openchatcut

maintainer tiancaijb · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged `npx tsx desktop/prebuild-remotion.mts` runs a local script from the project's own source tree using a locally installed tsx (from node_modules after npm install), not a remote package; the registry rewrite from npmmirror.com to registry.npmjs.org is a legitimate mirror normalization; the bundled patch file has SKIP checksum but is a local file applied to the project's own source; overall this is a normal AUR build of an open-source project from its official GitHub repo with no evidence of malicious behavior.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged `npx tsx desktop/prebuild-remotion.mts` runs a local script from the project's own source tree using a locally installed tsx (from node_modules after npm install), not a remote package; the registry rewrite from npmmirror.com to registry.npmjs.org is a legitimate mirror normalization; the bundled patch file has SKIP checksum but is a local file applied to the project's own source; overall this is a normal AUR build of an open-source project from its official GitHub repo with no evidence of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:89 npx tsx desktop/prebuild-remotion.mts

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <your@email.com>
    
      2# Contributor: OpenChatCut Contributors
    
      3#
    
      4# OpenChatCut — Local-first conversational AI video editor
    
      5#   https://github.com/0xsline/OpenChatCut
    
      6#
    
      7# This PKGBUILD uses system Electron (electron-builder is build-only) and
    
      8# system Chromium (for Remotion headless rendering) plus system FFmpeg.
    
      9# The Remotion serve bundle is prebuilt at package time for fast startup.
    
      10#
    
      11# ── Building locally ──────────────────────────────────────────────────────
    
      12#   cd /tmp
    
      13#   git clone https://github.com/0xsline/OpenChatCut.git openchatcut
    
      14#   cd openchatcut
    
      15#   makepkg -si
    
      16#
    
      17# ── AUR submission notes ──────────────────────────────────────────────────
    
      18# Replace 'Your Name' and email above with the AUR maintainer info.
    
      19# Run `namcap PKGBUILD` and `namcap openchatcut-*.pkg.tar.zst` for QA.
    
      20
    
      21pkgname=openchatcut
    
      22pkgver=0.1.1
    
      23pkgrel=1
    
      24pkgdesc="Local-first conversational AI video editor with multi-track timeline, Agent Skills, MCP integration, and Remotion-powered rendering"
    
      25arch=('x86_64')
    
      26url="https://github.com/0xsline/OpenChatCut"
    
      27license=('AGPL3')
    
      28depends=(
    
      29  'electron>=30'
    
      30  'nodejs>=24'
    
      31  'npm'
    
      32  'chromium'
    
      33  'ffmpeg'
    
      34  'fontconfig'
    
      35)
    
      36makedepends=(
    
      37  'git'
    
      38)
    
      39source=("$pkgname-$pkgver.tar.gz::https://github.com/0xsline/OpenChatCut/archive/refs/tags/v$pkgver.tar.gz"
    
      40        'electron43-isPackaged.patch')
    
      41sha256sums=('dc44414523f118ee9c07a41854843893075981a0c84fa04d72ed21f2c3722711'
    
      42            'SKIP')
    
      43# v0.1.1 annotated tag → commit ab07f81a21bb33700cb4c4a71ff0b2387fb9e625
    
      44# GitHub archive handles annotated tags correctly.
    
      45
    
      46prepare() {
    
      47  cd "$srcdir"
    
      48
    
      49  # GitHub archive tag extracts to OpenChatCut-<ver> (capitalized)
    
      50  if [ -d "OpenChatCut-${pkgver}" ] && [ ! -d "${pkgname}-${pkgver}" ]; then
    
      51    mv "OpenChatCut-${pkgver}" "${pkgname}-${pkgver}"
    
      52  fi
    
      53
    
      54  cd "${pkgname}-${pkgver}"
    
      55
    
      56  # The lockfile ships with npmmirror.com mirrors. npm 12+ refuses to fetch
    
      57  # lockfile URLs outside the configured registry. Rewrite to canonical npmjs.org.
    
      58  sed -i 's|https://registry.npmmirror.com/|https://registry.npmjs.org/|g' package-lock.json
    
      59
    
      60  # .nvmrc is for dev; ensure it matches our nodejs dep range
    
      61  echo '24' > .nvmrc
    
      62
    
      63  # Arch Electron compat: Arch's electron43 forces app.isPackaged=true,
    
      64  # which breaks path resolution. Patch to always use import.meta.url.
    
      65  patch -Np1 < "$srcdir/electron43-isPackaged.patch"
    
      66}
    
      67
    
      68build() {
    
      69  cd "$srcdir/${pkgname}-${pkgver}"
    
      70
    
      71  # ── npm install ─────────────────────────────────────────────────────────
    
      72  # npm 12 blocks install scripts by default. We'll run the essential ones
    
      73  # manually afterward.
    
      74  npm install --registry https://registry.npmjs.org
    
      75
    
      76  # Manually run essential install scripts that npm 12 blocked
    
      77  # esbuild — needed for building the Electron main process
    
      78  node node_modules/esbuild/install.js 2>/dev/null || true
    
      79  # @ffprobe-installer — make ffprobe executable
    
      80  chmod 755 node_modules/@ffprobe-installer/linux-x64/ffprobe 2>/dev/null || true
    
      81
    
      82  # ── TypeScript check + Vite build (web app) ─────────────────────────────
    
      83  npm run build
    
      84
    
      85  # ── Electron main process (esbuild) ─────────────────────────────────────
    
      86  npm run desktop:build:main
    
      87
    
      88  # ── Remotion serve bundle (avoid on-demand webpack at runtime) ──────────
    
      89  npx tsx desktop/prebuild-remotion.mts
    
      90
    
      91  # ── Remove devDependencies (electron, typescript, vite, etc.) ───────────
    
      92  # Saves ~165 MB
    
      93  npm prune --production
    
      94}
    
      95
    
      96package() {
    
      97  cd "$srcdir/${pkgname}-${pkgver}"
    
