lager-cli 0.32.1__tar.gz → 0.32.2__tar.gz

{lager_cli-0.32.1/lager_cli.egg-info → lager_cli-0.32.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.1
+Version: 0.32.2
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data
@@ -274,10 +274,10 @@ lager devenv terminal
 ### Package Management
 ```bash
 # Add a package to the box's declarative config
-lager box config pip add numpy
+lager box-config pip add numpy
 
 # Apply the change (restarts the lager container, runs pip install)
-lager box config apply
+lager box-config apply
 ```
 
 ## Supported Hardware

{lager_cli-0.32.1 → lager_cli-0.32.2}/README.md

@@ -221,10 +221,10 @@ lager devenv terminal
 ### Package Management
 ```bash
 # Add a package to the box's declarative config
-lager box config pip add numpy
+lager box-config pip add numpy
 
 # Apply the change (restarts the lager container, runs pip install)
-lager box config apply
+lager box-config apply
 ```
 
 ## Supported Hardware

{lager_cli-0.32.1 → lager_cli-0.32.2}/__init__.py

@@ -7,4 +7,4 @@ Lager CLI
 A Command Line Interface for Lager Data
 """
 
-__version__ = '0.32.1'
+__version__ = '0.32.2'

{lager_cli-0.32.1 → lager_cli-0.32.2}/box_storage.py

@@ -458,7 +458,7 @@ def _check_box_lock(ip, box_name):
 
     try:
         resp = requests.get(f'http://{ip}:9000/lock', timeout=3, **_gateway_kwargs(ip))
-        _check_gateway(resp, ip)
+        resp = _check_gateway(resp, ip)
         if resp.status_code == 404:
             # :9000 answered but has no /lock route: the box image predates
             # the lock API on :9000. Locks can't be enforced against it, so
@@ -581,12 +581,57 @@ def _gateway_kwargs(ip):
     return {'headers': headers} if headers else {}
 
 
+def _resend_with_auth(prepared, headers):
+    """Re-send an already-prepared request with extra headers merged in.
+    Returns the new response, or None if the resend itself failed."""
+    import requests
+    req = prepared.copy()
+    for key, value in headers.items():
+        req.headers[key] = value
+    try:
+        return requests.Session().send(req, timeout=30, stream=False)
+    except requests.RequestException:
+        return None
+
+
 def _check_gateway(resp, ip):
-    """Turn a gateway denial into the actionable `lager login` error and
-    record the box→auth-server mapping so the next call authenticates."""
-    from .gateway_auth import DISCOVERY_HEADER, handle_gateway_denial
-    if resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp.headers:
-        handle_gateway_denial(resp, ip)
+    """Resolve a gateway response, returning the response the caller should use.
+
+    On a plain (un-gated) box this is a passthrough. On a gated box:
+
+    - First contact — we sent no token (the box→auth-server link is only
+      learned from this very 401's discovery header) but we already hold a
+      session for that server: record the mapping, attach the token, and
+      retry the request once. The caller gets the authenticated response and
+      never sees the round trip. A plain box never receives the token,
+      because only a gateway sends the discovery header.
+    - Genuine denials (revoked session, no access grant, auth server down)
+      raise the actionable `lager login` / "ask your admin" error as before.
+
+    Callers should adopt the return value: ``resp = _check_gateway(resp, ip)``.
+    """
+    from .gateway_auth import (
+        DISCOVERY_HEADER, handle_gateway_denial,
+        record_box_auth_server, auth_headers_for_box,
+    )
+    if not (resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp.headers):
+        return resp
+
+    sent_auth = 'Authorization' in getattr(resp.request, 'headers', {})
+    if resp.status_code == 401 and not sent_auth:
+        record_box_auth_server(ip, resp.headers[DISCOVERY_HEADER])
+        headers = auth_headers_for_box(ip)
+        if headers:
+            retried = _resend_with_auth(resp.request, headers)
+            if retried is not None:
+                gated = (retried.status_code in (401, 403, 503)
+                         and DISCOVERY_HEADER in retried.headers)
+                if not gated:
+                    return retried      # transparently authenticated
+                resp = retried          # still refused — report on the retry
+
+    handle_gateway_denial(resp, ip)     # raises the actionable error
+    return resp
 
