aur-shield v0.1.0: AI-powered AUR firewall

- FastAPI server with scan/build/repo endpoints
- LLM scanner (Ollama) with regex pre-scan
- makepkg/devtools builder with chroot isolation
- Scan cache with TTL + PKGBUILD hash
- Client installer + safe-yay wrapper
- Docs + config example

install-client.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# AUR-Shield Client Installer
+# Configures pacman to use the AUR-Shield repo
+set -euo pipefail
+
+SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
+SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"
+
+echo "╔══════════════════════════════════════════════╗"
+echo "║        AUR-Shield Client Installer           ║"
+echo "╚══════════════════════════════════════════════╝"
+echo ""
+
+if ! command -v pacman &>/dev/null; then
+    echo "✗ This script requires Arch Linux (pacman)."
+    exit 1
+fi
+
+echo "Server: http://$SHIELD_HOST:$SHIELD_PORT"
+echo ""
+
+# Add pacman repo
+PACMAN_CONF="/etc/pacman.conf"
+REPO_ENTRY="[aur-shield]
+Server = http://$SHIELD_HOST:$SHIELD_PORT/repo
+SigLevel = Never"
+
+if grep -q "^\[aur-shield\]" "$PACMAN_CONF"; then
+    echo "⚠ [aur-shield] already exists in $PACMAN_CONF — skipping"
+else
+    echo "Adding [aur-shield] to $PACMAN_CONF..."
+    sudo tee -a "$PACMAN_CONF" > /dev/null << EOF
+
+# AUR-Shield — AI-scanned AUR packages
+$REPO_ENTRY
+EOF
+    echo "✓ Added repo entry"
+fi
+
+# Install safe-yay wrapper
+WRAPPER_PATH="/usr/local/bin/safe-yay"
+echo "Installing safe-yay wrapper to $WRAPPER_PATH..."
+
+sudo tee "$WRAPPER_PATH" > /dev/null << 'WRAPPER'
+#!/usr/bin/env bash
+# safe-yay — wrapper that routes AUR packages through AUR-Shield
+set -euo pipefail
+
+SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
+SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"
+
+if [ $# -eq 0 ]; then
+    echo "Usage: safe-yay <package> [package2 ...]"
+    echo "Scans and builds AUR packages through AUR-Shield"
+    exit 0
+fi
+
+for pkg in "$@"; do
+    echo "→ Processing $pkg..."
+    
+    # Call AUR-Shield to scan + build
+    RESPONSE=$(curl -sf "http://$SHIELD_HOST:$SHIELD_PORT/api/build/$pkg" 2>&1) || {
+        echo "✗ Failed to process $pkg"
+        echo "  $RESPONSE"
+        continue
+    }
+    
+    # Extract verdict
+    VERDICT=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('verdict','error'))" 2>/dev/null)
+    
+    case "$VERDICT" in
+        clean)
+            echo "  ✓ Clean — package built and added to repo"
+            ;;
+        suspicious)
+            echo "  ⚠ Suspicious — package built but review recommended"
+            echo "  Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
+            ;;
+        malicious)
+            echo "  ✗ MALICIOUS — package blocked!"
+            echo "  Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
+            continue
+            ;;
+        *)
+            echo "  ? Error: $RESPONSE"
+            continue
+            ;;
+    esac
+    
+    # Now install via pacman
+    echo "  Installing via pacman..."
+    sudo pacman -Sy "aur-shield/$pkg" || {
+        echo "  ⚠ Package not in repo yet — may need to wait for build"
+    }
+done
+
+echo "Done."
+WRAPPER
+
+sudo chmod +x "$WRAPPER_PATH"
+echo "✓ Installed safe-yay"
+
+echo ""
+echo "╔══════════════════════════════════════════════╗"
+echo "║  Client setup complete!                      ║"
+echo "╠══════════════════════════════════════════════╣"
+echo "║                                              ║"
+echo "║  Usage:                                      ║"
+echo "║    safe-yay <package>                         ║"
+echo "║    sudo pacman -S aur-shield/<package>        ║"
+echo "║                                              ║"
+echo "║  Set server via env:                         ║"
+echo "║    export AUR_SHIELD_HOST=10.90.9.102        ║"
+echo "║    export AUR_SHIELD_PORT=8443               ║"
+echo "║                                              ║"
+echo "╚══════════════════════════════════════════════╝"