agents-anywhere

LOW
maintainer duanluan 0 votes scanned 2026-10-23 15:37:50.087015
View on AUR
Why flagged

Package builds from upstream source, downloads official runtimes (uv, Python) over HTTPS with checksums, and patches fonts to avoid network access; no malicious behavior despite untrusted host (gh-proxy.com) used as fallback mirror.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from upstream source, downloads official runtimes (uv, Python) over HTTPS with checksums, and patches fonts to avoid network access; no malicious behavior despite untrusted host (gh-proxy.com) used as fallback mirror.

PKGBUILD

1# Maintainer: duanluan <duanluan@outlook.com>
2#
3# Built from the upstream source (desktop-workbench). The project publishes
4# no Linux release: upstream ships macOS/Windows installers only, although
5# the electron-builder config carries a Linux target. The bundle scripts
6# download the uv and python-build-standalone runtimes for the build host
7# architecture from their official releases.
8#
9# Note: the upstream repository carries no LICENSE file at the time of
10# packaging; the license field stays NOASSERTION until upstream adds one.
11
12pkgname=agents-anywhere
13pkgver=2.0.3
14pkgrel=1
15pkgdesc='Open-source cross-device AI agent workbench desktop app (built from source)'
16arch=('x86_64' 'aarch64')
17url='https://github.com/anywhere-labs/Agents-Anywhere'
18license=('NOASSERTION')
19depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'libsecret' 'libappindicator-gtk3')
20makedepends=('nodejs' 'curl')
21options=('!strip' '!debug')
22source=("Agents-Anywhere-${pkgver}.tar.gz::https://github.com/anywhere-labs/Agents-Anywhere/archive/refs/tags/v${pkgver}.tar.gz")
23sha256sums=('5b36e7937e24f43318ee5bbd80710c3e378b62484f4f09483b7c5a7a8b1a3094')
24
25build() {
26 cd "${srcdir}/Agents-Anywhere-${pkgver}/desktop-workbench"
27
28 # corepack 从 registry 拉 yarn 4 时不要交互确认
29 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
30 # yarn 4 沿文件系统祖先链向上找项目根，用户家目录里误生成的
31 # package.json 会被当成顶层项目（"doesn't seem to be part of the
32 # project"）。空的 yarn.lock 把 workbench 声明为独立项目根，
33 # 这是 yarn 报错信息里给出的官方解法
34 : > yarn.lock
35 # 上游没有提交 yarn.lock，依赖按 semver 浮动
36 corepack yarn install
37
38 # next/font/google 在构建期要从 Google Fonts 下载字体，离线或受限
39 # 网络下构建失败；改为系统字体栈，只影响默认字体观感
40 python - <<'PYEOF'
41from pathlib import Path
42import re
43p = Path("renderer/src/app/layout.tsx")
44s = p.read_text()
45if 'from "next/font/google"' in s:
46 s = s.replace(
47 'import { Geist, Geist_Mono, Instrument_Serif } from "next/font/google";',
48 '// [arch build] next/font/google requires Google Fonts access at build time')
49 s = re.sub(r'const sans = Geist\(\{.*?\}\);', 'const sans = { variable: "--font-geist" };', s, flags=re.S)
50 s = re.sub(r'const mono = Geist_Mono\(\{.*?\}\);', 'const mono = { variable: "--font-geist-mono" };', s, flags=re.S)
51 s = re.sub(r'const serif = Instrument_Serif\(\{.*?\}\);', 'const serif = { variable: "--font-instrument-serif" };', s, flags=re.S)
52 p.write_text(s)
53c = Path("renderer/src/app/globals.css")
54t = c.read_text()
55t = t.replace("--font-sans: var(--font-geist);", "--font-sans: ui-sans-serif, system-ui, -apple-system, 'Segoe UI', Roboto, 'Noto Sans', sans-serif;")
56t = t.replace("--font-heading: var(--font-geist);", "--font-heading: ui-sans-serif, system-ui, -apple-system, 'Segoe UI', Roboto, 'Noto Sans', sans-serif;")