      98
    
      99  local _libdir="/usr/lib/${pkgname}"
    
      100
    
      101  install -dm755 "${pkgdir}${_libdir}"
    
      102  install -dm755 "${pkgdir}/usr/bin"
    
      103  install -dm755 "${pkgdir}/usr/share/applications"
    
      104  install -dm755 "${pkgdir}/usr/share/pixmaps"
    
      105
    
      106  # ── App code ────────────────────────────────────────────────────────────
    
      107  cp -r dist                   "${pkgdir}${_libdir}/dist"
    
      108  cp -r desktop-dist           "${pkgdir}${_libdir}/desktop-dist"
    
      109  cp -r server                 "${pkgdir}${_libdir}/server"
    
      110  cp -r shared                 "${pkgdir}${_libdir}/shared"
    
      111  cp -r remotion               "${pkgdir}${_libdir}/remotion"
    
      112  cp -r assets                 "${pkgdir}${_libdir}/assets"
    
      113  cp -r public                 "${pkgdir}${_libdir}/public"
    
      114  cp -r src                    "${pkgdir}${_libdir}/src"
    
      115
    
      116  # ── npm dependencies (pruned: production only) ──────────────────────────
    
      117  cp -r node_modules           "${pkgdir}${_libdir}/node_modules"
    
      118
    
      119  # ── Config / metadata ───────────────────────────────────────────────────
    
      120  cp package.json               "${pkgdir}${_libdir}/"
    
      121  cp package-lock.json          "${pkgdir}${_libdir}/"
    
      122  cp vite.config.ts             "${pkgdir}${_libdir}/"
    
      123  cp tsconfig.json              "${pkgdir}${_libdir}/"
    
      124  cp tsconfig.app.json          "${pkgdir}${_libdir}/"
    
      125  cp tsconfig.node.json         "${pkgdir}${_libdir}/"
    
      126  cp electron-builder.config.mjs "${pkgdir}${_libdir}/"
    
      127  cp index.html                 "${pkgdir}${_libdir}/"
    
      128  cp .env.example               "${pkgdir}${_libdir}/"
    
      129
    
      130  # Fix permissions: node_modules/.bin contains launcher scripts
    
      131  find "${pkgdir}${_libdir}/node_modules/.bin" -type f -exec chmod 755 {} + 2>/dev/null || true
    
      132
    
      133  # ── Wrapper script ──────────────────────────────────────────────────────
    
      134  cat >"${pkgdir}/usr/bin/${pkgname}" <<'WRAPPER'
    
      135#!/bin/bash
    
      136# OpenChatCut — Arch launcher
    
      137# chdirs to XDG config dir, links system binaries, launches via system Electron.
    
      138
    
      139set -euo pipefail
    
      140
    
      141CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/openchatcut"
    
      142LIB_DIR="/usr/lib/openchatcut"
    
      143
    
      144mkdir -p "$CONFIG_DIR"
    
      145
    
      146# First-run: copy .env.example → .env.local if no config exists
    
      147ENV_LOCAL="$CONFIG_DIR/.env.local"
    
      148if [ ! -f "$ENV_LOCAL" ]; then
    
      149  if [ -f "$LIB_DIR/.env.example" ]; then
    
      150    cp "$LIB_DIR/.env.example" "$ENV_LOCAL"
    
      151    echo "OpenChatCut: created default config at $ENV_LOCAL"
    
      152    echo "  → Edit it to add your LLM / media-service API keys."
    
      153  fi
    
      154fi
    
      155
    
      156# Speed up Remotion rendering: use prebuilt serve bundle (avoids on-demand webpack)
    
      157export CC_REMOTION_BUNDLE="$LIB_DIR/desktop-dist/remotion-bundle"
    
      158
    
      159# Let Remotion find system Chromium for headless rendering
    
      160export REMOTION_BROWSER_EXECUTABLE="/usr/bin/chromium"
    
      161
    
      162# Use system FFmpeg/FFprobe (not the bundled static binaries)
    
      163export FFMPEG_PATH="/usr/bin/ffmpeg"
    
      164export FFPROBE_PATH="/usr/bin/ffprobe"
    
      165
    
      166cd "$CONFIG_DIR"
    
      167exec /usr/bin/electron --user-data-dir="$CONFIG_DIR" "$LIB_DIR/desktop-dist/main.mjs" "$@"
    
      168WRAPPER
    
      169  chmod 755 "${pkgdir}/usr/bin/${pkgname}"
    
      170
    
      171  # ── Desktop entry ──────────────────────────────────────────────────────
    
      172  cat >"${pkgdir}/usr/share/applications/${pkgname}.desktop" <<DESKTOP
    
      173[Desktop Entry]
    
      174Name=OpenChatCut
    
      175Comment=Local-first conversational AI video editor
    
      176Exec=${pkgname}
    
      177Icon=${pkgname}
    
      178Type=Application
    
      179Categories=AudioVideo;Video;Editor;
    
      180Terminal=false
    
      181StartupWMClass=OpenChatCut
    
      182MimeType=application/x-openchatcut-project;
    
      183DESKTOP
    
      184
    
      185  # ── Icon ────────────────────────────────────────────────────────────────
    
      186  install -Dm644 public/openchatcut-icon.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      187}
    
      188

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 07:19:23	LOW	3
2026-07-21 07:16:26	MEDIUM	2