kanibako-cli 1.6.0.dev30__tar.gz → 1.6.0rc3__tar.gz

{kanibako_cli-1.6.0.dev30/src/kanibako_cli.egg-info → kanibako_cli-1.6.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kanibako-cli
-Version: 1.6.0.dev30
+Version: 1.6.0rc3
 Summary: Run AI coding agents in rootless containers with per-project isolation
 Requires-Python: >=3.11
 License-File: LICENSE.md
@@ -13,4 +13,5 @@ Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: mypy; extra == "dev"
 Requires-Dist: ruff; extra == "dev"
 Requires-Dist: bump2version; extra == "dev"
+Requires-Dist: pexpect>=4.8; extra == "dev"
 Dynamic: license-file

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "kanibako-cli"
-version = "1.6.0.dev30"
+version = "1.6.0rc3"
 description = "Run AI coding agents in rootless containers with per-project isolation"
 requires-python = ">=3.11"
 dependencies = ["argcomplete>=3.0", "PyYAML>=6.0", "packaging>=20.0"]
@@ -16,7 +16,7 @@ kanibako = "kanibako.cli:main"
 no_agent = "kanibako.targets.no_agent:NoAgentTarget"
 
 [project.optional-dependencies]
-dev = ["pytest>=7.0", "pytest-cov", "mypy", "ruff", "bump2version"]
+dev = ["pytest>=7.0", "pytest-cov", "mypy", "ruff", "bump2version", "pexpect>=4.8"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/__init__.py

@@ -1,6 +1,6 @@
 """kanibako: Run AI coding agents in rootless containers with per-project isolation."""
 
-__version__ = "1.6.0.dev30"
+__version__ = "1.6.0rc3"
 
 # The oldest build version whose ``setup`` run is still considered current.  The
 # setup-completion gate (W1) re-nudges the user to re-run ``kanibako setup`` when