57t = t.replace("--font-mono: var(--font-geist-mono);", "--font-mono: ui-monospace, 'Cascadia Mono', 'JetBrains Mono', Menlo, Consolas, monospace;")
58t = t.replace("--font-serif: var(--font-instrument-serif);", "--font-serif: Georgia, 'Times New Roman', serif;")
59c.write_text(t)
60print("fonts switched to system stacks")
61PYEOF
62
63 # prepare-uv.mjs 只会从 GitHub 直连下载且没有镜像变量；它要取四个
64 # 文件（归档、官方 .sha256、两份许可证），download() 见文件已存在
65 # 即跳过，所以预先放好。GitHub 优先，失败再走镜像
66 aa_fetch() {
67 local dest="$1" u
68 shift
69 [[ -s "${dest}" ]] && return 0
70 for u in "$@"; do
71 curl -fsSL --retry 2 --speed-limit 1024 --speed-time 30 --max-time 600 \
72 -o "${dest}" "${u}" && return 0 || true
73 done
74 return 1
75 }
76 local uv_ver uv_triple uv_asset uv_cache uv_lic uv_gh uv_raw
77 uv_ver="$(sed -nE 's/.*UV_BUNDLE_VERSION \|\| \"([^\"]+)\".*/\1/p' scripts/prepare-uv.mjs | head -n1)"
78 case "${CARCH}" in
79 x86_64) uv_triple='x86_64-unknown-linux-gnu' ;;
80 aarch64) uv_triple='aarch64-unknown-linux-gnu' ;;
81 esac
82 uv_asset="uv-${uv_triple}.tar.gz"
83 uv_cache=".cache/uv/${uv_ver}"
84 uv_lic="build/uv/THIRD_PARTY_LICENSES/uv"
85 uv_gh="https://github.com/astral-sh/uv/releases/download/${uv_ver}/${uv_asset}"
86 uv_raw="https://raw.githubusercontent.com/astral-sh/uv/${uv_ver}"
87 install -dm755 "${uv_cache}" "${uv_lic}"
88 aa_fetch "${uv_cache}/${uv_asset}" "${uv_gh}" "https://gh-proxy.com/${uv_gh}"
89 aa_fetch "${uv_cache}/${uv_asset}.sha256" "${uv_gh}.sha256" "https://gh-proxy.com/${uv_gh}.sha256"
90 aa_fetch "${uv_lic}/LICENSE-MIT" "${uv_raw}/LICENSE-MIT" "https://gh-proxy.com/${uv_raw}/LICENSE-MIT"
91 aa_fetch "${uv_lic}/LICENSE-APACHE" "${uv_raw}/LICENSE-APACHE" "https://gh-proxy.com/${uv_raw}/LICENSE-APACHE"
92 [[ -s "${uv_cache}/${uv_asset}" && -s "${uv_cache}/${uv_asset}.sha256" &&
93 -s "${uv_lic}/LICENSE-MIT" && -s "${uv_lic}/LICENSE-APACHE" ]] || {
94 printf 'failed to pre-seed the uv bundle cache\n' >&2
95 return 1
96 }
97
98 # 捆绑 uv 与 python-build-standalone 运行时（按构建机架构取 linux 变体）
99 corepack yarn bundle:uv
100 corepack yarn bundle:python
101
102 corepack yarn build
103 corepack yarn exec electron-builder --linux dir
104}
105
106package() {
107 local app_dir="${srcdir}/Agents-Anywhere-${pkgver}/desktop-workbench/release/linux-unpacked"
108
109 install -dm755 "${pkgdir}/opt/agents-anywhere"
110 cp -a "${app_dir}/." "${pkgdir}/opt/agents-anywhere/"
111
112 # chrome-sandbox 需要 setuid 才能在未启用 --no-sandbox 时工作
113 chmod 4755 "${pkgdir}/opt/agents-anywhere/chrome-sandbox"
114
115 install -Dm755 /dev/stdin "${pkgdir}/usr/bin/agents-anywhere" <<'LAUNCHER'
116#!/usr/bin/env bash
117exec /opt/agents-anywhere/agents-anywhere-desktop-workbench "$@"
118LAUNCHER
119
120 install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/agents-anywhere.desktop" <<DESKTOP
121[Desktop Entry]
122Type=Application
123Version=1.0
124Name=Agents Anywhere
125Comment=Open-source cross-device AI agent workbench
126Exec=agents-anywhere %U
127Icon=agents-anywhere
128Terminal=false
129StartupNotify=true
130StartupWMClass=Agents Anywhere
131Categories=Development;Utility;
132DESKTOP
133
134 # 上游只提供一张源图标，按 hicolor 惯例放到 512x512
135 install -Dm644 "${app_dir}/resources/build/icon-mac-source.png" \
136 "${pkgdir}/usr/share/icons/hicolor/512x512/apps/agents-anywhere.png"
137}
138

Scan history

Scanned at (UTC)SeverityRules
2026-10-23 15:37:50 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion