mistral-vibe

MEDIUM

maintainer Vial 6 votes scanned 2026-09-27 13:18:29.354985

View on AUR

Why flagged

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Rubin Simons <me@rubin55.org>
    
      2
    
      3pkgname=mistral-vibe
    
      4pkgver=2.25.5
    
      5pkgrel=1
    
      6pkgdesc='Minimal CLI coding agent by Mistral'
    
      7arch=('x86_64')
    
      8url='https://github.com/mistralai/mistral-vibe'
    
      9license=(Apache-2.0)
    
      10depends=(
    
  "python"
    
  "python-agent-client-protocol"
    
  "python-aiofiles"
    
  "python-dotenv"
    
  "python-giturlparse"
    
  "python-google-auth"
    
  "python-httpx"
    
  "python-humanize"
    
  "python-jsonpatch"
    
  "python-keyring"
    
  "python-linkify-it-py"
    
  "python-mcp"
    
  "python-mistralai"
    
  "python-opentelemetry-api"
    
  "python-opentelemetry-exporter-otlp"
    
  "python-opentelemetry-semantic-conventions"
    
  "python-packaging"
    
  "python-pexpect"
    
  "python-pydantic"
    
  "python-pydantic-settings"
    
  "python-pyperclip"
    
  "python-rfc8785"
    
  "python-rich"
    
  "python-sentry_sdk"
    
  "python-textual"
    
  "python-tomli-w"
    
  "python-tree-sitter-bash"
    
  "python-truststore"
    
  "python-watchfiles"
    
  "python-yaml"
    
  "python-zstandard"
    
  "python-sounddevice"
    
      43)
    
      44makedepends=(
    
  "python-build"
    
  "python-hatchling"
    
  "python-hatch-vcs"
    
  "python-installer"
    
      49)
    
      50checkdepends=(
    
  "pre-commit"
    
  "pyright"
    
  "python-pytest"
    
  "python-pytest-asyncio"
    
  "python-pytest-textual-snapshot"
    
  "python-pytest-timeout"
    
  "python-pytest-xdist"
    
  "python-respx"
    
  "ruff"
    
  "twine"
    
  "typos"
    
  "uv"
    
  "vulture"
    
      64)
    
      65source=("git+${url}.git#tag=v${pkgver}"
    
      "lower_hatchling_version_requirements.patch"
    
      "clear_multiplexer_env_in_theme_tests.patch"
    
      "stabilize_click_chain_timing_in_word_drag_tests.patch"
    
      "stretch_e2e_timeouts_when_builder_is_loaded.patch")
    
      70sha256sums=('bc4d6f3c021388f7702abb2d168e21b7ddcf0d7f1de55b8d9a4959c2e1142175'
    
          'c9b417d8a6445bcca31f8d75757a7ec2d78e4b5aec784a7b5d2c9adf62106014'
    
          'f24330784d56591d197dc260166d29fff717fab763963fb2c7d8221f81135069'
    
          'ec15c34e133eb3ca09c593ac03a715beb30557585d81b0ac99bffcf5818bd5e2'
    
          '2706769c69b63715757f2d820b4b3d9c363a278821d58c29fdd5ecf25fb720c9')
    
      75prepare() {
    
  cd "$pkgname"
    
  cat "$srcdir/lower_hatchling_version_requirements.patch" | patch -p1
    
  cat "$srcdir/clear_multiplexer_env_in_theme_tests.patch" | patch -p1
    
  cat "$srcdir/stabilize_click_chain_timing_in_word_drag_tests.patch" | patch -p1
    
  cat "$srcdir/stretch_e2e_timeouts_when_builder_is_loaded.patch" | patch -p1
    
      81}
    
      82
    
      83build() {
    
  cd "$pkgname"
    
  python -m build --wheel --no-isolation
    
      86}
    
      87
    
      88check() {
    
  cd "$pkgname"
    
