fix WSL tmux upgrades and add Byobu, Trustmux, and Bubblewrap

catalog/README.md

@@ -71,7 +71,7 @@ Install tools via system package managers (apt, brew, dnf, pacman).
 2. The tool will automatically be available via `make install-<tool>`, `make upgrade-<tool>`, `make uninstall-<tool>`, and `make reconcile-<tool>`
 3. No need to create a custom install script!
 
-Currently **100 tools** are cataloged.
+Currently **103 tools** are cataloged.
 
 ## Environment Variables
 
@@ -96,6 +96,6 @@ make upgrade
 
 ## Architecture
 
-All 100 tools have catalog entries. The generic installer (`scripts/install_tool.sh`) reads a tool's catalog JSON and delegates to the appropriate method-specific installer under `scripts/installers/`. Tools with complex installation needs (python, node, docker, rust, etc.) use `install_method: "dedicated_script"` to route to their existing bespoke scripts.
+All 103 tools have catalog entries. The generic installer (`scripts/install_tool.sh`) reads a tool's catalog JSON and delegates to the appropriate method-specific installer under `scripts/installers/`. Tools with complex installation needs (python, node, docker, rust, etc.) use `install_method: "dedicated_script"` to route to their existing bespoke scripts.
 
 See [ADR-007](../docs/adr/ADR-007-generic-tool-installation-architecture.md) for the full architectural decision record.

catalog/bwrap.json

@@ -0,0 +1,21 @@
+{
+  "name": "bwrap",
+  "category": "security",
+  "install_method": "package_manager",
+  "description": "Unprivileged sandboxing tool based on Linux namespaces",
+  "homepage": "https://github.com/containers/bubblewrap",
+  "github_repo": "containers/bubblewrap",
+  "binary_name": "bwrap",
+  "version_command": "bwrap --version 2>/dev/null | head -1",
+  "packages": {
+    "apt": "bubblewrap",
+    "dnf": "bubblewrap",
+    "pacman": "bubblewrap"
+  },
+  "tags": [
+    "sandbox",
+    "security",
+    "linux"
+  ],
+  "notes": "Linux-only sandbox runtime. The package is named bubblewrap; the executable is bwrap."
+}

catalog/byobu.json

@@ -0,0 +1,15 @@
+{
+  "name": "byobu",
+  "category": "general",
+  "install_method": "dedicated_script",
+  "description": "Text-based window manager and terminal multiplexer enhancement",
+  "homepage": "https://byobu.org/",
+  "github_repo": "dustinkirkland/byobu",
+  "binary_name": "byobu",
+  "script": "install_byobu.sh",
+  "version_command": "awk -F= '$1 == \"VERSION\" { print $2; exit }' \"$(command -v byobu)\"",
+  "requires": [
+    "tmux"
+  ],
+  "notes": "Built from the newest stable upstream source tag because distribution packages lag behind."
+}

catalog/trustmux.json

@@ -0,0 +1,15 @@
+{
+  "name": "trustmux",
+  "category": "security",
+  "install_method": "uv_tool",
+  "description": "Secure mobile companion for remote tmux sessions over Tailscale",
+  "homepage": "https://trustmux.dev/",
+  "package_name": "trustmux",
+  "binary_name": "trustmux",
+  "source_kind": "pypi",
+  "version_command": "trustmuxd --version 2>/dev/null | head -1",
+  "requires": [
+    "tmux"
+  ],
+  "notes": "Installed from the newest stable PyPI release instead of the distribution package bundled with Byobu."
+}

docs/superpowers/plans/2026-07-27-byobu-trustmux-installers.md

@@ -0,0 +1,68 @@
+# Byobu and Trustmux Upstream Installers Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add audited, user-local installations of the latest stable Byobu and Trustmux releases without using distribution packages.
+
+**Architecture:** Byobu uses a dedicated Bash installer because upstream publishes source tags rather than a standalone binary; it selects only numeric stable tags, builds the tagged archive, and installs under `~/.local`. Trustmux uses the existing generic `uv_tool` installer and its official PyPI package. Both catalog entries feed the existing GitHub/PyPI collectors and snapshot model.
+
+**Tech Stack:** Bash, GitHub REST API/source archives, Autoconf/Automake/Make, JSON catalog metadata, uv/PyPI, pytest.
+
+---
+
+## Task 1: Specify catalog and installer behavior with failing tests
+
+**Files:**
+- Modify: `tests/test_catalog_and_collectors.py`
+- Test: `tests/test_catalog_and_collectors.py`
+
+- [ ] Add `TestByobuCatalog` assertions for `catalog/byobu.json`, `name == "byobu"`, `install_method == "dedicated_script"`, `script == "install_byobu.sh"`, `github_repo == "dustinkirkland/byobu"`, `binary_name == "byobu"`, and `requires == ["tmux"]`.
+- [ ] Add `TestByobuInstallScript` assertions that `scripts/install_byobu.sh` exists, is executable, filters tags with the stable numeric expression `^[0-9]+([.][0-9]+)+$`, uses the GitHub tag archive URL, configures `--prefix="$INSTALL_PREFIX"`, supports uninstall, and verifies `$INSTALL_PREFIX/bin/byobu`.
+- [ ] Add `TestTrustmuxCatalog` assertions for `catalog/trustmux.json`, `install_method == "uv_tool"`, `package_name == "trustmux"`, `binary_name == "trustmux"`, `source_kind == "pypi"`, and `requires == ["tmux"]`.
+- [ ] Run `UV_CACHE_DIR=/tmp/cli-toolset-uv-cache /home/sme/.local/bin/uv run pytest tests/test_catalog_and_collectors.py -k 'Byobu or Trustmux' -q` and confirm failure because the new files do not exist.
+
+## Task 2: Implement the Byobu source installer and both catalog entries
+
+**Files:**
+- Create: `scripts/install_byobu.sh`
+- Create: `catalog/byobu.json`
+- Create: `catalog/trustmux.json`
+- Modify: `catalog/README.md`
+
+- [ ] Create `catalog/byobu.json` with category `general`, dedicated installer metadata, homepage `https://byobu.org/`, GitHub repository `dustinkirkland/byobu`, `byobu --version` detection, tmux dependency, and notes that source installation avoids stale apt packages.
+- [ ] Create `catalog/trustmux.json` with category `security`, `uv_tool`, official homepage `https://trustmux.dev/`, PyPI package/binary `trustmux`, `trustmux --version` detection, tmux dependency, and notes that PyPI avoids stale distro packages.
+- [ ] Create strict-mode `scripts/install_byobu.sh` with `install`, `update`, and `uninstall` dispatch.
+- [ ] Implement latest-version lookup using the GitHub tags API, accepting only numeric stable tags and sorting them with `sort -V`; accept an explicit version as the second script argument for reproducible installs.
+- [ ] Download `https://github.com/dustinkirkland/byobu/archive/refs/tags/${version}.tar.gz` with HTTPS failure handling, retries, timeouts, temporary-directory cleanup, and retained build-log tail on failure.
+- [ ] Check required build commands, run `./autogen.sh`, `./configure --prefix="$INSTALL_PREFIX"`, `make`, and `make install`, then verify the direct path `$INSTALL_PREFIX/bin/byobu` reports the requested version.
+- [ ] Make `scripts/install_byobu.sh` executable and update both catalog count references from 101 to 103.
+- [ ] Run the focused tests and confirm they pass.
+- [ ] Run `bash -n scripts/install_byobu.sh` and `shellcheck -x scripts/install_byobu.sh`.
+
+## Task 3: Record upstream versions and perform real user-local installs
+
+**Files:**
+- Modify: `upstream_versions.json`
+- Runtime outputs: `local_state.json` and audit snapshot (gitignored)
+- Install destinations: `~/.local/bin/byobu` and the uv tool directory exposing `~/.local/bin/trustmux`
+
+- [ ] Update the committed baseline with `UV_CACHE_DIR=/tmp/cli-toolset-uv-cache /home/sme/.local/bin/uv run python audit.py --update-baseline byobu` and the equivalent command for `trustmux`.
+- [ ] Confirm baseline versions are Byobu `7.15` from the GitHub tag collector and Trustmux `7.15` from PyPI, preserving unrelated baseline metadata.
+- [ ] Install Byobu with `FORCE_INSTALL=1 ./scripts/install_byobu.sh update 7.15`.
+- [ ] Install Trustmux with `UV_CACHE_DIR=/tmp/cli-toolset-uv-cache ./scripts/install_tool.sh trustmux update`.
+- [ ] Verify `/home/sme/.local/bin/byobu --version` and `/home/sme/.local/bin/trustmux --version`.
+- [ ] Refresh/merge local collection with `CLI_AUDIT_COLLECT=1 CLI_AUDIT_MERGE=1 UV_CACHE_DIR=/tmp/cli-toolset-uv-cache /home/sme/.local/bin/uv run python audit.py byobu trustmux`.
+- [ ] Confirm JSON audit output reports both tools installed from user-local paths and up to date.
+
+## Task 4: Run complete verification and commit only scoped changes
+
+**Files:**
+- Verify all changed files
+
+- [ ] Run `UV_CACHE_DIR=/tmp/cli-toolset-uv-cache /home/sme/.local/bin/uv run pytest -q`.
+- [ ] Run `UV_CACHE_DIR=/tmp/cli-toolset-uv-cache /home/sme/.local/bin/uv run python -m flake8 cli_audit tests`.
+- [ ] Run `./scripts/test_smoke.sh`.
+- [ ] Run `git diff --check` and inspect `git status --short`.
+- [ ] Preserve unrelated modifications to `scripts/lib/bashrc.sh`, `scripts/lib/completion.sh`, and `requirements-frozen-20260722.txt`.
+- [ ] Commit the tmux installer fix separately as `fix(scripts): install tmux binary without manpage`.
+- [ ] Commit the catalog/installer work, including Bubblewrap, Byobu, Trustmux, tests, baseline, and catalog counts, as `feat(catalog): add sandbox and terminal tools`.

