Add slap-notes-bin - #282
Open
Onefailatatime wants to merge 4 commits into
Open
Conversation
Local-first block notes with a wiki-link graph and a built-in AI research agent. Electron over a Next.js server, x86_64. Not in the AUR - it follows its own GitHub release feed, so it carries an .omarchy/upstream.sh that reads the tag and checksum from SHA256SUMS published beside each release. Nothing has to be downloaded to hash. Dependencies are derived from ldd against the shipped binary.
The package symlinked /usr/bin/slap-notes straight at the Electron binary and installed upstream's desktop entry verbatim, whose Exec pointed into /opt. Both paths left Chromium's own Ozone detection to decide the platform, and it falls back to XWayland often enough that the window is blurry on every scaled display. A launcher asks for Wayland directly, the way t3code-bin and perplexity do, and reads ~/.config/slap-notes-flags.conf; the desktop entry's Exec is rewritten to go through it. .omarchy/upstream.sh reported its checksum under the "x86_64" key while the PKGBUILD carried a single unsuffixed sha256sums, so bin/sync-upstream looked for a sha256sums_x86_64 that was not there and failed the whole run: ✗ Expected exactly one sha256sums_x86_64 assignment in .../PKGBUILD ✗ Upstream sync completed with failures Every six-hourly sync would have failed that way. The vendor tarball now lives in source_x86_64/sha256sums_x86_64, which is both what the hook reports and what keeps the launcher's own checksum out of the array being rewritten. libnotify and libsecret are opened by name at runtime rather than linked, so nothing else in depends pulled them in -- notifications and Electron's encrypted storage were relying on them happening to be installed. The sandbox helper is set 4755 in package(), as Arch ships Chromium's and Electron's, instead of having post_install probe for user namespaces and chmod the file out from under pacman's manifest. That leaves the install script with its first-run message, and drops the AppArmor profile handling: it was carried over from the Debian package and Arch does not enable AppArmor. url= pointed at slapnotes.com, whose apex serves no HTTPS, and now points at the repository the release feed is read from. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
0.2.3 is the first release whose in-app updater leaves a packaged install to the package manager. Earlier builds downloaded the release's own package and ran pkexec pacman -U on it, which on a machine tracking this repository would have put down an artifact the repository never built and left the local version ahead of the channel. The release no longer attaches a built package either, so the tarball this PKGBUILD compiles is the only thing it can be. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Author
|
Worth flagging for review, since a bundled self-updater is a fair thing to ask about. Through 0.2.2 the app's own updater would download the release's package and As of 0.2.3 a copy under The PKGBUILD now pins 0.2.3, and |
The apex serves HTTPS now; it was on a parking IP with 443 closed when this was opened, so the homepage hung and the repository URL stood in. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds slap-notes-bin — local-first block notes with a wiki-link graph (the
Cluster Brain) and a built-in AI research agent. Electron over a Next.js
server, x86_64 only.
DHH suggested opening this here, so here it is.
How it tracks versions
Not in the AUR — it follows its own GitHub release feed, so it carries an
.omarchy/upstream.shmodelled ont3code-bin.SHA256SUMSis publishedbeside every release, so the hook reads the tag and the checksum straight from
the feed and nothing has to be downloaded to hash. It returns
{}when thePKGBUILD is already current, and stops with an error rather than pinning a
checksum for an asset that doesn't exist.
.omarchy/package.jsonis{"source": "local", "release_ring": "fast"}.Dependencies
Derived from
lddagainst the shipped binary rather than copied from anotherElectron package — the earlier hand-written list named
libxssandlibnotify, which it doesn't link, and omittedat-spi2-core,libcups,libdrm,mesa,libxkbcommon,pangoandcairo, which it does. It wouldhave failed to start on a minimal install.
Worth flagging
It's proprietary and closed-source — the licence is
custom:proprietaryand the app source isn't public. Only the built artefacts and the installer
are. I see
cursor-binandlmstudio-binare in the same position, but saythe word if that's a problem for the OPR and I'll take it elsewhere.
The app is free to use and needs no account. AI Research is bring-your-own-key
(Anthropic, OpenAI, Google, Groq or OpenRouter) — nothing is proxied, keys stay
on the device, and every other feature works without one.
Checks
upstream.shtested both ways:{}when current, and correctpkgver+sha256sumswhen a newer release exists, matching the publishedSHA256SUMSsha256sumsin the PKGBUILD matches the published 0.2.2 tarball