feat(claude): add forward_host_credentials support

Reads the host's Claude OAuth session key from ~/.claude.json at launch
and forwards it only to the egress sidecar (never to the agent), placing
a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent env so Claude Code
starts without seeing the real credential.

Mirrors the existing Codex forward_host_credentials flow (PRD 0029).
Adds claude_auth.py to extract and validate the sessionKey, a
CLAUDE_HOST_CREDENTIAL_TOKEN_REF constant in egress.py, and updates
manifest_agent.py to allow the flag for both 'codex' and 'claude'
templates. Also adds a mutual-exclusion check that rejects setting
both auth_token and forward_host_credentials together.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(claude): read credentials from ~/.claude/.credentials.json

The actual OAuth token is in ~/.claude/.credentials.json under
claudeAiOauth.accessToken, not in ~/.claude.json.
~/.claude.json holds only UI state and profile metadata (oauthAccount
has no token fields). expiresAt in the credentials file is milliseconds,
not seconds.

Discovered after testing against Claude Code 2.1.198.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(claude): fall back to macOS Keychain for credentials

On macOS, Claude Code stores credentials in the Keychain under
service "Claude Code-credentials" rather than in a file. When
~/.claude/.credentials.json is absent, shell out to:
  security find-generic-password -s "Claude Code-credentials" -w
and parse the result as the same JSON schema.

~/.claude.json holds only profile/UI metadata (oauthAccount has
no token fields). expiresAt in the credentials is milliseconds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs(prd): fix credential path references (~/.claude/.credentials.json)

fix(test): suppress gitleaks false positives on synthetic Claude tokens

bot_bottle/agent_provider.py

@@ -45,6 +45,10 @@ PROVIDER_TEMPLATES = frozenset({PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_PI})
 # forward_host_credentials is enabled. Pipelock must pass these through
 # (no TLS MITM) or its header DLP blocks the injected JWT.
 CODEX_HOST_CREDENTIAL_HOSTS = ("api.openai.com", "chatgpt.com")
+
+# Host that egress injects the host Claude bearer on when Claude
+# forward_host_credentials is enabled.
+CLAUDE_HOST_CREDENTIAL_HOSTS = ("api.anthropic.com",)
 PromptMode = Literal[
     "append_file",
     "read_prompt_file",

bot_bottle/contrib/claude/agent_provider.py

@@ -23,8 +23,9 @@ from ...agent_provider import (
     provider_startup_args,
 )
 from ...backend.docker import util as docker_mod
-from ...egress import EgressRoute
+from ...egress import CLAUDE_HOST_CREDENTIAL_TOKEN_REF, EgressRoute
 from ...log import die, info, warn
+from .claude_auth import claude_host_access_token
 
 
 if TYPE_CHECKING:
@@ -118,7 +119,6 @@ class ClaudeAgentProvider(AgentProvider):
         color: str = "",
         provider_settings: dict[str, object] | None = None,
     ) -> AgentProvisionPlan:
-        del forward_host_credentials, host_env
         resolved_guest_env = dict(guest_env or {})
         startup_args = provider_startup_args(provider_settings)
         guest_home = self.guest_home
@@ -180,13 +180,24 @@ class ClaudeAgentProvider(AgentProvider):
                 claude_settings,
                 f"{guest_home}/.claude/settings.json",
             ))
+        provisioned_env: dict[str, str] = {}
+        if forward_host_credentials:
+            _host_env = host_env or dict(os.environ)
+            provisioned_env[CLAUDE_HOST_CREDENTIAL_TOKEN_REF] = (
+                claude_host_access_token(_host_env)
+            )
+
+        cred_token_ref = (
+            CLAUDE_HOST_CREDENTIAL_TOKEN_REF if forward_host_credentials
+            else auth_token
+        )
         egress_routes = (EgressRoute(
             host="api.anthropic.com",
-            auth_scheme="Bearer" if auth_token else "",
-            token_ref=auth_token,
+            auth_scheme="Bearer" if (auth_token or forward_host_credentials) else "",
+            token_ref=cred_token_ref,
         ),)
         hidden_env_names: frozenset[str] = frozenset()
-        if auth_token:
+        if auth_token or forward_host_credentials:
             env_vars["CLAUDE_CODE_OAUTH_TOKEN"] = "egress-placeholder"
             hidden_env_names = frozenset({"CLAUDE_CODE_OAUTH_TOKEN"})
 
@@ -208,6 +219,7 @@ class ClaudeAgentProvider(AgentProvider):
             files=tuple(files),
             egress_routes=egress_routes,
             hidden_env_names=hidden_env_names,
+            provisioned_env=provisioned_env,
         )
 
     def provision_skills(self, plan: "BottlePlan", bottle: "Bottle") -> None:

bot_bottle/contrib/claude/claude_auth.py

@@ -0,0 +1,114 @@
+"""Host Claude auth helpers.
+
+Reads the host's Claude Code credentials and returns only the access
+token needed by egress. Does not expose refresh tokens or raw payloads.
+
+Credential storage by platform:
+  Linux  — ~/.claude/.credentials.json
+  macOS  — macOS Keychain, service "Claude Code-credentials"
+            (file path is tried first; Keychain is the fallback)
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+from ...log import die
+
+
+_KEYCHAIN_SERVICE = "Claude Code-credentials"
+
+
+def claude_auth_path(host_env: dict[str, str] | None = None) -> Path:
+    env = os.environ if host_env is None else host_env
+    home = env.get("HOME")
+    if home:
+        return Path(home) / ".claude" / ".credentials.json"
+    return Path.home() / ".claude" / ".credentials.json"
+
+
+def _read_keychain() -> dict[str, object] | None:
+    """Try the macOS Keychain. Returns parsed JSON dict or None."""
+    if sys.platform != "darwin":
+        return None
+    try:
+        result = subprocess.run(
+            ["security", "find-generic-password", "-s", _KEYCHAIN_SERVICE, "-w"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return None
+    if result.returncode != 0 or not result.stdout.strip():
+        return None
+    try:
+        raw = json.loads(result.stdout.strip())
+    except json.JSONDecodeError:
+        return None
+    return raw if isinstance(raw, dict) else None
+
+
+def claude_host_access_token(
+    host_env: dict[str, str] | None = None,
+    *,
+    now: datetime | None = None,
+) -> str:
+    path = claude_auth_path(host_env)
+    raw: dict[str, object] | None = None
+
+    if path.is_file():
+        try:
+            raw = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError) as e:
+            die(f"claude host credentials: could not read valid JSON at {path}: {e}")
+        if not isinstance(raw, dict):
+            die(f"claude host credentials: {path} must contain a JSON object")
+    else:
+        raw = _read_keychain()
+        if raw is None:
+            die(
+                f"claude host credentials: auth file missing at {path} and "
+                f"macOS Keychain lookup for '{_KEYCHAIN_SERVICE}' failed. "
+                "Run `claude login` on the host or disable "
+                "agent_provider.forward_host_credentials."
+            )
+
+    oauth = raw.get("claudeAiOauth")
+    if not isinstance(oauth, dict):
+        die(
+            "claude host credentials: claudeAiOauth is missing from credentials. "
+            "Run `claude login` on the host or disable "
+            "agent_provider.forward_host_credentials."
+        )
+
+    access_token = oauth.get("accessToken")
+    if not isinstance(access_token, str) or not access_token:
+        die(
+            "claude host credentials: claudeAiOauth.accessToken is missing or empty. "
+            "Run `claude login` on the host and restart the bottle."
+        )
+
+    # expiresAt is in milliseconds
+    expires_at = oauth.get("expiresAt")
+    if isinstance(expires_at, (int, float)):
+        check_now = now or datetime.now(timezone.utc)
+        exp_dt = datetime.fromtimestamp(float(expires_at) / 1000.0, timezone.utc)
+        if exp_dt <= check_now:
+            die(
+                "claude host credentials: host Claude access token is expired. "
+                "Run `claude login` on the host and restart the bottle."
+            )
+
+    return access_token
+
+
+__all__ = [
+    "claude_auth_path",
+    "claude_host_access_token",
+]

bot_bottle/egress.py

@@ -30,6 +30,7 @@ if TYPE_CHECKING:
     from .manifest import ManifestBottle
 
 CODEX_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CODEX_HOST_ACCESS_TOKEN"
+CLAUDE_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN"
 
 EGRESS_HOSTNAME = "egress"
 
@@ -400,6 +401,7 @@ class Egress(ABC):
         )
 
 __all__ = [
+    "CLAUDE_HOST_CREDENTIAL_TOKEN_REF",
     "CODEX_HOST_CREDENTIAL_TOKEN_REF",
     "EGRESS_HOSTNAME",
     "EGRESS_ROUTES_FILENAME",

bot_bottle/manifest_agent.py

@@ -25,8 +25,9 @@ class ManifestAgentProvider:
     header, and sets a placeholder CLAUDE_CODE_OAUTH_TOKEN in the agent
     so the Claude Code CLI starts.
 
