stably-orca

MEDIUM

maintainer bhyoo 0 votes scanned 2026-09-15 07:19:15.107868

View on AUR

Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

PKGBUILD:139 // Why after the prune: `pnpm install:release` widens the CPU set for cross-builds,

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
    
      2
    
      3pkgname=stably-orca
    
      4pkgver=1.4.203
    
      5pkgrel=1
    
      6pkgdesc='Stably AI Orca agentic coding IDE and headless runtime (built from source)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/stablyai/orca'
    
      9license=('MIT')
    
      10depends=(
    
'alsa-lib'
    
'at-spi2-core'
    
'dbus'
    
'electron43'
    
'gcc-libs'
    
'gdk-pixbuf2'
    
'glibc'
    
'gtk3'
    
'hicolor-icon-theme'
    
'libdrm'
    
'libnotify'
    
'libsecret'
    
'libxcomposite'
    
'libxdamage'
    
'libxfixes'
    
'libxkbcommon'
    
'libxrandr'
    
'libxss'
    
'libxtst'
    
'mesa'
    
'nss'
    
'python'
    
'python-gobject'
    
'systemd-libs'
    
'zlib'
    
      36)
    
      37optdepends=(
    
'kwin: optional KWin virtual Wayland compositor service'
    
'wl-clipboard: Wayland clipboard support for computer-use'
    
'xclip: X11 clipboard support for computer-use'
    
'xsel: alternative X11 clipboard support for computer-use'
    
'xdotool: X11 hotkey and window activation support for computer-use'
    
'xorg-server-xvfb: automatic virtual X display when no DISPLAY is provided'
    
'xorg-xauth: Xwayland authentication for the KWin virtual display service'
    
'xorg-xdpyinfo: external X display readiness validation'
    
'xorg-xwayland: Xwayland support for the KWin virtual display service'
    
      47)
    
      48makedepends=(
    
'nodejs-lts-krypton'
    
'python-setuptools'
    
      51)
    
      52provides=("orca-ide=$pkgver")
    
      53conflicts=('stably-orca-bin' 'stably-orca-git' 'orca-ide' 'orca-ide-bin')
    
      54options=('!strip' '!debug')
    
      55install=stably-orca.install
    
      56
    
      57_pnpmver=12.0.0
    
      58_electronmajor=43
    
      59source=(
    
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
"pnpm-$_pnpmver.tgz::https://registry.npmjs.org/pnpm/-/pnpm-$_pnpmver.tgz"
    
'stably-orca.sh'
    
'orca-ide.sh'
    
'stably-orca.desktop'
    
'stably-orca-serve@.service'
    
'stably-orca-serve-systemd'
    
'stably-orca-kwin-virtual@.service'
    
'stably-orca-kwin-display'
    
'stably-orca-serve.env.example'
    
'stably-orca-serve-kwin.conf.example'
    
      71)
    
      72source_x86_64=(
    
"pnpm-exe-linux-x64-$_pnpmver.tgz::https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-$_pnpmver.tgz"
    
      74)
    
      75source_aarch64=(
    
"pnpm-exe-linux-arm64-$_pnpmver.tgz::https://registry.npmjs.org/@pnpm/exe.linux-arm64/-/exe.linux-arm64-$_pnpmver.tgz"
    
      77)
    
      78sha256sums=('4b775bf6f5bb85e0ef9abc37f2d01ea6a516a1502c2a973362827047dd968c1d'
    
          '5ef12ab545a211627c23f05eb589a051e6c207a3f2c3382add8f0573400b871d'
    
          'd76ba8a9856aa7181a41bccb1bb7a09b10cc990b0a6d680c328af75eb185c90d'
    
          '0d8e816f7dd5d46b9da40748ac7a0d709adfd7f09d79ffe71327b60c5c5abbb7'
    
          '77a10524dc1b971fecd99a5be47b13f93021b0882495ed32a37d12a2f7fed835'
    
          '0d262438d6ca1de562db33ba8373ccc08298f3fdfa18209864d4189bddfaf742'
    
          'd423881ade5704432cbe9afea626438991a1dcda3dda3ed18811e1b3fd721e1e'
    
          '3b1943f5b65997ce52196f055b3c10b30dd5e81ae934a91bff096d42c7fcc425'
    
          'aba5146aed46aa61abf4000285460f088698f618991d81ef9730d408173cc253'
    
