Files

T

didericis-claude 8a1b833aaa fix(gateway): persist mitmproxy CA on the host, not a named volume (#450 )

The shared gateway self-generates a mitmproxy CA that every bottle installs
to trust its TLS interception. It was persisted on a Docker named volume,
which survives `docker rm` but is silently wiped by `docker volume prune` /
`docker system prune --volumes` during routine host maintenance. When that
happens the gateway mints a fresh CA on restart, and every already-running
bottle fails the TLS handshake even after it re-resolves and reconnects to
the moved gateway — a re-attachment blocker distinct from #443/#445.

Move CA persistence to a host bind-mount under the app-data root
(`bot_bottle_root()/gateway-ca`, via `host_gateway_ca_dir()`), mirroring how
the shared DB and control-plane token already live on the host. Docker never
prunes a path under the root, and it stays inspectable + rotatable from the
host. mitmproxy already adopts an existing CA and generates one only on first
run, so the bind-mount gives adopt-existing/generate-on-first-run for free.

Add an explicit rollover path: `rotate_gateway_ca()` clears the persisted CA
so the next start remints it, and `python -m bot_bottle.orchestrator.rotate_ca`
wires that together with dropping the running gateway container (whose
mitmproxy still holds the old CA in memory). Rotation stays an operator action
— it doesn't auto-re-provision running bottles, which re-attach to pick up the
new anchor.

Scope: the Docker infra/gateway path (the "infra container" in the report).
The macOS (`container`-only volume) and Firecracker (VM-attached ext4) backends
persist the CA differently and are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-21 15:01:38 -04:00

canaries

chore: delete pipelock files and strip from manifest layer

2026-06-04 21:11:14 +00:00

integration

fix(agent-images): retain SSH client

2026-07-21 14:52:44 -04:00

unit

fix(gateway): persist mitmproxy CA on the host, not a named volume (#450 )

2026-07-21 15:01:38 -04:00

__init__.py

refactor: convert project from bash to Python

2026-05-08 15:26:58 +00:00

_bin.py

fix(tests): resolve sleep from PATH so subprocess tests run on NixOS

2026-07-18 22:09:05 -04:00

_docker.py

fix(tests): run sandbox integration on firecracker

2026-07-19 02:34:53 +00:00

fixtures.py

refactor(manifest): split Manifest into ManifestIndex + Manifest single-value type

2026-06-22 23:54:02 -04:00

README.md

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

README.md

Tests

Plain-Python test suite using stdlib unittest. No external dependencies. Unit tests run anywhere Python 3 is present; integration tests need Docker and skip cleanly otherwise.

Layout

tests/
  fixtures.py                       # JSON manifest builders (shared)
  _docker.py                        # docker-availability skip helper (shared)
  unit/
    test_egress.py
    test_egress_addon_core.py
    test_manifest_egress.py
    test_dlp_detectors.py
    test_manifest_runtime.py
    ...                             # many others; see unit/ directory
  integration/
    test_gateway_image.py
    test_dry_run_plan.py
    test_orphan_cleanup.py
    ...
  canaries/                         # opt-in; see below (currently empty)

Classification falls out of the directory — no hand-maintained list to keep in sync.

Running

python -m unittest discover -t . -s tests/unit -v         # unit only
python -m unittest discover -t . -s tests/integration -v  # integration only
python -m unittest discover -t . -s tests -v              # both (recursive)
python -m unittest tests.unit.test_manifest_egress        # one file

Discovery is invoked with -t . (top-level dir = repo root) so the bot_bottle package on sys.path resolves correctly.

What the integration tests cover

test_dry_run_plan.py — cli.py start --dry-run --format=json emits a structured plan that contains the resolved egress allowlist and the bottle's runtime, and creates zero Docker resources.
test_orphan_cleanup.py — network_remove is idempotent against missing resources, so the EXIT trap can call it unconditionally.
test_gateway_image.py — builds Dockerfile.gateway and probes that gitleaks / mitmdump / supervise are all reachable inside the gateway image.

Canaries

tests/canaries/ holds upstream-regression checks gated on BOT_BOTTLE_RUN_CANARIES=1 and not part of the per-push suite. They're invoked by the scheduled canaries workflow. Currently no canaries are defined.

BOT_BOTTLE_RUN_CANARIES=1 python -m unittest discover -t . -s tests/canaries -v

What's NOT covered

bot_bottle/ssh.py end-to-end (would need a fake SSH host inside the container).
A live SSH-through-git-gate tunnel against a real Tailscale-style IP.
DLP false-positive measurements.
TLS handling / cert pinning behavior.

Adding a test

Pick the directory: tests/unit/ for a pure unit test, tests/integration/ for one that needs Docker.
Filename: test_<topic>.py.

Boilerplate:

import unittest

from bot_bottle.<module> import <symbol>

class TestThing(unittest.TestCase):
    def test_x(self):
        ...

if __name__ == "__main__":
    unittest.main()

For Docker-dependent tests, decorate the class with @skip_unless_docker() from tests._docker.