fix(smolmachines): exclude /tmp+/var/tmp from snapshot; mkdir -p on boot

On resume from a committed snapshot, smolvm's pack process remaps all file uids to the host uid (501 on macOS). Files in /tmp that were created during the session (e.g. /tmp/claude-1000 owned by node=uid 1000) get remapped to 501. Claude Code then refuses to use the temp directory because it's owned by a different uid. Two-part fix: - Exclude ./tmp and ./var/tmp from the tar in _exec_tar_to_file. Both directories are ephemeral; a resumed VM should start with clean temp directories identical to a fresh VM. - Add mkdir -p /tmp /var/tmp to _init_vm before chown/chmod, so the directories are created if the committed snapshot omitted them.
fix(smolmachines): write tar to VM file then machine_cp to host
2026-06-23 18:06:41 +00:00 · 2026-06-23 16:37:43 +00:00 · 2026-06-23 09:15:17 +00:00 · 2026-06-23 09:04:35 +00:00 · 2026-06-23 08:57:06 +00:00 · 2026-06-23 08:42:03 +00:00
39 changed files with 138 additions and 1404 deletions
@@ -5,43 +5,28 @@
 # bot-bottle

 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![pylint](https://img.shields.io/badge/pylint-9.93%2F10-brightgreen)](https://github.com/PyCQA/pylint)
+[![pylint](https://img.shields.io/badge/pylint-9.92%2F10-brightgreen)](https://github.com/PyCQA/pylint)
 [![pyright](https://img.shields.io/badge/pyright-0%20errors-brightgreen)](https://github.com/microsoft/pyright)

-**Run any coding agent like it might be compromised — and lose nothing when it is.**
+**Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.

-bot-bottle is a provider-neutral, security-first substrate for autonomous agents. Bring Claude Code, Codex, or your own harness; each one runs in an ephemeral, per-agent "bottle" it cannot modify, where every byte of egress is scanned for exfiltration and capabilities are narrowed to exactly what the task declares.
+**Solution:** Ephemeral, per agent "bottles" the agent cannot modify that scan all traffic for data exfiltration and limit capabilities and egress to only what the agent needs.

-**Problem:** You want to let a coding agent run unsupervised, but a prompt-injected or misbehaving agent — or a poisoned repo, MCP server, or skill — can wreck your environment or exfiltrate your secrets. Locking yourself to one vendor's cloud doesn't fix that; it just moves the blast radius.
+## Features

-**Solution:** A neutral control plane that runs *whatever agent you choose* inside an isolation boundary the agent can't touch: TLS-bumped egress allowlisting, outbound/inbound DLP, gitleaks-gated pushes, and host secrets the agent never sees. Swap the agent; keep the guarantees.
-
-## Why bot-bottle
-
-### A neutral substrate — bring your own agent
-
- **Provider-agnostic by design** — Claude and Codex ship built in; any other agent (Gemini, Aider, a local-model wrapper) is a drop-in plugin at `~/.bot-bottle/contrib/<name>/` — no fork, no PR against this repo. The manifest accepts any provider template, and the isolation, egress, and git guarantees are identical across all of them.
- **One control plane, every harness** — the same bottle, egress policy, and supervise flow wrap whichever agent you run, so switching or mixing providers doesn't change your security posture.
- **Composable bottles (`extends:`)** — keep provider/runtime policy in one base bottle (e.g. `claude.md`) and overlay task bottles on top.
-
-### An isolation boundary the agent can't touch
-
- **Per-bottle egress allowlist** — TLS-bumped HTTP/HTTPS chokepoint with a per-manifest host allowlist; per-route path/method/header `matches` filtering; outbound DLP scanning for known tokens and secrets, inbound DLP scanning for prompt-injection attempts; DoH and arbitrary hosts blocked by default.
+- **Per-bottle egress allowlist** — TLS-bumped HTTP/HTTPS chokepoint with a per-manifest host allowlist and request-body DLP scanner; DoH and arbitrary hosts blocked by default.
 - **Tokens the agent never sees** — host secrets live in a sidecar; the agent dials `http://sidecar:9099/<path>` and the proxy strips inbound `Authorization` and injects the real token before forwarding. `printenv` in the agent shows proxy URLs only.
 - **Gitleaks-scanned push (git-gate)** — `bottle.git` remotes route through a per-bottle `git daemon` that gitleaks-scans incoming refs pre-receive and forwards clean refs upstream over SSH. The agent never holds the upstream credential.
 - **Manifest-scoped skills + secrets** — each bottle declares its skills, env, git identity, remotes, and egress routes; unknown keys die at load.
 - **Trust boundary at `$HOME`** — bottles (credentials, egress, remotes) live only under `~/.bot-bottle/bottles/`. Repos may ship agents but not bottles, so a cloned repo can't redirect an env var to an attacker host.
-
-### Isolation that matches your host
-
+- **Composable bottles (`extends:`)** — keep provider/runtime policy in one base bottle (e.g. `claude.md`) and overlay task bottles on top.
 - **Parallel, isolated bottles** — each bottle runs in its own backend-owned isolation boundary; bottles don't share state or talk to each other.
+- **Provider templates (Claude, Codex)** — `Dockerfile.claude` / `Dockerfile.codex`, or a bottle-supplied Dockerfile. Claude auth via long-lived OAuth token; Codex via opt-in host device-auth forwarding.
 - **gVisor auto-detect** — on Linux hosts where `runsc` is registered with Docker, every bottle launches under it for a userspace syscall barrier; no manifest config required.
 - **Apple Container backend (macOS default when available)** — runs the agent and sidecar bundle with Apple's `container` CLI, using a host-only agent network plus a separate sidecar egress network.
 - **Smolmachines backend** — runs the agent in a libkrun micro-VM while the sidecar bundle stays in Docker. TSI and smolmachines DNS filtering close the raw DNS exfiltration gap that exists in the legacy Docker backend.
 - **Legacy Docker backend** — still available for examples, CI, and hosts without Apple Container via `BOT_BOTTLE_BACKEND=docker` or `--backend=docker`.

-Per-provider auth (Claude long-lived OAuth token; Codex opt-in host device-auth forwarding) and per-provider images (`Dockerfile.claude` / `Dockerfile.codex`, or a bottle-supplied Dockerfile) are configured on the bottle — see [Manifest](#manifest).
-
 ## Architecture

 On the default macOS Apple Container backend, a bottle is an agent container on a host-only internal network plus a sidecar bundle attached to both that internal network and a NAT egress network. The agent gets HTTP(S)_PROXY and CA bundle env vars pointing at the sidecar's internal-network IP, so HTTP/HTTPS traffic flows through the sidecar instead of direct egress. `bottle.git` / git-gate is intentionally deferred on this backend until a safe Apple Container key-delivery path exists.
@@ -83,27 +68,6 @@ The Docker topology looks like this:

 When the agent exits, `cli.py` tears down every sidecar and both networks; nothing about a bottle persists between runs.

-## Install
-
-Install the CLI with the bootstrap script:
-
-```sh
-curl -fsSL https://gitea.dideric.is/didericis/bot-bottle/raw/branch/main/install.sh | sh
-```
-
-The script checks Python 3.11+, checks Docker daemon reachability, creates the `~/.bot-bottle/` config directories, installs the Python package with `pipx` when available or `pip --user` otherwise, then runs:
-
-```sh
-bot-bottle doctor
-```
-
-Python-native installers can use the package metadata directly:
-
-```sh
-pipx install git+https://gitea.dideric.is/didericis/bot-bottle.git
-uv tool install git+https://gitea.dideric.is/didericis/bot-bottle.git
-```
-
 ## Quickstart

 On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The smolmachines backend requires Docker on the host for the sidecar bundle plus smolvm. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
@@ -142,15 +106,8 @@ egress:
  routes:
    - host: gitea.dideric.is
      auth:
-        scheme: token        # Bearer | token
+        scheme: token
        token_ref: BOT_BOTTLE_GITEA_TOKEN
-      matches:               # optional — restrict to specific paths/methods/headers
-        - paths:
-            - {type: prefix, value: /api/v1/}
-          methods: [GET, POST, PATCH, DELETE]
-      dlp:                   # optional — per-route detector overrides (default: all on)
-        outbound_detectors: [token_patterns, known_secrets]
-        inbound_detectors: false   # disable response scanning for this host
 ---

 The `gitea-dev` bottle. Provider auth via the inherited Claude route;
@@ -169,23 +126,6 @@ skills:
 You help maintain Gitea-hosted projects.
 ````

-**Egress route fields:**
-
-| Field | Required | Description |
-|---|---|---|
-| `host` | yes | Hostname to allowlist. One entry per host. |
-| `role` | no | Reserved for future use. The key is recognised but any value is currently rejected at load. Provider auth routes (e.g. Claude's `api.anthropic.com`) are injected automatically from `agent_provider.auth_token`, not via `role`. |
-| `auth.scheme` | when `auth` present | `Bearer` or `token`. Injected by the proxy; the agent never sees the value. |
-| `auth.token_ref` | when `auth` present | Env-var name holding the secret on the host. |
-| `matches` | no | Array of `{paths, methods, headers}` filters. A request must match at least one entry (if any are given) to be forwarded. |
-| `matches[].paths` | no | Array of `{type, value}`. `type` is `prefix` (default), `exact`, or `regex`. |
-| `matches[].methods` | no | Array of HTTP method strings, e.g. `[GET, POST]`. |
-| `matches[].headers` | no | Array of `{name, value, type}`. `type` is `exact` (default) or `regex`. |
-| `dlp` | no | Per-route DLP overrides. Omit to use defaults (all detectors on). |
-| `dlp.outbound_detectors` | no | `false` disables outbound scanning; list restricts to named detectors (`token_patterns`, `known_secrets`). |
-| `dlp.inbound_detectors` | no | `false` disables inbound scanning; list restricts to named detectors (`naive_injection_detection`). |
-| `git.fetch` | no | `true` permits smart HTTP clone/fetch (`git-upload-pack`) for this host. Push (`git-receive-pack`) remains blocked. |
-
 More examples in `examples/`. Full design lives under `docs/prds/`; the trust-boundary rationale is in `docs/prds/0011-per-file-md-manifest.md`.

 ## Trademarks
@@ -1,96 +0,0 @@
-# Per-bottle sidecar bundle image (PRD 0024).
-#
-# Collapses the prior per-sidecar images (egress, git-gate,
-# supervise) into one. A small stdlib-Python init supervisor at
-# /app/sidecar_init.py spawns all daemons, forwards SIGTERM, and
-# propagates per-daemon stdout/stderr to the container log with a
-# `[name]` prefix. See PRD 0024 for the rationale.
-#
-# Layout:
-#
-#   /usr/bin/gitleaks                    gitleaks binary
-#   /app/egress_addon.py + siblings      mitmproxy addon (egress)
-#   /app/egress-entrypoint.sh            mitmdump launcher
-#   /app/supervise_server.py + .py       supervise MCP server
-#   /app/sidecar_init.py                 PID 1 supervisor
-#   /etc/egress/routes.yaml              bind-mounted at run time
-#   /etc/git-gate/pre-receive            docker-cp'd at start time
-#   /git-gate-entrypoint.sh              docker-cp'd at start time
-#   /git-gate/creds/*                    docker-cp'd at start time
-#   /git/*                               bare repos, populated at runtime
-#   /run/supervise/queue/                bind-mounted at run time
-#   /home/mitmproxy/.mitmproxy/          mitmproxy CA dir
-#
-# Exposed ports inside the container:
-#   9099  egress (mitmproxy, agent-facing HTTPS proxy)
-#   9418  git-gate (git-daemon)
-#   9420  git-gate smart HTTP (smolmachines agent-facing transport)
-#   9100  supervise (MCP HTTP)
-
-# Stage 1: gitleaks binary. The upstream gitleaks image is alpine
-# with the binary at /usr/bin/gitleaks. Pinned by digest in lockstep
-# with Dockerfile.git-gate's prior base (now deleted at chunk 3).
-FROM zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f AS gitleaks-src
-
-# Stage 2: assembly. mitmproxy/mitmproxy is debian-slim-based with
-# Python + mitmdump pre-installed — heavier than the others, so
-# this stage starts there and pulls the standalone binaries in.
-FROM mitmproxy/mitmproxy:11.1.3
-
-# Run as root inside the bundle. The bundle is the isolation
-# boundary; per-daemon user separation inside it is not load-bearing
-# and complicates the supervisor's spawn path.
-USER root
-
-# Runtime system deps:
-#   git supplies the `git daemon` subcommand (no separate package)
-#     plus the core `git` binary the pre-receive hook invokes.
-#   openssh-client supplies the upstream SSH transport the
-#     pre-receive hook uses to forward accepted refs.
-#   ca-certificates is needed for mitmdump upstream TLS (the
-#     base image already has it; listed for explicitness).
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      git openssh-client ca-certificates \
- && rm -rf /var/lib/apt/lists/*
-
-# Pull the standalone binaries into the final image.
-COPY --from=gitleaks-src /usr/bin/gitleaks /usr/bin/gitleaks
-
-# Project Python: addon + server modules + the init supervisor.
-# Kept flat under /app/ so mitmdump's loader resolves them as
-# top-level siblings (absolute imports), matching the prior
-# Dockerfile.egress / Dockerfile.supervise layout.
-COPY bot_bottle/egress_addon_core.py /app/egress_addon_core.py
-COPY bot_bottle/egress_addon.py      /app/egress_addon.py
-COPY bot_bottle/dlp_detectors.py     /app/dlp_detectors.py
-COPY bot_bottle/yaml_subset.py       /app/yaml_subset.py
-COPY bot_bottle/supervise.py         /app/supervise.py
-COPY bot_bottle/supervise_server.py  /app/supervise_server.py
-COPY bot_bottle/sidecar_init.py      /app/sidecar_init.py
-COPY bot_bottle/git_http_backend.py  /app/git_http_backend.py
-COPY bot_bottle/egress_entrypoint.sh /app/egress-entrypoint.sh
-RUN chmod +x /app/egress-entrypoint.sh
-
-# Pre-create runtime directories the compose renderer + start
-# step expect to exist. `docker cp` does not create intermediate
-# dirs, and bind mounts won't either if the parent is missing.
-RUN mkdir -p \
-      /etc/egress \
-      /etc/git-gate \
-      /git-gate/creds \
-      /git \
-      /run/supervise/queue \
-      /home/mitmproxy/.mitmproxy
-
-# Documentation only — the compose renderer publishes whichever
-# subset the bottle uses.
-EXPOSE 8888 9099 9418 9420 9100
-
-# WORKDIR matches Dockerfile.supervise's prior layout so the
-# in-app same-dir import in supervise_server.py stays deterministic.
-WORKDIR /app
-
-# PID 1 is the supervisor. It owns signal handling and exit-code
-# propagation; no `exec` chain in the entrypoint itself.
-ENTRYPOINT ["python3", "/app/sidecar_init.py"]
@@ -58,17 +58,10 @@ from .sidecar_bundle import (
 )


-# Repo root or installed site-packages root, used as the build context for
-# Dockerfiles that COPY bot_bottle source files.
+# Repo root, used as the build context for the bundle Dockerfile.
 _REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)


-def _sidecar_bundle_dockerfile() -> str:
-    if (Path(_REPO_DIR) / SIDECAR_BUNDLE_DOCKERFILE).is_file():
-        return SIDECAR_BUNDLE_DOCKERFILE
-    return f"bot_bottle/{SIDECAR_BUNDLE_DOCKERFILE}"
-
-
 def bottle_plan_to_compose(plan: DockerBottlePlan) -> dict[str, Any]:
    """Render a Compose v2 spec dict from a fully-resolved
    DockerBottlePlan.
@@ -141,7 +134,7 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
    ep = plan.egress_plan
    volumes.append(_bind(ep.mitmproxy_ca_host_path, EGRESS_CA_IN_CONTAINER))
    if ep.routes:
-        volumes.append(_bind(ep.routes_path.parent, str(Path(EGRESS_ROUTES_IN_CONTAINER).parent)))
+        volumes.append(_bind(ep.routes_path, EGRESS_ROUTES_IN_CONTAINER))
        for token_env in sorted(ep.token_env_map.keys()):
            env.append(token_env)

@@ -190,7 +183,7 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
        "image": SIDECAR_BUNDLE_IMAGE,
        "build": {
            "context": _REPO_DIR,
-            "dockerfile": _sidecar_bundle_dockerfile(),
+            "dockerfile": SIDECAR_BUNDLE_DOCKERFILE,
        },
        "container_name": sidecar_bundle_container_name(plan.slug),
        "networks": {
@@ -1,21 +1,24 @@
-"""Host-side helper for egress sidecar inspection and live updates.
+"""Host-side helper for egress sidecar inspection (issue #198).

-The approve path uses this module to validate a proposed routes file,
-write it to the bottle's live egress state dir, and signal the sidecar
-bundle so the mitmproxy addon reloads it.
+`_merge_single_route`, `add_route`, and `apply_routes_change` were
+removed when the egress-block MCP tool was dropped. The remaining
+helpers support runtime inspection and validation of the routes file
+without modifying it at runtime.
 """

 from __future__ import annotations

-import os
 import subprocess

 from ...egress import EGRESS_ROUTES_IN_CONTAINER
-from ...log import warn
-from ..egress_apply import EgressApplicator, EgressApplyError
+from ...egress_addon_core import load_routes
 from .sidecar_bundle import sidecar_bundle_container_name


+class EgressApplyError(RuntimeError):
+    pass
+
+
 def fetch_current_routes(slug: str) -> str:
    container = sidecar_bundle_container_name(slug)
    r = subprocess.run(
@@ -30,31 +33,17 @@ def fetch_current_routes(slug: str) -> str:
    return r.stdout


-class DockerEgressApplicator(EgressApplicator):
-    def _signal_bundle_reload(self, slug: str) -> None:
-        container = sidecar_bundle_container_name(slug)
-        result = subprocess.run(
-            ["docker", "kill", "--signal", "HUP", container],
-            capture_output=True, text=True, check=False, env=os.environ,
-        )
-        if result.returncode != 0:
-            last_error = (result.stderr or "").strip() or (result.stdout or "").strip()
-            warn(
-                f"egress: routes updated on disk for {slug}, but bundle reload failed: "
-                f"{last_error or 'docker kill failed'}"
-            )
-            raise EgressApplyError(
-                f"could not reload egress bundle {container}: "
-                f"{last_error or 'docker kill failed'}"
-            )
-
-
-applicator = DockerEgressApplicator()
+def validate_routes_content(content: str) -> None:
+    try:
+        load_routes(content)
+    except ValueError as e:
+        raise EgressApplyError(
+            f"proposed routes.yaml is not valid: {e}"
+        ) from e


 __all__ = [
-    "DockerEgressApplicator",
    "EgressApplyError",
-    "applicator",
    "fetch_current_routes",
+    "validate_routes_content",
 ]
@@ -12,10 +12,9 @@ from __future__ import annotations
 import os


-# Bundle image. Defaults to a built-locally tag. Source checkouts
-# build from the repo-root Dockerfile.sidecars; installed packages
-# build from the packaged copy under bot_bottle/.
-# Operators pinning to a published digest can override via env.
+# Bundle image. Defaults to a built-locally tag (built from the
+# repo's Dockerfile.sidecars via compose `build:`). Operators
+# pinning to a published digest can override via env.
 SIDECAR_BUNDLE_IMAGE = os.environ.get(
    "BOT_BOTTLE_SIDECAR_IMAGE",
    "bot-bottle-sidecars:latest",
@@ -1,50 +0,0 @@
-"""Shared base class for host-side egress apply across backends.
-
-Each backend subclasses EgressApplicator and overrides _signal_bundle_reload
-with the backend-specific kill command.
-"""
-
-from __future__ import annotations
-
-from abc import ABC, abstractmethod
-from pathlib import Path
-
-from ..bottle_state import egress_state_dir
-from ..egress import EGRESS_ROUTES_FILENAME
-from ..egress_addon_core import load_routes
-
-
-class EgressApplyError(RuntimeError):
-    pass
-
-
-class EgressApplicator(ABC):
-    def apply_routes_change(self, slug: str, content: str) -> tuple[str, str]:
-        """Persist `content` to the live routes file and reload egress."""
-        self.validate_routes_content(content)
-        routes_path = self._routes_path(slug)
-        routes_path.parent.mkdir(parents=True, exist_ok=True)
-        before = routes_path.read_text(encoding="utf-8") if routes_path.exists() else ""
-        routes_path.write_text(content, encoding="utf-8")
-        routes_path.chmod(0o600)
-        self._signal_bundle_reload(slug)
-        return before, content
-
-    @staticmethod
-    def validate_routes_content(content: str) -> None:
-        try:
-            load_routes(content)
-        except ValueError as e:
-            raise EgressApplyError(
-                f"proposed routes.yaml is not valid: {e}"
-            ) from e
-
-    @staticmethod
-    def _routes_path(slug: str) -> Path:
-        return egress_state_dir(slug) / EGRESS_ROUTES_FILENAME
-
-    @abstractmethod
-    def _signal_bundle_reload(self, slug: str) -> None: ...
-
-
-__all__ = ["EgressApplicator", "EgressApplyError"]
@@ -1,39 +0,0 @@
-"""Host-side egress apply for the macos-container backend.
-
-Uses `container kill --signal HUP` (Apple Container framework) instead
-of `docker kill` to signal the sidecar bundle.
-"""
-
-from __future__ import annotations
-
-import os
-import subprocess
-
-from ...log import warn
-from ..egress_apply import EgressApplicator, EgressApplyError
-from .launch import sidecar_container_name
-
-
-class MacOSContainerEgressApplicator(EgressApplicator):
-    def _signal_bundle_reload(self, slug: str) -> None:
-        container = sidecar_container_name(slug)
-        result = subprocess.run(
-            ["container", "kill", "--signal", "HUP", container],
-            capture_output=True, text=True, check=False, env=os.environ,
-        )
-        if result.returncode != 0:
-            last_error = (result.stderr or "").strip() or (result.stdout or "").strip()
-            warn(
-                f"egress: routes updated on disk for {slug}, but bundle reload failed: "
-                f"{last_error or 'container kill failed'}"
-            )
-            raise EgressApplyError(
-                f"could not reload egress bundle {container}: "
-                f"{last_error or 'container kill failed'}"
-            )
-
-
-applicator = MacOSContainerEgressApplicator()
-
-
-__all__ = ["MacOSContainerEgressApplicator", "EgressApplyError", "applicator"]
@@ -12,6 +12,7 @@ from __future__ import annotations

 import dataclasses
 import os
+import shutil
 import subprocess
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
@@ -377,7 +378,7 @@ def _sidecar_mounts(
    ))
    if ep.routes:
        mounts.append((
-            str(ep.routes_path.parent),
+            str(_stage_routes_dir(plan)),
            str(Path(EGRESS_ROUTES_IN_CONTAINER).parent),
            True,
        ))
@@ -388,6 +389,17 @@ def _sidecar_mounts(

    return tuple(mounts)

+
+def _stage_routes_dir(plan: MacosContainerBottlePlan) -> Path:
+    routes_dir = plan.stage_dir / "macos-container-egress"
+    routes_dir.mkdir(parents=True, exist_ok=True)
+    shutil.copyfile(
+        plan.egress_plan.routes_path,
+        routes_dir / Path(EGRESS_ROUTES_IN_CONTAINER).name,
+    )
+    return routes_dir
+
+
 def _mount_spec(host_path: str, container_path: str, read_only: bool) -> str:
    spec = f"type=bind,source={host_path},target={container_path}"
    if read_only:
@@ -1,21 +0,0 @@
-"""Egress apply for the smolmachines backend.
-
-The smolmachines sidecar bundle runs as a host-side Docker container,
-so egress signalling is identical to the docker backend.
-"""
-
-from __future__ import annotations
-
-from ..docker.egress_apply import (  # noqa: F401
-    DockerEgressApplicator,
-    EgressApplyError,
-    applicator,
-    fetch_current_routes,
-)
-
-__all__ = [
-    "DockerEgressApplicator",
-    "EgressApplyError",
-    "applicator",
-    "fetch_current_routes",
-]
@@ -214,15 +214,11 @@ def _discover_urls(
        agent_supervise_url = f"http://{loopback_ip}:{supervise_host_port}/"

    existing_no_proxy = plan.guest_env.get("NO_PROXY", "localhost,127.0.0.1")
-    no_proxy = f"{existing_no_proxy},{loopback_ip}"
    guest_env = {
        **plan.guest_env,
        "HTTPS_PROXY": agent_proxy_url,
        "HTTP_PROXY":  agent_proxy_url,
-        "https_proxy": agent_proxy_url,
-        "http_proxy":  agent_proxy_url,
-        "NO_PROXY":    no_proxy,
-        "no_proxy":    no_proxy,
+        "NO_PROXY":    f"{existing_no_proxy},{loopback_ip}",
    }
    if agent_git_gate_host:
        guest_env["GIT_GATE_URL"] = f"http://{agent_git_gate_host}"
@@ -315,7 +311,7 @@ def _bundle_launch_spec(
    ep = plan.egress_plan
    volumes.append((str(ep.mitmproxy_ca_host_path), EGRESS_CA_IN_CONTAINER, True))
    if ep.routes:
-        volumes.append((str(ep.routes_path.parent), str(Path(EGRESS_ROUTES_IN_CONTAINER).parent), True))
+        volumes.append((str(ep.routes_path), EGRESS_ROUTES_IN_CONTAINER, True))
        # Bare-name entries for upstream-token slots. Their values
        # come from the docker-run subprocess env (inherited from
        # the operator's shell), never landing on argv.
@@ -1,6 +1,6 @@
 """Main CLI dispatcher.

