fix(tests): resolve pyright errors in stale-check test files

Remove unused imports, add missing type annotations, fix Die()
constructor calls (int code, not str), replace fake backend
subclass with patch.object approach to avoid reportMissingParameterType
and override-incompatibility errors in strict pyright mode.

Dockerfile.sidecars

@@ -14,10 +14,9 @@
 #   /app/supervise_server.py + .py       supervise MCP server
 #   /app/sidecar_init.py                 PID 1 supervisor
 #   /etc/egress/routes.yaml              bind-mounted at run time
-#   /etc/git-gate/entrypoint.sh          per-bottle (docker-cp or virtiofs mount)
-#   /etc/git-gate/pre-receive            per-bottle (docker-cp or virtiofs mount)
-#   /git-gate-entrypoint.sh              static wrapper → /etc/git-gate/entrypoint.sh
-#   /git-gate/creds/*                    per-bottle (docker-cp or virtiofs mount)
+#   /etc/git-gate/pre-receive            docker-cp'd at start time
+#   /git-gate-entrypoint.sh              docker-cp'd at start time
+#   /git-gate/creds/*                    docker-cp'd at start time
 #   /git/*                               bare repos, populated at runtime
 #   /run/supervise/bot-bottle.db         bind-mounted at run time
 #   /home/mitmproxy/.mitmproxy/          mitmproxy CA dir
@@ -89,21 +88,7 @@ RUN mkdir -p \
       /git-gate/creds \
       /git \
       /run/supervise \
-      /home/mitmproxy/.mitmproxy \
-      /bot-bottle-data/egress \
-      /bot-bottle-data/git-gate
-
-# Static wrapper for the git-gate entrypoint. The per-bottle
-# entrypoint script is either:
-#   - docker-cp'd to /git-gate-entrypoint.sh (docker/macOS backends),
-#     which overwrites this wrapper; or
-#   - virtiofs-mounted at /bot-bottle-data/git-gate/entrypoint.sh
-#     (smolmachines), where this wrapper delegates to it at runtime.
-#     Fallback to /etc/git-gate/ for backwards compatibility.
-# Either way sidecar_init.py calls `/bin/sh /git-gate-entrypoint.sh`.
-RUN printf '#!/bin/sh\nif [ -x /bot-bottle-data/git-gate/entrypoint.sh ]; then\n  exec /bot-bottle-data/git-gate/entrypoint.sh "$@"\nfi\nexec /etc/git-gate/entrypoint.sh "$@"\n' \
-      > /git-gate-entrypoint.sh \
-    && chmod 755 /git-gate-entrypoint.sh
+      /home/mitmproxy/.mitmproxy
 
 # Documentation only — the compose renderer publishes whichever
 # subset the bottle uses.

bot_bottle/backend/__init__.py

@@ -276,18 +276,6 @@ PlanT = TypeVar("PlanT", bound=BottlePlan)
 CleanupT = TypeVar("CleanupT", bound=BottleCleanupPlan)
 
 
-@dataclass(frozen=True)
-class BottleImages:
-    """Resolved image references (or artifact paths) for a bottle launch.
-
-    For Docker/macOS-container backends, `agent` and `sidecar` are string
-    image refs. For the smolmachines backend they are Path objects pointing
-    to pre-built `.smolmachine` artifacts."""
-
-    agent: str | Path
-    sidecar: str | Path
-
-
 class BottleBackend(ABC, Generic[PlanT, CleanupT]):
     """Abstract base for selectable bottle backends. Concrete subclasses
     (e.g. DockerBottleBackend) own their own prepare/launch impls.
@@ -447,27 +435,26 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         prompt file, Dockerfile path, and guest home all live on
         `agent_provision_plan` — the source of truth."""
 
-    def prelaunch_checks(self, plan: PlanT) -> None:
-        """Raise StaleImageError if any cached image used by this plan is stale.
-        No-op default; backends override to call the shared check_stale*
-        helpers on their image/artifact timestamps. Called by the CLI before
-        launch so the operator can be prompted outside the launch context."""
-
     @contextmanager
-    def launch(self, plan: PlanT) -> Generator[Bottle, None, None]:
-        """Template: build or load images, then delegate to _launch_impl."""
-        images = self._build_or_load_images(plan)
-        with self._launch_impl(plan, images) as bottle:
+    def launch(
+        self, plan: PlanT, *, skip_stale: bool = False
+    ) -> Generator[Bottle, None, None]:
+        """Template: optionally check for stale cached images, then delegate
+        to `_launch_impl`. Pass `skip_stale=True` to bypass the stale check
+        (used by the interactive CLI after the operator confirms)."""
+        if not skip_stale:
+            self._image_stale_checks(plan)
+        with self._launch_impl(plan) as bottle:
             yield bottle
 
-    @abstractmethod
-    def _build_or_load_images(self, plan: PlanT) -> BottleImages:
-        """Return the agent and sidecar image references (or artifact paths)
-        for this plan, building fresh images when the policy requires it."""
+    def _image_stale_checks(self, plan: PlanT) -> None:
+        """Raise StaleImageError if any cached image used by this plan is stale.
+        No-op default; backends override to call the shared `check_stale*`
+        helpers on their image/artifact timestamps."""
 
     @abstractmethod
-    def _launch_impl(self, plan: PlanT, images: BottleImages) -> AbstractContextManager[Bottle]:
-        """Bring up the bottle using pre-resolved images; yield a handle; tear down on exit."""
+    def _launch_impl(self, plan: PlanT) -> AbstractContextManager[Bottle]:
+        """Build/run the bottle and yield a handle; tear down on exit."""
 
     def provision(self, plan: PlanT, bottle: "Bottle") -> str | None:
         """Copy host-side files (CA cert, prompt, skills, .git) into

bot_bottle/backend/docker/backend.py

@@ -31,7 +31,7 @@ from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
 from ...manifest import Manifest
-from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
+from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -85,15 +85,12 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
             stage_dir=stage_dir,
         )
 
-    def prelaunch_checks(self, plan: DockerBottlePlan) -> None:
+    def _image_stale_checks(self, plan: DockerBottlePlan) -> None:
         _launch.stale_checks(plan)
 
-    def _build_or_load_images(self, plan: DockerBottlePlan) -> BottleImages:
-        return _launch.build_or_load_images(plan)
-
     @contextmanager
-    def _launch_impl(self, plan: DockerBottlePlan, images: BottleImages) -> Generator[DockerBottle, None, None]:
-        with _launch.launch(plan, images, provision=self.provision) as bottle:
+    def _launch_impl(self, plan: DockerBottlePlan) -> Generator[DockerBottle, None, None]:
+        with _launch.launch(plan, provision=self.provision) as bottle:
             yield bottle
 
     def supervise_mcp_url(self, plan: DockerBottlePlan) -> str:

bot_bottle/backend/docker/launch.py

@@ -43,7 +43,6 @@ from ...git_gate import (
 )
 from ...image_cache import check_stale
 from ...log import die, info, warn
-from .. import BottleImages
 from . import network as network_mod
 from . import util as docker_mod
 from .bottle import DockerBottle
@@ -72,50 +71,16 @@ from .sidecar_bundle import SIDECAR_BUNDLE_IMAGE
 _REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)
 
 
-def build_or_load_images(plan: DockerBottlePlan) -> BottleImages:
-    """Resolve the agent and sidecar image refs for this plan.
-
-    Returns the committed snapshot if one exists, the local cached images
-    when the policy is 'cached', or builds fresh images and returns those."""
-    committed = read_committed_image(plan.slug)
-    if committed and docker_mod.image_exists(committed):
-        info(f"using committed image {committed!r}")
-        return BottleImages(agent=committed, sidecar=SIDECAR_BUNDLE_IMAGE)
-    if plan.spec.image_policy == "cached":
-        if not docker_mod.image_exists(plan.image):
-            die(
-                f"cached agent image {plan.image!r} not found; "
-                "run without --cached-images to build it"
-            )
-        if not docker_mod.image_exists(SIDECAR_BUNDLE_IMAGE):
-            die(
-                f"cached sidecar image {SIDECAR_BUNDLE_IMAGE!r} not found; "
-                "run without --cached-images to build it"
-            )
-        info(f"using cached agent image {plan.image!r}")
-        info(f"using cached sidecar image {SIDECAR_BUNDLE_IMAGE!r}")
-        return BottleImages(agent=plan.image, sidecar=SIDECAR_BUNDLE_IMAGE)
-    docker_mod.build_image(plan.image, _REPO_DIR, dockerfile=plan.dockerfile_path)
-    return BottleImages(agent=plan.image, sidecar=SIDECAR_BUNDLE_IMAGE)
-
-
 @contextmanager
 def launch(
     plan: DockerBottlePlan,
-    images: BottleImages,
     *,
     provision: Callable[[DockerBottlePlan, "DockerBottle"], str | None],
 ) -> Generator[DockerBottle, None, None]:
-    """Launch and provision a Docker bottle via compose. Teardown on exit."""
+    """Build, launch, and provision a Docker bottle via compose.
+    Teardown on exit."""
     stack = ExitStack()
 
