Shims & versions.

install-shell prepends ~/.tebako/shims to PATH inside a managed block in your shell startup file — idempotent, and removed by tebako-shim uninstall-shell. On Windows the shim directory goes on the user PATH in the registry (HKCU). Open a new shell afterwards.

tebako install registers them — registry installs always do; installing a local package file does it only with --shims. tebako uninstall <name> removes the shims and the cache entry. There is no tebako shim add/remove/list — the read-side verb is tebako-shim list.

Every invocation re-evaluates the chain. The environment beats the project, the project beats your config, your config beats the publisher’s default.

1. Environment — one shell, one pin.

The variable name is the tool name uppercased, non-alphanumerics replaced with underscores — a tool mn-cli answers to TEBAKO_MN_CLI_VERSION. Highest precedence, easiest to undo.

2. Project file — pinned with the code.

The dispatcher walks up from the current directory; the nearest file that pins the command wins. A nearer file that does not mention the command does not shadow a farther one that does. Commit the file with the project.

3. Your defaults in ~/.tebako/config.yaml.

Hand-edited. The only command that ever writes this file is tebako add-registry; there is no tebako use.

4. Registry default — the publisher’s word.

If nothing above pins a version, the registry’s own default: entry decides.

The chosen entrypoint declares a runtime requirement. The dispatcher picks the newest compatible runtime already in the cache — no download — or, if none fits, downloads, verifies, and caches one. Pure-language payloads declare a range (>= 3.3, < 5.0); native-extension payloads pin an ABI line (~> 3.3.0) plus a platform ABI string, and a wrong line is a named error, never a segfault. Entrypoints that need no interpreter — native tools — declare no runtime and get none.

which is read-only: it shows what this invocation would dispatch — payload, where the version came from, image, entrypoint, runtime, mounts, and the final exec argv — without running anything. Output above is representative.

doctor checks that the shim directory is on PATH, that every shim resolves, that payload records and their trust anchors exist, that the config parses, that registries are fresh, and that the runtime cache is intact. It ends with no problems found (exit 0) or a problem count (exit 1). Note the binary: there is no tebako doctor — the verb is tebako-shim doctor.

disable parks a version — or the whole tool — so dispatch no longer selects it; enable restores it. The state lives in ~/.tebako/shims/.disabled.yaml: a plain YAML file you can read or edit.

Leading --jail, --mount, and --no-host tokens are consumed by the dispatcher; everything after them reaches the payload verbatim. The policy grammar is in the jails guide.

See also: Set a jail policy · Debug & logging · Dispatch, in the architecture docs.