didericis 8f611b5687 fix(egress): emit preserve_auth into the generated routes ...

The flag from #453 was parsed off the manifest and honored by the
addon, but `_route_to_yaml_fields` never wrote it, so it was dropped on
the way to the proxy and has never worked end to end. Every registry
route silently kept the unconditional Authorization strip.

That is the whole of the Docker Hub / GHCR "unauthorized" blocker in
#392: podman fetched a valid 2658-byte bearer from auth.docker.io, the
proxy stripped it, and registry-1.docker.io answered the resulting
anonymous request with a fresh WWW-Authenticate challenge — which reads
exactly like a credential problem rather than a serializer gap.

Found by diffing a bottle's rendered routes.yaml against its manifest:
preserve_auth was in the manifest and absent from the output.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-21 20:17:04 -04:00

..

__init__.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

_docker_bottle_plan.py

fix(tests): pyright strict — export _plan fixture, drop unused imports

2026-07-14 17:12:12 -04:00

test_agent_provider.py

feat(claude): add forward_host_credentials support

2026-07-21 13:15:05 -04:00

test_backend_freezer.py

test(firecracker): satisfy pyright strict + line length in committed-rootfs tests

2026-07-17 00:36:43 -04:00

test_backend_parity.py

feat(backend): remove smolmachines; firecracker is the Linux default

2026-07-11 13:24:47 -04:00

test_backend_prepare.py

feat(macos): run containers inside a bottle via guest-local podman

2026-07-21 15:39:11 -04:00

test_backend_selection.py

fix(backend): don't prompt in headless/non-interactive backend selection

2026-07-20 19:58:14 +00:00

test_backend_setup.py

test: cover _daemon_reachable timeout path and DbStore.is_migrated

2026-07-19 02:18:07 +00:00

test_backend_terminal.py

feat(backend): remove smolmachines; firecracker is the Linux default

2026-07-11 13:24:47 -04:00

test_backend_util.py

test(backend): cover poll_ca_cert timeout paths for diff-coverage gate

2026-07-21 04:54:40 +00:00

test_backend_workspace.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_bottle_state.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_builtin_agent_images.py

Revert "refactor(agent-images): use explicit Debian base"

2026-07-21 14:52:44 -04:00

test_cli_backend.py

feat(backend): add teardown() to the contract; backend teardown

2026-07-11 16:56:17 -04:00

test_cli_cleanup_cross_backend.py

fix: remove CLI backend assumptions and add docker fallback prompt

2026-07-20 19:13:08 +00:00

test_cli_commit.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_cli_dispatch.py

fix(cli): exempt backend command from DB migration gate

2026-07-18 15:27:29 -04:00

test_cli_login.py

fix(login): narrow exception types and cover cleanup path

2026-07-21 14:25:38 -04:00

test_cli_module_entry.py

feat(cli): make bot_bottle.cli runnable with python -m

2026-07-21 14:25:38 -04:00

test_cli_start_backend_flag.py

fix: remove CLI backend assumptions and add docker fallback prompt

2026-07-20 19:13:08 +00:00

test_cli_start_headless.py

Add cached image quickstart

2026-07-21 13:56:29 -04:00

test_cli_start_selector.py

Add cached image quickstart

2026-07-21 13:56:29 -04:00

test_cli_start_settle.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_cli_start_stale.py

refactor: BottleImages dataclass, prelaunch_checks, build_or_load_images

2026-07-21 13:56:29 -04:00

test_cli_tui.py

feat(tui,start): space/enter split, bottle lineage, YAML preflight

2026-06-25 16:13:19 -04:00

test_codex_auth.py

refactor: move codex_auth into contrib/codex

2026-06-07 11:35:35 -04:00

test_compose.py

refactor(de-sidecar): rename sidecar_init→gateway_init, drop docker's dead per-bottle compose renderer

