karnel-termux 4.13.10 → 4.13.11

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/israelmarques1024-dotcom/karnel-termux">
-    <img src="https://img.shields.io/badge/version-4.13.10-0078D4?style=for-the-badge" alt="Version">
+    <img src="https://img.shields.io/badge/version-4.13.11-0078D4?style=for-the-badge" alt="Version">
   </a>
   <a href="https://www.npmjs.com/package/karnel-termux">
     <img src="https://img.shields.io/npm/v/karnel-termux?style=for-the-badge&logo=npm&color=cb3837" alt="npm">
@@ -166,6 +166,10 @@ user's permissions. They are not sandboxed. Registry plugins have reviewed
 metadata and are staged, validated, and atomically activated, but you should
 still review code you do not trust.
 
+Each Karnel release pins and verifies one reviewed registry snapshot. New
+registry entries become available after updating Karnel to a release that
+includes that snapshot.
+
 Installing an arbitrary GitHub repository requires both `--unsafe` and an
 interactive confirmation:
 
@@ -304,7 +308,7 @@ karnel install ai --opencode --ollama         # Install specific agents
 | **Cursor CLI** | `--cursor-cli` | Official Cursor AI agent adapted for Termux (glibc) |
 | **Oh-My-Pi** | `--oh-my-pi` | Enhanced Pi agent with native Rust addons |
 | **Goose CLI** | `--goose` | AI agent framework by Block (native Termux musl) |
-| **Factory Droid** | `--droid` | Enterprise AI agent (via proot-distro Ubuntu) |
+| **Factory Droid** | `--droid` | Enterprise AI agent (Ubuntu proot-distro with pinned npm package) |
 | **Supercode CLI** | `--supercode-cli` | Supercode CLI — official npm package |
 | **Puter CLI** | `--puter` | Puter CLI for sites and workers |
 | **KeelCode** | `--keelcode` | Hosted coding-agent CLI |

package/docs/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Documentation Changelog
 
+## 4.13.11 - 2026-08-10
+
+- Hardened installers to preserve user-managed commands and data, with atomic
+  staging for downloaded payloads and native binaries.
+- Added verified plugin registry snapshots, npm release pinning, and regression
+  contracts for installers, ownership, and package postinstall behavior.
+- Added Android-compatible Railway installation through Ubuntu Proot and
+  verified Railway and Netlify CLI installation on Termux.
+- Synchronized CLI, GitHub README, npm metadata, and site documentation.
+- Corrected the portable npm postinstall fixture used by release validation.
+
 ## 4.13.10 - 2026-08-06
 
 - Included root documentation in the npm package and synchronized help, TUI, and release assets.

package/docs/cli/README.md

@@ -36,7 +36,7 @@ karnel install <module> --tool1 --tool2  # Install specific tools only
 | `osint`   | Robin v2.8 — dark web OSINT via Tor + LLM |
 | `voice`   | Speech-to-agent via Termux:API |
 | `security`| Nmap, Hydra, SQLMap, Metasploit, and 26 other tools |
-| `plugin`  | Install plugins from the official registry |
+| `plugin`  | Built-in manager for plugins from the official registry |
 
 ### Per-module tool flags
 
@@ -76,8 +76,8 @@ karnel uninstall <module> --tool1 --tool2
 
 Same modules and flags as `install`. Removes installed packages and binaries.
 User configuration is preserved by default; Karnel asks for confirmation before
-removing configuration paths it manages. `ui --extra-keys` is a legacy
-exception: it replaces and removes `~/.termux/termux.properties` directly.
+removing configuration paths it manages. `ui --extra-keys` adds and removes
+only its marked block in `~/.termux/termux.properties`.
 
 ```bash
 karnel uninstall ai --opencode --ollama
@@ -205,6 +205,7 @@ Opens the official documentation page for a module using
 | `ui`             | Termux UI |
 | `auto`           | Automation tools |
 | `deploy`         | Deploy CLIs |
+| `supabase`       | Supabase CLI |
 | `games`          | Games |
 | `cleanup`        | Cache cleanup |
 | `network`        | Network tools |
@@ -778,7 +779,10 @@ The main tool modules work with `install`, `uninstall`, `reinstall`, `update`,
 `list`, `show`, and `open`:
 
 `ai` `auto` `db` `deploy` `dev` `editor` `games` `lang` `network` `npm`
-`osint` `security` `shell` `ui` `utils` `voice`
+`osint` `security` `shell` `ui` `utils`
+
+`voice` works with `install`, `uninstall`, `reinstall`, `update`, `list`, and
+`open`; it has no per-tool README for `show`.
 
 `plugin` works with `install`, `uninstall`, `reinstall`, `update`, `list`, and
 `open`, but does not expose tool documentation through `show`.

package/install.sh

@@ -207,6 +207,12 @@ clone_repo() {
 		log_info "Developer installation detected"
 		log_ok "Using local repository"
 	elif [[ -d "$KARNEL_REPO/.git" ]]; then
+		local origin_url
+		origin_url="$(git -C "$KARNEL_REPO" remote get-url origin 2>/dev/null)"
+		if [[ "$origin_url" != "$REPO" && "$origin_url" != "${REPO%.git}" ]]; then
+			log_fail "Existing Karnel repository has an unexpected origin"
+			return 1
+		fi
 		progress_bar 3 10
 		if [[ -n "$RELEASE_REF" ]]; then
 			if ! git -C "$KARNEL_REPO" fetch --depth=1 origin "refs/tags/$BRANCH" &>/dev/null ||
@@ -215,7 +221,7 @@ clone_repo() {
 				return 1
 			fi
 		else
-			if ! git -C "$KARNEL_REPO" pull origin "$BRANCH" &>/dev/null; then
+			if ! git -c core.hooksPath=/dev/null -C "$KARNEL_REPO" pull origin "$BRANCH" &>/dev/null; then
 				log_fail "Failed to update existing repository"
 				return 1
 			fi
@@ -224,7 +230,6 @@ clone_repo() {
 		echo
 		log_ok "Repository updated"
 	else
-		_INSTALL_CREATED_KARNEL_REPO=true
 		progress_bar 0 10
 		git clone --depth=1 -b "$BRANCH" "$REPO" "$KARNEL_REPO" &>/dev/null &
 		local pid=$!
@@ -235,6 +240,7 @@ clone_repo() {
 			sleep 0.5
 		done
 		wait "$pid" || { log_fail "Failed to clone repository"; _cleanup_failed; exit 1; }
+		_INSTALL_CREATED_KARNEL_REPO=true
 		progress_bar 10 10
 		echo
 		log_ok "Repository cloned"

package/karnel/bin/karnel

@@ -75,7 +75,7 @@ show_update_notification() {
     echo
     log_warn "New version available: ${D_GREEN}$new_version${D_NC} (current: ${D_CYAN}$KARNEL_VERSION${D_NC})"
     echo
-    list_item "Run: ${D_CYAN}karnel update${D_NC} to update"
+    list_item "Run: ${D_CYAN}karnel update karnel${D_NC} to update"
     echo
   fi
 }

package/karnel/cli/commands/install.sh

@@ -233,13 +233,13 @@ _install_specific_tools() {
               ((failed_count++))
             fi
             ;;
-          *)
-            ((failed_count++))
-            ;;
-           2)
+          2)
             # Already installed (skipped)
             ((skipped_count++))
             ;;
+          *)
+            ((failed_count++))
+            ;;
         esac
       else
         log_warn "Function not found: $func_name"

package/karnel/cli/commands/list.sh

@@ -197,7 +197,7 @@ _list_ai() {
   table_row "Cline CLI" "--cline" "cline" "$(_check_cmd "cline")"
   table_row "Odysseus" "--odysseus" "odysseus" "$(_check_cmd "odysseus")"
   table_row "Kimchi CLI" "--kimchi-code" "kimchi" "$(_check_cmd "kimchi")"
-  table_row "omniRoute" "--omni-route" "omni-route" "$(_check_cmd "omni-route")"
+  table_row "omniRoute" "--omni-route" "omni-route" "$(_check_omni_route)"
   table_row "Context7 Docs" "--ctx7" "ctx7" "$(_check_cmd "ctx7")"
   table_row "OpenSpec SDD" "--openspec" "openspec" "$(_check_cmd "openspec")"
   table_row "Qoder" "--qoder" "qodercli" "$(_check_cmd "qodercli")"
@@ -229,7 +229,7 @@ _list_editor() {
   table_start "Component" "Install Flag" "Status"
   table_row "code-server" "--code-server" "$(_check_cmd "code-server")"
   table_row "neovim" "--neovim" "$(_check_cmd "nvim")"
-  table_row "nvchad" "--nvchad" "$(_check_cmd "nvim")"
+  table_row "nvchad" "--nvchad" "$(_check_nvchad)"
   table_end
 
   echo
@@ -364,9 +364,9 @@ _list_ui() {
   echo
 
   table_start "Component" "Install Flag" "Status"
-  table_row "Meslo Nerd Font" "--font" "$(_check_file "$HOME/.termux/font.ttf")"
+  table_row "Meslo Nerd Font" "--font" "$(_check_font)"
   table_row "Extra Keys" "--extra-keys" "$(_check_extra_keys)"
-  table_row "Cursor Color" "--cursor" "$(_check_file "$HOME/.termux/colors.properties")"
+  table_row "Cursor Color" "--cursor" "$(_check_cursor)"
   table_row "Startup Banner" "--banner" "$(_grep_config "$HOME/.zshrc" "# ===== Karnel Banner =====" "$HOME/.bashrc")"
   table_end
 
@@ -474,6 +474,22 @@ _check_cmd() {
   fi
 }
 
+_check_omni_route() {
+  if command -v omni-route &>/dev/null && omni-route --version &>/dev/null 2>&1; then
+    echo -e "${D_GREEN}installed${NC}"
+  else
+    echo -e "${D_RED}not installed${NC}"
+  fi
+}
+
+_check_nvchad() {
+  if [[ -d "$KARNEL_DATA/nvchad-termux/.git" && -d "$HOME/.config/nvim" ]]; then
+    echo -e "${D_GREEN}installed${NC}"
+  else
+    echo -e "${D_RED}not installed${NC}"
+  fi
+}
+
 # Check if any of the comma-separated commands exists
 _check_cmd_any() {
   local bin_list="$1"
@@ -498,28 +514,27 @@ _check_pkg() {
   fi
 }
 
-# Check if directory exists
-_check_dir() {
-  local dir="$1"
-  if [[ -d "$dir" ]]; then
+_check_robin() {
+  if _robin_is_installed; then
     echo -e "${D_GREEN}installed${NC}"
   else
     echo -e "${D_RED}not installed${NC}"
   fi
 }
 
-_check_robin() {
-  if _robin_is_installed; then
+_check_font() {
+  local font_source
+  font_source="$(dirname "$KARNEL_PATH")/assets/fonts/font.ttf"
+  if [[ -f "$font_source" ]] && cmp -s "$font_source" "$HOME/.termux/font.ttf"; then
     echo -e "${D_GREEN}installed${NC}"
   else
     echo -e "${D_RED}not installed${NC}"
   fi
 }
 
-# Check if file exists
-_check_file() {
-  local file="$1"
-  if [[ -f "$file" ]]; then
+_check_cursor() {
+  if grep -qF '# Karnel cursor begin' "$HOME/.termux/colors.properties" 2>/dev/null &&
+    grep -qF '# Karnel cursor end' "$HOME/.termux/colors.properties" 2>/dev/null; then
     echo -e "${D_GREEN}installed${NC}"
   else
     echo -e "${D_RED}not installed${NC}"