          'c97fe80d1e55c274207f62c6b388ae4573627028624ae73bcabd0eabcc7d76e5'
    
          'eacec99a44af83ed452e367f343e69042a21f8d9750f15a6447b7de2991146a0')
    
      89sha256sums_x86_64=('d0c64efab39d560ef3ae4dc8be5dd08951e5409ed2d53cb6b8317b7713c26333')
    
      90sha256sums_aarch64=('e227252e352b8023fd1151fbe36eeb934a26eef2e0c327b8d1a1aad7b4bfbd90')
    
      91noextract=(
    
"pnpm-$_pnpmver.tgz"
    
"pnpm-exe-linux-x64-$_pnpmver.tgz"
    
"pnpm-exe-linux-arm64-$_pnpmver.tgz"
    
      95)
    
      96
    
      97prepare() {
    
local pnpm_platform
    
case $CARCH in
    
  x86_64) pnpm_platform=linux-x64 ;;
    
  aarch64) pnpm_platform=linux-arm64 ;;
    
  *)
    
    printf 'ERROR: unsupported pnpm platform for architecture %s\n' "$CARCH" >&2
    
    return 1
    
    ;;
    
esac
    
      107
    
rm -rf "$srcdir/pnpm"
    
install -d "$srcdir/pnpm"
    
bsdtar -xf "$srcdir/pnpm-$_pnpmver.tgz" --strip-components 1 -C "$srcdir/pnpm"
    
      111
    
local pnpm_exe="$srcdir/pnpm/node_modules/@pnpm/exe.$pnpm_platform"
    
install -d "$pnpm_exe"
    
bsdtar -xf "$srcdir/pnpm-exe-$pnpm_platform-$_pnpmver.tgz" \
    
  --strip-components 1 -C "$pnpm_exe"
    
node "$srcdir/pnpm/install.js"
    
      117
    
local pnpm_version
    
pnpm_version=$("$srcdir/pnpm/pnpm" --version)
    
if [[ $pnpm_version != "$_pnpmver" ]]; then
    
  printf 'ERROR: expected pnpm %s, found %s\n' \
    
    "$_pnpmver" "$pnpm_version" >&2
    
  return 1
    
fi
    
      125
    
cd "$srcdir/orca-$pkgver"
    
python - <<'PY'
    
      128from pathlib import Path
    
      129
    
      130path = Path("config/electron-builder.config.cjs")
    
      131data = path.read_text()
    
      132import_line = (
    
  "const { verifyLinuxGlibcFloor } = "
    
  "require('./scripts/verify-linux-glibc-floor.cjs')\n"
    
      135)
    
      136check_block = """    // Why: a Linux runner-image glibc bump silently shipped a node-pty pty.node
    
  // requiring GLIBC_2.34, crashing the app on startup on Ubuntu 20.04 (#9902).
    
  // Fail packaging if any bundled native binary exceeds the supported floor.
    
  // Why after the prune: `pnpm install:release` widens the CPU set for cross-builds,
    
  // so an arm64 slice can still carry the x64 @parcel/watcher until
    
  // prunePackagedRuntimeNodeModules drops it.
    
  if (context.electronPlatformName === 'linux') {
    
    // Why the arch is passed: symbol-version checks pass happily on a wrong-architecture binary,
    
    // so a cross-built slice could ship the host's pty.node and only fail at runtime.
    
    verifyLinuxGlibcFloor(context.appOutDir, {
    
      targetArch: { 1: 'x64', 3: 'arm64' }[context.arch]
    
    })
    
  }
    
      149"""
    
      150if data.count(import_line) != 1 or data.count(check_block) != 1:
    
  raise SystemExit("upstream glibc-floor check changed")
    
      152path.write_text(data.replace(import_line, "").replace(check_block, ""))
    
      153PY
    
      154}
    
      155
    
      156build() {
    
cd "$srcdir/orca-$pkgver"
    
      158
    
local electron_dist="/usr/lib/electron$_electronmajor"
    
local electron_version
    
electron_version=$(<"$electron_dist/version")
    
electron_version=${electron_version#v}
    
if [[ $electron_version != "$_electronmajor".* ]]; then
    
  printf 'ERROR: electron%s provides unexpected version %s\n' \
    
    "$_electronmajor" "$electron_version" >&2
    
  return 1
    
fi
    
      168
    
local pnpm=("$srcdir/pnpm/pnpm")
    
      170
    
export HOME="$srcdir/.home"
    
export XDG_CACHE_HOME="$srcdir/.cache"
    
export XDG_DATA_HOME="$srcdir/.local/share"
    
export PNPM_HOME="$srcdir/.pnpm-home"
    
export npm_config_cache="$srcdir/.npm"
    
export npm_config_manage_package_manager_versions=false
    
export npm_config_store_dir="$srcdir/.pnpm-store"
    
export ELECTRON_BUILDER_CACHE="$srcdir/.cache/electron-builder"
    
export ELECTRON_OVERRIDE_DIST_PATH="$electron_dist"
    
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export ORCA_FORCE_NATIVE_REBUILD=1
    
export HUSKY=0
    
      183
    
install -d "$HOME" "$XDG_CACHE_HOME" "$XDG_DATA_HOME" "$PNPM_HOME" \
    
  "$npm_config_cache" "$npm_config_store_dir" "$ELECTRON_BUILDER_CACHE"
    
      186
    
"${pnpm[@]}" install --frozen-lockfile --ignore-scripts
    
      188
    
rm -rf node_modules/electron/dist
    
ln -s "$electron_dist" node_modules/electron/dist
    
printf 'electron' >node_modules/electron/path.txt
    
node - "$electron_version" <<'JS'
    
      193const fs = require('node:fs')
    
      194const path = 'node_modules/electron/package.json'
    
      195const pkg = JSON.parse(fs.readFileSync(path, 'utf8'))
    
      196pkg.version = process.argv[2]
    
      197fs.writeFileSync(path, `${JSON.stringify(pkg, null, 2)}\n`)
    
      198JS
    
      199
    
"${pnpm[@]}" rebuild esbuild @parcel/watcher
    
"${pnpm[@]}" run postinstall
    
local target
    
for target in build:relay build:cli build:electron-vite build:web; do
    
  "${pnpm[@]}" run "$target"
    
done
    
"${pnpm[@]}" run ensure:electron-runtime
    
      207
    
# System Electron resolves process.resourcesPath to /usr/lib/electron43/resources.
    
# Orca's packaged assets live under /usr/lib/stably-orca instead.
    
python - <<'PY'
    
      211from pathlib import Path
    
      212import re
    
      213import subprocess
    
      214
    
      215pattern = re.compile(r"(?<![\w$.])process\.resourcesPath\b")
    
      216replacement = "'/usr/lib/stably-orca'"
    
      217changed_files = []
    
      218changed_references = 0
    
      219for path in Path("out").rglob("*.js"):
    
  data = path.read_text()
    
  updated, count = pattern.subn(replacement, data)
    
  if count:
    
      path.write_text(updated)
    
      changed_files.append(path)
    
      changed_references += count
    
      226if not changed_files:
    
  raise SystemExit("compiled output has no process.resourcesPath references")
    
      228for path in changed_files:
    
  subprocess.run(["node", "--check", str(path)], check=True)
    
      230print(
    
  f"patched {changed_references} process.resourcesPath references "
    
  f"across {len(changed_files)} files"
    
      233)
    
      234PY
    
      235
    
"${pnpm[@]}" exec electron-builder \
    
  --config config/electron-builder.config.cjs \
    
  --linux dir \
    
  --publish never \
    
  --config.electronDist="$electron_dist" \
    
  --config.electronVersion="$electron_version"
    
      242}
    
      243
    
      244package() {
    
cd "$srcdir/orca-$pkgver"
    
      246
    
local unpacked=(dist/linux*-unpacked)
    
if [[ ${#unpacked[@]} -ne 1 || ! -d ${unpacked[0]} ]]; then
    
  printf 'ERROR: expected one electron-builder unpacked Linux directory\n' >&2
    
  return 1
    
fi
    
      252
    
local resources="${unpacked[0]}/resources"
    
install -d "$pkgdir/usr/lib/$pkgname"
    
cp -a "$resources/." "$pkgdir/usr/lib/$pkgname/"
    
chmod -R go-w "$pkgdir/usr/lib/$pkgname"
    
      257
    
# Pacman owns upgrades for this package. Without the generated AppImage
    
# manifest, release checks may run but electron-updater cannot self-apply.
    
rm -f "$pkgdir/usr/lib/$pkgname/app-update.yml"
    