-    `forward_host_credentials` forwards the host Codex auth token into
-    the egress daemon (Codex only).
+    `forward_host_credentials` forwards the host provider auth token into
+    the egress sidecar (Codex and Claude). For Codex this reads
+    `~/.codex/auth.json`; for Claude it reads `~/.claude/.credentials.json`.
     """
 
     template: str = "claude"
@@ -92,10 +93,15 @@ class ManifestAgentProvider:
                 f"is only supported for built-in templates "
                 f"({', '.join(sorted(PROVIDER_TEMPLATES))})"
             )
-        if forward_host_credentials and template != "codex":
+        if forward_host_credentials and template not in {"codex", "claude"}:
             raise ManifestError(
                 f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
-                "is currently only supported for template 'codex'"
+                "is only supported for templates 'codex' and 'claude'"
+            )
+        if forward_host_credentials and auth_token:
+            raise ManifestError(
+                f"bottle '{bottle_name}' agent_provider.forward_host_credentials "
+                "and auth_token both set; use one or the other"
             )
         settings = _parse_provider_settings(bottle_name, template, d.get("settings"))
         return cls(

docs/prds/prd-new-claude-forward-host-credentials.md

@@ -0,0 +1,146 @@
+# PRD prd-new: Claude forward_host_credentials
+
+- **Status:** Draft
+- **Author:** claude
+- **Created:** 2026-07-01
+- **Issue:** #325
+
+## Summary
+
+Add `agent_provider.forward_host_credentials: true` support for the
+`claude` template, mirroring the existing Codex flow. When enabled,
+bot-bottle reads the host's Claude OAuth session key from
+`~/.claude/.credentials.json` at launch, forwards it only to the egress sidecar,
+and injects a placeholder `CLAUDE_CODE_OAUTH_TOKEN` into the agent so
+Claude Code starts without ever seeing the real credential.
+
+## Problem
+
+Running a Claude agent in a container today requires the operator to
+manually extract a long-lived OAuth token (`claude setup-token`), export
+it as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`, and reference it explicitly in
+the manifest with `agent_provider.auth_token:
+"BOT_BOTTLE_CLAUDE_OAUTH_TOKEN"`. This is a two-step manual ceremony
+that is easy to skip or do incorrectly.
+
+The host already stores a valid Claude session in `~/.claude/.credentials.json`
+after `claude login`. Codex already automates an
+equivalent extraction from `~/.codex/auth.json`. There is no reason
+Claude bottles cannot do the same.
+
+## Goals / Success Criteria
+
+- A Claude bottle with `forward_host_credentials: true` in the manifest
+  uses the host's `~/.claude/.credentials.json` session key at launch with no
+  additional operator steps.
+- The agent container receives only `CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder`
+  — never the real token.
+- The real session key lives only in the egress sidecar's environment.
+- Missing, malformed, or expired host Claude auth fails launch with a
+  clear operator-facing message.
+- Existing `auth_token` behavior is unchanged.
+- `forward_host_credentials: true` is rejected in the manifest when both
+  `auth_token` and `forward_host_credentials` are set, since they serve
+  the same purpose.
+
+## Non-goals
+
+- Refreshing Claude OAuth tokens in the sidecar.
+- Writing a dummy `~/.claude.json` auth state to the agent (unlike the
+  Codex flow, Claude Code reads its credential from `CLAUDE_CODE_OAUTH_TOKEN`
+  in env, not from an auth file — no guest-side auth marker is needed).
+- Supporting `forward_host_credentials` for providers other than `codex`
+  and `claude`.
+
+## Design
+
+### Manifest schema
+
+```yaml
+agent_provider:
+  template: claude
+  forward_host_credentials: true
+```
+
+Rejects in manifest validation when:
+- Template is not `codex` or `claude`.
+- Both `auth_token` and `forward_host_credentials` are set.
+
+### Host auth extraction (`contrib/claude/claude_auth.py`)
+
+Claude Code credential storage varies by platform:
+
+- **Linux**: `~/.claude/.credentials.json`
+- **macOS**: macOS Keychain, service `"Claude Code-credentials"`
+  (the file path is tried first; Keychain is the fallback when the file
+  is absent)
+
+`~/.claude.json` contains only UI state and profile metadata — no token.
+
+The credentials JSON schema (same whether from file or Keychain):
+
+```json
+{
+  "claudeAiOauth": {
+    "accessToken": "<access-token>",
+    "refreshToken": "<refresh-token>",
+    "expiresAt": 1748276587173,
+    "scopes": ["user:inference", "user:profile"]
+  }
+}
+```
+
+`expiresAt` is in **milliseconds** (not seconds).
+
+At prepare/launch time, when `forward_host_credentials: true`:
+
+1. Try `~/.claude/.credentials.json`; on macOS, if absent, run
+   `security find-generic-password -s "Claude Code-credentials" -w`
+   and parse its stdout as JSON.
+2. Require a `claudeAiOauth` dict.
+3. Require a non-empty `claudeAiOauth.accessToken` string.
+4. If `claudeAiOauth.expiresAt` is present, divide by 1000 and require
+   the result to be in the future.
+5. Return only the access token to the launch path.
+
+Errors name the missing or invalid condition and point the operator at
+`claude login`, without printing token values.
+
+### Egress route
+
+When `forward_host_credentials: true`:
+
+- Provision the session key in `provisioned_env` under
+  `BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN` (new constant in `egress.py`).
+- Set up the `api.anthropic.com` egress route with `auth_scheme: Bearer`
+  and `token_ref: BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN`.
+- Set `CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder` in the agent env and
+  add it to `hidden_env_names`.
+
+No dummy auth file and no `verify` step are needed — Claude Code reads
+the credential from the env var, not from a file.
+
+### Constants
+
+- `CLAUDE_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CLAUDE_HOST_ACCESS_TOKEN"`
+  in `egress.py` (alongside the existing `CODEX_HOST_CREDENTIAL_TOKEN_REF`).
+- `CLAUDE_HOST_CREDENTIAL_HOSTS = ("api.anthropic.com",)` in
+  `agent_provider.py` (alongside the existing `CODEX_HOST_CREDENTIAL_HOSTS`).
+
+### Data flow
+
+```
+Host ~/.claude/.credentials.json  →  bot-bottle launch
+                            │
+                            ├──► egress sidecar env (real token only)
+                            │
+                            └──► agent env: CLAUDE_CODE_OAUTH_TOKEN=egress-placeholder
+
+Agent  →  HTTPS to api.anthropic.com (via egress)
+Egress →  injects Authorization: Bearer <real token>
+Egress →  forwards to api.anthropic.com
+```
+
+## Open questions
+
+None — the Codex precedent makes the design clear.

docs/research/agent-sandbox-landscape.md

@@ -6,49 +6,27 @@ general AI-agent sandbox / containment projects — some Claude-specific,
 some agent-agnostic, some hosted SaaS — and contrasts them with
 bot-bottle's design.
 
-Research conducted 2026-05-11. CubeSandbox added 2026-07-18 (see its
-per-project note and the addendum at the end). Also updated 2026-07-18:
-bot-bottle no longer uses **pipelock** — outbound DLP is now bot-bottle's
-own (deliberately simple) egress scanner (a mitmproxy addon with custom
-detectors, PRD 0017 / 0053), and git-push secret scanning is handled by
-**gitleaks** in the git-gate. "pipelock" below has been replaced with the
-current mechanism; it survives only in older PRDs as history.
+Research conducted 2026-05-11.
 
 ## Summary
 
-Nine projects surveyed. None duplicate bot-bottle's combination of
-local VM-per-bottle isolation (Firecracker microVM on KVM Linux, Apple
-Container on macOS — Docker is now only the legacy fallback), a
-declarative JSON manifest, per-agent egress allowlist + outbound-content
-DLP via bot-bottle's own egress scanner (plus gitleaks secret-scanning on
-git push), and bottle/agent split. Two clusters stand out:
+Eight projects surveyed. None duplicate bot-bottle's combination of
+local Docker, declarative JSON manifest, per-agent egress allowlist via
+pipelock, and bottle/agent split. Two clusters stand out:
 
 - **Closest neighbours** — agent-safehouse and litterbox: local,
   single-user, thin wrappers over an existing OS primitive
   (`sandbox-exec`, Podman + Landlock).
 - **Different category** — tilde.run (hosted SaaS), boxlite and
-  microsandbox (microVM libraries for platform builders), CubeSandbox
-  (self-hosted multi-tenant microVM service), endo-familiar
+  microsandbox (microVM libraries for platform builders), endo-familiar
   (capability-security paradigm, no OS isolation).
 
-The microVM cluster (matchlock, smolmachines, boxlite, microsandbox,
-CubeSandbox) is the most relevant for the v2 isolation discussion in
+The microVM cluster (matchlock, smolmachines, boxlite, microsandbox) is
+the most relevant for the v2 isolation discussion in
 [`stronger-isolation-alternatives.md`](stronger-isolation-alternatives.md):
 libkrun and Apple's Virtualization.framework have made local microVMs
-ergonomic enough that microVMs are **now bot-bottle's default backend**
-(Firecracker on KVM Linux, Apple Container on macOS), with Docker kept
-only as a legacy fallback for CI / hosts without KVM or Apple Container.
-That discussion has since shipped, not just been theorized.
-
-**The one that matters most for positioning is CubeSandbox** — it is the
-first surveyed project to ship bot-bottle's would-be wedge (default-deny
-egress allowlist + full audit logs + in-flight credential custody so keys
-never enter the sandbox) *combined with* per-sandbox microVM isolation,
-open-source under Apache 2.0, with Tencent Cloud behind it and 10.4k
-stars. It's a self-hosted multi-tenant service for platform builders, not
-a single-user declarative tool, so it doesn't collide head-on — but it
-narrows the "nobody else bundles egress custody + credential injection"
-claim that the monetization positioning leans on. See the addendum.
+ergonomic enough that a `"runtime": "microvm"` option on a bottle is now
+plausible without a heavy stack.
 
 ## Per-project notes
 
@@ -177,105 +155,67 @@ claim that the monetization positioning leans on. See the addendum.
   also supported.
 - **Maturity**: Active through April 2026.
 
-### CubeSandbox *(added 2026-07-18)*
-- **Source**: https://github.com/TencentCloud/CubeSandbox ;
-  HN launch https://news.ycombinator.com/item?id=47863430
-- **License**: Apache 2.0 (~10.4k stars). By Tencent Cloud; described as
-  "battle-tested, production-ready" infra already running in Tencent
-  Cloud. Rust / Go / C.
-- **Isolation**: MicroVMs via RustVMM + KVM — "each sandbox gets its own
-  Guest OS kernel, no Docker shared-kernel escapes." Hardware-level
-  isolation, dedicated kernel per instance.
-- **Locality**: Self-hosted, but **server/cluster-oriented**, not a
-  single-user local CLI. Deploy guides target PVM cloud VMs, bare metal,
-  and dev. A single 96-vCPU host is claimed to run 2,000+ concurrent
-  sandboxes.
-- **Agent integration**: **Drop-in E2B SDK replacement** (single env-var
-  change) — the headline compatibility claim. OpenClaw assistant
-  integration; general LLM-code execution. Aimed at platform builders,
-  not one developer's laptop.
-- **Config**: Programmatic via the E2B-compatible SDK. No declarative
-  manifest.
-- **Network policy**: This is the striking part — **domain allowlists,
-  instant block on unauthorized egress, full audit logs, per-sandbox
-  traffic tokens, policy-routing egress**, enforced by an eBPF-based
-  virtual switch giving kernel-level network isolation. Closest match yet
-  to bot-bottle's own default-deny + per-bottle allowlist egress model.
-- **Credentials**: **Credential vault** — agents call external APIs / LLMs
-  while "keys never enter the sandbox, model context, or logs." Same
-  in-flight-injection idea as matchlock, but productized as a vault.
-- **Performance**: <60ms cold start (claimed 2.5–50× faster than
-  alternatives), <5MB memory per instance; millisecond snapshot rollback
-  is upcoming.
-- **Maturity**: Open-sourced July 2026 off production Tencent Cloud use;
-  most-starred project in this set (~10.4k).
-
 ## Comparison table
 
-| Axis | bot-bottle | endo-familiar | litterbox | agent-safehouse | matchlock | tilde.run | boxlite | microsandbox | smolmachines | CubeSandbox |
-|---|---|---|---|---|---|---|---|---|---|---|
-| Isolation | MicroVM per bottle default (Firecracker/KVM on Linux, Apple Container on macOS) + own egress DLP scanner; Docker legacy fallback, gVisor there if present | Object-capability (no OS isolation) | Podman + opt. Landlock | macOS `sandbox-exec` | MicroVM (Firecracker / Virt.fw) | Hosted container (unverified) | MicroVM (KVM / Hypervisor.fw) | MicroVM (libkrun) | MicroVM (libkrun / KVM) | MicroVM (RustVMM / KVM) |
-| Local vs hosted | Local | Local | Local (Linux) | Local (macOS) | Local | Hosted SaaS | Local | Local | Local | Self-hosted (server/cluster) |
-| Open source | Apache 2.0 | Apache 2.0 | Apache 2.0 | Apache 2.0 | MIT | No | Apache 2.0 | Apache 2.0 | Apache 2.0 | Apache 2.0 |
-| Agent target | Claude Code | Generic (demo) | Generic | Multi-agent wrapper | Generic (+ Claude/OpenAI SDKs) | Claude focus | Generic | Claude + Cursor (MCP/Skills) | Generic (AGENTS.md) | E2B-compatible (platform builders) |
-| Network policy | Default-deny via own egress scanner + per-bottle allowlist + content DLP + gitleaks on git push | Capability model only | Limited | Not addressed | Default-deny + allowlist + secret-injecting proxy | Default-deny + logging | Per-VM net (unverified) | Not documented | Off by default + allowlist | Default-deny allowlist + instant egress block + audit logs + per-sandbox tokens (eBPF) + credential vault |
-| Parallel agents | Yes (one bottle per agent) | n/a | Not addressed | One at a time | Multiple VMs | Yes (dashboard) | SDK-level | SDK-level | Architectural | Yes (2,000+/host claimed) |
-| Long-running posture | Persistent by default (named, supervised) | n/a (demo) | Session (up while in use) | Per-invocation | Ephemeral VM per run | Per-run (versioned) | Ephemeral + snapshot/fork | Ephemeral / on-demand | Named persistent by default | Ephemeral + auto pause/resume |
-| DX: run Claude yolo-style | One command → interactive yolo Claude (`start <agent>`, `--dangerously-skip-permissions` default) | n/a (lib demo) | Wizard + build, then run claude inside (Linux only) | One-command wrapper (`safehouse claude --dangerously-skip-permissions`) | CLI: run a cmd in a VM (not a Claude wrapper) | Hosted (`tilde exec`), not local-native | SDK code required (build the run yourself) | CLI/MCP: sandbox-as-a-tool for the agent, not a wrapper around it | SSH into a named machine, run claude there | Stand up a cluster + drive via E2B SDK |
-| Config | JSON manifest (bottles + agents) | Programmatic refs | CLI wizard | Profile files / shell fns | CLI / SDK | DSL + CLI + SDK | SDK | CLI / SDK / MCP | TOML Smolfile | E2B-compatible SDK |
-| Maturity | Active May 2026 | Research (2022+) | Early (~66 ⭐) | Active (~1.4k ⭐) | Experimental (~574 ⭐) | Private preview | YC, ~4.7k ⭐ | YC, ~6k ⭐, beta | ~3.1k ⭐ | Tencent, prod, ~10.4k ⭐ |
+| Axis | bot-bottle | endo-familiar | litterbox | agent-safehouse | matchlock | tilde.run | boxlite | microsandbox | smolmachines |
+|---|---|---|---|---|---|---|---|---|---|
+| Isolation | Docker + internal net + pipelock; gVisor if present | Object-capability (no OS isolation) | Podman + opt. Landlock | macOS `sandbox-exec` | MicroVM (Firecracker / Virt.fw) | Hosted container (unverified) | MicroVM (KVM / Hypervisor.fw) | MicroVM (libkrun) | MicroVM (libkrun / KVM) |
+| Local vs hosted | Local | Local | Local (Linux) | Local (macOS) | Local | Hosted SaaS | Local | Local | Local |
+| Open source | Apache 2.0 | Apache 2.0 | Apache 2.0 | Apache 2.0 | MIT | No | Apache 2.0 | Apache 2.0 | Apache 2.0 |
+| Agent target | Claude Code | Generic (demo) | Generic | Multi-agent wrapper | Generic (+ Claude/OpenAI SDKs) | Claude focus | Generic | Claude + Cursor (MCP/Skills) | Generic (AGENTS.md) |
+| Network policy | Default-deny via pipelock + per-bottle allowlist + DLP | Capability model only | Limited | Not addressed | Default-deny + allowlist + secret-injecting proxy | Default-deny + logging | Per-VM net (unverified) | Not documented | Off by default + allowlist |
+| Parallel agents | Yes (one bottle per agent) | n/a | Not addressed | One at a time | Multiple VMs | Yes (dashboard) | SDK-level | SDK-level | Architectural |
+| Config | JSON manifest (bottles + agents) | Programmatic refs | CLI wizard | Profile files / shell fns | CLI / SDK | DSL + CLI + SDK | SDK | CLI / SDK / MCP | TOML Smolfile |
+| Maturity | Active May 2026 | Research (2022+) | Early (~66 ⭐) | Active (~1.4k ⭐) | Experimental (~574 ⭐) | Private preview | YC, ~4.7k ⭐ | YC, ~6k ⭐, beta | ~3.1k ⭐ |
 
 ## What's closest, what's different
 
 **Closest in design and scope.** agent-safehouse and litterbox sit
 nearest bot-bottle: local, single-user, thin wrappers over an
 existing OS primitive, low-dep. The split is the isolation primitive —
-bot-bottle now defaults to a VM per bottle (Firecracker microVM on KVM
-Linux, Apple Container on macOS) with its own DLP-scanning egress proxy,
-keeping Docker only as a legacy fallback; agent-safehouse uses
-`sandbox-exec`; litterbox
-uses Podman + Landlock. matchlock and smolmachines are close on *both* the
-policy side (default-deny net, per-host allowlist) and — now that
-bot-bottle has moved off containers-by-default — the microVM isolation
-primitive.
+bot-bottle uses Docker + pipelock egress (plus gVisor where
+available); agent-safehouse uses `sandbox-exec`; litterbox uses Podman +
+Landlock. matchlock and smolmachines are spiritually close on the
+*policy* side (default-deny net, per-host allowlist) but use microVMs
+instead of containers.
 
 **Solving a different problem.** tilde.run is hosted SaaS for team /
 production agent pipelines with data-versioned rollback — explicitly
-opposite to bot-bottle's "infrastructure I control" goal. boxlite,
-microsandbox, and CubeSandbox are infrastructure libraries/services aimed
-at platform builders embedding sandboxes into agent frameworks; they
-would be a *backend* bot-bottle could call, not a competitor to its
-manifest layer. endo-familiar is in a different paradigm entirely:
-capability passing rather than kernel boundaries.
+opposite to bot-bottle's "infrastructure I control" goal. boxlite and
+microsandbox are infrastructure libraries aimed at platform builders
+embedding sandboxes into agent frameworks; they would be a *backend*
+bot-bottle could call, not a competitor to its manifest layer.
+endo-familiar is in a different paradigm entirely: capability passing
+rather than kernel boundaries.
 
 ## Borrowable ideas
 
 What bot-bottle already has that the survey suggested as
 differentiators:
-- Default-deny egress with a per-agent allowlist (own egress scanner).
+- Default-deny egress with a per-agent allowlist (pipelock).
 - DLP scanning of outbound traffic.
 - Bottle / agent split (manifest layer above the isolation primitive).
 - gVisor auto-detection on Linux.
 
-Ideas worth considering, without abandoning the Python-stdlib-first /
-local, single-operator stance:
+Ideas worth considering, without abandoning the Python-stdlib-first / local-Docker
+stance:
 
 1. **Per-use SSH key confirmation** (from litterbox). Even with
-   KnownHostKey pinning and the egress DLP scanner, a wrapper SSH agent that
+   KnownHostKey pinning and pipelock egress, a wrapper SSH agent that
    prompts on each key use (e.g. via `osascript` / `notify-send`) would
    catch an agent doing something off-policy with a key it legitimately
    holds. Pure-stdlib, no new deps.
-2. **In-flight secret injection** (from matchlock). The egress scanner
-   already does allowlisting and DLP; teaching it to *inject* tokens at
+2. **In-flight secret injection** (from matchlock). Pipelock already
+   does egress allowlisting and DLP; teaching it to *inject* tokens at
    proxy time so e.g. `GITEA_TOKEN` never appears in the container's
    env would close the "agent reads its own env and exfiltrates" path.
-   Fits the existing egress-proxy architecture.
-3. **MicroVM backend** — ~~on the radar~~ **shipped since this survey.**
-   microVMs are now bot-bottle's default (Firecracker on KVM Linux, Apple
-   Container on macOS); Docker is the legacy fallback. The libkrun / Apple
-   Virtualization.framework ergonomics that microsandbox, smolmachines,
-   and matchlock demonstrated turned out to be enough to make it the
-   default rather than an opt-in.
+   Fits the existing pipelock architecture.
+3. **MicroVM backend as an opt-in bottle type** — already on the radar
+   in `stronger-isolation-alternatives.md`. microsandbox, smolmachines,
+   and matchlock all show that libkrun + Apple's
+   Virtualization.framework is ergonomic enough that a
+   `"runtime": "microvm"` field on a bottle is plausible without a heavy
+   stack.
 