 
 def _lock_url(ip, suffix=''):
@@ -637,7 +682,7 @@ def acquire_box_lock(
     # the pre-existing lock as freshly acquired — and release it on exit.
     try:
         pre = requests.get(_lock_url(ip), timeout=5, **_gateway_kwargs(ip))
-        _check_gateway(pre, ip)
+        pre = _check_gateway(pre, ip)
         if pre.status_code == 200:
             try:
                 pre_data = pre.json()
@@ -663,7 +708,7 @@ def acquire_box_lock(
     while True:
         try:
             resp = requests.post(_lock_url(ip), json=payload, timeout=5, **_gateway_kwargs(ip))
-            _check_gateway(resp, ip)
+            resp = _check_gateway(resp, ip)
         except requests.exceptions.RequestException as exc:
             if not quiet:
                 click.secho(

{lager_cli-0.32.1 → lager_cli-0.32.2}/commands/box/_host_ops.py

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """
-Host-side SSH helpers for `lager box config apply`:
+Host-side SSH helpers for `lager box-config apply`:
   - apt_install: `sudo apt-get install -y` over SSH
   - sysctl_apply: write /etc/sysctl.d/99-lager-box-config.conf + sysctl --system
 
@@ -25,7 +25,7 @@ from ._ssh import SshRunner, default_ssh_runner, sudo_error_message
 
 SYSCTL_CONF_PATH = "/etc/sysctl.d/99-lager-box-config.conf"
 _SYSCTL_HEADER = (
-    "# Managed by `lager box config sysctl`; manual edits are overwritten on apply.\n"
+    "# Managed by `lager box-config sysctl`; manual edits are overwritten on apply.\n"
 )
 
 # User udev rules live in their own file so they never collide with the
@@ -37,13 +37,13 @@ UDEV_RULES_DIR = "/etc/udev/rules.d/"
 UDEV_RULES_PATH = UDEV_RULES_DIR + UDEV_RULES_FILENAME
 _UDEV_TMP_PATH = "/tmp/" + UDEV_RULES_FILENAME
 _UDEV_HEADER = (
-    "# Managed by `lager box config udev`; manual edits are overwritten on apply.\n"
+    "# Managed by `lager box-config udev`; manual edits are overwritten on apply.\n"
 )
 
 # --- Box-config sudoers rule: single source of truth ------------------------
 #
 # `lager install` and `lager update` write this rule to BOXCFG_SUDOERS_PATH
-# so `lager box config apply` can run apt-get/sysctl/mkdir/chown over
+# so `lager box-config apply` can run apt-get/sysctl/mkdir/chown over
 # BatchMode SSH. The rule must name the actual login user: it used to
 # hardcode `lagerdata`, so on boxes with a different login user the grant
 # never matched — install ended with "Sudoers file installed
@@ -69,7 +69,7 @@ def is_valid_unix_username(user: Optional[str]) -> bool:
 
 
 def boxcfg_sudoers_rules(user: str = "lagerdata") -> List[str]:
-    """The NOPASSWD rule lines for `lager box config apply`. tee/rm/sysctl
+    """The NOPASSWD rule lines for `lager box-config apply`. tee/rm/sysctl
     are path-scoped so a compromised account cannot escalate via them;
     apt-get and mkdir/chown are unscoped because the package list and host
     paths are user-defined. SETENV on apt-get is required so
@@ -127,7 +127,7 @@ def udev_sudoers_bootstrap(user: str = "lagerdata") -> str:
         "  SUDOERS\n"
         "  sudo chmod 440 /etc/sudoers.d/lagerdata-udev\n"
         "\n"
-        "Then re-run `lager box config apply`."
+        "Then re-run `lager box-config apply`."
     )
 