# serve-sim carries macOS helper binaries and authoring sources even in its
    
# Linux npm package. They are unreachable on Linux and confuse ELF analysis.
    
local serve_sim="$pkgdir/usr/lib/$pkgname/node_modules/serve-sim"
    
rm -rf "$serve_sim/Sources"
    
rm -f \
    
  "$serve_sim/bin/serve-sim-bin" \
    
  "$serve_sim/dist/simcam/libSimCameraInjector.dylib" \
    
  "$serve_sim/dist/simcam/serve-sim-camera-helper"
    
# Keep node-pty's loadable addon, but discard node-gyp/Forge build state,
    
# duplicate objects, dependency files and foreign Windows helper payloads.
    
local node_modules="$pkgdir/usr/lib/$pkgname/node_modules"
    
local node_pty="$node_modules/node-pty"
    
rm -f \
    
  "$node_pty/build/Makefile" \
    
  "$node_pty/build/binding.Makefile" \
    
  "$node_pty/build/pty.target.mk" \
    
  "$node_pty/build/config.gypi" \
    
  "$node_pty/build/Release/.forge-meta" \
    
  "$node_pty/build/Release/node-addon-api@"*/node_modules/node-addon-api/node_addon_api_except.stamp.d \
    
  "$node_pty/node-addon-api@"*/node_modules/node-addon-api/node_addon_api_except.stamp \
    
  "$node_modules/ssh2/util/pagent.exe"
    
rm -rf \
    
  "$node_pty/build/Release/.deps" \
    
  "$node_pty/build/Release/obj.target"
    
      285
    
# Pruning platform-specific npm payloads leaves empty package directories.
    
find "$node_modules" -depth -type d -empty -delete
    
      288
    
local pty_addon="$node_pty/build/Release/pty.node"
    
[[ -s "$pty_addon" ]] || {
    
  printf 'ERROR: packaged node-pty addon is missing or empty\n' >&2
    
  return 1
    
}
    
      294
    
local node_pty_build_extras=()
    
mapfile -d '' node_pty_build_extras < <(
    
  find "$node_pty/build" -mindepth 1 \
    
    ! -path "$node_pty/build/Release" \
    
    ! -path "$pty_addon" \
    
    -print0
    
)
    
if [[ ${#node_pty_build_extras[@]} -ne 0 ]]; then
    
  printf 'ERROR: packaged node-pty build tree contains unexpected entries:\n' >&2
    
  printf '  %s\n' "${node_pty_build_extras[@]}" >&2
    
  return 1
    
fi
    
      307
    
local node_pty_metadata=()
    
mapfile -d '' node_pty_metadata < <(
    
  find "$node_pty" \
    
    \( -name 'Makefile' \
    
    -o -name 'binding.Makefile' \
    
    -o -name '*.target.mk' \
    
    -o -name 'config.gypi' \
    
    -o -name '.forge-meta' \
    
    -o -name '*.stamp' \
    
    -o -name '*.stamp.d' \
    
    -o -name '.deps' \
    
    -o -name 'obj.target' \) \
    
    -print0
    
)
    
if [[ ${#node_pty_metadata[@]} -ne 0 ]]; then
    
  printf 'ERROR: packaged node-pty retains build metadata:\n' >&2
    
  printf '  %s\n' "${node_pty_metadata[@]}" >&2
    
  return 1
    
fi
    
      327
    
local node_pty_zero_files=()
    
mapfile -d '' node_pty_zero_files < <(
    
  find "$node_pty" -type f -empty -print0
    
)
    
if [[ ${#node_pty_zero_files[@]} -ne 0 ]]; then
    
  printf 'ERROR: packaged node-pty contains zero-length files:\n' >&2
    
  printf '  %s\n' "${node_pty_zero_files[@]}" >&2
    
  return 1
    
fi
    
[[ -x "$pkgdir/usr/lib/$pkgname/bin/orca-ide" ]] || {
    
  printf 'ERROR: packaged Orca CLI shim is missing\n' >&2
    
  return 1
    
}
    
[[ -f "$pkgdir/usr/lib/$pkgname/computer-use-linux/runtime.py" ]] || {
    
  printf 'ERROR: packaged Linux computer-use runtime is missing\n' >&2
    
  return 1
    
}
    
      345
    
# Upstream sherpa-onnx binaries may contain architecture-specific absolute
    
# CI paths in RPATH/RUNPATH. Keep only $ORIGIN-relative components without
    
# changing the ELF string-table size; an already-clean path is a no-op.
    
local sherpa
    
local sherpa_bins=()
    
