tui-tools

tui-tools

Every tui-tools tool in one place, installed through your package manager

A terminal UI (TUI) for pacman, apt and dnf on Linux: the launcher of the tui-tools family.

v0.3.2betapackagesMIT
The dashboard: every tool of the family, what this machine has, and what the repository offers
The dashboard: every tool of the family, what this machine has, and what the repository offers

The launcher of the tui-tools family. Every tool of the family is a card: what it does, whether this machine has it, which version, and whether the repository offers a newer one.

A second group holds the companions: family packages that are not terminal UIs, and upstream projects rebuilt under the family provenance gate. The row says which repository the installed copy came from; o switches it to the family's build.

Install, update and remove go through the distribution's own package manager — apt, dnf or pacman — each previewed as the exact command line and confirmed before it runs. enter hands the terminal to an installed tool and takes it back on exit.

The catalog it reads only says which packages exist. It never decides what reaches the machine: your package manager verifies the signed repository index and the signed package, and every package name in it is validated twice before it can reach a command line. A snapshot of it is built into the binary, so the dashboard works offline.

s sets the repository up, with the key pinned by fingerprint.

Run tui-tools --demo for a sample machine where every key works and nothing is touched.

Keys

KeyAction
enterLaunch the selected tool; on a companion, show its full status instead
iInstall it, through this machine's package manager
uUpdate it
x / dRemove it; nothing it pulled in is autoremoved
oSwitch a companion to the tui-tools build, when it came from elsewhere
sSet the tui-tools repository up, with the key pinned by fingerprint
rRe-read the catalog and the machine
/Filter by name, tagline, category or state
?Help
qQuit

Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.

Compatibility

This tool is a face on the program below, so its version matters. Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as (untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.

pacman

pacman ≥ 6.0
Binary
pacman
Minimum
6.0
Probed with
pacman --version
Tested
7.1.0

What changes on older versions

  • pacman >=6.0

    Arch has no supported partial upgrade, so an update is pacman -Syu with the tool named, and the dialog says so. Omarchy's pacman hook refuses a direct -Syu, so there it is pacman -S --needed instead, and the dialog says why

  • pacman >=6.0

    the repository setup writes a [tui-tools] section under /etc/pacman.d and adds one Include line to pacman.conf, so a later setup finds it again instead of appending a second block

  • pacman >=6.0

    pacman records no repository for an installed package, so a companion's origin is inferred rather than read: a bare [installed] in pacman -Sl tui-tools means the machine has the version that repository offers, and pacman -Si names the repository whose version matches the installed one

apt

apt ≥ 2.0
Binary
apt
Minimum
2.0
Probed with
apt --version
Tested
2.8.33.2.0

What changes on older versions

  • apt >=2.0

    the available version comes from apt-cache policy, which reads the lists already on disk; a repository added a moment ago reports nothing until the refresh, which is the first previewed step of an install rather than something the read path does behind you

  • apt >=2.0

    a companion's origin is read off apt-cache policy: the version marked *** is the installed one, and the first source under it that is not /var/lib/dpkg/status is where it came from. apt cannot install from a named repository, so a switch names the family's version instead

dnf

dnf ≥ 4.0
Binary
dnf
Minimum
4.0
Probed with
dnf --version
Tested
No recorded run yet. The tool still runs and reports the version it found as untested.

Needs a version this new

  • dnf5since 5.0

What changes on older versions

  • dnf >=5.0

    dnf --version prints dnf5 version 5.2.18.0, where dnf4 prints a bare 4.24.0 on its first line; both are read by the same pattern, which keeps three components because a four-part version is not one the family schema records

  • dnf >=4.0

    the available version comes from dnf repoquery, which answers from the cache on disk, so a machine whose metadata has expired reports what it last fetched rather than refreshing behind you

  • dnf >=4.0

    dnf is the one manager that records where an installed package came from, so a companion's origin is read rather than inferred: dnf repoquery --installed --qf '%{name}|%{from_repo}' answers it on dnf4 and dnf5, and @System means it came from a file

Maintain pacman, apt or dnf? You are welcome to help shape this tool. About → maintainers

Install

Once per machine, then every tool in the family is one pacman away.

Add the repository
$ curl -fsSL https://pkgs.tui.tools/install.sh | sh
Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
  sudo pacman-key --add /tmp/tui-tools.asc
  sudo pacman-key --lsign-key \
    "$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
  printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
    | sudo tee -a /etc/pacman.conf
  sudo pacman -Sy
Arch Linux · tui-tools
$ sudo pacman -S tui-tools

Upgrades then arrive with the rest of your system updates.

