fix(security): harden git_gate.py shell rendering with shlex.quote and name validation

Use shlex.quote() on name and upstream_url in git_gate_render_entrypoint()
so special characters (single quotes, spaces, semicolons) cannot break or
inject into the generated sh script.

Add _GIT_NAME_RE validation in GitEntry.from_repos_entry() to restrict
repo names to [A-Za-z0-9._-]+, making the manifest the first line of
defence and shlex.quote() the belt-and-suspenders backstop.

Closes #155

.codex/skills/quality-eval/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: quality-eval
+description: Use when the user asks to objectively evaluate, score, rate, audit, or quality-gate code, codebases, files, pull requests, or snippets using a strict 5-dimension engineering rubric with scores and refactoring steps.
+metadata:
+  short-description: Score code quality with a strict rubric
+---
+
+# Quality Eval
+
+## Role
+
+Act as a Staff Software Engineer and automated quality gate. Evaluate code objectively against the rubric below, surface hidden anti-patterns, and provide a mathematical grade with atomic refactoring steps.
+
+## Evaluation Rules
+
+- Evaluate only against the five rubric dimensions.
+- Be candid. Do not inflate scores for politeness.
+- Avoid generic advice. Every recommendation must name a specific code location, behavior, or pattern and include a concrete improvement direction.
+- Inspect the code before scoring. For codebases, read enough representative files, tests, and architecture boundaries to justify the scope.
+- When exact line numbers are available, cite them.
+- Do not reveal private chain-of-thought. In the required `Chain of Thought Analysis` section, provide a concise, step-by-step audit rationale with observable findings and score justifications.
+
+## Rubric
+
+Score each dimension from 1 to 5 using these anchors:
+
+| Dimension | Score 1 (Fail) | Score 3 (Pass) | Score 5 (Exemplary) |
+| :--- | :--- | :--- | :--- |
+| **Architecture** | Spaghettified; tight coupling; violated separation of concerns. | Modular but relies on leaky abstractions or mixed domains. | Strict domain isolation; follows SOLID; clear dependency inversion. |
+| **Readability** | Cryptic naming; deep nesting (>3 levels); widespread DRY violations. | Idiomatic but features over-complex functions or sparse documentation. | Self-documenting; expressive naming; high cohesion; flat structure. |
+| **Resilience** | Swallows errors blindly; lacks contextual logging; fragile to bad input. | Basic try/catch blocks present but lacks granular, typed error handling. | Explicit error boundaries; contextual logging; structured failure modes. |
+| **Testability** | Hardcoded dependencies make mocking or isolated testing impossible. | Pure functions are testable, but side-effect heavy logic lacks test hooks. | Decoupled IO; deterministic execution; structured for unit and integration tests. |
+| **SecOps** | Hardcoded secrets; O(n^2) bottlenecks; zero input sanitization. | Safe from obvious flaws but lacks deep defensive optimization. | Validated inputs; optimized algorithmic complexity; zero security debt. |
+
+## Scoring Method
+
+1. Determine the evaluated scope and primary language.
+2. Identify concrete evidence for each dimension.
+3. Assign integer dimension scores from 1 to 5.
+4. Compute `composite_score` as the arithmetic mean of the five dimension scores, rounded to one decimal place.
+5. Include code snippets only when they make a refactoring step more actionable.
+
+## Required Output
+
+Structure every response into exactly these three Markdown sections:
+
+### 1. Chain of Thought Analysis
+
+Provide a concise step-by-step audit rationale. Name specific files, functions, patterns, anti-patterns, and rubric anchors. Keep it evidence-based and do not include hidden private reasoning.
+
+### 2. Normalized Score Report
+
+```json
+{
+  "evaluation_metadata": {
+    "target_scope": "string",
+    "primary_language": "string"
+  },
+  "metrics": {
+    "architecture_and_modularity": 0,
+    "readability_and_maintainability": 0,
+    "error_handling_and_resilience": 0,
+    "testability_and_mocking": 0,
+    "security_and_performance": 0
+  },
+  "composite_score": 0.0
+}
+```
+
+### 3. Atomic Refactoring Playbook
+
+* **High Priority (To lift Score 1/2 to 3):**
+  - [ ] Actionable, specific refactoring step with file/line/context reference.
+* **Medium Priority (To lift Score 3 to 4/5):**
+  - [ ] Optimization or architectural pattern implementation step.
+

.codex/skills/quality-eval/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: Quality Eval
+short_description: Scores code quality with a strict five-dimension rubric and refactoring playbook.
+default_prompt: Evaluate this code objectively using the quality-eval rubric and return the three-section score report.

Dockerfile.codex

@@ -9,7 +9,7 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends git ca-certificates openssh-client socat curl dnsutils python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g --no-fund --no-audit @openai/codex@0.134.0 \
+RUN npm install -g --no-fund --no-audit @openai/codex@0.136.0 \
   && npm cache clean --force
 
 USER node

README.md

@@ -157,14 +157,8 @@ and MCP endpoints resolve without an agent-side change.
   upstream has *now* (fail-closed if unreachable). The agent's
   `~/.gitconfig` rewrites the real URL to the gate via `insteadOf`,
   so push, fetch, clone, and pull all route through. The agent
-  never sees the upstream credential. If the upstream's hostname
-  isn't resolvable from the gate container (e.g. a Tailscale-only
-  host whose public DNS points elsewhere), pin its IP via
-  `ExtraHosts: { "<hostname>": "<ip>" }` on the `bottle.git` entry —
-  the gate's `/etc/hosts` gets the override while the agent's
-  `insteadOf` rewrite still keys off the original hostname. Brought
-  up only when `bottle.git` has entries. Design in
-  `docs/prds/0008-git-gate.md`.
+  never sees the upstream credential. Brought up only when
+  `bottle.git` has entries. Design in `docs/prds/0008-git-gate.md`.
 - **cred-proxy image** — per-bottle sidecar (`python:3.13-alpine`
   base, stdlib-only) that holds API tokens declared in
   `bottle.cred_proxy.routes`. Each route names a `path`,

bot-bottle.demo.json

@@ -4,14 +4,15 @@
       "env": {
         "FAKE_TOKEN": "ghp_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4yZ"
       },
-      "git": [
-        {
-          "Name": "foo",
-          "Upstream": "ssh://git@upstream.invalid/path.git",
-          "IdentityFile": "~/.cache/bot-bottle-demo/fake-key",
-          "KnownHostKey": "ssh-ed25519 AAAAEXAMPLE"
+      "git-gate": {
+        "repos": {
+          "foo": {
+            "url": "ssh://git@upstream.invalid/path.git",
+            "identity": "~/.cache/bot-bottle-demo/fake-key",
+            "host_key": "ssh-ed25519 AAAAEXAMPLE"
+          }
         }
-      ]
+      }
     }
   },
 

bot_bottle/agent_provider.py

@@ -7,6 +7,7 @@ command, default image, and prompt/auth behavior.
 
 from __future__ import annotations
 
+import json
 import os
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -136,9 +137,11 @@ def agent_provision_plan(
     auth_token: str = "",
     forward_host_credentials: bool = False,
     host_env: dict[str, str] | None = None,
+    trusted_project_path: str = "",
 ) -> AgentProvisionPlan:
     runtime = runtime_for(template)
     resolved_guest_env = dict(guest_env or {})
+    trusted_path = trusted_project_path or guest_home
     env_vars: dict[str, str] = {}
     provisioned_env: dict[str, str] = {}
     dirs: list[AgentProvisionDir] = []
@@ -156,8 +159,9 @@ def agent_provision_plan(
         dirs.append(AgentProvisionDir(auth_dir))
         config_path = f"{auth_dir}/config.toml"
         config_file = state_dir / "codex-config.toml"
+        toml_path = trusted_path.replace("\\", "\\\\").replace('"', '\\"')
         config_file.write_text(
-            f'[projects."{guest_home}"]\n'
+            f'[projects."{toml_path}"]\n'
             'trust_level = "trusted"\n'
         )
         config_file.chmod(0o600)
@@ -202,6 +206,19 @@ def agent_provision_plan(
     if template == PROVIDER_CLAUDE:
         env_vars["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] = "1"
         env_vars["DISABLE_ERROR_REPORTING"] = "1"
+        claude_config = state_dir / "claude.json"
+        claude_projects = {
+            guest_home: {"hasTrustDialogAccepted": True},
+        }
+        claude_projects[trusted_path] = {"hasTrustDialogAccepted": True}
+        claude_config.write_text(json.dumps({
+            "hasCompletedOnboarding": True,
+            "theme": "dark",
+            "bypassPermissionsModeAccepted": True,
+            "projects": claude_projects,
+        }, indent=2) + "\n")
+        claude_config.chmod(0o600)
+        files.append(AgentProvisionFile(claude_config, f"{guest_home}/.claude.json"))
         egress_routes.append(EgressRoute(
             host="api.anthropic.com",
             auth_scheme="Bearer" if auth_token else "",

bot_bottle/backend/__init__.py

@@ -46,6 +46,7 @@ from ..log import die, info
 from ..manifest import GitEntry, Manifest
 from ..supervise import SupervisePlan
 from ..util import expand_tilde
+from ..workspace import WorkspacePlan
 from .print_util import print_multi, visible_agent_env_names
 from .util import host_skill_dir
 
@@ -79,6 +80,7 @@ class BottlePlan(ABC):
     egress_plan: EgressPlan
     supervise_plan: SupervisePlan | None
     agent_provision: AgentProvisionPlan
+    workspace_plan: WorkspacePlan
 
     def print(self, *, remote_control: bool) -> None:
         """Render the y/N preflight summary to stderr."""
@@ -320,7 +322,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         decide whether to add provider-specific prompt args to the agent's
         argv.
 
-        Default orchestration: ca → prompt → skills → git →
+        Default orchestration: ca → prompt → skills → workspace → git →
         supervise. CA install runs first so the agent's trust store
         is rebuilt before anything inside the agent makes a TLS call.
         Subclasses typically don't override this; they implement the
@@ -335,6 +337,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         prompt_path = self.provision_prompt(plan, target)
         self.provision_provider_auth(plan, target)
         self.provision_skills(plan, target)
+        self.provision_workspace(plan, target)
         self.provision_git(plan, target)
         self.provision_supervise(plan, target)
         return prompt_path
@@ -365,6 +368,11 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         """Copy the agent's named skills from the host into the
         running bottle. No-op when the agent has no skills."""
 
+    def provision_workspace(self, plan: PlanT, target: str) -> None:
+        """Copy the operator workspace into the running bottle when
+        the backend cannot bake it into the agent image. Default is
+        no-op for backends like Docker that handle this before launch."""
+
     @abstractmethod
     def provision_git(self, plan: PlanT, target: str) -> None:
         """Copy the host's cwd `.git` directory into the running
@@ -466,14 +474,20 @@ def enumerate_active_agents() -> list[ActiveAgent]:
     """All currently-running agents, across every available
     backend. Used by CLI `list active` and the dashboard's agents
     pane so neither has to know which backends exist. Skips
-    backends whose `is_available()` reports False. Ordered by
-    backend name, then by whatever each backend's
-    `enumerate_active` returns."""
+    backends whose `is_available()` reports False.
+
+    Sorted by `(started_at, slug)` so the list is stable across
+    dashboard refresh ticks — agents don't shift position while
+    the operator navigates with arrow keys. ISO 8601 timestamps
+    sort lexicographically in chronological order; `slug` is the
+    deterministic tiebreaker. Agents with missing metadata
+    (`started_at == ""`) sort first."""
     out: list[ActiveAgent] = []
     for name in known_backend_names():
         if not has_backend(name):
             continue
         out.extend(_BACKENDS[name].enumerate_active())
+    out.sort(key=lambda a: (a.started_at, a.slug))
     return out
 
 

bot_bottle/backend/docker/compose.py

@@ -49,7 +49,7 @@ from ...egress import (
     EGRESS_HOSTNAME,
     EGRESS_ROUTES_IN_CONTAINER,
 )
-from ...git_gate import GIT_GATE_HOSTNAME, git_gate_aggregate_extra_hosts
+from ...git_gate import GIT_GATE_HOSTNAME
 from ...log import die, warn
 from ...pipelock import PIPELOCK_HOSTNAME
 from ...supervise import (
@@ -198,7 +198,6 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
             env.append(token_env)
 
     # --- git-gate ----------------------------------------------------
-    extra_hosts: list[str] = []
     gp = plan.git_gate_plan
     if gp.upstreams:
         volumes += [
@@ -217,8 +216,6 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
                     u.known_hosts_file,
                     f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-known_hosts",
                 ))
-        extra_map = git_gate_aggregate_extra_hosts(gp.upstreams)
-        extra_hosts = [f"{host}:{ip}" for host, ip in sorted(extra_map.items())]
 
     # --- supervise ---------------------------------------------------
     sp = plan.supervise_plan
@@ -261,8 +258,6 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
         "environment": env,
         "volumes": volumes,
     }
-    if extra_hosts:
-        service["extra_hosts"] = extra_hosts
     return service
 
 

bot_bottle/backend/docker/launch.py

@@ -43,7 +43,7 @@ from pathlib import Path
 from typing import Callable, Generator
 
 from ...egress import egress_resolve_token_values
-from ...log import info
+from ...log import info, warn
 from . import network as network_mod
 from . import util as docker_mod
 from .bottle import DockerBottle
@@ -87,10 +87,11 @@ def launch(
     def teardown() -> None:
         try:
             stack.close()
-        except BaseException:
-            # Teardown must not raise; swallow so the caller's
-            # __exit__ path can still propagate the original error.
-            pass
+        except BaseException as exc:
+            warn(
+                f"teardown failed for container {plan.container_name}"
+                f" (compose-down): {exc!r}"
+            )
 
     try:
         # Step 1: agent image build. Sidecar images get built lazily by
@@ -101,7 +102,7 @@ def launch(
         )
         if plan.derived_image:
             docker_mod.build_image_with_cwd(
-                plan.derived_image, plan.image, plan.spec.user_cwd
+                plan.derived_image, plan.image, plan.workspace_plan
             )
 
         # Networks: compose-managed. The names are derived

bot_bottle/backend/docker/prepare.py

@@ -22,6 +22,7 @@ from ...git_gate import GitGate
 from ...log import die
 from ...pipelock import PipelockProxy
 from ...supervise import Supervise
+from ...workspace import workspace_plan as resolve_workspace_plan
 from .. import BottleSpec
 from . import util as docker_mod
 from .bottle_plan import DockerBottlePlan
@@ -62,6 +63,8 @@ def resolve_plan(
     bottle = manifest.bottle_for(spec.agent_name)
     provider = bottle.agent_provider
     provider_runtime = runtime_for(provider.template)
+    guest_home = os.environ.get("BOT_BOTTLE_CONTAINER_HOME", "/home/node")
+    workspace_plan = resolve_workspace_plan(spec, guest_home=guest_home)
 
     # PRD 0016 follow-up: identity, not bare slug. A fresh `start`
     # mints a random-suffixed identity (so parallel runs of the same
@@ -177,10 +180,11 @@ def resolve_plan(
         template=provider.template,
         dockerfile=dockerfile_path,
         state_dir=agent_dir,
-        guest_home=os.environ.get("BOT_BOTTLE_CONTAINER_HOME", "/home/node"),
+        guest_home=guest_home,
         forward_host_credentials=provider.forward_host_credentials,
         auth_token=provider.auth_token,
         host_env=dict(os.environ),
+        trusted_project_path=workspace_plan.workdir,
     )
     guest_env = dict(agent_provision.guest_env)
     for key, val in agent_provision.env_vars.items():
@@ -245,6 +249,7 @@ def resolve_plan(
         supervise_plan=supervise_plan,
         use_runsc=use_runsc,
         agent_provision=agent_provision,
+        workspace_plan=workspace_plan,
     )
 
 

bot_bottle/backend/docker/provision/git.py

@@ -3,7 +3,7 @@
 Three concerns, all about git in the agent:
 
   1. If --cwd was passed AND the host cwd has a .git, copy that .git
-     into /home/node/workspace/.git so the agent operates on the
+     into the planned guest workspace so the agent operates on the
      user's repo.
   2. If the bottle declares `git` entries (PRD 0008), write a
      ~/.gitconfig with insteadOf rules so every git operation
@@ -20,7 +20,6 @@ from __future__ import annotations
 
 import os
 import subprocess
-from pathlib import Path
 
 from ....git_gate import GIT_GATE_HOSTNAME, git_gate_render_gitconfig
 from ....log import info
@@ -40,19 +39,22 @@ def _provision_cwd_git(plan: DockerBottlePlan, target: str) -> None:
     """If --cwd was set and the host cwd has a .git directory, copy
     it into /home/node/workspace/.git and fix ownership. No-op
     otherwise."""
-    if not (plan.spec.copy_cwd and Path(plan.spec.user_cwd, ".git").is_dir()):
+    workspace = plan.workspace_plan
+    if not (workspace.enabled and workspace.copy_git and workspace.has_host_git_dir):
         return
     container = target
-    info(f"copying {plan.spec.user_cwd}/.git -> {container}:/home/node/workspace/.git")
+    guest_workspace_git = f"{workspace.guest_path}/.git"
+    host_git = str(workspace.host_path / ".git")
+    info(f"copying {host_git} -> {container}:{guest_workspace_git}")
     subprocess.run(
-        ["docker", "cp", f"{plan.spec.user_cwd}/.git", f"{container}:/home/node/workspace/.git"],
+        ["docker", "cp", host_git, f"{container}:{guest_workspace_git}"],
         stdout=subprocess.DEVNULL,
         check=True,
     )
     subprocess.run(
         [
             "docker", "exec", "-u", "0", container,
-            "chown", "-R", "node:node", "/home/node/workspace/.git",
+            "chown", "-R", workspace.owner, guest_workspace_git,
         ],
         stdout=subprocess.DEVNULL,
         check=True,

bot_bottle/backend/docker/util.py

@@ -7,9 +7,11 @@ from __future__ import annotations
 import re
 import shutil
 import subprocess
+import tempfile
 from typing import Iterable, Iterator
 
 from ...log import die, info
+from ...workspace import WorkspacePlan
 
 
 # Cap on the suffix the container-name conflict logic will try before
@@ -116,35 +118,39 @@ def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     subprocess.run(args, check=True)
 
 
-_TRUST_DIALOG_NODE_SCRIPT = (
-    'const fs=require("fs"),p=process.env.HOME+"/.claude.json",'
-    'c=JSON.parse(fs.readFileSync(p,"utf8"));'
-    'c.projects=c.projects||{};'
-    'c.projects[process.env.HOME+"/workspace"]={hasTrustDialogAccepted:true};'
-    'fs.writeFileSync(p,JSON.stringify(c,null,2));'
-)
-
-
-def build_image_with_cwd(derived: str, base: str, cwd: str) -> None:
-    """Build a thin derived image that copies <cwd> into
-    /home/node/workspace and adds a trust-dialog entry for it."""
+def build_image_with_cwd(
+    derived: str,
+    base: str,
+    workspace: WorkspacePlan,
+) -> None:
+    """Build a thin derived image that copies the workspace into
+    the plan's guest path and sets the plan's workdir."""
     import os
 
+    cwd = str(workspace.host_path)
     if not os.path.isdir(cwd):
         die(f"cwd not found at {cwd}")
-    info(f"building image {derived} from {base} with {cwd} -> /home/node/workspace")
-    dockerfile = (
-        f"FROM {base}\n"
-        f"COPY --chown=node:node . /home/node/workspace\n"
-        f"RUN node -e '{_TRUST_DIALOG_NODE_SCRIPT}'\n"
-        f"WORKDIR /home/node/workspace\n"
-    )
-    subprocess.run(
-        ["docker", "build", "-t", derived, "-f", "-", cwd],
-        input=dockerfile,
-        text=True,
-        check=True,
-    )
+    info(f"building image {derived} from {base} with {cwd} -> {workspace.guest_path}")
+    with tempfile.TemporaryDirectory(prefix="bot-bottle-cwd.") as tmp:
+        context_dir = os.path.join(tmp, "context")
+        staged_workspace = os.path.join(context_dir, "workspace")
+        shutil.copytree(
+            cwd,
+            staged_workspace,
+            symlinks=True,
+            ignore=shutil.ignore_patterns(".git"),
+        )
+        dockerfile = (
+            f"FROM {base}\n"
+            f"COPY --chown=node:node workspace/. {workspace.guest_path}\n"
+            f"WORKDIR {workspace.workdir}\n"
+        )
+        subprocess.run(
+            ["docker", "build", "-t", derived, "-f", "-", context_dir],
+            input=dockerfile,
+            text=True,
+            check=True,
+        )
 
 
 def image_id(ref: str) -> str:

bot_bottle/backend/smolmachines/backend.py

@@ -22,6 +22,7 @@ from .provision import prompt as _prompt
 from .provision import provider_auth as _provider_auth
 from .provision import skills as _skills
 from .provision import supervise as _supervise
+from .provision import workspace as _workspace
 
 
 class SmolmachinesBottleBackend(
@@ -72,6 +73,11 @@ class SmolmachinesBottleBackend(
     ) -> None:
         _skills.provision_skills(plan, target)
 
+    def provision_workspace(
+        self, plan: SmolmachinesBottlePlan, target: str
+    ) -> None:
+        _workspace.provision_workspace(plan, target)
+
     def provision_git(
         self, plan: SmolmachinesBottlePlan, target: str
     ) -> None:

bot_bottle/backend/smolmachines/launch.py

@@ -349,7 +349,6 @@ def _bundle_launch_spec(
             env.append(token_env)
 
     # --- git-gate ---------------------------------------------
-    extra_hosts: list[str] = []
     gp = plan.git_gate_plan
     if gp.upstreams:
         daemons += ["git-gate", "git-http"]

bot_bottle/backend/smolmachines/prepare.py

@@ -32,6 +32,7 @@ from ...env import resolve_env
 from ...git_gate import GitGate
 from ...pipelock import PipelockProxy
 from ...supervise import Supervise
+from ...workspace import workspace_plan as resolve_workspace_plan
 from .bottle_plan import SmolmachinesBottlePlan
 from .util import smolmachines_bundle_subnet, smolmachines_preflight
 
@@ -60,6 +61,8 @@ def resolve_plan(
     bottle = manifest.bottle_for(spec.agent_name)
     provider = bottle.agent_provider
     provider_runtime = runtime_for(provider.template)
+    guest_home = os.environ.get("BOT_BOTTLE_GUEST_HOME", "/home/node")
+    workspace_plan = resolve_workspace_plan(spec, guest_home=guest_home)
 
     slug = spec.identity or bottle_identity(spec.agent_name)
 
@@ -130,11 +133,12 @@ def resolve_plan(
         template=provider.template,
         dockerfile=agent_dockerfile_path,
         state_dir=agent_dir,
-        guest_home=os.environ.get("BOT_BOTTLE_GUEST_HOME", "/home/node"),
+        guest_home=guest_home,
         guest_env=guest_env,
         forward_host_credentials=provider.forward_host_credentials,
         auth_token=provider.auth_token,
         host_env=dict(os.environ),
+        trusted_project_path=workspace_plan.workdir,
     )
     merged_guest_env = dict(agent_provision.guest_env)
     for key, val in agent_provision.env_vars.items():
@@ -181,6 +185,7 @@ def resolve_plan(
         egress_plan=egress_plan,
         supervise_plan=supervise_plan,
         agent_provision=agent_provision,
+        workspace_plan=workspace_plan,
     )
 
