Fix Incus host misdetection in update paths

Make Incus platform detection resilient when `incus` is installed outside PATH (e.g., /snap/bin) and when `incus info` is unavailable to non-root users. The change adds Incus binary/path resolution, ensures PATH is corrected early in build flow, prioritizes container markers before host checks, and uses filesystem/socket signals for host detection. It also hardens the menu update branch to explicitly refuse running container update logic on detected PVE/Incus hosts and provides recovery guidance.

Author: MickLesk

core/build.func

@@ -309,6 +309,12 @@ _cs_prefetch_engine || true
 
 _cs_source_func "lxc/platform.func"
 
+# Before anything asks which platform this is: the client has to be resolvable,
+# or an Incus host detects as a plain container and the ct script below runs its
+# update path against the host.
+declare -f ensure_incus_on_path >/dev/null 2>&1 && ensure_incus_on_path
+true
+
 # Inside a container the OS is a fact, not a choice. A dual-OS script branches
 # on var_os near the top of the file and only offers the menu on a host, so an
 # update took the Debian arm and told an Alpine container it needed 6 GB and

lxc/platform.func

@@ -16,25 +16,66 @@
 [[ -n "${_LXC_PLATFORM_FUNC_LOADED:-}" ]] && return
 _LXC_PLATFORM_FUNC_LOADED=1
 
+# The client is not always on PATH: a non-login shell misses /snap/bin, and
+# sudo's secure_path can drop it too. `command -v incus` then failed, detection
+# answered "container", and the ct script updated the host instead of building.
+_lxc_incus_bin() {
+  if command -v incus &>/dev/null; then
+    command -v incus
+    return 0
+  fi
+  local p
+  for p in /usr/bin/incus /usr/local/bin/incus /snap/bin/incus /opt/incus/bin/incus; do
+    [[ -x "$p" ]] && {
+      printf '%s\n' "$p"
+      return 0
+    }
+  done
+  return 1
+}
+
+# Detection finding the client is not enough - every later `incus` call in the
+# engine has to resolve too. Idempotent, and a no-op when it is already there.
+ensure_incus_on_path() {
+  command -v incus &>/dev/null && return 0
+  local bin dir
+  bin="$(_lxc_incus_bin)" || return 1
+  dir="$(dirname "$bin")"
+  case ":${PATH}:" in
+  *":${dir}:"*) ;;
+  *)
+    PATH="${dir}:${PATH}"
+    export PATH
+    ;;
+  esac
+}
+
 detect_lxc_platform() {
   if [[ -n "${LXC_PLATFORM:-}" ]]; then
     echo "$LXC_PLATFORM"
     return
   fi
 
-  if command -v pveversion &>/dev/null; then
-    echo "pve"
+  # Container markers come first now: the host test below no longer needs a
+  # reachable daemon, so a container carrying the client could match it.
+  if [[ -S /dev/incus/sock ]] || [[ -f /etc/profile.d/incus-motd.sh ]]; then
+    echo "incus-container"
     return
   fi
 
-  if command -v incus &>/dev/null && incus info &>/dev/null 2>&1; then
-    echo "incus"
+  if command -v pveversion &>/dev/null; then
+    echo "pve"
     return
   fi
 
-  if [[ -S /dev/incus/sock ]] || [[ -f /etc/profile.d/incus-motd.sh ]]; then
-    echo "incus-container"
-    return
+  # `incus info` needs a running daemon AND group membership, neither of which
+  # a non-root operator is guaranteed. On-disk state settles it either way.
+  local bin
+  if bin="$(_lxc_incus_bin)"; then
+    if "$bin" info &>/dev/null 2>&1 || [[ -d /var/lib/incus ]] || [[ -S /var/run/incus/unix.socket ]]; then
+      echo "incus"
+      return
+    fi
   fi
 
   echo "container"

ui/menu.func

@@ -1096,10 +1096,24 @@ start() {
   # five parts were six network requests between the header and the menu,
   # every run, whatever else had already been fetched.
   _cs_source_func "lib/tools.func"
+
+  # Every branch after the first updates the system it is running on. Missing
+  # pveversion used to be taken as proof of being inside a container, but an
+  # Incus host has none either, so a create run fell through and ran apt-get
+  # against the host. Only refuse on a positively identified host, so an
+  # environment we cannot classify still updates as before.
+  local _cs_platform=""
+  declare -f detect_lxc_platform >/dev/null 2>&1 && _cs_platform="$(detect_lxc_platform)"
+
   if command -v pveversion >/dev/null 2>&1; then
     runtime_script_status_guard install || return 0
     install_script || return 0
     return 0
+  elif [[ "$_cs_platform" == "pve" || "$_cs_platform" == "incus" ]]; then
+    msg_error "This is a ${_cs_platform} host, not a container - refusing to update it"
+    msg_custom "ℹ️" "${YW}" "The engine could not load the ${_cs_platform} backend, so ${APP:-this script} never got to the create path"
+    msg_custom "ℹ️" "${YW}" "Retry with: LXC_PLATFORM=${_cs_platform} bash -c \"\$(curl -fsSL <script-url>)\""
+    exit 1
   elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
     VERBOSE="no"
     set_std_mode