happy-cli-git

maintainer lidiazegar · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a recently orphaned but re-adopted AUR entry, but sources are from the official GitHub repository via git, uses standard build practices, patches to use system binaries, and installs only project-owned code without executing untrusted remote payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a recently orphaned but re-adopted AUR entry, but sources are from the official GitHub repository via git, uses standard build practices, patches to use system binaries, and installs only project-owned code without executing untrusted remote payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Christopher Cooper <christopher@cg505.com>
    
      2pkgname=happy-cli-git
    
      3pkgver=r1518.3ed8b121
    
      4pkgrel=1
    
      5pkgdesc="Mobile and Web client for Claude Code and Codex - remote control your AI coding agent"
    
      6arch=('any')
    
      7url="https://github.com/slopus/happy"
    
      8license=('MIT')
    
      9# Upstream bundles ripgrep and difftastic binaries, but we use system packages instead.
    
      10# Difftastic: patched in prepare() to use /usr/bin/difft
    
      11# Ripgrep: no patch needed - the launcher script (scripts/ripgrep_launcher.cjs) has a
    
      12#          fallback chain that searches system PATH before using bundled binaries
    
      13depends=('nodejs' 'ripgrep' 'difftastic')
    
      14makedepends=(
    
      15    'yarn'
    
      16    'npm'  # used to create isolated production install (see build())
    
      17    'git'
    
      18)
    
      19conflicts=('happy-cli')
    
      20provides=('happy-cli')
    
      21source=("$pkgname::git+https://github.com/slopus/happy.git")
    
      22b2sums=('SKIP')
    
      23
    
      24pkgver() {
    
      25    cd "$srcdir/$pkgname"
    
      26    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      27}
    
      28
    
      29prepare() {
    
      30    cd "$srcdir/$pkgname/packages/happy-cli"
    
      31
    
      32    # Patch difftastic module to use system binary instead of bundled one.
    
      33    # The bundled binary path is hardcoded in getBinaryPath() - we replace it
    
      34    # with the system path. Ripgrep doesn't need this - its launcher already
    
      35    # searches system PATH as a fallback.
    
      36    sed -i "s|resolve(join(projectPath(), 'tools', 'unpacked', binaryName))|'/usr/bin/difft'|" \
    
      37        src/modules/difftastic/index.ts
    
      38}
    
      39
    
      40build() {
    
      41    cd "$srcdir/$pkgname/packages/happy-cli"
    
      42
    
      43    # Install all deps (devDeps needed for build and check)
    
      44    yarn install --frozen-lockfile --cache-folder "$srcdir/yarn-cache"
    
      45    yarn build
    
      46
    
      47    # Create production node_modules in isolated directory outside the monorepo.
    
      48    # Why: upstream uses yarn workspaces which hoists deps to the monorepo root.
    
      49    # If we ran "yarn install --production" here, deps would be hoisted and not
    
      50    # available in packages/happy-cli/node_modules. By copying package.json to
    
      51    # an isolated directory and running npm there, we get a flat node_modules
    
      52    # with all production deps, matching what users get from "npm install".
    
      53    # --ignore-scripts: skip postinstall (unpack-tools.cjs) since we use system tools
    
      54    mkdir -p "$srcdir/prod-install"
    
      55    cp package.json "$srcdir/prod-install/"
    
      56    cd "$srcdir/prod-install"
    
      57    npm install --omit=dev --ignore-scripts --cache "$srcdir/npm-cache"
    
      58}
    
      59
    
      60check() {
    
      61    cd "$srcdir/$pkgname/packages/happy-cli"
    
      62    # Run unit tests only (integration tests require running happy server)
    
      63    yarn vitest run --exclude='**/*.integration.test.ts'
    
      64}
    
      65
    
      66package() {
    
      67    cd "$srcdir/$pkgname/packages/happy-cli"
    
      68
    
      69    install -dm755 "$pkgdir/usr/"{lib/happy-cli,bin}
    
      70
    
      71    # Copy built files and runtime scripts
    
      72    cp -r dist bin scripts package.json "$pkgdir/usr/lib/happy-cli/"
    
      73
    
      74    # Copy production node_modules from isolated install
    
      75    cp -r "$srcdir/prod-install/node_modules" "$pkgdir/usr/lib/happy-cli/"
    
      76
    
      77    # Remove unpack-tools script - it extracts bundled binaries which we don't use
    
      78    rm "$pkgdir/usr/lib/happy-cli/scripts/unpack-tools.cjs"
    
      79
    
      80    ln -s /usr/lib/happy-cli/bin/happy.mjs "$pkgdir/usr/bin/happy"
    
      81    ln -s /usr/lib/happy-cli/bin/happy-mcp.mjs "$pkgdir/usr/bin/happy-mcp"
    
      82
    
      83    install -Dm644 "$srcdir/$pkgname/LICENCE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0