-    # Stamp the resolved agent image ref into the plan so compose rendering
-    # picks up the right image (may be a committed snapshot or cached ref).
-    plan = dataclasses.replace(
-        plan,
-        agent_provision=dataclasses.replace(plan.agent_provision, image=str(images.agent)),
-    )
-
     _bottle_for_revoke = plan.manifest.bottle
     _git_gate_dir_for_revoke = git_gate_state_dir(plan.slug)
 
@@ -132,6 +97,36 @@ def launch(
         )
 
     try:
+        # Step 1: agent image. Use a committed snapshot when one exists
+        # and is present in the local daemon; otherwise build from the
+        # Dockerfile. Sidecar images get built lazily by `docker compose
+        # up` via the renderer's `build:` directives.
+        committed = read_committed_image(plan.slug)
+        cached_policy = plan.spec.image_policy == "cached"
+        if committed and docker_mod.image_exists(committed):
+            info(f"using committed image {committed!r}")
+            plan = dataclasses.replace(
+                plan,
+                agent_provision=dataclasses.replace(plan.agent_provision, image=committed),
+            )
+        elif cached_policy:
+            if not docker_mod.image_exists(plan.image):
+                die(
+                    f"cached agent image {plan.image!r} not found; "
+                    "run without --cached-images to build it"
+                )
+            if not docker_mod.image_exists(SIDECAR_BUNDLE_IMAGE):
+                die(
+                    f"cached sidecar image {SIDECAR_BUNDLE_IMAGE!r} not found; "
+                    "run without --cached-images to build it"
+                )
+            info(f"using cached agent image {plan.image!r}")
+            info(f"using cached sidecar image {SIDECAR_BUNDLE_IMAGE!r}")
+        else:
+            docker_mod.build_image(
+                plan.image, _REPO_DIR,
+                dockerfile=plan.dockerfile_path,
+            )
 
         internal_network = network_mod.network_name_for_slug(plan.slug)
         egress_network = network_mod.network_egress_name_for_slug(plan.slug)

bot_bottle/backend/macos_container/backend.py

@@ -12,7 +12,7 @@ from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
 from ...manifest import Manifest
-from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
+from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -67,17 +67,14 @@ class MacosContainerBottleBackend(
             stage_dir=stage_dir,
         )
 
-    def prelaunch_checks(self, plan: MacosContainerBottlePlan) -> None:
+    def _image_stale_checks(self, plan: MacosContainerBottlePlan) -> None:
         _launch.stale_checks(plan)
 
-    def _build_or_load_images(self, plan: MacosContainerBottlePlan) -> BottleImages:
-        return _launch.build_or_load_images(plan)
-
     @contextmanager
     def _launch_impl(
-        self, plan: MacosContainerBottlePlan, images: BottleImages
+        self, plan: MacosContainerBottlePlan
     ) -> Generator[MacosContainerBottle, None, None]:
-        with _launch.launch(plan, images, provision=self.provision) as bottle:
+        with _launch.launch(plan, provision=self.provision) as bottle:
             yield bottle
 
     def prepare_cleanup(self) -> MacosContainerBottleCleanupPlan:

bot_bottle/backend/macos_container/launch.py

@@ -34,7 +34,6 @@ from ...git_gate import (
 )
 from ...image_cache import check_stale
 from ...log import die, info, warn
-from .. import BottleImages
 from ...supervise import DB_PATH_IN_CONTAINER, SUPERVISE_PORT
 from ...util import expand_tilde
 from ..docker.egress import EGRESS_CA_IN_CONTAINER, EGRESS_PORT
@@ -73,51 +72,17 @@ def sidecar_container_name(slug: str) -> str:
     return f"bot-bottle-sidecars-{slug}"
 
 
-def build_or_load_images(plan: MacosContainerBottlePlan) -> BottleImages:
-    """Resolve agent and sidecar image refs. Builds the sidecar when needed,
-    but never builds the agent when policy is 'cached'."""
-    committed = read_committed_image(plan.slug)
-    if committed and container_mod.image_exists(committed):
-        info(f"using committed image {committed!r}")
-        if plan.spec.image_policy != "cached":
-            container_mod.build_image(SIDECAR_BUNDLE_IMAGE, _REPO_DIR, dockerfile=SIDECAR_BUNDLE_DOCKERFILE)
-        return BottleImages(agent=committed, sidecar=SIDECAR_BUNDLE_IMAGE)
-    if plan.spec.image_policy == "cached":
-        if not container_mod.image_exists(plan.image):
-            die(
-                f"cached agent image {plan.image!r} not found; "
-                "run without --cached-images to build it"
-            )
-        if not container_mod.image_exists(SIDECAR_BUNDLE_IMAGE):
-            die(
-                f"cached sidecar image {SIDECAR_BUNDLE_IMAGE!r} not found; "
-                "run without --cached-images to build it"
-            )
-        info(f"using cached agent image {plan.image!r}")
-        info(f"using cached sidecar image {SIDECAR_BUNDLE_IMAGE!r}")
-        return BottleImages(agent=plan.image, sidecar=SIDECAR_BUNDLE_IMAGE)
-    container_mod.build_image(SIDECAR_BUNDLE_IMAGE, _REPO_DIR, dockerfile=SIDECAR_BUNDLE_DOCKERFILE)
-    container_mod.build_image(plan.image, _REPO_DIR, dockerfile=plan.dockerfile_path)
-    return BottleImages(agent=plan.image, sidecar=SIDECAR_BUNDLE_IMAGE)
-
-
 @contextmanager
 def launch(
     plan: MacosContainerBottlePlan,
-    images: BottleImages,
     *,
     provision: Callable[[MacosContainerBottlePlan, "MacosContainerBottle"], str | None],
 ) -> Generator[MacosContainerBottle, None, None]:
-    """Run, provision, and yield an Apple Container bottle."""
+    """Build, run, provision, and yield an Apple Container bottle."""
     stack = ExitStack()
     bottle_for_revoke = plan.manifest.bottle
     git_gate_dir_for_revoke = git_gate_state_dir(plan.slug)
 
-    plan = dataclasses.replace(
-        plan,
-        agent_provision=dataclasses.replace(plan.agent_provision, image=str(images.agent)),
-    )
-
     def teardown() -> None:
         teardown_exc: BaseException | None = None
         try:
@@ -131,6 +96,7 @@ def launch(
 
     try:
         plan = _mint_certs(plan)
+        plan = _build_images(plan)
 
         internal_network = internal_network_name(plan.slug)
         egress_network = egress_network_name(plan.slug)
@@ -183,6 +149,35 @@ def _mint_certs(plan: MacosContainerBottlePlan) -> MacosContainerBottlePlan:
     return dataclasses.replace(plan, egress_plan=egress_plan)
 