 
@@ -150,7 +150,7 @@ def sudoers_bootstrap(user: str = "lagerdata") -> str:
         f"  sudo chmod 440 {BOXCFG_SUDOERS_PATH}\n"
         f"  sudo touch {BOXCFG_SUDOERS_MARKER} && sudo chmod 644 {BOXCFG_SUDOERS_MARKER}\n"
         "\n"
-        "Then re-run `lager box config apply`. tee/rm/sysctl are path-scoped so a "
+        "Then re-run `lager box-config apply`. tee/rm/sysctl are path-scoped so a "
         f"compromised {user} account cannot escalate to root via them; apt-get "
         "and mkdir/chown are unscoped because the package list and host paths are "
         "user-defined. SETENV on apt-get is required so "
@@ -264,7 +264,7 @@ def render_udev_rules_file(rules: List[Dict[str, object]]) -> str:
         vid = str(r.get("vid", ""))
         pid = str(r.get("pid", ""))
         mode = str(r.get("mode", "0660"))
-        body += f"# vid:pid {vid}:{pid} (added via `lager box config udev`)\n"
+        body += f"# vid:pid {vid}:{pid} (added via `lager box-config udev`)\n"
         body += (
             f'SUBSYSTEM=="usb", ATTRS{{idVendor}}=="{vid}", '
             f'ATTRS{{idProduct}}=="{pid}", MODE="{mode}", GROUP="lager"\n'

{lager_cli-0.32.1 → lager_cli-0.32.2}/commands/box/_mount_prep.py

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """
-Auto-prep helper for `lager box config` mounts.
+Auto-prep helper for `lager box-config` mounts.
 
 The lager container runs as uid 33 (www-data). For every host->container
 bind mount, the host path must (a) exist and (b) for read-write mounts,
@@ -49,7 +49,7 @@ def sudoers_bootstrap(user: str = "lagerdata") -> str:
         "    | sudo tee /etc/sudoers.d/lager-box-config\n"
         "  sudo chmod 440 /etc/sudoers.d/lager-box-config\n"
         "\n"
-        "Then re-run `lager box config mount add ...` (or `apply`). The "
+        "Then re-run `lager box-config mount add ...` (or `apply`). The "
         "rule is narrow-scoped (mkdir + chown only)."
     )
 

{lager_cli-0.32.1 → lager_cli-0.32.2}/commands/box/_pip_validation.py

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """
-Host-side helpers for `lager box config pip add`:
+Host-side helpers for `lager box-config pip add`:
   - PyPI existence check (best-effort, network-error tolerant)
 
 Format validation lives box-side only (see box/lager/box_config/config.py).

{lager_cli-0.32.1 → lager_cli-0.32.2}/commands/box/_ssh.py

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """
-Shared SSH transport for `lager box config` host-side operations.
+Shared SSH transport for `lager box-config` host-side operations.
 
 A single default runner (with optional stdin), and a parameterized
 sudo-error helper. Callers (mount prep, apply-time host ops, container
@@ -23,7 +23,7 @@ from ...errors import LagerError
 SshRunner = Callable[..., Tuple[int, str, str]]
 
 # Dedicated key used by `lager install` / `lager update`. When present,
-# it's tried first for all `lager box config` SSH calls — on boxes
+# it's tried first for all `lager box-config` SSH calls — on boxes
 # provisioned by lager it's the only key authorized for the box user.
 # Passing `-i` replaces ssh's default identity list, so when this key
 # is NOT authorized for the box's user (customer-managed users), a key
@@ -46,7 +46,7 @@ def ensure_lager_box_keypair(key_path: str = _LAGER_BOX_KEY) -> bool:
 
     Returns True if a new key was generated, False if one already existed.
     Raises :class:`LagerError` if ssh-keygen fails. This is the single
-    definition of how the lager_box key is created — ``lager authorize``
+    definition of how the lager_box key is created — ``lager ssh-setup``
     and ``lager update`` both call it, so the key type and comment can
     never drift apart between the two provisioning paths.
     """

lager_cli-0.32.2/commands/box/box_group.py

@@ -0,0 +1,36 @@
+# Copyright 2024-2026 Lager Data
+# SPDX-License-Identifier: Apache-2.0
+
+"""
+Deprecated `lager box` group. The subcommands moved to top level —
+`lager box config` became `lager box-config`, and `lager box dut`
+became `lager dut`. This hidden group keeps the old spellings working
+with a deprecation warning until they are removed.
+"""
+import click
+
+from .config import box_config
+from .dut import box_dut
+from ...core.group_usage import LagerGroup
+
+_RENAMES = {
+    "config": "lager box-config",
+    "dut": "lager dut",
+}
+
+
+@click.group(name="box", cls=LagerGroup, hidden=True)
+@click.pass_context
+def box(ctx: click.Context) -> None:
+    """Deprecated aliases for `lager box-config` and `lager dut`."""
+    new = _RENAMES.get(ctx.invoked_subcommand)
+    if new:
+        click.secho(
+            f"DEPRECATED: `lager box {ctx.invoked_subcommand}` is now `{new}`. "
+            "The old spelling still works but will be removed in a future release.",
+            fg="yellow", err=True,
+        )
+
+
+box.add_command(box_config, name="config")
+box.add_command(box_dut, name="dut")

{lager_cli-0.32.1 → lager_cli-0.32.2}/commands/box/config.py

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """
-`lager box config` — declarative per-box provisioning.
+`lager box-config` — declarative per-box provisioning.
 
 Reads/writes /etc/lager/box_config.json on the box (via the
 in-container shim cli/impl/box_config.py) and ships an `apply` verb
@@ -141,7 +141,7 @@ def _list_field(
 ) -> None:
     """Resolve box, fetch `show`, pluck `key`, print formatted entries.
 
-    Shared by every `lager box config <group> list` command. List-valued
+    Shared by every `lager box-config <group> list` command. List-valued
     fields (mounts/volumes/pip_packages/...) iterate items; the one dict
     field (sysctl) iterates key/value pairs — the formatter takes a tuple
     in that case, mirroring the diff printer's convention.
@@ -166,7 +166,7 @@ def _list_field(
             click.echo(formatter(item))
 
 
-@click.group(name="config", cls=LagerGroup, invoke_without_command=True, help="Manage declarative box provisioning")
+@click.group(name="box-config", cls=LagerGroup, invoke_without_command=True, help="Manage declarative box provisioning")
 @click.option("--box", help="Lagerbox name or IP")
 @click.pass_context
 def box_config(ctx: click.Context, box: Optional[str]) -> None:
@@ -200,7 +200,7 @@ def show_cmd(
             if i > 0:
                 click.echo()
             click.secho(
-                f"No box_config.json on {resolved}. Run `lager box config init`.",
+                f"No box_config.json on {resolved}. Run `lager box-config init`.",
                 fg="yellow",
             )
             continue
@@ -495,7 +495,7 @@ def init_cmd(ctx: click.Context, box: Optional[str], force: bool) -> None:
                 + ", ".join(imported),
                 fg="green",
             )
-            click.echo("Run `lager box config apply` to (re)install them in the container.")
+            click.echo("Run `lager box-config apply` to (re)install them in the container.")
         skipped = payload.get("skipped") or []
         if skipped:
             click.secho(f"Skipped {len(skipped)} legacy package(s):", fg="yellow")
@@ -653,7 +653,7 @@ def diff_cmd(ctx: click.Context, box: Optional[str], as_json: bool) -> None:
 def status_cmd(ctx: click.Context, box: Optional[str], as_json: bool) -> None:
     """Quick health check: clean vs. drifted, field counts, last audit entry.
 
-    Designed for `lager box config status --box <BOX>,<BOX>,<BOX>` —
+    Designed for `lager box-config status --box <BOX>,<BOX>,<BOX>` —
     one line of signal per box without needing to read full `show` output.
     """
     targets = _resolve_boxes(ctx, box)
@@ -694,7 +694,7 @@ def _print_status_human(s: dict) -> None:
     state = click.style("clean", fg="green") if s["clean"] else click.style("DRIFT", fg="yellow")
     click.echo(f"{box}: {state}")
     if not s["clean"]:
-        click.echo(f"  run `lager box config diff --box {box}` to see pending changes")
+        click.echo(f"  run `lager box-config diff --box {box}` to see pending changes")
     nonzero = {k: n for k, n in s["counts"].items() if n}
     if nonzero:
         # Compact rendering: "2 mounts, 3 pip, 1 cargo"
@@ -758,7 +758,7 @@ def import_cmd(ctx: click.Context, path: str, box: Optional[str], yes: bool) ->
         _print_errors(response.get("errors") or [response.get("error", "unknown error")])
         ctx.exit(1)
     click.secho(f"Imported {path} to {resolved}.", fg="green")
-    click.echo("Run `lager box config apply` to put the new config into effect.")
+    click.echo("Run `lager box-config apply` to put the new config into effect.")
 
 
 @box_config.command("edit", help="Open the box's config in $EDITOR for live editing.")
@@ -827,7 +827,7 @@ def edit_cmd(ctx: click.Context, box: Optional[str]) -> None:
             )
             if response.get("ok"):
                 click.secho(f"Saved on {resolved}.", fg="green")
-                click.echo("Run `lager box config apply` to put the new config into effect.")
+                click.echo("Run `lager box-config apply` to put the new config into effect.")
                 return
             click.secho("Config has errors:", fg="red", err=True)
             _print_errors(response.get("errors") or [])
@@ -883,7 +883,7 @@ def copy_cmd(ctx: click.Context, src: str, dst: str, yes: bool) -> None:
     click.secho(
         f"Copied config from {src_resolved} to {dst_resolved}.", fg="green",
     )
-    click.echo(f"Run `lager box config apply --box {dst}` to put the new config into effect.")
+    click.echo(f"Run `lager box-config apply --box {dst}` to put the new config into effect.")
 
 
 @box_config.command(
@@ -897,11 +897,11 @@ def repair_cmd(ctx: click.Context, box: Optional[str], yes: bool) -> None:
     """Recover a box whose box_config.json is broken or whose container
     is wedged on a bad config.
 
-    Does what `lager box config apply`'s rollback path does automatically
+    Does what `lager box-config apply`'s rollback path does automatically
     when a bounce fails — but exposed as a manual verb for situations
     that don't trigger automatic rollback:
     - Operator hand-edited /etc/lager/box_config.json into invalid JSON
-      (bypassing `lager box config edit`'s validation)
+      (bypassing `lager box-config edit`'s validation)
     - First-apply bounce failed AND there's no snapshot yet (rollback
       can't fire) — in that case this command also exits with no-snapshot
     - Container is up but the renderer soft-failed on a stale config and
@@ -925,9 +925,9 @@ def repair_cmd(ctx: click.Context, box: Optional[str], yes: bool) -> None:
     if rc != 0:
         click.secho(
             f"No applied snapshot on {resolved}; cannot repair. This box has "
-            "never had a successful `lager box config apply`. Manual fix: ssh "
+            "never had a successful `lager box-config apply`. Manual fix: ssh "
             "in, delete or hand-edit /etc/lager/box_config.json, then re-run "
-            "`lager box config init`.",
+            "`lager box-config init`.",
             fg="red", err=True,
         )
         ctx.exit(1)
@@ -1084,7 +1084,7 @@ def reset_cmd(ctx: click.Context, box: Optional[str], yes: bool, do_apply: bool)
         # config, even if it happened to already be empty.
         ctx.invoke(apply_cmd, box=box, yes=True, force=True)
     else:
-        click.echo("Run `lager box config apply` to restart the container on the empty config.")
+        click.echo("Run `lager box-config apply` to restart the container on the empty config.")
 
