fix(audit): skip virtualenv bin dirs when detecting installations

CHANGELOG.md

@@ -20,6 +20,7 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
 - Binary-probe fallback in `guide.sh` when the post-install snapshot refresh is stale.
 
 ### Fixed
+- Audit detection skips virtualenv/conda bin dirs, like reconcile already did. An activated `~/.venv` made the audit report its own copy (`~/.venv/bin/black` 25.11.0) instead of the installation (`uv tool` black 26.5.1), so every upgrade of black, isort and python@3.14 looked like a no-op. Catalog `version_command`s run with the same filtered PATH. Reconcile no longer drops uv-tool and pipx installations, whose per-tool directories also carry a `pyvenv.cfg`. A tool that exists only inside a virtualenv or conda environment is now reported as not installed; the bulk missing-tool check and the post-install validation use the same lookup.
 - `make upgrade` hid every pinned tool, whatever the pin. A release skipped with `s` ("ask again when newer patch available") hid the tool for good. A pin now hides a tool only while it is `never`, equals the target release (`s`), equals the installed version (`p`), or equals the cycle.
 - `make upgrade` auto-update no longer reports an upgrade as "Updated" just because the install script exited 0. The version is compared after the re-audit, the same check the interactive `Y`/`a` answers use; an unchanged version counts as "Failed" with the old and target version. A package manager without a newer package (`bwrap` on apt) and a binary identical to the target release with a stale version string (`sd` 1.1.0 reports 1.0.0) count as "Skipped". "Held back" requires the install command to succeed and, for apt, the installed package to be the candidate and to own the binary found on PATH; otherwise the unchanged version counts as "Failed". Without an upstream version the result is reported as unverified ("Skipped").
 - difftastic 0.71.0 puts the version into its release file names (`difft-0.71.0-x86_64-unknown-linux-gnu.tar.gz`); the catalog download URL now includes it. byobu is tagged `trustmux-v7.19` since the trustmux rename, and those tags fill the first page of the tags API, so the installer found no stable tag; it now accepts both tag forms.

cli_audit/bulk.py

@@ -8,7 +8,6 @@
 from __future__ import annotations
 
 import os
-import shutil
 import subprocess
 import tempfile
 import threading
@@ -21,6 +20,7 @@
 
 from .common import vlog
 from .config import Config
+from .detection import _which
 from .environment import Environment
 from .installer import InstallResult, install_tool
 from .package_managers import select_package_manager
@@ -38,6 +38,7 @@ class ToolSpec:
         language: Tool language/ecosystem (e.g., "python", "rust")
         dependencies: Tool names that must be installed first
     """
+
     tool_name: str
     package_name: str
     target_version: str = "latest"
@@ -65,6 +66,7 @@ class ProgressTracker:
         _progress: Progress state for each tool
         _callbacks: Callbacks to invoke on progress updates
     """
+
     _lock: threading.Lock = field(default_factory=threading.Lock)
     _progress: dict[str, dict] = field(default_factory=dict)
     _callbacks: list[Callable[[str, str, str], None]] = field(default_factory=list)
@@ -132,6 +134,7 @@ class BulkInstallResult:
         duration_seconds: Total execution time
         rollback_script: Path to generated rollback script (if any)
     """
+
     tools_attempted: tuple[str, ...]
     successes: tuple[InstallResult, ...]
     failures: tuple[InstallResult, ...]
@@ -164,7 +167,8 @@ def get_missing_tools(tool_names: Sequence[str], verbose: bool = False) -> list[
     """
     missing = []
     for tool_name in tool_names:
-        binary_path = shutil.which(tool_name)
+        # Same lookup as the audit: a copy inside an activated venv is no installation
+        binary_path = _which(tool_name)
         if not binary_path:
             missing.append(tool_name)
             vlog(f"Tool not found: {tool_name}", verbose)
@@ -252,26 +256,30 @@ def get_tools_to_install(
             return []
         for name in tool_names:
             tool_config = config.get_tool_config(name)
-            specs.append(ToolSpec(
-                tool_name=name,
-                package_name=name,
-                target_version=tool_config.version if tool_config else "latest",
-                language=None,
-                dependencies=(),
-            ))
+            specs.append(
+                ToolSpec(
+                    tool_name=name,
+                    package_name=name,
+                    target_version=tool_config.version if tool_config else "latest",
+                    language=None,
+                    dependencies=(),
+                )
+            )
 
     elif mode == "missing":
         all_tools = list(config.tools.keys())
         missing = get_missing_tools(all_tools, verbose)
         for name in missing:
             tool_config = config.get_tool_config(name)
-            specs.append(ToolSpec(
-                tool_name=name,
-                package_name=name,
-                target_version=tool_config.version if tool_config else "latest",
-                language=None,
-                dependencies=(),
-            ))
+            specs.append(
+                ToolSpec(
+                    tool_name=name,
+                    package_name=name,
+                    target_version=tool_config.version if tool_config else "latest",
+                    language=None,
+                    dependencies=(),
+                )
+            )
 
     elif mode == "preset":
         if not preset_name or not hasattr(config, "presets"):
@@ -280,25 +288,29 @@ def get_tools_to_install(
         preset_tools = getattr(config.presets, preset_name, [])
         for name in preset_tools:
             tool_config = config.get_tool_config(name)
-            specs.append(ToolSpec(
-                tool_name=name,
-                package_name=name,
-                target_version=tool_config.version if tool_config else "latest",
-                language=None,
-                dependencies=(),
-            ))
+            specs.append(
+                ToolSpec(
+                    tool_name=name,
+                    package_name=name,
+                    target_version=tool_config.version if tool_config else "latest",
+                    language=None,
+                    dependencies=(),
+                )
+            )
 
     elif mode == "all":
         all_tools = list(config.tools.keys())
         for name in all_tools:
             tool_config = config.get_tool_config(name)
-            specs.append(ToolSpec(
-                tool_name=name,
-                package_name=name,
-                target_version=tool_config.version if tool_config else "latest",
-                language=None,
-                dependencies=(),
-            ))
+            specs.append(
+                ToolSpec(
+                    tool_name=name,
+                    package_name=name,
+                    target_version=tool_config.version if tool_config else "latest",
+                    language=None,
+                    dependencies=(),
+                )
+            )
 
     vlog(f"Mode '{mode}' resolved to {len(specs)} tools", verbose)
     return specs
@@ -502,6 +514,7 @@ def bulk_install(
     # Determine max workers
     if max_workers is None:
         import os
+
         max_workers = min(16, os.cpu_count() or 4 + 4)
 
     # Execute installations level by level
@@ -551,7 +564,7 @@ def bulk_install(
         # Stop if fail-fast triggered
         if fail_fast and failures:
             # Mark remaining tools as skipped
-            for level in levels[level_idx + 1:]:
+            for level in levels[level_idx + 1 :]:
                 for spec in level:
                     skipped.append(spec.tool_name)
                     progress_tracker.update(spec.tool_name, "skipped", "Skipped due to fail-fast")