kanibako_cli-1.6.0rc3/src/kanibako/agent_defaults.py

@@ -0,0 +1,183 @@
+"""Per-agent plugin defaults — thin reader of each plugin's shipped defaults file.
+
+Each agent plugin package (``kanibako.plugins.claude`` / ``…goose`` / ``…codex``)
+owns ONE declarative defaults file (``<agent>-defaults.yaml``) holding that
+agent's complete DEFAULT-SET — its :class:`~kanibako.targets.base.PluginDescriptor`
+data (bindings, launch grammar, settings, container env, cred files, …) plus its
+AGENT-scope ``default_shares`` — in the specced structured form.  This mirrors how
+the system/core defaults ship (:mod:`kanibako.core_defaults` /
+``kanibako/data/core-defaults.yaml``) and how containerfiles/templates ship via
+:mod:`importlib.resources`.
+
+This module is the THIN reader those plugins call from their ``descriptor`` /
+``default_shares`` properties.  It builds the descriptor from the file so the
+in-code descriptor is no longer hand-written per plugin.
+
+Split (documented in each YAML header too):
+
+* DECLARATIVE — everything in the file: the binding ORIGIN selectors (which
+  detected install field supplies the host source — a declarative string, NOT a
+  probed value), box-side destinations, the mode/operations grammar, settings
+  routing, container env, cred-file lifecycle, host_prep/init_dirs, and the
+  agent-share box_dests.  Box-side destinations under the guest home are written
+  as ``$GUEST_HOME`` EXPRESSIONS (e.g. ``$GUEST_HOME/.local/bin/claude``) that
+  this loader expands from the single :data:`~kanibako.settings_resolve.GUEST_HOME`
+  constant — no ``/home/agent`` literal in the file.
+* CODE-RESOLVED — the CRITICAL/runtime-probed HOST binary paths stay in the
+  plugin's ``detect()`` (the contract-path constants + npm/ELF resolution).  The
+  file only names, declaratively, WHICH detected field (``binary`` / ``launcher`` /
+  ``install_dir``) each binding's host source comes from (its ``origin``); the
+  actual probed path is filled in later by ``descriptor_mounts`` from the
+  :class:`~kanibako.targets.base.AgentInstall`.
+"""
+
+from __future__ import annotations
+
+import importlib.resources
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from kanibako.settings_resolve import GUEST_HOME
+from kanibako.targets.base import (
+    BindDefault,
+    BindKind,
+    Binding,
+    BindScope,
+    Cadence,
+    Channel,
+    CredFileSpec,
+    HostSrcOrigin,
+    Operation,
+    PluginDescriptor,
+    SafeBypass,
+    SettingArg,
+)
+
+
+def _expand(value: str) -> str:
+    """Expand a ``$GUEST_HOME`` prefix in a box-side path expression.
+
+    The defaults files write every in-box destination as a ``$GUEST_HOME``
+    expression so the guest-home literal lives in exactly one place (the
+    :data:`~kanibako.settings_resolve.GUEST_HOME` constant, single SoT).  Only the
+    leading ``$GUEST_HOME`` token is substituted; the rest is left verbatim.
+    """
+    if value.startswith("$GUEST_HOME"):
+        return GUEST_HOME + value[len("$GUEST_HOME"):]
+    return value
+
+
+def _load_doc(package: str, filename: str) -> dict[str, Any]:
+    """Read and parse a plugin's bundled defaults file."""
+    ref = importlib.resources.files(package).joinpath(filename)
+    raw = yaml.safe_load(Path(str(ref)).read_text()) or {}
+    if not isinstance(raw, dict):
+        return {}
+    return raw
+
+
+def _build_binding(entry: dict[str, Any]) -> Binding:
+    """Build one :class:`Binding` from a declarative file entry.
+
+    ``origin`` names the detected install field that supplies the host source
+    (``binary`` / ``launcher`` / ``install_dir`` / ``literal``); ``box_dest`` is a
+    ``$GUEST_HOME`` expression expanded here.  ``kind`` / ``scope`` map to their
+    enums; ``ro`` defaults to True.
+    """
+    literal = entry.get("literal_src")
+    return Binding(
+        key=entry["key"],
