karnel-termux 4.17.0 → 4.17.2

package/install.sh

@@ -79,7 +79,9 @@ _INSTALL_KARNEL_SYMLINK_CHANGED=false
 _INSTALL_PREVIOUS_KARNEL_SYMLINK=""
 
 _cleanup_failed() {
-	echo -e "\n  ${P_FAIL}✖${P_NC}  Installation failed at step ${CURRENT_STEP}. Cleaning up..."
+  set +e
+  trap - ERR
+  echo -e "\n  ${P_FAIL}✖${P_NC}  Installation failed at step ${CURRENT_STEP}. Cleaning up..."
 	if $_INSTALL_KARNEL_SYMLINK_CHANGED; then
 		if [[ -n "$_INSTALL_PREVIOUS_KARNEL_SYMLINK" ]]; then
 			local rollback_link_dir
@@ -287,7 +289,23 @@ clone_repo() {
 			log_fail "Failed to clone repository"
 			return 1
 		fi
-		if [[ -n "$RELEASE_REF" ]]; then
+		if [[ -n "$RELEASE_COMMIT" ]]; then
+			if ! git -C "$candidate_repo" fetch --depth=1 origin "$RELEASE_COMMIT" &>/dev/null; then
+				log_fail "Failed to fetch release commit $RELEASE_COMMIT"
+				return 1
+			fi
+			if ! git -C "$candidate_repo" checkout --quiet --detach "$RELEASE_COMMIT" &>/dev/null; then
+				log_fail "Failed to checkout release commit $RELEASE_COMMIT"
+				return 1
+			fi
+			local candidate_commit
+			candidate_commit=$(git -C "$candidate_repo" rev-parse HEAD 2>/dev/null) || return 1
+			if [[ "$candidate_commit" != "$RELEASE_COMMIT" ]]; then
+				log_fail "Release commit mismatch"
+				log_info "Expected $RELEASE_COMMIT, got $candidate_commit"
+				return 1
+			fi
+		elif [[ -n "$RELEASE_REF" ]]; then
 			local candidate_commit
 			candidate_commit=$(git -C "$candidate_repo" rev-parse HEAD 2>/dev/null) || return 1
 			if [[ "$candidate_commit" != "$RELEASE_COMMIT" ]]; then

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-57a1aa3e5401b6ba9b37965d8680bcb543b0fc00
+680f9d3f783c6f2bf95e4499c3e230d2d25b7070

package/karnel/bin/karnel

@@ -30,7 +30,8 @@ import "@/utils/env"
 
 # ===== SEMVER COMPARISON =====
 _semver_gt() {
-  [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" == "$1" ]] && [[ "$1" != "$2" ]]
+  local a="${1#v}" b="${2#v}"
+  [[ "$(printf '%s\n%s' "$a" "$b" | sort -V | tail -1)" == "$a" ]] && [[ "$a" != "$b" ]]
 }
 
 _valid_semver() {

package/karnel/cli/commands/backup.sh

@@ -10,7 +10,7 @@ mkdir -p "$BACKUP_DIR"
 
 backup_main() {
   local cmd="${1:-}"
-  shift 2>/dev/null || true
+  shift || true
 
   case "$cmd" in
     --help|-h)      backup_help ;;

package/karnel/cli/commands/doctor/fixes.sh

@@ -292,7 +292,7 @@ _fix_locale() {
   if [[ ! -f "$config" ]] && [[ -f "$HOME/.bashrc" ]]; then
     config="$HOME/.bashrc"
   fi
-  echo 'export LANG=en_US.UTF-8' >> "$config" 2>/dev/null
+  grep -qxF 'export LANG=en_US.UTF-8' "$config" 2>/dev/null || echo 'export LANG=en_US.UTF-8' >> "$config" 2>/dev/null
 }
 
