wish-agent

LOW

maintainer windust 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package builds from source hosted on the maintainer's GitHub repositories with SKIP'd checksums, but the code is openly auditable and no remote execution or untrusted prebuilt binaries are involved; the low severity is due to weak verification, not malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the maintainer's GitHub repositories with SKIP'd checksums, but the code is openly auditable and no remote execution or untrusted prebuilt binaries are involved; the low severity is due to weak verification, not malicious behavior.

PKGBUILD

      1# Maintainer: WindustH <windusth2006@gmail.com>
    
      2
    
      3pkgname=wish-agent
    
      4pkgver=0.1.3
    
      5pkgrel=1
    
      6pkgdesc="Self-hosted AI agent server and web app: long-lived sessions, shell tools and many model providers"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/WindustH/wish-core"
    
      9license=('MIT')
    
      10depends=('glibc' 'libgcc')
    
      11# The web app's build fetches its pinned packages and fonts, and subsets the fonts.
    
      12makedepends=('git' 'cargo' 'nodejs' 'corepack' 'python' 'python-fonttools' 'python-brotli' 'python-numpy' '7zip')
    
      13conflicts=("$pkgname-bin" "$pkgname-git" 'tk')
    
      14options=('!lto' '!debug')
    
      15source=("wish-core::git+https://github.com/WindustH/wish-core.git#tag=v$pkgver"
    
      16        "wish-web::git+https://github.com/WindustH/wish-web.git#tag=v$pkgver"
    
      17        "wish-agent.service")
    
      18sha256sums=('SKIP'
    
      19            'SKIP'
    
      20            '932ff80ab90865dbeb39168c36293738af32ec5f197c7630930d0a54c2bac0d0')
    
      21
    
      22prepare() {
    
      23  cd wish-web
    
      24  ./pnpmw install --frozen-lockfile
    
      25  # Downloads the pinned fonts into .cache; the build reuses them.
    
      26  python3 tools/fonts.py
    
      27  cd ../wish-core
    
      28  export RUSTUP_TOOLCHAIN=stable
    
      29  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      30}
    
      31
    
      32build() {
    
      33  cd wish-web
    
      34  ./pnpmw build
    
      35  cd ../wish-core
    
      36  export RUSTUP_TOOLCHAIN=stable
    
      37  export CARGO_TARGET_DIR=target
    
      38  cargo build --frozen --release
    
      39}
    
      40
    
      41package() {
    
      42  # The program finds its web app beside it; /usr/bin holds a link. Tk's `wish` is the same path.
    
      43  install -Dm755 wish-core/target/release/wish "$pkgdir/usr/lib/$pkgname/wish"
    
      44  cp -r wish-web/dist "$pkgdir/usr/lib/$pkgname/web"
    
      45  install -dm755 "$pkgdir/usr/bin"
    
      46  ln -s "/usr/lib/$pkgname/wish" "$pkgdir/usr/bin/wish"
    
      47  install -Dm644 wish-agent.service "$pkgdir/usr/lib/systemd/user/wish-agent.service"
    
      48  install -Dm644 wish-core/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      49  install -Dm644 wish-core/README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Low	2