karnel-termux 4.17.1 → 4.17.3

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-c9797260b1affd17127bf2b1e5c22c1cf184adb1
+5b88c3c7229d293e0e92665c71bcb3501a87ed74

package/karnel/cli/commands/backup.sh

@@ -10,7 +10,7 @@ mkdir -p "$BACKUP_DIR"
 
 backup_main() {
   local cmd="${1:-}"
-  shift 2>/dev/null || true
+  shift || true
 
   case "$cmd" in
     --help|-h)      backup_help ;;

package/karnel/cli/commands/supabase.sh

@@ -5,7 +5,7 @@ import "@/utils/colors"
 
 supabase_main() {
   local subcommand="${1:-help}"
-  shift 2>/dev/null || true
+  shift || true
 
   case "$subcommand" in
     help|--help|-h)

package/karnel/tools/ai/antigravity-cli/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_ai.log"
 AGY_DATA_DIR="$HOME/.local/share/karnel-data/antigravity-cli"
@@ -63,17 +64,22 @@ _antigravity_download_binary() {
 }
 
 _antigravity_download_binary_impl() {
-  local latest_version
-  latest_version=$(_antigravity_get_latest_version)
-  if [ -z "$latest_version" ]; then
-    log_error "Failed to fetch latest Antigravity version"
+  local manifest
+  manifest=$(curl -fsSL "$MANIFEST_URL") || {
+    log_error "Failed to fetch Antigravity CLI manifest"
+    return 1
+  }
+  local latest_version download_url manifest_sha256
+  latest_version=$(printf '%s' "$manifest" | jq -r .version)
+  download_url=$(printf '%s' "$manifest" | jq -r .url)
+  manifest_sha256=$(printf '%s' "$manifest" | jq -r '.sha256 // empty')
+  if [ -z "$latest_version" ] || [ -z "$download_url" ]; then
+    log_error "Failed to parse Antigravity CLI manifest"
     return 1
   fi
 
   mkdir -p "$AGY_DATA_DIR"
 
-  local download_url
-  download_url=$(_antigravity_get_download_url)
   local tarball="$AGY_DATA_DIR/agy.tar.gz"
 
   if ! curl -fsSL -o "$tarball" "$download_url" &>>"$LOG_FILE"; then
@@ -81,6 +87,12 @@ _antigravity_download_binary_impl() {
     return 1
   fi
 
+  if [[ "$manifest_sha256" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$tarball" "$manifest_sha256" || return 1
+  else
+    log_warn "Antigravity CLI manifest does not publish a SHA-256; skipping integrity verification"
+  fi
+
   if ! tar -xzf "$tarball" -C "$AGY_DATA_DIR" &>>"$LOG_FILE"; then
     log_error "Failed to extract Antigravity CLI binary"
     return 1

package/karnel/tools/ai/cline/install.sh

@@ -83,6 +83,20 @@ _cline_install_global_impl() {
     return 1
   fi
 
+  local expected actual
+  expected=$(npm view "@cline/cli-linux-arm64@$version" dist.integrity 2>/dev/null)
+  if [[ -z "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Falha ao obter a integridade do binário do Cline no registry npm"
+    return 1
+  fi
+  actual=$(node -e 'const c=require("crypto");const h=c.createHash("sha512");h.update(require("fs").readFileSync(process.argv[1]));process.stdout.write("sha512-"+h.digest("base64"))' "$tarball" 2>/dev/null) || actual=""
+  if [[ "$actual" != "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Integridade do binário do Cline não confere (esperado $expected)"
+    return 1
+  fi
+
   mkdir -p "$CLINE_DATA_DIR"
   : >"$CLINE_DATA_DIR/$CLINE_MARKER"
   if ! tar -xzf "$tarball" -C "$CLINE_DATA_DIR" &>>"$LOG_FILE"; then

package/karnel/tools/ai/ctx7/install.sh

@@ -13,6 +13,13 @@ install_ctx7() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by ctx7)"
+      return 1
+    fi
+  fi
+
   log_info "Installing ctx7 (Context7 documentation provider)..."
   npm install -g ctx7 2>/dev/null
   local rc=$?

package/karnel/tools/ai/droid/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 import "@/utils/uninstall"
 
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
@@ -239,14 +240,20 @@ _droid_ubuntu_install_bin() {
 
   local binary_url="https://downloads.factory.ai/factory-cli/releases/$latest_version/linux/arm64/droid"
 
-  _droid_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(curl -fsSL "$binary_url.sha256" 2>/dev/null | awk '{print $1}') || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Droid; skipping integrity verification"
+  fi
+  _droid_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/droid-install &&
-    curl -fsSL '$binary_url' -o /tmp/droid-install/droid &&
+    curl -fsSL "$1" -o /tmp/droid-install/droid &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-install/droid | awk "{print \$1}")" = "$2" ]; } &&
     mkdir -p /usr/local/bin &&
     mv /tmp/droid-install/droid /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
     rm -rf /tmp/droid-install
-  " &>>"$LOG_FILE"
+  ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local droid_bin="$(_droid_detect_ubuntu_root)/usr/local/bin/droid"
   if [ ! -f "$droid_bin" ]; then
@@ -413,14 +420,20 @@ _update_droid_proot_impl() {
 
   local binary_url="https://downloads.factory.ai/factory-cli/releases/$latest_version/linux/arm64/droid"
 
-  _droid_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(curl -fsSL "$binary_url.sha256" 2>/dev/null | awk '{print $1}') || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Droid; skipping integrity verification"
+  fi
+  _droid_proot_ubuntu /bin/bash -c '
     rm -f /usr/local/bin/droid &&
     mkdir -p /tmp/droid-update &&
-    curl -fsSL '$binary_url' -o /tmp/droid-update/droid &&
+    curl -fsSL "$1" -o /tmp/droid-update/droid &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-update/droid | awk "{print \$1}")" = "$2" ]; } &&
     mv /tmp/droid-update/droid /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
     rm -rf /tmp/droid-update
-  " &>>"$LOG_FILE"
+  ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local ubuntu_root
   ubuntu_root="$(_droid_detect_ubuntu_root)"

package/karnel/tools/ai/freebuff/install.sh

@@ -9,6 +9,13 @@ install_freebuff() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Freebuff)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Freebuff..."
   npm install -g freebuff || {
     log_error "Failed to install Freebuff"

package/karnel/tools/ai/goose/install.sh

@@ -196,6 +196,7 @@ _goose_download_binary_proot_impl() {
     log_error "Failed to download Goose CLI"
     return 1
   fi
+  verify_github_release_asset aaif-goose/goose "v${latest_version}" "$tarball" "$GOOSE_DATA_DIR/$tarball" || return 1
   if ! tar -xzf "$GOOSE_DATA_DIR/$tarball" -C "$GOOSE_DATA_DIR" &>>"$LOG_FILE"; then
     rm -f "$GOOSE_DATA_DIR/$tarball"
     log_error "Failed to extract Goose CLI"

package/karnel/tools/ai/keelcode/install.sh

@@ -117,6 +117,13 @@ install_keelcode() {
   fi
   _keelcode_verify_ownership || return 1
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by KeelCode)"
+      return 1
+    fi
+  fi
+
   log_info "Installing KeelCode..."
   local output rc
   output="$(npm install -g "$KEELCODE_PACKAGE" --force 2>&1)"

package/karnel/tools/ai/kimchi-code/install.sh

@@ -262,9 +262,15 @@ _kimchi_ubuntu_install_bin() {
 
   local download_url="https://github.com/getkimchi/kimchi/releases/download/$latest_version/kimchi_linux_arm64.tar.gz"
 
-  _kimchi_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 getkimchi/kimchi "$latest_version" "kimchi_linux_arm64.tar.gz") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Kimchi; skipping integrity verification"
+  fi
+  _kimchi_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/kimchi-install &&
-    curl -fsSL '$download_url' -o /tmp/kimchi-install/kimchi.tar.gz &&
+    curl -fsSL "$1" -o /tmp/kimchi-install/kimchi.tar.gz &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/kimchi-install/kimchi.tar.gz | awk "{print \$1}")" = "$2" ]; } &&
     tar -zxf /tmp/kimchi-install/kimchi.tar.gz -C /tmp/kimchi-install &&
     mkdir -p /usr/local/bin /usr/local/share &&
     mv /tmp/kimchi-install/bin/kimchi /usr/local/bin/kimchi &&
@@ -272,7 +278,7 @@ _kimchi_ubuntu_install_bin() {
     rm -rf /usr/local/share/kimchi &&
     mv /tmp/kimchi-install/share/kimchi /usr/local/share/kimchi &&
     rm -rf /tmp/kimchi-install
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
 