 
@@ -425,6 +425,6 @@ _fix_keyring() {
 }
 
 _fix_apt_cache() {
-  rm -rf "$PREFIX/var/apt/lists"/* 2>/dev/null
+  rm -rf "${PREFIX:?}/var/apt/lists"/* 2>/dev/null
   pkg update -y &>/dev/null
 }

package/karnel/cli/commands/init.sh

@@ -1078,33 +1078,33 @@ configure_rust() {
 
 	# Append dependencies to Cargo.toml
 	if [[ -f "Cargo.toml" ]]; then
-		# Append after [dependencies] or add it
-		if grep -q '^\[dependencies\]' Cargo.toml; then
-			cat >>Cargo.toml <<EOF
-EOF
-		else
-			echo -e "\n[dependencies]" >> Cargo.toml
+		if ! grep -q '^\[dependencies\]' Cargo.toml; then
+			printf '\n[dependencies]\n' >> Cargo.toml
 		fi
-		cat >>Cargo.toml <<EOF
-tokio = { version = "1.0", features = ["full"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
-dotenvy = "0.15"
-EOF
+		local dep name spec
+		local -a deps=(
+			'tokio = { version = "1.0", features = ["full"] }'
+			'serde = { version = "1.0", features = ["derive"] }'
+			'serde_json = "1.0"'
+			'dotenvy = "0.15"'
+		)
 		if [[ "$framework_choice" == "Axum" ]]; then
-			cat >>Cargo.toml <<EOF
-axum = "0.7"
-EOF
+			deps+=('axum = "0.7"')
 		else
-			cat >>Cargo.toml <<EOF
-actix-web = "4.0"
-EOF
+			deps+=('actix-web = "4.0"')
 		fi
 		if [[ "$db_choice" == "SQLx (PostgreSQL)" ]]; then
-			cat >>Cargo.toml <<EOF
-sqlx = { version = "0.7", features = ["runtime-tokio", "postgres", "macros"] }
-EOF
+			deps+=('sqlx = { version = "0.7", features = ["runtime-tokio", "postgres", "macros"] }')
 		fi
+		for dep in "${deps[@]}"; do
+			name="${dep%% =*}"
+			name="${name%%[[:space:]]*}"
+			if grep -q "^${name} =" Cargo.toml; then
+				log_info "Dependency already present: ${name}"
+			else
+				sed -i "/^\[dependencies\]/a ${dep}" Cargo.toml
+			fi
+		done
 		log_success "Configured Cargo.toml"
 	fi
 

package/karnel/cli/commands/supabase.sh

@@ -5,7 +5,7 @@ import "@/utils/colors"
 
 supabase_main() {
   local subcommand="${1:-help}"
-  shift 2>/dev/null || true
+  shift || true
 
   case "$subcommand" in
     help|--help|-h)

package/karnel/tools/ai/antigravity-cli/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_ai.log"
 AGY_DATA_DIR="$HOME/.local/share/karnel-data/antigravity-cli"
@@ -63,17 +64,22 @@ _antigravity_download_binary() {
 }
 
 _antigravity_download_binary_impl() {
-  local latest_version
-  latest_version=$(_antigravity_get_latest_version)
-  if [ -z "$latest_version" ]; then
-    log_error "Failed to fetch latest Antigravity version"
+  local manifest
+  manifest=$(curl -fsSL "$MANIFEST_URL") || {
+    log_error "Failed to fetch Antigravity CLI manifest"
+    return 1
+  }
+  local latest_version download_url manifest_sha256
+  latest_version=$(printf '%s' "$manifest" | jq -r .version)
+  download_url=$(printf '%s' "$manifest" | jq -r .url)
+  manifest_sha256=$(printf '%s' "$manifest" | jq -r '.sha256 // empty')
+  if [ -z "$latest_version" ] || [ -z "$download_url" ]; then
+    log_error "Failed to parse Antigravity CLI manifest"
     return 1
   fi
 
   mkdir -p "$AGY_DATA_DIR"
 
-  local download_url
-  download_url=$(_antigravity_get_download_url)
   local tarball="$AGY_DATA_DIR/agy.tar.gz"
 
   if ! curl -fsSL -o "$tarball" "$download_url" &>>"$LOG_FILE"; then
@@ -81,6 +87,12 @@ _antigravity_download_binary_impl() {
     return 1
   fi
 
+  if [[ "$manifest_sha256" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$tarball" "$manifest_sha256" || return 1
+  else
+    log_warn "Antigravity CLI manifest does not publish a SHA-256; skipping integrity verification"
+  fi
+
   if ! tar -xzf "$tarball" -C "$AGY_DATA_DIR" &>>"$LOG_FILE"; then
     log_error "Failed to extract Antigravity CLI binary"
     return 1

package/karnel/tools/ai/ctx7/install.sh

@@ -13,6 +13,13 @@ install_ctx7() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by ctx7)"
+      return 1
+    fi
+  fi
+
   log_info "Installing ctx7 (Context7 documentation provider)..."
   npm install -g ctx7 2>/dev/null
   local rc=$?

package/karnel/tools/ai/droid/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 import "@/utils/uninstall"
 
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
@@ -239,14 +240,20 @@ _droid_ubuntu_install_bin() {
 
   local binary_url="https://downloads.factory.ai/factory-cli/releases/$latest_version/linux/arm64/droid"
 
-  _droid_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(curl -fsSL "$binary_url.sha256" 2>/dev/null | awk '{print $1}') || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Droid; skipping integrity verification"
+  fi
+  _droid_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/droid-install &&
-    curl -fsSL '$binary_url' -o /tmp/droid-install/droid &&
+    curl -fsSL "$1" -o /tmp/droid-install/droid &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-install/droid | awk "{print \$1}")" = "$2" ]; } &&
     mkdir -p /usr/local/bin &&
     mv /tmp/droid-install/droid /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
     rm -rf /tmp/droid-install
-  " &>>"$LOG_FILE"
+  ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local droid_bin="$(_droid_detect_ubuntu_root)/usr/local/bin/droid"
   if [ ! -f "$droid_bin" ]; then
@@ -413,14 +420,20 @@ _update_droid_proot_impl() {
 
   local binary_url="https://downloads.factory.ai/factory-cli/releases/$latest_version/linux/arm64/droid"
 
-  _droid_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(curl -fsSL "$binary_url.sha256" 2>/dev/null | awk '{print $1}') || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Droid; skipping integrity verification"
+  fi
+  _droid_proot_ubuntu /bin/bash -c '
     rm -f /usr/local/bin/droid &&
     mkdir -p /tmp/droid-update &&
-    curl -fsSL '$binary_url' -o /tmp/droid-update/droid &&
+    curl -fsSL "$1" -o /tmp/droid-update/droid &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-update/droid | awk "{print \$1}")" = "$2" ]; } &&
     mv /tmp/droid-update/droid /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
     rm -rf /tmp/droid-update
-  " &>>"$LOG_FILE"
+  ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local ubuntu_root
   ubuntu_root="$(_droid_detect_ubuntu_root)"

package/karnel/tools/ai/freebuff/install.sh

@@ -9,6 +9,13 @@ install_freebuff() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Freebuff)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Freebuff..."
   npm install -g freebuff || {
     log_error "Failed to install Freebuff"

package/karnel/tools/ai/goose/install.sh

@@ -196,6 +196,7 @@ _goose_download_binary_proot_impl() {
     log_error "Failed to download Goose CLI"
     return 1
   fi
+  verify_github_release_asset aaif-goose/goose "v${latest_version}" "$tarball" "$GOOSE_DATA_DIR/$tarball" || return 1
   if ! tar -xzf "$GOOSE_DATA_DIR/$tarball" -C "$GOOSE_DATA_DIR" &>>"$LOG_FILE"; then
     rm -f "$GOOSE_DATA_DIR/$tarball"
     log_error "Failed to extract Goose CLI"

package/karnel/tools/ai/keelcode/install.sh

@@ -117,6 +117,13 @@ install_keelcode() {
   fi
   _keelcode_verify_ownership || return 1
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by KeelCode)"
+      return 1
+    fi
+  fi
+
   log_info "Installing KeelCode..."
   local output rc
   output="$(npm install -g "$KEELCODE_PACKAGE" --force 2>&1)"

package/karnel/tools/ai/kimchi-code/install.sh

@@ -262,9 +262,15 @@ _kimchi_ubuntu_install_bin() {
 
   local download_url="https://github.com/getkimchi/kimchi/releases/download/$latest_version/kimchi_linux_arm64.tar.gz"
 
-  _kimchi_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 getkimchi/kimchi "$latest_version" "kimchi_linux_arm64.tar.gz") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Kimchi; skipping integrity verification"
+  fi
+  _kimchi_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/kimchi-install &&
-    curl -fsSL '$download_url' -o /tmp/kimchi-install/kimchi.tar.gz &&
+    curl -fsSL "$1" -o /tmp/kimchi-install/kimchi.tar.gz &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/kimchi-install/kimchi.tar.gz | awk "{print \$1}")" = "$2" ]; } &&
     tar -zxf /tmp/kimchi-install/kimchi.tar.gz -C /tmp/kimchi-install &&
     mkdir -p /usr/local/bin /usr/local/share &&
     mv /tmp/kimchi-install/bin/kimchi /usr/local/bin/kimchi &&
@@ -272,7 +278,7 @@ _kimchi_ubuntu_install_bin() {
     rm -rf /usr/local/share/kimchi &&
     mv /tmp/kimchi-install/share/kimchi /usr/local/share/kimchi &&
     rm -rf /tmp/kimchi-install
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
 
   local kimchi_bin
   kimchi_bin="$(_kimchi_detect_ubuntu_root)/usr/local/bin/kimchi"

package/karnel/tools/ai/oh-my-pi/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_ai.log"
 OMP_DATA_DIR="$HOME/.local/share/karnel-data/oh-my-pi"
@@ -85,8 +86,16 @@ _download_omp_binary_impl() {
     log_error "Failed to download Oh-My-Pi binary"
     return 1
   fi
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$target_dir/omp" "$expected" || return 1
+  else
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
   chmod +x "$target_dir/omp"
   echo "$latest_version" > "$target_dir/version"
+  : > "$target_dir/.karnel-managed"
   return 0
 }
 
@@ -160,15 +169,21 @@ _install_omp_proot_impl() {
     return 1
   fi
   local download_url="https://github.com/can1357/oh-my-pi/releases/download/$latest_version/omp-linux-arm64"
-  if ! _omp_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
+  if ! _omp_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/omp-install &&
-    curl -fsSL '$download_url' -o /tmp/omp-install/omp &&
+    curl -fsSL "$1" -o /tmp/omp-install/omp &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/omp-install/omp | awk "{print \$1}")" = "$2" ]; } &&
     chmod +x /tmp/omp-install/omp &&
     test -x /tmp/omp-install/omp &&
     mkdir -p /usr/local/bin &&
     mv /tmp/omp-install/omp /usr/local/bin/omp &&
     rm -rf /tmp/omp-install
-  " &>>"$LOG_FILE"; then
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"; then
     log_error "Failed to install Oh-My-Pi binary"
     return 1
   fi
@@ -209,6 +224,10 @@ install_oh_my_pi() {
 }
 
 _uninstall_omp_native_impl() {
+  if [[ ! -f "$OMP_DATA_DIR/.karnel-managed" ]]; then
+    log_error "Refusing to remove an Oh-My-Pi installation that is not managed by Karnel"
+    return 1
+  fi
   rm -f "$PREFIX/bin/omp"
   rm -rf "$OMP_DATA_DIR"
 }
@@ -256,14 +275,20 @@ _update_omp_proot_impl() {
     return 1
   fi
   local download_url="https://github.com/can1357/oh-my-pi/releases/download/$latest_version/omp-linux-arm64"
-  if ! _omp_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
+  if ! _omp_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/omp-update &&
-    curl -fsSL '$download_url' -o /tmp/omp-update/omp &&
+    curl -fsSL "$1" -o /tmp/omp-update/omp &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/omp-update/omp | awk "{print \$1}")" = "$2" ]; } &&
     chmod +x /tmp/omp-update/omp &&
     test -x /tmp/omp-update/omp &&
     mv /tmp/omp-update/omp /usr/local/bin/omp &&
     rm -rf /tmp/omp-update
-  " &>>"$LOG_FILE"; then
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"; then
     log_error "Failed to update Oh-My-Pi binary"
     return 1
   fi

package/karnel/tools/ai/omni-route/install.sh

@@ -127,6 +127,13 @@ install_omni_route() {
     fi
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by omniRoute)"
+      return 1
+    fi
+  fi
+
   log_info "Installing omniRoute (this may take a while)..."
   if command -v npm >/dev/null 2>&1 && npm i karnelroute --prefix "$OMNI_ROUTE_PKG" 2>>"$LOG_FILE"; then
     sed -i '1s|^#!/usr/bin/env node|#!'"$PREFIX"'/bin/node|' "$OMNI_ROUTE_LOCAL_BIN" 2>/dev/null

package/karnel/tools/ai/openspec/install.sh

@@ -13,6 +13,13 @@ install_openspec() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by openspec)"
+      return 1
+    fi
+  fi
+
   log_info "Installing openspec (Spec-Driven Development framework)..."
   npm install -g @fission-ai/openspec@latest 2>/dev/null
   local rc=$?

package/karnel/tools/ai/puter/install.sh

@@ -12,6 +12,13 @@ install_puter() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Puter CLI)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Puter CLI..."
   if ! npm install -g "$PUTER_PACKAGE" &>>"$PUTER_LOG_FILE"; then
     log_error "Failed to install Puter CLI; see $PUTER_LOG_FILE"

package/karnel/tools/ai/supercode-cli/install.sh

@@ -8,6 +8,13 @@ install_supercode_cli() {
     log_info "Supercode CLI is already installed"
     return 2
   fi
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Supercode CLI)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Supercode CLI..."
   local output rc
   output="$(npm install -g supercode-cli 2>&1)"

package/karnel/tools/db/redis/install.sh

@@ -50,7 +50,10 @@ _update_redis_impl() {
 
 _do_redis_update() {
 	mkdir -p "$(dirname "$LOG_FILE")"
-	pkg upgrade redis -y &>>"$LOG_FILE"
+	if ! pkg upgrade redis -y &>>"$LOG_FILE"; then
+		log_error "Falha ao atualizar Redis"
+		return 1
+	fi
 }
 
 update_redis() {

package/karnel/tools/deploy/netlify/install.sh

@@ -15,6 +15,13 @@ install_netlify() {
   if command -v netlify &>/dev/null && netlify --version &>/dev/null; then
     log_info "Netlify CLI is already installed"
     return 2
+  fi
+  if ! command -v node &>/dev/null || ! command -v npm &>/dev/null; then
+    log_info "Installing Node.js..."
+    if ! pkg install -y nodejs-lts &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js"
+      return 1
+    fi
   fi
 	if ! _netlify_node_supported; then
 		log_error "Netlify CLI requires Node.js 22.13.0 or newer. Update Node.js and retry."

package/karnel/tools/deploy/railway/install.sh

@@ -185,6 +185,15 @@ uninstall_railway() {
 }
 
 update_railway() {
+  if _railway_proot_wrapper_owned; then
+    log_info "Railway was installed via Ubuntu PRoot; updating inside the container..."
+    if proot-distro login ubuntu -- npm update -g @railway/cli &>>"$LOG_FILE"; then
+      log_success "Railway CLI updated through Ubuntu Proot"
+      return 0
+    fi
+    log_warn "Railway CLI update failed inside Ubuntu Proot"
+    return 1
+  fi
   _check_update_needed "Railway CLI" "$(_get_installed_npm_version @railway/cli)" "$(_get_remote_npm_version @railway/cli)" _do_update_railway
 }
 

package/karnel/tools/deploy/vercel/install.sh

@@ -10,6 +10,13 @@ install_vercel() {
     log_info "Vercel CLI is already installed"
     return 2
   fi
+  if ! command -v node &>/dev/null || ! command -v npm &>/dev/null; then
+    log_info "Installing Node.js..."
+    if ! pkg install -y nodejs-lts &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js"
+      return 1
+    fi
+  fi
   log_info "Installing Vercel CLI..."
   npm install -g vercel &>/dev/null || {
     log_error "Failed to install Vercel CLI"

package/karnel/tools/dev/openssh/install.sh

@@ -62,7 +62,10 @@ _update_openssh_pkg() {
 
 _do_openssh_update() {
   mkdir -p "$(dirname "$LOG_FILE")"
-  yes | pkg upgrade openssh -y &>>"$LOG_FILE"
+  if ! yes | pkg upgrade openssh -y &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar OpenSSH"
+    return 1
+  fi
 }
 
 update_openssh() {

package/karnel/tools/dev/tmux/install.sh

@@ -62,7 +62,10 @@ _update_tmux_pkg() {
 
 _do_tmux_update() {
   mkdir -p "$(dirname "$LOG_FILE")"
-  yes | pkg upgrade tmux -y &>>"$LOG_FILE"
+  if ! yes | pkg upgrade tmux -y &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar Tmux"
+    return 1
+  fi
 }
 