What it can do to your machine

  • Preview, then confirm

    Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.

  • Escalates for actions

    Reads are unprivileged: which tools are installed and which the repositories offer are local database queries any user may make. Escalation is sudo -n, which never prompts, and covers only the installs, updates, removals and the repository setup you confirmed.

  • No daemon, no state of its own

    Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.

  • Opens network connections

    It fetches https://tui.tools/catalog.json, the list of tools and their versions. The catalog only informs: nothing from it reaches a command line except a name matching tui-<word>, and the package manager verifies the signed repository. --offline uses the snapshot in the binary.

  • Static binary

    Released statically linked, with no runtime dependencies to install.

  • Signed release, with provenance

    checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.

Reporting

Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.

Downloads

v0.3.2 · 2026-09-26
FileSizeSHA-256
checksums.txt1016 B—
checksums.txt.sigstore.json10 KB—
provenance.intoto.jsonl12 KB—
tui-tools-0.3.2-1-aarch64.pkg.tar.zst3.0 MB67b891894e7f01150d9a649519c73c91cc31d89f14185d804ccf46882038beb0
tui-tools-0.3.2-1-x86_64.pkg.tar.zst3.4 MBbebbd927da495a5f7797d5a376357565d60ebe574f2a0a775b40ab19ac7e51d4
tui-tools-0.3.2-1.aarch64.rpm3.0 MB85218dc1c3febf6ce01ffdf2febe75025d147b94aec594851d2c6c2fbf80ea4c
tui-tools-0.3.2-1.x86_64.rpm3.3 MBc75abe65fc300821aebfd74101cd6f3cac80ce4171e59c6460feb12d5640d40d
tui-tools_0.3.2_amd64.deb3.3 MB2e51c5f2fe1b5a273a7ff3ed593b0f43c5bd45be1beac1089d23c0c19680c2ee
tui-tools_0.3.2_arm64.deb3.0 MBa967901a85492eae1329f2ebf6db0a8e131aaa5cdf07eec98b87c4794f8b6f7d
tui-tools_0.3.2_linux_amd64.tar.gz3.3 MB5339eeab75170ad064be600da8b86e0b57fc4fcf9e9b33b34612dd1dad9ec6fe
tui-tools_0.3.2_linux_amd64.tar.gz.cyclonedx.json23 KB2e27f3378b4b1e36d8c7cbe0961b43b87f0a003d04060ff045e761801d162112
tui-tools_0.3.2_linux_arm64.tar.gz3.0 MB63c3429842582767723f3496c34af2e6e1dda13405548f29de4bab010b04f308
tui-tools_0.3.2_linux_arm64.tar.gz.cyclonedx.json23 KBb011ac2f9af3ad7bdd7483412ee2d30b913b8d1524e44ccb42c7453053dec2ff

Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.

Releases

v0.3.2

2026-09-26
## tui-tools v0.3.2

tui-tools 0.3.2

The embedded catalog snapshot is refreshed: it now lists tui-dc, tui-router, tui-traffic, tui-tailscale and tui-wireguard (formerly tui-vpn), so the launcher shows the whole family even before it reaches the live catalog.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* ab4c1827a8de917d6e83d027d00831306c7ff054 catalog: refresh the embedded snapshot (#25)

v0.3.1

2026-09-25
## tui-tools v0.3.1

tui-tools 0.3.1

Release notes (0.3.1): companion packages (headscale, tui-tools components) are now installed, upgraded and removed through tui-kit's companion builders instead of a copy kept in this launcher. Installs and upgrades still name the family repository on pacman (`tui-tools/headscale`), so Arch's own build of a mirror cannot win over the family's; apt and dnf get the bare name as before. apt steps, the switch to the family build included, now run with `DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a`, and every command runs without a controlling terminal, so a debconf, needrestart or password prompt fails fast instead of waiting invisibly behind the TUI.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 0fe5abe623eae4c60dd0ecb2545070fb5cd74e7a Take tui-kit v0.4.4: companions go through the kit's builders (#24)

v0.3.0

2026-09-25
## tui-tools v0.3.0

tui-tools 0.3.0: Omarchy installs, companions from the family repository, a running indicator

tui-tools 0.3.0 installs and updates on Omarchy. Omarchy's pacman hook refuses a direct `-Syu`, so there the launcher uses `pacman -S --needed` for tools and companions alike, and the confirm dialog explains why before anything runs. Plain Arch keeps `-Syu`. On pacman, companions such as headscale are now installed and updated as `tui-tools/<name>`, so the family's build is what arrives even when the distribution ships the same package, and `o` remains the one way to switch a copy that came from elsewhere. While an install, update or removal runs, the status line shows what is running and for how long, updated every second, so a slow download no longer looks like a frozen screen. Built on tui-kit v0.4.1, which no longer cuts a mutation off at the read timeout.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 2957f82984bab79e7c45fb8e42c239de333d4349 Record the lab run on Ubuntu 26.04: apt 3.2.0 tested (#22)
* f905bf0ce7605da914f94b936794342c4111a21d Release 0.3.0: Omarchy installs, running indicator; tui-kit v0.4.1 (#23)

v0.2.2

2026-09-24
## tui-tools v0.2.2

Ubuntu: the dashboard reads the machine again once dpkg knows a sibling tool's name without it being installed (tui-kit v0.3.2). The .deb path is now exercised in CI on Ubuntu LTS and devel, and apt 2.8.3 on Ubuntu 24.04 is recorded as tested.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 2e0d03092cb9061745562d82586f42356e403b55 Bump anchore/sbom-action/download-syft (#5)
* 32d6f879630994f8d46c78393d0280c6dfde5572 Bump anchore/sbom-action/download-syft in the github-actions group (#18)
* 1febed20aeb6744478e3ae6ca7ed247a9663fedb Bump the github-actions group with 4 updates (#19)
* 76628fe00fb573af772f75c4dc97f5b913135f12 README: link the tool's page on tui.tools (#17)
* fe6fc7992382b78a4fa7601b97919c6d21115876 README: point the install snippet at the current release (#16)
* 6a13c6c37097325e0a88d7f790338bde501fbaf1 Read the dpkg status for the family and the companions; guard the .deb path in CI (#21)

v0.2.1

2026-09-02
## tui-tools v0.2.1

tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 5cffc85bf3773457fa40b6e4f7331e3e2c8d45b9 Bump tui-kit to v0.3.0 (#15)
* 541da53892282b130a36d7054a35bb443376c5e4 Re-render the README frames on the companions build (#14)

v0.2.0

2026-09-02
## tui-tools v0.2.0

v0.2.0

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* c25cd2e6a834404f6ae75e54d8a1c67fda22c9c2 A code of conduct that fits on one screen (#11)
* ed096cc3462b8ac4986bd8d172258b0870af400d Add --report, and a bug form that asks for it (#12)
* 65906d641b388bca2fadda50f23c65efea58ed45 Carry the OpenSSF Best Practices badge (#9)
* a5344ec3b5b5fad554ea98050ae8e558a3bde9fb Show the companions, and where each installed one came from (#13)
* bc4643d4471188e0c18a7f7180ac5ffa0eb2cb5a Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#10)

v0.1.3

2026-08-30
## tui-tools v0.1.3

Release notes that say what changed

The release header now prints the whole tag message, so this paragraph is
the first release note a reader of the family sees on a release page.
Nothing in the launcher itself moved since v0.1.1: same dashboard, same
package, same epoch.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* c10f83d71e7db96632ec951f8f8ab80638e9217d Print the whole tag message, not only its body (#8)

v0.1.2

2026-08-30
## tui-tools v0.1.2



Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* bad69f56854ddf9a474cbc70528c11f22da96fb9 Fetch the tag annotation before releasing (#7)
* 5191fe142898ffde4020e838e47e2f59cae4920e Say beta once (#6)

v0.1.1

2026-08-30
## tui-tools v0.1.1



Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 9739acf69ba242bff964856368eb6ecf1e3fc07d Pin what CI runs, fuzz the parsers, and say the releases are signed (#4)

v0.1.0

2026-08-30
## Changelog
* 22ef3093debdf59d9e3be1f96ed0d5a40c812978 Initial commit
* c6fe870df208bf0145a417b5616b68269814b0dc Outrank the metapackage that used to carry this name (#3)
* 43ce7c9482beb181af6d0b7e3d48f1ad3c170587 Take tui-kit v0.2.7: an Arch install is one -Syu step (#2)
* e4955cd15ae8779c798e684202cf18791d923079 The launcher: every tool of the family in one dashboard (#1)