thinkrail

LOW

maintainer jinzhongjia 0 votes scanned 2026-11-05 08:08:21.407183

View on AUR

Why flagged

The package builds from source hosted on GitHub and uses prebuilt runtimes (Electrobun, Bun) from trusted upstream GitHub releases; no untrusted remote code execution or obfuscated payloads are present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and uses prebuilt runtimes (Electrobun, Bun) from trusted upstream GitHub releases; no untrusted remote code execution or obfuscated payloads are present.

PKGBUILD

      1# Maintainer: jinzhongjia <mail@nvimer.org>
    
      2
    
      3pkgname=thinkrail
    
      4pkgver=0.3.1
    
      5pkgrel=1
    
      6pkgdesc="Lightweight IDE for vibe coding with the pi agent (desktop app and browser-based CLI)"
    
      7arch=('x86_64')
    
      8url="https://github.com/JetBrains/thinkrail"
    
      9license=('Apache-2.0')
    
      10depends=('cairo' 'gcc-libs' 'gdk-pixbuf2' 'git' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'icu'
    
      11         'libayatana-appindicator' 'librsvg' 'libsoup3' 'libx11' 'webkit2gtk-4.1')
    
      12optdepends=('xdg-utils: open the browser when launching the CLI'
    
      13            'xorg-xwayland: run the desktop app on Wayland, it only speaks X11'
    
      14            'ripgrep: otherwise pi downloads its own copy on first use'
    
      15            'fd: otherwise pi downloads its own copy on first use')
    
      16makedepends=('bun' 'patch')
    
      17conflicts=('thinkrail-bin')
    
      18# bun --compile appends the app to the runtime executable; strip would drop it.
    
      19# The desktop shell is upstream's prebuilt Electrobun and Bun runtime.
    
      20options=('!strip' '!debug')
    
      21_commit=344aafcb0b56902e5fc87834059a353d54ca8892
    
      22# Keep in sync with apps/desktop/package.json and electrobun.config.ts. Hutch
    
      23# fetches these itself; build() fails unless what it used matches these files.
    
      24_electrobun=2.0.5
    
      25_bun=1.4.4
    
      26source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      27        'pacman-managed.patch'
    
      28        'thinkrail-desktop.sh'
    
      29        'thinkrail.desktop')
    
      30source_x86_64=("electrobun-core-$_electrobun-x64.tar.gz::https://github.com/blackboardsh/electrobun/releases/download/v$_electrobun/electrobun-core-linux-x64.tar.gz"
    
      31               "bun-$_bun-x64.zip::https://github.com/oven-sh/bun/releases/download/bun-v$_bun/bun-linux-x64.zip")
    
      32noextract=("electrobun-core-$_electrobun-x64.tar.gz")
    
      33sha256sums=('0bd685864897c890f04d187884c5425125af70d86b70d9c2bcf99a7d8d43a8a2'
    
      34            '2836733fdb5683f8f1392e6871806aee1696d97444ac8bfe9249f433e6db6527'
    
      35            '2ce0adca5eb6d555e04f373cae485b106aefffbe4afa879e2a02021039d24cca'
    
      36            '76914be37000accd42d9702442cedd5a3b2a75ecca0dc1e1cc65c2e373577d2a')
    
      37sha256sums_x86_64=('29deec8eb7f8a017f786f95816bccccd91f514e57ea14868e4b97bd409268e88'
    
      38                   'bf8ccbfb2b0b80159e0f9a6d15c55317add8077534dbc6130a3edb52fccb395c')
    
      39
    
      40prepare() {
    
      41    mkdir -p electrobun-core
    
      42    bsdtar -xf "electrobun-core-$_electrobun-x64.tar.gz" -C electrobun-core
    
      43
    
      44    cd "$pkgname-$pkgver"
    
      45    local _upstream
    
      46    _upstream="$(bun -p "require('./apps/desktop/package.json').devDependencies.electrobun")"
    
      47    if [[ "$_upstream" != "$_electrobun" ]]; then
    
      48        error "upstream pins electrobun $_upstream, PKGBUILD has $_electrobun"
    
      49        return 1
    
      50    fi
    
      51    if ! grep -q "version: \"$_bun\"" apps/desktop/electrobun.config.ts; then
    
      52        error "upstream's desktop Bun runtime is no longer $_bun"
    
      53        return 1
    
      54    fi
    
      55    # Pacman owns the installed files: drop the CLI's `update` and `uninstall`,
    
      56    # and the desktop updater's base URL, which turns the updater off.
    