2026-07-14 16:46:46 -04:00

test_config_store.py

test: add unit tests for stale-image checks to reach ≥90% diff-coverage

2026-07-21 13:56:29 -04:00

test_consolidated_compose.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

test_consolidated_launch.py

feat(docker): consolidate to single infra container under gateway_init supervise tree

2026-07-21 04:54:40 +00:00

test_contrib_claude_auth.py

feat(claude): add forward_host_credentials support

2026-07-21 13:15:05 -04:00

test_contrib_claude_provider.py

fix(supervise): remove queue directory from db-backed flow

2026-07-01 19:50:38 +00:00

test_contrib_codex_provider.py

fix(codex): register supervise MCP via config.toml http_headers, not mcp add --header

2026-07-16 17:42:36 -04:00

test_contrib_gitea_deploy_key.py

fix: add explicit timeouts to subprocess and HTTP calls in git-gate paths

2026-06-25 04:12:43 -04:00

test_contrib_pi_provider.py

feat(cli): add headless launch mode for orchestrators

2026-06-30 15:08:14 -04:00

test_db_store.py

test: cover _daemon_reachable timeout path and DbStore.is_migrated

2026-07-19 02:18:07 +00:00

test_deploy_key_provisioner.py

refactor: fix unused imports, long lines, and type issues

2026-06-03 23:04:17 -04:00

test_dlp_detectors.py

perf(dlp): linearize injection proximity check; bound variant cache; dedup supervise schema

2026-06-26 23:22:18 -04:00

test_docker_bottle.py

fix: route remote control through provider startup args

2026-06-25 03:08:47 -04:00

test_docker_cleanup.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_docker_enumerate_active.py

refactor: move bot_bottle_root/host_db_path to paths; kill the monkeypatch (#352)

2026-07-14 02:38:20 -04:00

test_docker_launch_committed_image.py

fix(lint): remove unused BottleImages imports from two test files

2026-07-21 13:56:29 -04:00

test_docker_launch_teardown.py

refactor: BottleImages dataclass, prelaunch_checks, build_or_load_images

2026-07-21 13:56:29 -04:00

test_docker_provision_git_user.py

test(git): cover provisioning failures

2026-07-21 14:52:44 -04:00

test_docker_test_helpers.py

test(firecracker): satisfy pyright on the new infra-VM tests

2026-07-19 01:31:06 -04:00

test_docker_util_image.py

fix(pyright): assert not None before accessing datetime attributes in tests

2026-07-21 13:56:29 -04:00

test_egress_addon_core.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

test_egress_addon_log_redaction.py

refactor(gateway): replace flat-file import shims with installed package

2026-07-18 03:01:41 +00:00

test_egress_addon_request_flow.py

feat(egress): add preserve_auth flag to pass agent Authorization through

2026-07-21 15:01:59 -04:00

test_egress_apply.py

fix(tests): pyright strict — export _plan fixture, drop unused imports

2026-07-14 17:12:12 -04:00

test_egress_core_parsing.py

test(egress): ratchet egress_addon_core coverage to >=90%

2026-06-25 22:04:27 -04:00

test_egress_entrypoint.py

test(egress): set orchestrator URL for entrypoint tests; cover fail-closed guard

2026-07-17 22:34:28 -04:00

test_egress_multitenant.py

fix(egress): the unattributed message must name the token-mismatch cause too

2026-07-21 03:27:16 +00:00

test_egress.py

fix(egress): emit preserve_auth into the generated routes

2026-07-21 20:17:04 -04:00

test_firecracker_backend.py

fix(firecracker): restore agent home ownership at boot

2026-07-21 14:52:44 -04:00

test_firecracker_cleanup.py

refactor(de-sidecar): remove the per-bottle companion-container architecture

2026-07-14 17:02:08 -04:00

test_firecracker_helpers.py

test(firecracker): derive netpool names from config, not hardcoded defaults

2026-07-19 01:21:23 -04:00

test_firecracker_image_builder.py

fix(rebase): correct test_cached_lookup key and drop duplicate test

2026-07-21 13:56:29 -04:00

test_firecracker_infra_vm.py

test(backend): cover poll_ca_cert timeout paths for diff-coverage gate

2026-07-21 04:54:40 +00:00

test_gateway_init.py

fix(tests): resolve sleep from PATH so subprocess tests run on NixOS

2026-07-18 22:09:05 -04:00

test_gateway_net.py

feat(orchestrator): slice 13c(ii) — shared-gateway source-IP allocator

2026-07-14 02:38:20 -04:00

test_gateway_provision.py

fix(git-gate): make the gateway access-hook executable regardless of copy transport

2026-07-17 21:49:30 -04:00

test_git_gate_host_key.py

fix(tests): replace os.chmod with mock for unreadable-file tests

2026-07-09 17:35:28 +00:00

test_git_gate_provision_render.py

feat(git-gate+orchestrator): slice 13c(i) — per-bottle git-gate provisioning render

2026-07-14 02:38:20 -04:00

test_git_gate_render_provision.py

refactor(git-gate): centralize hostname qualification in globalize_slug

2026-07-16 23:07:12 -04:00

test_git_gate.py

fix(git-gate): scan $new --not --all for every push, not $old..$new

2026-07-18 16:51:31 -04:00

test_git_http_backend.py

test(git-http): wire the resolver into the access-hook-503 regression test

2026-07-17 22:34:28 -04:00

test_git_http_multitenant.py

refactor(gateway): remove the single-tenant data-plane paths (audit #400 finding 3)

2026-07-17 22:34:28 -04:00

test_image_cache.py

fix(tests): resolve pyright errors in stale-check test files

2026-07-21 13:56:29 -04:00

test_infra_artifact.py

fix(rebase): correct test_cached_lookup key and drop duplicate test

2026-07-21 13:56:29 -04:00

test_log.py

feat(log): add leveled severity and structured context to log wrappers

2026-06-24 15:37:57 -04:00

test_macos_consolidated_launch.py

feat(docker): consolidate to single infra container under gateway_init supervise tree

2026-07-21 04:54:40 +00:00

test_macos_container_bottle.py

fix: repair codex resume paths

2026-07-08 12:38:15 -04:00

test_macos_container_cleanup.py

fix: require authoritative container snapshot before reconciling

2026-07-21 03:39:18 +00:00

test_macos_container_launch_wiring.py

feat(macos): run containers inside a bottle via guest-local podman

2026-07-21 15:39:11 -04:00

test_macos_container_pty_forward.py

test(macos-container): satisfy pyright mock typing

2026-06-23 03:02:03 +00:00

test_macos_container_util.py

fix(pyright): assert not None before accessing datetime attributes in tests

2026-07-21 13:56:29 -04:00

test_macos_gateway_hosts.py

fix(macos): name the gateway instead of addressing it, so bottles survive it moving

2026-07-20 23:08:59 -04:00

test_macos_infra.py

fix(macos): persist gateway CA on host

2026-07-21 15:01:38 -04:00

test_macos_nested_containers.py

feat(macos): give nested containers working egress

2026-07-21 19:37:39 -04:00

test_manifest_agent_git_user.py

fix(types): add BottleSpec.loaded_manifest to satisfy pyright on union type

2026-06-22 23:54:02 -04:00

test_manifest_bottle_merge.py

fix(manifest): OR nested_containers across composed bottles

2026-07-21 15:43:31 -04:00

test_manifest_egress.py

feat(egress): add preserve_auth flag to pass agent Authorization through

2026-07-21 15:01:59 -04:00

test_manifest_extends.py

feat: support multiple parents in bottle extends:

2026-06-25 05:10:03 -04:00

test_manifest_git_user.py

refactor(manifest): split Manifest into ManifestIndex + Manifest single-value type

2026-06-22 23:54:02 -04:00

test_manifest_git.py

refactor(manifest): split Manifest into ManifestIndex + Manifest single-value type

2026-06-22 23:54:02 -04:00

test_manifest_lazy_loader.py

test(manifest): cover lazy (on-disk) loader branches

2026-06-26 21:19:27 -04:00

test_manifest_md_load.py

fix(types): add BottleSpec.loaded_manifest to satisfy pyright on union type

2026-06-22 23:54:02 -04:00

test_manifest_runtime.py

refactor(manifest): split Manifest into ManifestIndex + Manifest single-value type

2026-06-22 23:54:02 -04:00

test_manifest_validation.py

feat(macos): run containers inside a bottle via guest-local podman

2026-07-21 15:39:11 -04:00

test_orchestrator_broker.py

feat(orchestrator): slice 2 — launch lifecycle + signed launch-broker (#352)

2026-07-14 02:38:20 -04:00

test_orchestrator_client.py

fix(orchestrator): reap registry rows whose bottle is no longer running

2026-07-21 03:27:16 +00:00

test_orchestrator_config_store.py

refactor(config_store): replace generic key/value table with explicit schema

2026-07-21 00:40:59 -04:00

test_orchestrator_control_plane.py

fix(orchestrator): reap registry rows whose bottle is no longer running

2026-07-21 03:27:16 +00:00

test_orchestrator_docker_broker.py

feat(orchestrator): slice 3 — real Docker launch broker (#352)

2026-07-14 02:38:20 -04:00

test_orchestrator_gateway.py

fix(gateway): persist mitmproxy CA on the host, not a named volume (#450)

2026-07-21 15:01:38 -04:00

test_orchestrator_lifecycle.py

fix(gateway): persist mitmproxy CA on the host, not a named volume (#450)

2026-07-21 15:01:38 -04:00

test_orchestrator_registration.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

test_orchestrator_registry.py

fix(orchestrator): reap registry rows whose bottle is no longer running

2026-07-21 03:27:16 +00:00

test_orchestrator_rotate_ca.py

fix(gateway): persist mitmproxy CA on the host, not a named volume (#450)

2026-07-21 15:01:38 -04:00

test_orchestrator_service.py

fix(orchestrator): reap registry rows whose bottle is no longer running

2026-07-21 03:27:16 +00:00

test_plan_print_parity.py

feat(backend): remove smolmachines; firecracker is the Linux default

2026-07-11 13:24:47 -04:00

test_policy_resolver.py

fix(egress+orchestrator): inject per-bottle auth tokens in the shared gateway

2026-07-14 02:38:20 -04:00

test_print_util.py

feat(manifest): add agent_provider.auth_token for Claude OAuth via egress

2026-06-01 22:24:17 -04:00

test_provision_git.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

test_publish_infra.py

test(firecracker): cover published artifact reuse

2026-07-21 16:55:06 +00:00

test_stale_checks.py

fix(firecracker): honor cached image policy

2026-07-21 13:56:29 -04:00

test_supervise_cli_crash_logging.py

test(supervise): stub the client in cmd_supervise crash-logging tests

2026-07-16 22:44:47 -04:00

test_supervise_cli.py

feat(supervise): show the bottle's human slug, not its opaque id

2026-07-16 22:05:21 -04:00

test_supervise_edge.py

refactor: drop the vestigial bot_bottle_root/host_db_path re-exports (#352)

2026-07-14 02:38:20 -04:00

test_supervise_server.py

feat(supervise): non-blocking MCP — pending carries proposal id + check-proposal poll tool

2026-07-18 17:06:04 -04:00

test_supervise.py

refactor: drop the vestigial bot_bottle_root/host_db_path re-exports (#352)

2026-07-14 02:38:20 -04:00

test_tracker_policy.py

ci: enforce canonical issue metadata policy

2026-07-18 14:18:39 -04:00

test_yaml_subset.py

refactor(git-gate): replace regex frontmatter edit with parse→mutate→serialize

2026-07-09 17:21:57 +00:00