- Queries /api/status for scan_only flag
- Scan-only: no [aur-shield] in pacman.conf, removes stale entry if present
- Full mode: adds/updates repo as before
- No more pacman sync errors when LAN server is offline
Server:
- config: server.scan_only flag (default: false)
- /api/build returns scan_only=true without building when enabled
- /api/status reports scan_only mode
Client (safe-yay):
- Detects server scan_only from API response
- Scan-only server: builds locally with yay/paru after clean scan
- Full server: installs from pacman repo as before
- --noinstall flag for scan-only without build (was --scan-only)
- Suspicious: prompts for local build or repo install depending on server mode
Server setup, client install, all commands (safe-yay, -Syu,
--check-installed, --scan-only, --doctor), API usage, model
switching, troubleshooting, exit codes with script examples.
- Installer writes /etc/safe-yay.conf with SHIELD_HOST/SHIELD_PORT
- safe-yay sources /etc/safe-yay.conf at startup (overrides defaults)
- No more env-var juggling needed
- safe-yay -Syu: scans AUR updates through AUR-Shield before installing,
blocks malicious updates, prompts for suspicious ones
- safe-yay --check-installed: checks all installed AUR packages (pacman -Qmq)
against IOC lists — like archcanary's installed-package scan
- Both use exit codes: 0=clean, 1=warning, 2=malicious
Extended IOC sources (from archcanary):
- aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner)
- Community reports list (community-curated malicious packages)
- CHAOS RAT campaign list (backdoor payload)
- Russian spam campaign list (.bashrc injection)
Client features (archcanary-inspired):
- Exit codes: 0=clean, 1=warning, 2=malicious (scriptable)
- --doctor health check (server, ollama, repo status)
- --scan-only mode (scan without building)
- IOC match display in malicious blocks
- Suspicious packages: interactive install prompt
All IOC fetches run concurrently for speed.
arch_agent