 
+def _build_images(plan: MacosContainerBottlePlan) -> MacosContainerBottlePlan:
+    cached = plan.spec.image_policy == "cached"
+    committed = read_committed_image(plan.slug)
+    if committed and container_mod.image_exists(committed):
+        info(f"using committed image {committed!r}")
+        if not cached:
+            container_mod.build_image(SIDECAR_BUNDLE_IMAGE, _REPO_DIR, dockerfile=SIDECAR_BUNDLE_DOCKERFILE)
+        return dataclasses.replace(
+            plan,
+            agent_provision=dataclasses.replace(plan.agent_provision, image=committed),
+        )
+    if cached:
+        if not container_mod.image_exists(plan.image):
+            die(
+                f"cached agent image {plan.image!r} not found; "
+                "run without --cached-images to build it"
+            )
+        if not container_mod.image_exists(SIDECAR_BUNDLE_IMAGE):
+            die(
+                f"cached sidecar image {SIDECAR_BUNDLE_IMAGE!r} not found; "
+                "run without --cached-images to build it"
+            )
+        info(f"using cached agent image {plan.image!r}")
+        info(f"using cached sidecar image {SIDECAR_BUNDLE_IMAGE!r}")
+        return plan
+    container_mod.build_image(SIDECAR_BUNDLE_IMAGE, _REPO_DIR, dockerfile=SIDECAR_BUNDLE_DOCKERFILE)
+    container_mod.build_image(plan.image, _REPO_DIR, dockerfile=plan.dockerfile_path)
+    return plan
+
 
 def stale_checks(plan: MacosContainerBottlePlan) -> None:
     """Raise StaleImageError if a cached image is older than the configured

bot_bottle/backend/smolmachines/backend.py

@@ -19,7 +19,7 @@ from ...env import ResolvedEnv
 from ...git_gate import GitGatePlan
 from ...supervise import SupervisePlan
 from ...manifest import Manifest
-from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
+from .. import ActiveAgent, BottleBackend, BottleSpec
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -77,17 +77,14 @@ class SmolmachinesBottleBackend(
             stage_dir=stage_dir,
         )
 
-    def prelaunch_checks(self, plan: SmolmachinesBottlePlan) -> None:
+    def _image_stale_checks(self, plan: SmolmachinesBottlePlan) -> None:
         _launch.stale_checks(plan)
 
-    def _build_or_load_images(self, plan: SmolmachinesBottlePlan) -> BottleImages:
-        return _launch.build_or_load_images(plan)
-
     @contextmanager
     def _launch_impl(
-        self, plan: SmolmachinesBottlePlan, images: BottleImages
+        self, plan: SmolmachinesBottlePlan
     ) -> Generator[SmolmachinesBottle, None, None]:
-        with _launch.launch(plan, images, provision=self.provision) as bottle:
+        with _launch.launch(plan, provision=self.provision) as bottle:
             yield bottle
 
     def supervise_mcp_url(self, plan: SmolmachinesBottlePlan) -> str:

bot_bottle/backend/smolmachines/egress_apply.py

@@ -7,23 +7,16 @@ exec`` instead of Docker.
 
 from __future__ import annotations
 
-from pathlib import Path
-
-from ...bottle_state import egress_state_dir
+from ...egress import EGRESS_ROUTES_IN_CONTAINER
 from ...log import warn
 from ..egress_apply import EgressApplicator, EgressApplyError
 from . import sidecar_bundle as _bundle
 from . import smolvm as _smolvm
 
-# Routes file path inside the sidecar VM. Set via EGRESS_ROUTES env var
-# at launch so the addon reads from the virtiofs-mounted confdir instead
-# of the default /etc/egress/routes.yaml.
-_EGRESS_ROUTES_IN_SIDECAR_VM = "/bot-bottle-data/egress/routes.yaml"
-
 
 def fetch_current_routes(slug: str) -> str:
     machine = _bundle.bundle_machine_name(slug)
-    result = _smolvm.machine_exec(machine, ["cat", _EGRESS_ROUTES_IN_SIDECAR_VM])
+    result = _smolvm.machine_exec(machine, ["cat", EGRESS_ROUTES_IN_CONTAINER])
     if result.returncode != 0:
         raise EgressApplyError(
             f"could not read routes.yaml from {machine}: "
@@ -33,14 +26,6 @@ def fetch_current_routes(slug: str) -> str:
 
 
 class SmolmachinesEgressApplicator(EgressApplicator):
-    @staticmethod
-    def _routes_path(slug: str) -> Path:
-        # Routes live in the smolvm-sidecar-data staging dir, which is
-        # virtiofs-mounted at /bot-bottle-data/ in the sidecar VM. Writes
-        # here are visible inside the VM immediately; a SIGHUP causes the
-        # addon to reload from _EGRESS_ROUTES_IN_SIDECAR_VM.
-        return egress_state_dir(slug) / "smolvm-sidecar-data" / "egress" / "routes.yaml"
-
     def _signal_bundle_reload(self, slug: str) -> None:
         machine = _bundle.bundle_machine_name(slug)
         result = _smolvm.machine_exec(machine, ["sh", "-c", "kill -HUP 1"])

bot_bottle/backend/smolmachines/launch.py

@@ -14,12 +14,12 @@ from __future__ import annotations
 
 import dataclasses
 import os
-import shutil
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
 
 from ...egress import (
+    EGRESS_ROUTES_IN_CONTAINER,
     egress_agent_env_entries,
     egress_resolve_token_values,
     egress_sidecar_env_entries,
@@ -28,9 +28,16 @@ from ...supervise import DB_PATH_IN_CONTAINER, SUPERVISE_PORT
 from ...util import expand_tilde
 from ..docker import util as docker_mod
 from ..docker.egress import (
+    EGRESS_CA_IN_CONTAINER,
     EGRESS_PORT as _EGRESS_PORT,
     egress_tls_init,
 )
+from ..docker.git_gate import (
+    GIT_GATE_ACCESS_HOOK_IN_CONTAINER,
+    GIT_GATE_CREDS_DIR_IN_CONTAINER,
+    GIT_GATE_ENTRYPOINT_IN_CONTAINER,
+    GIT_GATE_HOOK_IN_CONTAINER,
+)
 from ...git_gate import (
     provision_git_gate_dynamic_keys,
     revoke_git_gate_provisioned_keys,
@@ -42,7 +49,6 @@ from ...bottle_state import (
     git_gate_state_dir,
     read_committed_image,
 )
-from .. import BottleImages
 from . import loopback_alias as _loopback
 from . import port_forward as _forward
 from . import sidecar_bundle as _bundle
@@ -56,18 +62,6 @@ from .local_registry import crane_push_tarball, ephemeral_registry
 _REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)
 
 
-# Single virtiofs mount for egress + git-gate files. libkrun limits
-# the total of mounts + port-mappings to 5; with 3 daemon ports the
-# sidecar VM can carry at most 2 mounts. Egress CA/routes and
-# git-gate scripts/creds are staged into subdirectories of one host
-# dir and mounted here. Env vars (EGRESS_CONFDIR, EGRESS_ROUTES,
-# and the Dockerfile's git-gate wrapper) point each daemon at its
-# subdirectory.
-_SIDECAR_DATA_DIR_IN_VM = "/bot-bottle-data"
-_EGRESS_CONFDIR_IN_VM = f"{_SIDECAR_DATA_DIR_IN_VM}/egress"
-_GIT_GATE_SCRIPTS_DIR_IN_VM = f"{_SIDECAR_DATA_DIR_IN_VM}/git-gate"
-
-
 # Per-host cache for `smolvm pack create` outputs. Keyed by the
 # docker image ID so a Dockerfile change automatically invalidates
 # the cache. `pack create` is idempotent on the smolvm side but
@@ -82,32 +76,13 @@ _GIT_HTTP_PORT = 9420
 _SUPERVISE_PORT = SUPERVISE_PORT
 
 
-def build_or_load_images(plan: SmolmachinesBottlePlan) -> BottleImages:
-    """Return pre-built or freshly built smolmachine artifact paths."""
-    return BottleImages(
-        agent=_agent_from_path(plan),
-        sidecar=_sidecar_from_path(plan),
-    )
-
-
-def _sidecar_from_path(plan: SmolmachinesBottlePlan) -> Path:
-    """Return the sidecar bundle artifact path, building it if needed."""
-    if _image_policy(plan) == "cached":
-        return _cached_smolmachine(_bundle.SIDECAR_BUNDLE_IMAGE, label="sidecar")
-    return _ensure_smolmachine(
-        _bundle.SIDECAR_BUNDLE_IMAGE,
-        dockerfile=_bundle.SIDECAR_BUNDLE_DOCKERFILE,
-    )
-
-
 @contextmanager
 def launch(
     plan: SmolmachinesBottlePlan,
-    images: BottleImages,
     *,
     provision: Callable[[SmolmachinesBottlePlan, "SmolmachinesBottle"], str | None],
 ) -> Generator[SmolmachinesBottle, None, None]:
-    """Run the bottle from pre-built images and yield a handle; tear everything
+    """Build + run the bottle and yield a handle; tear everything
     down on exit. Errors during bringup unwind any partial state
     via the ExitStack."""
     stack = ExitStack()
@@ -115,9 +90,11 @@ def launch(
         loopback_ip, network = _allocate_resources(plan, stack)
         plan = _mint_certs(plan)
         proxy_host = loopback_ip
-        plan = _start_bundle(plan, network, proxy_host, Path(images.sidecar), stack)
+        plan = _start_bundle(plan, network, proxy_host, stack)
 