   local kimchi_bin
   kimchi_bin="$(_kimchi_detect_ubuntu_root)/usr/local/bin/kimchi"
@@ -479,9 +485,15 @@ _update_kimchi_proot_impl() {
 
   local download_url="https://github.com/getkimchi/kimchi/releases/download/$latest_version/kimchi_linux_arm64.tar.gz"
 
-  _kimchi_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 getkimchi/kimchi "$latest_version" "kimchi_linux_arm64.tar.gz") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Kimchi; skipping integrity verification"
+  fi
+  _kimchi_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/kimchi-install &&
-    curl -fsSL '$download_url' -o /tmp/kimchi-install/kimchi.tar.gz &&
+    curl -fsSL "$1" -o /tmp/kimchi-install/kimchi.tar.gz &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/kimchi-install/kimchi.tar.gz | awk "{print \$1}")" = "$2" ]; } &&
     tar -zxf /tmp/kimchi-install/kimchi.tar.gz -C /tmp/kimchi-install &&
     rm -f /usr/local/bin/kimchi &&
     mv /tmp/kimchi-install/bin/kimchi /usr/local/bin/kimchi &&
@@ -489,7 +501,7 @@ _update_kimchi_proot_impl() {
     rm -rf /usr/local/share/kimchi &&
     mv /tmp/kimchi-install/share/kimchi /usr/local/share/kimchi &&
     rm -rf /tmp/kimchi-install
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
 
   local kimchi_bin
   kimchi_bin="$(_kimchi_detect_ubuntu_root)/usr/local/bin/kimchi"

package/karnel/tools/ai/oh-my-pi/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_ai.log"
 OMP_DATA_DIR="$HOME/.local/share/karnel-data/oh-my-pi"
@@ -85,8 +86,16 @@ _download_omp_binary_impl() {
     log_error "Failed to download Oh-My-Pi binary"
     return 1
   fi
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$target_dir/omp" "$expected" || return 1
+  else
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
   chmod +x "$target_dir/omp"
   echo "$latest_version" > "$target_dir/version"
+  : > "$target_dir/.karnel-managed"
   return 0
 }
 
@@ -160,15 +169,21 @@ _install_omp_proot_impl() {
     return 1
   fi
   local download_url="https://github.com/can1357/oh-my-pi/releases/download/$latest_version/omp-linux-arm64"
-  if ! _omp_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
+  if ! _omp_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/omp-install &&
-    curl -fsSL '$download_url' -o /tmp/omp-install/omp &&
+    curl -fsSL "$1" -o /tmp/omp-install/omp &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/omp-install/omp | awk "{print \$1}")" = "$2" ]; } &&
     chmod +x /tmp/omp-install/omp &&
     test -x /tmp/omp-install/omp &&
     mkdir -p /usr/local/bin &&
     mv /tmp/omp-install/omp /usr/local/bin/omp &&
     rm -rf /tmp/omp-install
-  " &>>"$LOG_FILE"; then
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"; then
     log_error "Failed to install Oh-My-Pi binary"
     return 1
   fi
@@ -209,6 +224,10 @@ install_oh_my_pi() {
 }
 
 _uninstall_omp_native_impl() {
+  if [[ ! -f "$OMP_DATA_DIR/.karnel-managed" ]]; then
+    log_error "Refusing to remove an Oh-My-Pi installation that is not managed by Karnel"
+    return 1
+  fi
   rm -f "$PREFIX/bin/omp"
   rm -rf "$OMP_DATA_DIR"
 }
@@ -256,14 +275,20 @@ _update_omp_proot_impl() {
     return 1
   fi
   local download_url="https://github.com/can1357/oh-my-pi/releases/download/$latest_version/omp-linux-arm64"
-  if ! _omp_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 can1357/oh-my-pi "$latest_version" "omp-linux-arm64") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Oh-My-Pi; skipping integrity verification"
+  fi
+  if ! _omp_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/omp-update &&
-    curl -fsSL '$download_url' -o /tmp/omp-update/omp &&
+    curl -fsSL "$1" -o /tmp/omp-update/omp &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/omp-update/omp | awk "{print \$1}")" = "$2" ]; } &&
     chmod +x /tmp/omp-update/omp &&
     test -x /tmp/omp-update/omp &&
     mv /tmp/omp-update/omp /usr/local/bin/omp &&
     rm -rf /tmp/omp-update
-  " &>>"$LOG_FILE"; then
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"; then
     log_error "Failed to update Oh-My-Pi binary"
     return 1
   fi