 
 @box_config.command(
@@ -1153,7 +1153,7 @@ def _apply_one(
     payload = _parse_response(raw, ctx)
     if not payload.get("exists", True):
         click.secho(
-            f"No box_config.json on {resolved}. Run `lager box config init` first.",
+            f"No box_config.json on {resolved}. Run `lager box-config init` first.",
             fg="yellow",
         )
         return False
@@ -1254,7 +1254,7 @@ def _apply_one(
         click.secho(
             f"Box config was NOT applied on {resolved} (the container is up and "
             "running the previous config). The applied-hash was left unchanged, "
-            "so `lager box config apply` will retry this config once the box is "
+            "so `lager box-config apply` will retry this config once the box is "
             "repaired — typically with `lager update --box <BOX>`.",
             fg="red",
             err=True,
@@ -1274,7 +1274,7 @@ def _apply_one(
             click.secho(
                 "Rolled back to the previously applied config; the new config "
                 "was rejected. The container is up on the previous config — fix "
-                "/etc/lager/box_config.json and re-run `lager box config apply`.",
+                "/etc/lager/box_config.json and re-run `lager box-config apply`.",
                 fg="yellow",
                 err=True,
             )
@@ -1342,7 +1342,7 @@ def _post_apply_consistency_ok(
         )
         _print_errors(post_validate.get("errors") or [])
         click.secho(
-            "Not updating applied-hash. Fix the file and re-run `lager box config apply`.",
+            "Not updating applied-hash. Fix the file and re-run `lager box-config apply`.",
             fg="yellow",
             err=True,
         )
@@ -1356,7 +1356,7 @@ def _post_apply_consistency_ok(
             "Warning: box_config.json was modified during apply. Container is "
             "running with the snapshot captured at the start of apply; the "
             "latest on-disk changes have NOT been applied. Re-run "
-            "`lager box config apply` to pick them up.",
+            "`lager box-config apply` to pick them up.",
             fg="yellow",
             err=True,
         )
@@ -1602,7 +1602,7 @@ def _preflight_mounts(ctx: click.Context, resolved: str, *, recursive: bool) ->
             "Warning: could not verify mount host paths over SSH; continuing with "
             "apply. If the container fails to start or a mounted path is missing "
             "or unwritable, fix SSH access to the box host (see above) and re-run "
-            "`lager box config apply`.",
+            "`lager box-config apply`.",
             fg="yellow",
             err=True,
         )
@@ -1686,7 +1686,7 @@ def _bounce_container_rc(ctx: click.Context, resolved_box: str) -> int:
         click.secho(
             f"SSH command timed out after {_BOUNCE_TIMEOUT_SECONDS // 60} minutes. "
             "start_box.sh may still be running on the box (cargo build, etc.); "
-            "re-run `lager box config apply` once it finishes.",
+            "re-run `lager box-config apply` once it finishes.",
             fg="red", err=True,
         )
         return _BOUNCE_FAILED
@@ -1823,7 +1823,7 @@ def mount_add_cmd(
                 # let apply's pre-flight re-check once SSH access is fixed.
                 click.secho(f"Warning: {prep_result.message}", fg="yellow", err=True)
                 click.secho(
-                    "Adding the mount to box_config.json anyway; `lager box config "
+                    "Adding the mount to box_config.json anyway; `lager box-config "
                     "apply` re-checks the host path before restarting the container.",
                     fg="yellow",
                 )
@@ -1868,7 +1868,7 @@ def mount_add_cmd(
         else:
             click.secho(f"Host path: {prep_result.message}", fg="green")
 
-    click.echo("Run `lager box config apply` to restart the container.")
+    click.echo("Run `lager box-config apply` to restart the container.")
 
 
 @mount_group.command("remove", help="Remove a bind mount by host+container path.")
@@ -1892,7 +1892,7 @@ def mount_remove_cmd(
     payload = _parse_response(raw, ctx)
     if payload.get("removed"):
         click.secho(f"Removed mount {host} -> {container} on {resolved}.", fg="green")
-        click.echo("Run `lager box config apply` to restart the container.")
+        click.echo("Run `lager box-config apply` to restart the container.")
     else:
         click.secho(f"No matching mount on {resolved}.", fg="yellow")
 
@@ -1933,7 +1933,7 @@ def volume_add_cmd(
         _print_errors(payload.get("errors") or [payload.get("error", "unknown error")])
         ctx.exit(1)
     click.secho(f"Added volume {name} -> {container} on {resolved}.", fg="green")
-    click.echo("Run `lager box config apply` to restart the container.")
+    click.echo("Run `lager box-config apply` to restart the container.")
 
 
 @volume_group.command("remove", help="Remove a named docker volume by name.")
@@ -1955,7 +1955,7 @@ def volume_remove_cmd(
     payload = _parse_response(raw, ctx)
     if payload.get("removed"):
         click.secho(f"Removed volume {name} on {resolved}.", fg="green")
-        click.echo("Run `lager box config apply` to restart the container.")
+        click.echo("Run `lager box-config apply` to restart the container.")
     else:
         click.secho(f"No volume named {name} on {resolved}.", fg="yellow")
 
@@ -2022,7 +2022,7 @@ def pip_add_cmd(
         ctx.exit(1)
     added = payload.get("added") or list(packages)
     click.secho(f"Added {len(added)} pip package(s) on {resolved}: " + ", ".join(added), fg="green")
-    click.echo("Run `lager box config apply` to install them in the container.")
+    click.echo("Run `lager box-config apply` to install them in the container.")
 
 
 @pip_group.command("remove", help="Remove one or more pip packages from the box config.")
@@ -2040,7 +2040,7 @@ def pip_remove_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> N
     removed = payload.get("removed") or []
     if removed:
         click.secho(f"Removed {len(removed)} pip package(s): " + ", ".join(removed), fg="green")
-        click.echo("Run `lager box config apply` to update the running container.")
+        click.echo("Run `lager box-config apply` to update the running container.")
     else:
         click.secho("No matching pip packages were configured.", fg="yellow")
 
@@ -2063,7 +2063,7 @@ def pip_import_legacy_cmd(ctx: click.Context, box: Optional[str]) -> None:
     skipped = payload.get("skipped") or []
     if imported:
         click.secho(f"Imported {len(imported)} package(s): " + ", ".join(imported), fg="green")
-        click.echo("Run `lager box config apply` to (re)install them.")
+        click.echo("Run `lager box-config apply` to (re)install them.")
     else:
         click.secho("No new packages to import.", fg="yellow")
     if skipped:
@@ -2109,7 +2109,7 @@ def apt_add_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> None
         ctx.exit(1)
     added = payload.get("added") or list(packages)
     click.secho(f"Added {len(added)} apt package(s) on {resolved}: " + ", ".join(added), fg="green")
-    click.echo("Run `lager box config apply` to install them on the box host.")
+    click.echo("Run `lager box-config apply` to install them on the box host.")
 
 
 @apt_group.command("remove", help="Remove one or more apt packages from the box config.")
@@ -2128,7 +2128,7 @@ def apt_remove_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> N
     if removed:
         click.secho(f"Removed {len(removed)} apt package(s): " + ", ".join(removed), fg="green")
         click.echo(
-            "Run `lager box config apply` to record the change. Note: existing "
+            "Run `lager box-config apply` to record the change. Note: existing "
             "installs are not auto-uninstalled."
         )
     else:
@@ -2199,7 +2199,7 @@ def udev_add_cmd(
         ctx.exit(1)
     added = payload.get("added") or [f"{r['vid']}:{r['pid']}" for r in rules]
     click.secho(f"Added {len(added)} udev rule(s) on {resolved}: " + ", ".join(added), fg="green")
-    click.echo("Run `lager box config apply` to install them on the box host.")
+    click.echo("Run `lager box-config apply` to install them on the box host.")
 
 
 @udev_group.command("remove", help="Remove udev rules by VID:PID.")
@@ -2218,7 +2218,7 @@ def udev_remove_cmd(ctx: click.Context, devices: tuple, box: Optional[str]) -> N
     removed = payload.get("removed") or []
     if removed:
         click.secho(f"Removed {len(removed)} udev rule(s): " + ", ".join(removed), fg="green")
-        click.echo("Run `lager box config apply` to update udev on the box host.")
+        click.echo("Run `lager box-config apply` to update udev on the box host.")
     else:
         click.secho("No matching udev rules were configured.", fg="yellow")
 
@@ -2281,7 +2281,7 @@ def sysctl_set_cmd(ctx: click.Context, entries: tuple, box: Optional[str]) -> No
         f"Set {len(set_keys)} sysctl key(s) on {resolved}: " + ", ".join(set_keys),
         fg="green",
     )
-    click.echo("Run `lager box config apply` to write /etc/sysctl.d/ and reload.")
+    click.echo("Run `lager box-config apply` to write /etc/sysctl.d/ and reload.")
 
 
 @sysctl_group.command("unset", help="Remove one or more sysctl keys from the box config.")
@@ -2299,7 +2299,7 @@ def sysctl_unset_cmd(ctx: click.Context, keys: tuple, box: Optional[str]) -> Non
     removed = payload.get("removed") or []
     if removed:
         click.secho(f"Removed {len(removed)} sysctl key(s): " + ", ".join(removed), fg="green")
-        click.echo("Run `lager box config apply` to update /etc/sysctl.d/ and reload.")
+        click.echo("Run `lager box-config apply` to update /etc/sysctl.d/ and reload.")
     else:
         click.secho("No matching sysctl keys were configured.", fg="yellow")
 
@@ -2362,7 +2362,7 @@ def env_set_cmd(ctx: click.Context, entries: tuple, box: Optional[str]) -> None:
         f"Set {len(set_keys)} env var(s) on {resolved}: " + ", ".join(set_keys),
         fg="green",
     )
-    click.echo("Run `lager box config apply` to put the new env vars into effect.")
+    click.echo("Run `lager box-config apply` to put the new env vars into effect.")
 
 
 @env_group.command("unset", help="Remove one or more env vars from the box config.")
@@ -2380,7 +2380,7 @@ def env_unset_cmd(ctx: click.Context, keys: tuple, box: Optional[str]) -> None:
     removed = payload.get("removed") or []
     if removed:
         click.secho(f"Removed {len(removed)} env var(s): " + ", ".join(removed), fg="green")
-        click.echo("Run `lager box config apply` to update the running container.")
+        click.echo("Run `lager box-config apply` to update the running container.")
     else:
         click.secho("No matching env vars were configured.", fg="yellow")
 
@@ -2420,7 +2420,7 @@ def cargo_add_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> No
         ctx.exit(1)
     added = payload.get("added") or list(packages)
     click.secho(f"Added {len(added)} cargo crate(s) on {resolved}: " + ", ".join(added), fg="green")
-    click.echo("Run `lager box config apply` to install them in the container.")
+    click.echo("Run `lager box-config apply` to install them in the container.")
 
 
 @cargo_group.command("remove", help="Remove one or more cargo crates from the box config.")
@@ -2439,7 +2439,7 @@ def cargo_remove_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) ->
     if removed:
         click.secho(f"Removed {len(removed)} cargo crate(s): " + ", ".join(removed), fg="green")
         click.echo(
-            "Run `lager box config apply` to record the change. Note: existing "
+            "Run `lager box-config apply` to record the change. Note: existing "
             "installs in the container are not auto-uninstalled."
         )
     else:
@@ -2481,7 +2481,7 @@ def npm_add_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> None
         ctx.exit(1)
     added = payload.get("added") or list(packages)
     click.secho(f"Added {len(added)} npm package(s) on {resolved}: " + ", ".join(added), fg="green")
-    click.echo("Run `lager box config apply` to install them in the container.")
+    click.echo("Run `lager box-config apply` to install them in the container.")
 
 
 @npm_group.command("remove", help="Remove one or more npm packages from the box config.")
@@ -2500,7 +2500,7 @@ def npm_remove_cmd(ctx: click.Context, packages: tuple, box: Optional[str]) -> N
     if removed:
         click.secho(f"Removed {len(removed)} npm package(s): " + ", ".join(removed), fg="green")
         click.echo(
-            "Run `lager box config apply` to record the change. Note: existing "
+            "Run `lager box-config apply` to record the change. Note: existing "
             "installs in the container are not auto-uninstalled."
         )
     else: