Shelly ALPM v3.2.1 adds Shelly-TUI, a brand-new terminal interface for installing, removing, and updating packages. The text-based UI is led by contributor VinnyQF and marks Shelly's third way to use the tool, joining its existing GTK4 app and command-line client. Alongside the release, the project keeps pushing RLPM, a from-scratch Zig rewrite of libalpm that brings security-conscious design but remains work in progress. As CachyOS's default package manager since April 2026, Shelly reaches far beyond hobbyist forums, making this update notably impactful for Arch Linux users.
It does the expected stuff first. Browse packages, filter what's installed, spot the differences between versions. Then comes the more useful, and more dangerous, part: batch-install or batch-remove across your system, the AUR, and Flatpak all at once. AUR PKGBUILDs get previews, reviews, diffs, and security scans before you commit to them.
Keep in mind that it also hardens authentication. Rather than leaning on askpass, it spins up a private sudo PTY and won't let you quit mid-operation. That's the whole point. A package transaction is exactly the moment you don't want interrupted.
The project's reception has never been tidy. Shelly is opinionated, and it reaches users who never opted in, which tends to generate opinions. A recurring sentiment on r/cachyos runs along the lines of: don't bother, it's for people allergic to the terminal. That crowd would argue pacman plus an AUR helper and three keystrokes beats any GUI. The GitHub repo itself sits at roughly 1,258 stars and 106 forks, which says more about its reach than its controversy.
On the other side, 9to5Linux and Linux Today called Shelly "a very good candidate" to become Arch's default package-management interface. Some users say it beats Pamac for search and install, and gets everyday jobs done without the usual friction.
For the rest of v3.2.1, it's mostly background noise: Polish, Portuguese, and French translation updates, plus performance fixes that skip redundant update scans. Head here for the full release notes if you want the complete changelog.
The engineering choices are genuine, not marketing copy. RLPM reads repository databases straight into in-memory SQLite, sidestepping the disk extraction step. It detects your CPU's architecture tier and runs at the highest microarch it supports. Archives get copied into a sealed in-memory file before signature checking, a move aimed at fighting TOCTOU attacks. Hooks run inside their own network namespace by default, with filesystem work confined via openat2.
It's arguably one of the more security-aware package managers being built right now. It's also unfinished. RLPM shipped in v3.1.7 on October 15, and its first prebuilt binary came out with a linking bug that left sqlite3_open_v2 unresolved, effectively killing RLPM until v3.1.8 landed three days later just to fix it.
You can switch backends on the fly. Run shelly config set NativePackageBackend rlpm or libalpm, and the change takes effect on the next command with no migration step required.
Shelly ALPM v3.2.1 adds a terminal interface and keeps pushing its Zig bet
Shelly, the native Arch package manager that ships by default in CachyOS, got a text-based front end with its v3.2.1 release. A new terminal UI rounds out the tool, but the real story underneath is a risky from-scratch Zig rewrite.
Shelly just gained a way to use it from inside a terminal. The v3.2.1 release from Seafoam Labs, which landed November 9, adds a text-based front end on top of the GTK4 desktop app and the command-line tool it already shipped with.
It's a third interface, and it's the headline of a release that's really about two things at once: meeting terminal users where they are, and the risky Zig rewrite the project has been grinding on for months.
Why the TUI matters
The new terminal UI answers the biggest ask from people who'd rather type than click. PR #2136 shipped 98 commits after VinnyQF led the effort, with treshaun and sirlucjan trimming the rough edges. It merged on November 6, a few days before the release itself.It does the expected stuff first. Browse packages, filter what's installed, spot the differences between versions. Then comes the more useful, and more dangerous, part: batch-install or batch-remove across your system, the AUR, and Flatpak all at once. AUR PKGBUILDs get previews, reviews, diffs, and security scans before you commit to them.
Keep in mind that it also hardens authentication. Rather than leaning on askpass, it spins up a private sudo PTY and won't let you quit mid-operation. That's the whole point. A package transaction is exactly the moment you don't want interrupted.
The project's reception has never been tidy. Shelly is opinionated, and it reaches users who never opted in, which tends to generate opinions. A recurring sentiment on r/cachyos runs along the lines of: don't bother, it's for people allergic to the terminal. That crowd would argue pacman plus an AUR helper and three keystrokes beats any GUI. The GitHub repo itself sits at roughly 1,258 stars and 106 forks, which says more about its reach than its controversy.
On the other side, 9to5Linux and Linux Today called Shelly "a very good candidate" to become Arch's default package-management interface. Some users say it beats Pamac for search and install, and gets everyday jobs done without the usual friction.
For the rest of v3.2.1, it's mostly background noise: Polish, Portuguese, and French translation updates, plus performance fixes that skip redundant update scans. Head here for the full release notes if you want the complete changelog.
A Zig rewrite, and a bigger bet
Here's the part that actually keeps some Arch veterans up at night. Shelly has spent the last several weeks building RLPM, a from-scratch reimplement of libalpm in Zig. libalpm is the very C library pacman is built on. Relatively nobody tries to reimplement it.The engineering choices are genuine, not marketing copy. RLPM reads repository databases straight into in-memory SQLite, sidestepping the disk extraction step. It detects your CPU's architecture tier and runs at the highest microarch it supports. Archives get copied into a sealed in-memory file before signature checking, a move aimed at fighting TOCTOU attacks. Hooks run inside their own network namespace by default, with filesystem work confined via openat2.
It's arguably one of the more security-aware package managers being built right now. It's also unfinished. RLPM shipped in v3.1.7 on October 15, and its first prebuilt binary came out with a linking bug that left sqlite3_open_v2 unresolved, effectively killing RLPM until v3.1.8 landed three days later just to fix it.
You can switch backends on the fly. Run shelly config set NativePackageBackend rlpm or libalpm, and the change takes effect on the next command with no migration step required.
Head here to the Shelly-ALPM GitHub repo for the full release notes.