package/karnel/cli/commands/open.sh

@@ -48,6 +48,9 @@ open_main() {
 	deploy)
 		url="$OPEN_BASE_URL/karnel/deploy"
 		;;
+	supabase)
+		url="$OPEN_BASE_URL/karnel/supabase"
+		;;
   cleanup)
     url="$OPEN_BASE_URL/karnel/cleanup"
     ;;
@@ -129,6 +132,7 @@ open_help() {
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "ui" "Termux UI"
   printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "auto" "Automation tools"
   printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "deploy" "Deploy CLIs"
+  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "supabase" "Supabase CLI"
   printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "games" "Games"
   printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "cleanup" "Cache cleanup"
   printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "network" "Network tools"

package/karnel/cli/commands/supabase.sh

@@ -199,7 +199,7 @@ supabase_remote() {
   log_info "For full local development, use a Linux host:"
   echo
   list_item "1. SSH into a Linux VPS, Codespaces, or local Linux machine"
-  list_item "2. Install Docker: ${D_CYAN}curl -fsSL https://get.docker.com | sh${NC}"
+  list_item "2. Install Docker using the official Linux installation guide"
   list_item "3. Install Supabase CLI on that machine"
   list_item "4. Clone your project there"
   list_item "5. Run ${D_CYAN}supabase start${NC} for local stack"

package/karnel/cli/karnel.sh

@@ -370,7 +370,7 @@ _tui_list_menu() {
   local modules="ai db lang dev editor npm shell ui auto deploy games network utils osint voice plugin security"
   local choice
   choice=$(_dialog_menu "List Tools" "Select a module to list:" \
-    "ai" "AI Agents (39)" \
+    "ai" "AI Agents (41)" \
     "db" "Databases" \
     "lang" "Programming Languages" \
     "editor" "Code Editors" \

package/karnel/modules/ai.sh

@@ -60,21 +60,6 @@ _install_ai_tools_wrapper() {
 uninstall_ai() {
   import "@/tools/ai/all"
 
-  # Verifica se alguma ferramenta AI está instalada via AI_TOOLS_REGISTRY
-  local found=false
-  local _reg_entry _id _name _bins
-  for _reg_entry in "${AI_TOOLS_REGISTRY[@]}"; do
-    IFS=':' read -r _id _name _bins <<< "$_reg_entry"
-    local _first_bin="${_bins%%,*}"
-    if command -v "$_first_bin" &>/dev/null; then
-      found=true
-      break
-    fi
-  done
-  if [[ "$found" == "false" ]]; then
-    log_info "AI Tools are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling AI Tools"
   separator

package/karnel/modules/auto.sh

@@ -36,10 +36,6 @@ _install_auto_wrapper() {
 }
 
 uninstall_auto() {
-	if ! command -v n8n &>/dev/null; then
-		log_info "Automation Tools are not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Automation Tools"
 	separator

package/karnel/modules/db.sh

@@ -45,10 +45,6 @@ _install_db_tools_wrapper() {
 }
 
 uninstall_db() {
-	if ! command -v postgres &>/dev/null; then
-		log_info "Databases are not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Databases"
 	separator

package/karnel/modules/deploy.sh

@@ -30,10 +30,6 @@ _install_deploy_wrapper() {
 }
 
 uninstall_deploy() {
-  if ! command -v vercel &>/dev/null && ! command -v railway &>/dev/null && ! command -v netlify &>/dev/null; then
-    log_info "Deploy CLIs are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling Deploy CLIs"
   separator

package/karnel/modules/dev.sh

@@ -36,10 +36,6 @@ _install_dev_wrapper() {
 }
 
 uninstall_dev() {
-	if ! command -v gh &>/dev/null; then
-		log_info "Development Tools are not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Development Tools"
 	separator

package/karnel/modules/editor.sh

@@ -32,10 +32,6 @@ install_editor() {
 }
 
 uninstall_editor() {
-	if ! command -v code-server &>/dev/null; then
-		log_info "Code Editor is not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Code Editor"
 	separator

package/karnel/modules/games.sh

@@ -29,10 +29,6 @@ install_games() {
 }
 
 uninstall_games() {
-  if ! command -v buzz &>/dev/null && ! command -v ctfgod &>/dev/null; then
-    log_info "Games are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling Games"
   separator

package/karnel/modules/lang.sh

@@ -42,10 +42,6 @@ _install_lang_wrapper() {
 }
 
 uninstall_lang() {
-	if ! command -v node &>/dev/null; then
-		log_info "Language Packages are not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Language Packages"
 	separator

package/karnel/modules/network.sh

@@ -29,10 +29,6 @@ install_network() {
 }
 
 uninstall_network() {
-  if ! command -v dark &>/dev/null && ! command -v dedsec-network &>/dev/null; then
-    log_info "Network Tools are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling Network Tools"
   separator

package/karnel/modules/npm.sh

@@ -48,10 +48,6 @@ _install_npm_wrapper() {
 }
 
 uninstall_npm() {
-	if ! command -v tsc &>/dev/null; then
-		log_info "Node.js Modules are not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Node.js Modules"
 	separator

package/karnel/modules/osint.sh

@@ -39,10 +39,6 @@ _install_osint_wrapper() {
 
 uninstall_osint() {
 	_robin_print_disclaimer
-  if [[ ! -d "$KARNEL_TOOLS/osint" ]]; then
-    log_info "OSINT tools are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling OSINT Tools"
   separator

package/karnel/modules/shell.sh

@@ -240,10 +240,6 @@ uninstall_oh_my_zsh() {
 }
 
 uninstall_shell() {
-	if [[ ! -d "$OH_MY_ZSH_DIR" ]]; then
-		log_info "ZSH Shell Environment is not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling ZSH Shell Environment"
 	separator
@@ -253,7 +249,9 @@ uninstall_shell() {
 
 	local rc=0
 	_uninstall_shell_plugins_wrapper || rc=$?
-	uninstall_oh_my_zsh || rc=1
+	local oh_my_zsh_rc=0
+	uninstall_oh_my_zsh || oh_my_zsh_rc=$?
+	((rc += oh_my_zsh_rc))
 
 	echo
 	separator

package/karnel/modules/ui.sh

@@ -51,10 +51,6 @@ _setup_ui_wrapper() {
 }
 
 uninstall_ui() {
-	if [[ ! -d "$TERMUX_DIR" ]]; then
-		log_info "Termux UI Configuration is not installed"
-		return 0
-	fi
 	separator
 	box "Uninstalling Termux UI Configuration"
 	separator

package/karnel/modules/utils.sh

@@ -29,10 +29,6 @@ install_utils() {
 }
 
 uninstall_utils() {
-  if ! command -v fconv &>/dev/null && ! command -v notes &>/dev/null; then
-    log_info "Utility Tools are not installed"
-    return 0
-  fi
   separator
   box "Uninstalling Utility Tools"
   separator

package/karnel/tools/ai/all.sh

@@ -113,18 +113,6 @@ _validate_tool_installed() {
   return 1
 }
 
-# Valida que o binário realmente executa (tenta --version ou --help)
-_validate_tool_executable() {
-  local binary="$1"
-  local tool_name="$2"
-  if command -v "$binary" &>/dev/null; then
-    # Tenta executar com --version (ignora exit code, só verifica se não crasha)
-    "$binary" --version &>/dev/null || "$binary" --help &>/dev/null || "$binary" -h &>/dev/null || true
-    return 0
-  fi
-  return 1
-}
-
 # ---- FUNÇÕES DE LOTE ----
 
 _all_ai_tools_action() {

package/karnel/tools/ai/antigravity-cli/install.sh

@@ -223,7 +223,8 @@ _install_antigravity_proot_impl() {
     export SHELL=/bin/bash
     export TMPDIR=/tmp
     export HOME=/root
-    curl -fsSL https://antigravity.google/cli/install.sh | bash
+    echo "Antigravity Proot installation is unavailable because upstream does not publish a verifiable artifact." >&2
+    exit 1
   ' &>>"$LOG_FILE"
 
   local ubuntu_root
@@ -318,7 +319,7 @@ install_antigravity_cli() {
 
   read_select "Installation method" SELECTED_METHOD \
     "Native (recommended) - Compile with glibc support" \
-    "Proot-distro (alternative) - Ubuntu container"
+    "Proot-distro (unavailable: upstream has no verifiable artifact)"
 
   case "$SELECTED_METHOD" in
   *Native*)
@@ -391,7 +392,8 @@ _update_antigravity_cli_impl() {
     export SHELL=/bin/bash
     export TMPDIR=/tmp
     export HOME=/root
-    curl -fsSL https://antigravity.google/cli/install.sh | bash
+    echo "Antigravity Proot update is unavailable because upstream does not publish a verifiable artifact." >&2
+    exit 1
   ' &>>"$LOG_FILE"
 
   local ubuntu_root

package/karnel/tools/ai/claude-code/README.md

@@ -16,7 +16,7 @@ Claude Code is Anthropic's AI-powered coding assistant that runs directly in you
 ## Dependencies
 
 - **Native mode:** glibc-repo, glibc, clang, curl, tar
-- **Proot mode:** proot-distro, curl, ca-certificates
+- **Proot mode:** proot-distro, ca-certificates, nodejs, npm
 
 ## Install
 
@@ -39,7 +39,6 @@ karnel update ai --claude-code
 ## Notes
 
 - Native installation (recommended): runs directly with glibc support via a C bootstrapper
-- Proot-distro (alternative): runs inside an Ubuntu container for compatibility
+- Proot-distro (alternative): runs the pinned `@anthropic-ai/claude-code@2.1.226` npm package inside an Ubuntu container
 - The installer will prompt you to select which method to use
 - Data directory: `~/.local/share/karnel-data/claude/`
-

package/karnel/tools/ai/claude-code/install.sh

@@ -154,14 +154,14 @@ _install_claude_proot_impl() {
   fi
 
   _claude_proot_ubuntu /bin/bash -c \
-    'apt-get update && apt-get upgrade -y && apt-get install -y curl ca-certificates' \
+    'apt-get update && apt-get upgrade -y && apt-get install -y ca-certificates nodejs npm' \
     &>>"$LOG_FILE"
 
   _claude_proot_ubuntu /bin/bash -c '
 		export SHELL=/bin/bash
 		export TMPDIR=/tmp
 		export HOME=/root
-		curl -fsSL https://claude.ai/install.sh | bash
+		npm install -g @anthropic-ai/claude-code@2.1.226
 	' &>>"$LOG_FILE"
 
   local ubuntu_root
@@ -262,7 +262,7 @@ _do_update_claude_code() {
 
   _claude_proot_ubuntu /bin/bash -c '
     export HOME=/root
-    curl -fsSL https://claude.ai/install.sh | bash
+    npm install -g @anthropic-ai/claude-code@2.1.226
   ' &>>"$LOG_FILE"
 
   if ! _claude_proot_ubuntu test -x /root/.local/bin/claude &>>"$LOG_FILE"; then

package/karnel/tools/ai/codegraph/install.sh

@@ -39,6 +39,7 @@ _download_codegraph() {
 }
 
 _download_codegraph_impl() {
+	local staging_dir old_dir
 	LATEST_VERSION=$(curl -sI https://github.com/colbymchenry/codegraph/releases/latest | grep -i location | sed -E 's#.*/tag/([^[:space:]]+).*#\1#')
 	LATEST_VERSION="${LATEST_VERSION#v}"
 
@@ -52,22 +53,35 @@ _download_codegraph_impl() {
 		return 1
 	fi
 
-	local tarball
-	tarball=$(mktemp "$KARNEL_DATA/codegraph-XXXXXX.tar.gz")
+	mkdir -p "$KARNEL_DATA"
+	staging_dir=$(mktemp -d "$KARNEL_DATA/.codegraph.XXXXXX") || return 1
+	local tarball="$staging_dir/codegraph.tar.gz"
 
 	if ! curl -L "https://github.com/colbymchenry/codegraph/releases/download/v${LATEST_VERSION}/codegraph-linux-arm64.tar.gz" -o "$tarball" &>>"$LOG_FILE"; then
 		log_error "Failed to download CodeGraph"
-		rm -f "$tarball"
+		rm -rf "$staging_dir"
 		return 1
 	fi
 
-	if ! tar -xzf "$tarball" -C "$KARNEL_DATA" &>>"$LOG_FILE"; then
+	if ! tar -xzf "$tarball" -C "$staging_dir" &>>"$LOG_FILE" ||
+		[[ ! -f "$staging_dir/codegraph-linux-arm64/lib/dist/bin/codegraph.js" ]]; then
 		log_error "Failed to extract CodeGraph"
-		rm -f "$tarball"
+		rm -rf "$staging_dir"
 		return 1
 	fi
 
 	rm -f "$tarball"
+	old_dir="$KARNEL_DATA/.codegraph-linux-arm64.previous.$$"
+	if [ -d "$KARNEL_DATA/codegraph-linux-arm64" ] && ! mv "$KARNEL_DATA/codegraph-linux-arm64" "$old_dir"; then
+		rm -rf "$staging_dir"
+		return 1
+	fi
+	if ! mv "$staging_dir/codegraph-linux-arm64" "$KARNEL_DATA/codegraph-linux-arm64"; then
+		[[ -d "$old_dir" ]] && mv "$old_dir" "$KARNEL_DATA/codegraph-linux-arm64"
+		rm -rf "$staging_dir"
+		return 1
+	fi
+	rm -rf "$staging_dir" "$old_dir"
 
 	return 0
 }
@@ -82,8 +96,23 @@ _write_codegraph_wrapper_impl() {
 		log_error "Wrapper template not found at $wrapper_src"
 		return 1
 	fi
-	cp "$wrapper_src" "$PREFIX/bin/codegraph"
-	chmod +x "$PREFIX/bin/codegraph"
+	local staging_wrapper old_wrapper
+	mkdir -p "$PREFIX/bin"
+	staging_wrapper=$(mktemp "$PREFIX/bin/.codegraph.XXXXXX") || return 1
+	if ! cp "$wrapper_src" "$staging_wrapper" || ! chmod +x "$staging_wrapper" || [[ ! -x "$staging_wrapper" ]]; then
+		rm -f "$staging_wrapper"
+		return 1
+	fi
+	old_wrapper="$PREFIX/bin/codegraph.previous.$$"
+	if [ -e "$PREFIX/bin/codegraph" ] && ! mv "$PREFIX/bin/codegraph" "$old_wrapper"; then
+		rm -f "$staging_wrapper"
+		return 1
+	fi
+	if ! mv "$staging_wrapper" "$PREFIX/bin/codegraph"; then
+		[[ -e "$old_wrapper" ]] && mv "$old_wrapper" "$PREFIX/bin/codegraph"
+		return 1
+	fi
+	rm -f "$old_wrapper"
 
 	return 0
 }
@@ -136,7 +165,6 @@ update_codegraph() {
 }
 
 _do_update_codegraph() {
-  loading "Removing old CodeGraph" _update_codegraph_remove_impl
   _codegraph_dependencies || return 1
   _download_codegraph || return 1
   _write_codegraph_wrapper || return 1