": {
                 "url": "ssh://git@github.com/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -70,19 +70,19 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_missing_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {"key": {"provider": "static", "path": "/dev/null"}},
             }))
 
     def test_missing_key_block_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {"url": "ssh://git@github.com/foo.git"},
             }))
 
     def test_unknown_key_in_entry_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -92,7 +92,7 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_non_ssh_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "https://github.com/didericis/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -101,7 +101,7 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_scp_style_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "git@github.com:didericis/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -110,7 +110,7 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_url_without_user_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -119,7 +119,7 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_url_without_path_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -128,7 +128,7 @@ class TestGitEntryParsing(unittest.TestCase):
 
     def test_non_numeric_port_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com:notaport/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -136,7 +136,7 @@ class TestGitEntryParsing(unittest.TestCase):
             }))
 
     def test_ip_literal_upstream(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "bot-bottle": {
                 "url": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -152,7 +152,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
     def test_two_repos_different_hosts_both_parsed(self):
         # Repo names come from dict keys; two distinct keys always produce
         # two distinct entries (uniqueness is guaranteed at the YAML/dict level).
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"git-gate": {"repos": {
                 "foo": {
                     "url": "ssh://git@a.example/x.git",
@@ -170,7 +170,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
 
     def test_legacy_ssh_field_dies_with_hint(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {
                     "dev": {
                         "ssh": [{
@@ -187,7 +187,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
 
     def test_name_with_single_quote_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "o'reilly": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -196,7 +196,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
 
     def test_name_with_space_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "my repo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -205,7 +205,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
 
     def test_name_with_semicolon_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo;bar": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -214,7 +214,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
 
     def test_name_with_dollar_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo$bar": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null"},
@@ -222,7 +222,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
             }))
 
     def test_valid_name_with_dots_and_hyphens_accepted(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "my.repo-name_1": {
                 "url": "ssh://git@github.com/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -233,7 +233,7 @@ class TestGitEntryCrossValidation(unittest.TestCase):
     def test_legacy_git_key_dies_with_hint(self):
         msg = ""
         try:
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"git": {"remotes": {}}}},
                 "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
             })
@@ -247,7 +247,7 @@ class TestStaticKey(unittest.TestCase):
     """git-gate.repos entries with key.provider = "static"."""
 
     def test_static_key_minimal(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "bot-bottle": {
                 "url": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
                 "key": {"provider": "static", "path": "/home/user/.ssh/id_ed25519"},
@@ -260,7 +260,7 @@ class TestStaticKey(unittest.TestCase):
         self.assertEqual("/home/user/.ssh/id_ed25519", e.IdentityFile)
 
     def test_static_key_sets_identity_file_at_parse_time(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "foo": {
                 "url": "ssh://git@github.com/foo.git",
                 "key": {"provider": "static", "path": "/dev/null"},
@@ -270,7 +270,7 @@ class TestStaticKey(unittest.TestCase):
 
     def test_static_key_missing_path_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static"},
@@ -279,7 +279,7 @@ class TestStaticKey(unittest.TestCase):
 
     def test_static_key_unknown_field_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "static", "path": "/dev/null", "api_url": "x"},
@@ -291,7 +291,7 @@ class TestGiteaKey(unittest.TestCase):
     """git-gate.repos entries with key.provider = "gitea"."""
 
     def test_gitea_key_minimal(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "bot-bottle": {
                 "url": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
                 "key": {
@@ -308,7 +308,7 @@ class TestGiteaKey(unittest.TestCase):
         self.assertEqual("", e.IdentityFile)
 
     def test_gitea_key_with_api_url(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "repo": {
                 "url": "ssh://git@gitea.example.com/org/repo.git",
                 "key": {
@@ -321,7 +321,7 @@ class TestGiteaKey(unittest.TestCase):
         self.assertEqual("https://gitea.example.com", m.bottles["dev"].git[0].Key.api_url)
 
     def test_gitea_key_has_no_identity_file_at_parse_time(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "foo": {
                 "url": "ssh://git@github.com/didericis/foo.git",
                 "key": {"provider": "gitea", "forge_token_env": "T"},
@@ -331,7 +331,7 @@ class TestGiteaKey(unittest.TestCase):
 
     def test_gitea_key_missing_forge_token_env_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "gitea"},
@@ -340,7 +340,7 @@ class TestGiteaKey(unittest.TestCase):
 
     def test_gitea_key_unknown_field_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {
@@ -357,7 +357,7 @@ class TestKeyBlockValidation(unittest.TestCase):
 
     def test_missing_provider_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"path": "/dev/null"},
@@ -366,7 +366,7 @@ class TestKeyBlockValidation(unittest.TestCase):
 
     def test_unknown_provider_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {
                     "url": "ssh://git@github.com/foo.git",
                     "key": {"provider": "github"},
@@ -375,14 +375,14 @@ class TestKeyBlockValidation(unittest.TestCase):
 