docs/superpowers/specs/2026-07-27-byobu-trustmux-installers-design.md

@@ -0,0 +1,58 @@
+# Byobu and Trustmux Upstream Installers
+
+## Goal
+
+Add Byobu and Trustmux to the CLI tool catalog without relying on outdated
+distribution packages. Both tools must install into the user's home directory,
+participate in version auditing, and leave system-managed installations intact.
+
+## Byobu
+
+Byobu does not publish a standalone executable release. A dedicated installer
+will therefore:
+
+1. Resolve the newest stable tag from `dustinkirkland/byobu`.
+2. Download the corresponding GitHub source archive with HTTP failure checks
+   and bounded retries.
+3. Build from the release source using `autogen.sh` when required, followed by
+   `configure --prefix="$HOME/.local"`, `make`, and user-local installation.
+4. Verify the installed command directly below `~/.local/bin` rather than
+   relying on `PATH`.
+5. Support `install`, `update`, and `uninstall` actions and refresh the local
+   audit snapshot after successful installation.
+
+Build logs must be retained until cleanup and their final lines printed when a
+step fails. Temporary files must be removed on normal exit and interruption.
+
+## Trustmux
+
+Trustmux is officially published on PyPI. Its catalog entry will use the
+existing `uv_tool` installer with package name and binary name `trustmux`.
+This provides the newest stable published version as a user-local executable
+without using the Ubuntu PPA or the Byobu distribution package.
+
+## Catalog and audit
+
+Each tool receives a catalog entry with its official homepage, upstream source,
+binary name, version command, category, and installation method. The committed
+upstream baseline will contain both tools. Catalog documentation counts will be
+updated to match the resulting number of entries.
+
+## Testing
+
+Catalog tests will verify:
+
+- both entries exist and contain the intended installation methods;
+- Byobu points to its dedicated installer;
+- Trustmux maps to the PyPI package and `trustmux` executable;
+- all catalog JSON remains valid.
+
+The dedicated Byobu installer must pass Bash syntax checks and Shellcheck. The
+catalog test module and full Python test suite must remain green.
+
+## Out of scope
+
+- Installing development snapshots from a default branch.
+- Replacing or deleting distribution-managed Byobu or Trustmux packages.
+- Starting, enabling, pairing, or configuring the Trustmux daemon.
+- Enabling Byobu automatically at login.

scripts/install_byobu.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+# Install the newest stable Byobu tag from upstream source.
+# Distribution packages commonly lag behind the upstream release.
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/lib/install_strategy.sh
+. "$DIR/lib/install_strategy.sh"
+
+TOOL="byobu"
+INSTALL_PREFIX="${INSTALL_PREFIX:-${HOME}/.local}"
+GITHUB_REPO="dustinkirkland/byobu"
+MANIFEST_DIR="$INSTALL_PREFIX/share/cli-audit/manifests"
+MANIFEST_FILE="$MANIFEST_DIR/byobu.txt"
+BUILD_LOG=""
+BUILD_TMPDIR=""
+
+cleanup() {
+    if [ -n "$BUILD_TMPDIR" ] && [ -d "$BUILD_TMPDIR" ]; then
+        rm -rf "$BUILD_TMPDIR"
+    fi
+}
+trap cleanup EXIT
+trap 'exit 130' INT TERM
+
+show_build_failure() {
+    local step="$1"
+    echo "[$TOOL] Error: $step failed" >&2
+    if [ -n "$BUILD_LOG" ] && [ -f "$BUILD_LOG" ]; then
+        echo "[$TOOL] Last build output:" >&2
+        tail -n 40 "$BUILD_LOG" >&2
+    fi
+}
+
+require_commands() {
+    local command_name
+    local missing=()
+
+    for command_name in curl jq tar sort make autoreconf automake autoconf; do
+        command -v "$command_name" >/dev/null 2>&1 || missing+=("$command_name")
+    done
+
+    if [ "${#missing[@]}" -gt 0 ]; then
+        echo "[$TOOL] Error: Missing build commands: ${missing[*]}" >&2
+        return 1
+    fi
+}
+
+get_installed_version() {
+    local installed_binary="$INSTALL_PREFIX/bin/byobu"
+    if [ -x "$installed_binary" ]; then
+        awk -F= '$1 == "VERSION" { print $2; exit }' "$installed_binary"
+    fi
+}
+
+get_target_version() {
+    local tags_json=""
+    local version=""
+
+    if command -v gh >/dev/null 2>&1; then
+        tags_json="$(gh api "repos/$GITHUB_REPO/tags?per_page=100" 2>/dev/null || true)"
+    fi
+    if [ -z "$tags_json" ]; then
+        tags_json="$(curl --proto '=https' --proto-redir '=https' -fsSL \
+            --retry 3 --retry-delay 1 --connect-timeout 10 \
+            -H "Accept: application/vnd.github+json" \
+            -H "User-Agent: cli-audit" \
+            "https://api.github.com/repos/$GITHUB_REPO/tags?per_page=100")"
+    fi
+
+    version="$(printf '%s' "$tags_json" |
+        jq -r '.[].name' |
+        grep -E '^[0-9]+([.][0-9]+)+$' |
+        sort -V |
+        tail -1)"
+    printf '%s' "$version"
+}
+
+remove_manifest_files() {
+    local relative_path
+
+    if [ ! -f "$MANIFEST_FILE" ]; then
+        return 0
+    fi
+
+    while IFS= read -r relative_path; do
+        if [ -n "$relative_path" ]; then
+            rm -f "$INSTALL_PREFIX/$relative_path"
+        fi
+    done <"$MANIFEST_FILE"
+    rm -f "$MANIFEST_FILE"
+}
+
+install_byobu() {
+    local version="${1:-}"
+    local before=""
+    local after=""
+    local archive=""
+    local url=""
+    local src_dir=""
+    local stage_dir=""
+    local installed_binary="$INSTALL_PREFIX/bin/byobu"
+
+    require_commands
+
+    if [ -z "$version" ]; then
+        echo "[$TOOL] Fetching latest stable tag..." >&2
+        version="$(get_target_version)"
+    fi
+    if ! grep -Eq '^[0-9]+([.][0-9]+)+$' <<<"$version"; then
+        echo "[$TOOL] Error: Invalid stable version: ${version:-<none>}" >&2
+        return 1
+    fi
+
+    before="$(get_installed_version)"
+    BUILD_TMPDIR="$(mktemp -d)"
+    BUILD_LOG="$BUILD_TMPDIR/build.log"
+    archive="$BUILD_TMPDIR/byobu-$version.tar.gz"
+    stage_dir="$BUILD_TMPDIR/stage"
+    url="https://github.com/$GITHUB_REPO/archive/refs/tags/${version}.tar.gz"
+
+    echo "[$TOOL] Downloading $url..." >&2
+    if ! curl --proto '=https' --proto-redir '=https' -fL \
+        --retry 3 --retry-delay 1 --connect-timeout 10 \
+        "$url" -o "$archive"; then
+        echo "[$TOOL] Error: Failed to download $url" >&2
+        return 1
+    fi
+    if ! tar -xzf "$archive" -C "$BUILD_TMPDIR"; then
+        echo "[$TOOL] Error: Invalid source archive: $url" >&2
+        return 1
+    fi
+
+    src_dir="$(find "$BUILD_TMPDIR" -maxdepth 1 -type d -name 'byobu-*' | head -1)"
+    if [ -z "$src_dir" ]; then
+        echo "[$TOOL] Error: Could not find source directory in archive" >&2
+        return 1
+    fi
+
+    cd "$src_dir"
+    if ! ./autogen.sh >"$BUILD_LOG" 2>&1; then
+        show_build_failure "autogen"
+        return 1
+    fi
+    if ! ./configure --prefix="$INSTALL_PREFIX" --disable-trustmux >>"$BUILD_LOG" 2>&1; then
+        show_build_failure "configure"
+        return 1
+    fi
+    if ! make -j"$(nproc)" >>"$BUILD_LOG" 2>&1; then
+        show_build_failure "build"
+        return 1
+    fi
+    if ! make install DESTDIR="$stage_dir" >>"$BUILD_LOG" 2>&1; then
+        show_build_failure "staged install"
+        return 1
+    fi
+
+    mkdir -p "$INSTALL_PREFIX" "$MANIFEST_DIR"
+    remove_manifest_files
+    if ! cp -a "$stage_dir$INSTALL_PREFIX/." "$INSTALL_PREFIX/" >>"$BUILD_LOG" 2>&1; then
+        show_build_failure "install"
+        return 1
+    fi
+    find "$stage_dir$INSTALL_PREFIX" \( -type f -o -type l \) -printf '%P\n' |
+        sort >"$MANIFEST_FILE"
+
+    cd /
+    if [ -x "$installed_binary" ]; then
+        after="$(get_installed_version)"
+    fi
+    if [ "$after" != "$version" ]; then
+        echo "[$TOOL] Error: Installed binary reports '${after:-<none>}', expected '$version'" >&2
+        return 1
+    fi
+
+    printf "[%s] before: %s\n" "$TOOL" "${before:-<none>}"
+    printf "[%s] after:  %s\n" "$TOOL" "$after"
+    printf "[%s] path:   %s\n" "$TOOL" "$installed_binary"
+    refresh_snapshot "$TOOL"
+}
+
+case "${1:-install}" in
+    install|update)
+        install_byobu "${2:-}"
+        ;;
+    uninstall)
+        echo "[$TOOL] Removing user-local installation" >&2
+        remove_manifest_files
+        hash -r 2>/dev/null || true
+        ;;
+    *)
+        echo "Usage: $0 [install|update|uninstall] [version]" >&2
+        exit 1
+        ;;
+esac