-Commands: cleanup, commit, doctor, edit, info, init, list, resume, start, supervise
+Commands: cleanup, commit, edit, info, init, list, resume, start, supervise
 """

 from __future__ import annotations
@@ -13,7 +13,6 @@ from ._common import PROG
 from . import list as _list_mod
 from .cleanup import cmd_cleanup
 from .commit import cmd_commit
-from .doctor import cmd_doctor
 from .edit import cmd_edit
 from .info import cmd_info
 from .init import cmd_init
@@ -26,7 +25,6 @@ cmd_list = _list_mod.cmd_list
 COMMANDS = {
    "cleanup": cmd_cleanup,
    "commit": cmd_commit,
-    "doctor": cmd_doctor,
    "edit": cmd_edit,
    "info": cmd_info,
    "init": cmd_init,
@@ -42,7 +40,6 @@ def usage() -> None:
    sys.stderr.write("Commands:\n")
    sys.stderr.write("  cleanup   stop and remove all active bot-bottle containers\n")
    sys.stderr.write("  commit    snapshot a running bottle's container state to a Docker image\n")
-    sys.stderr.write("  doctor    check Python, Docker, and bot-bottle config prerequisites\n")
    sys.stderr.write("  edit      open an agent in vim for editing\n")
    sys.stderr.write("  info      print env, skills, and prompt details for a named agent\n")
    sys.stderr.write("  init      interactively create a new agent and add it to bot-bottle.json\n")
@@ -6,7 +6,7 @@ import os
 import sys
 from pathlib import Path

-PROG = Path(sys.argv[0]).name or "bot-bottle"
+PROG = "cli.py"
 USER_CWD = os.getcwd()
 REPO_DIR = str(Path(__file__).resolve().parent.parent.parent)

@@ -1,73 +0,0 @@
-"""doctor: validate host prerequisites for running bot-bottle."""
-
-from __future__ import annotations
-
-import argparse
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-from ._common import PROG
-
-
-def _ok(label: str, detail: str) -> None:
-    print(f"ok: {label}: {detail}")
-
-
-def _fail(label: str, detail: str) -> None:
-    print(f"fail: {label}: {detail}")
-
-
-def _check_python() -> bool:
-    version = sys.version_info
-    detail = f"{version.major}.{version.minor}.{version.micro}"
-    if version >= (3, 11):
-        _ok("python", detail)
-        return True
-    _fail("python", f"{detail}; need 3.11 or newer")
-    return False
-
-
-def _check_docker() -> bool:
-    docker = shutil.which("docker")
-    if not docker:
-        _fail("docker", "docker command not found")
-        return False
-    try:
-        result = subprocess.run(
-            [docker, "info"],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            check=False,
-            timeout=10,
-        )
-    except (OSError, subprocess.TimeoutExpired) as exc:
-        _fail("docker", f"daemon check failed: {exc}")
-        return False
-    if result.returncode == 0:
-        _ok("docker", "daemon reachable")
-        return True
-    _fail("docker", "daemon not reachable")
-    return False
-
-
-def _check_config_dir() -> bool:
-    config = Path.home() / ".bot-bottle"
-    if config.is_dir():
-        _ok("config", str(config))
-        return True
-    _fail("config", f"{config} does not exist")
-    return False
-
-
-def cmd_doctor(argv: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog=f"{PROG} doctor", add_help=True)
-    parser.parse_args(argv)
-
-    checks = (
-        _check_python(),
-        _check_docker(),
-        _check_config_dir(),
-    )
-    return 0 if all(checks) else 1
@@ -3,8 +3,7 @@ act on them (approve / modify / reject).

 Curses-based TUI; modify-then-approve shells out to $EDITOR. The
 approval handler wires to PRD 0016 (capability-block), which rebuilds
-the bottle Dockerfile. Egress proposals are queued for operator review
-as full routes.yaml updates.
+the bottle Dockerfile. The egress-block tool was removed in issue #198.
 """

 from __future__ import annotations
@@ -21,21 +20,11 @@ from datetime import datetime, timezone
 from pathlib import Path

 from .. import supervise as _supervise
-from ..bottle_state import read_metadata
+# from ..bottle_state import read_metadata
 # from ..backend.docker.capability_apply import (
 #     CapabilityApplyError,
 #     apply_capability_change,
 # )
-from ..backend.docker.egress_apply import (
-    EgressApplyError,
-    applicator as _docker_applicator,
-)
-from ..backend.macos_container.egress_apply import (
-    applicator as _macos_applicator,
-)
-from ..backend.smolmachines.egress_apply import (
-    applicator as _smolmachines_applicator,
-)
 from ..log import Die, error, info


@@ -51,9 +40,6 @@ from ..supervise import (
    STATUS_MODIFIED,
    STATUS_REJECTED,
    TOOL_CAPABILITY_BLOCK,
-    TOOL_ALLOW,
-    TOOL_EGRESS_BLOCK,
-    TOOL_GITLEAKS_ALLOW,
    archive_proposal,
    list_pending_proposals,
    render_diff,
@@ -77,17 +63,7 @@ class QueuedProposal:
 # Errors any remediation engine may raise. Caught by the TUI key
 # handlers and surfaced in the status line so a failed apply keeps
 # the proposal pending rather than crashing curses.
-ApplyError = (CapabilityApplyError, EgressApplyError)
-
-
-def apply_routes_change(slug: str, content: str) -> tuple[str, str]:
-    meta = read_metadata(slug)
-    backend = meta.backend if meta is not None else ""
-    if backend == "macos-container":
-        return _macos_applicator.apply_routes_change(slug, content)
-    if backend == "smolmachines":
-        return _smolmachines_applicator.apply_routes_change(slug, content)
-    return _docker_applicator.apply_routes_change(slug, content)
+ApplyError = (CapabilityApplyError,)


 def discover_pending() -> list[QueuedProposal]:
@@ -139,10 +115,6 @@ def _detail_lines(
 def _suffix_for_tool(tool: str) -> str:
    if tool == TOOL_CAPABILITY_BLOCK:
        return ".dockerfile"
-    if tool in (TOOL_ALLOW, TOOL_EGRESS_BLOCK):
-        return ".yaml"
-    if tool == TOOL_GITLEAKS_ALLOW:
-        return ".txt"
    return ".txt"


@@ -157,7 +129,6 @@ def approve(
 ) -> None:
    """Apply the proposal, write the waiting response, and audit it."""
    status = STATUS_MODIFIED if final_file is not None else STATUS_APPROVED
-    file_to_apply = final_file if final_file is not None else qp.proposal.proposed_file

    diff_before, diff_after = "", ""
    # if qp.proposal.tool == TOOL_CAPABILITY_BLOCK:
@@ -171,11 +142,6 @@ def approve(
    #     diff_before, diff_after = apply_capability_change(
    #         qp.proposal.bottle_slug, file_to_apply,
    #     )
-    if qp.proposal.tool in (TOOL_ALLOW, TOOL_EGRESS_BLOCK):
-        diff_before, diff_after = apply_routes_change(
-            qp.proposal.bottle_slug,
-            file_to_apply,
-        )

    response = Response(
        proposal_id=qp.proposal.id,
@@ -204,23 +170,6 @@ def reject(qp: QueuedProposal, *, reason: str) -> None:
    _write_audit(qp, action=STATUS_REJECTED, notes=reason, diff_before="", diff_after="")


-def _approve_from_tui(
-    stdscr: "curses._CursesWindow",  # type: ignore
-    qp: QueuedProposal,
-    *,
-    final_file: str | None = None,
-    notes: str = "",
-) -> str:
-    """Approve from curses, prompting for any tool-specific audit note."""
-    if qp.proposal.tool == TOOL_GITLEAKS_ALLOW and final_file is None:
-        notes = _prompt(stdscr, "allow reason (test fixture/false positive): ")
-        if not notes:
-            return "approve aborted (empty reason)"
-    approve(qp, final_file=final_file, notes=notes)
-    verb = "modified+approved" if final_file is not None else "approved"
-    return _approval_status(qp, verb)
-
-
 def _write_audit(
    qp: QueuedProposal,
    *,
@@ -404,22 +353,18 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:  # type: ignore
            _detail_view(stdscr, qp, green_attr=green_attr)
        elif key == ord("a"):
            try:
-                status_line = _approve_from_tui(stdscr, qp)
+                approve(qp)
+                status_line = _approval_status(qp, "approved")
            except ApplyError as e:
                status_line = f"apply failed: {e}"
        elif key == ord("m"):
-            if qp.proposal.tool == TOOL_GITLEAKS_ALLOW:
-                status_line = "modify unavailable for gitleaks-allow"
-                continue
            edited = _modify(stdscr, qp)
            if edited is None:
                status_line = "modify aborted (no change)"
            else:
                try:
-                    status_line = _approve_from_tui(
-                        stdscr, qp, final_file=edited,
-                        notes="operator modified before approving",
-                    )
+                    approve(qp, final_file=edited, notes="operator modified before approving")
+                    status_line = _approval_status(qp, "modified+approved")
                except ApplyError as e:
                    status_line = f"apply failed: {e}"
        elif key == ord("r"):
@@ -517,20 +462,15 @@ def _detail_view(
            offset = max(0, len(lines) - 1)
        elif key == ord("a"):
            try:
-                _approve_from_tui(stdscr, qp)
+                approve(qp)
            except ApplyError:
                pass
            return
        elif key == ord("m"):
-            if qp.proposal.tool == TOOL_GITLEAKS_ALLOW:
-                return
            edited = _modify(stdscr, qp)
            if edited is not None:
                try:
-                    _approve_from_tui(
-                        stdscr, qp, final_file=edited,
-                        notes="operator modified before approving",
-                    )
+                    approve(qp, final_file=edited, notes="operator modified before approving")
                except ApplyError:
                    pass
            return
@@ -261,8 +261,8 @@ class CodexAgentProvider(AgentProvider):
            return
        info(f"registering supervise MCP server in agent codex config → {supervise_url}")
        r = bottle.exec(
-            f"codex mcp add {_SUPERVISE_MCP_NAME} --url "
-            f"{shlex.quote(supervise_url)}",
+            f"codex mcp add --transport http "
+            f"{_SUPERVISE_MCP_NAME} {supervise_url}",
            user="node",
        )
        if r.returncode != 0:
@@ -270,7 +270,7 @@ class CodexAgentProvider(AgentProvider):
                f"`codex mcp add supervise` failed (exit {r.returncode}): "
                f"{(r.stderr or r.stdout or '').strip()}. Inside the bottle, "
                f"register manually with: "
-                f"codex mcp add supervise --url {shlex.quote(supervise_url)}"
+                f"codex mcp add --transport http supervise {supervise_url}"
            )


@@ -31,7 +31,6 @@ CODEX_HOST_CREDENTIAL_TOKEN_REF = "BOT_BOTTLE_CODEX_HOST_ACCESS_TOKEN"
 EGRESS_HOSTNAME = "egress"

 EGRESS_ROUTES_IN_CONTAINER = "/etc/egress/routes.yaml"
-EGRESS_ROUTES_FILENAME = Path(EGRESS_ROUTES_IN_CONTAINER).name


@dataclass(frozen=True)
@@ -296,7 +295,7 @@ class Egress(ABC):
    ) -> EgressPlan:
        routes = egress_routes_for_bottle(bottle, provider_routes)
        log = bottle.egress.Log
-        routes_path = stage_dir / EGRESS_ROUTES_FILENAME
+        routes_path = stage_dir / "egress_routes.yaml"
        routes_path.write_text(egress_render_routes(routes, log=log))
        routes_path.chmod(0o600)
        return EgressPlan(
@@ -310,7 +309,6 @@ class Egress(ABC):
 __all__ = [
    "CODEX_HOST_CREDENTIAL_TOKEN_REF",
    "EGRESS_HOSTNAME",
-    "EGRESS_ROUTES_FILENAME",
    "EGRESS_ROUTES_IN_CONTAINER",
    "Egress",
    "EgressPlan",
@@ -5,6 +5,7 @@ egress container."""

