One issue found: the librefang-desktop-bin PKGBUILD hardcodes data.tar.gz when extracting the .deb, which will silently break for any release whose Debian package uses data.tar.xz or data.tar.zst (both are common from Tauri). See the inline comment on line 28 for the safer glob-based pattern.

The other two packages (librefang-bin and librefang-docker) look correct.

Generated by Claude Code

Thanks for the AUR packaging work.
The native librefang-bin service looks correct — it binds loopback by default, so it boots cleanly and isn't network-exposed.
Two issues on the librefang-docker side, the first a blocker.

Blocker: librefang-docker cannot start out of the box

The helper always passes --env "LIBREFANG_LISTEN=0.0.0.0:4545" (the docker_args array in packaging/aur/librefang-docker/librefang-docker), which is required for --publish to reach the process inside the container.
But a fresh librefang-data volume has no auth configured, and LIBREFANG_ALLOW_NO_AUTH=1 is left commented out in librefang-docker.env.

At boot, LIBREFANG_LISTEN overrides config.api_listen (crates/librefang-kernel/src/kernel/boot.rs:47-48), and then check_bind_auth_safety refuses to start on a non-loopback bind when no auth is configured and the operator has not opted in (crates/librefang-api/src/server.rs:1812-1813, decision logic in evaluate_bind_auth_safety at server.rs:280-302).
The daemon exits non-zero.

So systemctl enable --now librefang-docker.service — exactly what librefang-docker.install tells the user to run — fails immediately, and Restart=on-failure + RestartSec=5 in librefang-docker.service turns it into a crash loop that re-runs docker pull every five seconds.
The package never comes up on a default install.

The only documented escape, uncommenting LIBREFANG_ALLOW_NO_AUTH=1, then makes it boot but exposes an unauthenticated admin API (shell-exec, vault, LLM keys) on the host's 0.0.0.0:4545, reachable from the whole LAN.

Note one constraint when fixing this: binding loopback inside the container (e.g. LIBREFANG_LISTEN=127.0.0.1:4545) does not help, because Docker port publishing forwards into the container's network namespace and a process bound to the container's loopback is unreachable through the published port.
The working safe pattern is to keep the container bound to 0.0.0.0:4545, set LIBREFANG_ALLOW_NO_AUTH=1 by default so the daemon boots, and publish only to the host loopback — --publish 127.0.0.1:${PORT}:4545.
That matches the native package's loopback-only posture: it works out of the box and the open admin API is reachable only from the host, not the LAN.
If you prefer a fully authenticated default instead, the package needs to provision an api_key (or dashboard credentials) on first run rather than leaving auth empty.

Minor: LIBREFANG_MODEL is a no-op env var

librefang-docker.env documents # LIBREFANG_MODEL= and the helper forwards it via append_env_if_set LIBREFANG_MODEL, but nothing in the codebase reads LIBREFANG_MODEL — there are no occurrences outside packaging/aur/, and there is no generic LIBREFANG_-prefixed env-to-config mapping.
Setting it silently does nothing, which is misleading sitting next to OPENAI_API_KEY / ANTHROPIC_API_KEY / GROQ_API_KEY, which are genuinely read through each driver's api_key_env.
Please drop it from both the env file and the forwarding list, or point users at the real surface (config.toml / agent.toml).

Both blockers from the previous review are resolved in 43bb0ac0. Thanks for the quick turnaround.

• data.tar.gz hardcode → fixed. librefang-desktop-bin/PKGBUILD now globs data.tar.* and extracts with bsdtar --no-same-owner, so .gz / .xz / .zst Debian payloads all work. bsdtar ships with libarchive (a base dependency), so no new depends entry is needed.
• librefang-docker unauthenticated network exposure → fixed. --publish is now 127.0.0.1:${PORT}:4545, so the daemon is reachable only from host loopback; the in-container LIBREFANG_LISTEN=0.0.0.0:4545 is just the bind needed for the published port to reach the process. First-run boot is handled — librefang-docker.env ships LIBREFANG_ALLOW_NO_AUTH=1 and the helper forwards it, so a fresh librefang-data volume starts cleanly.

One optional, non-blocking note for later: the daemon is still unauthenticated, just confined to host loopback — anyone with a local shell on the host can reach it. Fine for a single-user box; a one-line mention in the env comment / README pointing at how to enable auth would be a nice touch, but it doesn't gate this PR.

Approving.