     def test_missing_key_block_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest({
+            ManifestIndex.from_json_obj(_manifest({
                 "foo": {"url": "ssh://git@github.com/foo.git"},
             }))
 
 
 class TestEmptyGitGateField(unittest.TestCase):
     def test_no_git_gate_field_yields_empty_tuple(self):
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
@@ -390,13 +390,13 @@ class TestEmptyGitGateField(unittest.TestCase):
 
     def test_git_gate_object_type_required(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {"git-gate": "not-a-dict"}},
                 "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
             })
 
     def test_empty_repos_yields_empty_tuple(self):
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"git-gate": {"repos": {}}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })

tests/unit/test_manifest_git_user.py

@@ -2,7 +2,7 @@
 
 import unittest
 
-from bot_bottle.manifest import ManifestError, ManifestGitUser, Manifest
+from bot_bottle.manifest import ManifestError, ManifestGitUser, ManifestIndex
 
 
 def _error_message(callable_, *args, **kwargs) -> str:  # type: ignore
@@ -23,7 +23,7 @@ def _manifest(git_user):  # type: ignore
 
 class TestGitUserParsing(unittest.TestCase):
     def test_parses_both_fields(self):
-        m = Manifest.from_json_obj(_manifest({
+        m = ManifestIndex.from_json_obj(_manifest({
             "name": "Eric Bauerfeld",
             "email": "eric+claude@dideric.is",
         }))
@@ -33,13 +33,13 @@ class TestGitUserParsing(unittest.TestCase):
         self.assertFalse(u.is_empty())
 
     def test_name_only(self):
-        m = Manifest.from_json_obj(_manifest({"name": "Bot"}))
+        m = ManifestIndex.from_json_obj(_manifest({"name": "Bot"}))
         u = m.bottles["dev"].git_user
         self.assertEqual("Bot", u.name)
         self.assertEqual("", u.email)
 
     def test_email_only(self):
-        m = Manifest.from_json_obj(_manifest({"email": "bot@example.com"}))
+        m = ManifestIndex.from_json_obj(_manifest({"email": "bot@example.com"}))
         u = m.bottles["dev"].git_user
         self.assertEqual("", u.name)
         self.assertEqual("bot@example.com", u.email)
@@ -47,7 +47,7 @@ class TestGitUserParsing(unittest.TestCase):
     def test_omitted_defaults_to_empty(self):
         # No git.user block at all → empty GitUser, is_empty True →
         # provisioner skips the `git config` step entirely.
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
@@ -59,13 +59,13 @@ class TestGitUserParsing(unittest.TestCase):
         # /  half-finished edit; fail loudly rather than silently
         # no-op (the operator clearly meant to configure something).
         msg = _error_message(
-            Manifest.from_json_obj, _manifest({"name": "", "email": ""}),
+            ManifestIndex.from_json_obj, _manifest({"name": "", "email": ""}),
         )
         self.assertIn("neither name nor email", msg)
 
     def test_unknown_key_dies(self):
         msg = _error_message(
-            Manifest.from_json_obj,
+            ManifestIndex.from_json_obj,
             _manifest({"name": "Bot", "username": "bot"}),
         )
         self.assertIn("unknown key", msg)
@@ -73,19 +73,19 @@ class TestGitUserParsing(unittest.TestCase):
 
     def test_non_string_name_dies(self):
         msg = _error_message(
-            Manifest.from_json_obj, _manifest({"name": 42}),
+            ManifestIndex.from_json_obj, _manifest({"name": 42}),
         )
         self.assertIn("git-gate.user.name must be a string", msg)
 
     def test_non_string_email_dies(self):
         msg = _error_message(
-            Manifest.from_json_obj, _manifest({"email": ["x@y.z"]}),
+            ManifestIndex.from_json_obj, _manifest({"email": ["x@y.z"]}),
         )
         self.assertIn("git-gate.user.email must be a string", msg)
 
     def test_legacy_top_level_git_user_dies(self):
         msg = _error_message(
-            Manifest.from_json_obj,
+            ManifestIndex.from_json_obj,
             {
                 "bottles": {"dev": {"git_user": {"name": "Bot"}}},
                 "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},

tests/unit/test_manifest_md_load.py

@@ -11,7 +11,7 @@ import textwrap
 import unittest
 from pathlib import Path
 
-from bot_bottle.manifest import ManifestError, Manifest
+from bot_bottle.manifest import ManifestError, ManifestIndex
 
 
 def _write(p: Path, text: str) -> None:
@@ -45,7 +45,7 @@ _AGENT_IMPL = """
 
 
 class _ResolveCase(unittest.TestCase):
-    """Drives `Manifest.resolve(cwd)` against a temp $HOME and a
+    """Drives `ManifestIndex.resolve(cwd)` against a temp $HOME and a
     temp cwd. Subclasses lay down fixture files in setUp."""
 
     def setUp(self) -> None:
@@ -71,20 +71,19 @@ class _ResolveCase(unittest.TestCase):
     def cwd_cb(self) -> Path:
         return self.cwd_root / ".bot-bottle"
 
-    def resolve(self) -> Manifest:
-        return Manifest.resolve(str(self.cwd_root))
+    def resolve(self) -> ManifestIndex:
+        return ManifestIndex.resolve(str(self.cwd_root))
 
 
 class TestBottleFileParses(_ResolveCase):
     """SC #1: a bottle file under $HOME/.bot-bottle/bottles/
-    parses into the expected Bottle shape."""
+    parses into the expected Bottle shape via load_for_agent."""
 
     def test_loads(self):
         _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
-        m = self.resolve()
-        self.assertIn("dev", m.bottles)
-        routes = m.bottles["dev"].egress.routes
+        m = self.resolve().load_for_agent("implementer")
+        routes = m.bottle.egress.routes
         self.assertEqual(2, len(routes))
         self.assertEqual("api.anthropic.com", routes[0].Host)
         self.assertEqual("Bearer", routes[0].AuthScheme)
@@ -94,14 +93,14 @@ class TestBottleFileParses(_ResolveCase):
 
 class TestAgentFileParses(_ResolveCase):
     """SC #2: an agent file under $HOME/.bot-bottle/agents/
-    parses, the body becomes the prompt, the frontmatter fields
-    map to Agent fields."""
+    parses via load_for_agent; the body becomes the prompt, the
+    frontmatter fields map to Agent fields."""
 
     def test_loads(self):
         _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
-        m = self.resolve()
-        a = m.agents["implementer"]
+        m = self.resolve().load_for_agent("implementer")
+        a = m.agent
         self.assertEqual("dev", a.bottle)
         self.assertEqual(("init-prd",), a.skills)
         # Body became the prompt; whitespace stripped.
@@ -128,10 +127,10 @@ class TestCwdAgentOverridesHome(_ResolveCase):
             CWD-OVERRIDE-PROMPT
             """,
         )
-        m = self.resolve()
-        self.assertIn("CWD-OVERRIDE-PROMPT", m.agents["implementer"].prompt)
-        # Home bottle still present
-        self.assertEqual(2, len(m.bottles["dev"].egress.routes))
+        m = self.resolve().load_for_agent("implementer")
+        self.assertIn("CWD-OVERRIDE-PROMPT", m.agent.prompt)
+        # Home bottle still present with its two egress routes
+        self.assertEqual(2, len(m.bottle.egress.routes))
 
 
 class TestCwdBottlesIgnored(_ResolveCase):
@@ -155,11 +154,11 @@ class TestCwdBottlesIgnored(_ResolveCase):
             ---
             """,
         )
-        m = self.resolve()
+        m = self.resolve().load_for_agent("implementer")
         # Home value wins because cwd bottles are ignored entirely.
         self.assertEqual(
             "api.anthropic.com",
-            m.bottles["dev"].egress.routes[0].Host,
+            m.bottle.egress.routes[0].Host,
         )
 
 
@@ -176,12 +175,12 @@ class TestStdlibOnly(unittest.TestCase):
 
 
 class TestExistingFromJsonObjStillWorks(unittest.TestCase):
-    """SC #6: `Manifest.from_json_obj` continues to work as a
+    """SC #6: `ManifestIndex.from_json_obj` continues to work as a
     programmatic entry point even though disk loading moved to the
     MD layout."""
 
     def test_from_json_obj(self):
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "hi",
                                 "bottle": "dev"}},
@@ -215,9 +214,9 @@ class TestAgentFileDoublesAsClaudeCodeSubagent(_ResolveCase):
             Agent prompt body.
             """,
         )
-        m = self.resolve()
-        self.assertEqual("dev", m.agents["implementer"].bottle)
-        self.assertEqual(("init-prd",), m.agents["implementer"].skills)
+        m = self.resolve().load_for_agent("implementer")
+        self.assertEqual("dev", m.agent.bottle)
+        self.assertEqual(("init-prd",), m.agent.skills)
 
 
 class TestManifestEntryPointParity(_ResolveCase):
@@ -228,8 +227,8 @@ class TestManifestEntryPointParity(_ResolveCase):
         _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
 
-        md_manifest = self.resolve()
-        json_manifest = Manifest.from_json_obj({
+        md_manifest = self.resolve().load_for_agent("implementer")
+        json_index = ManifestIndex.from_json_obj({
             "bottles": {
                 "dev": {
                     "egress": {
@@ -256,17 +255,17 @@ class TestManifestEntryPointParity(_ResolveCase):
         })
 
         self.assertEqual(
-            md_manifest.agents["implementer"],
-            json_manifest.agents["implementer"],
+            md_manifest.agent,
+            json_index.agents["implementer"],
         )
         self.assertEqual(
-            md_manifest.bottles["dev"].egress.routes,
-            json_manifest.bottles["dev"].egress.routes,
+            md_manifest.bottle.egress.routes,
+            json_index.bottles["dev"].egress.routes,
         )
 
     def test_json_agent_rejects_unknown_keys(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
+            ManifestIndex.from_json_obj({
                 "bottles": {"dev": {}},
                 "agents": {
                     "implementer": {
@@ -277,7 +276,7 @@ class TestManifestEntryPointParity(_ResolveCase):
             })
 
     def test_json_agent_accepts_claude_code_passthrough_keys(self):
-        manifest = Manifest.from_json_obj({
+        index = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {
                 "implementer": {
@@ -291,37 +290,51 @@ class TestManifestEntryPointParity(_ResolveCase):
             },
         })
 