 Not worth borrowing: the SDK-first programmatic API style of boxlite /
 microsandbox (cuts against the declarative-manifest stance), and the
@@ -290,122 +230,3 @@ hosted-SaaS dashboard model of tilde.run (cuts against the
 - The `superradcompany/microsandbox` URL in the original prompt
   redirects to `microsandbox/microsandbox`; the surveyed project is the
   same.
-- CubeSandbox performance/scale numbers (<60ms cold start, <5MB/instance,
-  2,000+ sandboxes per 96-vCPU host) are the project's own launch claims,
-  not independently verified here.
-
-## Addendum 2026-07-18 — CubeSandbox and the positioning read
-
-CubeSandbox (Tencent Cloud, Apache 2.0, ~10.4k stars, HN launch
-[#47863430](https://news.ycombinator.com/item?id=47863430)) is the first
-project in this survey to combine, in one open-source stack, everything
-bot-bottle treated as its differentiator:
-
-- **Egress custody (connection level)** — default-deny domain allowlist
-  (L7 domain/SNI filtering), instant block on unauthorized egress,
-  per-sandbox traffic tokens, full audit logs of destinations (eBPF
-  virtual switch, "CubeVS"). This matches bot-bottle's egress scanner at
-  the *connection level*, productized — see the one thing it does **not**
-  match, below.
-- **Credential custody** — a vault where keys "never enter the sandbox,
-  model context, or logs." This is the in-flight-injection idea from
-  matchlock, but as a first-class feature, and it's exactly the
-  cross-vendor "egress audit + custody" wedge the monetization
-  positioning treats as the one defensible moat.
-- **Isolation on par with bot-bottle's current default** — a dedicated
-  guest kernel per sandbox (RustVMM/KVM). bot-bottle now defaults to the
-  same class of boundary (Firecracker microVM / Apple Container), so this
-  is parity, not an edge; CubeSandbox's remaining edge is running that
-  per-kernel isolation multi-tenant at scale on one host.
-
-The one axis CubeSandbox does **not** cover — and where bot-bottle stays
-distinctive:
-
-- **Content DLP on *authorized* channels.** CubeSandbox's egress control
-  is connection-level: it decides *whether* a destination is allowed and
-  logs it, and its vault keeps *injected* credentials out of the sandbox
-  entirely. Neither inspects the *payload* of traffic to an allowed
-  destination. So an agent that exfiltrates over a permitted channel —
-  pasting a repo's contents, an agent-derived secret, or PHI into an
-  allowed API/domain — is not caught by CubeSandbox. bot-bottle's own
-  egress DLP scanner does scan that: response + websocket content against
-  the resolved per-flow config, with per-bottle token redaction (see
-  recent egress commits). The vault
-  approach is arguably *stronger* for the specific case of pre-known
-  injected credentials (they can't leak if they were never present), but
-  it is not a substitute for content inspection of everything else.
-
-**Long-running posture — a sharper axis than raw isolation.** E2B and
-CubeSandbox are *ephemeral-per-task* by design; a long-running agent is an
-architected pattern on top, not the default. E2B: 5-minute default
-timeout, continuous runtime tier-capped (~1h Hobby / ~24h Pro), duration
-achieved via **pause/resume** (preserves filesystem + memory + processes;
-reconnect by sandbox ID via `Sandbox.connect()`; resume resets the timeout
-to 5 min; auto-pause via `on_timeout: "pause"`). CubeSandbox mirrors this
-(E2B drop-in) with first-class auto pause/resume and hundred-ms
-checkpoint/fork — and, self-hosted, sets its own timeout policy with no
-vendor tier caps. bot-bottle inverts the model: a bottle is **persistent,
-named, and supervised by default** — long-running *is* the default, not a
-session-management loop over pause/resume. smolmachines is the other
-persistent-by-default project in this set. For anyone building agents that
-run for hours/days, this posture difference matters more than the
-isolation primitive.
-
-**DX — the "run Claude yolo-style" bar.** The reason `claude
---dangerously-skip-permissions` is so widely used is DX: it's one command
-and the agent just goes. The bottle thesis is to make a *sandboxed* run
-that easy — `start <agent>` builds the image on first run and drops you
-into an interactive Claude session that already has
-`--dangerously-skip-permissions` on by default
-(`contrib/claude/agent_provider.py`), with the sandbox as the guardrail
-instead of per-action prompts. On this axis the field splits cleanly:
-- **Wrappers around the agent** (as-easy-as-native): bot-bottle and
-  **agent-safehouse** (`safehouse claude --dangerously-skip-permissions`).
-  These *are* the run-Claude experience. agent-safehouse is the real DX
-  peer — but it's macOS-only Seatbelt, single-run, and doesn't address
-  network egress; bot-bottle adds VM-grade isolation, egress DLP, and
-  persistent/parallel bottles across macOS + Linux.
-- **Libraries / services** (you build the run yourself): boxlite,
-  microsandbox, CubeSandbox, E2B. These hand you an SDK or a cluster and
-  expect you to wire the agent in — powerful for platform builders,
-  heavyweight for "just run Claude on my laptop." microsandbox's MCP/Skills
-  angle is *sandbox-as-a-tool the agent calls*, which is the inverse of
-  wrapping the agent.
-- **In between:** litterbox (wizard + build, Linux only), smolmachines
-  (SSH into a named machine), matchlock (run a command in a VM).
-
-So DX is a genuine bot-bottle differentiator, and the only project that
-matches it (agent-safehouse) does so with materially weaker isolation and
-no egress story. "As easy as native yolo, but actually sandboxed" is a
-defensible one-liner.
-
-Why it still doesn't collide head-on:
-
-1. **Shape.** CubeSandbox is a *multi-tenant service for platform
-   builders* (drop-in E2B replacement, SDK-driven, 2,000 sandboxes on a
-   box). bot-bottle is a *single-operator, declarative-manifest tool for
-   the infrastructure I run*. Different buyer, different ergonomics — no
-   JSON manifest, no bottle/agent split, no "one command on my laptop."
-2. **Backend, not competitor.** Like boxlite/microsandbox, CubeSandbox is
-   something bot-bottle could sit *on top of* — a `"runtime": "microvm"`
-   or `"runtime": "cubesandbox"` backend under the manifest layer — while
-   keeping the manifest, the bottle/agent split, and the local,
-   single-operator default.
-
-Why it matters anyway:
-
-- The "nobody else bundles connection-level egress allowlist + audit +
-  in-flight credential custody" line is **no longer true for the
-  primitive** — a well-funded, 10k-star open-source project now ships it.
-  But **content DLP on authorized channels is still not matched** (see
-  above), and neither is the *layer above* the primitive (declarative
-  manifest, cross-vendor orchestration, operator UX, the
-  phone-control/dashboard north star). Those two — outbound-payload DLP
-  and the orchestration layer — are where the defensible ground now sits;
-  the connection-level allowlist + vault mechanism, on its own, is no
-  longer differentiating. Revisit the monetization open/paid line with
-  that in mind.
-- Worth a closer look at **how** CubeSandbox does credential injection
-  and per-sandbox egress tokens (eBPF virtual switch vs. bot-bottle's
-  mitmproxy egress proxy) before the next iteration of bot-bottle's
-  in-flight-secret feature — see borrowable idea #2 above.