 from __future__ import annotations

+import dataclasses
 import json
 import os
 import signal
@@ -26,7 +27,6 @@ from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: dis
    load_config,
    match_route,
    outbound_scan_headers,
-    route_to_yaml_dict,
    scan_inbound,
    scan_outbound,
 )
@@ -82,7 +82,7 @@ class EgressAddon:
    def _serve_introspection(self, flow: http.HTTPFlow, path: str) -> None:
        if path == "/allowlist":
            payload = json.dumps(
-                {"routes": [route_to_yaml_dict(r) for r in self.config.routes]},
+                {"routes": [dataclasses.asdict(r) for r in self.config.routes]},
                indent=2,
            ).encode("utf-8")
            flow.response = http.Response.make(
@@ -359,56 +359,6 @@ def _parse_one(idx: int, raw: object) -> Route:
    )


-def _path_match_to_dict(pm: PathMatch) -> dict[str, object]:
-    d: dict[str, object] = {"value": pm.value}
-    if pm.type != "prefix":
-        d["type"] = pm.type
-    return d
-
-
-def _header_match_to_dict(hm: HeaderMatch) -> dict[str, object]:
-    d: dict[str, object] = {"name": hm.name, "value": hm.value}
-    if hm.type != "exact":
-        d["type"] = hm.type
-    return d
-
-
-def _match_entry_to_dict(me: MatchEntry) -> dict[str, object]:
-    d: dict[str, object] = {}
-    if me.paths:
-        d["paths"] = [_path_match_to_dict(p) for p in me.paths]
-    if me.methods:
-        d["methods"] = list(me.methods)
-    if me.headers:
-        d["headers"] = [_header_match_to_dict(h) for h in me.headers]
-    return d
-
-
-def route_to_yaml_dict(r: Route) -> dict[str, object]:
-    """Serialize a Route to YAML-schema-compatible dict.
-
-    Uses the same field names the YAML parser accepts, so the output
-    can be round-tripped directly into an `allow` or `egress-block`
-    proposal without translation. Fields that are empty/default are
-    omitted so the agent doesn't copy irrelevant keys."""
-    d: dict[str, object] = {"host": r.host}
-    if r.auth_scheme:
-        d["auth_scheme"] = r.auth_scheme
-        d["token_env"] = r.token_env
-    if r.matches:
-        d["matches"] = [_match_entry_to_dict(m) for m in r.matches]
-    if r.git_fetch:
-        d["git"] = {"fetch": True}
-    dlp: dict[str, object] = {}
-    if r.outbound_detectors is not None:
-        dlp["outbound_detectors"] = list(r.outbound_detectors)
-    if r.inbound_detectors is not None:
-        dlp["inbound_detectors"] = list(r.inbound_detectors)
-    if dlp:
-        d["dlp"] = dlp
-    return d
-
-
 def load_routes(text: str) -> tuple[Route, ...]:
    """Parse YAML text → routes."""
    try:
@@ -748,7 +698,6 @@ def scan_inbound(

 __all__ = [
    "LOG_BLOCKS",
-    "route_to_yaml_dict",
    "LOG_FULL",
    "LOG_OFF",
    "Config",
@@ -247,164 +247,6 @@ cat > "$refs_file"

 zero=0000000000000000000000000000000000000000

-supervise_gitleaks_allow() {
-  log_opts=$1
-  ref=$2
-  report_file=$(mktemp)
-  if ! gitleaks git \
-      --log-opts="$log_opts" \
-      --no-banner \
-      --redact \
-      --ignore-gitleaks-allow \
-      --report-format=json \
-      --report-path="$report_file" \
-      --exit-code 0 \
-      1>&2; then
-    rm -f "$report_file"
-    echo "git-gate: gitleaks inline-suppression scan failed for $ref" >&2
-    return 1
-  fi
-
-  proposal_id=$(
-    GITLEAKS_ALLOW_REF="$ref" python3 - "$report_file" <<'PY'
-import datetime
-import hashlib
-import json
-import os
-import sys
-import uuid
-from pathlib import Path
-
-report_path = Path(sys.argv[1])
-queue_dir = os.environ.get("SUPERVISE_QUEUE_DIR", "")
-slug = os.environ.get("SUPERVISE_BOTTLE_SLUG", "")
-if not queue_dir or not slug:
-    sys.exit(2)
-
-try:
-    raw = json.loads(report_path.read_text() or "[]")
-except json.JSONDecodeError:
-    sys.exit(3)
-if not isinstance(raw, list):
-    sys.exit(3)
-if not raw:
-    sys.exit(0)
-
-ref = os.environ.get("GITLEAKS_ALLOW_REF", "")
-lines = [
-    "gitleaks inline suppression requires supervisor approval",
-    f"ref: {ref}",
-    "",
-]
-for i, finding in enumerate(raw, 1):
-    if not isinstance(finding, dict):
-        continue
-    file_path = finding.get("File", "")
-    line_no = finding.get("StartLine", finding.get("Line", ""))
-    rule_id = finding.get("RuleID", "")
-    commit = finding.get("Commit", "")
-    line = finding.get("Line", "")
-    lines.extend([
-        f"finding {i}:",
-        f"  file: {file_path}",
-        f"  line: {line_no}",
-        f"  rule: {rule_id}",
-        f"  commit: {commit}",
-        f"  code: {line}",
-        "",
-    ])
-
-payload = "\n".join(lines).rstrip() + "\n"
-proposal_id = str(uuid.uuid4())
-proposal = {
-    "id": proposal_id,
-    "bottle_slug": slug,
-    "tool": "gitleaks-allow",
-    "proposed_file": payload,
-    "justification": (
-        "git-gate found gitleaks findings hidden by # gitleaks:allow; "
-        "approve only for dummy test fixtures or confirmed false positives"
-    ),
-    "arrival_timestamp": datetime.datetime.now(
-        datetime.timezone.utc
-    ).isoformat(),
-    "current_file_hash": hashlib.sha256(payload.encode("utf-8")).hexdigest(),
-}
-queue = Path(queue_dir)
-queue.mkdir(parents=True, exist_ok=True)
-path = queue / f"{proposal_id}.proposal.json"
-tmp = path.with_suffix(path.suffix + ".tmp")
-with tmp.open("w", encoding="utf-8") as f:
-    json.dump(proposal, f, indent=2)
-    f.write("\n")
-os.chmod(tmp, 0o600)
-os.replace(tmp, path)
-print(proposal_id)
-PY
-  )
-  rc=$?
-  rm -f "$report_file"
-  if [ "$rc" -eq 0 ] && [ -z "$proposal_id" ]; then
-    return 0
-  fi
-  if [ "$rc" -ne 0 ]; then
-    echo "git-gate: cannot route # gitleaks:allow finding to supervisor; refusing push" >&2
-    return 1
-  fi
-
-  queue_dir=${SUPERVISE_QUEUE_DIR:-}
-  response_file="$queue_dir/${proposal_id}.response.json"
-  timeout=${SUPERVISE_GITLEAKS_ALLOW_TIMEOUT_SECONDS:-300}
-  case "$timeout" in
-    ''|*[!0-9]*)
-      echo "git-gate: invalid SUPERVISE_GITLEAKS_ALLOW_TIMEOUT_SECONDS=$timeout" >&2
-      return 1
-      ;;
-  esac
-  echo "git-gate: queued # gitleaks:allow supervisor approval $proposal_id" >&2
-  echo "git-gate: approve with './cli.py supervise' to continue this push" >&2
-  waited=0
-  while [ "$waited" -lt "$timeout" ]; do
-    if [ -f "$response_file" ]; then
-      status=$(python3 - "$response_file" <<'PY'
-import json
-import sys
-try:
-    with open(sys.argv[1], encoding="utf-8") as f:
-        raw = json.load(f)
-except (OSError, json.JSONDecodeError):
-    sys.exit(1)
-status = raw.get("status")
-if not isinstance(status, str):
-    sys.exit(1)
-print(status)
-PY
-      ) || status=""
-      case "$status" in
-        approved|modified)
-          mkdir -p "$queue_dir/processed"
-          mv -f "$queue_dir/${proposal_id}.proposal.json" "$queue_dir/processed/" 2>/dev/null || true
-          mv -f "$queue_dir/${proposal_id}.response.json" "$queue_dir/processed/" 2>/dev/null || true
-          echo "git-gate: supervisor approved # gitleaks:allow for $ref" >&2
-          return 0
-          ;;
-        rejected)
-          echo "git-gate: supervisor rejected # gitleaks:allow for $ref" >&2
-          return 1
-          ;;
-        *)
-          echo "git-gate: invalid supervisor response for # gitleaks:allow" >&2
-          return 1
-          ;;
-      esac
-    fi
-    sleep 1
-    waited=$((waited + 1))
-  done
-  echo "git-gate: supervisor approval timed out for # gitleaks:allow; refusing push" >&2
-  return 1
-}
-
 # Phase 1: gitleaks scan each ref's incoming commits.
 while IFS=' ' read -r old new ref; do
  [ -z "$ref" ] && continue
@@ -426,9 +268,6 @@ while IFS=' ' read -r old new ref; do
    echo "git-gate: gitleaks rejected push to $ref" >&2
    exit 1
  fi
-  if ! supervise_gitleaks_allow "$log_opts" "$ref"; then
-    exit 1
-  fi
 done < "$refs_file"

 # Phase 2: forward each ref to the upstream (`origin`, configured
@@ -19,7 +19,7 @@ Bottle schema (frontmatter):
    repos:      { <name>: <git-gate-entry>, ... }  # optional
  egress: { routes: [ <egress-route>, ... ] }
    # route keys: host, matches, auth, role, dlp
-  supervise:    <bool>                          # optional (default true)
+  supervise:    <bool>                          # optional

 Agent schema (frontmatter):
  bottle:        <bottle-name>          # required
@@ -111,13 +111,13 @@ class ManifestBottle:
    # identity without any git-gate.repos upstreams, and vice versa.
    git_user: ManifestGitUser = field(default_factory=ManifestGitUser)
    egress: ManifestEgressConfig = field(default_factory=ManifestEgressConfig)
-    # Per-bottle stuck-recovery sidecar (PRD 0013). When true (the
-    # default, issue #249), the launch step brings up a supervise
-    # sidecar that exposes MCP tools to the agent (egress-block,
-    # capability-block) plus mounts the current-config dir read-only
-    # into the agent at /etc/bot-bottle/current-config. Set
-    # `supervise: false` to skip the sidecar and mount.
-    supervise: bool = True
+    # Opt-in per-bottle stuck-recovery sidecar (PRD 0013). When true,
+    # the launch step brings up a supervise sidecar that exposes MCP
+    # tools to the agent (egress-block, capability-block) plus mounts
+    # the current-config dir read-only into the agent at
+    # /etc/bot-bottle/current-config. False (the default) skips the
+    # sidecar and mount.
+    supervise: bool = False

    @classmethod
    def from_dict(cls, name: str, raw: object) -> "ManifestBottle":
@@ -190,7 +190,7 @@ class ManifestBottle:
            else ManifestEgressConfig()
        )

-        supervise_raw = d.get("supervise", True)
+        supervise_raw = d.get("supervise", False)
        if not isinstance(supervise_raw, bool):
            raise ManifestError(
                f"bottle '{name}' supervise must be a boolean "
@@ -5,7 +5,7 @@ queue/audit support. The sidecar (bot_bottle.supervise_server)
 sits on the bottle's internal network and exposes three MCP tools the
 agent calls when it hits a stuck-recovery category:

-  * egress-block / allow — agent proposes a new routes.yaml
+  * egress-block — agent proposes a new routes.yaml
  * capability-block — agent proposes a new agent Dockerfile

 Each tool call: the agent passes the full proposed file plus a
@@ -49,36 +49,27 @@ SUPERVISE_HOSTNAME = "supervise"
 SUPERVISE_PORT = 9100

 TOOL_CAPABILITY_BLOCK = "capability-block"
-TOOL_EGRESS_BLOCK = "egress-block"
-TOOL_ALLOW = "allow"
-TOOL_GITLEAKS_ALLOW = "gitleaks-allow"
 TOOL_LIST_EGRESS_ROUTES = "list-egress-routes"
 TOOLS: tuple[str, ...] = (
-    TOOL_ALLOW,
    TOOL_CAPABILITY_BLOCK,
-    TOOL_EGRESS_BLOCK,
-    TOOL_GITLEAKS_ALLOW,
    TOOL_LIST_EGRESS_ROUTES,
 )

 # The supervise sidecar uses these to query egress's
 # introspection endpoint for the `list-egress-routes` MCP
 # tool. The hostname + port match egress's docker network
-# listen port (see backend.docker.egress.EGRESS_PORT). The supervise
-# daemon runs inside the sidecar bundle alongside egress, so loopback
-# is the stable address across docker, smolmachines, and Apple
-# Container backends.
-EGRESS_FORWARD_PROXY = "http://127.0.0.1:9099"
+# alias + listen port (see bot_bottle.egress.EGRESS_HOSTNAME
+# and backend.docker.egress.EGRESS_PORT — the values
+# are inlined here so the in-container supervise_server doesn't
+# need to import the egress package).
+EGRESS_FORWARD_PROXY = "http://egress:9099"
 EGRESS_INTROSPECT_URL = "http://_egress.local/allowlist"

 # capability-block has no on-disk config the operator edits in place
 # (the Dockerfile is rebuilt, not patched), so it has no audit log
-# here — those changes are captured by git history + the rebuild record
-# laid down in PRD 0016.
-COMPONENT_FOR_TOOL: dict[str, str] = {
-    TOOL_ALLOW: "egress",
-    TOOL_EGRESS_BLOCK: "egress",
-}
+# here — those changes are captured by git history + the rebuild
+# record laid down in PRD 0016. egress-block was removed in issue #198.
+COMPONENT_FOR_TOOL: dict[str, str] = {}

 STATUS_APPROVED = "approved"
 STATUS_MODIFIED = "modified"
@@ -440,9 +431,9 @@ def sha256_hex(content: str) -> str:
 # Dockerfile and propose modifications.
 #
 # routes.yaml + allowlist used to live here too; PRD 0017 chunk 3
-# moved them behind the `list-egress-routes` MCP tool (live state
-# from egress's introspection endpoint) so the agent always sees
-# current data rather than a launch-time snapshot.
+# moved them behind the `list-egress-routes` MCP tool (live
+# state from egress's introspection endpoint) so the agent
+# always sees current data rather than a launch-time snapshot.
 CURRENT_CONFIG_DOCKERFILE = "Dockerfile"


@@ -555,7 +546,6 @@ __all__ = [
    "EGRESS_FORWARD_PROXY",
    "EGRESS_INTROSPECT_URL",
    "TOOL_CAPABILITY_BLOCK",
-    "TOOL_GITLEAKS_ALLOW",
    "TOOL_LIST_EGRESS_ROUTES",
    "archive_proposal",
    "audit_dir",
@@ -1,8 +1,8 @@
 """Supervise sidecar HTTP server (PRD 0013).

 Per-bottle MCP server exposing tools the agent calls to propose config
-changes when stuck. The tools are `allow`, `egress-block`,
-`capability-block`, and `list-egress-routes`.
+changes when stuck. The egress-block tool was removed in issue #198;
+the remaining tools are `capability-block` and `list-egress-routes`.

 Each queued tool call:

@@ -44,15 +44,9 @@ import urllib.request
 from dataclasses import dataclass
 from pathlib import Path

-try:
-    # Same-directory imports inside the bundle container; these files are
-    # COPYed flat under /app by Dockerfile.sidecars.
-    from egress_addon_core import load_routes
-    import supervise as _sv
-except ModuleNotFoundError:
-    # Package imports for host-side tests and tooling.
-    from .egress_addon_core import load_routes
-    from . import supervise as _sv
+# Same-directory import inside the bundle container; `supervise.py`
+# is COPYed alongside this file by Dockerfile.sidecars.
+import supervise as _sv


 # --- JSON-RPC / MCP plumbing ----------------------------------------------
@@ -148,9 +142,8 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
            "allowlist. Returns JSON with one entry per allowed host, "
            "each carrying its matches rules (if any) and whether "
            "the proxy injects Authorization for the route. Use this "
-            "before composing an `allow` or `egress-block` proposal so "
-            "the new routes file extends the live one rather than "
-            "replacing it."
+            "before composing an `egress-block` proposal so the new "
+            "routes file extends the live one rather than replacing it."
        ),
        "inputSchema": {
            "type": "object",
@@ -158,88 +151,6 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
            "additionalProperties": False,
        },
    },
-    {
-        "name": _sv.TOOL_ALLOW,
-        "description": (
-            "Request operator approval to change the bottle's egress "
-            "allowlist. Pass the full proposed routes.yaml content, not "
-            "just the new host, plus a justification. Use "
-            "`list-egress-routes` first so the proposal preserves existing "
-            "routes."
-        ),
-        "inputSchema": {
-            "type": "object",
-            "properties": {
-                "routes_yaml": {
-                    "type": "string",
-                    "description": (
-                        "Full proposed /etc/egress/routes.yaml content. "
-                        "Each route entry accepts these keys:\n"
-                        "  host: <hostname>  (required)\n"
-                        "  auth_scheme: Bearer|token  (must pair with token_env)\n"
-                        "  token_env: <ENV_VAR_NAME>  (must pair with auth_scheme)\n"
-                        "  matches:  (optional list of match entries)\n"
-                        "    - paths: [{type: prefix|exact|regex, value: /...}]\n"
-                        "      methods: [GET, POST, ...]\n"
-                        "      headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
-                        "  git:  (optional; omit to block git clone/fetch)\n"
-                        "    fetch: true\n"
-                        "  dlp:  (optional DLP scanner overrides)\n"
-                        "    outbound_detectors: [token_patterns, known_secrets]\n"
-                        "    inbound_detectors: [naive_injection_detection]\n"
-                        "Omit any key that should use its default. "
-                        "`list-egress-routes` returns routes in this same format."
-                    ),
-                },
-                "justification": {
-                    "type": "string",
-                    "description": "Why this egress route is needed.",
-                },
-            },
-            "required": ["routes_yaml", "justification"],
-        },
-    },
-    {
-        "name": _sv.TOOL_EGRESS_BLOCK,
-        "description": (
-            "Request operator approval to change the bottle's egress "
-            "allowlist after a blocked outbound request. Pass the full "
-            "proposed routes.yaml content plus a justification. Use "
-            "`list-egress-routes` first so the proposal preserves existing "
-            "routes."
-        ),
-        "inputSchema": {
-            "type": "object",
-            "properties": {
-                "routes_yaml": {
-                    "type": "string",
-                    "description": (
-                        "Full proposed /etc/egress/routes.yaml content. "
-                        "Each route entry accepts these keys:\n"
-                        "  host: <hostname>  (required)\n"
-                        "  auth_scheme: Bearer|token  (must pair with token_env)\n"
-                        "  token_env: <ENV_VAR_NAME>  (must pair with auth_scheme)\n"
-                        "  matches:  (optional list of match entries)\n"
-                        "    - paths: [{type: prefix|exact|regex, value: /...}]\n"
-                        "      methods: [GET, POST, ...]\n"
-                        "      headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
-                        "  git:  (optional; omit to block git clone/fetch)\n"
-                        "    fetch: true\n"
-                        "  dlp:  (optional DLP scanner overrides)\n"
-                        "    outbound_detectors: [token_patterns, known_secrets]\n"
-                        "    inbound_detectors: [naive_injection_detection]\n"
-                        "Omit any key that should use its default. "
-                        "`list-egress-routes` returns routes in this same format."
-                    ),
-                },
-                "justification": {
-                    "type": "string",
-                    "description": "Why this egress route is needed.",
-                },
-            },
-            "required": ["routes_yaml", "justification"],
-        },
-    },
    {
        "name": _sv.TOOL_CAPABILITY_BLOCK,
        "description": (
@@ -271,12 +182,11 @@ TOOL_DEFINITIONS: list[dict[str, object]] = [
 ]


-# Map each proposal tool to the input field that carries the agent's
-# payload (stored in Proposal.proposed_file).
+# Map each non-egress tool to the input field that carries the agent's
+# payload (stored in Proposal.proposed_file). egress-block builds its
+# payload from structured input fields in `handle_egress_block`.
 PROPOSED_FILE_FIELD: dict[str, str] = {
-    _sv.TOOL_ALLOW: "routes_yaml",
    _sv.TOOL_CAPABILITY_BLOCK: "dockerfile",
-    _sv.TOOL_EGRESS_BLOCK: "routes_yaml",
 }


@@ -293,14 +203,6 @@ def validate_proposed_file(tool: str, content: str) -> None:
        # Dockerfiles are too varied to validate syntactically beyond
        # non-empty. The operator reads the diff in the TUI.
        pass
-    elif tool in (_sv.TOOL_ALLOW, _sv.TOOL_EGRESS_BLOCK):
-        try:
-            load_routes(content)
-        except ValueError as e:
-            raise _RpcError(
-                ERR_INVALID_PARAMS,
-                f"{tool}: proposed routes.yaml is not valid: {e}",
-            ) from e
    else:
        raise _RpcError(ERR_INVALID_PARAMS, f"unknown tool {tool!r}")

@@ -1,101 +0,0 @@
-# PRD 0061: Gitleaks inline suppression supervision
-
- **Status:** Active
- **Author:** codex
- **Created:** 2026-06-10
- **Issue:** #208
-
-## Summary
-
-Route every `# gitleaks:allow` inline suppression through the existing
-supervisor approval queue before git-gate forwards a push upstream. The
-annotation remains available for test fixtures and confirmed false positives,
-but it no longer lets an agent silently bypass the gate's secret scan.
-
-## Problem
-
-Gitleaks supports inline suppression comments. With the default behaviour,
-a pushed line that contains a secret-like value and `# gitleaks:allow` is
-ignored by gitleaks and accepted by git-gate. That is convenient for dummy
-credentials in tests, but it also gives an agent a one-line bypass for a real
-secret. Once the commit lands, the diff alone cannot prove whether the
-suppression was legitimate.
-
-## Goals / Success Criteria
-
-1. Git-gate continues to run the normal gitleaks scan for every incoming ref.
-2. After the normal scan passes, git-gate runs a second scan with
-   `--ignore-gitleaks-allow` and a JSON report so suppressed findings become
-   visible.
-3. If that second scan reports no suppressed findings, the push proceeds
-   unchanged.
-4. If it reports suppressed findings, git-gate creates a `gitleaks-allow`
-   supervisor proposal containing the ref, file path, line number, rule,
-   commit, and flagged line for each finding.
-5. The push proceeds only when the supervisor explicitly approves the
-   proposal; rejection, malformed responses, missing supervisor configuration,
-   and timeout all refuse the push.
-6. The supervisor TUI requires a reason when approving a `gitleaks-allow`
-   proposal, so the audit trail records whether the approval was for a test
-   fixture or a false positive.
-
-## Non-goals
-
- Replacing gitleaks or changing the main secret-detection rule set.
- Removing support for `# gitleaks:allow`.
- Automatically classifying fixture files or false positives.
- Adding new supervisor transport or authentication mechanisms.
-
-## Design
-
-### Git-gate flow
-
-`git_gate_render_hook()` emits a `supervise_gitleaks_allow` shell helper.
-For each incoming ref, git-gate first runs the existing gitleaks command. If
-that scan passes, it runs:
-
-```sh
-gitleaks git \
-  --log-opts="$log_opts" \
-  --no-banner \
-  --redact \
-  --ignore-gitleaks-allow \
-  --report-format=json \
-  --report-path="$report_file" \
-  --exit-code 0
-```
-
-The second pass keeps the push path non-interactive while producing a report
-of findings that would otherwise have been hidden by inline suppression.
-
-### Supervisor proposal
-
-When the JSON report contains findings, an embedded Python helper writes a
-proposal into `SUPERVISE_QUEUE_DIR` using the existing proposal schema. The
-proposal uses:
-
- `tool: "gitleaks-allow"`
- a text payload with the ref and each finding's file, line, rule, commit,
-  and redacted code line
- a justification that tells the operator to approve only dummy test fixtures
-  or confirmed false positives
-
-Git-gate then waits for `<proposal-id>.response.json` for
-`SUPERVISE_GITLEAKS_ALLOW_TIMEOUT_SECONDS`, defaulting to 300 seconds.
-`approved` and `modified` responses allow the push; `rejected`, invalid
-responses, invalid timeout configuration, or timeout refuse it.
-
-### Supervisor UI
-
-`TOOL_GITLEAKS_ALLOW` is added to the supervisor tool registry. The curses
-supervisor renders the proposal as text and allows approval or rejection.
-Modification is unavailable for this proposal type because there is no file
-patch to apply. Approval from the TUI prompts for a non-empty reason and
-writes that reason to the response/audit path.
-
-### Tests
-
-Unit tests assert that the rendered git-gate hook includes the second gitleaks
-pass, supervisor queue fields, and fail-closed messages. Supervisor tests cover
-the new tool constant, proposal archiving, and the required TUI approval
-reason.
@@ -1,4 +1,4 @@
-# PRD 0060: Commit bottle state to an image
+# PRD prd-new: Commit bottle state to an image

 - **Status:** Active
 - **Author:** Claude
@@ -1,75 +0,0 @@
-# PRD prd-new: Install script
-
- **Status:** Active
- **Author:** didericis
- **Created:** 2026-06-06
- **Issue:** #197
-
-## Summary
-
-Add a proper Python package distribution and a thin `install.sh` bootstrapper so users can install bot-bottle with a single command without cloning the repo.
-
-## Problem
-
-There is currently no install path for new users. The only way to run bot-bottle is to clone the repo and invoke `cli.py` directly. This blocks any HN-style public demo: readers want `curl | sh` or `pipx install`, not a manual clone-and-configure flow.
-
-## Goals / Success Criteria
-
- `curl -fsSL <url>/install.sh | sh` (or equivalent) leaves a working `bot-bottle` command on PATH.
- Python-native users can install with `pipx install bot-bottle` or `uv tool install bot-bottle`.
- `install.sh` validates prerequisites (Python ≥ 3.11, Docker) and exits with a clear message if they are missing. It does not silently install Docker.
- `install.sh` runs `bot-bottle doctor` (or equivalent diagnostic) after install to confirm the environment is ready.
- The package has no runtime pip dependencies (stdlib-only, matching the existing constraint).
-
-## Non-goals
-
- Bundling a Python runtime or producing a standalone binary.
- Automatic Docker installation.
- Plugin architecture changes (out of scope; see issue #197 for future direction).
- Publishing to PyPI in this PR — the package structure is the deliverable; publishing is a separate step.
-
-## Design
-
-### Package structure
-
-Add a minimal `pyproject.toml` at the repo root:
-
-```toml
-[project]
-name = "bot-bottle"
-version = "0.1.0"
-requires-python = ">=3.11"
-dependencies = []
-
-[project.scripts]
-bot-bottle = "bot_bottle.cli:main"
-```
-
-The existing `bot_bottle/` package and `cli.py` entry point already contain the logic; this just wires up the standard entry point. `cli.py` may need a small refactor to expose a `main()` callable if it uses `if __name__ == "__main__"` only.
-
-### `install.sh`
-
-A thin bootstrapper that:
-
-1. Checks `python3 --version` ≥ 3.11; exits with instructions if not met.
-2. Checks `docker info` exits 0; exits with instructions if Docker is not running.
-3. Installs via `pipx` if available, otherwise falls back to `pip install --user`.
-4. Runs `bot-bottle doctor` to verify the install.
-
-The script must be idempotent (safe to re-run) and must not require `sudo`.
-
-### `bot-bottle doctor`
-
-A new subcommand that checks and reports:
-
- Python version.
- Docker daemon reachability.
- Whether `~/.bot-bottle/` config directory exists.
-
-Exits 0 if all checks pass, non-zero otherwise.
-
-## Decisions
-
- `install.sh` is hosted from the repo's raw Gitea URL for now:
-  `https://gitea.dideric.is/didericis/bot-bottle/raw/branch/main/install.sh`.
- Should `version` in `pyproject.toml` be driven by a git tag at build time (e.g. via `hatch-vcs`) or kept as a static string? Static is simpler for now.
@@ -1,14 +1,14 @@
 ---
 agent_provider:
  template: claude
-  # auth_token names the host env var holding the Claude OAuth token. The
-  # provider injects a provider-owned api.anthropic.com egress route that
-  # re-injects this token as the Bearer header; the agent only ever sees a
-  # placeholder CLAUDE_CODE_OAUTH_TOKEN. DLP defaults (token_patterns,
-  # known_secrets outbound; naive_injection_detection inbound) apply to
-  # that route. To scan additional hosts, declare them under egress.routes
-  # with per-route matches/dlp (see README "Egress route fields").
-  auth_token: BOT_BOTTLE_CLAUDE_OAUTH_TOKEN
+
+egress:
+  routes:
+    - host: api.anthropic.com
+      role: claude_code_oauth
+      auth:
+        scheme: Bearer
+        token_ref: BOT_BOTTLE_CLAUDE_OAUTH_TOKEN
 ---

 Common Claude provider boundary. Drop this file into
@@ -1,50 +0,0 @@
-#!/bin/sh
-set -eu
-
-PACKAGE_SPEC="${BOT_BOTTLE_INSTALL_SPEC:-git+https://gitea.dideric.is/didericis/bot-bottle.git}"
-MIN_PYTHON="3.11"
-
-say() {
-    printf 'bot-bottle install: %s\n' "$*" >&2
-}
-
-die() {
-    say "error: $*"
-    exit 1
-}
-
-command -v python3 >/dev/null 2>&1 || die "python3 is required (version ${MIN_PYTHON} or newer)"
-
-python3 - <<'PY' || die "python3 3.11 or newer is required"
-import sys
-
-raise SystemExit(0 if sys.version_info >= (3, 11) else 1)
-PY
-
-command -v docker >/dev/null 2>&1 || die "Docker is required; install Docker and start the daemon, then re-run this script"
-docker info >/dev/null 2>&1 || die "Docker is installed but the daemon is not reachable; start Docker and re-run this script"
-
-mkdir -p \
-    "${HOME}/.bot-bottle/agents" \
-    "${HOME}/.bot-bottle/bottles" \
-    "${HOME}/.bot-bottle/contrib"
-
-if command -v pipx >/dev/null 2>&1; then
-    say "installing with pipx"
-    pipx install --force "${PACKAGE_SPEC}"
-else
-    say "pipx not found; installing with python3 -m pip --user"
-    python3 -m pip install --user --upgrade "${PACKAGE_SPEC}"
-fi
-
-if command -v bot-bottle >/dev/null 2>&1; then
-    BOT_BOTTLE_BIN="bot-bottle"
-elif [ -x "${HOME}/.local/bin/bot-bottle" ]; then
-    BOT_BOTTLE_BIN="${HOME}/.local/bin/bot-bottle"
-    say "using ${BOT_BOTTLE_BIN}; add ${HOME}/.local/bin to PATH for future shells"
-else
-    die "bot-bottle was installed but is not on PATH"
-fi
-
-say "running bot-bottle doctor"
-"${BOT_BOTTLE_BIN}" doctor
@@ -1,27 +0,0 @@
-[build-system]
-requires = ["setuptools>=68"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "bot-bottle"
-version = "0.1.0"
-description = "Self-hosted sandbox for AI coding agents with egress controls"
-readme = "README.md"
-requires-python = ">=3.11"
-license = { text = "Apache-2.0" }
-dependencies = []
-
-[project.scripts]
-bot-bottle = "bot_bottle.cli:main"
-
-[tool.setuptools.packages.find]
-include = ["bot_bottle*"]
-
-[tool.setuptools.package-data]
-bot_bottle = [
-    "Dockerfile.sidecars",
-    "egress_entrypoint.sh",
-    "contrib/claude/Dockerfile",
-    "contrib/codex/Dockerfile",
-    "contrib/pi/Dockerfile",
-]
@@ -1,51 +0,0 @@
-"""Unit: `bot-bottle doctor` host prerequisite checks."""
-
-from __future__ import annotations
-
-import tempfile
-import unittest
-from pathlib import Path
-from unittest.mock import MagicMock, patch
-
-from bot_bottle.cli import doctor
-
-
-class TestDoctor(unittest.TestCase):
-    def test_success_when_prerequisites_present(self):
-        with tempfile.TemporaryDirectory() as tmp, patch.object(
-            doctor.Path, "home", return_value=Path(tmp),
-        ), patch.object(
-            doctor.shutil, "which", return_value="/usr/bin/docker",
-        ), patch.object(
-            doctor.subprocess, "run",
-            return_value=MagicMock(returncode=0),
-        ):
-            Path(tmp, ".bot-bottle").mkdir()
-            self.assertEqual(0, doctor.cmd_doctor([]))
-
-    def test_missing_config_fails(self):
-        with tempfile.TemporaryDirectory() as tmp, patch.object(
-            doctor.Path, "home", return_value=Path(tmp),
-        ), patch.object(
-            doctor.shutil, "which", return_value="/usr/bin/docker",
-        ), patch.object(
-            doctor.subprocess, "run",
-            return_value=MagicMock(returncode=0),
-        ):
-            self.assertEqual(1, doctor.cmd_doctor([]))
-
-    def test_missing_docker_fails_before_daemon_check(self):
-        with tempfile.TemporaryDirectory() as tmp, patch.object(
-            doctor.Path, "home", return_value=Path(tmp),
-        ), patch.object(
-            doctor.shutil, "which", return_value=None,
-        ), patch.object(
-            doctor.subprocess, "run",
-        ) as run:
-            Path(tmp, ".bot-bottle").mkdir()
-            self.assertEqual(1, doctor.cmd_doctor([]))
-            run.assert_not_called()
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -301,19 +301,6 @@ class TestSidecarBundleShape(unittest.TestCase):
        self.assertEqual("bot-bottle-sidecars:latest", sc["image"])
        self.assertEqual("Dockerfile.sidecars", sc["build"]["dockerfile"])

-    def test_bundle_uses_packaged_dockerfile_when_root_missing(self):
-        from bot_bottle.backend.docker import compose as compose_mod
-
-        original = compose_mod._REPO_DIR
-        try:
-            compose_mod._REPO_DIR = "/tmp/does-not-exist"
-            self.assertEqual(
-                "bot_bottle/Dockerfile.sidecars",
-                compose_mod._sidecar_bundle_dockerfile(),
-            )
-        finally:
-            compose_mod._REPO_DIR = original
-
    def test_bundle_container_name_uses_sidecars_prefix(self):
        sc = self._render()["services"]["sidecars"]
        self.assertEqual(f"bot-bottle-sidecars-{SLUG}", sc["container_name"])
@@ -405,7 +392,7 @@ class TestSidecarBundleShape(unittest.TestCase):
            "services"]["sidecars"]
        targets = {v["target"] for v in sc["volumes"]}
        self.assertIn("/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem", targets)
-        self.assertIn("/etc/egress", targets)
+        self.assertIn("/etc/egress/routes.yaml", targets)
        self.assertIn("/git-gate-entrypoint.sh", targets)
        self.assertIn("/git-gate/creds/upstream-known_hosts", targets)
        self.assertTrue(any("supervise/queue" in t or t.startswith("/run/supervise")
@@ -292,10 +292,10 @@ class TestCodexSuperviseMcp(unittest.TestCase):
        bottle.exec.assert_called_once()
        script = bottle.exec.call_args.args[0]
        self.assertEqual("node", bottle.exec.call_args.kwargs.get("user"))
-        self.assertEqual(
-            f"codex mcp add supervise --url {_URL}",
-            script,
-        )
+        self.assertIn("codex mcp add", script)
+        self.assertIn("--transport http", script)
+        self.assertIn("supervise", script)
+        self.assertIn(_URL, script)

    def test_logs_warning_on_failure_but_does_not_raise(self):
        bottle = _make_bottle(
@@ -2,15 +2,12 @@
 add_route removed; docker exec / cp / kill paths are covered by the
 integration test)."""

-import tempfile
 import unittest
-from pathlib import Path
-from types import SimpleNamespace
-from unittest.mock import patch

-from bot_bottle import supervise
-from bot_bottle.backend.egress_apply import EgressApplyError
-from bot_bottle.backend.docker.egress_apply import applicator
+from bot_bottle.backend.docker.egress_apply import (
+    EgressApplyError,
+    validate_routes_content,
+)


 _ROUTES_EMPTY = "routes: []\n"
@@ -19,11 +16,11 @@ _ROUTES_ONE = 'routes:\n  - host: "api.anthropic.com"\n'

 class TestValidateRoutesContent(unittest.TestCase):
    def test_accepts_minimal_route_table(self):
-        applicator.validate_routes_content(_ROUTES_EMPTY)
-        applicator.validate_routes_content(_ROUTES_ONE)
+        validate_routes_content(_ROUTES_EMPTY)
+        validate_routes_content(_ROUTES_ONE)

    def test_accepts_full_route_with_matches(self):
-        applicator.validate_routes_content(
+        validate_routes_content(
            'routes:\n'
            '  - host: "api.github.com"\n'
            '    auth_scheme: "Bearer"\n'
@@ -35,65 +32,25 @@ class TestValidateRoutesContent(unittest.TestCase):

    def test_rejects_bad_yaml(self):
        with self.assertRaises(EgressApplyError) as cm:
-            applicator.validate_routes_content("routes:\n\t- host: x\n")
+            validate_routes_content("routes:\n\t- host: x\n")
        self.assertIn("not valid", str(cm.exception))

    def test_rejects_missing_routes_key(self):
        with self.assertRaises(EgressApplyError):
-            applicator.validate_routes_content("other: []\n")
+            validate_routes_content("other: []\n")

    def test_rejects_non_list_routes(self):
        with self.assertRaises(EgressApplyError):
-            applicator.validate_routes_content('routes: "not a list"\n')
+            validate_routes_content('routes: "not a list"\n')

    def test_rejects_partial_auth_pair(self):
        with self.assertRaises(EgressApplyError):
-            applicator.validate_routes_content(
+            validate_routes_content(
                'routes:\n'
                '  - host: "x.example"\n'
                '    auth_scheme: "Bearer"\n'
            )


-class TestApplyRoutesChange(unittest.TestCase):
-    def setUp(self):
-        self._tmp = tempfile.TemporaryDirectory(prefix="egress-apply-test.")
-        original = supervise.bot_bottle_root
-
-        def fake_root() -> Path:
-            return Path(self._tmp.name) / ".bot-bottle"
-
-        supervise.bot_bottle_root = fake_root  # type: ignore[assignment]
-        self.addCleanup(lambda: setattr(supervise, "bot_bottle_root", original))
-        self.addCleanup(self._tmp.cleanup)
-
-    def test_writes_live_routes_and_signals_reload(self):
-        calls: list[list[str]] = []
-
-        def fake_run(argv: list[str], **kwargs: object) -> SimpleNamespace:
-            calls.append(list(argv))
-            return SimpleNamespace(returncode=0, stdout="", stderr="")
-
-        with patch(
-            "bot_bottle.backend.docker.egress_apply.subprocess.run",
-            side_effect=fake_run,
-        ):
-            before, after = applicator.apply_routes_change(
-                "dev",
-                "routes:\n  - host: google.com\n",
-            )
-
-        self.assertEqual("", before)
-        self.assertEqual("routes:\n  - host: google.com\n", after)
-        self.assertEqual(
-            "routes:\n  - host: google.com\n",
-            (Path(self._tmp.name) / ".bot-bottle/state/dev/egress/routes.yaml").read_text(encoding="utf-8"),
-        )
-        self.assertEqual(
-            ["docker", "kill", "--signal", "HUP", "bot-bottle-sidecars-dev"],
-            calls[0],
-        )
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -199,30 +199,6 @@ class TestHookRender(unittest.TestCase):
        self.assertIn('set -- "$@" --push-option="$opt"', hook)
        self.assertIn('git push "$@" origin "$refspec"', hook)

-    def test_inline_gitleaks_allow_routes_to_supervisor(self):
-        hook = git_gate_render_hook()
-        # First gitleaks runs normally; only if that passes does the
-        # hook ask gitleaks to ignore inline allow comments and report
-        # the suppressed findings for human approval.
-        self.assertIn("--ignore-gitleaks-allow", hook)
-        self.assertIn("--report-format=json", hook)
-        self.assertIn('"tool": "gitleaks-allow"', hook)
-        self.assertIn("SUPERVISE_QUEUE_DIR", hook)
-        self.assertIn("SUPERVISE_BOTTLE_SLUG", hook)
-        self.assertIn("supervisor approved # gitleaks:allow", hook)
-        self.assertIn("supervisor rejected # gitleaks:allow", hook)
-
-    def test_inline_gitleaks_allow_fails_closed_without_supervisor(self):
-        hook = git_gate_render_hook()
-        self.assertIn(
-            "cannot route # gitleaks:allow finding to supervisor; refusing push",
-            hook,
-        )
-        self.assertIn(
-            "supervisor approval timed out for # gitleaks:allow; refusing push",
-            hook,
-        )
-

 class TestAccessHookRender(unittest.TestCase):
    def test_access_hook_refreshes_origin_on_upload_pack(self):
@@ -1,34 +0,0 @@
-"""Unit: install.sh static contract checks."""
-
-from __future__ import annotations
-
-import subprocess
-import unittest
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[2]
-
-
-class TestInstallScript(unittest.TestCase):
-    def test_shell_syntax(self):
-        result = subprocess.run(
-            ["sh", "-n", str(ROOT / "install.sh")],
-            check=False,
-            capture_output=True,
-            text=True,
-        )
-        self.assertEqual("", result.stderr)
-        self.assertEqual(0, result.returncode)
-
-    def test_contract_phrases(self):
-        script = (ROOT / "install.sh").read_text(encoding="utf-8")
-        self.assertIn("python3", script)
-        self.assertIn("docker info", script)
-        self.assertIn("pipx install --force", script)
-        self.assertIn("pip install --user --upgrade", script)
-        self.assertIn('"${BOT_BOTTLE_BIN}" doctor', script)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -31,7 +31,7 @@ def _plan(
    agent_git_gate_url: str = "",
    agent_supervise_url: str = "",
 ) -> MacosContainerBottlePlan:
-    routes_path = stage_dir / "routes.yaml"
+    routes_path = stage_dir / "source-routes.yaml"
    routes_path.write_text("routes: []\n", encoding="utf-8")
    ca_dir = stage_dir / "egress-ca"
    ca_dir.mkdir(exist_ok=True)
@@ -129,10 +129,15 @@ class TestMacosContainerLaunchArgv(unittest.TestCase):
            f"type=bind,source={self.stage_dir / 'egress-ca'},target=/home/mitmproxy/.mitmproxy",
            argv,
        )
+        routes_dir = self.stage_dir / "macos-container-egress"
        self.assertIn(
-            f"type=bind,source={self.stage_dir},target=/etc/egress,readonly",
+            f"type=bind,source={routes_dir},target=/etc/egress,readonly",
            argv,
        )
+        self.assertEqual(
+            "routes: []\n",
+            (routes_dir / "routes.yaml").read_text(encoding="utf-8"),
+        )
        self.assertIn(
            "type=bind,source=/state/supervise/queue,target=/run/supervise/queue",
            argv,
@@ -1,27 +0,0 @@
-"""Unit: Python package metadata for install script PRD."""
-
-from __future__ import annotations
-
-import tomllib
-import unittest
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[2]
-
-
-class TestPyproject(unittest.TestCase):
-    def test_console_script_and_no_runtime_dependencies(self):
-        data = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
-        project = data["project"]
-        self.assertEqual("bot-bottle", project["name"])
-        self.assertEqual(">=3.11", project["requires-python"])
-        self.assertEqual([], project["dependencies"])
-        self.assertEqual(
-            "bot_bottle.cli:main",
-            project["scripts"]["bot-bottle"],
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -17,7 +17,6 @@ from bot_bottle.supervise import (
    STATUS_MODIFIED,
    STATUS_REJECTED,
    TOOL_CAPABILITY_BLOCK,
-    TOOL_GITLEAKS_ALLOW,
    archive_proposal,
    audit_log_path,
    list_pending_proposals,
@@ -318,23 +317,15 @@ class TestToolConstants(unittest.TestCase):
    def test_tools_tuple_matches_individual_constants(self):
        self.assertEqual(
            (
-                supervise.TOOL_ALLOW,
                TOOL_CAPABILITY_BLOCK,
-                supervise.TOOL_EGRESS_BLOCK,
-                TOOL_GITLEAKS_ALLOW,
                supervise.TOOL_LIST_EGRESS_ROUTES,
            ),
            supervise.TOOLS,
        )

-    def test_component_map_has_egress_entries(self):
-        self.assertEqual(
-            {
-                supervise.TOOL_ALLOW: "egress",
-                supervise.TOOL_EGRESS_BLOCK: "egress",
-            },
-            supervise.COMPONENT_FOR_TOOL,
-        )
+    def test_component_map_has_no_entries(self):
+        # egress-block removed in issue #198; capability-block never had one.
+        self.assertEqual({}, supervise.COMPONENT_FOR_TOOL)


 class _StubSupervise(supervise.Supervise):
@@ -2,6 +2,9 @@

 The curses TUI itself isn't exercised here — these tests cover the
 discovery + approve/reject paths that the TUI's key handlers call into.
+
+egress-block (add_route) was removed in issue #198; the TestEgressApplyWiring
+class and all stubs for add_route have been dropped accordingly.
 """

 import os
@@ -9,7 +12,6 @@ import tempfile
 import unittest
 from datetime import datetime, timezone
 from pathlib import Path
-from unittest.mock import patch

 from bot_bottle import supervise
 from bot_bottle.cli import supervise as supervise_cli
@@ -19,7 +21,6 @@ from bot_bottle.supervise import (
    STATUS_MODIFIED,
    STATUS_REJECTED,
    TOOL_CAPABILITY_BLOCK,
-    TOOL_GITLEAKS_ALLOW,
    read_audit_entries,
    read_response,
    sha256_hex,
@@ -32,9 +33,6 @@ FIXED = datetime(2026, 5, 25, 12, 0, 0, tzinfo=timezone.utc)
 def _proposal(slug: str = "dev", tool: str = TOOL_CAPABILITY_BLOCK) -> Proposal:
    payloads = {
        TOOL_CAPABILITY_BLOCK: "FROM python:3.13\n",
-        supervise.TOOL_ALLOW: "routes:\n  - host: example.com\n",
-        supervise.TOOL_EGRESS_BLOCK: "routes:\n  - host: example.com\n",
-        TOOL_GITLEAKS_ALLOW: "file: tests/test_fixture.py\nline: 3\n",
    }
    payload = payloads.get(tool, "")
    return Proposal.new(
@@ -156,46 +154,6 @@ class TestApproveReject(_FakeHomeMixin, unittest.TestCase):
        supervise_cli.approve(qp)
        self.assertEqual([], read_audit_entries("egress", "dev"))

-    def test_approve_egress_block_writes_audit_log(self):
-        qp = self._enqueue(tool=supervise.TOOL_EGRESS_BLOCK)
-        with patch(
-            "bot_bottle.cli.supervise.apply_routes_change",
-            return_value=("routes: []\n", "routes:\n  - host: example.com\n"),
-        ) as apply_routes_change:
-            supervise_cli.approve(qp)
-        apply_routes_change.assert_called_once_with(
-            "dev",
-            "routes:\n  - host: example.com\n",
-        )
-        entries = read_audit_entries("egress", "dev")
-        self.assertEqual(1, len(entries))
-        self.assertEqual(STATUS_APPROVED, entries[0].operator_action)
-        self.assertEqual("needed for dev", entries[0].justification)
-
-    def test_approve_gitleaks_allow_leaves_response_for_gate(self):
-        qp = self._enqueue(tool=TOOL_GITLEAKS_ALLOW)
-        supervise_cli.approve(qp, notes="dummy fixture")
-        # Gate polls the queue dir for the response; TUI must not archive it.
-        resp = read_response(qp.queue_dir, qp.proposal.id)
-        self.assertEqual(STATUS_APPROVED, resp.status)
-        self.assertEqual("dummy fixture", resp.notes)
-        self.assertFalse((qp.queue_dir / "processed").exists())
-
-    def test_tui_gitleaks_allow_requires_reason(self):
-        qp = self._enqueue(tool=TOOL_GITLEAKS_ALLOW)
-        with patch.object(supervise_cli, "_prompt", return_value=""):
-            status = supervise_cli._approve_from_tui(None, qp)  # type: ignore[arg-type]
-        self.assertEqual("approve aborted (empty reason)", status)
-        self.assertFalse((qp.queue_dir / "processed").exists())
-
-    def test_tui_gitleaks_allow_writes_reason(self):
-        qp = self._enqueue(tool=TOOL_GITLEAKS_ALLOW)
-        with patch.object(supervise_cli, "_prompt", return_value="test fixture"):
-            status = supervise_cli._approve_from_tui(None, qp)  # type: ignore[arg-type]
-        self.assertIn("approved gitleaks-allow", status)
-        resp = read_response(qp.queue_dir, qp.proposal.id)
-        self.assertEqual("test fixture", resp.notes)
-

 # class TestCapabilityApplyWiring(_FakeHomeMixin, unittest.TestCase):
 #     # DISABLED — capability_apply functionality is currently commented out.
@@ -54,19 +54,13 @@ class TestValidation(unittest.TestCase):
        )

    def test_empty_proposed_file_rejected_for_tools_with_file_field(self):
+        # egress-block has structured input (validated in
+        # _validate_and_bundle_egress_route, not here) and
+        # list-egress-routes takes no input. Only capability-block
+        # goes through `validate_proposed_file`.
