didericis
cd9f023f3d
prd-number-check / require-numbered-prds (pull_request) Successful in 11s
tracker-policy-pr / check-pr (pull_request) Successful in 14s
test / unit (pull_request) Successful in 59s
test / integration-docker (pull_request) Successful in 1m6s
test / coverage (push) Successful in 21s
test / image-input-builds (push) Successful in 44s
test / image-input-builds (pull_request) Successful in 1m15s
test / unit (push) Successful in 57s
test / coverage (pull_request) Successful in 20s
lint / lint (push) Successful in 1m3s
Update Quality Badges / update-badges (push) Successful in 1m12s
test / integration-docker (push) Successful in 1m0s
`doctor` told users to run `./cli.py backend setup`. cli.py is a four-line wrapper at the repo root that calls bot_bottle.cli:main, and it does not ship — [tool.setuptools.packages.find] includes only bot_bottle*, so anyone who installed rather than cloned has no such file. Confirmed against a real install: the user's tree contains exactly one executable, `bot-bottle`, and no cli.py anywhere, while doctor recommended `./cli.py` three times. Invisible in development, where ./cli.py works fine from a checkout, which is why only a clean-install test surfaced it. The two entry points are the same code, so the fix is to name the one that always exists. 141 replacements across 45 files: the runtime messages that caused this, plus README, docs, PRDs, research notes and test prose, so nothing teaches the invocation a user cannot run. scripts/demo.sh is deliberately untouched — it *executes* ./cli.py from a checkout, where that is the correct and available path. Verified end to end: a sandbox install now reports "Run: bot-bottle backend setup --backend=firecracker", and bot-bottle is on that user's PATH. Unit suite unchanged against the pre-existing baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WEfZZhakx13bxTfXcZCoS5
79 lines
2.7 KiB
VHS
79 lines
2.7 KiB
VHS
# VHS tape — drives `bot-bottle start demo` interactively and asks
|
|
# claude (the AI) to run four probes via natural-language prompts.
|
|
# Setup (manifest + dummy SSH key + image pre-warm) and teardown
|
|
# happen outside the tape; record via `bash scripts/demo-record.sh`,
|
|
# which wraps both and decimates dead time post-record.
|
|
#
|
|
# Re-record when the prompts, manifest, or cli.py preflight rendering
|
|
# change. Claude's response time varies; the Sleeps below are sized
|
|
# for typical bottle launch + tool-use latencies and can be tightened
|
|
# if a recording consistently has slack.
|
|
|
|
Output docs/demo.gif
|
|
|
|
Set Shell "bash"
|
|
Set FontSize 13
|
|
Set Width 1180
|
|
Set Height 780
|
|
Set Padding 20
|
|
Set Theme "BirdsOfParadise"
|
|
Set TypingSpeed 40ms
|
|
|
|
Hide
|
|
Type "clear"
|
|
Enter
|
|
Show
|
|
|
|
# Real cli.py invocation — what a user with bot-bottle.json in cwd
|
|
# would type. The bottle declares one allowlist (only baked-in
|
|
# defaults), one git upstream (unreachable on purpose so gitleaks runs
|
|
# before the gate would forward), and a FAKE_TOKEN env var shaped like
|
|
# a GitHub PAT.
|
|
Type "bot-bottle start demo"
|
|
Enter
|
|
Sleep 8s
|
|
|
|
# Confirm the y/N preflight. cli.py reads from /dev/tty.
|
|
Type "y"
|
|
Enter
|
|
|
|
# Wait for the bottle to launch: networks created, pipelock + git-gate
|
|
# companion containers started, agent container started, claude boots.
|
|
Sleep 22s
|
|
|
|
# Probe 1 — warm-up. A reply at all proves api.anthropic.com is
|
|
# reachable through pipelock end-to-end: bumped TLS handshake, DLP
|
|
# scan, and forward all succeed.
|
|
Type "hello there"
|
|
Enter
|
|
Sleep 10s
|
|
|
|
# Probe 2 — non-allowlisted host. Pipelock's host filter refuses to
|
|
# forward example.com; the agent runs curl via Bash and reports the
|
|
# 403 it sees. The bottle prompt frames this as a proxy-behavior
|
|
# probe so claude doesn't second-guess the request.
|
|
Type "GET http://example.com via curl — what status does the proxy give back?"
|
|
Enter
|
|
Sleep 18s
|
|
|
|
# Probe 3 — allowlisted host BUT a credential-shaped body. The
|
|
# bottle's FAKE_TOKEN env var is a ghp_-prefixed synthetic. The host
|
|
# check passes; pipelock's DLP body scanner has to catch it.
|
|
Type `POST "token=$FAKE_TOKEN" to http://api.anthropic.com/dlp-probe via curl — what does the proxy do?`
|
|
Enter
|
|
Sleep 20s
|
|
|
|
# Probe 4 — commit an AKIA-shaped key and push to the declared
|
|
# upstream. The bottle's ~/.gitconfig rewrites the URL to the
|
|
# git-gate via `insteadOf`, so the push lands at the gate, gitleaks
|
|
# runs in pre-receive, and the ref is rejected before the gate
|
|
# would forward upstream.
|
|
Type "init /tmp/r, commit AKIAQRJHK7N5ZPM2VXTL to leak.txt, push to ssh://git@upstream.invalid/path.git main — does the gate let it through?"
|
|
Enter
|
|
Sleep 30s
|
|
|
|
# Leave claude. The launcher tears down the container, companion containers, and
|
|
# networks on session end.
|
|
Ctrl+D
|
|
Sleep 4s
|