docs/research/malicious-commit-scanning.md

@@ -1,204 +0,0 @@
-# Scanning for malicious commits at the git-gate — and whether the semantic layer is a paid feature
-
-A sandboxed agent's most durable way out isn't live exfiltration — it's the
-**artifact it pushes**. Code committed through the git-gate leaves the
-sandbox and runs *later*, in CI or production, with none of the bottle's
-isolation or egress control. gitleaks covers *secrets* on that channel
-(see [`git-gate` pre-receive](../../bot_bottle/git_gate_render.py)); this
-note asks the harder question — can we scan for *malicious code* in
-commits — and the product question the answer raises: is the semantic
-(LLM) layer a decent paid feature on "git egress," alongside a paid
-human-review console for the supervise flow?
-
-## Summary
-
-- **No scanner reliably detects malicious code.** It's undecidable in
-  general and adversarial in practice — a capable agent hides a backdoor
-  from any pattern scanner (and from human reviewers). So the frame is not
-  "detect malice"; it's **raise the cost, cover the common/obvious cases,
-  and put a human on the high-leverage ones.**
-- **Layered, ranked by ROI:** (1) supply-chain / malicious-dependency
-  scanning (Socket, OSV-Scanner, GuardDog) — highest ROI, best git fit;
-  (2) fast heuristic / obfuscation / dangerous-sink scanning
-  (Semgrep-on-diff) — gitleaks-shaped; (3) **risk-based human gating** via
-  the existing supervise plane on high-risk file classes; (4) **LLM
-  semantic diff-review** as a best-effort backstop for novel backdoors.
-- **Architecture:** the git-gate's `pre-receive` is *synchronous* (it
-  blocks the push), so run only fast scanners inline and push heavy
-  analysis (CodeQL, full LLM review) to an **async post-push CI lane** that
-  can't hold the developer hostage.
-- **Monetization verdict: yes — but the paid unit is the *governed
-  git-egress review bundle*, not the raw scanner.** The pre-receive
-  mechanics and the fast OSS scanners stay free (open-core social
-  contract, same as gitleaks). The sell is the control-plane workflow
-  around them: **managed semantic review + a web-console human-review flow
-  + RBAC + audit retention + cross-run policy.** A bare per-push scan is
-  borderline "single-run = free" by our own heuristic, and its detection
-  accuracy is not something to sell on. Sell the *workflow and the
-  governance*, not the detector.
-
-## The threat: temporal escape
-
-This is the one containment fundamentally can't close. bot-bottle's VM
-isolation + egress DLP shrink *live* exfiltration, but the git push
-channel launders a payload past all of it: the agent commits code that
-looks benign at review time and does its work later, outside the
-perimeter — the "blind-XSS"-style temporal escape that both the "3 reasons
-sandboxing won't secure your AI agent" talk and Embroidery's "In sandboxes
-we (shouldn't) trust" call the sharpest gap. gitleaks gates *secrets* on
-this channel; malicious *code* is the uncovered surface, and it's the
-behavioral half of the isolation-vs-behavioral split noted in
-[`agent-sandbox-landscape.md`](agent-sandbox-landscape.md).
-
-## Why it's fundamentally hard
-
-Distinguishing malicious from legitimate code is undecidable in general
-and adversarial in the specific. The underhanded-code contests show humans
-hide backdoors from *human reviewers*; a scanner reduces to regex/dataflow
-heuristics a motivated agent writes around. So "catch malicious commits"
-is the wrong success metric. The right ones: *how much did we raise the
-cost*, *did we cover the common and the obvious*, and *did a human see the
-dangerous changes before they left*.
-
-## Landscape of git-pluggable approaches (ranked by ROI)
-
-1. **Supply-chain / malicious-dependency scanning — highest ROI.** The
-   most likely agent-introduced threat is a malicious or typosquatted
-   *dependency*, not a hand-written backdoor — and it's far more
-   detectable. **Socket** (behavioral analysis of packages: install
-   scripts, obfuscation, unexpected network/fs access, typosquats) is the
-   closest thing to malicious-intent detection that actually works;
-   **OSV-Scanner** (known-bad DB, fast) and **GuardDog** (PyPI/npm
-   heuristics) complement it. Trigger only when a commit changes a
-   lockfile/manifest → block or escalate.
-2. **Fast heuristic / obfuscation / dangerous-sink scanning.** **Semgrep**
-   with a curated ruleset, scanning the *diff* (fast enough for
-   pre-receive). Catches obfuscation (`eval(atob(...))`, base64/hex blobs,
-   minified source), exfil primitives (`curl | sh`, reverse shells,
-   DNS-exfil), and dangerous sinks (`shell=True`, `pickle.loads`, unsafe
-   `yaml.load`, `child_process.exec`). Tune noisy rules to *escalate*, not
-   block.
-3. **Risk-based human gating — the most robust control, already
-   half-built.** The git-gate already escalates `# gitleaks:allow`
-   findings to a supervisor proposal and blocks the push pending approval
-   (`supervise_gitleaks_allow`, [`git_gate_render.py`](../../bot_bottle/git_gate_render.py)).
-   Extend the same flow to **high-risk file classes**: any commit touching
-   CI/build/deploy scripts, auth/crypto code, egress config, or
-   adding/changing dependencies → route to `./cli.py supervise`. This is
-   attribution/policy, not detection, and it's the strongest thing here —
-   a human on exactly the temporal-escape surfaces.
-4. **LLM semantic diff-review — the behavioral backstop.** The only
-   approach with a shot at a novel, benign-looking backdoor: a model
-   reviews the diff for a backdoor / exfiltration / obfuscated payload /
-   dangerous behavior. This is the behavioral-detection thesis applied to
-   the *artifact* (the diff) rather than the agent's reasoning. Real
-   caveats: false positives and negatives, latency/cost, it can be
-   prompt-injected by hostile content *in the diff itself*, and it invites
-   over-trust. Useful, never a guarantee.
-
-**Not for this job:** CodeQL, Trivy, Grype, Bandit. They find *known
-vulns and insecure patterns* (bugs), not deliberate backdoors, and the
-powerful ones (CodeQL taint) need a build + database — too heavy for a
-synchronous gate. They belong in the async CI lane if at all.
-
-## Fit into bot-bottle's git-gate
-
-The `pre-receive` hook today is: gitleaks-scan each ref → escalate
-`# gitleaks:allow` findings to supervise → forward to upstream
-([`git_gate_render.py`](../../bot_bottle/git_gate_render.py)). The
-additions slot in cleanly:
-
-- **Inline (fast), before forward:** a dep-scan phase (on manifest/lockfile
-  change) and a Semgrep-diff phase. Findings block or open a supervise
-  proposal, same shape as gitleaks.
-- **New supervise tool types** alongside the existing
-  `egress-block/allow`, `gitleaks-allow`, `egress-token-allow`
-  ([`supervise_types.py`](../../bot_bottle/supervise_types.py)) — e.g. a
-  `commit-review` proposal for risky-file-class gating and for semantic
-  review. The supervise plane is already the right abstraction; this is
-  another *producer* feeding it, and [`supervise_server.py`](../../bot_bottle/supervise_server.py)
-  (JSON-RPC) is already the console backend.
-- **Async lane (heavy):** full LLM review + any CodeQL run out of band
-  after the push, feeding the same review/audit surface, so the
-  synchronous gate stays fast.
-
-## The product question: paid feature on git egress?
-
-Restating the open-core line bot-bottle runs on: *give away the
-sandbox/runtime, charge for the control plane; single-run/single-node =
-free, cross-run aggregation + central enforcement + identity/fleet = paid;
-the moat is uniform egress audit + secret custody + policy across
-untrusted agents.*
-
-Against that line, the split is clean:
-
-**Free (OSS runtime — the trust funnel):**
-- the `pre-receive` gate mechanics and gitleaks;
-- wiring the OSS scanners (Socket CLI / OSV-Scanner / Semgrep);
-- the CLI supervise flow.
-Keeping the raw scanners free is the same social contract as gitleaks and
-preserves the bottom-up distribution funnel.
-
-**Paid (the governed git-egress bundle — the control plane):**
-- **Managed semantic diff-review** — hosted inference + a curated,
-  maintained malicious-pattern/policy set. This is *capability* (metered),
-  not *insurance* — the thing individuals actually pay for. Position it as
-  **governed code-egress review**, not "we resell inference" (the
-  monetization notes explicitly warn against reselling compute).
-- **The web-console supervise/review flow — the strongest anchor.** Turn
-  the CLI `./cli.py supervise` approval into a real review surface:
-  rendered diff + finding context, approve/reject, **who-approved audit
-  trail, RBAC on approvers, mobile/phone-control** (ties to the
-  dashboard/vault north star). This is "central enforcement +
-  identity/fleet = paid" almost verbatim — and it generalizes across
-  *every* supervise proposal (egress block/allow, gitleaks-allow,
-  commit-review), so it's worth building for the whole plane, with the
-  semantic check as one producer.
-- **Cross-run governance:** fleet-wide policy for what escalates,
-  review-decision history/search/export, and drift alerts.
-
-**Why it fits the moat rather than bolting on:** a git push *is* an egress
-channel. A semantic review + human approval + audit on it extends the
-uniform "egress audit + custody + policy across untrusted agents" wedge to
-**code artifacts** — the same product, applied to the one channel gitleaks
-only half-covers. That's on-moat, not a detour.
-
-**The honest nuance (don't oversell):** a bare per-push LLM scan is
-arguably *free* by the single-run heuristic, and its detection accuracy is
-not defensible to charge for. The paid value is the **governance around
-it** — the console, RBAC, audit retention, cross-run policy — plus the
-managed capability. Sell the *review-and-approve-and-audit workflow*; let
-the detector be explicitly best-effort. And per the monetization
-guardrail, the "anti-corporate" free crowd must not veto these team
-features: the review console + RBAC + audit *are* the monetization.
-
-## Recommendation
-
-1. **Land the free layer first.** Add the dep-scan and Semgrep-diff phases
-   to `pre-receive`, and extend supervise to risky-file-class gating —
-   reuses existing machinery, immediate value, stays OSS.
-2. **Build the supervise web console** over `supervise_server`'s JSON-RPC
-   (already the Phase-1 move in the monetization path). This is the paid
-   anchor and it serves *all* proposal types, not just commit review.
-3. **Add managed semantic diff-review as a paid producer** feeding that
-   console — "governed code-egress review," metered, explicitly
-   best-effort on detection.
-4. **Don't oversell detection.** Market the workflow (review + approve +
-   audit) and the cross-run policy/RBAC, where the value is real and
-   defensible; keep the raw scanners open.
-
-## Sources / references
-
-- [`agent-sandbox-landscape.md`](agent-sandbox-landscape.md) — the
-  egress-DLP gap and isolation-vs-behavioral framing.
-- Git-gate internals: [`git_gate_render.py`](../../bot_bottle/git_gate_render.py),
-  [`supervise_types.py`](../../bot_bottle/supervise_types.py),
-  [`supervise_server.py`](../../bot_bottle/supervise_server.py).
-- External tools: Socket (socket.dev), OSV-Scanner (google/osv-scanner),
-  GuardDog (DataDog/guarddog), Semgrep (semgrep/semgrep).
-- Threat framing: "3 reasons sandboxing won't secure your AI agent"
-  (youtube TsYDazwHJ6U); Embroidery, "In sandboxes we (shouldn't) trust."
-- The authoritative monetization/positioning analysis (the open-core line,
-  the wedge, single-run-free/cross-run-paid) lives in the **separate
-  `bot-bottle-console` repo**, not this one — cited here from memory, not
-  linked.