+        origin=HostSrcOrigin(entry["origin"]),
+        box_dest=_expand(entry["box_dest"]),
+        kind=BindKind(entry["kind"]),
+        scope=BindScope(entry["scope"]),
+        ro=bool(entry.get("ro", True)),
+        literal_src=Path(literal) if literal is not None else None,
+    )
+
+
+def _build_safe_bypass(raw: dict[str, Any] | None) -> SafeBypass | None:
+    """Build the :class:`SafeBypass` toggle from its declarative block (or None)."""
+    if not raw:
+        return None
+    return SafeBypass(
+        channel=Channel(raw["channel"]),
+        flag=tuple(raw.get("flag", ())),
+        env_var=raw.get("env_var", ""),
+        env_value=raw.get("env_value", ""),
+        secure_env_value=raw.get("secure_env_value", ""),
+        secure_flag=tuple(raw.get("secure_flag", ())),
+        setting_key=raw.get("setting_key", ""),
+    )
+
+
+def _build_setting_arg(entry: dict[str, Any]) -> SettingArg:
+    return SettingArg(
+        setting_key=entry["setting_key"],
+        channel=Channel(entry["channel"]),
+        flag=tuple(entry.get("flag", ())),
+        env_var=entry.get("env_var", ""),
+    )
+
+
+def _build_cred_file(entry: dict[str, Any]) -> CredFileSpec:
+    return CredFileSpec(
+        home_rel=entry["home_rel"],
+        host_rel=entry["host_rel"],
+        cadence=Cadence(entry.get("cadence", "sync")),
+        mtime_gate=bool(entry.get("mtime_gate", True)),
+        filtered=bool(entry.get("filtered", False)),
+        is_dir=bool(entry.get("is_dir", False)),
+    )
+
+
+def load_descriptor(package: str, filename: str) -> PluginDescriptor:
+    """Build a plugin's :class:`PluginDescriptor` from its shipped defaults file.
+
+    *package* is the plugin's import package (e.g. ``"kanibako.plugins.claude"``)
+    and *filename* its declarative defaults file (e.g. ``"claude-defaults.yaml"``).
+    The returned descriptor is byte-for-byte equivalent to the former hand-written
+    one — box_dest ``$GUEST_HOME`` expressions are expanded and every enum field
+    is mapped from its string name.
+    """
+    doc = _load_doc(package, filename)
+    desc = doc.get("descriptor", {})
+
+    return PluginDescriptor(
+        command=tuple(desc["command"]),
+        bindings=tuple(_build_binding(b) for b in desc.get("bindings", [])),
+        mode={k: tuple(v) for k, v in desc.get("mode", {}).items()},
+        operations={
+            k: Operation(tuple(v["fragment"]))
+            for k, v in desc.get("operations", {}).items()
+        },
+        safe_bypass=_build_safe_bypass(desc.get("safe_bypass")),
+        settings=tuple(_build_setting_arg(s) for s in desc.get("settings", [])),
+        container_env=dict(desc.get("container_env", {})),
+        cred_files=tuple(_build_cred_file(c) for c in desc.get("cred_files", [])),
+        host_prep=bool(desc.get("host_prep", False)),
+        init_dirs=tuple(desc.get("init_dirs", ())),
+    )
+
+
+def load_shares(package: str, filename: str) -> dict[str, BindDefault]:
+    """Build a plugin's AGENT-scope ``default_shares`` map from its defaults file.
+
+    Each entry maps a scoped category key (``agent.shared.<name>``) to a STRUCTURED
+    bind pair ``(host_src, box_dest)`` (spec §2a — a tuple, NOT a colon-joined
+    string).  The relative ``host_src`` joins under the per-agent store root in the
+    category resolver; ``box_dest`` is a ``$GUEST_HOME`` expression expanded here.
+    Returns ``{}`` when the file declares no shares.
+    """
+    shares: dict[str, BindDefault] = {}
+    for entry in _load_doc(package, filename).get("shares", []):
+        options = entry.get("options")
+        if options is not None:
+            shares[entry["key"]] = (
+                entry["host_src"], _expand(entry["box_dest"]), options,
+            )
+        else:
+            shares[entry["key"]] = (entry["host_src"], _expand(entry["box_dest"]))
+    return shares

kanibako_cli-1.6.0rc3/src/kanibako/box_seed.py

@@ -0,0 +1,84 @@
+"""Uniform per-box seed-once query/record API.
+
+This is the single read/write surface the launch path (Step 3) will call to
+ask "has this box already been seeded?" and to record "this box is now
+seeded".  It hides where each box's seeded flag lives by dispatching on
+``proj.mode`` (a :class:`kanibako.paths.BoxMode`) to whichever registry owns
+the box:
+
+* ``BoxMode.primary``    → the ``seeded`` section's ``projects`` domain in
+  ``registry.yaml`` (keyed by ``proj.name``).
+* ``BoxMode.standalone`` → the ``seeded`` section's ``standalone`` domain in
+  ``registry.yaml`` (keyed by ``proj.name``).
+* ``BoxMode.named``      → ``WorksetProject.seeded`` inside the owning
+  workset's ``settings.yaml`` (located via ``proj.group.root``).
+
+It is the explicit, registry-resident successor to the brittle ``.seeded``
+sentinel file (now REMOVED): Step 3 wired launch-time detection over to here,
+ORing this registry flag with an existing-inbox backstop for legacy boxes.
+Layering: this module
+depends on ``paths`` (types only), ``registry_store``, and ``workset``; none of
+those import ``box_seed``, so there is no import cycle.
+"""
+
+from __future__ import annotations
+
+from kanibako import registry_store
+from kanibako.paths import BoxMode, ProjectPaths, StandardPaths
+
+
+def box_is_seeded(proj: ProjectPaths, std: StandardPaths) -> bool:
+    """Return whether *proj*'s box has completed its one-time seed.
+
+    Dispatches on ``proj.mode`` to the owning registry.  Returns False for a
+    box that has never been seeded (or, defensively, a ``named`` box whose
+    group/workset-project cannot be resolved).
+    """
+    if proj.mode is BoxMode.primary:
+        return registry_store.is_box_seeded(std.data_path, "projects", proj.name)
+    if proj.mode is BoxMode.standalone:
+        return registry_store.is_box_seeded(std.data_path, "standalone", proj.name)
+    # BoxMode.named: the flag lives on the WorksetProject.
+    if proj.group is None:
+        return False
+    from kanibako.errors import WorksetError
+    from kanibako.workset import load_workset
+
+    try:
+        ws = load_workset(proj.group.root)
+    except WorksetError:
+        # Defensive: a named box whose workset cannot be loaded (e.g. its
+        # settings.yaml is absent or not yet materialised) reads as unseeded.
+        return False
+    for p in ws.projects:
+        if p.name == proj.name:
+            return p.seeded
+    return False
+
+
+def mark_box_seeded(proj: ProjectPaths, std: StandardPaths) -> None:
+    """Record that *proj*'s box has completed its one-time seed.
+
+    Dispatches on ``proj.mode`` to the owning registry.  Idempotent; a no-op
+    (defensive) for a ``named`` box whose group/workset-project cannot be
+    resolved.
+    """
+    if proj.mode is BoxMode.primary:
+        registry_store.mark_box_seeded_entry(std.data_path, "projects", proj.name)
+        return
+    if proj.mode is BoxMode.standalone:
+        registry_store.mark_box_seeded_entry(std.data_path, "standalone", proj.name)
+        return
+    # BoxMode.named: persist on the WorksetProject via the workset's public API.
+    if proj.group is None:
+        return
+    from kanibako.errors import WorksetError
+    from kanibako.workset import load_workset, set_project_seeded
+
+    try:
+        ws = load_workset(proj.group.root)
+        set_project_seeded(ws, proj.name)
+    except WorksetError:
+        # Defensive: a named box whose workset cannot be loaded/updated is a
+        # no-op (mirrors the missing-group guard above).
+        return

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/cli.py

@@ -184,6 +184,44 @@ _SUBCOMMANDS = {
 }
 
 
+def _normalize_command(effective: list[str]) -> list[str]:
+    """Reorder argv so a leading global-style flag doesn't swallow a subcommand.
+
+    The dispatcher's fallback rule ``effective[0] not in _SUBCOMMANDS -> prepend
+    "start"`` treats a LEADING flag (e.g. ``--agent goose shell``) as a bare
+    ``start`` with that flag — turning ``--agent goose shell`` into ``start
+    shell`` with ``project="shell"``, which both launches the wrong thing and
+    fires the Gate-1 setup nudge.
+
+    To honour the blanket-flag design (``kanibako --agent X <subcommand>`` ==
+    ``kanibako <subcommand> --agent X``), when ``effective[0]`` is an option
+    (starts with ``-``) and a KNOWN subcommand appears later, move the FIRST such
+    subcommand token to the front, preserving the relative order of everything
+    else.  ``--agent goose shell`` -> ``["shell", "--agent", "goose"]``.
+
+    Heuristic (kept simple, matches the documented design where flags normally
+    follow the subcommand): scan for the first token that is a ``_SUBCOMMANDS``
+    member.  A flag VALUE that happens to equal a subcommand name (e.g.
+    ``--box shell start`` where a box is literally named "shell") would be
+    matched as the subcommand; this is an accepted edge case.
+
+    The genuinely-no-subcommand cases are left untouched here so the caller's
+    existing ``prepend "start"`` rule still handles them: ``kanibako myproject``
+    (bare positional) and ``kanibako -A`` / ``kanibako -N`` (leading flags, no
+    subcommand) both fall through unchanged.
+    """
+    if not effective or not effective[0].startswith("-"):
+        return effective
+    sub_idx = next(
+        (i for i, tok in enumerate(effective) if tok in _SUBCOMMANDS),
+        None,
+    )
+    if sub_idx is None:
+        return effective
+    sub = effective[sub_idx]
+    return [sub] + effective[:sub_idx] + effective[sub_idx + 1:]
+
+
 def _ensure_initialized() -> None:
     """Ensure kanibako is initialized (create config + data dirs on first run)."""
     from kanibako.config import (
@@ -256,8 +294,9 @@ def _ensure_initialized() -> None:
     # CURATED templates instead.  The content ships as static package data and
     # is COPIED here into the runtime template dirs (@system.base_template +
     # @system.agents/<agent>/template), create-if-absent so user edits survive
-    # an upgrade.  The layered seed-once apply (templates.apply_template_layers)
-    # then copies them into each new box home at creation.
+    # an upgrade.  The layered seed-once stage+seed
+    # (templates.stage_and_seed_templates) then copies them into each new box
+    # home at creation.
     from kanibako.paths import load_std_paths
     from kanibako.templates import install_packaged_templates
 
@@ -339,6 +378,12 @@ def main(argv: list[str] | None = None) -> None:
         print(f"kanibako {__version__}")
         sys.exit(0)
     else:
+        # Reorder a leading global-style flag ahead of a later subcommand so
+        # `kanibako --agent goose shell` dispatches as `shell` (not `start` with
+        # project="shell").  Must run BEFORE the prepend-"start" fallback and the
+        # `--` split below.
+        effective = _normalize_command(effective)
+
         # If the first arg isn't a known subcommand, default to "start".
         if not effective or effective[0] not in _SUBCOMMANDS:
             effective = ["start"] + effective

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/commands/agent_cmd.py

@@ -433,9 +433,25 @@ def run_reauth(args: argparse.Namespace) -> int:
             return 1
 
     if target.check_auth():
-        # Sync refreshed credentials to the project shell directory
+        # Sync refreshed credentials to the project shell directory.  Mirror the
+        # start.py gate exactly: descriptor-bearing targets route their cred
+        # refresh through the credsync engine (descriptor.cred_files); only legacy
+        # (desc is None) targets fall back to the per-plugin refresh hook.  An
+        # ungated target.refresh_credentials here would push a descriptor agent
+        # (e.g. goose) down its legacy path / bespoke copy.
         if proj.group_auth:
-            target.refresh_credentials(proj.shell_path)
+            from pathlib import Path
+
+            from kanibako.targets import credsync
+
+            desc = target.descriptor
+            if desc is not None:
+                credsync.refresh_cred_files(
+                    desc, target, host_home=Path.home(),
+                    project_home=proj.shell_path, group_auth=proj.group_auth,
+                )
+            else:
+                target.refresh_credentials(proj.shell_path)
         print(f"{target.display_name}: authenticated.", file=sys.stderr)
         return 0
 

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/commands/flags.py

@@ -249,6 +249,17 @@ def check_flag_relevance(args: argparse.Namespace) -> None:
     # the excluded commands entirely.  Only a real string value counts as "set"
     # (a non-str sentinel from a MagicMock test stub is ignored).
     if isinstance(agent, str) and key not in _AGENT_FLAG_EXCLUDE:
+        # `shell` (and `box shell`) is a shell — it never launches an agent, so
+        # `--agent` is meaningless rather than wrong.  Product decision: IGNORE
+        # it with a clear note (don't hard-error), then proceed to open a plain
+        # shell.  run_shell never reads args.agent, so the value is dropped here.
+        if key in ("shell", "box shell"):
+            print(
+                "Note: --agent is ignored for 'shell' "
+                "(a shell never launches an agent).",
+                file=sys.stderr,
+            )
+            return
         if key not in AGENT_FLAG_COMMANDS:
             raise FlagRelevanceError(
                 f"--agent is not valid for '{key}'. It applies to agent "

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/commands/helper_cmd.py

@@ -370,6 +370,7 @@ def run_stop(args: argparse.Namespace) -> int:
             send_request(_socket_path(), {
                 "action": "stop",
                 "container_name": container_name,
+                "helper_num": helper_num,
             })
         except Exception:
             pass  # Best-effort stop
@@ -399,6 +400,7 @@ def run_cleanup(args: argparse.Namespace) -> int:
             send_request(_socket_path(), {
                 "action": "stop",
                 "container_name": container_name,
+                "helper_num": helper_num,
             })
         except Exception:
             pass

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/commands/image.py

@@ -33,7 +33,7 @@ from kanibako.rig_registry import (
     remove as registry_remove,
     upsert,
 )
-from kanibako.rig_resolve import resolve_rig
+from kanibako.rig_resolve import RigResolution, resolve_rig
 from kanibako.rig_source import derive_name, detect_source_kind, fetch_to_temp
 from kanibako.shells import capture_image_shell
 from kanibako.templates_image import (
@@ -76,6 +76,30 @@ def add_parser(subparsers: argparse._SubParsersAction) -> None:
     prep_p.add_argument("--all", action="store_true", dest="all_images", help="Prep all local kanibako rigs")
     prep_p.set_defaults(func=run_prep)
 
+    # kanibako rig update
+    update_p = image_sub.add_parser(
+        "update",
+        help="Bring a rig up to date: pull a newer image (or rebuild on it)",
+        description=(
+            "Refresh a rig to the latest image. For a pulled/prefab rig, pull "
+            "the newer upstream image; for a template/built rig, rebuild it on "
+            "top of the refreshed base. Defaults to the current box's rig "
+            "(box.image) when no name is given. This is the everyday "
+            "'get the latest' path; use 'rig prep --force' to rebuild from "
+            "scratch."
+        ),
+    )
+    update_p.add_argument(
+        "name", nargs="?", default=None,
+        help="Rig name to update (omit to update the configured box.image rig; "
+             "use --all for every local kanibako rig)",
+    )
+    update_p.add_argument(
+        "--all", action="store_true", dest="all_images",
+        help="Update all local kanibako rigs (pull each)",
+    )
+    update_p.set_defaults(func=run_update)
+
     # kanibako rig add
     add_p = image_sub.add_parser(
         "add",
@@ -778,25 +802,106 @@ def run_prep(args: argparse.Namespace) -> int:
         return 0
 
     if res.kind == "template":
-        cf = res.containerfile or get_containerfile(
-            f"template-{args.name}", containers_dir,
+        return _build_template(
+            runtime, res, args.name, containers_dir, std,
         )
-        if cf is None:
+
+    # prefab: pull (same as rebuild).
+    return _update_one(runtime, res.image, std)
+
+
+def _build_template(
+    runtime: ContainerRuntime,
+    res: RigResolution,
+    name: str,
+    containers_dir: Path,
+    std,
+) -> int:
+    """Build a template rig from its Containerfile and capture its image shell.
+
+    Shared by ``rig prep`` (build/--force-rebuild paths) and ``rig update``
+    (rebuild-on-refreshed-base path). The build always reads ``FROM`` afresh, so
+    a rebuild naturally picks up a newer base image.
+    """
+    cf = res.containerfile or get_containerfile(
+        f"template-{name}", containers_dir,
+    )
+    if cf is None:
+        print(
+            f"error: Containerfile not found for template '{name}'.",
+            file=sys.stderr,
+        )
+        return 1
+    print(f"Building rig '{name}' from {cf.name}...")
+    rc = runtime.rebuild(res.image, cf, cf.parent, build_args=None)
+    if rc == 0:
+        print(f"Rig '{name}' prepped as {res.image}")
+        capture_image_shell(runtime, res.image, std)
+    else:
+        print(f"Build failed with exit code {rc}", file=sys.stderr)
+    return rc
+
+
+def run_update(args: argparse.Namespace) -> int:
+    """Bring a rig up to date with the latest image.
+
+    Unlike ``prep`` (which short-circuits an already-prepped rig) and
+    ``prep --force`` (which rebuilds from scratch), ``update`` is the everyday
+    "get the latest" path:
+
+    * **prefab / pulled base** -> pull the upstream image again (idempotent;
+      podman reports whether the layers changed);
+    * **template / built rig** -> rebuild it, which reads ``FROM`` afresh and so
+      lands on the refreshed base;
+    * **extended (interactive)** -> has no reproducible recipe; report that it
+      can't be auto-updated.
+
+    With no *name*, the target defaults to the configured ``box.image`` rig (the
+    current box's rig). ``--all`` pulls every local kanibako rig.
+    """
+    config_file = config_file_path(xdg("XDG_CONFIG_HOME", ".config"))
+    config = load_config(config_file)
+    std = load_std_paths(config)
+    containers_dir = std.data_path / "containers"
+
+    try:
+        runtime = ContainerRuntime()
+    except ContainerError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        return 1
+
+    if args.all_images:
+        return _update_all(runtime, std)
+
+    merged = load_merged_config(config_file, None)
+
+    # Default target: the configured box.image rig (the current box's rig).
+    name = args.name if args.name is not None else merged.box_image
+
+    registry = load_registry(registry_path(std))
+    res = resolve_rig(name, runtime, std, merged, registry=registry)
+
+    if res.kind == "extended":
+        if res.prep_action == "none":
             print(
-                f"error: Containerfile not found for template '{args.name}'.",
-                file=sys.stderr,
+                f"Rig '{name}' is an extended (interactive) rig with no recipe "
+                f"to rebuild; nothing to update. Re-create it with 'rig extend', "
+                f"or move a fresh build with 'rig export'/'rig import'.",
             )
-            return 1
-        print(f"Building rig '{args.name}' from {cf.name}...")
-        rc = runtime.rebuild(res.image, cf, cf.parent, build_args=None)
-        if rc == 0:
-            print(f"Rig '{args.name}' prepped as {res.image}")
-            capture_image_shell(runtime, res.image, std)
-        else:
-            print(f"Build failed with exit code {rc}", file=sys.stderr)
-        return rc
+            return 0
+        print(
+            f"error: extended rig '{name}' image is missing and has no recipe "
+            f"to rebuild (use 'rig export'/'rig import' or 'rig extend').",
+            file=sys.stderr,
+        )
+        return 1
 
-    # prefab: pull (same as rebuild).
+    if res.kind == "template":
+        # Rebuild on the refreshed base (FROM is re-read on every build).
+        return _build_template(runtime, res, name, containers_dir, std)
+
+    # prefab / pulled base: always pull, even if already local -- the whole
+    # point of update is to fetch a possibly-newer upstream image.
     return _update_one(runtime, res.image, std)
 
 

{kanibako_cli-1.6.0.dev30 → kanibako_cli-1.6.0rc3}/src/kanibako/commands/setup_cmd.py

@@ -184,6 +184,16 @@ def run_setup(args: argparse.Namespace) -> int:
     for name, cls in targets.items():
         try:
             instance = cls()
+            if not getattr(instance, "has_binary", True):
+                # The binary-less "Shell" no-agent target needs no host binary;
+                # it ships in the image and is always available -- never flag it
+                # as "not found" (mirrors `system diagnose`).
+                print(
+                    f"  [ok] {instance.display_name} "
+                    "(image default; no host binary needed)"
+                )
+                found_any = True
+                continue
             install = instance.detect()
             if install is not None:
                 print(f"  [ok] {instance.display_name} detected")