  uv sync
    
  # The build environment has no D-Bus session bus, so keyring's
    
  # SecretService backend blocks indefinitely on every lookup (e.g. during
    
  # ACP initialize and CLI onboarding), which times out the e2e and ACP
    
  # tests. Force a non-blocking in-memory backend.
    
  export PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring
    
      96
    
  # tests/tools/test_bash.py asserts on the English strerror text of a
    
  # failing `cat`. Since v2.23.0 the bash tool no longer pins LC_ALL for
    
  # spawned shells, so a translated builder locale breaks that test.
    
  export LC_MESSAGES=C
    
      101
    
  # The e2e tests poll the rendered TUI with tight wall-clock deadlines
    
  # (5-15s) that assume an idle machine. On a loaded builder (parallel
    
  # builds, kernel compile in the background) the mock-server responses can
    
  # take far longer than that to render. The e2e patch exposes
    
  # VIBE_TEST_TIME_SCALE; stretch all e2e deadlines by 3x.
    
  export VIBE_TEST_TIME_SCALE=3
    
      108
    
  # These two tests exercise scripts/install.sh and assume no `uv`/`vibe`
    
  # binary in /usr/bin or /bin. They fail on a builder that already has
    
  # system-wide installs (which this package itself provides). Skip them.
    
  local deselect=(
    
      --deselect tests/test_install_script.py::test_install_reports_missing_path_for_uv_tool_bin
    
      --deselect tests/test_install_script.py::test_install_fails_when_vibe_not_in_uv_tool_dir
    
  )
    
      116
    
  # Run test suite in parallel, skip deselected and any e2e tests.
    
  uv run pytest -n4 --timeout=60 "${deselect[@]}" --ignore=tests/e2e
    
      119
    
  # Run e2e tests serially (these fail too often in parallel).
    
  uv run pytest -n0 --timeout=60 "${deselect[@]}" tests/e2e
    
      122}
    
      123
    
      124package() {
    
  cd "$pkgname"
    
  python -m installer --destdir="$pkgdir" dist/*.whl
    
  echo "#!/usr/bin/env python3" > "${pkgdir}/usr/bin/vibe"
    
  pyver=$(python3 --version | awk '{print $2}' | cut -d. -f1,2)
    
  cat "${pkgdir}/usr/lib/python${pyver}/site-packages/vibe/cli/entrypoint.py" >> "${pkgdir}/usr/bin/vibe"
    
  chmod 755 "${pkgdir}/usr/bin/vibe"
    
      131}
    
      132

Changes since previous scan

--- PKGBUILD @ 2026-09-12 21:12
+++ PKGBUILD @ 2026-09-27 13:18
@@ -1,7 +1,7 @@
 # Maintainer: Rubin Simons <me@rubin55.org>
 
 pkgname=mistral-vibe
-pkgver=2.25.3
+pkgver=2.25.5
 pkgrel=1
 pkgdesc='Minimal CLI coding agent by Mistral'
 arch=('x86_64')
@@ -67,7 +67,7 @@
         "clear_multiplexer_env_in_theme_tests.patch"
         "stabilize_click_chain_timing_in_word_drag_tests.patch"
         "stretch_e2e_timeouts_when_builder_is_loaded.patch")
-sha256sums=('79835eed651f8f338d07ab01061878a41e61b15fd60890d00d371dd4410ab1c2'
+sha256sums=('bc4d6f3c021388f7702abb2d168e21b7ddcf0d7f1de55b8d9a4959c2e1142175'
             'c9b417d8a6445bcca31f8d75757a7ec2d78e4b5aec784a7b5d2c9adf62106014'
             'f24330784d56591d197dc260166d29fff717fab763963fb2c7d8221f81135069'
             'ec15c34e133eb3ca09c593ac03a715beb30557585d81b0ac99bffcf5818bd5e2'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 13:18:29	Medium	1
2026-09-18 15:28:46	Clean	0
2026-09-12 21:12:39	Clean	0
2026-09-11 21:24:02	Clean	0
2026-09-09 15:19:51	Clean	0
2026-09-04 11:57:41	Clean	0
2026-08-30 13:42:42	Clean	0
2026-08-27 21:33:25	Clean	0
2026-08-27 19:33:23	Clean	0
2026-08-20 21:12:41	Clean	0
2026-08-19 15:42:02	Clean	0
2026-08-19 03:41:13	Clean	0
2026-08-13 19:26:43	Clean	0
2026-07-30 19:16:23	Clean	0
2026-07-28 21:39:42	Clean	0
2026-07-28 19:39:35	Clean	0
2026-07-21 21:18:19	Clean	0
2026-07-19 09:10:42	Clean	0
2026-07-17 19:55:55	Clean	0
2026-07-13 09:41:03	Clean	0