-        self.assertEqual("dev", manifest.agents["implementer"].bottle)
+        self.assertEqual("dev", index.agents["implementer"].bottle)
 
 
-class TestUnknownAgentKeyDies(_ResolveCase):
-    """A typo'd / unknown frontmatter key on an agent file dies
-    rather than silently ignoring."""
+class TestBrokenAgentOnlyFailsAtPreflight(_ResolveCase):
+    """A typo'd / unknown frontmatter key on an agent file does NOT crash
+    resolve(). The agent appears in all_agent_names for the selector.
+    The error surfaces only when load_for_agent is called for that agent."""
 
-    def test_dies(self):
+    def test_resolve_succeeds_despite_broken_agent(self):
         _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(
-            self.home_cb / "agents" / "implementer.md",
+            self.home_cb / "agents" / "bad.md",
             """
             ---
             bottle: dev
             skillz: [init-prd]
             ---
-
-            ...
             """,
         )
-        with self.assertRaises(ManifestError):
-            self.resolve()
+        _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
+        m = self.resolve()
+        # Resolve itself does not raise; broken agent appears in the name list.
+        self.assertIn("bad", m.all_agent_names)
+        self.assertIn("implementer", m.all_agent_names)
 
-
-class TestUnknownBottleKeyDies(_ResolveCase):
-    """A typo'd / unknown frontmatter key on a bottle file dies
-    rather than silently ignoring."""
-
-    def test_dies(self):
+    def test_load_for_agent_raises_for_broken_agent(self):
+        _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(
-            self.home_cb / "bottles" / "dev.md",
+            self.home_cb / "agents" / "bad.md",
+            """
+            ---
+            bottle: dev
+            skillz: [init-prd]
+            ---
+            """,
+        )
+        m = self.resolve()
+        with self.assertRaises(ManifestError):
+            m.load_for_agent("bad")
+
+    def test_broken_bottle_only_fails_at_preflight(self):
+        """A broken bottle does not crash resolve; only load_for_agent for
+        an agent that references it raises. Unrelated agents still work."""
+        _write(
+            self.home_cb / "bottles" / "bad.md",
             """
             ---
             credproxy:
@@ -329,9 +342,26 @@ class TestUnknownBottleKeyDies(_ResolveCase):
             ---
             """,
         )
+        _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
+        _write(
+            self.home_cb / "agents" / "broken-agent.md",
+            """
+            ---
+            bottle: bad
+            ---
+            """,
+        )
+        m = self.resolve()
+        # Both agents appear in the name list at resolve time.
+        self.assertIn("implementer", m.all_agent_names)
+        self.assertIn("broken-agent", m.all_agent_names)
+        # Valid agent loads fine.
+        full = m.load_for_agent("implementer")
+        self.assertEqual("dev", full.agent.bottle)
+        # Broken bottle's agent raises at preflight.
         with self.assertRaises(ManifestError):
-            self.resolve()
+            m.load_for_agent("broken-agent")
 
 
 class TestStaleJsonDies(_ResolveCase):
@@ -354,16 +384,16 @@ class TestNoManifestDies(_ResolveCase):
             self.resolve()
 
     def test_missing_ok_returns_empty_manifest(self):
-        m = Manifest.resolve(str(self.cwd_root), missing_ok=True)
+        m = ManifestIndex.resolve(str(self.cwd_root), missing_ok=True)
         self.assertEqual({}, dict(m.bottles))
         self.assertEqual({}, dict(m.agents))
 
 
-class TestUnknownBottleReferenceDies(_ResolveCase):
-    """An agent file naming a bottle that doesn't exist on disk
-    dies with the existing "bottle not defined" error."""
+class TestUnknownBottleReferenceFailsAtPreflight(_ResolveCase):
+    """An agent file naming a non-existent bottle appears in all_agent_names
+    at resolve time; the error only surfaces when load_for_agent is called."""
 
-    def test_dies(self):
+    def test_stray_bottle_reference_fails_at_preflight(self):
         _write(self.home_cb / "bottles" / "dev.md", _BOTTLE_DEV)
         _write(
             self.home_cb / "agents" / "stray.md",
@@ -373,8 +403,17 @@ class TestUnknownBottleReferenceDies(_ResolveCase):
             ---
             """,
         )
+        _write(self.home_cb / "agents" / "implementer.md", _AGENT_IMPL)
+        m = self.resolve()
+        # Both names visible at resolve time.
+        self.assertIn("stray", m.all_agent_names)
+        self.assertIn("implementer", m.all_agent_names)
+        # Valid agent loads fine.
+        full = m.load_for_agent("implementer")
+        self.assertEqual("dev", full.agent.bottle)
+        # Stray agent fails at preflight.
         with self.assertRaises(ManifestError):
-            self.resolve()
+            m.load_for_agent("stray")
 
 
 class TestFilenameValidation(_ResolveCase):
@@ -388,10 +427,6 @@ class TestFilenameValidation(_ResolveCase):
         # This file should be skipped — capital letters not allowed.
         _write(self.home_cb / "agents" / "BadName.md", _AGENT_IMPL)
         m = self.resolve()
-        self.assertIn("implementer", m.agents)
-        self.assertNotIn("BadName", m.agents)
-        self.assertNotIn("badname", m.agents)
-
-
-if __name__ == "__main__":
-    unittest.main()
+        self.assertIn("implementer", m.all_agent_names)
+        self.assertNotIn("BadName", m.all_agent_names)
+        self.assertNotIn("badname", m.all_agent_names)

tests/unit/test_manifest_runtime.py

@@ -7,7 +7,7 @@ silently ignoring."""
 import unittest
 from typing import Any
 
-from bot_bottle.manifest import ManifestError, ManifestBottle, Manifest
+from bot_bottle.manifest import ManifestError, ManifestBottle, ManifestIndex
 
 
 def _manifest_with_runtime(value: object) -> dict[str, Any]:
@@ -19,7 +19,7 @@ def _manifest_with_runtime(value: object) -> dict[str, Any]:
 
 class TestManifestRuntimeRemoved(unittest.TestCase):
     def test_loads_when_runtime_absent(self):
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
@@ -32,7 +32,7 @@ class TestManifestRuntimeRemoved(unittest.TestCase):
         for value in ("runsc", "runc", "kata-runtime", "", 42, None):
             with self.subTest(value=value):
                 with self.assertRaises(ManifestError):
-                    Manifest.from_json_obj(_manifest_with_runtime(value))
+                    ManifestIndex.from_json_obj(_manifest_with_runtime(value))
 
 
 if __name__ == "__main__":

tests/unit/test_plan_print_parity.py

@@ -19,19 +19,18 @@ from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.backend.smolmachines.bottle_plan import SmolmachinesBottlePlan
 from bot_bottle.egress import EgressPlan, EgressRoute
 from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import Manifest, ManifestIndex
 
 
-def _manifest() -> Manifest:
-    return Manifest.from_json_obj({
-        "bottles": {"dev": {}},
-        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-    })
+_INDEX = ManifestIndex.from_json_obj({
+    "bottles": {"dev": {}},
+    "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+})
 
 
-def _spec(manifest: Manifest, tmp: str) -> BottleSpec:
+def _spec(index: ManifestIndex, tmp: str) -> BottleSpec:
     return BottleSpec(
-        manifest=manifest,
+        manifest=index,
         agent_name="demo",
         copy_cwd=False,
         user_cwd=tmp,
@@ -92,10 +91,11 @@ def _agent_provision(tmp: str) -> AgentProvisionPlan:
     )
 
 
-def _docker_plan(spec: BottleSpec, tmp: str) -> DockerBottlePlan:
+def _docker_plan(spec: BottleSpec, manifest: Manifest, tmp: str) -> DockerBottlePlan:
     stage = Path(tmp)
     return DockerBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage,
         git_gate_plan=_git_gate_plan(tmp),
         egress_plan=_egress_plan(tmp),
@@ -107,10 +107,11 @@ def _docker_plan(spec: BottleSpec, tmp: str) -> DockerBottlePlan:
     )
 
 
-def _smolmachines_plan(spec: BottleSpec, tmp: str) -> SmolmachinesBottlePlan:
+def _smolmachines_plan(spec: BottleSpec, manifest: Manifest, tmp: str) -> SmolmachinesBottlePlan:
     stage = Path(tmp)
     return SmolmachinesBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage,
         git_gate_plan=_git_gate_plan(tmp),
         egress_plan=_egress_plan(tmp),
@@ -140,10 +141,10 @@ class TestGitGatePrintParity(unittest.TestCase):
 
     def setUp(self) -> None:
         self._tmp = tempfile.mkdtemp(prefix="plan-print-parity-")
-        manifest = _manifest()
-        spec = _spec(manifest, self._tmp)
-        self._docker_lines = _capture_print(_docker_plan(spec, self._tmp))
-        self._smol_lines = _capture_print(_smolmachines_plan(spec, self._tmp))
+        manifest = _INDEX.load_for_agent("demo")
+        spec = _spec(_INDEX, self._tmp)
+        self._docker_lines = _capture_print(_docker_plan(spec, manifest, self._tmp))
+        self._smol_lines = _capture_print(_smolmachines_plan(spec, manifest, self._tmp))
 
     def _git_gate_lines(self, lines: list[str]) -> list[str]:
         return [ln for ln in lines if "git gate" in ln]
@@ -170,10 +171,10 @@ class TestEgressPrintParity(unittest.TestCase):
 
     def setUp(self) -> None:
         self._tmp = tempfile.mkdtemp(prefix="plan-print-parity-")
-        manifest = _manifest()
-        spec = _spec(manifest, self._tmp)
-        self._docker_lines = _capture_print(_docker_plan(spec, self._tmp))
-        self._smol_lines = _capture_print(_smolmachines_plan(spec, self._tmp))
+        manifest = _INDEX.load_for_agent("demo")
+        spec = _spec(_INDEX, self._tmp)
+        self._docker_lines = _capture_print(_docker_plan(spec, manifest, self._tmp))
+        self._smol_lines = _capture_print(_smolmachines_plan(spec, manifest, self._tmp))
 
     def _egress_section(self, lines: list[str]) -> list[str]:
         """Return lines from the egress label through the last route entry.

tests/unit/test_provision_git.py

@@ -10,7 +10,7 @@ from bot_bottle.git_gate import (
     GIT_GATE_HOSTNAME,
     git_gate_render_gitconfig,
 )
-from bot_bottle.manifest import Manifest
+from bot_bottle.manifest import ManifestIndex
 from tests.fixtures import fixture_minimal, fixture_with_git
 
 
@@ -72,7 +72,7 @@ class TestGitGateGitconfigRender(unittest.TestCase):
     def test_ip_upstream_emits_single_insteadof(self):
         # In the new format the dict key is the repo name, not a host
         # alias, so there is only one insteadOf rule — for the IP URL.
-        m = Manifest.from_json_obj({
+        m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"git-gate": {"repos": {
                 "bot-bottle": {
                     "url": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",

tests/unit/test_smolmachines_launch_image.py

@@ -16,6 +16,8 @@ from __future__ import annotations
 import tempfile
 import unittest
 from pathlib import Path
+from types import SimpleNamespace
+from typing import Any, cast
 from unittest.mock import patch
 
 from bot_bottle.backend.smolmachines import launch as _launch_mod
@@ -141,5 +143,46 @@ class TestEnsureSmolmachine(unittest.TestCase):
         self.assertTrue(str(pack_args[1]).endswith(f"{digest}.smolmachine"))
 
 
+class TestAgentFromPath(unittest.TestCase):
+    def _plan(self) -> Any:
+        return cast(Any, SimpleNamespace(
+            slug="dev-abc12",
+            agent_image="bot-bottle-claude:latest",
+            agent_dockerfile_path="/repo/Dockerfile",
+        ))
+
+    def test_uses_committed_artifact_when_present(self):
+        with tempfile.TemporaryDirectory(prefix="committed-smolmachine.") as tmp:
+            artifact = Path(tmp) / "committed-smolmachine.smolmachine"
+            artifact.write_text("")
+            with patch.object(
+                _launch_mod, "read_committed_image", return_value=str(artifact),
+            ), patch.object(
+                _launch_mod, "_ensure_smolmachine",
+            ) as ensure, patch.object(
+                _launch_mod, "info",
+            ):
+                result = _launch_mod._agent_from_path(self._plan())
+
+        self.assertEqual(artifact, result)
+        ensure.assert_not_called()
+
+    def test_falls_back_when_committed_artifact_missing(self):
+        packed = Path("/cache/agent.smolmachine")
+        with patch.object(
+            _launch_mod, "read_committed_image",
+            return_value="/missing/committed.smolmachine",
+        ), patch.object(
+            _launch_mod, "_ensure_smolmachine", return_value=packed,
+        ) as ensure:
+            result = _launch_mod._agent_from_path(self._plan())
+
+        self.assertEqual(packed, result)
+        ensure.assert_called_once_with(
+            "bot-bottle-claude:latest",
+            dockerfile="/repo/Dockerfile",
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_smolmachines_provision.py

@@ -33,7 +33,7 @@ from bot_bottle.backend.smolmachines.launch import _bundle_launch_spec
 from bot_bottle.backend.util import AGENT_CA_PATH
 from bot_bottle.egress import EgressPlan, EgressRoute
 from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
-from bot_bottle.manifest import ManifestGitEntry, ManifestKeyConfig, Manifest
+from bot_bottle.manifest import ManifestGitEntry, ManifestKeyConfig, ManifestIndex
 from bot_bottle.supervise import SupervisePlan
 
 
@@ -110,7 +110,7 @@ def _plan(
         bottle_json["git-gate"] = git_gate_json
     if supervise:
         bottle_json["supervise"] = True
-    manifest = Manifest.from_json_obj({
+    index = ManifestIndex.from_json_obj({
         "bottles": {"dev": bottle_json},
         "agents": {
             "demo": {
@@ -120,8 +120,9 @@ def _plan(
             },
         },
     })
+    manifest = index.load_for_agent("demo")
     spec = BottleSpec(
-        manifest=manifest,
+        manifest=index,
         agent_name="demo",
         copy_cwd=copy_cwd,
         user_cwd=user_cwd,
@@ -135,6 +136,7 @@ def _plan(
         )
     return SmolmachinesBottlePlan(
         spec=spec,
+        manifest=manifest,
         stage_dir=stage_dir or Path("/tmp/stage"),
         slug="demo-abc12",
         bundle_subnet="192.168.50.0/24",

tests/unit/test_smolmachines_smolvm.py

@@ -24,6 +24,7 @@ from bot_bottle.backend.smolmachines.smolvm import (
     machine_start,
     machine_stop,
     pack_create,
+    pack_create_from_vm,
     wait_exec_ready,
 )
 
@@ -63,6 +64,17 @@ class TestArgvShapes(unittest.TestCase):
             argv,
         )
 
+    def test_pack_create_from_vm_argv(self):
+        with self._patch_run() as m:
+            pack_create_from_vm("bot-bottle-dev-abc12", Path("/tmp/committed"))
+        argv = m.call_args.args[0]
+        self.assertEqual(
+            ["smolvm", "pack", "create",
+             "--from-vm", "bot-bottle-dev-abc12",
+             "-o", "/tmp/committed"],
+            argv,
+        )
+
     def test_machine_create_minimal(self):
         with self._patch_run() as m:
             machine_create("agent-xyz")
@@ -193,6 +205,14 @@ class TestErrorPath(unittest.TestCase):
             with self.assertRaises(SmolvmError):
                 pack_create("missing:tag", Path("/tmp/out"))
 
+    def test_pack_create_from_vm_failure_raises(self):
+        with patch(
+            "bot_bottle.backend.smolmachines.smolvm.subprocess.run",
+            return_value=_fail("pack failed"),
+        ):
+            with self.assertRaises(SmolvmError):
+                pack_create_from_vm("bot-bottle-dev-abc12", Path("/tmp/out"))
+
     def test_exec_failure_returns_result(self):
         # The in-VM command's exit code is what Bottle.exec sees;
         # `false` exiting non-zero is not a smolvm failure.

tests/unit/test_supervise.py

@@ -317,15 +317,22 @@ class TestToolConstants(unittest.TestCase):
     def test_tools_tuple_matches_individual_constants(self):
         self.assertEqual(
             (
+                supervise.TOOL_ALLOW,
                 TOOL_CAPABILITY_BLOCK,
+                supervise.TOOL_EGRESS_BLOCK,
                 supervise.TOOL_LIST_EGRESS_ROUTES,
             ),
             supervise.TOOLS,
         )
 
-    def test_component_map_has_no_entries(self):
-        # egress-block removed in issue #198; capability-block never had one.
-        self.assertEqual({}, supervise.COMPONENT_FOR_TOOL)
+    def test_component_map_has_egress_entries(self):
+        self.assertEqual(
+            {
+                supervise.TOOL_ALLOW: "egress",
+                supervise.TOOL_EGRESS_BLOCK: "egress",
+            },
+            supervise.COMPONENT_FOR_TOOL,
+        )
 
 
 class _StubSupervise(supervise.Supervise):

tests/unit/test_supervise_cli.py

@@ -2,9 +2,6 @@
 
 The curses TUI itself isn't exercised here — these tests cover the
 discovery + approve/reject paths that the TUI's key handlers call into.
-
-egress-block (add_route) was removed in issue #198; the TestEgressApplyWiring
-class and all stubs for add_route have been dropped accordingly.
 """
 
 import os
@@ -12,6 +9,7 @@ import tempfile
 import unittest
 from datetime import datetime, timezone
 from pathlib import Path
+from unittest.mock import patch
 
 from bot_bottle import supervise
 from bot_bottle.cli import supervise as supervise_cli
@@ -33,6 +31,8 @@ FIXED = datetime(2026, 5, 25, 12, 0, 0, tzinfo=timezone.utc)
 def _proposal(slug: str = "dev", tool: str = TOOL_CAPABILITY_BLOCK) -> Proposal:
     payloads = {
         TOOL_CAPABILITY_BLOCK: "FROM python:3.13\n",
+        supervise.TOOL_ALLOW: "routes:\n  - host: example.com\n",
+        supervise.TOOL_EGRESS_BLOCK: "routes:\n  - host: example.com\n",
     }
     payload = payloads.get(tool, "")
     return Proposal.new(
@@ -154,6 +154,22 @@ class TestApproveReject(_FakeHomeMixin, unittest.TestCase):
         supervise_cli.approve(qp)
         self.assertEqual([], read_audit_entries("egress", "dev"))
 
+    def test_approve_egress_block_writes_audit_log(self):
+        qp = self._enqueue(tool=supervise.TOOL_EGRESS_BLOCK)
+        with patch(
+            "bot_bottle.cli.supervise.apply_routes_change",
+            return_value=("routes: []\n", "routes:\n  - host: example.com\n"),
+        ) as apply_routes_change:
+            supervise_cli.approve(qp)
+        apply_routes_change.assert_called_once_with(
+            "dev",
+            "routes:\n  - host: example.com\n",
+        )
+        entries = read_audit_entries("egress", "dev")
+        self.assertEqual(1, len(entries))
+        self.assertEqual(STATUS_APPROVED, entries[0].operator_action)
+        self.assertEqual("needed for dev", entries[0].justification)
+
 
 # class TestCapabilityApplyWiring(_FakeHomeMixin, unittest.TestCase):
 #     # DISABLED — capability_apply functionality is currently commented out.

tests/unit/test_supervise_server.py

@@ -54,13 +54,19 @@ class TestValidation(unittest.TestCase):
         )
 
     def test_empty_proposed_file_rejected_for_tools_with_file_field(self):
-        # egress-block has structured input (validated in
-        # _validate_and_bundle_egress_route, not here) and
-        # list-egress-routes takes no input. Only capability-block
-        # goes through `validate_proposed_file`.
         with self.assertRaises(_RpcError):
             validate_proposed_file(_sv.TOOL_CAPABILITY_BLOCK, "   \n\t")
 
+    def test_egress_routes_yaml_is_validated(self):
+        validate_proposed_file(
+            _sv.TOOL_ALLOW,
+            "routes:\n  - host: example.com\n",
+        )
+
+    def test_invalid_egress_routes_yaml_rejected(self):
+        with self.assertRaises(_RpcError):
+            validate_proposed_file(_sv.TOOL_EGRESS_BLOCK, "routes: nope\n")
+
 
 # --- JSON-RPC parsing ------------------------------------------------------
 
@@ -141,7 +147,9 @@ class TestHandleToolsList(unittest.TestCase):
         names = [t["name"] for t in result["tools"]]  # type: ignore[index]
         self.assertEqual(
             sorted([
+                _sv.TOOL_ALLOW,
                 _sv.TOOL_CAPABILITY_BLOCK,
+                _sv.TOOL_EGRESS_BLOCK,
                 _sv.TOOL_LIST_EGRESS_ROUTES,
             ]),
             sorted(names),
@@ -172,6 +180,17 @@ class TestHandleToolsList(unittest.TestCase):
         # No `required` array because no inputs are required.
         self.assertNotIn("required", schema)  # type: ignore[operator]
 
+    def test_egress_tools_take_routes_yaml_and_justification(self):
+        for tool_name in (_sv.TOOL_ALLOW, _sv.TOOL_EGRESS_BLOCK):
+            with self.subTest(tool_name=tool_name):
+                tool = next(t for t in TOOL_DEFINITIONS if t["name"] == tool_name)
+                schema = tool["inputSchema"]
+                self.assertEqual("object", schema["type"])  # type: ignore[index]
+                self.assertEqual(
+                    ["routes_yaml", "justification"],
+                    schema["required"],  # type: ignore[index]
+                )
+
 
 class TestHandleToolsCall(unittest.TestCase):
     def setUp(self):
@@ -220,6 +239,26 @@ class TestHandleToolsCall(unittest.TestCase):
         self.assertIn("status: approved", text)
         self.assertIn("notes: lgtm", text)
 
+    def test_allow_round_trips_through_queue(self):
+        responder = self._respond_when_proposal_appears(_sv.STATUS_APPROVED, notes="ok")
+        try:
+            result = handle_tools_call(
+                {
+                    "name": _sv.TOOL_ALLOW,
+                    "arguments": {
+                        "routes_yaml": "routes:\n  - host: example.com\n",
+                        "justification": "need example.com",
+                    },
+                },
+                self.config,
+            )
+        finally:
+            responder.join()
+        self.assertFalse(result["isError"])  # type: ignore[index]
+        text = result["content"][0]["text"]  # type: ignore[index]
+        self.assertIn("status: approved", text)
+        self.assertIn("notes: ok", text)
+
     def test_rejected_response_sets_isError(self):
         responder = self._respond_when_proposal_appears(_sv.STATUS_REJECTED, notes="nope")
         try:
@@ -412,7 +451,8 @@ class TestHttpEndToEnd(unittest.TestCase):
         self.assertEqual(1, result["id"])
         names = [t["name"] for t in result["result"]["tools"]]  # type: ignore[index]
         self.assertIn(_sv.TOOL_CAPABILITY_BLOCK, names)
-        self.assertNotIn("egress-block", names)
+        self.assertIn(_sv.TOOL_ALLOW, names)
+        self.assertIn(_sv.TOOL_EGRESS_BLOCK, names)
 
     def test_unknown_method_returns_jsonrpc_error(self):
         result = self._post_jsonrpc(