python-jiuwenswarm
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The main wheel is fetched from the official PyPI CDN with a pinned SHA256, and the git source is from a plausible project-owned host (gitcode.com/openJiuwen); the npm registry is explicitly forced to registry.npmjs.org overriding an upstream mirror; the SKIP checksum on the git tag is a quality concern but not malicious, and no obfuscated payloads or exfiltration are present.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 65%): The main wheel is fetched from the official PyPI CDN with a pinned SHA256, and the git source is from a plausible project-owned host (gitcode.com/openJiuwen); the npm registry is explicitly forced to registry.npmjs.org overriding an upstream mirror; the SKIP checksum on the git tag is a quality concern but not malicious, and no obfuscated payloads or exfiltration are present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:83
"${_tag}.tar.gz::git+https://gitcode.com/openJiuwen/jiuwenswarm.git#tag=${_tag}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: enihcam <enihcam@noreply.gitcode.com>
2
3
pkgname=python-jiuwenswarm
4
pkgver=0.2.2
5
pkgrel=3
6
pkgdesc="Open-source multi-agent orchestration framework (Python backend + bundled React frontend + native TUI built from source)"
7
arch=('x86_64')
8
url="https://pypi.org/project/jiuwenswarm/"
9
license=('Apache-2.0')
10
# Requires Python 3.11–3.13 (per upstream Requires-Python: >=3.11,<3.14).
11
# Arch `python` is currently on 3.13 at time of writing — safe.
12
depends=(
13
'python>=3.11'
14
'python-aiosqlite'
15
'python-charset-normalizer'
16
'python-chromadb'
17
'python-croniter'
18
'python-discord'
19
'python-dingtalk-stream'
20
'python-dotenv'
21
'faiss-cpu' # provides faiss lib (no python- prefix in Arch)
22
'python-fastapi'
23
'python-google-genai'
24
'python-greenlet'
25
'python-httpx'
26
'python-json-repair'
27
'python-lark-oapi'
28
'python-loguru'
29
'python-multipart'
30
'python-mutagen'
31
'python-numpy'
32
'python-opentelemetry-api'
33
'python-opentelemetry-exporter-otlp-proto-grpc'
34
'python-opentelemetry-exporter-otlp-proto-http'
35
'python-opentelemetry-sdk'
36
'python-pgvector'
37
'python-psutil'
38
'python-pydantic'
39
'python-requests'
40
'python-ruamel-yaml'
41
'python-sqlite-vec'
42
'python-telegram-bot'
43
'python-tree-sitter'
44
'python-tree-sitter-bash'
45
'python-urllib3'
46
'uvicorn' # extra/uvicorn (no python- prefix in Arch)
47
'python-websockets'
48
'python-yaml'
49
'icu' # libicui18n/libicuuc/libicudata needed by TUI native binary
50
)
51
makedepends=(
52
'bun' # compiles TUI TypeScript into a self-contained native binary
53
'nodejs' # npm ci for TUI JS runtime deps
54
'python-build' # python -m build --wheel for the TUI Python wheel
55
'python-installer' # python -m installer to copy wheels into $pkgdir
56
'python-wheel' # required by python -m build
57
'git' # base-devel; needed for git+https:// source
58
)
59
optdepends=(
60
'python-a2a-sdk-fastapi: highly recommended - A2A HTTP server transport, required by jiuwenswarm-acp (the a2a-sdk[http-server] extra)'
61
'python-a2a-sdk: A2A protocol SDK runtime (needed alongside python-a2a-sdk-fastapi for jiuwenswarm-acp)'
62
'python-pywebview: desktop application GUI (jiuwenswarm-desktop)'
63
'openjiuwen: distributed deployment extras (postgres, zmq backends)'
64
)
65
# The real jiuwenswarm-tui (TypeScript-based interactive terminal client built with Bun)
66
# is no longer an optdepend — it is built from source and bundled in this package.
67
#
68
# Source 1: PyPI wheel. Pure-Python (`py3-none-any`), bundles the built React frontend
69
# `dist/`, so no Node.js build step is required for the main package at install time.
70
# Local filename must match the wheel's internal .dist-info directory name
71
# (jiuwenswarm-${pkgver}.dist-info). Using ${pkgname}- prefix breaks
72
# python -m installer's filename-to-dist-info check.
73
#
74
# Source 2: Upstream git tag. The tag for v0.2.2 on gitcode is named "JiuwenSwarm0.2.2"
75
# (no `v` prefix, capital `J`). Provides:
76
# - jiuwenswarm/channels/tui/frontend/ (TypeScript source + package.json + package-lock.json)
77
# - packages/jiuwenswarm-tui/ (Python wrapper package + setup.py + pyproject.toml)
78
# - scripts/build_tui.py (Bun --compile script)
79
# Git sources are inherently unstable so checksum is SKIP; pin by commit in a follow-up.
80
_tag="JiuwenSwarm${pkgver}"
81
source=(
82
"jiuwenswarm-${pkgver}-py3-none-any.whl::https://files.pythonhosted.org/packages/83/0f/d8368cccd39019ffb7fa3610151fa5f2b129385b163b4f09c9451e1a1eb4/jiuwenswarm-${pkgver}-py3-none-any.whl"
83
"${_tag}.tar.gz::git+https://gitcode.com/openJiuwen/jiuwenswarm.git#tag=${_tag}"
84
)
85
sha256sums=(
86
'2a5814b6865dd5932497c4d61ca2374483a174c905652937d671c1f4f99ce817' # main PyPI wheel
87
'SKIP' # git tag, verified via git fetch + checkout
88
)
89
90
prepare() {
91
cd "$srcdir/${_tag}.tar.gz"
92
93
# Extract main wheel metadata so we can install LICENSE to the canonical path
94
# without polluting $pkgdir with a second copy of the dist-info tree.
95
python -m zipfile -e \
96
"$srcdir/jiuwenswarm-${pkgver}-py3-none-any.whl" \
97
"$srcdir/wheel-extract"
98
99
# Install TUI JS runtime dependencies (chalk, ws, @mariozechner/pi-tui).
100
# Skip devDependencies (typescript, oxlint, oxfmt) — not needed for the build.
101
# The upstream package-lock.json pins to registry.npmmirror.com — force the
102
# official npmjs.org registry so AUR users worldwide can build without
103
# depending on a third-party mirror.
104
# `--allow-remote=all` is required by npm >=11 which defaults to allow-remote=none
105
# to block remote package fetches.
106
pushd "jiuwenswarm/channels/tui/frontend" >/dev/null
107
npm ci --omit=dev \
108
--allow-remote=all \
109
--registry=https://registry.npmjs.org/
110
popd >/dev/null
111
112
# Compile TUI TypeScript into a self-contained native binary via Bun.
113
# scripts/build_tui.py writes the binary to
114
# packages/jiuwenswarm-tui/jiuwenswarm_tui/resources/tui-bin/<platform>/jiuwenswarm-tui
115
# so the TUI Python wrapper package picks it up at install time.
116
python scripts/build_tui.py --target current
117
118
# Build the TUI Python wheel (which now bundles the native binary inside).
119
# --no-isolation reuses the system Python's build/wheel/setuptools (faster, no venv).
120
pushd "packages/jiuwenswarm-tui" >/dev/null
121
python -m build --wheel --no-isolation
122
popd >/dev/null
123
}
124
125
package() {
126
cd "$srcdir"
127
128
# Install main wheel first (contains the `jiuwenswarm-tui` CLI subcommand dispatcher).
129
python -m installer --destdir="$pkgdir" \
130
"jiuwenswarm-${pkgver}-py3-none-any.whl"
131
132
# Install TUI wheel LAST with --overwrite-existing so the real launcher
133
# (jiuwenswarm_tui.app:main) replaces the bundled CLI dispatcher under
134
# the same /usr/bin/jiuwenswarm-tui path.
135
python -m installer --destdir="$pkgdir" --overwrite-existing \
136
"${_tag}.tar.gz/packages/jiuwenswarm-tui/dist/"*.whl
137
138
# Install upstream LICENSE into the canonical Arch location.
139
install -Dm644 \
140
"$srcdir/wheel-extract/jiuwenswarm-${pkgver}.dist-info/licenses/LICENSE" \
141
"$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
142
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |