How do I install the Fresh Upstream skill?

Run npx skillmds@latest add patrickjaja/fresh-upstream in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fresh Upstream safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fresh Upstream?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fresh Upstream free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fresh Upstream?

patrickjaja (@patrickjaja) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fresh Upstream by patrickjaja — Agent Skill

Name: Fresh Upstream
Author: patrickjaja

Fresh Upstream

For claude-desktop-extra - wipe any existing extracted Claude Desktop bundles and extract a fresh, CLEAN, UNPATCHED copy of the latest official Claude Desktop Linux .deb into ./tmp/ for patch analysis. Fetches + GPG/SHA256-verifies the latest .deb if missing or stale, then extracts app.asar via asar (NOT the build script, which applies patches).

patrickjaja b509afc 3.5 KB Updated Sep 17, 2026

File contents

Fresh upstream extract (clean, unpatched)

Goal: a pristine unpatched bundle in ./tmp/ so patch work compares against the true upstream. Run from the repo root. ./tmp/ is gitignored.

Critical: scripts/build-patched-tarball.sh runs apply_patches.py - its output is PATCHED. For a clean baseline use the manual fetch + asar flow below.

Steps

cd to the repo and read tracked version:

cd "$(git rev-parse --show-toplevel)"
cat .upstream-version

Resolve latest upstream version (GPG + SHA256-verified via the canonical fetcher):
```
LATEST_VERSION=$(.github/scripts/apt-fetch-verify.sh poll)
echo "upstream latest: $LATEST_VERSION"
```
Report latest vs .upstream-version so the user sees whether this is a new version.
Download + verify the official .deb if missing or stale. apt-fetch-verify.sh download resolves the highest amd64 version, downloads the .deb into ./tmp/, and verifies its SHA256 against the signed Packages index (which is itself verified against the GPG-signed Release):
```
mkdir -p ./tmp
DEB=$(.github/scripts/apt-fetch-verify.sh download amd64 ./tmp)
echo "verified .deb: $DEB"
```
(~150MB.) If the download or verification fails, stop and report - do NOT trust an unverified .deb.
Wipe old extracted bundles (project-local only - never touch ~/.config/Claude):
```
rm -rf ./tmp/extract ./tmp/app.asar.contents ./extract ./build/work 2>/dev/null || true
```
Leave the freshly downloaded ./tmp/claude-desktop_*_amd64.deb in place and leave ./build/ packages alone unless the user asked for a full clean.
Extract clean, unpatched to ./tmp/. Crack the .deb (dpkg-deb -x, or ar + tar if dpkg-deb is unavailable), then asar extract the app.asar:
```
dpkg-deb -x "$DEB" ./tmp/extract
asar extract ./tmp/extract/usr/lib/claude-desktop/resources/app.asar ./tmp/app.asar.contents
```
- Unpatched main bundle: ./tmp/app.asar.contents/.vite/build/index.js
- Renderer bundles: ./tmp/app.asar.contents/.vite/renderer/*/assets/*.js
- ion-dist (3P-config SPA): ./tmp/extract/usr/lib/claude-desktop/resources/ion-dist/
- i18n: ./tmp/extract/usr/lib/claude-desktop/resources/*.json
Sanity check and report:
```
node --check ./tmp/app.asar.contents/.vite/build/index.js && echo "OK: clean unpatched index.js parses"
ls -la ./tmp/app.asar.contents/.vite/build/
```
Report: upstream version extracted, where the unpatched index.js is, whether it's a new version vs .upstream-version. If new, suggest /update. If just refreshing for analysis, suggest /audit.

Notes

This does NOT patch, build, or bump anything - it only stages a clean bundle.
Distinguish "clean unpatched" (this skill, manual .deb crack + asar) from "patched build" (./scripts/build-local.sh).
The official .deb bundles Electron 42.5.1 and prebuilt node-pty for both arches - we do not self-manage either.
Stale extracts have different minified names → always re-extract before patch debugging if ./tmp is older than today.

---name: fresh-upstreamdescription: For claude-desktop-extra - wipe any existing extracted Claude Desktop bundles and extract a fresh, CLEAN, UNPATCHED copy of the latest official Claude Desktop Linux .deb into ./tmp/ for patch analysis. Fetches + GPG/SHA256-verifies the latest .deb if missing or stale, then extracts app.asar via asar (NOT the build script, which applies patches).---# Fresh upstream extract (clean, unpatched)Goal: a pristine unpatched bundle in `./tmp/` so patch work compares against the true upstream. Run from the repo root. `./tmp/` is gitignored.**Critical:** `scripts/build-patched-tarball.sh` runs `apply_patches.py` - its output is PATCHED. For a clean baseline use the manual fetch + `asar` flow below.## Steps1. **cd to the repo** and read tracked version: ```bash cd "$(git rev-parse --show-toplevel)" cat .upstream-version ```2. **Resolve latest upstream** version (GPG + SHA256-verified via the canonical fetcher): ```bash LATEST_VERSION=$(.github/scripts/apt-fetch-verify.sh poll) echo "upstream latest: $LATEST_VERSION" ``` Report latest vs `.upstream-version` so the user sees whether this is a new version.3. **Download + verify the official .deb if missing or stale.** `apt-fetch-verify.sh download` resolves the highest amd64 version, downloads the `.deb` into `./tmp/`, and verifies its SHA256 against the signed Packages index (which is itself verified against the GPG-signed Release): ```bash mkdir -p ./tmp DEB=$(.github/scripts/apt-fetch-verify.sh download amd64 ./tmp) echo "verified .deb: $DEB" ``` (~150MB.) If the download or verification fails, stop and report - do NOT trust an unverified `.deb`.4. **Wipe old extracted bundles** (project-local only - never touch ~/.config/Claude): ```bash rm -rf ./tmp/extract ./tmp/app.asar.contents ./extract ./build/work 2>/dev/null || true ``` Leave the freshly downloaded `./tmp/claude-desktop_*_amd64.deb` in place and leave `./build/` packages alone unless the user asked for a full clean.5. **Extract clean, unpatched** to `./tmp/`. Crack the `.deb` (`dpkg-deb -x`, or `ar` + `tar` if `dpkg-deb` is unavailable), then `asar extract` the app.asar: ```bash dpkg-deb -x "$DEB" ./tmp/extract asar extract ./tmp/extract/usr/lib/claude-desktop/resources/app.asar ./tmp/app.asar.contents ``` - Unpatched main bundle: `./tmp/app.asar.contents/.vite/build/index.js` - Renderer bundles: `./tmp/app.asar.contents/.vite/renderer/*/assets/*.js` - ion-dist (3P-config SPA): `./tmp/extract/usr/lib/claude-desktop/resources/ion-dist/` - i18n: `./tmp/extract/usr/lib/claude-desktop/resources/*.json`6. **Sanity check** and report: ```bash node --check ./tmp/app.asar.contents/.vite/build/index.js && echo "OK: clean unpatched index.js parses" ls -la ./tmp/app.asar.contents/.vite/build/ ``` Report: upstream version extracted, where the unpatched index.js is, whether it's a new version vs `.upstream-version`. If new, suggest `/update`. If just refreshing for analysis, suggest `/audit`.## Notes- This does NOT patch, build, or bump anything - it only stages a clean bundle.- Distinguish "clean unpatched" (this skill, manual .deb crack + asar) from "patched build" (`./scripts/build-local.sh`).- The official `.deb` bundles Electron 42.5.1 and prebuilt node-pty for both arches - we do not self-manage either.- Stale extracts have different minified names → always re-extract before patch debugging if `./tmp` is older than today.

Frequently asked questions