 update_tmux() {

package/karnel/tools/lang/bun/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_lang.log"
 BUN_DATA_DIR="$KARNEL_DATA/bun"
@@ -268,16 +269,22 @@ _install_bun_proot_impl() {
   _bun_proot_ubuntu /bin/bash -c \
     'apt-get update && apt-get upgrade -y && apt-get install -y curl ca-certificates unzip' \
     &>>"$LOG_FILE"
-  _bun_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 "$BUN_REPO" "bun-v$version" "bun-linux-aarch64.zip") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Bun; skipping integrity verification"
+  fi
+  _bun_proot_ubuntu /bin/bash -c '
     export HOME=/root TMPDIR=/tmp
     cd /tmp &&
-    curl -fsSL '$download_url' -o bun.zip &&
+    curl -fsSL "$1" -o bun.zip &&
+    { [ -z "$2" ] || [ "$(sha256sum bun.zip | awk "{print \$1}")" = "$2" ]; } &&
     unzip -o bun.zip >/dev/null 2>&1 &&
     mkdir -p /usr/local/bin &&
     mv bun-linux-aarch64/bun /usr/local/bin/bun &&
     chmod +x /usr/local/bin/bun &&
     rm -rf bun.zip bun-linux-aarch64
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
   local ubuntu_root
   ubuntu_root="$(_bun_detect_ubuntu_root)"
   if [ -z "$ubuntu_root" ]; then
@@ -296,6 +303,7 @@ _install_bun_proot_impl() {
   fi
   sed "s|__UBUNTU_ROOTFS__|$ubuntu_root|g" "$wrapper_src" >"$PREFIX/bin/bun"
   chmod +x "$PREFIX/bin/bun"
+  mkdir -p "$BUN_DATA_DIR" && : >"$BUN_DATA_DIR/.karnel-proot"
   return 0
 }
 
@@ -339,7 +347,12 @@ _uninstall_bun_impl() {
     _uninstall_bun_native
     return $?
   fi
-  _uninstall_bun_proot
+  if [ -f "$BUN_DATA_DIR/.karnel-proot" ]; then
+    _uninstall_bun_proot
+    return $?
+  fi
+  log_error "Refusing to remove unowned bun command: $PREFIX/bin/bun"
+  return 1
 }
 
 uninstall_bun() {
@@ -368,16 +381,22 @@ _update_bun_proot() {
   fi
   local download_url="https://github.com/$BUN_REPO/releases/download/bun-v$version/bun-linux-aarch64.zip"
   _bun_proot_ubuntu /bin/bash -c 'rm -f /usr/local/bin/bun' &>>"$LOG_FILE"
-  _bun_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 "$BUN_REPO" "bun-v$version" "bun-linux-aarch64.zip") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Bun; skipping integrity verification"
+  fi
+  _bun_proot_ubuntu /bin/bash -c '
     export HOME=/root TMPDIR=/tmp
     cd /tmp &&
-    curl -fsSL '$download_url' -o bun.zip &&
+    curl -fsSL "$1" -o bun.zip &&
+    { [ -z "$2" ] || [ "$(sha256sum bun.zip | awk "{print \$1}")" = "$2" ]; } &&
     unzip -o bun.zip >/dev/null 2>&1 &&
     mkdir -p /usr/local/bin &&
     mv bun-linux-aarch64/bun /usr/local/bin/bun &&
     chmod +x /usr/local/bin/bun &&
     rm -rf bun.zip bun-linux-aarch64
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
   local ubuntu_root
   ubuntu_root="$(_bun_detect_ubuntu_root)"
   local bun_bin="$ubuntu_root/usr/local/bin/bun"

package/karnel/tools/npm/turbopack/install.sh

@@ -178,8 +178,8 @@ install_turbopack() {
 
 uninstall_turbopack() {
 	if ! _has_glibc_node; then
-		log_warn "Turbopack is not installed"
-		return 1
+		log_info "Turbopack is not installed"
+		return 2
 	fi
 
 	loading "Removing CLI wrappers" _uninstall_wrappers

package/karnel/tools/osint/robin/install.sh

@@ -493,10 +493,14 @@ uninstall_robin() {
     return 2
   fi
 
+  if [[ ! -f "$ROBIN_ROOT/.managed-by-karnel" ]]; then
+    log_error "Robin at $ROBIN_ROOT is not managed by Karnel; refusing to remove it to avoid deleting unrelated data"
+    return 1
+  fi
+
   _robin_acquire_lock || return 1
   local rc=0
-  _robin_migrate_legacy_layout || rc=$?
-  if (( rc == 0 )) && _robin_runtime_active; then
+  if _robin_runtime_active; then
     log_error "Stop Robin before uninstalling it: karnel robin stop"
     rc=1
   fi

package/karnel/tools/security/amass/install.sh

@@ -24,10 +24,17 @@ install_amass() (
   log_info "Instalando amass..."
   if [ ! -f "$_AMASS_MARKER" ] &&
     { pkg install -y amass 2>/dev/null || apt install -y amass 2>/dev/null; }; then
+    local bin; bin="$(command -v amass)"
+    [ -n "$bin" ] && sha256sum "$bin" > "$_AMASS_MARKER" 2>/dev/null
     log_success "amass instalado"
     return 0
   fi
 
+  command -v unzip >/dev/null 2>&1 || pkg install -y unzip >/dev/null 2>&1 || {
+    log_error "unzip indisponível; não foi possível extrair amass"
+    return 1
+  }
+
   local arch asset checksum url tmpdir archive amass_bin staged_bin
   arch=$(_amass_arch) || { log_error "Arquitetura não suportada"; return 1; }
   [[ "$arch" == armv7 ]] && arch="arm"

package/karnel/tools/security/subfinder/install.sh

@@ -24,10 +24,17 @@ install_subfinder() (
   log_info "Instalando subfinder..."
   if [ ! -f "$_SUBFINDER_MARKER" ] &&
     { pkg install -y subfinder 2>/dev/null || apt install -y subfinder 2>/dev/null; }; then
+    local bin; bin="$(command -v subfinder)"
+    [ -n "$bin" ] && sha256sum "$bin" > "$_SUBFINDER_MARKER" 2>/dev/null
     log_success "subfinder instalado"
     return 0
   fi
 
+  command -v unzip >/dev/null 2>&1 || pkg install -y unzip >/dev/null 2>&1 || {
+    log_error "unzip indisponível; não foi possível extrair subfinder"
+    return 1
+  }
+
   local arch asset checksum url tmpdir archive staged_bin
   arch=$(_subfinder_arch) || { log_error "Arquitetura não suportada"; return 1; }
   [[ "$arch" == armv7 ]] && arch="arm"

package/karnel/tools/shell/zsh-defer/install.sh

@@ -60,7 +60,7 @@ install_zsh_defer() {
 _uninstall_zsh_defer_impl() {
   if [[ ! -d "$ZSH_PLUGINS_DIR/zsh-defer" ]]; then
     log_info "zsh-defer is not installed"
-    return 2
+    return 0
   fi
 
   local remove_rc=0

package/karnel/utils/install.sh

@@ -269,8 +269,14 @@ managed_file_matches() {
 
 github_download_and_extract() {
   local repo="$1" version="$2" asset="$3" outdir="$4"
-  local tarball
+  local tarball expected
   tarball=$(github_download_release "$repo" "$version" "$asset" "$outdir") || return 1
+  expected=$(github_release_asset_sha256 "$repo" "$version" "$asset") || expected=""
+  if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$tarball" "$expected" || return 1
+  else
+    log_warn "No published SHA-256 digest for $repo/$asset; skipping integrity verification"
+  fi
   extract_tarball "$tarball" "$outdir" || return 1
   return 0
 }

package/karnel/utils/tools.sh

@@ -106,6 +106,10 @@ _batch_tool_action() {
   local failed_count=0
   local skipped_count=0
 
+  # An explicit uninstall should actually remove owned data, even when no TTY
+  # is attached (piped/non-interactive). Ownership is still guarded upstream.
+  [[ "$action" == "uninstall" ]] && export KARNEL_REMOVE_DEFAULT=y
+
   import "@/tools/$module/all"
 
   for tool in "${tools[@]}"; do

package/karnel/utils/uninstall.sh

@@ -3,6 +3,7 @@
 confirm_remove_paths() {
   local label="$1"
   shift
+  local default="${KARNEL_REMOVE_DEFAULT:-n}"
   local answer path
   local -a existing=()
 
@@ -11,7 +12,7 @@ confirm_remove_paths() {
   done
   (( ${#existing[@]} > 0 )) || return 0
 
-  read_confirm_default "Remove $label configuration and data?" "n" answer || return 2
+  read_confirm_default "Remove $label configuration and data?" "$default" answer || return 2
   [[ "$answer" == "y" ]] || return 2
 
   rm -rf -- "${existing[@]}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.0",
+  "version": "4.17.2",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"