fix(start): show bottle lineage root-first with -> arrows

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -6,8 +6,8 @@
 
 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
 [![pylint](https://img.shields.io/badge/pylint-9.93%2F10-brightgreen)](https://github.com/PyCQA/pylint)
-[![pyright](https://img.shields.io/badge/pyright-0%20errors-brightgreen)](https://github.com/microsoft/pyright)
-[![coverage](https://img.shields.io/badge/coverage-79%25-brightgreen)](https://coverage.readthedocs.io/)
+[![pyright](https://img.shields.io/badge/pyright-1%20errors-brightgreen)](https://github.com/microsoft/pyright)
+[![coverage](https://img.shields.io/badge/coverage-unknown-lightgrey)](https://coverage.readthedocs.io/)
 
 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
 

docs/prds/prd-new-separate-agent-bottle-selection.md

@@ -1,4 +1,4 @@
-# PRD 0066: Separate agent and bottle selection
+# PRD prd-new: Separate agent and bottle selection
 
 - **Status:** Active
 - **Author:** claude

tests/unit/test_dlp_detectors.py

@@ -24,36 +24,61 @@ from bot_bottle.dlp_detectors import (
 )
 
 
-# (case id, sample body carrying the token, substring expected in the reason).
-# One row per known token shape; all are block-severity credential matches.
-# `# gitleaks:allow` marks the synthetic tokens so a source scan won't flag them.
-_TOKEN_PATTERN_CASES: list[tuple[str, str, str]] = [
-    ("aws_access_key", "key=AKIAIOSFODNN7EXAMPLE", "AWS access key"),
-    ("github_classic", "token: ghp_" + "A" * 36, "GitHub token"),  # gitleaks:allow
-    ("github_fine_grained", "pat=github_pat_" + "A" * 82, "fine-grained"),  # gitleaks:allow
-    ("anthropic", "auth: sk-ant-" + "A" * 93, "Anthropic"),  # gitleaks:allow
-    ("openai", "key=sk-" + "A" * 48, "OpenAI"),  # gitleaks:allow
-    ("stripe_live", "stripe: sk_live_" + "A" * 24, "Stripe"),  # gitleaks:allow
-    ("bearer_jwt", "Authorization: Bearer " + "A" * 60, "Bearer JWT"),  # gitleaks:allow
-    ("openai_project", "key=sk-proj-" + "A" * 48, "OpenAI project"),  # gitleaks:allow
-    ("huggingface", "token=hf_" + "A" * 34, "HuggingFace"),  # gitleaks:allow
-    ("databricks", "dapi" + "a" * 32, "Databricks"),  # gitleaks:allow
-    ("slack_bot", "xoxb-00000000000-00000000000-" + "A" * 24, "Slack"),  # gitleaks:allow
-    ("npm", "npm_" + "A" * 36, "npm"),  # gitleaks:allow
-    ("sendgrid", "SG." + "A" * 22 + "." + "B" * 43, "SendGrid"),  # gitleaks:allow
-    ("pypi", "pypi-" + "A" * 80, "PyPI"),  # gitleaks:allow
-    ("vault", "hvs." + "A" * 24, "Vault"),  # gitleaks:allow
-]
-
-
 class TestScanTokenPatterns(unittest.TestCase):
-    def test_detects_each_token_pattern(self):
-        for case_id, sample, expected in _TOKEN_PATTERN_CASES:
-            with self.subTest(case_id):
-                result = scan_token_patterns(sample)
-                assert result is not None
-                self.assertEqual("block", result.severity)
-                self.assertIn(expected, result.reason)
+    def test_aws_access_key(self):
+        result = scan_token_patterns("key=AKIAIOSFODNN7EXAMPLE")
+        assert result is not None
+        self.assertEqual("block", result.severity)
+        self.assertIn("AWS access key", result.reason)
+
+    def test_github_classic_token(self):
+        result = scan_token_patterns(
+            "token: ghp_" + "A" * 36,
+        )
+        assert result is not None
+        self.assertIn("GitHub token", result.reason)
+
+    def test_github_fine_grained_token(self):
+        result = scan_token_patterns(
+            "pat=github_pat_" + "A" * 82,
+        )
+        assert result is not None
+        self.assertIn("fine-grained", result.reason)
+
+    def test_anthropic_api_key(self):
+        result = scan_token_patterns(
+            "auth: sk-ant-" + "A" * 93,
+        )
+        assert result is not None
+        self.assertIn("Anthropic", result.reason)
+
+    def test_openai_api_key(self):
+        result = scan_token_patterns(
+            "key=sk-" + "A" * 48,
+        )
+        assert result is not None
+        self.assertIn("OpenAI", result.reason)
+
+    def test_stripe_live_key(self):
+        result = scan_token_patterns(
+            "stripe: sk_live_" + "A" * 24,
+        )
+        assert result is not None
+        self.assertIn("Stripe", result.reason)
+
+    def test_bearer_jwt(self):
+        result = scan_token_patterns(
+            "Authorization: Bearer " + "A" * 60,
+        )
+        assert result is not None
+        self.assertIn("Bearer JWT", result.reason)
+
+    def test_openai_project_key(self):
+        result = scan_token_patterns(
+            "key=sk-proj-" + "A" * 48,
+        )
+        assert result is not None
+        self.assertIn("OpenAI project", result.reason)
 
     def test_clean_text_returns_none(self):
         self.assertIsNone(scan_token_patterns("hello world"))
@@ -282,6 +307,44 @@ class TestEncodedVariants(unittest.TestCase):
         self.assertEqual(len(v), len(set(v)))
 
 
+class TestScanTokenPatternsExtended(unittest.TestCase):
+    def test_huggingface_token(self):
+        result = scan_token_patterns("token=hf_" + "A" * 34)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("HuggingFace", result.reason)
+
+    def test_databricks_token(self):
+        result = scan_token_patterns("dapi" + "a" * 32)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("Databricks", result.reason)
+
+    def test_slack_bot_token(self):
+        # Use all-zero numeric segments to keep entropy low
+        result = scan_token_patterns("xoxb-00000000000-00000000000-" + "A" * 24)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("Slack", result.reason)
+
+    def test_npm_token(self):
+        result = scan_token_patterns("npm_" + "A" * 36)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("npm", result.reason)
+
+    def test_sendgrid_key(self):
+        result = scan_token_patterns("SG." + "A" * 22 + "." + "B" * 43)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("SendGrid", result.reason)
+
+    def test_pypi_token(self):
+        result = scan_token_patterns("pypi-" + "A" * 80)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("PyPI", result.reason)
+
+    def test_vault_token(self):
+        result = scan_token_patterns("hvs." + "A" * 24)  # gitleaks:allow
+        assert result is not None
+        self.assertIn("Vault", result.reason)
+
+
 class TestUnicodeNormalization(unittest.TestCase):
     def test_fullwidth_chars_normalized(self):
         # Fullwidth ASCII chars (U+FF21..U+FF3A) should map to ASCII