-        _launch_vm(plan, Path(images.agent), proxy_host, stack)
+        agent_from_path = _agent_from_path(plan)
+
+        _launch_vm(plan, agent_from_path, proxy_host, stack)
         _init_vm(plan)
 
         bottle = SmolmachinesBottle(
@@ -194,18 +171,24 @@ def _start_bundle(
     plan: SmolmachinesBottlePlan,
     network: str,
     proxy_host: str,
-    sidecar_artifact: Path,
     stack: ExitStack,
 ) -> SmolmachinesBottlePlan:
-    """Build the BundleLaunchSpec, start the sidecar VM from the pre-resolved
-    artifact, wrap its raw smolVM-published loopback ports with per-bottle
-    forwarders, stamp agent URLs from those forwarder ports, and register teardown."""
+    """Build the BundleLaunchSpec, start the sidecar VM, wrap its raw
+    smolVM-published loopback ports with per-bottle forwarders, stamp
+    agent URLs from those forwarder ports, and register teardown."""
     plan = _provision_git_gate_keys(plan)
     bundle_spec = _bundle_launch_spec(plan, network, proxy_host)
     token_env = _resolve_token_env(plan, dict(os.environ))
+    if _image_policy(plan) == "cached":
+        artifact = _cached_smolmachine(bundle_spec.image, label="sidecar")
+    else:
+        artifact = _ensure_smolmachine(
+            bundle_spec.image,
+            dockerfile=_bundle.SIDECAR_BUNDLE_DOCKERFILE,
+        )
     launch = _bundle.start_bundle_vm(
         bundle_spec,
-        from_path=sidecar_artifact,
+        from_path=artifact,
         host_env={**os.environ, **token_env},
     )
     stack.callback(_bundle.stop_bundle_vm, plan.slug)
@@ -312,16 +295,6 @@ def _launch_vm(
     fails closed if it can't. Smolfile isn't usable here — smolvm 0.8.0
     makes --from and --smolfile mutually exclusive."""
     tsi_cidr = f"{proxy_host}/32"
-    # Destroy any leftover machine from a previous run that didn't
-    # clean up (e.g. crash, interrupted teardown).
-    try:
-        _smolvm.machine_stop(plan.machine_name)
-    except _smolvm.SmolvmError:
-        pass
-    try:
-        _smolvm.machine_delete(plan.machine_name)
-    except _smolvm.SmolvmError:
-        pass
     _smolvm.machine_create(
         plan.machine_name,
         from_path=agent_from_path,
@@ -389,64 +362,6 @@ def _port_for_label(label: str) -> int:
     raise ValueError(f"unknown sidecar forward label: {label}")
 
 
-def _stage_sidecar_data(plan: SmolmachinesBottlePlan) -> Path:
-    """Stage egress + git-gate files into one virtiofs-mountable dir.
-
-    libkrun limits total mounts + port-mappings to 5. With 3 daemon
-    ports the sidecar VM can carry at most 2 mounts (the second is
-    the supervise DB). Egress and git-gate share a single mount:
-
-        <staging>/egress/     → _EGRESS_CONFDIR_IN_VM
-        <staging>/git-gate/   → _GIT_GATE_SCRIPTS_DIR_IN_VM
-
-    The mount is writable so mitmproxy can write combined-trust.pem
-    and cache per-host certs under the egress subdir."""
-    staging = egress_state_dir(plan.slug) / "smolvm-sidecar-data"
-
-    # --- egress subdir ---
-    confdir = staging / "egress"
-    confdir.mkdir(parents=True, exist_ok=True)
-    ep = plan.egress_plan
-    shutil.copy2(str(ep.mitmproxy_ca_host_path), str(confdir / "mitmproxy-ca.pem"))
-    if ep.routes:
-        shutil.copy2(str(ep.routes_path), str(confdir / "routes.yaml"))
-
-    # --- git-gate subdir (only when upstreams are configured) ---
-    gp = plan.git_gate_plan
-    if gp.upstreams:
-        scripts_dir = staging / "git-gate"
-        scripts_dir.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(str(gp.entrypoint_script), str(scripts_dir / "entrypoint.sh"))
-        shutil.copy2(str(gp.hook_script), str(scripts_dir / "pre-receive"))
-        shutil.copy2(str(gp.access_hook_script), str(scripts_dir / "access-hook"))
-        for name in ("entrypoint.sh", "pre-receive", "access-hook"):
-            (scripts_dir / name).chmod(0o755)
-
-        # Patch credential paths: the rendered entrypoint hardcodes
-        # /git-gate/creds/; rewrite to the in-VM git-gate subdir.
-        ep_path = scripts_dir / "entrypoint.sh"
-        ep_path.write_text(
-            ep_path.read_text().replace(
-                "/git-gate/creds/",
-                f"{_GIT_GATE_SCRIPTS_DIR_IN_VM}/creds/",
-            )
-        )
-
-        creds_dir = scripts_dir / "creds"
-        creds_dir.mkdir(exist_ok=True)
-        for u in gp.upstreams:
-            keypath = Path(expand_tilde(u.identity_file))
-            dest_key = creds_dir / f"{u.name}-key"
-            shutil.copy2(str(keypath), str(dest_key))
-            dest_key.chmod(0o600)
-            if u.known_hosts_file:
-                dest_kh = creds_dir / f"{u.name}-known_hosts"
-                shutil.copy2(str(u.known_hosts_file), str(dest_kh))
-                dest_kh.chmod(0o600)
-
-    return staging
-
-
 def _bundle_launch_spec(
     plan: SmolmachinesBottlePlan, network: str, proxy_host: str,
 ) -> _bundle.BundleLaunchSpec:
@@ -465,26 +380,35 @@ def _bundle_launch_spec(
     env: list[str] = []
     volumes: list[tuple[str, str, bool]] = []
 
-    # --- egress + git-gate (single mount) ---------------------
-    # Stage both into one dir and mount it at _SIDECAR_DATA_DIR_IN_VM.
-    # libkrun limits mounts + port-mappings to 5; with 3 daemon ports
-    # we can carry at most 2 mounts (this one + supervise DB).
-    # Writable so egress_entrypoint.sh can write combined-trust.pem
-    # and mitmproxy can create its per-host cert cache.
+    # --- egress -----------------------------------------------
     ep = plan.egress_plan
-    gp = plan.git_gate_plan
-    staging = _stage_sidecar_data(plan)
-    volumes.append((str(staging), _SIDECAR_DATA_DIR_IN_VM, False))
-    # Tell the egress entrypoint where to find its CA + routes.
-    env.append(f"EGRESS_CONFDIR={_EGRESS_CONFDIR_IN_VM}")
-    # Always set EGRESS_ROUTES so the addon reads from the confdir path
-    # even when no routes were configured at launch (apply_routes_change
-    # writes here and a SIGHUP causes the addon to pick them up).
-    env.append(f"EGRESS_ROUTES={_EGRESS_CONFDIR_IN_VM}/routes.yaml")
+    volumes.append((str(ep.mitmproxy_ca_host_path), EGRESS_CA_IN_CONTAINER, True))
+    if ep.routes:
+        volumes.append((str(ep.routes_path.parent), str(Path(EGRESS_ROUTES_IN_CONTAINER).parent), True))
     env.extend(egress_sidecar_env_entries(ep))
 
+    # --- git-gate ---------------------------------------------
+    gp = plan.git_gate_plan
     if gp.upstreams:
         daemons += ["git-gate", "git-http"]
+        volumes += [
+            (str(gp.entrypoint_script), GIT_GATE_ENTRYPOINT_IN_CONTAINER, True),
+            (str(gp.hook_script), GIT_GATE_HOOK_IN_CONTAINER, True),
+            (str(gp.access_hook_script), GIT_GATE_ACCESS_HOOK_IN_CONTAINER, True),
+        ]
+        for u in gp.upstreams:
+            keypath = expand_tilde(u.identity_file)
+            volumes.append((
+                keypath,
+                f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-key",
+                True,
+            ))
+            if u.known_hosts_file:
+                volumes.append((
+                    str(u.known_hosts_file),
+                    f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-known_hosts",
+                    True,
+                ))
 
     # --- supervise --------------------------------------------
     sp = plan.supervise_plan
@@ -495,13 +419,7 @@ def _bundle_launch_spec(
             f"SUPERVISE_DB_PATH={DB_PATH_IN_CONTAINER}",
             f"SUPERVISE_PORT={SUPERVISE_PORT}",
         ]
-        # virtiofs requires directory mount — mount the DB's parent
-        # dir so bot-bottle.db lands at the right in-VM path.
-        volumes.append((
-            str(sp.db_path.parent),
-            str(Path(DB_PATH_IN_CONTAINER).parent),
-            False,
-        ))
+        volumes.append((str(sp.db_path), DB_PATH_IN_CONTAINER, False))
 
     # Container ports the agent reaches from the smolvm guest —
     # published on `proxy_host` so the TSI allowlist and the docker

bot_bottle/backend/smolmachines/sidecar_bundle.py

@@ -135,16 +135,6 @@ def start_bundle_vm(
         elif entry in effective_host_env:
             env[entry] = effective_host_env[entry]
     name = bundle_machine_name(spec.slug)
-    # Destroy any leftover machine from a previous run that didn't
-    # clean up (e.g. crash, interrupted teardown).
-    try:
-        _smolvm.machine_stop(name)
-    except _smolvm.SmolvmError:
-        pass
-    try:
-        _smolvm.machine_delete(name)
-    except _smolvm.SmolvmError:
-        pass
     _smolvm.machine_create(
         name,
         from_path=from_path,

bot_bottle/cli/start.py

@@ -556,35 +556,38 @@ def _launch_bottle(
             return 0
 
         backend = get_bottle_backend(backend_name)
-        try:
-            backend.prelaunch_checks(plan)
-        except StaleImageError as exc:
-            if assume_yes:
-                die(str(exc))
-            sys.stderr.write(f"bot-bottle: {exc}\nLaunch anyway? [y/N] ")
-            sys.stderr.flush()
-            if read_tty_line() not in ("y", "Y", "yes", "YES"):
-                return 0
-        with backend.launch(plan) as bottle:
-            agent_provider_template = getattr(plan, "agent_provider_template", "claude")
-            extra_args: tuple[str, ...] = ()
-            if headless_prompt_text:
-                extra_args = tuple(
-                    get_provider(agent_provider_template).headless_prompt(
-                        headless_prompt_text
+        skip_stale = False
+        while True:
+            try:
+                with backend.launch(plan, skip_stale=skip_stale) as bottle:
+                    agent_provider_template = getattr(plan, "agent_provider_template", "claude")
+                    extra_args: tuple[str, ...] = ()
+                    if headless_prompt_text:
+                        extra_args = tuple(
+                            get_provider(agent_provider_template).headless_prompt(
+                                headless_prompt_text
+                            )
+                        )
+                    exit_code = attach_agent(
+                        bottle,
+                        agent_provider_template=agent_provider_template,
+                        startup_args=plan.agent_provision.startup_args + extra_args,
                     )
-                )
-            exit_code = attach_agent(
-                bottle,
-                agent_provider_template=agent_provider_template,
-                startup_args=plan.agent_provision.startup_args + extra_args,
-            )
-            info(
-                f"session ended (exit {exit_code}); "
-                f"container {bottle.name} will be removed"
-            )
-            if agent_provider_template == "claude":
-                capture_claude_session_state(identity, exit_code)
+                    info(
+                        f"session ended (exit {exit_code}); "
+                        f"container {bottle.name} will be removed"
+                    )
+                    if agent_provider_template == "claude":
+                        capture_claude_session_state(identity, exit_code)
+                break
+            except StaleImageError as exc:
+                if assume_yes:
+                    die(str(exc))
+                sys.stderr.write(f"bot-bottle: {exc}\nLaunch anyway? [y/N] ")
+                sys.stderr.flush()
+                if read_tty_line() not in ("y", "Y", "yes", "YES"):
+                    break
+                skip_stale = True
         return 0
     finally:
         # PRD 0018 chunk 2: prepare now writes the bottle's bind-mount

bot_bottle/egress_entrypoint.sh

@@ -28,7 +28,7 @@ set -e
 # flag mitmdump would generate a fresh CA on the wrong path and
 # the agent's installed trust anchor would no longer match the
 # bumped leaf certs.
-CONFDIR="${EGRESS_CONFDIR:-/home/mitmproxy/.mitmproxy}"
+CONFDIR=/home/mitmproxy/.mitmproxy
 CONFDIR_FLAG="--set confdir=$CONFDIR"
 
 MODE="--mode regular@9099"

docs/research/landscape-containerized-claude.md

@@ -1,20 +1,14 @@
-# Landscape: containerized AI coding agent tools
+# Landscape: containerized Claude Code agent tools
 
 Research into whether bot-bottle is redundant with existing projects, and
 whether it's worth publishing.
 
 ## Summary
 
-The "AI coding agents in isolated sandboxes" space is active but not saturated.
-bot-bottle occupies a distinct position: no surveyed project combines all five
-of its defining features. Publishing is likely worthwhile, with the main risk
-being claudebox expanding to absorb the same niche.
-
-**Updated 2026-07-09:** bot-bottle now supports three isolation backends
-(Docker, Apple `container`, smolmachines/libkrun microVMs) and three built-in
-agent providers (Claude Code, OpenAI Codex, Pi) with an open plugin system for
-arbitrary providers. This meaningfully strengthens the differentiation against
-all surveyed competitors.
+The "Claude Code in Docker" space is active but not saturated. bot-bottle
+occupies a distinct position: no surveyed project combines all five of its
+defining features. Publishing is likely worthwhile, with the main risk being
+claudebox expanding to absorb the same niche.
 
 ## Closest competitor: claudebox
 
@@ -49,78 +43,28 @@ manifest merge.
   Still marked early-development.
 - **E2B, Northflank, Cloudflare Sandbox SDK** — cloud-hosted SaaS sandbox
   runtimes; fundamentally different architecture.
-- **superhq.ai / SuperHQ** (v0.4.4, April 2026) — macOS desktop app (Rust/GPUI)
-  that runs Claude Code, Codex, and Pi inside microVMs via Apple's
-  Virtualization.framework (their own shuru-sdk / libkrun). Auth gateway
-  injects API keys on the wire so the sandbox never sees them; tmpfs overlay
-  stages agent writes for diff-and-accept review; mobile remote access via
-  remote.superhq.ai. Early alpha, free on launch, Apple Silicon only.
-
-  Overlap: both projects cover agent isolation, credential proxying, and
-  multi-provider support (Claude Code / Codex / Pi). Differences: SuperHQ is a
-  GUI desktop app with no manifest layer; bot-bottle is a CLI fleet manager with
-  named agents, skills injection, per-agent system prompts, and cross-platform
-  backends (Docker, Apple `container`, smolmachines). SuperHQ's microVM
-  isolation story is now partially matched by bot-bottle's `macos_container` and
-  smolmachines backends. Worth watching — it targets the same security-minded
-  power-user audience and moves fast.
-
-  **Known gap in SuperHQ (user-requested, as of 2026-07-09):** A named user
-  (Brian Cheong, Founder, Dunialabs.io) explicitly called out the absence of
-  per-run audit logging: tool calls and network egress. Bot-bottle covers both:
-  network egress is logged by pipelock/mitmproxy, and per-run op-log/audit state
-  is persisted to SQLite.
 