tests/unit/test_agent_provider.py

@@ -9,11 +9,15 @@ import unittest
 from pathlib import Path
 
 from bot_bottle.agent_provider import (
+    CLAUDE_HOST_CREDENTIAL_HOSTS,
     CODEX_HOST_CREDENTIAL_HOSTS,
     build_agent_provision_plan,
     prompt_args,
 )
-from bot_bottle.egress import CODEX_HOST_CREDENTIAL_TOKEN_REF
+from bot_bottle.egress import (
+    CLAUDE_HOST_CREDENTIAL_TOKEN_REF,
+    CODEX_HOST_CREDENTIAL_TOKEN_REF,
+)
 
 
 def _jwt(exp: int) -> str:
@@ -292,6 +296,67 @@ class TestAgentProviderRuntime(unittest.TestCase):
             )
         self.assertEqual({}, plan.provisioned_env)
 
+    def test_claude_forward_host_credentials_populates_egress_route(self):
+        access_token = "sk-ant-oat01-test-key"  # gitleaks:allow
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            home = Path(tmp) / "host-claude"
+            cred_dir = home / ".claude"
+            cred_dir.mkdir(parents=True)
+            (cred_dir / ".credentials.json").write_text(json.dumps({
+                "claudeAiOauth": {"accessToken": access_token},
+            }))
+            plan = build_agent_provision_plan(
+                template="claude",
+                dockerfile="",
+                state_dir=Path(tmp),
+                instance_name="bot-bottle-test",
+                prompt_file=Path(tmp) / "prompt.txt",
+                forward_host_credentials=True,
+                host_env={"HOME": str(home)},
+            )
+        self.assertEqual(1, len(plan.egress_routes))
+        route = plan.egress_routes[0]
+        self.assertIn(route.host, CLAUDE_HOST_CREDENTIAL_HOSTS)
+        self.assertEqual("Bearer", route.auth_scheme)
+        self.assertEqual(CLAUDE_HOST_CREDENTIAL_TOKEN_REF, route.token_ref)
+        self.assertEqual("egress-placeholder", plan.env_vars["CLAUDE_CODE_OAUTH_TOKEN"])
+        self.assertEqual(frozenset({"CLAUDE_CODE_OAUTH_TOKEN"}), plan.hidden_env_names)
+
+    def test_claude_forward_host_credentials_populates_provisioned_env(self):
+        access_token = "sk-ant-oat01-test-key"  # gitleaks:allow
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            home = Path(tmp) / "host-claude"
+            cred_dir = home / ".claude"
+            cred_dir.mkdir(parents=True)
+            (cred_dir / ".credentials.json").write_text(json.dumps({
+                "claudeAiOauth": {"accessToken": access_token},
+            }))
+            plan = build_agent_provision_plan(
+                template="claude",
+                dockerfile="",
+                state_dir=Path(tmp),
+                instance_name="bot-bottle-test",
+                prompt_file=Path(tmp) / "prompt.txt",
+                forward_host_credentials=True,
+                host_env={"HOME": str(home)},
+            )
+        self.assertEqual(
+            {CLAUDE_HOST_CREDENTIAL_TOKEN_REF: access_token},
+            plan.provisioned_env,
+        )
+
+    def test_claude_without_forward_host_credentials_has_empty_provisioned_env(self):
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            plan = build_agent_provision_plan(
+                template="claude",
+                dockerfile="",
+                state_dir=Path(tmp),
+                instance_name="bot-bottle-test",
+                prompt_file=Path(tmp) / "prompt.txt",
+                forward_host_credentials=False,
+            )
+        self.assertEqual({}, plan.provisioned_env)
+
     def test_pi_plan_writes_default_ollama_models(self):
         with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
             plan = build_agent_provision_plan(

tests/unit/test_contrib_claude_auth.py

@@ -0,0 +1,186 @@
+"""Unit: host Claude auth extraction."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+import unittest
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from bot_bottle.contrib.claude.claude_auth import (
+    claude_auth_path,
+    claude_host_access_token,
+)
+from bot_bottle.log import Die
+
+
+def _cred_json(access_token: str, **extra: object) -> str:
+    payload: dict[str, object] = {"claudeAiOauth": {"accessToken": access_token, **extra}}
+    return json.dumps(payload)
+
+
+class TestClaudeHostAccessToken(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory(prefix="bb-claude-auth.")
+        self.home = Path(self.tmp.name)
+        self.cred_dir = self.home / ".claude"
+        self.cred_dir.mkdir()
+        self.auth_path = self.cred_dir / ".credentials.json"
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def _write(self, payload: dict) -> None:  # type: ignore[no-untyped-def]
+        self.auth_path.write_text(json.dumps(payload))
+
+    def test_auth_path_uses_home_env(self):
+        self.assertEqual(
+            self.auth_path,
+            claude_auth_path({"HOME": str(self.home)}),
+        )
+
+    # --- file-based (Linux) ---
+
+    def test_file_returns_access_token(self):
+        key = "sk-ant-oat01-real-key"  # gitleaks:allow
+        self._write({"claudeAiOauth": {"accessToken": key}})
+        out = claude_host_access_token({"HOME": str(self.home)})
+        self.assertEqual(key, out)
+
+    def test_file_missing_claude_ai_oauth_dies(self):
+        self._write({"hasCompletedOnboarding": True})
+        with self.assertRaises(Die):
+            claude_host_access_token({"HOME": str(self.home)})
+
+    def test_file_missing_access_token_dies(self):
+        self._write({"claudeAiOauth": {"expiresAt": 2000000000000}})
+        with self.assertRaises(Die):
+            claude_host_access_token({"HOME": str(self.home)})
+
+    def test_file_empty_access_token_dies(self):
+        self._write({"claudeAiOauth": {"accessToken": ""}})
+        with self.assertRaises(Die):
+            claude_host_access_token({"HOME": str(self.home)})
+
+    def test_file_expired_token_dies(self):
+        # expiresAt is milliseconds; 1_000_000 ms is year 1970
+        self._write({
+            "claudeAiOauth": {"accessToken": "sk-ant-oat01-x", "expiresAt": 1_000_000},  # gitleaks:allow
+        })
+        with self.assertRaises(Die):
+            claude_host_access_token(
+                {"HOME": str(self.home)},
+                now=datetime(2026, 1, 1, tzinfo=timezone.utc),
+            )
+
+    def test_file_future_expiry_is_accepted(self):
+        key = "sk-ant-oat01-y"  # gitleaks:allow
+        # 2_000_000_000_000 ms ≈ year 2033
+        self._write({
+            "claudeAiOauth": {"accessToken": key, "expiresAt": 2_000_000_000_000},
+        })
+        out = claude_host_access_token(
+            {"HOME": str(self.home)},
+            now=datetime(2026, 1, 1, tzinfo=timezone.utc),
+        )
+        self.assertEqual(key, out)
+
+    def test_file_absent_expiry_is_accepted(self):
+        key = "sk-ant-oat01-z"  # gitleaks:allow
+        self._write({"claudeAiOauth": {"accessToken": key}})
+        out = claude_host_access_token({"HOME": str(self.home)})
+        self.assertEqual(key, out)
+
+    def test_file_non_json_dies(self):
+        self.auth_path.write_text("not json {{{")
+        with self.assertRaises(Die):
+            claude_host_access_token({"HOME": str(self.home)})
+
+    def test_file_json_array_root_dies(self):
+        self.auth_path.write_text("[]")
+        with self.assertRaises(Die):
+            claude_host_access_token({"HOME": str(self.home)})
+
+    def test_file_extra_fields_are_ignored(self):
+        key = "sk-ant-oat01-real"  # gitleaks:allow
+        self._write({
+            "claudeAiOauth": {
+                "accessToken": key,
+                "refreshToken": "sk-ant-ort01-secret",  # gitleaks:allow
+                "scopes": ["user:inference"],
+                "expiresAt": 2_000_000_000_000,
+            },
+        })
+        out = claude_host_access_token({"HOME": str(self.home)})
+        self.assertEqual(key, out)
+
+    # --- macOS Keychain fallback ---
+
+    def _home_without_creds(self) -> Path:
+        """A home dir that has .claude/ but no .credentials.json."""
+        empty = self.home / "no-creds"
+        (empty / ".claude").mkdir(parents=True)
+        return empty
+
+    def _mock_keychain(self, stdout: str, returncode: int = 0) -> MagicMock:
+        mock = MagicMock()
+        mock.returncode = returncode
+        mock.stdout = stdout
+        return mock
+
+    def test_keychain_used_when_file_absent(self):
+        key = "sk-ant-oat01-keychain"  # gitleaks:allow
+        home = self._home_without_creds()
+        with patch(
+            "bot_bottle.contrib.claude.claude_auth.subprocess.run",
+            return_value=self._mock_keychain(_cred_json(key)),
+        ), patch(
+            "bot_bottle.contrib.claude.claude_auth.sys.platform", "darwin",
+        ):
+            out = claude_host_access_token({"HOME": str(home)})
+        self.assertEqual(key, out)
+
+    def test_keychain_failure_when_file_absent_dies(self):
+        home = self._home_without_creds()
+        with patch(
+            "bot_bottle.contrib.claude.claude_auth.subprocess.run",
+            return_value=self._mock_keychain("", returncode=44),
+        ), patch(
+            "bot_bottle.contrib.claude.claude_auth.sys.platform", "darwin",
+        ):
+            with self.assertRaises(Die):
+                claude_host_access_token({"HOME": str(home)})
+
+    def test_no_file_no_keychain_on_linux_dies(self):
+        home = self._home_without_creds()
+        with patch("bot_bottle.contrib.claude.claude_auth.sys.platform", "linux"):
+            with self.assertRaises(Die):
+                claude_host_access_token({"HOME": str(home)})
+
+    def test_keychain_non_json_dies(self):
+        home = self._home_without_creds()
+        with patch(
+            "bot_bottle.contrib.claude.claude_auth.subprocess.run",
+            return_value=self._mock_keychain("not-json"),
+        ), patch(
+            "bot_bottle.contrib.claude.claude_auth.sys.platform", "darwin",
+        ):
+            with self.assertRaises(Die):
+                claude_host_access_token({"HOME": str(home)})
+
+    def test_keychain_security_not_found_dies(self):
+        home = self._home_without_creds()
+        with patch(
+            "bot_bottle.contrib.claude.claude_auth.subprocess.run",
+            side_effect=FileNotFoundError,
+        ), patch(
+            "bot_bottle.contrib.claude.claude_auth.sys.platform", "darwin",
+        ):
+            with self.assertRaises(Die):
+                claude_host_access_token({"HOME": str(home)})
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_manifest_egress.py

@@ -80,11 +80,19 @@ class TestAgentProviderHostCredentials(unittest.TestCase):
                 "forward_host_credentials": "yes",
             })
 
-    def test_forward_host_credentials_rejected_for_claude(self):
+    def test_forward_host_credentials_allowed_for_claude(self):
+        b = _provider_config_bottle({
+            "template": "claude",
+            "forward_host_credentials": True,
+        })
+        self.assertTrue(b.agent_provider.forward_host_credentials)
+
+    def test_forward_host_credentials_and_auth_token_rejected_together(self):
         with self.assertRaises(ManifestError):
             _provider_config_bottle({
                 "template": "claude",
                 "forward_host_credentials": True,
+                "auth_token": "SOME_TOKEN",
             })
 
     def test_auth_token_defaults_empty(self):

tests/unit/test_manifest_validation.py

@@ -86,10 +86,22 @@ class TestAgentProviderValidation(unittest.TestCase):
                 "b", {"forward_host_credentials": True, "template": "weird"}
             )
 
-    def test_forward_creds_non_codex_template(self) -> None:
+    def test_forward_creds_pi_template_rejected(self) -> None:
         with self.assertRaises(ManifestError):
             ManifestAgentProvider.from_dict(
-                "b", {"forward_host_credentials": True, "template": "claude"}
+                "b", {"forward_host_credentials": True, "template": "pi"}
+            )
+
+    def test_forward_creds_claude_allowed(self) -> None:
+        p = ManifestAgentProvider.from_dict(
+            "b", {"forward_host_credentials": True, "template": "claude"}
+        )
+        self.assertTrue(p.forward_host_credentials)
+
+    def test_forward_creds_and_auth_token_rejected(self) -> None:
+        with self.assertRaises(ManifestError):
+            ManifestAgentProvider.from_dict(
+                "b", {"forward_host_credentials": True, "auth_token": "T", "template": "claude"}
             )
 
     def test_valid_claude_auth_token(self) -> None: