kun-gui

maintainer xmengnet · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs 'electron-vite build' locally on the project's own source code after npm install, which is a standard build step for Electron apps and does not execute untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command runs 'electron-vite build' locally on the project's own source code after npm install, which is a standard build step for Electron apps and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:36 npx electron-vite build

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: liyp <my@liyp.cc>
    
      2pkgname=kun-gui
    
      3pkgver=0.2.20
    
      4pkgrel=1
    
      5pkgdesc="AI agent workspace with Code and Write modes - Electron client"
    
      6arch=('x86_64')
    
      7url="https://github.com/KunAgent/Kun"
    
      8license=('custom:PolyForm-Noncommercial-1.0.0')
    
      9depends=('electron34')
    
      10makedepends=('npm' 'nodejs>=20' 'python')
    
      11optdepends=('libxss: screen saver inhibit support'
    
      12            'libappindicator-gtk3: system tray support on GTK-based DEs')
    
      13source=("${pkgname}-${pkgver}.tar.gz::https://github.com/KunAgent/Kun/archive/refs/tags/v${pkgver}.tar.gz")
    
      14sha256sums=('2615e45f556f99e5756d986bd214838153f021a3bb46d0bcae3a10ff7fb7a53e')
    
      15options=('!strip')
    
      16
    
      17prepare() {
    
      18    cd "${srcdir}/Kun-${pkgver}"
    
      19    # Install main project, skip postinstall (it auto-builds kun and tries electron prebuild)
    
      20    npm install --ignore-scripts
    
      21    # Install kun runtime dependencies
    
      22    npm --prefix kun install
    
      23}
    
      24
    
      25build() {
    
      26    cd "${srcdir}/Kun-${pkgver}"
    
      27    # Build kun runtime (was skipped by --ignore-scripts above)
    
      28    npm --prefix kun run build
    
      29    # Verify kun runtime was built
    
      30    if [ ! -f "kun/dist/cli/serve-entry.js" ]; then
    
      31        echo "ERROR: kun runtime build failed - kun/dist/cli/serve-entry.js not found"
    
      32        return 1
    
      33    fi
    
      34    echo "==> kun runtime built successfully"
    
      35    # Build Electron app (tsc + vite)
    
      36    npx electron-vite build
    
      37    # Prune to production dependencies only (must be after vite build which needs devDeps)
    
      38    npm prune --production
    
      39    npm --prefix kun prune --production
    
      40}
    
      41
    
      42package() {
    
      43    cd "${srcdir}/Kun-${pkgver}"
    
      44
    
      45    # Install application to /usr/lib/kun-gui
    
      46    install -d "${pkgdir}/usr/lib/${pkgname}"
    
      47
    
      48    # Copy built output
    
      49    cp -r out "${pkgdir}/usr/lib/${pkgname}/out"
    
      50    # Fix version: source package.json says 0.1.0, set to actual release version
    
      51    # (CI uses electron-builder's extraMetadata + KUN_APP_VERSION, we patch directly)
    
      52    sed -i "s/\"version\": \"[^\"]*\"/\"version\": \"${pkgver}\"/" package.json
    
      53    install -Dm644 package.json "${pkgdir}/usr/lib/${pkgname}/package.json"
    
      54
    
      55    # Copy production node_modules
    
      56    cp -r node_modules "${pkgdir}/usr/lib/${pkgname}/node_modules"
    
      57
    
      58    # Copy kun runtime + dependencies — only into out/main/
    
      59    # The app resolves kun path relative to __dirname (out/main/), root-level copy is unused
    
      60    mkdir -p "${pkgdir}/usr/lib/${pkgname}/out/main"
    
      61    cp -r kun "${pkgdir}/usr/lib/${pkgname}/out/main/kun"
    
      62
    
      63    # Copy vendor dependencies
    
      64    if [ -d "vendor" ]; then
    
      65        cp -r vendor "${pkgdir}/usr/lib/${pkgname}/vendor"
    
      66    fi
    
      67
    
      68    # Aggressively clean up to reduce package size
    
      69    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name "*.map" -delete
    
      70    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name "*.ts" -not -name "*.d.ts" -delete
    
      71    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name "README*" -delete 2>/dev/null || true
    
      72    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name "CHANGELOG*" -delete 2>/dev/null || true
    
      73    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name ".package-lock.json" -delete
    
      74    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "test" -exec rm -rf {} + 2>/dev/null || true
    
      75    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "tests" -exec rm -rf {} + 2>/dev/null || true
    
      76    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "example" -exec rm -rf {} + 2>/dev/null || true
    
      77    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "examples" -exec rm -rf {} + 2>/dev/null || true
    
      78    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "doc" -exec rm -rf {} + 2>/dev/null || true
    
      79    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name "docs" -exec rm -rf {} + 2>/dev/null || true
    
      80    # Remove .d.ts type definitions (not needed at runtime) — saves ~10M+
    
      81    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -name "*.d.ts" -delete
    
      82    # Remove TypeScript compiler (devDependency that survived prune) — saves ~23M
    
      83    rm -rf "${pkgdir}/usr/lib/${pkgname}/node_modules/typescript"
    
      84    # Remove @types packages (type-only, not needed at runtime) — saves ~4M
    
      85    rm -rf "${pkgdir}/usr/lib/${pkgname}/node_modules/@types"
    
      86    # Remove @napi-rs/canvas native binary (mermaid server-side canvas; Electron uses browser canvas) — saves ~32M
    
      87    rm -rf "${pkgdir}/usr/lib/${pkgname}/node_modules/@napi-rs/canvas-linux-x64-gnu"
    
      88    # Clean up out/main/kun/ — remove source, tests, build scripts, and type definitions
    
      89    rm -rf "${pkgdir}/usr/lib/${pkgname}/out/main/kun/src"
    
      90    rm -rf "${pkgdir}/usr/lib/${pkgname}/out/main/kun/tests"
    
      91    rm -rf "${pkgdir}/usr/lib/${pkgname}/out/main/kun/scripts"
    
      92    find "${pkgdir}/usr/lib/${pkgname}/out/main/kun" -name "*.d.ts" -delete
    
      93    find "${pkgdir}/usr/lib/${pkgname}/out/main/kun" -name "*.d.ts.map" -delete
    
      94    find "${pkgdir}/usr/lib/${pkgname}/out/main/kun" -name "*.map" -delete
    
      95
    
      96    # Create launch script
    
      97    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" << 'LAUNCHER'
    
      98#!/bin/bash
    
      99
    
      100XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-~/.config}
    
      101
    
      102if [[ -f "${XDG_CONFIG_HOME}/kun-gui-flags.conf" ]]; then
    
      103	mapfile -t KUN_GUI_USER_FLAGS <<<"$(grep -v '^#' "${XDG_CONFIG_HOME}/kun-gui-flags.conf")"
    
      104	echo "User flags:" ${KUN_GUI_USER_FLAGS[@]}
    
      105fi
    
      106
    
      107exec -a kun-gui /bin/electron34 /usr/lib/kun-gui/out/main/index.js ${KUN_GUI_USER_FLAGS[@]} "$@"
    
      108LAUNCHER
    
      109
    
      110    # Install desktop file
    
      111    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" << 'EOF'
    
      112[Desktop Entry]
    
      113Name=Kun
    
      114Comment=AI agent workspace with Code and Write modes
    
      115Exec=kun-gui %U
    
      116Icon=kun-gui
    
      117Type=Application
    
      118Categories=Development;
    
      119StartupWMClass=kun-gui
    
      120EOF
    
      121
    
      122    # Install icon to hicolor theme (required for KDE Wayland dock icon matching)
    
      123    install -Dm644 "src/asset/img/kun.png" \
    
      124        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/kun-gui.png"
    
      125    # Also keep in pixmaps as fallback
    
      126    install -Dm644 "src/asset/img/kun.png" "${pkgdir}/usr/share/pixmaps/kun-gui.png"
    
      127
    
      128    # Install license
    
      129    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      130    cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
    
      131PolyForm Noncommercial License 1.0.0
    
      132https://polyformproject.org/licenses/noncommercial/1.0.0
    
      133
    
      134Copyright (c) Kun Contributors
    
      135EOF
    
      136}
    
      137

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2