 ## What no found project does
 
 None combine:
-1. Named-agent manifest with per-agent env resolution (prompt / host-forward / literal), supporting multiple providers (Claude Code, Codex, Pi, arbitrary plugins)
-2. Skills directory injection
+1. Named-agent JSON manifest with per-agent env resolution (prompt / host-forward / literal)
+2. Claude Code skills directory injection
 3. Per-agent system prompts
 4. SSH-agent key forwarding without copying private keys into the container
 5. Home + project manifest merge
-6. Pluggable isolation backends: Docker (Linux/macOS), Apple `container` (macOS microVMs), smolmachines/libkrun microVMs
-7. Per-run audit log: network egress via pipelock/mitmproxy + op-log persisted to SQLite
-
-**In-flight directions (not yet shipped):**
-
-- **Forge-native dispatch (issue #317):** Gitea webhook → orchestrator spins up a bottle
-  with the issue body as prompt → agent works → bottle freezes awaiting review comment →
-  rehydrates on comment → tears down on PR close. The issue-to-PR lifecycle concept is not
-  novel (Devin, Copilot Workspace, SWE-agent all do this as cloud services); what's
-  distinct is doing it self-hosted, manifest-driven, inside bot-bottle's isolation
-  primitives.
-- **Paid web control plane (issue #327):** Browser-based multi-host agent launch and
-  monitoring; account-scoped bottle and agent definitions; secret custody (encrypted at
-  rest, injected into the sidecar at launch, never exposed to the agent or returned by any
-  read API). Monetization model: OSS runtime free, control plane paid — a standard split
-  (HashiCorp, Grafana) applied to a self-hosted agent sandbox. The principled secret
-  custody model (agent never sees real credentials, even via printenv) is more rigorous
-  than most surveyed tools but not unprecedented.
 
 ## Publishing verdict
 
 Worth publishing. Differentiators that matter to the target audience (power
-users running parallel AI coding agent sessions with distinct personas/tooling):
+users running parallel Claude Code sessions with distinct personas/tooling):
 
-- The Python-stdlib-first, low-dependency design — competitors are npm-based,
-  Rust/GUI, or Kubernetes-native.
+- The Python-stdlib-first, low-dependency design — competitors are npm-based or
+  Kubernetes-native.
 - Named agents with distinct skills and system prompts, not just language profiles.
-- Multi-backend isolation: Docker, Apple `container` microVMs, and
-  smolmachines/libkrun — single manifest works across all three.
-- Multi-provider: Claude Code, Codex, Pi, plus an open plugin system for
-  arbitrary providers.
 - SSH forwarding without key copying.
-- Per-run audit log (tool calls + network egress) — an explicitly requested gap
-  in SuperHQ as of 2026-07-09.
-- Forge-native dispatch and a paid control plane (in flight) bring bot-bottle
-  into the same product category as cloud services like Devin and Copilot
-  Workspace — but self-hosted, with stronger isolation guarantees and a
-  manifest-driven fleet model those services don't have.
 
-Main risk: claudebox adds manifest/agent config; SuperHQ is moving fast on the
-GUI / microVM side. The space is moving fast enough that publishing sooner is
-better if establishing prior art matters.
+Main risk: claudebox adds manifest/agent config. The space is moving fast
+enough that publishing sooner is better if establishing prior art matters.
 
 Discovery will be slow without active promotion; an Anthropic Discord post or
 HN "Show HN" would do most of the work.
@@ -129,4 +73,4 @@ HN "Show HN" would do most of the work.
 
 - GitHub search cannot surface private or very new repos comprehensively.
 - Counts (stars, forks) were not confirmed for every project.
-- Initial research conducted 2026-05-07; SuperHQ entry added 2026-07-09; the space moves fast.
+- Research conducted 2026-05-07; the space moves fast.

tests/unit/test_cli_start_stale.py

@@ -1,9 +1,9 @@
 """Unit: _launch_bottle StaleImageError handling.
 
-Exercises prelaunch_checks / backend.launch flow:
+Exercises the while-True / try-except loop around backend.launch:
   - headless mode → die on stale
   - interactive mode, user declines → stop without launching
-  - interactive mode, user confirms → skip stale check and launch once
+  - interactive mode, user confirms → retry with skip_stale=True
 """
 
 from __future__ import annotations
@@ -28,6 +28,14 @@ def _fake_plan() -> Any:
     ))
 
 
+def _stale_cm() -> MagicMock:
+    """Return a context-manager mock whose __enter__ raises StaleImageError."""
+    cm = MagicMock()
+    cm.__enter__ = MagicMock(side_effect=StaleImageError("image is 5 day(s) old"))
+    cm.__exit__ = MagicMock(return_value=False)
+    return cm
+
+
 def _ok_cm(bottle: Any) -> MagicMock:
     """Return a context-manager mock that yields `bottle`."""
     cm = MagicMock()
@@ -70,25 +78,23 @@ class TestLaunchBottleStaleHandling(unittest.TestCase):
             )
 
     def test_headless_stale_calls_die(self) -> None:
-        """In headless mode (assume_yes=True), a StaleImageError from prelaunch_checks must call die()."""
+        """In headless mode (assume_yes=True), a StaleImageError must call die()."""
         import bot_bottle.cli.start as start_mod
 
         backend_mock = MagicMock()
-        backend_mock.prelaunch_checks.side_effect = StaleImageError("image is 5 day(s) old")
+        backend_mock.launch.return_value = _stale_cm()
 
         with patch.object(start_mod, "get_bottle_backend", return_value=backend_mock), \
              patch.object(start_mod, "die", side_effect=Die()):
             with self.assertRaises(Die):
                 self._run_launch(assume_yes=True)
 
-        backend_mock.launch.assert_not_called()
-
-    def test_interactive_user_declines_stops_before_launch(self) -> None:
-        """Interactive user answering 'n' → launch is never called."""
+    def test_interactive_user_declines_stops_loop(self) -> None:
+        """Interactive user answering 'n' → loop exits without a second launch."""
         import bot_bottle.cli.start as start_mod
 
         backend_mock = MagicMock()
-        backend_mock.prelaunch_checks.side_effect = StaleImageError("image is 5 day(s) old")
+        backend_mock.launch.return_value = _stale_cm()
 
         with patch.object(start_mod, "get_bottle_backend", return_value=backend_mock), \
              patch.object(start_mod, "read_tty_line", return_value="n"), \
@@ -96,18 +102,23 @@ class TestLaunchBottleStaleHandling(unittest.TestCase):
             rc = self._run_launch(assume_yes=False)
 
         self.assertEqual(0, rc)
-        backend_mock.launch.assert_not_called()
+        # launch was called once (stale), then the user declined → no second call.
+        backend_mock.launch.assert_called_once()
 
-    def test_interactive_user_confirms_launches_once(self) -> None:
-        """Interactive user answering 'y' → prelaunch stale error is bypassed; launch called once."""
+    def test_interactive_user_confirms_retries_with_skip_stale(self) -> None:
+        """Interactive user answering 'y' → second launch with skip_stale=True."""
         import bot_bottle.cli.start as start_mod
 
         bottle_mock = MagicMock()
         bottle_mock.name = "dev-abc"
 
+        def launch_side_effect(plan: Any, *, skip_stale: bool = False) -> Any:
+            if not skip_stale:
+                return _stale_cm()
+            return _ok_cm(bottle_mock)
+
         backend_mock = MagicMock()
-        backend_mock.prelaunch_checks.side_effect = StaleImageError("image is 5 day(s) old")
-        backend_mock.launch.return_value = _ok_cm(bottle_mock)
+        backend_mock.launch.side_effect = launch_side_effect
 
         with patch.object(start_mod, "get_bottle_backend", return_value=backend_mock), \
              patch.object(start_mod, "read_tty_line", return_value="y"), \
@@ -117,8 +128,11 @@ class TestLaunchBottleStaleHandling(unittest.TestCase):
             rc = self._run_launch(assume_yes=False)
 
         self.assertEqual(0, rc)
-        backend_mock.prelaunch_checks.assert_called_once()
-        backend_mock.launch.assert_called_once()
+        # First call: skip_stale=False → stale. Second call: skip_stale=True → ok.
+        self.assertEqual(2, backend_mock.launch.call_count)
+        calls = backend_mock.launch.call_args_list
+        self.assertFalse(calls[0].kwargs.get("skip_stale", False))
+        self.assertTrue(calls[1].kwargs.get("skip_stale", False))
 
     def test_interactive_yes_uppercase_also_accepted(self) -> None:
         """'Y' or 'YES' should also be accepted as confirmation."""
@@ -127,9 +141,13 @@ class TestLaunchBottleStaleHandling(unittest.TestCase):
         bottle_mock = MagicMock()
         bottle_mock.name = "dev-abc"
 
+        def launch_side_effect(plan: Any, *, skip_stale: bool = False) -> Any:
+            if not skip_stale:
+                return _stale_cm()
+            return _ok_cm(bottle_mock)
+
         backend_mock = MagicMock()
-        backend_mock.prelaunch_checks.side_effect = StaleImageError("image is 5 day(s) old")
-        backend_mock.launch.return_value = _ok_cm(bottle_mock)
+        backend_mock.launch.side_effect = launch_side_effect
 
         with patch.object(start_mod, "get_bottle_backend", return_value=backend_mock), \
              patch.object(start_mod, "read_tty_line", return_value="YES"), \
@@ -139,7 +157,7 @@ class TestLaunchBottleStaleHandling(unittest.TestCase):
             rc = self._run_launch(assume_yes=False)
 
         self.assertEqual(0, rc)
-        backend_mock.launch.assert_called_once()
+        self.assertEqual(2, backend_mock.launch.call_count)
 
 
 if __name__ == "__main__":

tests/unit/test_docker_launch_committed_image.py

@@ -90,7 +90,7 @@ class TestLaunchCommittedImage(unittest.TestCase):
         committed_tag: str | None = None,
         image_present: bool = True,
     ) -> list[str]:
-        """Drive build_or_load_images() + launch() with the committed-image
+        """Drive launch() through its full sequence with the committed-image
         behaviour controlled by the arguments. Returns the images that were
         passed to `build_image` (empty list if it was never called)."""
         built: list[str] = []
@@ -124,9 +124,8 @@ class TestLaunchCommittedImage(unittest.TestCase):
            mock.patch.object(launch_mod, "compose_dump_logs"), \
            mock.patch.object(launch_mod, "compose_down"), \
            contextlib.redirect_stderr(io.StringIO()):
-            images = launch_mod.build_or_load_images(plan)
             provision = mock.Mock(return_value=None)
-            with launch_mod.launch(plan, images, provision=provision):
+            with launch_mod.launch(plan, provision=provision):
                 pass
 
         return built
@@ -171,9 +170,8 @@ class TestLaunchCommittedImage(unittest.TestCase):
            mock.patch.object(launch_mod, "compose_dump_logs"), \
            mock.patch.object(launch_mod, "compose_down"), \
            contextlib.redirect_stderr(io.StringIO()):
-            images = launch_mod.build_or_load_images(plan)
             provision = mock.Mock(return_value=None)
-            with launch_mod.launch(plan, images, provision=provision):
+            with launch_mod.launch(plan, provision=provision):
                 pass
 
         self.assertEqual(1, len(captured_plans))

tests/unit/test_docker_launch_teardown.py

@@ -16,7 +16,7 @@ from pathlib import Path
 from unittest import mock
 
 from bot_bottle.agent_provider import AgentProvisionPlan
-from bot_bottle.backend import BottleImages, BottleSpec
+from bot_bottle.backend import BottleSpec
 from bot_bottle.backend.docker import launch as launch_mod
 from bot_bottle.backend.docker.bottle_plan import DockerBottlePlan
 from bot_bottle.egress import EgressPlan
@@ -86,8 +86,6 @@ class TestTeardownWarning(unittest.TestCase):
         plan = _plan(self._tmp)
         buf = io.StringIO()
 
-        images = BottleImages(agent="bot-bottle-claude:latest", sidecar="bot-bottle-sidecars:latest")
-
         with mock.patch.object(launch_mod.docker_mod, "build_image"), \
              mock.patch.object(
                  launch_mod, "egress_tls_init",
@@ -117,7 +115,7 @@ class TestTeardownWarning(unittest.TestCase):
              ), \
              contextlib.redirect_stderr(buf):
             provision = mock.Mock(return_value=None)
-            with launch_mod.launch(plan, images, provision=provision):
+            with launch_mod.launch(plan, provision=provision):
                 pass
 
         output = buf.getvalue()

tests/unit/test_macos_container_launch.py

@@ -339,9 +339,9 @@ class TestMacosContainerLaunchCommittedImage(unittest.TestCase):
         ), patch.object(
             launch.container_mod, "build_image", side_effect=fake_build,
         ), patch.object(launch, "info"):
-            images = launch.build_or_load_images(plan)
+            updated = launch._build_images(plan)
 
-        self.assertEqual("bot-bottle-committed-dev-abc:latest", images.agent)
+        self.assertEqual("bot-bottle-committed-dev-abc:latest", updated.image)
         self.assertEqual(1, len(calls))
         self.assertEqual(launch.SIDECAR_BUNDLE_IMAGE, calls[0][0])
 
@@ -360,9 +360,9 @@ class TestMacosContainerLaunchCommittedImage(unittest.TestCase):
         ), patch.object(
             launch.container_mod, "build_image", side_effect=fake_build,
         ):
-            images = launch.build_or_load_images(plan)
+            updated = launch._build_images(plan)
 
-        self.assertEqual("bot-bottle-agent:latest", images.agent)
+        self.assertEqual("bot-bottle-agent:latest", updated.image)
         self.assertEqual(2, len(calls))
         self.assertEqual("bot-bottle-agent:latest", calls[1][0])
 
@@ -395,7 +395,7 @@ class TestMacosContainerLaunchCachedImages(unittest.TestCase):
             launch, "die", side_effect=Die(),
         ):
             with self.assertRaises(Die):
-                launch.build_or_load_images(plan)
+                launch._build_images(plan)
 
     def test_cached_mode_dies_when_sidecar_image_missing(self) -> None:
         plan = self._cached_plan()
@@ -411,7 +411,7 @@ class TestMacosContainerLaunchCachedImages(unittest.TestCase):
             launch, "die", side_effect=Die(),
         ):
             with self.assertRaises(Die):
-                launch.build_or_load_images(plan)
+                launch._build_images(plan)
 
     def test_cached_mode_both_present_returns_unchanged_plan(self) -> None:
         plan = self._cached_plan()
@@ -422,10 +422,10 @@ class TestMacosContainerLaunchCachedImages(unittest.TestCase):
         ), patch.object(
             launch.container_mod, "build_image",
         ) as build, patch.object(launch, "info"):
-            images = launch.build_or_load_images(plan)
+            result = launch._build_images(plan)
 
         build.assert_not_called()
-        self.assertEqual(plan.image, images.agent)
+        self.assertEqual(plan.image, result.image)
 
     def test_committed_image_plus_cached_skips_sidecar_build(self) -> None:
         plan = self._cached_plan()
@@ -437,11 +437,11 @@ class TestMacosContainerLaunchCachedImages(unittest.TestCase):
         ), patch.object(
             launch.container_mod, "build_image",
         ) as build, patch.object(launch, "info"):
-            images = launch.build_or_load_images(plan)
+            result = launch._build_images(plan)
 
         # In cached mode with a committed image, no builds should fire.
         build.assert_not_called()
-        self.assertEqual("bot-bottle-committed-dev-abc:latest", images.agent)
+        self.assertEqual("bot-bottle-committed-dev-abc:latest", result.image)
 
 
 if __name__ == "__main__":

tests/unit/test_smolmachines_egress_apply.py

@@ -18,7 +18,7 @@ class TestFetchCurrentRoutes(unittest.TestCase):
             self.assertEqual("routes", egress_apply.fetch_current_routes("dev-abc"))
         exec_.assert_called_once_with(
             "bot-bottle-sidecars-dev-abc",
-            ["cat", "/bot-bottle-data/egress/routes.yaml"],
+            ["cat", "/etc/egress/routes.yaml"],
         )
 
     def test_read_failure_raises_apply_error(self):

tests/unit/test_smolmachines_provision.py

@@ -404,11 +404,7 @@ class TestBundleLaunchSpec(unittest.TestCase):
             ),
         )
 
-        with patch(
-            "bot_bottle.backend.smolmachines.launch._stage_sidecar_data",
-            return_value=Path("/tmp/smolvm-sidecar-data"),
-        ):
-            spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
+        spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
 
         self.assertEqual(
             "egress,git-gate,git-http",
@@ -420,11 +416,7 @@ class TestBundleLaunchSpec(unittest.TestCase):
     def test_canary_env_registered_as_sensitive_in_bundle(self):
         plan = _plan(canary=True)
 
-        with patch(
-            "bot_bottle.backend.smolmachines.launch._stage_sidecar_data",
-            return_value=Path("/tmp/smolvm-sidecar-data"),
-        ):
-            spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
+        spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
 
         self.assertIn("CANON_ALPHA_SECRET=fake-canary-value", spec.environment)
         self.assertIn(
@@ -435,16 +427,10 @@ class TestBundleLaunchSpec(unittest.TestCase):
     def test_supervise_adds_daemon_volume_and_env(self):
         from bot_bottle.supervise import DB_PATH_IN_CONTAINER
         plan = _plan(supervise=True)
-        with patch(
-            "bot_bottle.backend.smolmachines.launch._stage_sidecar_data",
-            return_value=Path("/tmp/smolvm-sidecar-data"),
-        ):
-            spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
+        spec = _bundle_launch_spec(plan, "net", "127.0.0.16")
         self.assertIn("supervise", spec.daemons_csv)
         self.assertIn(f"SUPERVISE_DB_PATH={DB_PATH_IN_CONTAINER}", spec.environment)
-        # virtiofs requires directory mounts; the DB's parent dir is
-        # mounted so bot-bottle.db lands at the right in-VM path.
-        self.assertIn(("/tmp", str(Path(DB_PATH_IN_CONTAINER).parent), False), spec.volumes)
+        self.assertIn(("/tmp/bot-bottle.db", DB_PATH_IN_CONTAINER, False), spec.volumes)
 
     def test_canary_env_visible_to_smolvm_guest(self):
         plan = _plan(canary=True)
@@ -560,25 +546,24 @@ class TestLaunchResourceWiring(unittest.TestCase):
             ),
         )
 
-        sidecar_artifact = Path("/cache/sidecar.smolmachine")
-
         with patch(
             "bot_bottle.backend.smolmachines.launch._provision_git_gate_keys",
             return_value=plan,
         ), patch(
+            "bot_bottle.backend.smolmachines.launch._ensure_smolmachine",
+            return_value=Path("/cache/sidecar.smolmachine"),
+        ) as ensure, patch(
             "bot_bottle.backend.smolmachines.launch._bundle.start_bundle_vm",
             return_value=raw_launch,
         ) as start_vm, patch(
-            "bot_bottle.backend.smolmachines.launch._stage_sidecar_data",
-            return_value=Path("/tmp/smolvm-sidecar-data"),
-        ), patch(
             "bot_bottle.backend.smolmachines.launch._forward.start_forwarder",
             return_value=handle,
         ) as start_forwarder:
-            stamped = _launch._start_bundle(plan, "net", "127.0.0.16", sidecar_artifact, stack)
+            stamped = _launch._start_bundle(plan, "net", "127.0.0.16", stack)
 
+        ensure.assert_called_once()
         start_vm.assert_called_once()
-        self.assertEqual(sidecar_artifact, start_vm.call_args.kwargs["from_path"])
+        self.assertEqual(Path("/cache/sidecar.smolmachine"), start_vm.call_args.kwargs["from_path"])
         specs = start_forwarder.call_args.args[0]
         self.assertEqual(
             (

tests/unit/test_stale_checks.py

@@ -1,5 +1,5 @@
 """Unit: stale-image check functions across backends, and the
-BottleBackend.launch template method (prelaunch_checks + build_or_load_images).
+BottleBackend.launch template method (skip_stale flag).
 
 No real images or containers are used — all Docker/container/smolmachine
 calls are mocked at the module boundary."""
@@ -23,41 +23,51 @@ def _bottle_cm(bottle: Any) -> MagicMock:
 
 
 # ---------------------------------------------------------------------------
-# BottleBackend.launch template — prelaunch_checks + _build_or_load_images
+# BottleBackend.launch template — _image_stale_checks + skip_stale
 # ---------------------------------------------------------------------------
 
 class TestBottleBackendLaunchTemplate(unittest.TestCase):
     """Verify the concrete launch() method on BottleBackend calls
-    _build_or_load_images and _launch_impl, and that prelaunch_checks is a no-op
-    on the base class."""
+    _image_stale_checks unless skip_stale=True, then delegates to _launch_impl."""
 
     def _make_backend(self) -> Any:
         from bot_bottle.backend.docker.backend import DockerBottleBackend
         return DockerBottleBackend()
 
-    def test_launch_delegates_to_build_or_load_and_launch_impl(self) -> None:
-        from bot_bottle.backend import BottleImages
+    def test_stale_checks_called_by_default(self) -> None:
         backend = self._make_backend()
         plan = cast(Any, SimpleNamespace())
         bottle = MagicMock()
-        images = BottleImages(agent="agent:latest", sidecar="sidecar:latest")
         with patch.object(
-            backend, "_build_or_load_images", return_value=images,
-        ) as build_mock, patch.object(
+            backend, "_image_stale_checks",
+        ) as stale_mock, patch.object(
             backend, "_launch_impl",
             return_value=_bottle_cm(bottle),
-        ) as impl_mock:
+        ):
             with backend.launch(plan):
                 pass
-        build_mock.assert_called_once_with(plan)
-        impl_mock.assert_called_once_with(plan, images)
+        stale_mock.assert_called_once_with(plan)
 
-    def test_noop_default_prelaunch_checks(self) -> None:
+    def test_skip_stale_bypasses_stale_checks(self) -> None:
+        backend = self._make_backend()
+        plan = cast(Any, SimpleNamespace())
+        bottle = MagicMock()
+        with patch.object(
+            backend, "_image_stale_checks",
+        ) as stale_mock, patch.object(
+            backend, "_launch_impl",
+            return_value=_bottle_cm(bottle),
+        ):
+            with backend.launch(plan, skip_stale=True):
+                pass
+        stale_mock.assert_not_called()
+
+    def test_noop_default_image_stale_checks(self) -> None:
         from bot_bottle.backend.docker.backend import DockerBottleBackend
         from bot_bottle.backend import BottleBackend
         backend = DockerBottleBackend()
-        # Base-class prelaunch_checks is a no-op — must not raise.
-        BottleBackend.prelaunch_checks(backend, cast(Any, SimpleNamespace()))  # type: ignore[arg-type]
+        # Call the base-class _image_stale_checks directly to verify it's a no-op.
+        BottleBackend._image_stale_checks(backend, cast(Any, SimpleNamespace()))  # type: ignore[arg-type]
 
 
 # ---------------------------------------------------------------------------
@@ -132,13 +142,13 @@ class TestDockerStaleChecks(unittest.TestCase):
         self.assertEqual(1, cs.call_count)
         self.assertIn(plan.image, cs.call_args.args[0])
 
-    def test_backend_prelaunch_checks_delegates(self) -> None:
+    def test_backend_image_stale_checks_delegates(self) -> None:
         from bot_bottle.backend.docker.backend import DockerBottleBackend
         from bot_bottle.backend.docker import launch as mod
         backend = DockerBottleBackend()
         plan = self._plan()
         with patch.object(mod, "stale_checks") as sc:
-            backend.prelaunch_checks(plan)  # type: ignore[arg-type]
+            backend._image_stale_checks(plan)  # type: ignore[arg-type]
         sc.assert_called_once_with(plan)
 
 
@@ -217,13 +227,13 @@ class TestSmolmachinesStaleChecks(unittest.TestCase):
         sidecar_calls = [c for c in csp.call_args_list if "sidecar" in c.args[0]]
         self.assertGreaterEqual(len(sidecar_calls), 1)
 
-    def test_backend_prelaunch_checks_delegates(self) -> None:
+    def test_backend_image_stale_checks_delegates(self) -> None:
         from bot_bottle.backend.smolmachines.backend import SmolmachinesBottleBackend
         from bot_bottle.backend.smolmachines import launch as mod
         backend = SmolmachinesBottleBackend()
         plan = self._plan()
         with patch.object(mod, "stale_checks") as sc:
-            backend.prelaunch_checks(plan)  # type: ignore[arg-type]
+            backend._image_stale_checks(plan)  # type: ignore[arg-type]
         sc.assert_called_once_with(plan)
 
 
@@ -278,13 +288,13 @@ class TestMacosContainerStaleChecks(unittest.TestCase):
             mod.stale_checks(self._plan())
         cs.assert_not_called()
 
-    def test_backend_prelaunch_checks_delegates(self) -> None:
+    def test_backend_image_stale_checks_delegates(self) -> None:
         from bot_bottle.backend.macos_container.backend import MacosContainerBottleBackend
         from bot_bottle.backend.macos_container import launch as mod
         backend = MacosContainerBottleBackend()
         plan = self._plan()
         with patch.object(mod, "stale_checks") as sc:
-            backend.prelaunch_checks(plan)  # type: ignore[arg-type]
+            backend._image_stale_checks(plan)  # type: ignore[arg-type]
         sc.assert_called_once_with(plan)