      57    patch -Np1 -i "$srcdir/pacman-managed.patch"
    
      58    # Upstream's release CI overwrites this module. The "dev" channel keeps the
    
      59    # CLI's update notice off, and the empty analytics key never reports usage.
    
      60    cat > packages/shared/src/version.ts <<STAMP
    
      61export const version = "$pkgver";
    
      62export const channel = "dev";
    
      63export const commit = "${_commit:0:9}";
    
      64export const posthogProjectKey = "";
    
      65STAMP
    
      66    export BUN_INSTALL_CACHE_DIR="$srcdir/.bun-cache"
    
      67    HUSKY=0 bun install --frozen-lockfile
    
      68}
    
      69
    
      70build() {
    
      71    cd "$pkgname-$pkgver"
    
      72    export BUN_INSTALL_CACHE_DIR="$srcdir/.bun-cache"
    
      73    export TURBO_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1
    
      74    bun run build:web
    
      75    bun apps/cli/scripts/build-binary.ts
    
      76
    
      77    # Keep Hutch's toolchain cache out of $HOME.
    
      78    HOME="$srcdir/.home" XDG_CACHE_HOME="$srcdir/.home/.cache" HUTCH_HOME="$srcdir/.hutch" \
    
      79        bun run --cwd apps/desktop package:stable
    
      80
    
      81    # The stable build is a self-extractor that unpacks into $HOME on first
    
      82    # run; only its inner tree belongs in /usr/lib.
    
      83    rm -rf "$srcdir/desktop"
    
      84    mkdir "$srcdir/desktop"
    
      85    bsdtar -xf apps/desktop/build/stable-linux-x64/ThinkRail/Resources/*.tar.zst -C "$srcdir/desktop"
    
      86
    
      87    local _bin="$srcdir/desktop/ThinkRail/bin" _f
    
      88    for _f in launcher libElectrobunCore.so libNativeWrapper.so libasar.so; do
    
      89        cmp "$_bin/$_f" "$srcdir/electrobun-core/$_f"
    
      90    done
    
      91    cmp "$_bin/bun" "$srcdir/bun-linux-x64/bun"
    
      92}
    
      93
    
      94check() {
    
      95    cd "$pkgname-$pkgver/apps/cli"
    
      96    HOME="$srcdir/check-home" bun test
    
      97}
    
      98
    
      99package() {
    
      100    cd "$pkgname-$pkgver"
    
      101    install -Dm755 apps/cli/dist/thinkrail "$pkgdir/usr/bin/thinkrail"
    
      102    install -Dm755 "$srcdir/thinkrail-desktop.sh" "$pkgdir/usr/bin/thinkrail-desktop"
    
      103
    
      104    local _app="$srcdir/desktop/ThinkRail"
    
      105    # Only the self-updater and uninstaller use these.
    
      106    rm -f "$_app/Resources/uninstall" "$_app/bin/bspatch" "$_app/bin/zig-zstd"
    
      107    install -d "$pkgdir/usr/lib/thinkrail"
    
      108    cp -r --no-preserve=ownership "$_app/bin" "$_app/Resources" "$pkgdir/usr/lib/thinkrail/"
    
      109
    
      110    install -Dm644 "$srcdir/thinkrail.desktop" "$pkgdir/usr/share/applications/thinkrail.desktop"
    
      111    install -Dm644 packages/shared/assets/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/thinkrail.png"
    
      112    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      113}
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 08:08:21	Low	2