zcode-cli
LOW
maintainer rcdfrd
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
Package builds from verifiable upstream source, uses frozen dependencies, and installs only JavaScript files; low risk despite untrusted host due to non-executable payload and no remote code execution.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from verifiable upstream source, uses frozen dependencies, and installs only JavaScript files; low risk despite untrusted host due to non-executable payload and no remote code execution.
PKGBUILD
1
# Maintainer: rcdfrd <rcdfrd@gmail.com>
2
#
3
# 开源版 ZCode：从 zai-org/ZCode 源码构建命令行 TUI 与 Web 工作台。
4
# 与 AUR 上基于官方 Linux 二进制的 zcode / z-code-bin / zcode-bin 等包不同，
5
# 本包只使用上游 Apache-2.0 源码，产物为 `zcode` 命令（无参数进入 TUI，`--web` 启动 Web）。
6
7
pkgname=zcode-cli
8
pkgver=3.15.1
9
pkgrel=1
10
pkgdesc="ZCode open-source AI coding workbench (TUI + Web) built from source"
11
arch=('x86_64' 'aarch64')
12
url="https://github.com/zai-org/ZCode"
13
license=('Apache-2.0')
14
# 发行包本身是 JS，运行仍需 Node.js；上游 mise.toml 固定 Node 24，已在 24/26 上验证。
15
depends=('nodejs')
16
makedepends=('pnpm')
17
# 提供同名命令，与安装 /usr/bin/zcode 的桌面端包互斥。
18
conflicts=('zcode' 'zcode-bin' 'z-code-bin' 'zcode-desktop-bin' 'zcode-ce-bin' 'zcode-pro' 'zcode-redminote11tech')
19
options=('!strip' '!debug')
20
source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
21
sha256sums=('dfab1f9fdf0d454d8fbeceae2d5454af4e4db248f74029e3a1821b1deb343139')
22
23
# build:zcode 生成的 install.sh 只用于自更新索引，这里填入上游 release 地址作为占位。
24
_dist_base_url="${url}/releases/download/v${pkgver}/"
25
26
build() {
27
cd "ZCode-${pkgver}"
28
29
# 避免 husky 在非 git 目录里执行 prepare 钩子。
30
export HUSKY=0
31
export CI=1
32
# node-gyp 默认把 Node 头文件解到 /tmp；构建机 /tmp 常为 tmpfs，空间不足会直接失败。
33
export TMPDIR="${srcdir}/tmp"
34
mkdir -p "${TMPDIR}"
35
36
# 发行所需的 node-pty / sharp / koffi 等原生依赖都由上游预编译包提供，
37
# 不需要在本机重新编译；跳过 install script 也能避免拉取 Electron 运行时。
38
pnpm install --frozen-lockfile --ignore-scripts
39
40
# 根 packages/shared 没有 build script，但 TUI runtime 收集阶段要求它的 dist 产物；
41
# 上游 build:zcode 不会自行编译它，缺这一步会在 stageTuiRuntime 直接失败。
42
pnpm exec tsc -b packages/shared
43
44
pnpm --filter "@zcode/cli..." build
45
pnpm --filter "@zcode/server..." build
46
pnpm --filter "@zcode/web..." build
47
48
pnpm build:zcode --skip-build --base-url "${_dist_base_url}" --out-dir dist/zcode
49
}
50
51
check() {
52
cd "ZCode-${pkgver}"
53
54
local _check_dir="${srcdir}/zcode-check"
55
rm -rf "${_check_dir}"
56
mkdir -p "${_check_dir}"
57
tar -xzf "dist/zcode/releases/${pkgver}/zcode-${pkgver}.tar.gz" -C "${_check_dir}"
58
59
node "${_check_dir}/zcode/bin/zcode.mjs" --version
60
node "${_check_dir}/zcode/bin/zcode.mjs" --web --help
61
}
62
63
package() {
64
cd "ZCode-${pkgver}"
65
66
local _stage_dir="${srcdir}/zcode-stage"
67
rm -rf "${_stage_dir}"
68
mkdir -p "${_stage_dir}"
69
tar -xzf "dist/zcode/releases/${pkgver}/zcode-${pkgver}.tar.gz" -C "${_stage_dir}"
70
71
install -dm755 "${pkgdir}/usr/lib" "${pkgdir}/usr/bin"
72
cp -a "${_stage_dir}/zcode" "${pkgdir}/usr/lib/zcode"
73
74
# bin/zcode.mjs 自带 `#!/usr/bin/env node`，软链即可作为 /usr/bin/zcode 使用。
75
ln -s /usr/lib/zcode/bin/zcode.mjs "${pkgdir}/usr/bin/zcode"
76
ln -s /usr/lib/zcode/bin/zcode.mjs "${pkgdir}/usr/bin/zcode-cli"
77
78
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
79
install -Dm644 NOTICE.md "${pkgdir}/usr/share/licenses/${pkgname}/NOTICE.md"
80
install -Dm644 THIRD-PARTY-NOTICES.md \
81
"${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY-NOTICES.md"
82
}
83
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 11:10:32 | Low | 2 |