mapfile -d '' sherpa_bins < <(
    
  find "$pkgdir/usr/lib/$pkgname" -type f -name 'sherpa-onnx.node' -print0
    
)
    
if [[ ${#sherpa_bins[@]} -eq 0 ]]; then
    
  printf 'ERROR: packaged sherpa-onnx native module is missing\n' >&2
    
  return 1
    
fi
    
for sherpa in "${sherpa_bins[@]}"; do
    
  python - "$sherpa" <<'PY'
    
      360from pathlib import Path
    
      361import os
    
      362import re
    
      363import subprocess
    
      364import sys
    
      365
    
      366path = Path(sys.argv[1])
    
      367result = subprocess.run(
    
  ["readelf", "-d", path],
    
  check=True,
    
  capture_output=True,
    
  text=True,
    
  env={**os.environ, "LC_ALL": "C"},
    
      373)
    
      374matches = re.findall(
    
  r"Library (?:rpath|runpath): \[(.*?)\]",
    
  result.stdout,
    
  flags=re.IGNORECASE,
    
      378)
    
      379if len(matches) != 1:
    
  raise SystemExit(
    
      f"expected one sherpa-onnx RPATH/RUNPATH, found {len(matches)}: {path}"
    
  )
    
      383
    
      384current = matches[0]
    
      385components = current.split(":")
    
      386kept = [
    
  component
    
  for component in components
    
  if component == "$ORIGIN" or component.startswith("$ORIGIN/")
    
      390]
    
      391if not kept:
    
  raise SystemExit(f"sherpa-onnx path has no $ORIGIN component: {path}: {current}")
    
      393
    
      394cleaned = ":".join(kept)
    
      395if current != cleaned:
    
  data = path.read_bytes()
    
  needle = current.encode() + b"\0"
    
  if data.count(needle) != 1:
    
      raise SystemExit(
    
          f"expected one sherpa-onnx path string, found {data.count(needle)}: {path}"
    
      )
    
  replacement = cleaned.encode() + b"\0" * (len(needle) - len(cleaned))
    
  path.write_bytes(data.replace(needle, replacement, 1))
    
      404PY
    
done
    
      406
    
install -Dm755 "$srcdir/stably-orca.sh" "$pkgdir/usr/bin/stably-orca"
    
install -Dm755 "$srcdir/orca-ide.sh" "$pkgdir/usr/bin/orca-ide"
    
install -Dm755 "$srcdir/stably-orca-serve-systemd" \
    
  "$pkgdir/usr/lib/$pkgname/stably-orca-serve-systemd"
    
install -Dm755 "$srcdir/stably-orca-kwin-display" \
    
  "$pkgdir/usr/lib/$pkgname/stably-orca-kwin-display"
    
install -Dm644 "$srcdir/stably-orca-serve@.service" \
    
  "$pkgdir/usr/lib/systemd/user/stably-orca-serve@.service"
    
install -Dm644 "$srcdir/stably-orca-kwin-virtual@.service" \
    
  "$pkgdir/usr/lib/systemd/user/stably-orca-kwin-virtual@.service"
    
install -Dm644 "$srcdir/stably-orca-serve.env.example" \
    
  "$pkgdir/usr/share/doc/$pkgname/stably-orca-serve.env.example"
    
install -Dm644 "$srcdir/stably-orca-serve-kwin.conf.example" \
    
  "$pkgdir/usr/share/doc/$pkgname/stably-orca-serve-kwin.conf.example"
    
install -Dm644 "$srcdir/stably-orca.desktop" \
    
  "$pkgdir/usr/share/applications/stably-orca.desktop"
    
python - resources/build/icon.png resources/icon.png <<'PY'
    
      424from pathlib import Path
    
      425import sys
    
      426
    
      427def check_png(path_str, expected_dims):
    
  path = Path(path_str)
    
  data = path.read_bytes()[:24]
    
  if data[:8] != b"\x89PNG\r\n\x1a\n" or data[12:16] != b"IHDR":
    
      raise SystemExit(f"Orca icon is not a valid PNG: {path}")
    
  dimensions = (
    
      int.from_bytes(data[16:20], "big"),
    
      int.from_bytes(data[20:24], "big"),
    
  )
    
  if dimensions != expected_dims:
    
      raise SystemExit(f"expected {expected_dims} Orca icon, found {dimensions}: {path}")
    
      438
    
      439check_png(sys.argv[1], (1024, 1024))
    
      440check_png(sys.argv[2], (256, 256))
    
      441PY
    
install -Dm644 resources/icon.png \
    
  "$pkgdir/usr/share/icons/hicolor/256x256/apps/stably-orca.png"
    
install -Dm644 resources/build/icon.png \
    
  "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/stably-orca.png"
    
install -Dm644 resources/icon.png \
    
  "$pkgdir/usr/share/pixmaps/stably-orca.png"
    
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      449
    
local empty_dirs=()
    
mapfile -d '' empty_dirs < <(find "$pkgdir" -type d -empty -print0)
    
if [[ ${#empty_dirs[@]} -ne 0 ]]; then
    
  printf 'ERROR: packaged tree contains empty directories:\n' >&2
    
  printf '  %s\n' "${empty_dirs[@]}" >&2
    
  return 1
    
fi
    
      457}
    
      458

Changes since previous scan

--- PKGBUILD @ 2026-09-14 05:16
+++ PKGBUILD @ 2026-09-15 07:19
@@ -1,7 +1,7 @@
 # Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
 
 pkgname=stably-orca
-pkgver=1.4.200
+pkgver=1.4.203
 pkgrel=1
 pkgdesc='Stably AI Orca agentic coding IDE and headless runtime (built from source)'
 arch=('x86_64' 'aarch64')
@@ -75,7 +75,7 @@
 source_aarch64=(
   "pnpm-exe-linux-arm64-$_pnpmver.tgz::https://registry.npmjs.org/@pnpm/exe.linux-arm64/-/exe.linux-arm64-$_pnpmver.tgz"
 )
-sha256sums=('212be0869ba03b3eb63a46fcce88bf84880c24ebffbf268ef92d8985a547c3ce'
+sha256sums=('4b775bf6f5bb85e0ef9abc37f2d01ea6a516a1502c2a973362827047dd968c1d'
             '5ef12ab545a211627c23f05eb589a051e6c207a3f2c3382add8f0573400b871d'
             'd76ba8a9856aa7181a41bccb1bb7a09b10cc990b0a6d680c328af75eb185c90d'
             '0d8e816f7dd5d46b9da40748ac7a0d709adfd7f09d79ffe71327b60c5c5abbb7'
@@ -136,9 +136,9 @@
 check_block = """    // Why: a Linux runner-image glibc bump silently shipped a node-pty pty.node
     // requiring GLIBC_2.34, crashing the app on startup on Ubuntu 20.04 (#9902).
     // Fail packaging if any bundled native binary exceeds the supported floor.
-    // Why after the prune: cross-builds intentionally install every optional
-    // native variant, so an arm64 slice still carries the x64 @parcel/watcher
-    // until prunePackagedRuntimeNodeModules drops it.
+    // Why after the prune: `pnpm install:release` widens the CPU set for cross-builds,
+    // so an arm64 slice can still carry the x64 @parcel/watcher until
+    // prunePackagedRuntimeNodeModules drops it.
     if (context.electronPlatformName === 'linux') {
       // Why the arch is passed: symbol-version checks pass happily on a wrong-architecture binary,
       // so a cross-built slice could ship the host's pty.node and only fail at runtime.

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 07:19:15	Medium	1
2026-09-14 05:16:15	Clean	0
2026-09-11 09:22:22	Clean	0
2026-09-09 21:20:09	Clean	0
2026-09-08 15:17:32	Clean	0
2026-09-04 07:57:01	Clean	0
2026-09-04 05:56:41	Clean	0
2026-09-03 05:52:26	Clean	0
2026-09-01 07:47:32	Clean	0
2026-08-31 13:45:31	Clean	0
2026-08-31 01:44:31	Clean	0
2026-08-27 05:31:50	Clean	0
2026-08-22 13:17:31	Clean	0
2026-08-21 11:15:01	Clean	0
2026-08-21 03:13:51	Clean	0
2026-08-19 11:41:55	Clean	0
2026-08-17 07:35:18	Clean	0
2026-08-15 07:30:18	Clean	0
2026-08-13 19:26:43	Clean	0
2026-08-12 05:22:53	Clean	0