        with self.assertRaises(_RpcError):
            validate_proposed_file(_sv.TOOL_CAPABILITY_BLOCK, "   \n\t")

-    def test_egress_routes_yaml_is_validated(self):
-        validate_proposed_file(
-            _sv.TOOL_ALLOW,
-            "routes:\n  - host: example.com\n",
-        )
-
-    def test_invalid_egress_routes_yaml_rejected(self):
-        with self.assertRaises(_RpcError):
-            validate_proposed_file(_sv.TOOL_EGRESS_BLOCK, "routes: nope\n")
-

 # --- JSON-RPC parsing ------------------------------------------------------

@@ -147,9 +141,7 @@ class TestHandleToolsList(unittest.TestCase):
        names = [t["name"] for t in result["tools"]]  # type: ignore[index]
        self.assertEqual(
            sorted([
-                _sv.TOOL_ALLOW,
                _sv.TOOL_CAPABILITY_BLOCK,
-                _sv.TOOL_EGRESS_BLOCK,
                _sv.TOOL_LIST_EGRESS_ROUTES,
            ]),
            sorted(names),
@@ -180,17 +172,6 @@ class TestHandleToolsList(unittest.TestCase):
        # No `required` array because no inputs are required.
        self.assertNotIn("required", schema)  # type: ignore[operator]

-    def test_egress_tools_take_routes_yaml_and_justification(self):
-        for tool_name in (_sv.TOOL_ALLOW, _sv.TOOL_EGRESS_BLOCK):
-            with self.subTest(tool_name=tool_name):
-                tool = next(t for t in TOOL_DEFINITIONS if t["name"] == tool_name)
-                schema = tool["inputSchema"]
-                self.assertEqual("object", schema["type"])  # type: ignore[index]
-                self.assertEqual(
-                    ["routes_yaml", "justification"],
-                    schema["required"],  # type: ignore[index]
-                )
-

 class TestHandleToolsCall(unittest.TestCase):
    def setUp(self):
@@ -239,26 +220,6 @@ class TestHandleToolsCall(unittest.TestCase):
        self.assertIn("status: approved", text)
        self.assertIn("notes: lgtm", text)

-    def test_allow_round_trips_through_queue(self):
-        responder = self._respond_when_proposal_appears(_sv.STATUS_APPROVED, notes="ok")
-        try:
-            result = handle_tools_call(
-                {
-                    "name": _sv.TOOL_ALLOW,
-                    "arguments": {
-                        "routes_yaml": "routes:\n  - host: example.com\n",
-                        "justification": "need example.com",
-                    },
-                },
-                self.config,
-            )
-        finally:
-            responder.join()
-        self.assertFalse(result["isError"])  # type: ignore[index]
-        text = result["content"][0]["text"]  # type: ignore[index]
-        self.assertIn("status: approved", text)
-        self.assertIn("notes: ok", text)
-
    def test_rejected_response_sets_isError(self):
        responder = self._respond_when_proposal_appears(_sv.STATUS_REJECTED, notes="nope")
        try:
@@ -451,8 +412,7 @@ class TestHttpEndToEnd(unittest.TestCase):
        self.assertEqual(1, result["id"])
        names = [t["name"] for t in result["result"]["tools"]]  # type: ignore[index]
        self.assertIn(_sv.TOOL_CAPABILITY_BLOCK, names)
-        self.assertIn(_sv.TOOL_ALLOW, names)
-        self.assertIn(_sv.TOOL_EGRESS_BLOCK, names)
+        self.assertNotIn("egress-block", names)

    def test_unknown_method_returns_jsonrpc_error(self):
        result = self._post_jsonrpc(
Author	SHA1	Message	Date
didericis-claude	828101412c	fix(smolmachines): exclude /tmp+/var/tmp from snapshot; mkdir -p on boot lint / lint (push) Successful in 1m41s Details test / unit (pull_request) Successful in 32s Details test / integration (pull_request) Successful in 17s Details On resume from a committed snapshot, smolvm's pack process remaps all file uids to the host uid (501 on macOS). Files in /tmp that were created during the session (e.g. /tmp/claude-1000 owned by node=uid 1000) get remapped to 501. Claude Code then refuses to use the temp directory because it's owned by a different uid. Two-part fix: - Exclude ./tmp and ./var/tmp from the tar in _exec_tar_to_file. Both directories are ephemeral; a resumed VM should start with clean temp directories identical to a fresh VM. - Add mkdir -p /tmp /var/tmp to _init_vm before chown/chmod, so the directories are created if the committed snapshot omitted them.	2026-06-23 18:06:41 +00:00
didericis-claude	3372e6259b	fix(smolmachines): write tar to VM file then machine_cp to host lint / lint (push) Successful in 1m41s Details test / unit (pull_request) Successful in 34s Details test / integration (pull_request) Successful in 19s Details Replace the Popen/stdout=PIPE approach with a write-then-copy strategy that avoids binary-stdout piping through the smolvm exec channel entirely: 1. Probe connectivity with `machine_exec(machine, ["true"])` first. If this fails while an interactive session is running, the error now says "concurrent exec not available" instead of the opaque "<no stderr>". 2. Run `tar --create --gzip --file=/var/tmp/.bot-bottle-commit.tar.gz` inside the VM via machine_exec (same mechanism used during provisioning). tar writes to a file in the VM, not stdout, so smolvm never has to transmit binary data over the exec channel. 3. Copy the compressed archive to the host with machine_cp. 4. Dockerfile switches to ADD rootfs.tar.gz / — Docker decompresses gzip tarballs automatically.	2026-06-23 16:37:43 +00:00
didericis-claude	d6a5c72ac7	fix(smolmachines): pipe tar stdout via PIPE not file fd lint / lint (push) Successful in 1m39s Details test / unit (pull_request) Successful in 32s Details test / integration (pull_request) Successful in 17s Details smolvm machine exec requires stdout to be a pipe, not a regular file descriptor. Passing stdout=file caused smolvm to return non-zero with no stderr (the error was silently swallowed or went to the regular-file fd instead of reaching us). Switch _snapshot_running_vm to a new _exec_tar_to_file helper that uses Popen with stdout=PIPE and streams the tar to disk via shutil.copyfileobj. A background thread drains stderr concurrently to prevent deadlock when the stderr pipe buffer fills while we are writing stdout data.	2026-06-23 09:15:17 +00:00
didericis-claude	7d531502d8	fix(smolmachines): use sh -c not sh -lc in exec_agent lint / lint (push) Successful in 1m39s Details test / unit (pull_request) Successful in 30s Details test / integration (pull_request) Successful in 15s Details The terminal-decoration wrapper script is invoked with sh -lc, which sources login-shell init files (/etc/profile, ~/.profile) rather than interactive-shell files (~/.zshrc). smolvm is typically installed via homebrew whose PATH setup lands in ~/.zprofile or ~/.zshrc — not picked up by sh -l — so pty_resize.py's Popen(["smolvm", ...]) raises FileNotFoundError, pty_resize exits non-zero, and the trailing reset- printf makes sh exit 0. The caller sees "session ended (exit 0)" immediately with no agent output. Use sh -c instead. The calling process (./cli.py) inherits the user's interactive shell PATH where smolvm is present, confirmed by the provision steps (machine_exec) succeeding before exec_agent is reached.	2026-06-23 09:04:35 +00:00
didericis-claude	7df77495b6	fix(smolmachines): commit via exec-tar instead of stop→pack lint / lint (push) Successful in 1m37s Details test / unit (pull_request) Successful in 33s Details test / integration (pull_request) Successful in 15s Details smolvm pack create --from-vm requires the VM to be stopped, and stopping a smolmachines VM terminates any running interactive session. Instead, mirror the macos-container approach: exec into the running VM as root and stream the root filesystem via tar (smolvm machine exec -- tar), build a Docker image from the archive, push to an ephemeral local registry, and run smolvm pack create --image to produce the .smolmachine artifact. The VM stays running throughout the commit. Remove the stop-confirm prompt and machine_is_running check that were added in the previous commit — neither is needed when we no longer stop.	2026-06-23 08:57:06 +00:00
didericis-claude	5f473eb842	fix(smolmachines): stop VM before pack commit, with confirm prompt lint / lint (push) Successful in 1m37s Details test / unit (pull_request) Successful in 30s Details test / integration (pull_request) Successful in 15s Details smolvm pack create --from-vm requires the VM to be stopped. Add machine_is_running() to smolvm.py (via machine ls --json state field), and add the same confirm-stop flow to SmolmachinesFreezer that was originally designed for macos-container: if running, prompt the user, stop the VM, then pack. Already-stopped VMs are packed directly.	2026-06-23 08:42:03 +00:00
didericis-claude	4695e51bae	test: update macos-container tests for exec-tar commit approach lint / lint (push) Successful in 1m39s Details test / unit (pull_request) Successful in 31s Details test / integration (pull_request) Successful in 16s Details - Rename export test to reflect new exec-tar mechanism; update argv assertions to match the new `container exec ... tar` command shape - Change mock stderr from str to bytes (subprocess.PIPE without text=True) - Add type annotation to capture_freeze closure to satisfy pyright	2026-06-23 08:27:01 +00:00
didericis-claude	7fc5a3af66	fix(macos-container): commit via exec-tar instead of stop→export lint / lint (push) Failing after 1m41s Details test / unit (pull_request) Failing after 34s Details test / integration (pull_request) Successful in 18s Details Apple Container removes containers when they stop, making the stop-then-export flow impossible regardless of the --rm flag. Replace `container export` (requires stopped container) with `container exec --user root <name> tar --create ... --file=- --directory=/ .` streamed to a temp file, then build the committed image from that archive as before. The bottle stays running after commit, which is better UX. Drop the stop-confirm prompt from MacosContainerFreezer since we no longer need to stop the container at all.	2026-06-23 08:18:18 +00:00
didericis-claude	f2f82910c9	fix(macos-container): remove --rm from agent run so commit can export lint / lint (push) Failing after 1m36s Details test / unit (pull_request) Successful in 32s Details test / integration (pull_request) Successful in 17s Details container stop was removing the container immediately (due to --rm) before container export could run. The force_remove_container teardown callback on the ExitStack already handles cleanup on normal exit, so --rm was redundant. Without it, the stopped container stays available for container export to snapshot.	2026-06-23 07:59:09 +00:00
didericis-claude	d5762fa9d8	refactor(freezer): drop Bottle from commit signature lint / lint (push) Failing after 1m38s Details test / unit (pull_request) Successful in 31s Details test / integration (pull_request) Successful in 16s Details Freezer._freeze only ever used bottle.name, which is always f"bot-bottle-{agent.slug}". Remove the Bottle parameter from commit() and _freeze(), derive the container name from agent.slug directly in each subclass, and delete the _NamedBottle stub that existed solely to paper over this.	2026-06-23 07:46:38 +00:00
didericis-claude	8ab24726fe	refactor(commit): introduce Freezer class hierarchy across backends lint / lint (push) Failing after 1m38s Details test / unit (pull_request) Successful in 31s Details test / integration (pull_request) Successful in 15s Details Adds a Freezer ABC (backend/freeze.py) that encapsulates the stop-commit-mark-preserved flow for all backends, following the same pattern as BottleBackend. Each backend gets its own Freezer subclass: DockerFreezer — docker commit MacosContainerFreezer — container export + image rebuild; prompts to stop if the container is running SmolmachinesFreezer — smolvm pack create --from-vm The base class owns write_committed_image, mark_preserved, and the resume hint. Subclasses implement _freeze() and optionally override _export_hint() for migration instructions. Freezer.commit(agent, bottle) is the primary entry point for use within a live launch context. Freezer.commit_slug(slug) is a convenience wrapper for cmd_commit, which no longer branches on backend names itself. get_freezer(backend_name) is the factory, analogous to get_bottle_backend(). CommitCancelled is raised by MacosContainerFreezer when the user declines the stop prompt; cmd_commit catches it and returns 0.	2026-06-23 07:41:48 +00:00
didericis-claude	3cd4a7acd9	fix(commit): stop running macos-container bottle before committing lint / lint (push) Successful in 1m38s Details test / unit (pull_request) Successful in 32s Details test / integration (pull_request) Successful in 17s Details `container export` requires the container to be stopped first. When a running bottle is detected, prompt the user to confirm, stop the container, then commit. Adds `container_is_running` and `stop_container` helpers to the macos-container util. Addresses #240 (comment)	2026-06-23 07:22:33 +00:00
didericis-claude	81ce23a54d	fix: correct Manifest/ManifestIndex usage and add missing type annotations in tests lint / lint (push) Successful in 1m41s Details test / unit (pull_request) Successful in 37s Details test / integration (pull_request) Successful in 16s Details - test_docker_launch_committed_image: replace Manifest.from_json_obj (nonexistent) with ManifestIndex.from_json_obj; pass manifest= arg to DockerBottlePlan constructor (required by BottlePlan base class) - test_macos_container_launch: cast SimpleNamespace stubs to their expected types (BottleSpec, GitGatePlan, EgressPlan) in _build_plan; add str type annotations to fake_build parameter signatures - test_macos_container_util: add str type annotations to fake_build_image parameter signatures	2026-06-23 07:07:28 +00:00
didericis	d4f4846667	feat: support macos-container bottle commits lint / lint (push) Failing after 1m40s Details test / unit (pull_request) Failing after 34s Details test / integration (pull_request) Successful in 19s Details	2026-06-23 00:43:17 -04:00
didericis-codex	16020a6a09	feat: support smolmachines bottle commit lint / lint (push) Failing after 1m55s Details test / unit (pull_request) Failing after 40s Details test / integration (pull_request) Successful in 29s Details	2026-06-23 00:35:13 -04:00
didericis-claude	6e67b9c771	docs(prd): mark commit-bottle-state PRD as Active	2026-06-23 00:35:13 -04:00
didericis-claude	3484c3aed0	feat(cli): add commit command to snapshot running bottle state Adds `./cli.py commit [<slug>]` which runs `docker commit` on the active agent container and stores the resulting image tag in per-bottle state. The next `./cli.py resume <slug>` automatically boots from the committed snapshot instead of rebuilding from the Dockerfile, preserving all in-container state across restarts and migrations. - bottle_state: add write_committed_image / read_committed_image helpers - docker/util: add commit_container wrapper around `docker commit` - docker/launch: check for a committed image before the Dockerfile build step; fall back to normal build if the image is absent from the daemon - cli/commit: new command with interactive slug picker; errors clearly on non-Docker backends - 50 new unit tests covering all paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-23 00:35:13 -04:00