 

bot_bottle/backend/smolmachines/provision/git.py

@@ -4,7 +4,7 @@
 Three concerns, all about git in the agent:
 
   1. If --cwd was passed AND the host cwd has a .git, copy that
-     .git into /home/node/workspace/.git so the agent operates on
+     .git into the planned guest workspace so the agent operates on
      the user's repo.
   2. If the bottle declares `git` entries (PRD 0008), write a
      ~/.gitconfig with insteadOf rules so every git operation
@@ -58,20 +58,22 @@ def _provision_cwd_git(plan: SmolmachinesBottlePlan, target: str) -> None:
     """If --cwd was set and the host cwd has a .git directory, copy
     it into <guest_home>/workspace/.git and fix ownership. No-op
     otherwise."""
-    if not (plan.spec.copy_cwd and Path(plan.spec.user_cwd, ".git").is_dir()):
+    workspace = plan.workspace_plan
+    if not (workspace.enabled and workspace.copy_git and workspace.has_host_git_dir):
         return
-    guest_workspace_git = f"{_guest_home()}/workspace/.git"
-    info(f"copying {plan.spec.user_cwd}/.git -> {target}:{guest_workspace_git}")
+    guest_workspace_git = f"{workspace.guest_path}/.git"
+    host_git = str(workspace.host_path / ".git")
+    info(f"copying {host_git} -> {target}:{guest_workspace_git}")
     # mkdir -p the workspace dir so `machine cp` lands the .git
     # directly there even on first-time bottles.
-    _smolvm.machine_exec(target, ["mkdir", "-p", f"{_guest_home()}/workspace"])
+    _smolvm.machine_exec(target, ["mkdir", "-p", workspace.guest_path])
     _smolvm.machine_cp(
-        f"{plan.spec.user_cwd}/.git", f"{target}:{guest_workspace_git}",
+        host_git, f"{target}:{guest_workspace_git}",
     )
     # `machine cp` lands files as root; the agent runs as node so
     # the workspace tree must be chowned over.
     _smolvm.machine_exec(
-        target, ["chown", "-R", "node:node", guest_workspace_git],
+        target, ["chown", "-R", workspace.owner, guest_workspace_git],
     )
 
 

bot_bottle/backend/smolmachines/provision/workspace.py

@@ -0,0 +1,36 @@
+"""Copy the operator workspace into a smolmachines guest."""
+
+from __future__ import annotations
+
+import shlex
+
+from ....log import info
+from .. import smolvm as _smolvm
+from ..bottle_plan import SmolmachinesBottlePlan
+
+
+def provision_workspace(plan: SmolmachinesBottlePlan, target: str) -> None:
+    """Copy host cwd contents to the planned guest workspace."""
+    workspace = plan.workspace_plan
+    if not (workspace.enabled and workspace.copy_contents):
+        return
+
+    guest_parent = workspace.guest_path.rsplit("/", 1)[0] or "/"
+    guest_path_q = shlex.quote(workspace.guest_path)
+    guest_parent_q = shlex.quote(guest_parent)
+    owner_q = shlex.quote(workspace.owner)
+    mode_q = shlex.quote(workspace.mode)
+    info(f"copying {workspace.host_path} -> {target}:{workspace.guest_path}")
+    _smolvm.machine_exec(
+        target,
+        ["sh", "-c", f"rm -rf {guest_path_q} && mkdir -p {guest_parent_q}"],
+    )
+    _smolvm.machine_cp(str(workspace.host_path), f"{target}:{workspace.guest_path}")
+    _smolvm.machine_exec(
+        target,
+        [
+            "sh", "-c",
+            f"chown -R {owner_q} {guest_path_q} && "
+            f"chmod {mode_q} {guest_path_q}",
+        ],
+    )

bot_bottle/codex_auth.py

@@ -122,6 +122,14 @@ def _dummy_exp(now: datetime | None, exp_ts: int | None) -> int:
     return int(check_now.timestamp()) + 3600
 
 
+def _dummy_timestamp(now: datetime | None = None) -> str:
+    check_now = now or datetime.now(timezone.utc)
+    if check_now.tzinfo is None:
+        check_now = check_now.replace(tzinfo=timezone.utc)
+    check_now = check_now.astimezone(timezone.utc)
+    return check_now.isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
 def _dummy_jwt(now: datetime | None = None, *, exp_ts: int | None = None) -> str:
     return _encode_dummy_jwt({
         "exp": _dummy_exp(now, exp_ts),
@@ -247,6 +255,10 @@ def _redact_codex_auth(
             out[key] = inner
         elif lower == "openai_api_key":
             out[key] = None
+        elif lower == "last_refresh":
+            # Codex parses this as a timestamp on startup. Keep the
+            # schema valid without copying host-side session metadata.
+            out[key] = _dummy_timestamp(now)
         elif lower == "tokens":
             out[key] = _redact_token_block(inner, now=now, exp_ts=exp_ts)
         else:

bot_bottle/git_gate.py

@@ -29,12 +29,11 @@ backend-specific and lives on concrete subclasses (see
 
 from __future__ import annotations
 
+import shlex
 from abc import ABC, abstractmethod
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from pathlib import Path
-from typing import Mapping
 
-from .log import die
 from .manifest import Bottle, GitEntry
 
 
@@ -47,10 +46,6 @@ GIT_GATE_HOSTNAME = "git-gate"
 GIT_GATE_DAEMON_TIMEOUT_SECS = 15
 
 
-def _empty_str_map() -> dict[str, str]:
-    return {}
-
-
 @dataclass(frozen=True)
 class GitGateUpstream:
     """One bare repo on the gate. `name` drives the bare-repo path
@@ -64,10 +59,7 @@ class GitGateUpstream:
     KnownHostKey string from the manifest; the gate's start step
     materialises it into a known_hosts file if non-empty.
 
-    `extra_hosts` is a `{hostname: ip}` map the backend injects into
-    the gate container's `/etc/hosts` via `--add-host` so the gate
-    can resolve upstream hostnames that aren't reachable via the
-    container's default DNS (e.g. Tailscale-only hosts)."""
+    the gate credential paths inside the running sidecar."""
 
     name: str
     upstream_url: str
@@ -76,7 +68,6 @@ class GitGateUpstream:
     identity_file: str
     known_host_key: str
     known_hosts_file: Path = Path()
-    extra_hosts: Mapping[str, str] = field(default_factory=_empty_str_map)
 
 
 @dataclass(frozen=True)
@@ -113,38 +104,11 @@ def git_gate_upstreams_for_bottle(bottle: Bottle) -> tuple[GitGateUpstream, ...]
             upstream_port=e.UpstreamPort,
             identity_file=e.IdentityFile,
             known_host_key=e.KnownHostKey,
-            extra_hosts=dict(e.ExtraHosts),
         )
         for e in bottle.git
     )
 
 
-def git_gate_aggregate_extra_hosts(
-    upstreams: tuple[GitGateUpstream, ...],
-) -> dict[str, str]:
-    """Merge every upstream's `extra_hosts` into a single
-    `{hostname: ip}` map for `--add-host` on the gate container. Two
-    entries naming the same hostname with different IPs is a manifest
-    bug — the gate has one /etc/hosts — so die loudly with the
-    conflicting names rather than silently picking one."""
-    merged: dict[str, str] = {}
-    source: dict[str, str] = {}
-    for u in upstreams:
-        for host, ip in u.extra_hosts.items():
-            existing = merged.get(host)
-            if existing is None:
-                merged[host] = ip
-                source[host] = u.name
-            elif existing != ip:
-                die(
-                    f"git-gate ExtraHosts conflict: '{host}' maps to "
-                    f"'{existing}' in upstream '{source[host]}' and to "
-                    f"'{ip}' in upstream '{u.name}'. The gate has one "
-                    f"/etc/hosts; pick one IP."
-                )
-    return merged
-
-
 def git_gate_render_gitconfig(
     entries: tuple[GitEntry, ...], gate_host: str, *, scheme: str = "git",
 ) -> str:
@@ -244,10 +208,7 @@ def git_gate_render_entrypoint(upstreams: tuple[GitGateUpstream, ...]) -> str:
         "mkdir -p /git",
     ]
     for u in upstreams:
-        # Single-quote args so URL/path content (containing : and /)
-        # passes through ash unmangled. Names came through the manifest
-        # validator so they don't contain a single quote.
-        lines.append(f"init_repo '{u.name}' '{u.upstream_url}'")
+        lines.append(f"init_repo {shlex.quote(u.name)} {shlex.quote(u.upstream_url)}")
     lines.extend([
         "",
         "exec git daemon \\",
@@ -443,7 +404,6 @@ class GitGate(ABC):
                     identity_file=u.identity_file,
                     known_host_key=u.known_host_key,
                     known_hosts_file=known_hosts_file,
-                    extra_hosts=dict(u.extra_hosts),
                 )
             )
         return GitGatePlan(

bot_bottle/git_http_backend.py

@@ -49,6 +49,18 @@ class GitHttpHandler(BaseHTTPRequestHandler):
                 check=False,
             )
             if hook.returncode != 0:
+                detail = (hook.stderr or hook.stdout).decode(
+                    "utf-8", errors="replace",
+                ).rstrip()
+                if detail:
+                    for line in detail.splitlines():
+                        self.log_message("access-hook denied %s: %s",
+                                         parsed.path, line)
+                else:
+                    self.log_message(
+                        "access-hook denied %s: exit=%d (no output)",
+                        parsed.path, hook.returncode,
+                    )
                 self.send_response(403)
                 self.send_header("Content-Type", "text/plain; charset=utf-8")
                 self.end_headers()

bot_bottle/manifest.py

@@ -14,9 +14,9 @@ the system prompt, for bottles the body is human documentation
 Bottle schema (frontmatter):
   extends:      <bottle-name>                   # optional (PRD 0025)
   env:          { <NAME>: <env-entry>, ... }
-  git:
+  git-gate:                                     # optional (PRD 0047)
     user:       { name: <str>, email: <str> }   # optional
-    remotes:    { <host>: <git-entry>, ... }    # optional
+    repos:      { <name>: <git-gate-entry>, ... }  # optional
   egress: { routes: [ <egress-route>, ... ] }
     # route keys: host, path_allowlist, auth, role, pipelock
     # pipelock: { tls_passthrough: <bool>, ssrf_ip_allowlist: [<cidr>, ...] }
@@ -25,6 +25,8 @@ Bottle schema (frontmatter):
 Agent schema (frontmatter):
   bottle:        <bottle-name>          # required
   skills:        [ <skill-name>, ... ]   # optional
+  git-gate:
+    user:        { name: <str>, email: <str> }  # optional; overlays bottle
   # Claude Code subagent passthrough fields — accepted, ignored:
   name, description, model, color, memory
 
@@ -43,541 +45,48 @@ on-disk files.
 
 from __future__ import annotations
 
-import ipaddress
 import os
 from dataclasses import dataclass, field, replace
 from pathlib import Path
-from typing import Mapping, cast
+from typing import Mapping
 
-from .agent_provider import PROVIDER_TEMPLATES
-from .log import warn
-from .manifest_schema import AGENT_MODEL_KEYS, BOTTLE_KEYS
+from .manifest_util import ManifestError, as_json_object
+from .manifest_agent import Agent, AgentProvider
+from .manifest_egress import (
+    EGRESS_AUTH_SCHEMES,
+    EgressConfig,
+    EgressRoute,
+    PipelockRoutePolicy,
+    validate_egress_routes,
+)
+from .manifest_git import GitEntry, GitUser, parse_git_gate_config
+from .manifest_schema import BOTTLE_KEYS
 
-
-class ManifestError(Exception):
-    """A manifest file (or the manifest tree) is invalid."""
+# Re-export everything that callers currently import from this module.
+__all__ = [
+    "ManifestError",
+    "GitEntry",
+    "GitUser",
+    "AgentProvider",
+    "EGRESS_AUTH_SCHEMES",
+    "PipelockRoutePolicy",
+    "EgressRoute",
+    "EgressConfig",
+    "Agent",
+    "Bottle",
+    "Manifest",
+]
 
 
 def _empty_str_dict() -> dict[str, str]:
     return {}
 
 
-@dataclass(frozen=True)
-class GitEntry:
-    """One upstream the per-agent git-gate (PRD 0008) is allowed to
-    talk to. `Upstream` is the real remote URL the agent would push to
-    if there were no gate; the gate hosts a bare repo at /git/<Name>.git
-    and `IdentityFile` is the SSH key the gate uses to push that repo
-    upstream after gitleaks passes. The agent itself never holds the
-    upstream credential.
-
-    `ExtraHosts` is an optional `{hostname: ip}` map injected into the
-    gate container's `/etc/hosts` via `--add-host`. Use it when the
-    Upstream's hostname isn't resolvable from the gate (e.g. a
-    Tailscale-only host whose public DNS A record points elsewhere):
-    the agent's `insteadOf` rewrite still matches the original
-    hostname, but the gate routes to the right IP.
-
-    The Upstream URL is parsed once at construction and the pieces are
-    stashed in the `Upstream*` fields so the git-gate render step
-    doesn't have to re-parse."""
-
-    Name: str
-    Upstream: str
-    IdentityFile: str
-    KnownHostKey: str = ""
-    ExtraHosts: Mapping[str, str] = field(default_factory=_empty_str_dict)
-    RemoteKey: str = ""
-    UpstreamUser: str = ""
-    UpstreamHost: str = ""
-    UpstreamPort: str = ""
-    UpstreamPath: str = ""
-
-    @classmethod
-    def from_dict(cls, bottle_name: str, idx: int, raw: object) -> "GitEntry":
-        d = _as_json_object(raw, f"bottle '{bottle_name}' git[{idx}]")
-        return cls._from_object(bottle_name, d, f"git[{idx}]", None)
-
-    @classmethod
-    def from_remote_dict(
-        cls, bottle_name: str, host_key: str, raw: object
-    ) -> "GitEntry":
-        if not host_key:
-            raise ManifestError(f"bottle '{bottle_name}' git.remotes has an empty host key")
-        d = _as_json_object(raw, f"bottle '{bottle_name}' git.remotes[{host_key!r}]")
-        return cls._from_object(
-            bottle_name, d, f"git.remotes[{host_key!r}]", host_key,
-        )
-
-    @classmethod
-    def _from_object(
-        cls,
-        bottle_name: str,
-        d: dict[str, object],
-        label: str,
-        host_key: str | None,
-    ) -> "GitEntry":
-        name = d.get("Name")
-        if not isinstance(name, str) or not name:
-            raise ManifestError(
-                f"bottle '{bottle_name}' {label} missing required string "
-                f"field 'Name'"
-            )
-        upstream = d.get("Upstream")
-        if not isinstance(upstream, str) or not upstream:
-            raise ManifestError(
-                f"bottle '{bottle_name}' {label} '{name}' missing required string field "
-                f"'Upstream'"
-            )
-        ident = d.get("IdentityFile")
-        if not isinstance(ident, str) or not ident:
-            raise ManifestError(
-                f"bottle '{bottle_name}' {label} '{name}' missing required string field "
-                f"'IdentityFile'"
-            )
-        khk = _opt_str(
-            d.get("KnownHostKey"),
-            f"bottle '{bottle_name}' {label} '{name}' KnownHostKey",
-        )
-        extra_hosts = _opt_extra_hosts(
-            d.get("ExtraHosts"),
-            f"bottle '{bottle_name}' {label} '{name}' ExtraHosts",
-        )
-        user, host, port, path = _parse_git_upstream(
-            upstream, f"bottle '{bottle_name}' {label} '{name}' Upstream"
-        )
-        if (
-            host_key is not None
-            and host_key != host
-            and not _is_ip_literal(host)
-        ):
-            raise ManifestError(
-                f"bottle '{bottle_name}' git.remotes key {host_key!r} "
-                f"does not match Upstream host {host!r}"
-            )
-        return cls(
-            Name=name,
-            Upstream=upstream,
-            IdentityFile=ident,
-            KnownHostKey=khk,
-            ExtraHosts=extra_hosts,
-            RemoteKey=host_key or host,
-            UpstreamUser=user,
-            UpstreamHost=host,
-            UpstreamPort=port,
-            UpstreamPath=path,
-        )
-
-
-# Auth schemes for the egress route's optional `auth` block.
-# Same values cred-proxy accepts today; `token` sidesteps the Gitea
-# token-not-Bearer quirk (go-gitea/gitea#16734).
-EGRESS_AUTH_SCHEMES = ("Bearer", "token")
-
-
-@dataclass(frozen=True)
-class AgentProvider:
-    """Provider/template for the agent process inside a bottle.
-
-    `template` selects a built-in launch/runtime contract. `dockerfile`
-    optionally points at a custom agent-image Dockerfile while leaving
-    bot-bottle's sidecar infrastructure intact.
-
-    `auth_token` names the host env var that holds the provider's OAuth
-    token (Claude only). The provisioner injects a provider-owned egress
-    route for api.anthropic.com that re-injects this token as the Bearer
-    header, and sets a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent
-    so the Claude Code CLI starts.
-
-    `forward_host_credentials` forwards the host Codex auth token into
-    the egress sidecar (Codex only).
-    """
-
-    template: str = "claude"
-    dockerfile: str = ""
-    auth_token: str = ""
-    forward_host_credentials: bool = False
-
-    @classmethod
-    def from_dict(cls, bottle_name: str, raw: object) -> "AgentProvider":
-        d = _as_json_object(raw, f"bottle '{bottle_name}' agent_provider")
-        for k in d:
-            if k not in {"template", "dockerfile", "auth_token", "forward_host_credentials"}:
-                raise ManifestError(
-                    f"bottle '{bottle_name}' agent_provider has unknown key {k!r}; "
-                    f"allowed: template, dockerfile, auth_token, forward_host_credentials"
-                )
-        template = d.get("template", "claude")
-        if not isinstance(template, str) or not template:
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.template must be a "
-                f"non-empty string"
-            )
-        if template not in PROVIDER_TEMPLATES:
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.template {template!r} "
-                f"is not one of {', '.join(sorted(PROVIDER_TEMPLATES))}"
-            )
-        dockerfile = d.get("dockerfile", "")
-        if not isinstance(dockerfile, str):
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.dockerfile must be a "
-                f"string (was {type(dockerfile).__name__})"
-            )
-        auth_token = d.get("auth_token", "")
-        if not isinstance(auth_token, str):
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.auth_token must be a "
-                f"string (was {type(auth_token).__name__})"
-            )
-        if auth_token and template != "claude":
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.auth_token is only "
-                f"supported for template 'claude'"
-            )
-        forward_host_credentials = d.get("forward_host_credentials", False)
-        if not isinstance(forward_host_credentials, bool):
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
-                f"must be a boolean (was {type(forward_host_credentials).__name__})"
-            )
-        if forward_host_credentials and template != "codex":
-            raise ManifestError(
-                f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
-                "is currently only supported for template 'codex'"
-            )
-        return cls(
-            template=template,
-            dockerfile=dockerfile,
-            auth_token=auth_token,
-            forward_host_credentials=forward_host_credentials,
-        )
-
-
-@dataclass(frozen=True)
-class GitUser:
-    """Per-bottle `git config --global user.name` / `user.email`
-    pair (issue #86). The agent's commits inside the bottle are
-    attributed to this identity rather than the agent image's
-    image-baked default (no user, or whatever the image dropped
-    in). Either or both fields can be set independently.
-
-    `from_dict` is forgiving on shape (a single missing field is
-    fine — we just skip that config line at provisioning) but
-    strict on types (string-or-die)."""
-
-    name: str = ""
-    email: str = ""
-
-    @classmethod
-    def from_dict(cls, bottle_name: str, raw: object) -> "GitUser":
-        d = _as_json_object(raw, f"bottle '{bottle_name}' git.user")
-        for k in d.keys():
-            if k not in {"name", "email"}:
-                raise ManifestError(
-                    f"bottle '{bottle_name}' git.user has unknown key {k!r}; "
-                    f"allowed: name, email"
-                )
-        name = d.get("name", "")
-        email = d.get("email", "")
-        if not isinstance(name, str):
-            raise ManifestError(
-                f"bottle '{bottle_name}' git.user.name must be a string "
-                f"(was {type(name).__name__})"
-            )
-        if not isinstance(email, str):
-            raise ManifestError(
-                f"bottle '{bottle_name}' git.user.email must be a string "
-                f"(was {type(email).__name__})"
-            )
-        if not name and not email:
-            raise ManifestError(
-                f"bottle '{bottle_name}' git.user is set but neither "
-                f"name nor email is non-empty; remove the block or "
-                f"fill at least one field."
-            )
-        return cls(name=name, email=email)
-
-    def is_empty(self) -> bool:
-        return not self.name and not self.email
-
-
-def _parse_git_config(
-    bottle_name: str,
-    raw: object,
-) -> tuple[tuple[GitEntry, ...], GitUser]:
-    d = _as_json_object(raw, f"bottle '{bottle_name}' git")
-    for k in d.keys():
-        if k not in {"user", "remotes"}:
-            raise ManifestError(
-                f"bottle '{bottle_name}' git has unknown key {k!r}; "
-                f"allowed: user, remotes"
-            )
-
-    git_user = (
-        GitUser.from_dict(bottle_name, d["user"])
-        if "user" in d
-        else GitUser()
-    )
-
-    git: tuple[GitEntry, ...] = ()
-    remotes_raw = d.get("remotes")
-    if remotes_raw is not None:
-        remotes = _as_json_object(remotes_raw, f"bottle '{bottle_name}' git.remotes")
-        git = tuple(
-            GitEntry.from_remote_dict(bottle_name, host, entry)
-            for host, entry in remotes.items()
-        )
-        _validate_unique_git_names(bottle_name, git)
-
-    return git, git_user
-
-
-@dataclass(frozen=True)
-class PipelockRoutePolicy:
-    """Per-route pipelock policy overrides.
-
-    `TlsPassthrough` adds the route host to pipelock's
-    `tls_interception.passthrough_domains`, so pipelock still enforces
-    the hostname allowlist but does not MITM/decrypt request bodies or
-    headers for that host.
-
-    `SsrfIpAllowlist` adds explicit IPs/CIDRs to pipelock's SSRF
-    allowlist for private/internal destinations behind this route.
-    """
-
-    TlsPassthrough: bool = False
-    SsrfIpAllowlist: tuple[str, ...] = ()
-
-    @classmethod
-    def from_dict(
-        cls, bottle_name: str, idx: int, raw: object,
-    ) -> "PipelockRoutePolicy":
-        label = f"bottle '{bottle_name}' egress.routes[{idx}] pipelock"
-        d = _as_json_object(raw, label)
-        for k in d:
-            if k not in ("tls_passthrough", "ssrf_ip_allowlist"):
-                raise ManifestError(
-                    f"{label} has unknown key {k!r}; "
-                    f"only 'tls_passthrough' and 'ssrf_ip_allowlist' "
-                    f"are accepted"
-                )
-        tls_passthrough_raw = d.get("tls_passthrough", False)
-        if not isinstance(tls_passthrough_raw, bool):
-            raise ManifestError(
-                f"{label}.tls_passthrough must be a boolean "
-                f"(was {type(tls_passthrough_raw).__name__})"
-            )
-        ssrf_raw = d.get("ssrf_ip_allowlist", [])
-        if not isinstance(ssrf_raw, list):
-            raise ManifestError(
-                f"{label}.ssrf_ip_allowlist must be an array "
-                f"(was {type(ssrf_raw).__name__})"
-            )
-        ssrf_ip_allowlist: list[str] = []
-        for j, item in enumerate(ssrf_raw):
-            if not isinstance(item, str) or not item:
-                raise ManifestError(
-                    f"{label}.ssrf_ip_allowlist[{j}] must be a non-empty "
-                    f"string (was {type(item).__name__})"
-                )
-            try:
-                ipaddress.ip_network(item, strict=False)
-            except ValueError as e:
-                raise ManifestError(
-                    f"{label}.ssrf_ip_allowlist[{j}] must be an IP address "
-                    f"or CIDR (was {item!r}): {e}"
-                )
-            ssrf_ip_allowlist.append(item)
-        return cls(
-            TlsPassthrough=tls_passthrough_raw,
-            SsrfIpAllowlist=tuple(ssrf_ip_allowlist),
-        )
-
-
-@dataclass(frozen=True)
-class EgressRoute:
-    """One route on the per-bottle egress sidecar (PRD 0017).
-
-    `Host` matches the request's hostname (case-insensitive). The
-    optional `PathAllowlist` constrains the URL path to a set of
-    prefixes; empty tuple means no path-level filtering. The optional
-    `AuthScheme` / `TokenRef` pair drives credential injection:
-    when set, the proxy strips any inbound Authorization and injects
-    `<AuthScheme> <value-of-host-env-named-by-TokenRef>`. When the
-    manifest's `auth` block is omitted both fields are empty strings —
-    no Authorization is written, no token forwarded.
-
-    `Role` is reserved for future use; all role strings are currently
-    rejected by the validator.
-
-    Validation rules (enforced in `from_dict`):
-      - `host` required, non-empty.
-      - `path_allowlist` optional, list of absolute path prefixes.
-      - `auth` optional. If present, MUST carry both `scheme` and
-        `token_ref` as non-empty strings; an empty `auth: {}` is an
-        error rather than a synonym for "no auth" (omit `auth` for
-        that case).
-      - `role` optional, reserved — any non-empty value is rejected.
-    """
-
-    Host: str
-    PathAllowlist: tuple[str, ...] = ()
-    AuthScheme: str = ""
-    TokenRef: str = ""
-    Role: tuple[str, ...] = ()
-    Pipelock: PipelockRoutePolicy = field(default_factory=PipelockRoutePolicy)
-
-    @classmethod
-    def from_dict(cls, bottle_name: str, idx: int, raw: object) -> "EgressRoute":
-        label = f"bottle '{bottle_name}' egress.routes[{idx}]"
-        d = _as_json_object(raw, label)
-        host = d.get("host")
-        if not isinstance(host, str) or not host:
-            raise ManifestError(f"{label} missing required string field 'host'")
-
-        path_allow_raw = d.get("path_allowlist")
-        prefixes: tuple[str, ...] = ()
-        if path_allow_raw is not None:
-            if not isinstance(path_allow_raw, list):
-                raise ManifestError(
-                    f"{label} path_allowlist must be an array "
-                    f"(was {type(path_allow_raw).__name__})"
-                )
-            path_list = cast(list[object], path_allow_raw)
-            collected: list[str] = []
-            for j, p in enumerate(path_list):
-                if not isinstance(p, str):
-                    raise ManifestError(
-                        f"{label} path_allowlist[{j}] must be a string "
-                        f"(was {type(p).__name__})"
-                    )
-                if not p.startswith("/"):
-                    raise ManifestError(
-                        f"{label} path_allowlist[{j}] {p!r} must be an "
-                        f"absolute path prefix starting with '/'"
-                    )
-                collected.append(p)
-            prefixes = tuple(collected)
-
-        auth_scheme = ""
-        token_ref = ""
-        if "auth" in d:
-            auth_raw = d.get("auth")
-            auth_d = _as_json_object(auth_raw, f"{label} auth")
-            if not auth_d:
-                raise ManifestError(
-                    f"{label} auth is empty ({{}}); omit the 'auth' key "
-                    f"entirely if this route is unauthenticated. Otherwise "
-                    f"both 'scheme' and 'token_ref' are required."
-                )
-            auth_scheme_raw = auth_d.get("scheme")
-            if not isinstance(auth_scheme_raw, str) or not auth_scheme_raw:
-                raise ManifestError(
-                    f"{label} auth.scheme is required when 'auth' is set "
-                    f"(non-empty string)"
-                )
-            if auth_scheme_raw not in EGRESS_AUTH_SCHEMES:
-                raise ManifestError(
-                    f"{label} auth.scheme {auth_scheme_raw!r} is not one of "
-                    f"{', '.join(EGRESS_AUTH_SCHEMES)}"
-                )
-            token_ref_raw = auth_d.get("token_ref")
-            if not isinstance(token_ref_raw, str) or not token_ref_raw:
-                raise ManifestError(
-                    f"{label} auth.token_ref is required when 'auth' is set "
-                    f"(name of the host env var holding the token value)"
-                )
-            for k in auth_d:
-                if k not in ("scheme", "token_ref"):
-                    raise ManifestError(
-                        f"{label} auth has unknown key {k!r}; "
-                        f"only 'scheme' and 'token_ref' are accepted"
-                    )
-            auth_scheme = auth_scheme_raw
-            token_ref = token_ref_raw
-
-        role_raw = d.get("role")
-        roles: tuple[str, ...] = ()
-        if role_raw is None:
-            roles = ()
-        elif isinstance(role_raw, str):
-            roles = (role_raw,)
-        elif isinstance(role_raw, list):
-            role_list = cast(list[object], role_raw)
-            collected_roles: list[str] = []
-            for r in role_list:
-                if not isinstance(r, str):
-                    raise ManifestError(f"{label} role items must be strings (got {type(r).__name__})")
-                collected_roles.append(r)
-            roles = tuple(collected_roles)
-        else:
-            raise ManifestError(
-                f"{label} role must be a string or a list of strings "
-                f"(was {type(role_raw).__name__})"
-            )
-        if roles:
-            raise ManifestError(
-                f"{label} role {roles[0]!r} is not accepted; "
-                f"the 'role' field is reserved for future use"
-            )
-
-        pipelock = (
-            PipelockRoutePolicy.from_dict(bottle_name, idx, d["pipelock"])
-            if "pipelock" in d
-            else PipelockRoutePolicy()
-        )
-
-        for k in d:
-            if k not in ("host", "path_allowlist", "auth", "role", "pipelock"):
-                raise ManifestError(
-                    f"{label} has unknown key {k!r}; accepted keys are "
-                    f"'host', 'path_allowlist', 'auth', 'role', 'pipelock'"
-                )
-
-        return cls(
-            Host=host,
-            PathAllowlist=prefixes,
-            AuthScheme=auth_scheme,
-            TokenRef=token_ref,
-            Role=roles,
-            Pipelock=pipelock,
-        )
-
-
-@dataclass(frozen=True)
-class EgressConfig:
-    """Per-bottle egress configuration. Today this is just the
-    route table; the nesting under `egress:` leaves room for
-    per-bottle proxy settings (port override, log level, etc.) in
-    follow-ups."""
-
-    routes: tuple[EgressRoute, ...] = ()
-
-    @classmethod
-    def from_dict(cls, bottle_name: str, raw: object) -> "EgressConfig":
-        d = _as_json_object(raw, f"bottle '{bottle_name}' egress")
-        routes_raw = d.get("routes")
-        routes: tuple[EgressRoute, ...] = ()
-        if routes_raw is not None:
-            if not isinstance(routes_raw, list):
-                raise ManifestError(
-                    f"bottle '{bottle_name}' egress.routes must be an array "
-                    f"(was {type(routes_raw).__name__})"
-                )
-            routes_list = cast(list[object], routes_raw)
-            routes = tuple(
-                EgressRoute.from_dict(bottle_name, i, entry)
-                for i, entry in enumerate(routes_list)
-            )
-            _validate_egress_routes(bottle_name, routes)
-        for k in d:
-            if k != "routes":
-                raise ManifestError(
-                    f"bottle '{bottle_name}' egress has unknown key {k!r}; "
-                    f"only 'routes' is accepted"
-                )
-        return cls(routes=routes)
+def _section_dict(value: object, label: str) -> dict[str, object]:
+    """Like as_json_object but treats absent/null as an empty section."""
+    if value is None:
+        return {}
+    return as_json_object(value, label)
 
 
 @dataclass(frozen=True)
@@ -586,10 +95,9 @@ class Bottle:
     agent_provider: AgentProvider = field(default_factory=AgentProvider)
     git: tuple[GitEntry, ...] = ()
     # Per-bottle git identity (issue #86). Empty default — bottles
-    # that don't set `git.user:` in the manifest skip the
-    # `git config --global` step entirely. Set independently of
-    # the `git.remotes:` upstream map above: a bottle can declare a user
-    # identity without any git-gate upstreams, and vice versa.
+    # that don't set `git-gate.user:` in the manifest skip the
+    # `git config --global` step entirely. A bottle can declare a user
+    # identity without any git-gate.repos upstreams, and vice versa.
     git_user: GitUser = field(default_factory=GitUser)
     egress: EgressConfig = field(default_factory=EgressConfig)
     # Opt-in per-bottle stuck-recovery sidecar (PRD 0013). When true,
@@ -603,7 +111,7 @@ class Bottle:
 
     @classmethod
     def from_dict(cls, name: str, raw: object) -> "Bottle":
-        d = _as_json_object(raw, f"bottle '{name}'")
+        d = as_json_object(raw, f"bottle '{name}'")
 
         if "runtime" in d:
             raise ManifestError(
@@ -616,16 +124,22 @@ class Bottle:
         if "ssh" in d:
             raise ManifestError(
                 f"bottle '{name}' has an 'ssh' field, which has been removed "
-                f"(PRD 0009). Move each entry to 'git': declare the upstream "
-                f"as a git remote with Name + Upstream URL + IdentityFile, "
-                f"and the per-bottle git-gate (PRD 0008) will hold the "
-                f"credential and gitleaks-scan pushes."
+                f"(PRD 0009). Declare upstreams under 'git-gate.repos' with "
+                f"url + identity + host_key; the git-gate sidecar (PRD 0008) "
+                f"holds the credential and gitleaks-scans pushes."
+            )
+
+        if "git" in d:
+            raise ManifestError(
+                f"bottle '{name}' uses 'git' which has been replaced by "
+                f"'git-gate' (PRD 0047). Move git.user → git-gate.user "
+                f"and git.remotes → git-gate.repos (fields: url, identity, host_key)."
             )
 
         if "git_user" in d:
             raise ManifestError(
                 f"bottle '{name}' has a 'git_user' field, which has been "
-                f"removed. Move it under 'git.user'."
+                f"removed. Move it under 'git-gate.user'."
             )
 
         unknown = set(d.keys()) - BOTTLE_KEYS
@@ -639,7 +153,7 @@ class Bottle:
         env: dict[str, str] = {}
         env_raw = d.get("env")
         if env_raw is not None:
-            env_dict = _as_json_object(env_raw, f"bottle '{name}' env")
+            env_dict = as_json_object(env_raw, f"bottle '{name}' env")
             for var, value in env_dict.items():
                 if not isinstance(value, str):
                     raise ManifestError(
@@ -650,9 +164,9 @@ class Bottle:
 
         git: tuple[GitEntry, ...] = ()
         git_user = GitUser()
-        git_raw = d.get("git")
+        git_raw = d.get("git-gate")
         if git_raw is not None:
-            git, git_user = _parse_git_config(name, git_raw)
+            git, git_user = parse_git_gate_config(name, git_raw)
 
         agent_provider = (
             AgentProvider.from_dict(name, d["agent_provider"])
@@ -679,83 +193,6 @@ class Bottle:
         )
 
 
-@dataclass(frozen=True)
-class Agent:
-    bottle: str
-    skills: tuple[str, ...] = ()
-    prompt: str = ""
-    # Per-agent git identity (issue #94). Overlays the referenced
-    # bottle's git.user per-field at `Manifest.bottle_for`. Only the
-    # `user` block is allowed at the agent level; `git.remotes` stays
-    # bottle-only because it carries credentials and host trust.
-    git_user: GitUser = GitUser()
-
-    @classmethod
-    def from_dict(cls, name: str, raw: object, bottle_names: set[str]) -> "Agent":
-        d = _as_json_object(raw, f"agent '{name}'")
-        unknown = set(d.keys()) - AGENT_MODEL_KEYS
-        if unknown:
-            allowed = ", ".join(sorted(AGENT_MODEL_KEYS))
-            raise ManifestError(
-                f"agent '{name}' has unknown key(s) {sorted(unknown)}; "
-                f"allowed keys are {allowed}."
-            )
-
-        bottle = d.get("bottle")
-        if not isinstance(bottle, str) or not bottle:
-            raise ManifestError(f"agent '{name}' must declare a 'bottle' field naming a defined bottle")
-        if bottle not in bottle_names:
-            available = ", ".join(sorted(bottle_names)) or "(none defined)"
-            raise ManifestError(
-                f"agent '{name}' references bottle '{bottle}', which is not defined. "
-                f"Available: {available}"
-            )
-
-        skills: tuple[str, ...] = ()
-        skills_raw = d.get("skills")
-        if skills_raw is not None:
-            if not isinstance(skills_raw, list):
-                raise ManifestError(f"agent '{name}' skills must be an array (was {type(skills_raw).__name__})")
-            collected: list[str] = []
-            skills_list = cast(list[object], skills_raw)
-            for i, skill in enumerate(skills_list):
-                if not isinstance(skill, str):
-                    raise ManifestError(
-                        f"agent '{name}' skills[{i}] must be a string "
-                        f"(was {type(skill).__name__})"
-                    )
-                collected.append(skill)
-            skills = tuple(collected)
-
-        prompt_raw = d.get("prompt")
-        if prompt_raw is None:
-            prompt = ""
-        elif isinstance(prompt_raw, str):
-            prompt = prompt_raw
-        else:
-            raise ManifestError(f"agent '{name}' prompt must be a string (was {type(prompt_raw).__name__})")
-
-        # git: agents may declare only `git.user` (name/email). Any
-        # other git key — notably `remotes` — is rejected: remotes
-        # carry credentials and host trust and stay bottle-only.
-        git_user = GitUser()
-        git_raw = d.get("git")
-        if git_raw is not None:
-            gd = _as_json_object(git_raw, f"agent '{name}' git")
-            for k in gd.keys():
-                if k != "user":
-                    raise ManifestError(
-                        f"agent '{name}' git.{k} is not allowed at the "
-                        f"agent level; only git.user (name/email) may be "
-                        f"set on an agent. git.remotes is bottle-only "
-                        f"(it carries credentials and host trust)."
-                    )
-            if "user" in gd:
-                git_user = GitUser.from_dict(name, gd["user"])
-
-        return cls(bottle=bottle, skills=skills, prompt=prompt, git_user=git_user)
-
-
 @dataclass(frozen=True)
 class Manifest:
     bottles: Mapping[str, Bottle]
@@ -840,6 +277,7 @@ class Manifest:
                 files = sorted(stale_bottles.glob("*.md"))
                 if files:
                     names = ", ".join(p.name for p in files)
+                    from .log import warn
                     warn(
                         f"ignoring bottle file(s) under "
                         f"{stale_bottles}: {names}. Bottles can only "
@@ -857,7 +295,7 @@ class Manifest:
     @classmethod
     def from_json_obj(cls, obj: object) -> "Manifest":
         """Validate and build a Manifest from a raw JSON-like dict."""
-        d = _as_json_object(obj, "manifest")
+        d = as_json_object(obj, "manifest")
         raw_bottles_obj = _section_dict(d.get("bottles"), "manifest 'bottles'")
         raw_agents = _section_dict(d.get("agents"), "manifest 'agents'")
 
@@ -866,7 +304,7 @@ class Manifest:
         # consistently with the md-loader path.
         raw_bottles: dict[str, dict[str, object]] = {}
         for n, b in raw_bottles_obj.items():
-            raw_bottles[n] = _as_json_object(b, f"bottle '{n}'")
+            raw_bottles[n] = as_json_object(b, f"bottle '{n}'")
         from .manifest_extends import resolve_bottles
 
         bottles = resolve_bottles(raw_bottles)
@@ -946,124 +384,3 @@ class Manifest:
         if merged.email:
             parts.append(f"email={merged.email} ({'agent' if over.email else 'bottle'})")
         return ", ".join(parts)
-
-
-def _as_json_object(value: object, label: str) -> dict[str, object]:
-    """Assert that `value` is a JSON object (str-keyed dict) and return
-    a view typed as `dict[str, object]` so downstream `.get(...)` calls
-    have a typed surface."""
-    if not isinstance(value, dict):
-        raise ManifestError(f"{label} must be a JSON object (was {type(value).__name__})")
-    items = cast(dict[object, object], value)
-    out: dict[str, object] = {}
-    for k, v in items.items():
-        if not isinstance(k, str):
-            raise ManifestError(f"{label} keys must be strings (found {type(k).__name__})")
-        out[k] = v
-    return out
-
-
-def _section_dict(value: object, label: str) -> dict[str, object]:
-    """Like _as_json_object but treats absent/null as an empty section."""
-    if value is None:
-        return {}
-    return _as_json_object(value, label)
-
-
-def _opt_str(value: object, label: str) -> str:
-    if value is None:
-        return ""
-    if not isinstance(value, str):
-        raise ManifestError(f"{label} must be a string (was {type(value).__name__})")
-    return value
-
-
-def _opt_extra_hosts(value: object, label: str) -> dict[str, str]:
-    """Validate a `{hostname: ip}` object and return a plain dict. None
-    yields an empty dict so callers can treat ExtraHosts as always
-    present. IP format is not checked here; docker validates at
-    `--add-host` time."""
-    if value is None:
-        return {}
-    obj = _as_json_object(value, label)
-    out: dict[str, str] = {}
-    for host, ip in obj.items():
-        if not host:
-            raise ManifestError(f"{label} contains an empty hostname key")
-        if not isinstance(ip, str):
-            raise ManifestError(f"{label}['{host}'] must be a string (was {type(ip).__name__})")
-        if not ip:
-            raise ManifestError(f"{label}['{host}'] must be a non-empty string")
-        out[host] = ip
-    return out
-
-
-def _parse_git_upstream(url: str, label: str) -> tuple[str, str, str, str]:
-    """Parse `ssh://user@host[:port]/path` into (user, host, port, path).
-    Dies if `url` doesn't match the ssh:// shape v1 supports. Default
-    port is 22 (matches OpenSSH)."""
-    if not url.startswith("ssh://"):
-        raise ManifestError(f"{label} must be an ssh:// URL (was {url!r})")
-    rest = url[len("ssh://"):]
-    if "@" not in rest:
-        raise ManifestError(f"{label} must include a user (e.g. ssh://git@host/path.git); was {url!r}")
-    user, _, hostpart = rest.partition("@")
-    if not user:
-        raise ManifestError(f"{label} user is empty in {url!r}")
-    if "/" not in hostpart:
-        raise ManifestError(f"{label} must include a path (e.g. ssh://git@host/path.git); was {url!r}")
-    hostport, _, path = hostpart.partition("/")
-    if not path:
-        raise ManifestError(f"{label} path is empty in {url!r}")
-    if ":" in hostport:
-        host, _, port = hostport.partition(":")
-        if not port.isdigit():
-            raise ManifestError(f"{label} port must be numeric in {url!r}")
-    else:
-        host = hostport
-        port = "22"
-    if not host:
-        raise ManifestError(f"{label} host is empty in {url!r}")
-    return (user, host, port, path)
-
-
-def _is_ip_literal(value: str) -> bool:
-    try:
-        ipaddress.ip_address(value)
-    except ValueError:
-        return False
-    return True
-
-
-def _validate_egress_routes(
-    bottle_name: str,
-    routes: tuple[EgressRoute, ...],
-) -> None:
-    """Cross-validation for `bottle.egress.routes`: hosts must be unique.
-
-    The proxy matches by exact-host (v1); duplicate hosts leave the
-    route choice ambiguous so we reject them up front.
-
-    No cross-validation against `bottle.git` is performed. git-gate
-    (SSH push/fetch) and egress (HTTPS) broker different protocols;
-    declaring both for the same host is a legitimate dev setup."""
-    seen_hosts: dict[str, None] = {}
-    for r in routes:
-        key = r.Host.lower()
-        if key in seen_hosts:
-            raise ManifestError(
-                f"bottle '{bottle_name}' egress.routes has duplicate host "
-                f"{r.Host!r}; each host must be unique on the proxy."
-            )
-        seen_hosts[key] = None
-
-
-def _validate_unique_git_names(bottle_name: str, git: tuple[GitEntry, ...]) -> None:
-    seen: dict[str, None] = {}
-    for g in git:
-        if g.Name in seen:
-            raise ManifestError(
-                f"bottle '{bottle_name}' git entries have duplicate Name '{g.Name}'; "
-                f"each entry maps to a distinct bare repo on the gate."
-            )
-        seen[g.Name] = None

bot_bottle/manifest_agent.py

@@ -0,0 +1,166 @@
+"""Agent configuration manifest dataclasses."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import cast
+
+from .agent_provider import PROVIDER_TEMPLATES
+from .manifest_util import ManifestError, as_json_object
+from .manifest_git import GitUser
+from .manifest_schema import AGENT_MODEL_KEYS
+
+
+@dataclass(frozen=True)
+class AgentProvider:
+    """Provider/template for the agent process inside a bottle.
+
+    `template` selects a built-in launch/runtime contract. `dockerfile`
+    optionally points at a custom agent-image Dockerfile while leaving
+    bot-bottle's sidecar infrastructure intact.
+
+    `auth_token` names the host env var that holds the provider's OAuth
+    token (Claude only). The provisioner injects a provider-owned egress
+    route for api.anthropic.com that re-injects this token as the Bearer
+    header, and sets a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent
+    so the Claude Code CLI starts.
+
+    `forward_host_credentials` forwards the host Codex auth token into
+    the egress sidecar (Codex only).
+    """
+
+    template: str = "claude"
+    dockerfile: str = ""
+    auth_token: str = ""
+    forward_host_credentials: bool = False
+
+    @classmethod
+    def from_dict(cls, bottle_name: str, raw: object) -> "AgentProvider":
+        d = as_json_object(raw, f"bottle '{bottle_name}' agent_provider")
+        for k in d:
+            if k not in {"template", "dockerfile", "auth_token", "forward_host_credentials"}:
+                raise ManifestError(
+                    f"bottle '{bottle_name}' agent_provider has unknown key {k!r}; "
+                    f"allowed: template, dockerfile, auth_token, forward_host_credentials"
+                )
+        template = d.get("template", "claude")
+        if not isinstance(template, str) or not template:
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.template must be a "
+                f"non-empty string"
+            )
+        if template not in PROVIDER_TEMPLATES:
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.template {template!r} "
+                f"is not one of {', '.join(sorted(PROVIDER_TEMPLATES))}"
+            )
+        dockerfile = d.get("dockerfile", "")
+        if not isinstance(dockerfile, str):
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.dockerfile must be a "
+                f"string (was {type(dockerfile).__name__})"
+            )
+        auth_token = d.get("auth_token", "")
+        if not isinstance(auth_token, str):
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.auth_token must be a "
+                f"string (was {type(auth_token).__name__})"
+            )
+        if auth_token and template != "claude":
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.auth_token is only "
+                f"supported for template 'claude'"
+            )
+        forward_host_credentials = d.get("forward_host_credentials", False)
+        if not isinstance(forward_host_credentials, bool):
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
+                f"must be a boolean (was {type(forward_host_credentials).__name__})"
+            )
+        if forward_host_credentials and template != "codex":
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
+                "is currently only supported for template 'codex'"
+            )
+        return cls(
+            template=template,
+            dockerfile=dockerfile,
+            auth_token=auth_token,
+            forward_host_credentials=forward_host_credentials,
+        )
+
+
+@dataclass(frozen=True)
+class Agent:
+    bottle: str
+    skills: tuple[str, ...] = ()
+    prompt: str = ""
+    # Per-agent git identity (issue #94). Overlays the referenced
+    # bottle's git-gate.user per-field at `Manifest.bottle_for`. Only
+    # `user` is allowed at the agent level; `repos` stays bottle-only
+    # because it carries credentials and host trust.
+    git_user: GitUser = GitUser()
+
+    @classmethod
+    def from_dict(cls, name: str, raw: object, bottle_names: set[str]) -> "Agent":
+        d = as_json_object(raw, f"agent '{name}'")
+        unknown = set(d.keys()) - AGENT_MODEL_KEYS
+        if unknown:
+            allowed = ", ".join(sorted(AGENT_MODEL_KEYS))
+            raise ManifestError(
+                f"agent '{name}' has unknown key(s) {sorted(unknown)}; "
+                f"allowed keys are {allowed}."
+            )
+
+        bottle = d.get("bottle")
+        if not isinstance(bottle, str) or not bottle:
+            raise ManifestError(f"agent '{name}' must declare a 'bottle' field naming a defined bottle")
+        if bottle not in bottle_names:
+            available = ", ".join(sorted(bottle_names)) or "(none defined)"
+            raise ManifestError(
+                f"agent '{name}' references bottle '{bottle}', which is not defined. "
+                f"Available: {available}"
+            )
+
+        skills: tuple[str, ...] = ()
+        skills_raw = d.get("skills")
+        if skills_raw is not None:
+            if not isinstance(skills_raw, list):
+                raise ManifestError(f"agent '{name}' skills must be an array (was {type(skills_raw).__name__})")
+            collected: list[str] = []
+            skills_list = cast(list[object], skills_raw)
+            for i, skill in enumerate(skills_list):
+                if not isinstance(skill, str):
+                    raise ManifestError(
+                        f"agent '{name}' skills[{i}] must be a string "
+                        f"(was {type(skill).__name__})"
+                    )
+                collected.append(skill)
+            skills = tuple(collected)
+
+        prompt_raw = d.get("prompt")
+        if prompt_raw is None:
+            prompt = ""
+        elif isinstance(prompt_raw, str):
+            prompt = prompt_raw
+        else:
+            raise ManifestError(f"agent '{name}' prompt must be a string (was {type(prompt_raw).__name__})")
+
+        # git-gate: agents may declare only `git-gate.user` (name/email).
+        # `git-gate.repos` is bottle-only — it carries credentials and host trust.
+        git_user = GitUser()
+        git_raw = d.get("git-gate")
+        if git_raw is not None:
+            gd = as_json_object(git_raw, f"agent '{name}' git-gate")
+            for k in gd.keys():
+                if k != "user":
+                    raise ManifestError(
+                        f"agent '{name}' git-gate.{k} is not allowed at the "
+                        f"agent level; only git-gate.user (name/email) may be "
+                        f"set on an agent. git-gate.repos is bottle-only "
+                        f"(it carries credentials and host trust)."
+                    )
+            if "user" in gd:
+                git_user = GitUser.from_dict(name, gd["user"])
+
+        return cls(bottle=bottle, skills=skills, prompt=prompt, git_user=git_user)

bot_bottle/manifest_egress.py

@@ -0,0 +1,286 @@
+"""Egress routing manifest dataclasses and helpers."""
+
+from __future__ import annotations
+
+import ipaddress
+from dataclasses import dataclass, field
+from typing import cast
+
+from .manifest_util import ManifestError, as_json_object
+
+
+# Auth schemes for the egress route's optional `auth` block.
+# Same values cred-proxy accepts today; `token` sidesteps the Gitea
+# token-not-Bearer quirk (go-gitea/gitea#16734).
+EGRESS_AUTH_SCHEMES = ("Bearer", "token")
+
+
+def validate_egress_routes(
+    bottle_name: str,
+    routes: tuple[EgressRoute, ...],
+) -> None:
+    """Cross-validation for `bottle.egress.routes`: hosts must be unique.
+
+    The proxy matches by exact-host (v1); duplicate hosts leave the
+    route choice ambiguous so we reject them up front.
+
+    No cross-validation against `bottle.git-gate.repos` is performed.
+    git-gate (SSH push/fetch) and egress (HTTPS) broker different
+    protocols; declaring both for the same host is a legitimate dev
+    setup."""
+    seen_hosts: dict[str, None] = {}
+    for r in routes:
+        key = r.Host.lower()
+        if key in seen_hosts:
+            raise ManifestError(
+                f"bottle '{bottle_name}' egress.routes has duplicate host "
+                f"{r.Host!r}; each host must be unique on the proxy."
+            )
+        seen_hosts[key] = None
+
+
+@dataclass(frozen=True)
+class PipelockRoutePolicy:
+    """Per-route pipelock policy overrides.
+
+    `TlsPassthrough` adds the route host to pipelock's
+    `tls_interception.passthrough_domains`, so pipelock still enforces
+    the hostname allowlist but does not MITM/decrypt request bodies or
+    headers for that host.
+
+    `SsrfIpAllowlist` adds explicit IPs/CIDRs to pipelock's SSRF
+    allowlist for private/internal destinations behind this route.
+    """
+
+    TlsPassthrough: bool = False
+    SsrfIpAllowlist: tuple[str, ...] = ()
+
+    @classmethod
+    def from_dict(
+        cls, bottle_name: str, idx: int, raw: object,
+    ) -> "PipelockRoutePolicy":
+        label = f"bottle '{bottle_name}' egress.routes[{idx}] pipelock"
+        d = as_json_object(raw, label)
+        for k in d:
+            if k not in ("tls_passthrough", "ssrf_ip_allowlist"):
+                raise ManifestError(
+                    f"{label} has unknown key {k!r}; "
+                    f"only 'tls_passthrough' and 'ssrf_ip_allowlist' "
+                    f"are accepted"
+                )
+        tls_passthrough_raw = d.get("tls_passthrough", False)
+        if not isinstance(tls_passthrough_raw, bool):
+            raise ManifestError(
+                f"{label}.tls_passthrough must be a boolean "
+                f"(was {type(tls_passthrough_raw).__name__})"
+            )
+        ssrf_raw = d.get("ssrf_ip_allowlist", [])
+        if not isinstance(ssrf_raw, list):
+            raise ManifestError(
+                f"{label}.ssrf_ip_allowlist must be an array "
+                f"(was {type(ssrf_raw).__name__})"
+            )
+        ssrf_ip_allowlist: list[str] = []
+        for j, item in enumerate(ssrf_raw):
+            if not isinstance(item, str) or not item:
+                raise ManifestError(
+                    f"{label}.ssrf_ip_allowlist[{j}] must be a non-empty "
+                    f"string (was {type(item).__name__})"
+                )
+            try:
+                ipaddress.ip_network(item, strict=False)
+            except ValueError as e:
+                raise ManifestError(
+                    f"{label}.ssrf_ip_allowlist[{j}] must be an IP address "
+                    f"or CIDR (was {item!r}): {e}"
+                )
+            ssrf_ip_allowlist.append(item)
+        return cls(
+            TlsPassthrough=tls_passthrough_raw,
+            SsrfIpAllowlist=tuple(ssrf_ip_allowlist),
+        )
+
+
+@dataclass(frozen=True)
+class EgressRoute:
+    """One route on the per-bottle egress sidecar (PRD 0017).
+
+    `Host` matches the request's hostname (case-insensitive). The
+    optional `PathAllowlist` constrains the URL path to a set of
+    prefixes; empty tuple means no path-level filtering. The optional
+    `AuthScheme` / `TokenRef` pair drives credential injection:
+    when set, the proxy strips any inbound Authorization and injects
+    `<AuthScheme> <value-of-host-env-named-by-TokenRef>`. When the
+    manifest's `auth` block is omitted both fields are empty strings —
+    no Authorization is written, no token forwarded.
+
+    `Role` is reserved for future use; all role strings are currently
+    rejected by the validator.
+
+    Validation rules (enforced in `from_dict`):
+      - `host` required, non-empty.
+      - `path_allowlist` optional, list of absolute path prefixes.
+      - `auth` optional. If present, MUST carry both `scheme` and
+        `token_ref` as non-empty strings; an empty `auth: {}` is an
+        error rather than a synonym for "no auth" (omit `auth` for
+        that case).
+      - `role` optional, reserved — any non-empty value is rejected.
+    """
+
+    Host: str
+    PathAllowlist: tuple[str, ...] = ()
+    AuthScheme: str = ""
+    TokenRef: str = ""
+    Role: tuple[str, ...] = ()
+    Pipelock: PipelockRoutePolicy = field(default_factory=PipelockRoutePolicy)
+
+    @classmethod
+    def from_dict(cls, bottle_name: str, idx: int, raw: object) -> "EgressRoute":
+        label = f"bottle '{bottle_name}' egress.routes[{idx}]"
+        d = as_json_object(raw, label)
+        host = d.get("host")
+        if not isinstance(host, str) or not host:
+            raise ManifestError(f"{label} missing required string field 'host'")
+
+        path_allow_raw = d.get("path_allowlist")
+        prefixes: tuple[str, ...] = ()
+        if path_allow_raw is not None:
+            if not isinstance(path_allow_raw, list):
+                raise ManifestError(
+                    f"{label} path_allowlist must be an array "
+                    f"(was {type(path_allow_raw).__name__})"
+                )
+            path_list = cast(list[object], path_allow_raw)
+            collected: list[str] = []
+            for j, p in enumerate(path_list):
+                if not isinstance(p, str):
+                    raise ManifestError(
+                        f"{label} path_allowlist[{j}] must be a string "
+                        f"(was {type(p).__name__})"
+                    )
+                if not p.startswith("/"):
+                    raise ManifestError(
+                        f"{label} path_allowlist[{j}] {p!r} must be an "
+                        f"absolute path prefix starting with '/'"
+                    )
+                collected.append(p)
+            prefixes = tuple(collected)
+
+        auth_scheme = ""
+        token_ref = ""
+        if "auth" in d:
+            auth_raw = d.get("auth")
+            auth_d = as_json_object(auth_raw, f"{label} auth")
+            if not auth_d:
+                raise ManifestError(
+                    f"{label} auth is empty ({{}}); omit the 'auth' key "
+                    f"entirely if this route is unauthenticated. Otherwise "
+                    f"both 'scheme' and 'token_ref' are required."
+                )
+            auth_scheme_raw = auth_d.get("scheme")
+            if not isinstance(auth_scheme_raw, str) or not auth_scheme_raw:
+                raise ManifestError(
+                    f"{label} auth.scheme is required when 'auth' is set "
+                    f"(non-empty string)"
+                )
+            if auth_scheme_raw not in EGRESS_AUTH_SCHEMES:
+                raise ManifestError(
+                    f"{label} auth.scheme {auth_scheme_raw!r} is not one of "
+                    f"{', '.join(EGRESS_AUTH_SCHEMES)}"
+                )
+            token_ref_raw = auth_d.get("token_ref")
+            if not isinstance(token_ref_raw, str) or not token_ref_raw:
+                raise ManifestError(
+                    f"{label} auth.token_ref is required when 'auth' is set "
+                    f"(name of the host env var holding the token value)"
+                )
+            for k in auth_d:
+                if k not in ("scheme", "token_ref"):
+                    raise ManifestError(
+                        f"{label} auth has unknown key {k!r}; "
+                        f"only 'scheme' and 'token_ref' are accepted"
+                    )
+            auth_scheme = auth_scheme_raw
+            token_ref = token_ref_raw
+
+        role_raw = d.get("role")
+        roles: tuple[str, ...] = ()
+        if role_raw is None:
+            roles = ()
+        elif isinstance(role_raw, str):
+            roles = (role_raw,)
+        elif isinstance(role_raw, list):
+            role_list = cast(list[object], role_raw)
+            collected_roles: list[str] = []
+            for r in role_list:
+                if not isinstance(r, str):
+                    raise ManifestError(f"{label} role items must be strings (got {type(r).__name__})")
+                collected_roles.append(r)
+            roles = tuple(collected_roles)
+        else:
+            raise ManifestError(
+                f"{label} role must be a string or a list of strings "
+                f"(was {type(role_raw).__name__})"
+            )
+        if roles:
+            raise ManifestError(
+                f"{label} role {roles[0]!r} is not accepted; "
+                f"the 'role' field is reserved for future use"
+            )
+
+        pipelock = (
+            PipelockRoutePolicy.from_dict(bottle_name, idx, d["pipelock"])
+            if "pipelock" in d
+            else PipelockRoutePolicy()
+        )
+
+        for k in d:
+            if k not in ("host", "path_allowlist", "auth", "role", "pipelock"):
+                raise ManifestError(
+                    f"{label} has unknown key {k!r}; accepted keys are "
+                    f"'host', 'path_allowlist', 'auth', 'role', 'pipelock'"
+                )
+
+        return cls(
+            Host=host,
+            PathAllowlist=prefixes,
+            AuthScheme=auth_scheme,
+            TokenRef=token_ref,
+            Role=roles,
+            Pipelock=pipelock,
+        )
+
+
+@dataclass(frozen=True)
+class EgressConfig:
+    """Per-bottle egress configuration. Today this is just the
+    route table; the nesting under `egress:` leaves room for
+    per-bottle proxy settings (port override, log level, etc.) in
+    follow-ups."""
+
+    routes: tuple[EgressRoute, ...] = ()
+
+    @classmethod
+    def from_dict(cls, bottle_name: str, raw: object) -> "EgressConfig":
+        d = as_json_object(raw, f"bottle '{bottle_name}' egress")
+        routes_raw = d.get("routes")
+        routes: tuple[EgressRoute, ...] = ()
+        if routes_raw is not None:
+            if not isinstance(routes_raw, list):
+                raise ManifestError(
+                    f"bottle '{bottle_name}' egress.routes must be an array "
+                    f"(was {type(routes_raw).__name__})"
+                )
+            routes_list = cast(list[object], routes_raw)
+            routes = tuple(
+                EgressRoute.from_dict(bottle_name, i, entry)
+                for i, entry in enumerate(routes_list)
+            )
+            validate_egress_routes(bottle_name, routes)
+        for k in d:
+            if k != "routes":
+                raise ManifestError(
+                    f"bottle '{bottle_name}' egress has unknown key {k!r}; "
+                    f"only 'routes' is accepted"
+                )
+        return cls(routes=routes)

bot_bottle/manifest_extends.py

@@ -71,7 +71,8 @@ def _merge_bottles(
     name: str,
 ) -> Bottle:
     """Apply PRD 0025 merge rules."""
-    from .manifest import Bottle, GitUser, _validate_egress_routes
+    from .manifest import Bottle, GitUser
+    from .manifest_egress import validate_egress_routes
 
     # Parse the child's declared fields into a Bottle (with the
     # usual defaults for anything missing). Validation runs the same
@@ -81,19 +82,19 @@ def _merge_bottles(
     # env: dict merge, child wins on collision.
     merged_env = {**parent.env, **child.env}
 
-    # git.user: per-field overlay. Each non-empty field on child
+    # git-gate.user: per-field overlay. Each non-empty field on child
     # wins; empties fall through to parent. The default GitUser()
-    # is two empty strings, so a child that omits git.user
+    # is two empty strings, so a child that omits git-gate.user
     # inherits the parent's user verbatim.
     merged_git_user = GitUser(
         name=child.git_user.name or parent.git_user.name,
         email=child.git_user.email or parent.git_user.email,
     )
 
-    # git.remotes: missing means inherit; an explicit empty object
+    # git-gate.repos: missing means inherit; an explicit empty object
     # clears; otherwise parent and child merge by UpstreamHost with
     # child entries replacing duplicate hosts.
-    if _child_declares_git_remotes(child_raw):
+    if _child_declares_git_gate_repos(child_raw):
         merged_git = _merge_git_remotes(parent.git, child.git) if child.git else ()
     else:
         merged_git = parent.git
@@ -109,7 +110,7 @@ def _merge_bottles(
     merged_supervise = (
         child.supervise if "supervise" in child_raw else parent.supervise
     )
-    _validate_egress_routes(name, merged_egress.routes)
+    validate_egress_routes(name, merged_egress.routes)
 
     return Bottle(
         env=merged_env,
@@ -121,14 +122,14 @@ def _merge_bottles(
     )
 
 
-def _child_declares_git_remotes(child_raw: dict[str, object]) -> bool:
-    from .manifest import _as_json_object
+def _child_declares_git_gate_repos(child_raw: dict[str, object]) -> bool:
+    from .manifest_util import as_json_object
 
-    git_raw = child_raw.get("git")
+    git_raw = child_raw.get("git-gate")
     if git_raw is None:
         return False
-    git_obj = _as_json_object(git_raw, "child git")
-    return "remotes" in git_obj
+    git_obj = as_json_object(git_raw, "child git-gate")
+    return "repos" in git_obj
 
 
 def _merge_git_remotes(

bot_bottle/manifest_git.py

@@ -0,0 +1,222 @@
+"""Git-related manifest dataclasses and helpers."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from .manifest_util import ManifestError, as_json_object
+
+# Shell-safe characters for git-gate repo names. Names are embedded in
+# the generated entrypoint shell script (shlex.quote is the primary
+# defence; this regex is belt-and-suspenders and documents intent).
+_GIT_NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def _opt_str(value: object, label: str) -> str:
+    if value is None:
+        return ""
+    if not isinstance(value, str):
+        raise ManifestError(f"{label} must be a string (was {type(value).__name__})")
+    return value
+
+
+def parse_git_upstream(url: str, label: str) -> tuple[str, str, str, str]:
+    """Parse `ssh://user@host[:port]/path` into (user, host, port, path).
+    Dies if `url` doesn't match the ssh:// shape v1 supports. Default
+    port is 22 (matches OpenSSH)."""
+    if not url.startswith("ssh://"):
+        raise ManifestError(f"{label} must be an ssh:// URL (was {url!r})")
+    rest = url[len("ssh://"):]
+    if "@" not in rest:
+        raise ManifestError(f"{label} must include a user (e.g. ssh://git@host/path.git); was {url!r}")
+    user, _, hostpart = rest.partition("@")
+    if not user:
+        raise ManifestError(f"{label} user is empty in {url!r}")
+    if "/" not in hostpart:
+        raise ManifestError(f"{label} must include a path (e.g. ssh://git@host/path.git); was {url!r}")
+    hostport, _, path = hostpart.partition("/")
+    if not path:
+        raise ManifestError(f"{label} path is empty in {url!r}")
+    if ":" in hostport:
+        host, _, port = hostport.partition(":")
+        if not port.isdigit():
+            raise ManifestError(f"{label} port must be numeric in {url!r}")
+    else:
+        host = hostport
+        port = "22"
+    if not host:
+        raise ManifestError(f"{label} host is empty in {url!r}")
+    return (user, host, port, path)
+
+
+def validate_unique_git_names(bottle_name: str, git: tuple[GitEntry, ...]) -> None:
+    seen: dict[str, None] = {}
+    for g in git:
+        if g.Name in seen:
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.repos has duplicate name '{g.Name}'; "
+                f"each entry maps to a distinct bare repo on the gate."
+            )
+        seen[g.Name] = None
+
+
+@dataclass(frozen=True)
+class GitEntry:
+    """One upstream the per-agent git-gate (PRD 0008) is allowed to
+    talk to. `Upstream` is the real remote URL the agent would push to
+    if there were no gate; the gate hosts a bare repo at /git/<Name>.git
+    and `IdentityFile` is the SSH key the gate uses to push that repo
+    upstream after gitleaks passes. The agent itself never holds the
+    upstream credential.
+
+    The Upstream URL is parsed once at construction and the pieces are
+    stashed in the `Upstream*` fields so the git-gate render step
+    doesn't have to re-parse.
+
+    Manifest source: `git-gate.repos.<Name>` (PRD 0047). The YAML keys
+    are `url`, `identity`, and `host_key`; the internal field names are
+    stable across that rename."""
+
+    Name: str
+    Upstream: str
+    IdentityFile: str
+    KnownHostKey: str = ""
+    RemoteKey: str = ""
+    UpstreamUser: str = ""
+    UpstreamHost: str = ""
+    UpstreamPort: str = ""
+    UpstreamPath: str = ""
+
+    @classmethod
+    def from_repos_entry(
+        cls, bottle_name: str, repo_name: str, raw: object
+    ) -> "GitEntry":
+        """Parse one entry from `git-gate.repos.<repo_name>`.
+
+        YAML keys: `url` (required), `identity` (required),
+        `host_key` (optional). The repo_name becomes `Name`."""
+        if not repo_name:
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.repos has an empty key"
+            )
+        if not _GIT_NAME_RE.match(repo_name):
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.repos name {repo_name!r} is invalid; "
+                f"allowed characters: A-Z a-z 0-9 . _ -"
+            )
+        label = f"git-gate.repos[{repo_name!r}]"
+        d = as_json_object(raw, f"bottle '{bottle_name}' {label}")
+        for k in d:
+            if k not in {"url", "identity", "host_key"}:
+                raise ManifestError(
+                    f"bottle '{bottle_name}' {label} has unknown key {k!r}; "
+                    f"allowed: url, identity, host_key"
+                )
+        upstream = d.get("url")
+        if not isinstance(upstream, str) or not upstream:
+            raise ManifestError(
+                f"bottle '{bottle_name}' {label} missing required string field 'url'"
+            )
+        ident = d.get("identity")
+        if not isinstance(ident, str) or not ident:
+            raise ManifestError(
+                f"bottle '{bottle_name}' {label} missing required string field 'identity'"
+            )
+        khk = _opt_str(
+            d.get("host_key"),
+            f"bottle '{bottle_name}' {label} host_key",
+        )
+        user, host, port, path = parse_git_upstream(
+            upstream, f"bottle '{bottle_name}' {label} url"
+        )
+        return cls(
+            Name=repo_name,
+            Upstream=upstream,
+            IdentityFile=ident,
+            KnownHostKey=khk,
+            RemoteKey=host,
+            UpstreamUser=user,
+            UpstreamHost=host,
+            UpstreamPort=port,
+            UpstreamPath=path,
+        )
+
+
+@dataclass(frozen=True)
+class GitUser:
+    """Per-bottle `git config --global user.name` / `user.email`
+    pair (issue #86). The agent's commits inside the bottle are
+    attributed to this identity rather than the agent image's
+    image-baked default (no user, or whatever the image dropped
+    in). Either or both fields can be set independently.
+
+    `from_dict` is forgiving on shape (a single missing field is
+    fine — we just skip that config line at provisioning) but
+    strict on types (string-or-die)."""
+
+    name: str = ""
+    email: str = ""
+
+    @classmethod
+    def from_dict(cls, bottle_name: str, raw: object) -> "GitUser":
+        d = as_json_object(raw, f"bottle '{bottle_name}' git-gate.user")
+        for k in d.keys():
+            if k not in {"name", "email"}:
+                raise ManifestError(
+                    f"bottle '{bottle_name}' git-gate.user has unknown key {k!r}; "
+                    f"allowed: name, email"
+                )
+        name = d.get("name", "")
+        email = d.get("email", "")
+        if not isinstance(name, str):
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.user.name must be a string "
+                f"(was {type(name).__name__})"
+            )
+        if not isinstance(email, str):
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.user.email must be a string "
+                f"(was {type(email).__name__})"
+            )
+        if not name and not email:
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate.user is set but neither "
+                f"name nor email is non-empty; remove the block or "
+                f"fill at least one field."
+            )
+        return cls(name=name, email=email)
+
+    def is_empty(self) -> bool:
+        return not self.name and not self.email
+
+
+def parse_git_gate_config(
+    bottle_name: str,
+    raw: object,
+) -> tuple[tuple[GitEntry, ...], GitUser]:
+    d = as_json_object(raw, f"bottle '{bottle_name}' git-gate")
+    for k in d.keys():
+        if k not in {"user", "repos"}:
+            raise ManifestError(
+                f"bottle '{bottle_name}' git-gate has unknown key {k!r}; "
+                f"allowed: user, repos"
+            )
+
+    git_user = (
+        GitUser.from_dict(bottle_name, d["user"])
+        if "user" in d
+        else GitUser()
+    )
+
+    git: tuple[GitEntry, ...] = ()
+    repos_raw = d.get("repos")
+    if repos_raw is not None:
+        repos = as_json_object(repos_raw, f"bottle '{bottle_name}' git-gate.repos")
+        git = tuple(
+            GitEntry.from_repos_entry(bottle_name, name, entry)
+            for name, entry in repos.items()
+        )
+        validate_unique_git_names(bottle_name, git)
+
+    return git, git_user

bot_bottle/manifest_loader.py

@@ -93,13 +93,13 @@ def load_agents_from_dir(
         validate_agent_frontmatter_keys(path, fm.keys())
         # Build the dict Agent.from_dict expects. The body becomes
         # prompt; Claude Code passthrough fields stay in fm and get
-        # ignored by Agent.from_dict (which reads bottle/skills/git/prompt).
+        # ignored by Agent.from_dict (reads bottle/skills/git-gate/prompt).
         agent_dict: dict[str, object] = {
             "bottle": fm.get("bottle"),
             "skills": fm.get("skills", []),
             "prompt": body.strip(),
         }
-        if "git" in fm:
-            agent_dict["git"] = fm["git"]
+        if "git-gate" in fm:
+            agent_dict["git-gate"] = fm["git-gate"]
         out[name] = Agent.from_dict(name, agent_dict, bottle_names)
     return out

bot_bottle/manifest_schema.py

@@ -16,10 +16,10 @@ _FILENAME_RX = re.compile(r"^[a-z][a-z0-9-]*$")
 # sets dies with a "did you mean" pointer: typos should not silently
 # ghost into an empty config.
 BOTTLE_KEYS = frozenset(
-    {"env", "extends", "agent_provider", "git", "egress", "supervise"}
+    {"env", "extends", "agent_provider", "git-gate", "egress", "supervise"}
 )
 AGENT_KEYS_REQUIRED = frozenset({"bottle"})
-AGENT_KEYS_OPTIONAL = frozenset({"skills", "git"})
+AGENT_KEYS_OPTIONAL = frozenset({"skills", "git-gate"})
 
 # Claude Code subagent fields bot-bottle ignores at launch but does
 # not reject. This lets the same file double as
@@ -58,7 +58,7 @@ def _validate_frontmatter_keys(
     keys: object,
     allowed_keys: frozenset[str],
 ) -> None:
-    from .manifest import ManifestError
+    from .manifest_util import ManifestError
 
     key_set = set(keys)
     unknown = key_set - allowed_keys

bot_bottle/manifest_util.py

@@ -0,0 +1,24 @@
+"""Shared manifest primitives used by all manifest sub-modules."""
+
+from __future__ import annotations
+
+from typing import cast
+
+
+class ManifestError(Exception):
+    """A manifest file (or the manifest tree) is invalid."""
+
+
+def as_json_object(value: object, label: str) -> dict[str, object]:
+    """Assert that `value` is a JSON object (str-keyed dict) and return
+    a view typed as `dict[str, object]` so downstream `.get(...)` calls
+    have a typed surface."""
+    if not isinstance(value, dict):
+        raise ManifestError(f"{label} must be a JSON object (was {type(value).__name__})")
+    items = cast(dict[object, object], value)
+    out: dict[str, object] = {}
+    for k, v in items.items():
+        if not isinstance(k, str):
+            raise ManifestError(f"{label} keys must be strings (found {type(k).__name__})")
+        out[k] = v
+    return out

bot_bottle/util.py

@@ -5,9 +5,18 @@ level deeper, under their backend package."""
 
 from __future__ import annotations
 
+import ipaddress
 import os
 
 
+def is_ip_literal(value: str) -> bool:
+    try:
+        ipaddress.ip_address(value)
+    except ValueError:
+        return False
+    return True
+
+
 def expand_tilde(path: str) -> str:
     """Expand a leading '~' to $HOME. Leaves paths without a leading
     tilde unchanged. Falls back to the empty string if $HOME is unset

bot_bottle/workspace.py

@@ -0,0 +1,52 @@
+"""Backend-neutral plan for porting the operator workspace."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Protocol
+
+
+WORKSPACE_DIRNAME = "workspace"
+DEFAULT_WORKSPACE_OWNER = "node:node"
+DEFAULT_WORKSPACE_MODE = "755"
+
+
+class WorkspaceSpec(Protocol):
+    copy_cwd: bool
+    user_cwd: str
+
+
+@dataclass(frozen=True)
+class WorkspacePlan:
+    """Resolved workspace contract shared by all bottle backends."""
+
+    enabled: bool
+    host_path: Path
+    guest_home: str
+    guest_path: str
+    workdir: str
+    owner: str = DEFAULT_WORKSPACE_OWNER
+    mode: str = DEFAULT_WORKSPACE_MODE
+    copy_contents: bool = True
+    copy_git: bool = True
+    has_host_git_dir: bool = False
+
+
+def workspace_plan(spec: WorkspaceSpec, *, guest_home: str) -> WorkspacePlan:
+    """Resolve the in-bottle workspace path from CLI intent."""
+    host_path = Path(spec.user_cwd).expanduser()
+    if spec.copy_cwd:
+        guest_path = f"{guest_home.rstrip('/')}/{WORKSPACE_DIRNAME}"
+        workdir = guest_path
+    else:
+        guest_path = guest_home
+        workdir = guest_home
+    return WorkspacePlan(
+        enabled=spec.copy_cwd,
+        host_path=host_path,
+        guest_home=guest_home,
+        guest_path=guest_path,
+        workdir=workdir,
+        has_host_git_dir=(host_path / ".git").is_dir(),
+    )

docs/prds/0008-git-gate.md

@@ -83,12 +83,7 @@ for a declared upstream:
 - **Manifest field.** `bottle.git` — a list of git remotes the
   bottle is allowed to talk to, each with the credential the gate
   uses to push upstream. The agent gets no parallel `bottle.ssh`
-  entry for those upstreams. Each entry may also carry an
-  `ExtraHosts: { hostname: ip }` map, surfaced to the gate as
-  `--add-host` so the gate can resolve upstreams whose public DNS
-  doesn't point at the reachable IP (e.g. Tailscale-only hosts).
-  The agent-side `insteadOf` rewrite keys off the original hostname,
-  so the manifest's `Upstream` URL stays human-readable.
+  entry for those upstreams.
 - **Agent-side URL rewrite.** Provisioner emits `~/.gitconfig`
   with `[url "<gate-url>"] insteadOf = <real-url>` so every git
   operation against the declared upstream (push, fetch, clone,

docs/prds/0009-remove-ssh-gate.md

@@ -88,8 +88,7 @@ the unused path.
 - **Pipelock interaction.** Drop the SSH-derived branch from
   pipelock's `ssrf.ip_allowlist` build. With no `bottle.ssh`
   there is no per-upstream IP carve-out to render; git-gate
-  has its own egress network and pulls in upstream resolution
-  via `ExtraHosts` plus DNS.
+  has its own egress network.
 - **Tests.** Delete the ssh-gate unit + integration suites,
   the ssh fixtures in `tests/fixtures.py`, and the
   shadow-route assertions in `test_manifest_git.py`. Adjust

docs/prds/0011-per-file-md-manifest.md

@@ -274,8 +274,6 @@ git:
       Name: bot-bottle
       Upstream: ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git
       IdentityFile: ~/.ssh/gitea-delos-2.pem
-      ExtraHosts:
-        gitea.dideric.is: 100.78.141.42
       KnownHostKey: ssh-rsa AAAAB3...
 egress:
   allowlist:

docs/prds/0025-bottle-extends.md

@@ -161,8 +161,7 @@ expectation. (Same model as shell `export` precedence.)
 `git.remotes` is also keyed, so it follows dict-style inheritance:
 children can override one host without restating every remote. The
 remote entry is replaced as a whole on host collision because
-`Upstream`, `IdentityFile`, `KnownHostKey`, and `ExtraHosts` are
-tightly coupled.
+`Upstream`, `IdentityFile`, and `KnownHostKey` are tightly coupled.
 
 The `git.user` dataclass-overlay (each non-empty field wins
 individually) is so a parent can declare `git.user.name` and a

docs/prds/0045-workspace-porting-plan.md

@@ -0,0 +1,167 @@
+# PRD 0045: Workspace Porting Plan
+
+- **Status:** Active
+- **Author:** didericis-codex
+- **Created:** 2026-06-02
+- **Issue:** #116
+
+## Summary
+
+Add a backend-neutral `WorkspacePlan` that describes how the operator's current
+workspace is represented inside a bottle. Docker and smolmachines should both
+use this plan for workspace path, working directory, content copy, `.git` copy,
+ownership, and provider trust configuration instead of rediscovering
+`/home/node/workspace` in separate launch and provisioning code paths.
+
+## Problem
+
+The current `--cwd` behavior is spread across backend-specific code:
+
+- Docker builds a derived image that copies the host cwd to
+  `/home/node/workspace`, sets that as `WORKDIR`, and patches Claude trust in
+  the generated Dockerfile.
+- Docker git provisioning separately copies `.git` into
+  `/home/node/workspace/.git`.
+- smolmachines git provisioning reconstructs `<guest_home>/workspace/.git`, but
+  does not copy the full working tree.
+- Codex provider setup trusts `guest_home`, not the copied workspace path.
+
+These details create backend drift and make provider-specific workspace fixes
+easy to hard-code in the wrong layer.
+
+## Goals / Success Criteria
+
+- `BottleSpec` remains the CLI intent shape (`copy_cwd`, `user_cwd`), while a
+  resolved `WorkspacePlan` carries the backend-neutral guest workspace contract.
+- `BottlePlan` exposes `workspace_plan` so shared and backend-specific
+  provisioning paths consume one resolved object.
+- The default in-bottle workspace path remains `/home/node/workspace` when
+  `--cwd` is enabled.
+- Docker uses `WorkspacePlan` when building the derived cwd image and when
+  provisioning cwd `.git` state.
+- smolmachines copies the host cwd contents into the same logical workspace
+  path and uses `WorkspacePlan` when provisioning cwd `.git` state.
+- Provider trust configuration is written for the workspace path when `--cwd`
+  is enabled, and for the guest home when `--cwd` is disabled.
+- Unit tests cover plan resolution, provider trust path selection, Docker
+  derived image rendering, and both backends' `.git` copy targets.
+
+## Non-goals
+
+- No new user-facing flags for custom workspace paths.
+- No manifest schema changes.
+- No redesign of git-gate or `bottle.git` entries.
+- No switch from Docker image-copy to bind-mount.
+- No unrelated provider auth changes.
+
+## Scope
+
+In scope:
+
+- Add a small workspace planning module.
+- Add `workspace_plan` to `BottlePlan` and populate it in Docker and
+  smolmachines prepare paths.
+- Thread the trusted project path into provider provisioning.
+- Replace hard-coded `/home/node/workspace` cwd copy and `.git` copy sites with
+  `WorkspacePlan` values.
+- Copy full host cwd contents for smolmachines `--cwd` parity.
+- Update focused unit tests.
+
+Out of scope:
+
+- Integration tests that launch real Docker containers or smolmachines VMs.
+- Path customization in the bottle manifest or CLI.
+- Runtime synchronization after bottle launch; this remains a launch-time copy.
+
+## Design
+
+Add `bot_bottle/workspace.py`:
+
+```python
+@dataclass(frozen=True)
+class WorkspacePlan:
+    enabled: bool
+    host_path: Path
+    guest_home: str
+    guest_path: str
+    workdir: str
+    owner: str = "node:node"
+    mode: str = "755"
+    copy_contents: bool = True
+    copy_git: bool = True
+    has_host_git_dir: bool = False
+```
+
+`workspace_plan(spec, guest_home)` resolves:
+
+- `enabled` from `spec.copy_cwd`.
+- `host_path` from `spec.user_cwd`.
+- `guest_path` as `<guest_home>/workspace` when enabled, else `guest_home`.
+- `workdir` as `guest_path` when enabled, else `guest_home`.
+- `has_host_git_dir` from `<host_path>/.git`.
+
+Backends resolve this in `prepare` using their existing guest-home knobs:
+
+- Docker: `BOT_BOTTLE_CONTAINER_HOME`, default `/home/node`.
+- smolmachines: `BOT_BOTTLE_GUEST_HOME`, default `/home/node`.
+
+`BottlePlan` carries the result so launch, git provisioning, and provider
+provisioning stop consulting `spec.copy_cwd` and hard-coded paths directly.
+
+### Docker
+
+Keep the current derived-image transport. Change
+`build_image_with_cwd(derived, base, cwd)` to accept a `WorkspacePlan` or
+explicit guest path/workdir fields, then render:
+
+- `COPY --chown=node:node . <workspace_plan.guest_path>`
+- `WORKDIR <workspace_plan.workdir>`
+
+Claude trust should move out of the generated cwd Dockerfile and into provider
+provisioning so Docker and smolmachines share the same provider trust behavior.
+
+### smolmachines
+
+Copy host cwd contents into `workspace_plan.guest_path` during provisioning or
+VM initialization, then chown the resulting workspace to `node:node`. Continue
+to copy `.git` through the existing smolvm transport, but target
+`<workspace_plan.guest_path>/.git`.
+
+This intentionally closes the current parity gap where smolmachines receives
+repo metadata without the working tree.
+
+### Provider Trust
+
+Extend provider planning with a `trusted_project_path` argument. Callers pass
+`workspace_plan.workdir`.
+
+Codex writes:
+
+```toml
+[projects."<trusted_project_path>"]
+trust_level = "trusted"
+```
+
+Claude writes or updates `.claude.json` so `projects` includes
+`trusted_project_path` with `hasTrustDialogAccepted: true`. This provisioning
+belongs in `AgentProvisionPlan` so both backends apply it through their existing
+provider file-copy primitives.
+
+## Testing Strategy
+
+- Unit-test `workspace_plan()` for enabled and disabled cwd, guest-home
+  overrides, and `.git` detection.
+- Unit-test Docker cwd image rendering to prove it uses the plan's guest path
+  and workdir.
+- Unit-test provider planning for Codex and Claude trusted project paths.
+- Unit-test Docker and smolmachines git provisioning targets using mocked copy
+  and exec primitives.
+- Unit-test smolmachines workspace content copy target and ownership command.
+
+Run:
+
+- `python3 -m unittest discover -s tests/unit`
+
+## Open Questions
+
+None.

docs/prds/0046-remove-git-remote-host-overrides.md

@@ -0,0 +1,64 @@
+# PRD 0046: Remove Git Remote Host Overrides
+
+- **Status:** Active
+- **Author:** didericis-codex
+- **Created:** 2026-06-02
+- **Issue:** #152
+
+## Summary
+
+Remove git remote host override plumbing from bottle manifests and git-gate
+startup. Git remote declarations should describe upstream repositories and the
+git-gate credential material needed to mirror them; they should not also
+configure hosts-file behavior for sidecars.
+
+## Problem
+
+The git remote model currently has a hosts override path that can make a git
+upstream resolve differently inside the git-gate sidecar. That is surprising
+because the same hostname may also be used for HTTP/API traffic that should keep
+using the normal egress DNS and policy path.
+
+Keeping host resolution in the git remote model makes repository routing,
+sidecar hosts files, and egress behavior feel coupled even when the operator
+only meant to configure git-gate.
+
+## Goals / Success Criteria
+
+- Git remote manifest parsing no longer stores host override data.
+- Git-gate upstream plans no longer carry host override data.
+- Docker compose rendering no longer emits sidecar `extra_hosts` entries from
+  git remote declarations.
+- Smolmachines bundle launch planning has no unused host override path for
+  git-gate.
+- Focused unit tests cover the absence of sidecar `extra_hosts` for git
+  upstreams.
+- Current user-facing documentation no longer advertises git remote host
+  overrides.
+
+## Non-goals
+
+- No replacement hosts-file override feature.
+- No SSH client config provisioning.
+- No change to git-gate's SSH credential or known-host handling.
+- No change to egress DNS, HTTP auth, or pipelock routing semantics.
+
+## Design
+
+Remove the host override field from the internal `GitEntry` and
+`GitGateUpstream` models. Remove the git-gate aggregation helper and the Docker
+compose code that converted those values into sidecar `extra_hosts`.
+
+The manifest parser does not need a migration-specific error path. After this
+change, the old hosts override key has no internal model field and no runtime
+effect.
+
+## Testing Strategy
+
+Run:
+
+- `python3 -m unittest discover -s tests/unit`
+
+## Open Questions
+
+None.

docs/prds/0047-git-gate-manifest-redesign.md

@@ -0,0 +1,170 @@
+# PRD 0047: Git-gate Manifest Redesign
+
+- **Status:** Active
+- **Author:** didericis
+- **Created:** 2026-06-03
+- **Issue:** #160
+
+## Summary
+
+Replace the `git` top-level key in bottle and agent manifests with `git-gate`,
+consolidating git-identity configuration (`user`) and git-gate sidecar
+configuration (`repos`) under a single section. Within `repos`, field names
+move to lowercase snake_case and the local repo name is promoted to the YAML
+key. The change removes the ambiguity in the current `git` block: its fields
+are not generic git or SSH config — they are specifically the credential,
+host-trust, and identity material that is managed in relation to git-gate.
+
+## Problem
+
+The current bottle manifest uses a `git` top-level key that mixes two concerns:
+
+- `git.user` — `git config --global user.name / user.email` identity, which
+  the provisioner injects into the agent's shell.
+- `git.remotes` — upstream URL, identity file, and host key material that the
+  git-gate sidecar consumes; the agent never sees these values.
+
+That grouping suggests the `remotes` entries behave like an SSH config or a
+generic `.gitconfig` remote declaration. They do not. The gate reads the
+credential material to push upstream after gitleaks passes; the agent's
+`.gitconfig` receives only the `insteadOf` rewrite that redirects traffic
+through the gate. Nothing in the current key name or field names signals this.
+
+Splitting `git.user` into a separate section from `git.remotes` also doesn't
+help: both concepts exist because of git-gate, and keeping them under a single
+`git-gate` key makes their relationship and purpose explicit.
+
+The field names inside each remote entry also use PascalCase (`Name`,
+`Upstream`, `IdentityFile`, `KnownHostKey`), inconsistent with every other
+manifest section, which uses snake_case.
+
+The current `git.remotes` dict is keyed by upstream host, which works for
+simple remotes but forces a separate `Name` field to give the gate's bare repo
+a local label. The host key and `Name` field are often redundant or confusing
+(e.g., IP-literal upstreams where the key carries no semantic meaning).
+
+## Goals / Success Criteria
+
+- `git-gate` is accepted as a top-level bottle and agent key; `git` is removed
+  from both allowed-key sets.
+- `git-gate.repos` is a named map where each key is the local repo name
+  exposed by the gate (bottle-only; rejected at the agent level).
+- Each entry in `git-gate.repos` accepts exactly: `url` (required), `identity`
+  (required), `host_key` (optional).
+- `git-gate.user` replaces `git.user` on both bottles and agents, with the
+  same `name` / `email` fields and overlay semantics.
+- The manifest parser rejects `git.remotes` and `git.user` with errors that
+  point to the new keys.
+- `GitEntry` internal fields are updated to match the new names; all callers
+  (provisioner, git-gate render, plan, tests) compile and pass.
+- Existing unit tests in `tests/unit/test_manifest_git.py` and
+  `tests/unit/test_manifest_git_user.py` are rewritten to use the new YAML
+  shape; all other manifest unit tests remain green.
+- The demo manifest (`bot-bottle.demo.json`) and any examples using the old
+  shape are updated.
+
+## Non-goals
+
+- No change to `git.user` / `git-gate.user` semantics or field names (`name`,
+  `email`).
+- No change to git-gate runtime behavior (mirroring, gitleaks, access-hook
+  refresh).
+- No change to the `insteadOf` rewrite the provisioner emits.
+- No migration shim: the old `git.*` shape is rejected immediately with clear
+  error messages pointing to the new keys.
+- No change to how agent-level user config overlays the bottle-level value.
+
+## Design
+
+### New manifest shape
+
+**Before** (bottle frontmatter):
+
+```yaml
+git:
+  user:
+    name: implementer-bot
+    email: eric+implementer@dideric.is
+  remotes:
+    gitea.dideric.is:
+      Name: bot-bottle
+      Upstream: ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git
+      IdentityFile: ~/.ssh/gitea-delos-2.pem
+      KnownHostKey: "ssh-rsa AAAA..."
+```
+
+**After**:
+
+```yaml
+git-gate:
+  user:
+    name: implementer-bot
+    email: eric+implementer@dideric.is
+  repos:
+    bot-bottle:
+      url: ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git
+      identity: ~/.ssh/gitea-delos-2.pem
+      host_key: "ssh-rsa AAAA..."
+```
+
+`git-gate` is the single optional top-level key for all git configuration.
+Bottles that previously used only `git.user` now use only `git-gate.user`;
+those that used only `git.remotes` now use only `git-gate.repos`.
+
+### Key-name-as-repo-name
+
+The YAML key in `git-gate.repos` becomes the local repo name (previously
+`Name`). The upstream host is no longer the primary key; the provisioner and
+gate derive it from the `url` field during parse. IP-literal upstreams work
+without an artificial host-as-key constraint.
+
+### Field renames
+
+| Old field | New field |
+|-----------|-----------|
+| `Name` (from dict key) | YAML key in `repos` |
+| `Upstream` | `url` |
+| `IdentityFile` | `identity` |
+| `KnownHostKey` | `host_key` |
+
+### Parser changes
+
+- `manifest_schema.py`: replace `"git"` with `"git-gate"` in `BOTTLE_KEYS`
+  and `AGENT_KEYS_OPTIONAL`.
+- `manifest.py`: replace `_parse_git_config` with `_parse_git_gate_config`
+  that validates both `user` and `repos` subkeys. Update `Bottle.from_dict`
+  and `Agent.from_dict` to call it for the `"git-gate"` key.
+- `Agent.from_dict` continues to reject `repos` at the agent level with a
+  clear error.
+- Remove `from_remote_dict` and update `GitEntry._from_object` to accept the
+  new field names. Internal dataclass field names (`UpstreamUser`, etc.) are
+  unchanged — they are internal plumbing, not user-facing.
+- Any existing `"git"` key raises a targeted error:
+
+  ```
+  bottle 'dev' uses 'git' which has been replaced by 'git-gate' (PRD 0047).
+  Move git.user → git-gate.user and git.remotes → git-gate.repos.
+  ```
+
+## Testing Strategy
+
+Run:
+
+```
+python3 -m unittest discover -s tests/unit
+```
+
+Test files to update:
+
+- `tests/unit/test_manifest_git.py` — rewrite fixtures and assertions to use
+  `git-gate.repos` / lowercase fields. Cover: minimal entry, optional
+  `host_key`, missing `url`, missing `identity`, unknown key, IP-literal
+  upstreams, duplicate name rejection, old `git.remotes` and bare `git` key
+  both rejected.
+- `tests/unit/test_manifest_git_user.py` and
+  `tests/unit/test_manifest_agent_git_user.py` — update fixtures to use
+  `git-gate.user` at both bottle and agent level.
+
+## Open Questions
+
+None.

examples/agents/implementer.md

@@ -5,7 +5,7 @@ model: opus
 bottle: dev
 skills:
   - init-prd
-git:
+git-gate:
   user:
     name: implementer-bot
     email: eric+implementer@dideric.is

tests/fixtures.py

@@ -38,23 +38,21 @@ def fixture_with_egress_dict() -> dict[str, Any]:
 
 
 def fixture_with_git_dict() -> dict[str, Any]:
-    """Bottle declares a git-gate upstream. JSON shape."""
+    """Bottle declares git-gate upstreams. JSON shape."""
     return {
         "bottles": {
             "dev": {
-                "git": {
-                    "remotes": {
-                        "gitea.dideric.is": {
-                            "Name": "bot-bottle",
-                            "Upstream": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
-                            "IdentityFile": "/dev/null",
-                            "KnownHostKey": "ssh-ed25519 AAAA...",
+                "git-gate": {
+                    "repos": {
+                        "bot-bottle": {
+                            "url": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
+                            "identity": "/dev/null",
+                            "host_key": "ssh-ed25519 AAAA...",
                         },
-                        "github.com": {
-                            "Name": "foo",
-                            "Upstream": "ssh://git@github.com/didericis/foo.git",
-                            "IdentityFile": "/dev/null",
-                            "KnownHostKey": "ssh-ed25519 BBBB...",
+                        "foo": {
+                            "url": "ssh://git@github.com/didericis/foo.git",
+                            "identity": "/dev/null",
+                            "host_key": "ssh-ed25519 BBBB...",
                         },
                     },
                 }

tests/unit/test_agent_provider.py

@@ -31,6 +31,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
                 dockerfile="/tmp/Dockerfile.codex",
                 state_dir=Path(tmp),
             )
+            config = Path(tmp, "codex-config.toml").read_text()
         self.assertEqual("codex", plan.template)
         self.assertEqual("codex", plan.command)
         self.assertEqual("read_prompt_file", plan.prompt_mode)
@@ -45,6 +46,18 @@ class TestAgentProviderRuntime(unittest.TestCase):
             ("/home/node/.codex/config.toml",),
             tuple(f.guest_path for f in plan.files),
         )
+        self.assertIn('[projects."/home/node"]', config)
+
+    def test_codex_trusts_requested_project_path(self):
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            agent_provision_plan(
+                template="codex",
+                dockerfile="",
+                state_dir=Path(tmp),
+                trusted_project_path="/home/node/workspace",
+            )
+            config = Path(tmp, "codex-config.toml").read_text()
+        self.assertIn('[projects."/home/node/workspace"]', config)
 
     def test_codex_forward_host_credentials_adds_auth_and_verify(self):
         with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
@@ -79,6 +92,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
                 state_dir=Path(tmp),
                 auth_token="BOT_BOTTLE_CLAUDE_OAUTH_TOKEN",
             )
+            claude_config = json.loads(Path(tmp, "claude.json").read_text())
         self.assertEqual(1, len(plan.egress_routes))
         route = plan.egress_routes[0]
         self.assertEqual("api.anthropic.com", route.host)
@@ -89,6 +103,20 @@ class TestAgentProviderRuntime(unittest.TestCase):
         self.assertEqual("1", plan.env_vars["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"])
         self.assertEqual("1", plan.env_vars["DISABLE_ERROR_REPORTING"])
         self.assertEqual(frozenset({"CLAUDE_CODE_OAUTH_TOKEN"}), plan.hidden_env_names)
+        self.assertIn("/home/node", claude_config["projects"])
+        self.assertIn("/home/node/.claude.json", {f.guest_path for f in plan.files})
+
+    def test_claude_trusts_requested_project_path(self):
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            agent_provision_plan(
+                template="claude",
+                dockerfile="",
+                state_dir=Path(tmp),
+                trusted_project_path="/home/node/workspace",
+            )
+            config = json.loads(Path(tmp, "claude.json").read_text())
+        self.assertIn("/home/node", config["projects"])
+        self.assertIn("/home/node/workspace", config["projects"])
 
     def test_codex_forward_host_credentials_populates_egress_routes(self):
         with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:

tests/unit/test_backend_selection.py

@@ -81,6 +81,46 @@ class TestEnumerateActiveAgents(unittest.TestCase):
         ):
             self.assertEqual([a, b], enumerate_active_agents())
 
+    def test_sorts_by_started_at_then_slug_across_backends(self):
+        newer = ActiveAgent(
+            backend_name="docker", slug="docker-new", agent_name="impl",
+            started_at="2026-06-02T12:00:00Z", services=(),
+        )
+        tie_b = ActiveAgent(
+            backend_name="docker", slug="b-slug", agent_name="review",
+            started_at="2026-06-02T11:00:00Z", services=(),
+        )
+        missing_metadata = ActiveAgent(
+            backend_name="smolmachines", slug="missing-metadata",
+            agent_name="?", started_at="", services=(),
+        )
+        tie_a = ActiveAgent(
+            backend_name="smolmachines", slug="a-slug", agent_name="research",
+            started_at="2026-06-02T11:00:00Z", services=(),
+        )
+
+        class _FakeBackend:
+            def __init__(self, items):
+                self._items = items
+
+            def is_available(self):
+                return True
+
+            def enumerate_active(self):
+                return self._items
+
+        with patch.object(
+            backend_mod, "_BACKENDS",
+            {
+                "docker": _FakeBackend([newer, tie_b]),
+                "smolmachines": _FakeBackend([missing_metadata, tie_a]),
+            },
+        ):
+            self.assertEqual(
+                [missing_metadata, tie_a, tie_b, newer],
+                enumerate_active_agents(),
+            )
+
     def test_empty_when_no_backends_have_active(self):
         class _FakeBackend:
             def is_available(self):

tests/unit/test_codex_auth.py

@@ -157,6 +157,22 @@ class TestCodexHostAccessToken(unittest.TestCase):
             host_exp, _jwt_payload(dummy["tokens"]["id_token"])["exp"],
         )
 
+    def test_dummy_auth_replaces_last_refresh_with_valid_timestamp(self):
+        self._write({
+            "auth_mode": "chatgpt",
+            "last_refresh": "host-refresh-metadata",
+            "tokens": {
+                "access_token": _jwt(2000000000),
+                "refresh_token": "hidden",
+            },
+        })
+        dummy = json.loads(codex_dummy_auth_json(
+            {"CODEX_HOME": str(self.home)},
+            now=datetime(2026, 1, 1, 2, 3, 4, 5000, tzinfo=timezone.utc),
+        ))
+        self.assertEqual("2026-01-01T02:03:04.005Z", dummy["last_refresh"])
+        self.assertNotEqual("host-refresh-metadata", dummy["last_refresh"])
+
     def test_dummy_auth_keeps_required_account_claim_shape(self):
         self._write({
             "auth_mode": "chatgpt",
@@ -215,10 +231,12 @@ class TestCodexHostAccessToken(unittest.TestCase):
             "top-list-secret",
             "token-nested-secret",
             "token-list-secret",
+            "last-refresh-secret",
         ]
         self._write({
             "auth_mode": "chatgpt",
             "session_context": "top-session-secret",
+            "last_refresh": "last-refresh-secret",
             "future_nested": {"value": "top-nested-secret"},
             "future_list": ["top-list-secret"],
             "tokens": {
@@ -255,6 +273,7 @@ class TestCodexHostAccessToken(unittest.TestCase):
 
         dummy = json.loads(dummy_json)
         self.assertEqual("bot-bottle-placeholder", dummy["session_context"])
+        self.assertEqual("2026-01-01T00:00:00.000Z", dummy["last_refresh"])
         self.assertEqual({}, dummy["future_nested"])
         self.assertEqual([], dummy["future_list"])
         self.assertEqual("bot-bottle-placeholder", dummy["tokens"]["refresh_token"])

tests/unit/test_compose.py

@@ -33,6 +33,7 @@ from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.supervise import SupervisePlan
+from bot_bottle.workspace import workspace_plan
 
 
 SLUG = "demo-abc12"
@@ -48,11 +49,10 @@ def _manifest(*, supervise: bool, with_git: bool, with_egress: bool) -> Manifest
     if supervise:
         bottle["supervise"] = True
     if with_git:
-        bottle["git"] = {"remotes": {
-            "example.com": {
-                "Name": "upstream",
-                "Upstream": "ssh://git@example.com:22/x/y.git",
-                "IdentityFile": "/etc/hostname",  # any existing file
+        bottle["git-gate"] = {"repos": {
+            "upstream": {
+                "url": "ssh://git@example.com:22/x/y.git",
+                "identity": "/etc/hostname",  # any existing file
             },
         }}
     if with_egress:
@@ -150,7 +150,6 @@ def _plan(
             identity_file="/etc/hostname",
             known_host_key="",
             known_hosts_file=STATE / "git-gate" / "upstream-known_hosts",
-            extra_hosts={"example.com": "10.0.0.1"},
         ),)
     routes: tuple[EgressRoute, ...] = ()
     if with_egress:
@@ -163,8 +162,9 @@ def _plan(
             roles=(),
         ),)
 
+    spec = _spec(supervise=supervise, with_git=with_git, with_egress=with_egress)
     return DockerBottlePlan(
-        spec=_spec(supervise=supervise, with_git=with_git, with_egress=with_egress),
+        spec=spec,
         stage_dir=STAGE,
         slug=SLUG,
         container_name=f"bot-bottle-{SLUG}",
@@ -189,6 +189,7 @@ def _plan(
             dockerfile="",
             guest_env={},
         ),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
     )
 
 
@@ -437,12 +438,8 @@ class TestSidecarBundleShape(unittest.TestCase):
         self.assertTrue(any("supervise/queue" in t or t.startswith("/run/supervise")
                             for t in targets))
 
-    def test_extra_hosts_emitted_for_git_upstreams(self):
+    def test_extra_hosts_omitted_for_git_upstreams(self):
         sc = self._render(with_git=True)["services"]["sidecars"]
-        self.assertIn("example.com:10.0.0.1", sc.get("extra_hosts", []))
-
-    def test_extra_hosts_omitted_when_no_git(self):
-        sc = self._render()["services"]["sidecars"]
         self.assertNotIn("extra_hosts", sc)
 
     def test_agent_depends_on_bundle_only(self):

tests/unit/test_docker_launch_teardown.py

@@ -0,0 +1,145 @@
+"""Unit: Docker launch teardown warning on ExitStack failure (issue #156).
+
+When a callback registered in the ExitStack raises during teardown,
+the teardown function must emit a WARNING-level message that includes
+the container name and operation type, rather than silently discarding
+the exception.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from bot_bottle.agent_provider import AgentProvisionPlan
+from bot_bottle.backend import BottleSpec
+from bot_bottle.backend.docker import launch as launch_mod
+from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
+from bot_bottle.egress import EgressPlan
+from bot_bottle.git_gate import GitGatePlan
+from bot_bottle.manifest import Manifest
+from bot_bottle.pipelock import PipelockProxyPlan
+from bot_bottle.workspace import workspace_plan
+
+
+def _manifest() -> Manifest:
+    return Manifest.from_json_obj({
+        "bottles": {"dev": {}},
+        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+    })
+
+
+def _plan(tmp: str) -> DockerBottlePlan:
+    stage = Path(tmp)
+    manifest = _manifest()
+    spec = BottleSpec(
+        manifest=manifest,
+        agent_name="demo",
+        copy_cwd=False,
+        user_cwd=tmp,
+        identity="test-teardown-00001",
+    )
+    return DockerBottlePlan(
+        spec=spec,
+        stage_dir=stage,
+        git_gate_plan=GitGatePlan(
+            slug="test-teardown-00001",
+            entrypoint_script=stage / "entrypoint.sh",
+            hook_script=stage / "hook.sh",
+            access_hook_script=stage / "access-hook.sh",
+            upstreams=(),
+        ),
+        egress_plan=EgressPlan(
+            slug="test-teardown-00001",
+            routes_path=stage / "egress.yaml",
+            routes=(),
+            token_env_map={},
+        ),
+        supervise_plan=None,
+        agent_provision=AgentProvisionPlan(
+            template="claude",
+            command="claude",
+            prompt_mode="append_file",
+            image="",
+            dockerfile="",
+            guest_env={},
+        ),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
+        slug="test-teardown-00001",
+        container_name="bot-bottle-test-teardown-abc",
+        container_name_pinned=False,
+        image="bot-bottle-claude:latest",
+        derived_image="",
+        runtime_image="bot-bottle-claude:latest",
+        dockerfile_path="",
+        env_file=stage / "env",
+        forwarded_env={},
+        prompt_file=stage / "prompt.txt",
+        proxy_plan=PipelockProxyPlan(
+            yaml_path=stage / "pipelock.yaml",
+            slug="test-teardown-00001",
+        ),
+        use_runsc=False,
+    )
+
+
+class TestTeardownWarning(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.mkdtemp(prefix="docker-launch-teardown-test.")
+
+    def tearDown(self) -> None:
+        import shutil
+        shutil.rmtree(self._tmp, ignore_errors=True)
+
+    def test_teardown_failure_emits_warning_with_container_and_operation(self):
+        plan = _plan(self._tmp)
+        buf = io.StringIO()
+
+        with mock.patch.object(launch_mod.docker_mod, "build_image"), \
+             mock.patch.object(
+                 launch_mod, "pipelock_tls_init",
+                 return_value=(Path("/ca.crt"), Path("/ca.key")),
+             ), \
+             mock.patch.object(
+                 launch_mod, "egress_tls_init",
+                 return_value=(Path("/egress_ca"), Path("/egress_cert")),
+             ), \
+             mock.patch.object(
+                 launch_mod.network_mod, "network_name_for_slug",
+                 return_value="bb-internal-test",
+             ), \
+             mock.patch.object(
+                 launch_mod.network_mod, "network_egress_name_for_slug",
+                 return_value="bb-egress-test",
+             ), \
+             mock.patch.object(
+                 launch_mod, "bottle_plan_to_compose",
+                 return_value={"services": {"agent": {}}},
+             ), \
+             mock.patch.object(
+                 launch_mod, "write_compose_file",
+                 return_value=Path("/tmp/compose.yml"),
+             ), \
+             mock.patch.object(launch_mod, "compose_up"), \
+             mock.patch.object(launch_mod, "compose_dump_logs"), \
+             mock.patch.object(
+                 launch_mod, "compose_down",
+                 side_effect=RuntimeError("network remove failed"),
+             ), \
+             contextlib.redirect_stderr(buf):
+            provision = mock.Mock(return_value=None)
+            with launch_mod.launch(plan, provision=provision):
+                pass
+
+        output = buf.getvalue()
+        self.assertIn("bot-bottle: warning:", output)
+        self.assertIn("bot-bottle-test-teardown-abc", output)
+        self.assertIn("compose-down", output)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_docker_provision_git_user.py

@@ -21,20 +21,23 @@ from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
+from bot_bottle.workspace import workspace_plan
 
 
 def _plan(*, git_user: dict | None = None,
+          copy_cwd: bool = False,
+          user_cwd: str = "/tmp/x",
           stage_dir: Path | None = None) -> DockerBottlePlan:
     bottle_json: dict = {}
     if git_user is not None:
-        bottle_json["git"] = {"user": git_user}
+        bottle_json["git-gate"] = {"user": git_user}
     manifest = Manifest.from_json_obj({
         "bottles": {"dev": bottle_json},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     })
     spec = BottleSpec(
         manifest=manifest, agent_name="demo",
-        copy_cwd=False, user_cwd="/tmp/x",
+        copy_cwd=copy_cwd, user_cwd=user_cwd,
     )
     return DockerBottlePlan(
         spec=spec,
@@ -75,6 +78,7 @@ def _plan(*, git_user: dict | None = None,
             dockerfile="",
             guest_env={},
         ),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
     )
 
 
@@ -106,6 +110,28 @@ class TestProvisionGitUser(unittest.TestCase):
             )
         self.assertEqual([], _git_config_calls(run))
 
+    def test_copies_cwd_git_to_workspace_plan_path(self):
+        cwd = self.stage / "cwd"
+        (cwd / ".git").mkdir(parents=True)
+        plan = _plan(copy_cwd=True, user_cwd=str(cwd), stage_dir=self.stage)
+        with patch.object(_git.subprocess, "run") as run:
+            _git._provision_cwd_git(plan, "bot-bottle-demo-abc12")
+
+        self.assertEqual(
+            [
+                "docker", "cp", f"{cwd}/.git",
+                "bot-bottle-demo-abc12:/home/node/workspace/.git",
+            ],
+            run.call_args_list[0].args[0],
+        )
+        self.assertEqual(
+            [
+                "docker", "exec", "-u", "0", "bot-bottle-demo-abc12",
+                "chown", "-R", "node:node", "/home/node/workspace/.git",
+            ],
+            run.call_args_list[1].args[0],
+        )
+
     def test_sets_name_and_email(self):
         plan = _plan(
             git_user={"name": "Eric Bauerfeld", "email": "eric@dideric.is"},

tests/unit/test_docker_provision_provider_auth.py

@@ -18,6 +18,7 @@ from bot_bottle.egress import EgressPlan
 from bot_bottle.git_gate import GitGatePlan
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
+from bot_bottle.workspace import workspace_plan
 
 
 def _plan(
@@ -29,13 +30,14 @@ def _plan(
         "bottles": {"dev": {"agent_provider": {"template": "codex"}}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     })
+    spec = BottleSpec(
+        manifest=manifest,
+        agent_name="demo",
+        copy_cwd=False,
+        user_cwd="/tmp/x",
+    )
     return DockerBottlePlan(
-        spec=BottleSpec(
-            manifest=manifest,
-            agent_name="demo",
-            copy_cwd=False,
-            user_cwd="/tmp/x",
-        ),
+        spec=spec,
         stage_dir=Path("/tmp/stage"),
         slug="demo-abc12",
         container_name="bot-bottle-demo-abc12",
@@ -69,6 +71,7 @@ def _plan(
         agent_provision=_agent_provision(
             agent_provider_template, codex_auth_file=codex_auth_file,
         ),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
     )
 
 

tests/unit/test_docker_util_image.py

@@ -8,10 +8,13 @@ integration smoke."""
 from __future__ import annotations
 
 import subprocess
+import tempfile
 import unittest
+from pathlib import Path
 from unittest.mock import patch
 
 from bot_bottle.backend.docker import util as docker_mod
+from bot_bottle.workspace import WorkspacePlan
 
 
 def _ok(stdout: str = "", stderr: str = "") -> subprocess.CompletedProcess:
@@ -67,5 +70,60 @@ class TestSave(unittest.TestCase):
         )
 
 
+class TestBuildImageWithCwd(unittest.TestCase):
+    def test_uses_workspace_plan_paths(self):
+        with tempfile.TemporaryDirectory(prefix="bb-docker-cwd.") as tmp:
+            workspace = WorkspacePlan(
+                enabled=True,
+                host_path=Path(tmp),
+                guest_home="/guest/home",
+                guest_path="/guest/home/workspace",
+                workdir="/guest/home/workspace",
+            )
+            with patch.object(docker_mod.subprocess, "run") as run:
+                docker_mod.build_image_with_cwd("derived:tag", "base:tag", workspace)
+
+        argv = run.call_args.args[0]
+        dockerfile = run.call_args.kwargs["input"]
+        self.assertEqual(["docker", "build", "-t", "derived:tag", "-f", "-"], argv[:6])
+        self.assertTrue(argv[6].endswith("/context"))
+        self.assertIn("FROM base:tag\n", dockerfile)
+        self.assertIn(
+            "COPY --chown=node:node workspace/. /guest/home/workspace\n",
+            dockerfile,
+        )
+        self.assertIn("WORKDIR /guest/home/workspace\n", dockerfile)
+
+    def test_staged_context_includes_hidden_files_but_not_git_dir(self):
+        with tempfile.TemporaryDirectory(prefix="bb-docker-cwd.") as tmp:
+            root = Path(tmp)
+            (root / ".gitignore").write_text("*.pyc\n")
+            (root / ".dockerignore").write_text(".gitignore\n")
+            (root / ".env.example").write_text("SAFE=1\n")
+            (root / ".git").mkdir()
+            (root / ".git" / "config").write_text("[core]\n")
+            workspace = WorkspacePlan(
+                enabled=True,
+                host_path=root,
+                guest_home="/guest/home",
+                guest_path="/guest/home/workspace",
+                workdir="/guest/home/workspace",
+            )
+
+            def inspect_context(*args, **kwargs):
+                context = Path(args[0][-1])
+                staged = context / "workspace"
+                self.assertTrue((staged / ".gitignore").is_file())
+                self.assertTrue((staged / ".dockerignore").is_file())
+                self.assertTrue((staged / ".env.example").is_file())
+                self.assertFalse((staged / ".git").exists())
+                return _ok()
+
+            with patch.object(
+                docker_mod.subprocess, "run", side_effect=inspect_context,
+            ):
+                docker_mod.build_image_with_cwd("derived:tag", "base:tag", workspace)
+
+
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_git_gate.py

@@ -9,14 +9,12 @@ from bot_bottle.git_gate import (
     GitGate,
     GitGatePlan,
     GitGateUpstream,
-    git_gate_aggregate_extra_hosts,
     git_gate_known_hosts_line,
     git_gate_render_access_hook,
     git_gate_render_entrypoint,
     git_gate_render_hook,
     git_gate_upstreams_for_bottle,
 )
-from bot_bottle.log import Die
 from bot_bottle.manifest import Manifest
 from tests.fixtures import fixture_minimal, fixture_with_git
 
@@ -46,86 +44,6 @@ class TestUpstreamsForBottle(unittest.TestCase):
         self.assertEqual((), git_gate_upstreams_for_bottle(bottle))
 
 
-class TestExtraHostsPlumbing(unittest.TestCase):
-    def test_upstream_carries_extra_hosts_from_manifest(self):
-        m = Manifest.from_json_obj({
-            "bottles": {
-                "dev": {
-                    "git": {"remotes": {
-                        "gitea.dideric.is": {
-                            "Name": "bot-bottle",
-                            "Upstream": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
-                            "IdentityFile": "/dev/null",
-                            "ExtraHosts": {"gitea.dideric.is": "100.78.141.42"},
-                        },
-                    }},
-                },
-            },
-            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-        })
-        ups = git_gate_upstreams_for_bottle(m.bottles["dev"])
-        self.assertEqual(
-            {"gitea.dideric.is": "100.78.141.42"}, dict(ups[0].extra_hosts)
-        )
-
-    def test_aggregator_merges_distinct_hostnames(self):
-        ups = (
-            GitGateUpstream(
-                name="a", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"a.example": "10.0.0.1"},
-            ),
-            GitGateUpstream(
-                name="b", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"b.example": "10.0.0.2"},
-            ),
-        )
-        self.assertEqual(
-            {"a.example": "10.0.0.1", "b.example": "10.0.0.2"},
-            git_gate_aggregate_extra_hosts(ups),
-        )
-
-    def test_aggregator_allows_same_host_same_ip(self):
-        # Two entries listing the same host:ip is harmless duplication,
-        # not a conflict. The gate's /etc/hosts ends up with one line.
-        ups = (
-            GitGateUpstream(
-                name="a", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"gitea.dideric.is": "100.78.141.42"},
-            ),
-            GitGateUpstream(
-                name="b", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"gitea.dideric.is": "100.78.141.42"},
-            ),
-        )
-        self.assertEqual(
-            {"gitea.dideric.is": "100.78.141.42"},
-            git_gate_aggregate_extra_hosts(ups),
-        )
-
-    def test_aggregator_rejects_conflicting_ips(self):
-        ups = (
-            GitGateUpstream(
-                name="a", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"gitea.dideric.is": "100.78.141.42"},
-            ),
-            GitGateUpstream(
-                name="b", upstream_url="", upstream_host="", upstream_port="",
-                identity_file="", known_host_key="",
-                extra_hosts={"gitea.dideric.is": "10.0.0.99"},
-            ),
-        )
-        with self.assertRaises(Die):
-            git_gate_aggregate_extra_hosts(ups)
-
-    def test_aggregator_empty_is_empty(self):
-        self.assertEqual({}, git_gate_aggregate_extra_hosts(()))
-
-
 class TestKnownHostsLine(unittest.TestCase):
     def test_default_port_unbracketed(self):
         line = git_gate_known_hosts_line("github.com", "22", "ssh-ed25519 AAAA")
@@ -158,14 +76,18 @@ class TestEntrypointRender(unittest.TestCase):
         )
         script = git_gate_render_entrypoint(ups)
         self.assertIn("#!/bin/sh", script)
-        self.assertIn(
-            "init_repo 'bot-bottle' "
-            "'ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git'",
-            script,
+        # shlex.quote leaves safe strings unquoted; verify via token parse.
+        import shlex as _shlex
+        lines_with_init = [l for l in script.splitlines() if l.startswith("init_repo ")]
+        self.assertEqual(2, len(lines_with_init))
+        self.assertEqual(
+            ["init_repo", "bot-bottle",
+             "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git"],
+            _shlex.split(lines_with_init[0]),
         )
-        self.assertIn(
-            "init_repo 'foo' 'ssh://git@github.com/didericis/foo.git'",
-            script,
+        self.assertEqual(
+            ["init_repo", "foo", "ssh://git@github.com/didericis/foo.git"],
+            _shlex.split(lines_with_init[1]),
         )
         # Daemon line is what keeps PID 1 alive.
         self.assertIn("exec git daemon", script)
@@ -190,6 +112,41 @@ class TestEntrypointRender(unittest.TestCase):
         self.assertNotIn("init_repo '", script)
         self.assertIn("exec git daemon", script)
 
+    def test_single_quote_in_upstream_url_is_escaped(self):
+        ups = (GitGateUpstream(
+            name="myrepo",
+            upstream_url="ssh://git@host/path'with'quotes.git",
+            upstream_host="host",
+            upstream_port="22",
+            identity_file="/key",
+            known_host_key="",
+        ),)
+        script = git_gate_render_entrypoint(ups)
+        self.assertNotIn(
+            "init_repo 'myrepo' 'ssh://git@host/path'with'quotes.git'",
+            script,
+        )
+        self.assertIn("init_repo", script)
+        self.assertIn("path", script)
+
+    def test_space_and_semicolon_in_upstream_url_are_escaped(self):
+        import shlex as _shlex
+        raw_url = "ssh://git@host/path with spaces;evil.git"
+        ups = (GitGateUpstream(
+            name="myrepo",
+            upstream_url=raw_url,
+            upstream_host="host",
+            upstream_port="22",
+            identity_file="/key",
+            known_host_key="",
+        ),)
+        script = git_gate_render_entrypoint(ups)
+        line = next(l for l in script.splitlines() if l.startswith("init_repo "))
+        tokens = _shlex.split(line)
+        self.assertEqual(3, len(tokens))
+        self.assertEqual("myrepo", tokens[1])
+        self.assertEqual(raw_url, tokens[2])
+
 
 class TestHookRender(unittest.TestCase):
     def test_pre_receive_hook_has_two_phases(self):
@@ -302,11 +259,10 @@ class TestPrepare(unittest.TestCase):
 
     def test_prepare_skips_known_hosts_file_when_key_missing(self):
         manifest = Manifest.from_json_obj({
-            "bottles": {"dev": {"git": {"remotes": {
-                "github.com": {
-                    "Name": "foo",
-                    "Upstream": "ssh://git@github.com/didericis/foo.git",
-                    "IdentityFile": "/dev/null",
+            "bottles": {"dev": {"git-gate": {"repos": {
+                "foo": {
+                    "url": "ssh://git@github.com/didericis/foo.git",
+                    "identity": "/dev/null",
                 },
             }}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},

tests/unit/test_git_http_backend.py

@@ -150,6 +150,97 @@ class TestGitHttpBackend(unittest.TestCase):
             )
             self.assertEqual("git/test", env["HTTP_USER_AGENT"])
 
+    def test_access_hook_denial_is_logged_to_stdout(self):
+        """When the access-hook exits non-zero we still return 403 to the
+        client, but the hook's stderr must also appear on the handler's
+        stdout so docker logs surface *why* — otherwise the agent sees
+        the message and the operator just sees `403 -`."""
+        from http.server import ThreadingHTTPServer
+        import io
+        import sys
+
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "repo.git").mkdir()
+            old_root = os.environ.get("GIT_PROJECT_ROOT")
+            os.environ["GIT_PROJECT_ROOT"] = str(root)
+            self.addCleanup(self._restore_env, old_root)
+
+            server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
+            thread = threading.Thread(target=server.serve_forever, daemon=True)
+            thread.start()
+            self.addCleanup(server.shutdown)
+            self.addCleanup(server.server_close)
+
+            denial = b"git-gate: upstream fetch failed; refusing to serve stale data\n"
+            with mock.patch(
+                "bot_bottle.git_http_backend.subprocess.run",
+                return_value=subprocess.CompletedProcess(
+                    ["hook"], 1, b"", denial,
+                ),
+            ):
+                buf = io.StringIO()
+                with mock.patch.object(sys, "stdout", buf):
+                    req = urllib.request.Request(
+                        f"http://127.0.0.1:{server.server_port}"
+                        "/repo.git/info/refs?service=git-upload-pack",
+                        method="GET",
+                    )
+                    try:
+                        urllib.request.urlopen(req, timeout=5)
+                        self.fail("expected HTTPError 403")
+                    except urllib.error.HTTPError as e:
+                        self.assertEqual(403, e.code)
+                        self.assertIn(b"upstream fetch failed", e.read())
+
+                logged = buf.getvalue()
+                self.assertIn("access-hook denied", logged)
+                self.assertIn("upstream fetch failed", logged)
+
+    def test_access_hook_denial_without_output_logs_exit_code(self):
+        """If the hook exits non-zero but produces no stderr/stdout, the
+        log line should still say *something* — the exit code — instead
+        of silently emitting an empty line."""
+        from http.server import ThreadingHTTPServer
+        import io
+        import sys
+
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "repo.git").mkdir()
+            old_root = os.environ.get("GIT_PROJECT_ROOT")
+            os.environ["GIT_PROJECT_ROOT"] = str(root)
+            self.addCleanup(self._restore_env, old_root)
+
+            server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
+            thread = threading.Thread(target=server.serve_forever, daemon=True)
+            thread.start()
+            self.addCleanup(server.shutdown)
+            self.addCleanup(server.server_close)
+
+            with mock.patch(
+                "bot_bottle.git_http_backend.subprocess.run",
+                return_value=subprocess.CompletedProcess(
+                    ["hook"], 2, b"", b"",
+                ),
+            ):
+                buf = io.StringIO()
+                with mock.patch.object(sys, "stdout", buf):
+                    req = urllib.request.Request(
+                        f"http://127.0.0.1:{server.server_port}"
+                        "/repo.git/info/refs?service=git-upload-pack",
+                        method="GET",
+                    )
+                    try:
+                        urllib.request.urlopen(req, timeout=5)
+                        self.fail("expected HTTPError 403")
+                    except urllib.error.HTTPError as e:
+                        self.assertEqual(403, e.code)
+
+                logged = buf.getvalue()
+                self.assertIn("access-hook denied", logged)
+                self.assertIn("exit=2", logged)
+
     @staticmethod
     def _restore_env(value: str | None) -> None:
         if value is None:

tests/unit/test_manifest_agent_git_user.py

@@ -1,14 +1,14 @@
-"""Unit: agent-level git.user overlay + provenance (PRD 0027, issue #94).
+"""Unit: agent-level git-gate.user overlay + provenance (PRD 0027, PRD 0047).
 
-An agent file may declare `git.user` (name/email). At
+An agent file may declare `git-gate.user` (name/email). At
 `Manifest.bottle_for()` it overlays the referenced bottle's
-`git.user` per-field, agent-wins-on-non-empty. `git.remotes` is
+`git-gate.user` per-field, agent-wins-on-non-empty. `git-gate.repos` is
 rejected on agents. `Manifest.git_identity_summary()` reports the
 effective identity with per-field `(agent)`/`(bottle)` provenance.
 
 The `from_json_obj` path drives `Agent.from_dict` + `bottle_for`;
 a temp-dir case locks the md loader (the `_AGENT_KEYS` allow + the
-`git` threading into `agent_dict`)."""
+`git-gate` threading into `agent_dict`)."""
 
 from __future__ import annotations
 
@@ -34,10 +34,10 @@ def _error_message(callable_, *args, **kwargs) -> str:
 def _manifest(*, bottle_user=None, agent_git=None) -> Manifest:
     bottle: dict = {}
     if bottle_user is not None:
-        bottle = {"git": {"user": bottle_user}}
+        bottle = {"git-gate": {"user": bottle_user}}
     agent: dict = {"skills": [], "prompt": "", "bottle": "dev"}
     if agent_git is not None:
-        agent["git"] = agent_git
+        agent["git-gate"] = agent_git
     return Manifest.from_json_obj({
         "bottles": {"dev": bottle},
         "agents": {"impl": agent},
@@ -71,7 +71,6 @@ class TestAgentGitUserOverlay(unittest.TestCase):
 
     def test_agent_identity_with_bottle_declaring_none(self):
         m = _manifest(agent_git={"user": {"name": "a", "email": "a@b"}})
-        # The underlying bottle declares no identity; the merged one does.
         self.assertTrue(m.bottles["dev"].git_user.is_empty())
         self.assertFalse(m.bottle_for("impl").git_user.is_empty())
 
@@ -82,14 +81,10 @@ class TestAgentGitUserOverlay(unittest.TestCase):
         self.assertEqual("b@c", u.email)
 
     def test_bottle_for_returns_same_instance_when_no_overlay(self):
-        # No agent git.user → no replace(); the cached Bottle is
-        # returned as-is (identity check guards against churn).
         m = _manifest(bottle_user={"name": "B"})
         self.assertIs(m.bottles["dev"], m.bottle_for("impl"))
 
     def test_bottle_for_returns_same_instance_when_overlay_is_noop(self):
-        # Agent restates exactly what the bottle already has → merged
-        # == bottle.git_user → same instance, no replace().
         m = _manifest(
             bottle_user={"name": "B", "email": "b@c"},
             agent_git={"user": {"name": "B", "email": "b@c"}},
@@ -101,11 +96,11 @@ class TestAgentGitUserOverlay(unittest.TestCase):
             "bottles": {"dev": {
                 "env": {"FOO": "bar"},
                 "supervise": True,
-                "git": {"user": {"name": "B"}},
+                "git-gate": {"user": {"name": "B"}},
             }},
             "agents": {"impl": {
                 "bottle": "dev", "skills": [], "prompt": "",
-                "git": {"user": {"name": "a"}},
+                "git-gate": {"user": {"name": "a"}},
             }},
         })
         b = m.bottle_for("impl")
@@ -115,11 +110,11 @@ class TestAgentGitUserOverlay(unittest.TestCase):
 
 
 class TestAgentGitUserRejections(unittest.TestCase):
-    def test_agent_remotes_dies_bottle_only(self):
+    def test_agent_repos_dies_bottle_only(self):
         msg = _error_message(_manifest, agent_git={
-            "remotes": {"h": {"Name": "r", "Upstream": "ssh://x/y.git"}},
+            "repos": {"r": {"url": "ssh://git@x/y.git", "identity": "/dev/null"}},
         })
-        self.assertIn("git.remotes", msg)
+        self.assertIn("git-gate.repos", msg)
         self.assertIn("bottle-only", msg)
 
     def test_agent_unknown_git_subkey_dies(self):
@@ -127,7 +122,6 @@ class TestAgentGitUserRejections(unittest.TestCase):
         self.assertIn("not allowed at the agent level", msg)
 
     def test_agent_git_user_both_empty_dies(self):
-        # Reuses GitUser.from_dict validation.
         msg = _error_message(_manifest, agent_git={"user": {"name": "", "email": ""}})
         self.assertIn("neither name nor email", msg)
 
@@ -164,7 +158,7 @@ class TestGitIdentitySummary(unittest.TestCase):
 
 _BOTTLE_DEV = """
     ---
-    git:
+    git-gate:
       user:
         name: bottle-name
         email: bottle@example.com
@@ -176,7 +170,7 @@ _BOTTLE_DEV = """
 _AGENT_WITH_GIT = """
     ---
     bottle: dev
-    git:
+    git-gate:
       user:
         name: agent-name
     ---
@@ -184,14 +178,14 @@ _AGENT_WITH_GIT = """
     impl agent.
 """
 
-_AGENT_WITH_REMOTES = """
+_AGENT_WITH_REPOS = """
     ---
     bottle: dev
-    git:
-      remotes:
-        h:
-          Name: r
-          Upstream: ssh://x/y.git
+    git-gate:
+      repos:
+        r:
+          url: ssh://git@x/y.git
+          identity: /dev/null
     ---
 
     bad agent.
@@ -199,9 +193,9 @@ _AGENT_WITH_REMOTES = """
 
 
 class TestAgentGitUserMdLoader(unittest.TestCase):
-    """Locks the md path: `git` is an accepted agent key and threads
-    into the parsed Agent (not rejected as an unknown frontmatter
-    key), and agent `git.remotes` dies through the same loader."""
+    """Locks the md path: `git-gate` is an accepted agent key and threads
+    into the parsed Agent (not rejected as an unknown frontmatter key),
+    and agent `git-gate.repos` dies through the same loader."""
 
     def setUp(self) -> None:
         self.home = Path(tempfile.mkdtemp(prefix="cb-home-"))
@@ -225,18 +219,18 @@ class TestAgentGitUserMdLoader(unittest.TestCase):
         self._write("agents/impl.md", _AGENT_WITH_GIT)
         m = Manifest.resolve(str(self.home))
         u = m.bottle_for("impl").git_user
-        self.assertEqual("agent-name", u.name)        # agent wins
-        self.assertEqual("bottle@example.com", u.email)  # bottle falls through
+        self.assertEqual("agent-name", u.name)
+        self.assertEqual("bottle@example.com", u.email)
         self.assertEqual(
             "name=agent-name (agent), email=bottle@example.com (bottle)",
             m.git_identity_summary("impl"),
         )
 
-    def test_md_agent_remotes_dies(self):
+    def test_md_agent_repos_dies(self):
         self._write("bottles/dev.md", _BOTTLE_DEV)
-        self._write("agents/impl.md", _AGENT_WITH_REMOTES)
+        self._write("agents/impl.md", _AGENT_WITH_REPOS)
         msg = _error_message(Manifest.resolve, str(self.home))
-        self.assertIn("git.remotes", msg)
+        self.assertIn("git-gate.repos", msg)
         self.assertIn("bottle-only", msg)
 
 

tests/unit/test_manifest_extends.py

@@ -113,42 +113,30 @@ class TestExtendsEnvMerge(unittest.TestCase):
 
 
 class TestExtendsGitMerge(unittest.TestCase):
-    """git.user overlays by field; git.remotes merges by upstream
+    """git-gate.user overlays by field; git-gate.repos merges by upstream
     host, with child entries replacing duplicate hosts."""
 
-    _GIT_ENTRY_A = {
-        "Name": "a",
-        "Upstream": "ssh://git@host-a/a.git",
-        "IdentityFile": "/dev/null",
-    }
-    _GIT_ENTRY_B = {
-        "Name": "b",
-        "Upstream": "ssh://git@host-b/b.git",
-        "IdentityFile": "/dev/null",
-    }
+    _GIT_ENTRY_A = {"url": "ssh://git@host-a/a.git", "identity": "/dev/null"}
+    _GIT_ENTRY_B = {"url": "ssh://git@host-b/b.git", "identity": "/dev/null"}
 
-    def test_child_git_remotes_merge_with_parent(self):
+    def test_child_git_repos_merge_with_parent(self):
         m = _build(
-            base={"git": {"remotes": {"host-a": self._GIT_ENTRY_A}}},
+            base={"git-gate": {"repos": {"a": self._GIT_ENTRY_A}}},
             child={
                 "extends": "base",
-                "git": {"remotes": {"host-b": self._GIT_ENTRY_B}},
+                "git-gate": {"repos": {"b": self._GIT_ENTRY_B}},
             },
         )
         names = [e.Name for e in m.bottles["child"].git]
         self.assertEqual(["a", "b"], names)
 
-    def test_child_git_remote_replaces_same_host(self):
-        replacement = {
-            "Name": "a2",
-            "Upstream": "ssh://git@host-a/replacement.git",
-            "IdentityFile": "/dev/null",
-        }
+    def test_child_git_repo_replaces_same_host(self):
+        replacement = {"url": "ssh://git@host-a/replacement.git", "identity": "/dev/null"}
         m = _build(
-            base={"git": {"remotes": {"host-a": self._GIT_ENTRY_A}}},
+            base={"git-gate": {"repos": {"a": self._GIT_ENTRY_A}}},
             child={
                 "extends": "base",
-                "git": {"remotes": {"host-a": replacement}},
+                "git-gate": {"repos": {"a2": replacement}},
             },
         )
         entries = m.bottles["child"].git
@@ -156,30 +144,30 @@ class TestExtendsGitMerge(unittest.TestCase):
         self.assertEqual("a2", entries[0].Name)
         self.assertEqual("replacement.git", entries[0].UpstreamPath)
 
-    def test_child_omits_git_inherits_full_list(self):
+    def test_child_omits_git_gate_inherits_full_list(self):
         m = _build(
-            base={"git": {"remotes": {
-                "host-a": self._GIT_ENTRY_A,
-                "host-b": self._GIT_ENTRY_B,
+            base={"git-gate": {"repos": {
+                "a": self._GIT_ENTRY_A,
+                "b": self._GIT_ENTRY_B,
             }}},
             child={"extends": "base"},
         )
         names = [e.Name for e in m.bottles["child"].git]
         self.assertEqual(["a", "b"], names)
 
-    def test_child_explicit_empty_git_clears_parent(self):
-        # `git.remotes: {}` is the documented way to say "drop
-        # the parent's remotes" rather than "inherit them".
+    def test_child_explicit_empty_repos_clears_parent(self):
+        # `git-gate.repos: {}` is the documented way to say "drop
+        # the parent's repos" rather than "inherit them".
         m = _build(
-            base={"git": {"remotes": {"host-a": self._GIT_ENTRY_A}}},
-            child={"extends": "base", "git": {"remotes": {}}},
+            base={"git-gate": {"repos": {"a": self._GIT_ENTRY_A}}},
+            child={"extends": "base", "git-gate": {"repos": {}}},
         )
         self.assertEqual((), m.bottles["child"].git)
 
-    def test_child_git_user_inherits_parent_remotes(self):
+    def test_child_git_user_inherits_parent_repos(self):
         m = _build(
-            base={"git": {"remotes": {"host-a": self._GIT_ENTRY_A}}},
-            child={"extends": "base", "git": {"user": {"name": "Child"}}},
+            base={"git-gate": {"repos": {"a": self._GIT_ENTRY_A}}},
+            child={"extends": "base", "git-gate": {"user": {"name": "Child"}}},
         )
         self.assertEqual(["a"], [e.Name for e in m.bottles["child"].git])
         self.assertEqual("Child", m.bottles["child"].git_user.name)
@@ -209,12 +197,12 @@ class TestExtendsListsFullReplace(unittest.TestCase):
 
 
 class TestExtendsGitUserOverlay(unittest.TestCase):
-    """git.user: per-field overlay. Each non-empty field on child
+    """git-gate.user: per-field overlay. Each non-empty field on child
     wins; empties fall through to parent."""
 
     def test_parent_full_child_omits(self):
         m = _build(
-            base={"git": {"user": {"name": "Parent", "email": "p@x"}}},
+            base={"git-gate": {"user": {"name": "Parent", "email": "p@x"}}},
             child={"extends": "base"},
         )
         u = m.bottles["child"].git_user
@@ -223,10 +211,10 @@ class TestExtendsGitUserOverlay(unittest.TestCase):
 
     def test_child_overrides_both(self):
         m = _build(
-            base={"git": {"user": {"name": "Parent", "email": "p@x"}}},
+            base={"git-gate": {"user": {"name": "Parent", "email": "p@x"}}},
             child={
                 "extends": "base",
-                "git": {"user": {"name": "Child", "email": "c@x"}},
+                "git-gate": {"user": {"name": "Child", "email": "c@x"}},
             },
         )
         u = m.bottles["child"].git_user
@@ -234,11 +222,9 @@ class TestExtendsGitUserOverlay(unittest.TestCase):
         self.assertEqual("c@x", u.email)
 
     def test_child_adds_email_inherits_name(self):
-        # Parent sets only name; child sets only email. Both end
-        # up populated on the child.
         m = _build(
-            base={"git": {"user": {"name": "Parent"}}},
-            child={"extends": "base", "git": {"user": {"email": "c@x"}}},
+            base={"git-gate": {"user": {"name": "Parent"}}},
+            child={"extends": "base", "git-gate": {"user": {"email": "c@x"}}},
         )
         u = m.bottles["child"].git_user
         self.assertEqual("Parent", u.name)
@@ -246,11 +232,10 @@ class TestExtendsGitUserOverlay(unittest.TestCase):
 
     def test_child_overrides_only_email(self):
         m = _build(
-            base={"git": {"user": {"name": "Parent", "email": "p@x"}}},
-            child={"extends": "base", "git": {"user": {"email": "c@x"}}},
+            base={"git-gate": {"user": {"name": "Parent", "email": "p@x"}}},
+            child={"extends": "base", "git-gate": {"user": {"email": "c@x"}}},
         )
         u = m.bottles["child"].git_user
-        # Child overrides email; name inherited from parent.
         self.assertEqual("Parent", u.name)
         self.assertEqual("c@x", u.email)
 

tests/unit/test_manifest_git.py

@@ -1,39 +1,25 @@
-"""Unit: Bottle.git manifest parsing + validation (PRD 0008)."""
+"""Unit: git-gate.repos manifest parsing + validation (PRD 0047)."""
 
 import unittest
 
 from bot_bottle.manifest import ManifestError, Manifest
 
 
-def _manifest(git_entries):
+def _manifest(repos: dict) -> dict:
     return {
-        "bottles": {"dev": {"git": {"remotes": {
-            _host_for(entry): entry for entry in git_entries
-        }}}},
+        "bottles": {"dev": {"git-gate": {"repos": repos}}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     }
 
 
-def _host_for(entry):
-    upstream = entry.get("Upstream", "")
-    if "@a.example" in upstream:
-        return "a.example"
-    if "@b.example" in upstream:
-        return "b.example"
-    if "@github.com" in upstream:
-        return "github.com"
-    if "@gitea.dideric.is" in upstream:
-        return "gitea.dideric.is"
-    return "example.com"
-
-
 class TestGitEntryParsing(unittest.TestCase):
     def test_parses_minimal_entry(self):
-        m = Manifest.from_json_obj(_manifest([{
-            "Name": "bot-bottle",
-            "Upstream": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
-            "IdentityFile": "/dev/null",
-        }]))
+        m = Manifest.from_json_obj(_manifest({
+            "bot-bottle": {
+                "url": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
+                "identity": "/dev/null",
+            },
+        }))
         entries = m.bottles["dev"].git
         self.assertEqual(1, len(entries))
         e = entries[0]
@@ -44,185 +30,145 @@ class TestGitEntryParsing(unittest.TestCase):
         self.assertEqual("didericis/bot-bottle.git", e.UpstreamPath)
 
     def test_default_port_is_22(self):
-        m = Manifest.from_json_obj(_manifest([{
-            "Name": "foo",
-            "Upstream": "ssh://git@github.com/didericis/foo.git",
-            "IdentityFile": "/dev/null",
-        }]))
+        m = Manifest.from_json_obj(_manifest({
+            "foo": {
+                "url": "ssh://git@github.com/didericis/foo.git",
+                "identity": "/dev/null",
+            },
+        }))
         e = m.bottles["dev"].git[0]
         self.assertEqual("22", e.UpstreamPort)
         self.assertEqual("github.com", e.UpstreamHost)
 
-    def test_known_host_key_optional(self):
-        m = Manifest.from_json_obj(_manifest([{
-            "Name": "foo",
-            "Upstream": "ssh://git@github.com/foo.git",
-            "IdentityFile": "/dev/null",
-        }]))
+    def test_host_key_optional(self):
+        m = Manifest.from_json_obj(_manifest({
+            "foo": {
+                "url": "ssh://git@github.com/foo.git",
+                "identity": "/dev/null",
+            },
+        }))
         self.assertEqual("", m.bottles["dev"].git[0].KnownHostKey)
 
-    def test_missing_name_dies(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Upstream": "ssh://git@github.com/foo.git",
-                "IdentityFile": "/dev/null",
-            }]))
+    def test_host_key_stored(self):
+        m = Manifest.from_json_obj(_manifest({
+            "foo": {
+                "url": "ssh://git@github.com/foo.git",
+                "identity": "/dev/null",
+                "host_key": "ssh-ed25519 AAAA",
+            },
+        }))
+        self.assertEqual("ssh-ed25519 AAAA", m.bottles["dev"].git[0].KnownHostKey)
 
-    def test_missing_upstream_dies(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "IdentityFile": "/dev/null",
-            }]))
+    def test_repo_name_becomes_Name(self):
+        m = Manifest.from_json_obj(_manifest({
+            "my-repo": {
+                "url": "ssh://git@github.com/foo.git",
+                "identity": "/dev/null",
+            },
+        }))
+        self.assertEqual("my-repo", m.bottles["dev"].git[0].Name)
 
-    def test_missing_identity_file_dies(self):
+    def test_missing_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com/foo.git",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {"identity": "/dev/null"},
+            }))
 
-    def test_non_ssh_upstream_dies(self):
+    def test_missing_identity_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "https://github.com/didericis/foo.git",
-                "IdentityFile": "/dev/null",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {"url": "ssh://git@github.com/foo.git"},
+            }))
 
-    def test_scp_style_upstream_dies(self):
-        # SCP-style "git@host:path" is intentionally not supported in
-        # v1 — ssh:// only.
+    def test_unknown_key_in_entry_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "git@github.com:didericis/foo.git",
-                "IdentityFile": "/dev/null",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "ssh://git@github.com/foo.git",
+                    "identity": "/dev/null",
+                    "IdentityFile": "/dev/null",  # old PascalCase key
+                },
+            }))
 
-    def test_upstream_without_user_dies(self):
+    def test_non_ssh_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://github.com/foo.git",
-                "IdentityFile": "/dev/null",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "https://github.com/didericis/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
 
-    def test_upstream_without_path_dies(self):
+    def test_scp_style_url_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com",
-                "IdentityFile": "/dev/null",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "git@github.com:didericis/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
+
+    def test_url_without_user_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "ssh://github.com/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
+
+    def test_url_without_path_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "ssh://git@github.com",
+                    "identity": "/dev/null",
+                },
+            }))
 
     def test_non_numeric_port_dies(self):
         with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com:notaport/foo.git",
-                "IdentityFile": "/dev/null",
-            }]))
+            Manifest.from_json_obj(_manifest({
+                "foo": {
+                    "url": "ssh://git@github.com:notaport/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
 
-
-class TestGitEntryExtraHosts(unittest.TestCase):
-    def test_extra_hosts_defaults_to_empty(self):
-        m = Manifest.from_json_obj(_manifest([{
-            "Name": "foo",
-            "Upstream": "ssh://git@github.com/foo.git",
-            "IdentityFile": "/dev/null",
-        }]))
-        self.assertEqual({}, dict(m.bottles["dev"].git[0].ExtraHosts))
-
-    def test_extra_hosts_parses_host_to_ip_map(self):
-        m = Manifest.from_json_obj(_manifest([{
-            "Name": "bot-bottle",
-            "Upstream": "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
-            "IdentityFile": "/dev/null",
-            "ExtraHosts": {"gitea.dideric.is": "100.78.141.42"},
-        }]))
-        eh = dict(m.bottles["dev"].git[0].ExtraHosts)
-        self.assertEqual({"gitea.dideric.is": "100.78.141.42"}, eh)
-
-    def test_extra_hosts_must_be_object(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com/foo.git",
-                "IdentityFile": "/dev/null",
-                "ExtraHosts": ["gitea.dideric.is", "100.78.141.42"],
-            }]))
-
-    def test_extra_hosts_ip_must_be_string(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com/foo.git",
-                "IdentityFile": "/dev/null",
-                "ExtraHosts": {"gitea.dideric.is": 100},
-            }]))
-
-    def test_extra_hosts_empty_ip_dies(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj(_manifest([{
-                "Name": "foo",
-                "Upstream": "ssh://git@github.com/foo.git",
-                "IdentityFile": "/dev/null",
-                "ExtraHosts": {"gitea.dideric.is": ""},
-            }]))
+    def test_ip_literal_upstream(self):
+        m = Manifest.from_json_obj(_manifest({
+            "bot-bottle": {
+                "url": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
+                "identity": "/dev/null",
+            },
+        }))
+        e = m.bottles["dev"].git[0]
+        self.assertEqual("100.78.141.42", e.UpstreamHost)
+        self.assertEqual("30009", e.UpstreamPort)
+        self.assertEqual("bot-bottle", e.Name)
 
 
 class TestGitEntryCrossValidation(unittest.TestCase):
-    def test_duplicate_name_dies(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
-                "bottles": {"dev": {"git": {"remotes": {
-                    "a.example": {
-                        "Name": "foo",
-                        "Upstream": "ssh://git@a.example/x.git",
-                        "IdentityFile": "/dev/null",
-                    },
-                    "b.example": {
-                        "Name": "foo",
-                        "Upstream": "ssh://git@b.example/y.git",
-                        "IdentityFile": "/dev/null",
-                    },
-                }}}},
-                "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-            })
-
-    def test_remote_key_must_match_upstream_host(self):
-        with self.assertRaises(ManifestError):
-            Manifest.from_json_obj({
-                "bottles": {"dev": {"git": {"remotes": {
-                    "wrong.example": {
-                        "Name": "foo",
-                        "Upstream": "ssh://git@github.com/foo.git",
-                        "IdentityFile": "/dev/null",
-                    },
-                }}}},
-                "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-            })
-
-    def test_remote_key_can_name_logical_host_for_ip_upstream(self):
+    def test_two_repos_different_hosts_both_parsed(self):
+        # Repo names come from dict keys; two distinct keys always produce
+        # two distinct entries (uniqueness is guaranteed at the YAML/dict level).
         m = Manifest.from_json_obj({
-            "bottles": {"dev": {"git": {"remotes": {
-                "gitea.dideric.is": {
-                    "Name": "bot-bottle",
-                    "Upstream": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
-                    "IdentityFile": "/dev/null",
+            "bottles": {"dev": {"git-gate": {"repos": {
+                "foo": {
+                    "url": "ssh://git@a.example/x.git",
+                    "identity": "/dev/null",
+                },
+                "bar": {
+                    "url": "ssh://git@b.example/y.git",
+                    "identity": "/dev/null",
                 },
             }}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
-        e = m.bottles["dev"].git[0]
-        self.assertEqual("gitea.dideric.is", e.RemoteKey)
-        self.assertEqual("100.78.141.42", e.UpstreamHost)
-        self.assertEqual("30009", e.UpstreamPort)
+        names = {e.Name for e in m.bottles["dev"].git}
+        self.assertEqual({"foo", "bar"}, names)
 
     def test_legacy_ssh_field_dies_with_hint(self):
-        # PRD 0009: bottle.ssh is removed; manifests carrying it must
-        # fail loudly with a hint pointing at bottle.git.
         with self.assertRaises(ManifestError):
             Manifest.from_json_obj({
                 "bottles": {
@@ -239,25 +185,82 @@ class TestGitEntryCrossValidation(unittest.TestCase):
                 "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
             })
 
+    def test_name_with_single_quote_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "o'reilly": {
+                    "url": "ssh://git@github.com/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
 
-class TestEmptyGitField(unittest.TestCase):
-    def test_no_git_field_yields_empty_tuple(self):
+    def test_name_with_space_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "my repo": {
+                    "url": "ssh://git@github.com/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
+
+    def test_name_with_semicolon_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "foo;bar": {
+                    "url": "ssh://git@github.com/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
+
+    def test_name_with_dollar_dies(self):
+        with self.assertRaises(ManifestError):
+            Manifest.from_json_obj(_manifest({
+                "foo$bar": {
+                    "url": "ssh://git@github.com/foo.git",
+                    "identity": "/dev/null",
+                },
+            }))
+
+    def test_valid_name_with_dots_and_hyphens_accepted(self):
+        m = Manifest.from_json_obj(_manifest({
+            "my.repo-name_1": {
+                "url": "ssh://git@github.com/foo.git",
+                "identity": "/dev/null",
+            },
+        }))
+        self.assertEqual("my.repo-name_1", m.bottles["dev"].git[0].Name)
+
+    def test_legacy_git_key_dies_with_hint(self):
+        msg = ""
+        try:
+            Manifest.from_json_obj({
+                "bottles": {"dev": {"git": {"remotes": {}}}},
+                "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+            })
+        except ManifestError as e:
+            msg = str(e)
+        self.assertIn("git-gate", msg)
+        self.assertIn("PRD 0047", msg)
+
+
+class TestEmptyGitGateField(unittest.TestCase):
+    def test_no_git_gate_field_yields_empty_tuple(self):
         m = Manifest.from_json_obj({
             "bottles": {"dev": {}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
         self.assertEqual((), m.bottles["dev"].git)
 
-    def test_git_object_type_required(self):
+    def test_git_gate_object_type_required(self):
         with self.assertRaises(ManifestError):
             Manifest.from_json_obj({
-                "bottles": {"dev": {"git": "not-a-list"}},
+                "bottles": {"dev": {"git-gate": "not-a-dict"}},
                 "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
             })
 
-    def test_empty_remotes_yields_empty_tuple(self):
+    def test_empty_repos_yields_empty_tuple(self):
         m = Manifest.from_json_obj({
-            "bottles": {"dev": {"git": {"remotes": {}}}},
+            "bottles": {"dev": {"git-gate": {"repos": {}}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
         self.assertEqual((), m.bottles["dev"].git)

tests/unit/test_manifest_git_user.py

@@ -1,4 +1,4 @@
-"""Unit: Bottle git.user manifest parsing + validation (issue #86)."""
+"""Unit: Bottle git-gate.user manifest parsing + validation (issue #86, PRD 0047)."""
 
 import unittest
 
@@ -16,7 +16,7 @@ def _error_message(callable_, *args, **kwargs) -> str:
 
 def _manifest(git_user):
     return {
-        "bottles": {"dev": {"git": {"user": git_user}}},
+        "bottles": {"dev": {"git-gate": {"user": git_user}}},
         "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
     }
 
@@ -75,13 +75,13 @@ class TestGitUserParsing(unittest.TestCase):
         msg = _error_message(
             Manifest.from_json_obj, _manifest({"name": 42}),
         )
-        self.assertIn("git.user.name must be a string", msg)
+        self.assertIn("git-gate.user.name must be a string", msg)
 
     def test_non_string_email_dies(self):
         msg = _error_message(
             Manifest.from_json_obj, _manifest({"email": ["x@y.z"]}),
         )
-        self.assertIn("git.user.email must be a string", msg)
+        self.assertIn("git-gate.user.email must be a string", msg)
 
     def test_legacy_top_level_git_user_dies(self):
         msg = _error_message(
@@ -92,7 +92,7 @@ class TestGitUserParsing(unittest.TestCase):
             },
         )
         self.assertIn("git_user", msg)
-        self.assertIn("git.user", msg)
+        self.assertIn("git-gate.user", msg)
 
 
 class TestGitUserDirect(unittest.TestCase):

tests/unit/test_plan_print_parity.py

@@ -21,6 +21,7 @@ from bot_bottle.egress import EgressPlan, EgressRoute
 from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
 from bot_bottle.manifest import Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
+from bot_bottle.workspace import workspace_plan
 
 
 def _manifest() -> Manifest:
@@ -55,7 +56,6 @@ def _git_gate_plan(tmp: str) -> GitGatePlan:
                 upstream_port="30009",
                 identity_file="/dev/null",
                 known_host_key="ssh-ed25519 AAAA...",
-                extra_hosts={},
             ),
         ),
     )
@@ -109,6 +109,7 @@ def _docker_plan(spec: BottleSpec, tmp: str) -> DockerBottlePlan:
         egress_plan=_egress_plan(tmp),
         supervise_plan=None,
         agent_provision=_agent_provision(),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
         slug="test-00001",
         container_name="bot-bottle-test-00001",
         container_name_pinned=False,
@@ -133,6 +134,7 @@ def _smolmachines_plan(spec: BottleSpec, tmp: str) -> SmolmachinesBottlePlan:
         egress_plan=_egress_plan(tmp),
         supervise_plan=None,
         agent_provision=_agent_provision(),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
         slug="test-00001",
         bundle_subnet="10.99.0.0/24",
         bundle_gateway="10.99.0.1",

tests/unit/test_provision_git.py

@@ -69,13 +69,14 @@ class TestGitGateGitconfigRender(unittest.TestCase):
             '[url "http://127.0.0.16:57001/bot-bottle.git"]', out,
         )
 
-    def test_ip_upstream_also_rewrites_logical_remote_key(self):
+    def test_ip_upstream_emits_single_insteadof(self):
+        # In the new format the dict key is the repo name, not a host
+        # alias, so there is only one insteadOf rule — for the IP URL.
         m = Manifest.from_json_obj({
-            "bottles": {"dev": {"git": {"remotes": {
-                "gitea.dideric.is": {
-                    "Name": "bot-bottle",
-                    "Upstream": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
-                    "IdentityFile": "/dev/null",
+            "bottles": {"dev": {"git-gate": {"repos": {
+                "bot-bottle": {
+                    "url": "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
+                    "identity": "/dev/null",
                 },
             }}}},
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
@@ -86,11 +87,7 @@ class TestGitGateGitconfigRender(unittest.TestCase):
             "ssh://git@100.78.141.42:30009/didericis/bot-bottle.git",
             out,
         )
-        self.assertIn(
-            "\tinsteadOf = "
-            "ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git",
-            out,
-        )
+        self.assertNotIn("gitea.dideric.is", out)
 
 
 if __name__ == "__main__":

tests/unit/test_smolmachines_provision.py

@@ -30,6 +30,7 @@ from bot_bottle.backend.smolmachines.provision import (
     provider_auth as _provider_auth,
     skills as _skills,
     supervise as _supervise,
+    workspace as _workspace,
 )
 from bot_bottle.backend.smolmachines.launch import _bundle_launch_spec
 from bot_bottle.backend.smolmachines.smolvm import SmolvmRunResult
@@ -38,13 +39,9 @@ from bot_bottle.git_gate import GitGatePlan, GitGateUpstream
 from bot_bottle.manifest import GitEntry, Manifest
 from bot_bottle.pipelock import PipelockProxyPlan
 from bot_bottle.supervise import SupervisePlan
+from bot_bottle.workspace import workspace_plan
 
 
-def _remote_host(g: GitEntry) -> str:
-    if g.UpstreamHost:
-        return g.UpstreamHost
-    return g.Upstream.split("@", 1)[1].split("/", 1)[0].split(":", 1)[0]
-
 
 def _plan(
     *,
@@ -67,20 +64,19 @@ def _plan(
     guest_env: dict[str, str] | None = None,
 ) -> SmolmachinesBottlePlan:
     bottle_json: dict = {}
-    git_json: dict = {}
+    git_gate_json: dict = {}
     if git:
-        git_json["remotes"] = {
-            _remote_host(g): {
-                "Name": g.Name,
-                "Upstream": g.Upstream,
-                "IdentityFile": g.IdentityFile,
+        git_gate_json["repos"] = {
+            g.Name: {
+                "url": g.Upstream,
+                "identity": g.IdentityFile,
             }
             for g in git
         }
     if git_user is not None:
-        git_json["user"] = git_user
-    if git_json:
-        bottle_json["git"] = git_json
+        git_gate_json["user"] = git_user
+    if git_gate_json:
+        bottle_json["git-gate"] = git_gate_json
     if supervise:
         bottle_json["supervise"] = True
     manifest = Manifest.from_json_obj({
@@ -144,6 +140,7 @@ def _plan(
             codex_auth_file=codex_auth_file,
             guest_env=dict(guest_env or {}),
         ),
+        workspace_plan=workspace_plan(spec, guest_home="/home/node"),
     )
 
 
@@ -846,6 +843,55 @@ class TestProvisionGitUser(unittest.TestCase):
         self.assertEqual(["user.email", "bot@example.com"], calls[0][0][7:])
 
 
+class TestProvisionWorkspace(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="cb-prov-workspace.")
+        self.stage = Path(self._tmp.name)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_noop_when_copy_cwd_false(self):
+        plan = _plan(copy_cwd=False, stage_dir=self.stage)
+        with patch(
+            "bot_bottle.backend.smolmachines.provision.workspace._smolvm.machine_cp"
+        ) as cp, patch(
+            "bot_bottle.backend.smolmachines.provision.workspace._smolvm.machine_exec"
+        ) as ex:
+            _workspace.provision_workspace(plan, "bot-bottle-demo-abc12")
+        cp.assert_not_called()
+        ex.assert_not_called()
+
+    def test_copies_workspace_to_plan_path_and_chowns(self):
+        cwd = self.stage / "cwd"
+        cwd.mkdir()
+        plan = _plan(copy_cwd=True, user_cwd=str(cwd), stage_dir=self.stage)
+        with patch(
+            "bot_bottle.backend.smolmachines.provision.workspace._smolvm.machine_cp"
+        ) as cp, patch(
+            "bot_bottle.backend.smolmachines.provision.workspace._smolvm.machine_exec"
+        ) as ex:
+            _workspace.provision_workspace(plan, "bot-bottle-demo-abc12")
+
+        cp.assert_called_once_with(
+            str(cwd),
+            "bot-bottle-demo-abc12:/home/node/workspace",
+        )
+        argvs = [c.args[1] for c in ex.call_args_list]
+        self.assertIn(
+            ["sh", "-c", "rm -rf /home/node/workspace && mkdir -p /home/node"],
+            argvs,
+        )
+        self.assertIn(
+            [
+                "sh", "-c",
+                "chown -R node:node /home/node/workspace && "
+                "chmod 755 /home/node/workspace",
+            ],
+            argvs,
+        )
+
+
 class TestProvisionSupervise(unittest.TestCase):
     def test_noop_when_supervise_not_enabled(self):
         with patch(

tests/unit/test_workspace.py

@@ -0,0 +1,58 @@
+"""Unit: backend-neutral workspace planning."""
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from bot_bottle.backend import BottleSpec
+from bot_bottle.manifest import Manifest
+from bot_bottle.workspace import workspace_plan
+
+
+def _spec(*, copy_cwd: bool, user_cwd: str) -> BottleSpec:
+    manifest = Manifest.from_json_obj({
+        "bottles": {"dev": {}},
+        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+    })
+    return BottleSpec(
+        manifest=manifest,
+        agent_name="demo",
+        copy_cwd=copy_cwd,
+        user_cwd=user_cwd,
+    )
+
+
+class TestWorkspacePlan(unittest.TestCase):
+    def test_disabled_uses_guest_home_as_workdir(self):
+        plan = workspace_plan(
+            _spec(copy_cwd=False, user_cwd="/tmp/project"),
+            guest_home="/home/node",
+        )
+        self.assertFalse(plan.enabled)
+        self.assertEqual("/home/node", plan.guest_path)
+        self.assertEqual("/home/node", plan.workdir)
+
+    def test_enabled_uses_workspace_under_guest_home(self):
+        plan = workspace_plan(
+            _spec(copy_cwd=True, user_cwd="/tmp/project"),
+            guest_home="/guest/home",
+        )
+        self.assertTrue(plan.enabled)
+        self.assertEqual(Path("/tmp/project"), plan.host_path)
+        self.assertEqual("/guest/home/workspace", plan.guest_path)
+        self.assertEqual("/guest/home/workspace", plan.workdir)
+
+    def test_detects_host_git_dir(self):
+        with tempfile.TemporaryDirectory(prefix="bb-workspace.") as tmp:
+            Path(tmp, ".git").mkdir()
+            plan = workspace_plan(
+                _spec(copy_cwd=True, user_cwd=tmp),
+                guest_home="/home/node",
+            )
+        self.assertTrue(plan.has_host_git_dir)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_yaml_subset.py

@@ -160,13 +160,13 @@ class TestBlockList(unittest.TestCase):
         out = _y("""
             entries:
               - name: foo
-                ExtraHosts:
+                metadata:
                   host.example: 10.0.0.1
               - name: bar
         """)
         self.assertEqual(
             {"entries": [
-                {"name": "foo", "ExtraHosts": {"host.example": "10.0.0.1"}},
+                {"name": "foo", "metadata": {"host.example": "10.0.0.1"}},
                 {"name": "bar"},
             ]},
             out,
@@ -270,8 +270,7 @@ class TestRealisticBottleFile(unittest.TestCase):
                   Name: bot-bottle
                   Upstream: ssh://git@gitea.dideric.is:30009/x/y.git
                   IdentityFile: ~/.ssh/gitea.pem
-                  ExtraHosts:
-                    gitea.dideric.is: 100.78.141.42
+                  KnownHostKey: ssh-ed25519 AAAA...
         """)
         # Spot-check the deep parts; the structure is large.
         self.assertEqual(2, len(out["egress"]["routes"]))
@@ -284,8 +283,8 @@ class TestRealisticBottleFile(unittest.TestCase):
             out["egress"]["routes"][0]["auth"]["scheme"],
         )
         self.assertEqual(
-            "100.78.141.42",
-            out["git"]["remotes"]["gitea.dideric.is"]["ExtraHosts"]["gitea.dideric.is"],
+            "ssh-ed25519 AAAA...",
+            out["git"]["remotes"]["gitea.dideric.is"]["KnownHostKey"],
         )