package/karnel/tools/ai/omni-route/install.sh

@@ -127,6 +127,13 @@ install_omni_route() {
     fi
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by omniRoute)"
+      return 1
+    fi
+  fi
+
   log_info "Installing omniRoute (this may take a while)..."
   if command -v npm >/dev/null 2>&1 && npm i karnelroute --prefix "$OMNI_ROUTE_PKG" 2>>"$LOG_FILE"; then
     sed -i '1s|^#!/usr/bin/env node|#!'"$PREFIX"'/bin/node|' "$OMNI_ROUTE_LOCAL_BIN" 2>/dev/null

package/karnel/tools/ai/openspec/install.sh

@@ -13,6 +13,13 @@ install_openspec() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by openspec)"
+      return 1
+    fi
+  fi
+
   log_info "Installing openspec (Spec-Driven Development framework)..."
   npm install -g @fission-ai/openspec@latest 2>/dev/null
   local rc=$?

package/karnel/tools/ai/puter/install.sh

@@ -12,6 +12,13 @@ install_puter() {
     return 2
   fi
 
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Puter CLI)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Puter CLI..."
   if ! npm install -g "$PUTER_PACKAGE" &>>"$PUTER_LOG_FILE"; then
     log_error "Failed to install Puter CLI; see $PUTER_LOG_FILE"

package/karnel/tools/ai/supercode-cli/install.sh

@@ -8,6 +8,13 @@ install_supercode_cli() {
     log_info "Supercode CLI is already installed"
     return 2
   fi
+  if ! command -v npm &>/dev/null; then
+    if ! pkg install nodejs-lts -y &>>"$LOG_FILE"; then
+      log_error "Failed to install Node.js (required by Supercode CLI)"
+      return 1
+    fi
+  fi
+
   log_info "Installing Supercode CLI..."
   local output rc
   output="$(npm install -g supercode-cli 2>&1)"

package/karnel/tools/db/redis/install.sh

@@ -50,7 +50,10 @@ _update_redis_impl() {
 
 _do_redis_update() {
 	mkdir -p "$(dirname "$LOG_FILE")"
-	pkg upgrade redis -y &>>"$LOG_FILE"
+	if ! pkg upgrade redis -y &>>"$LOG_FILE"; then
+		log_error "Falha ao atualizar Redis"
+		return 1
+	fi
 }
 
 update_redis() {

package/karnel/tools/dev/openssh/install.sh

@@ -62,7 +62,10 @@ _update_openssh_pkg() {
 
 _do_openssh_update() {
   mkdir -p "$(dirname "$LOG_FILE")"
-  yes | pkg upgrade openssh -y &>>"$LOG_FILE"
+  if ! yes | pkg upgrade openssh -y &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar OpenSSH"
+    return 1
+  fi
 }
 
 update_openssh() {

package/karnel/tools/dev/tmux/install.sh

@@ -62,7 +62,10 @@ _update_tmux_pkg() {
 
 _do_tmux_update() {
   mkdir -p "$(dirname "$LOG_FILE")"
-  yes | pkg upgrade tmux -y &>>"$LOG_FILE"
+  if ! yes | pkg upgrade tmux -y &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar Tmux"
+    return 1
+  fi
 }
 
 update_tmux() {

package/karnel/tools/lang/bun/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_lang.log"
 BUN_DATA_DIR="$KARNEL_DATA/bun"
@@ -268,16 +269,22 @@ _install_bun_proot_impl() {
   _bun_proot_ubuntu /bin/bash -c \
     'apt-get update && apt-get upgrade -y && apt-get install -y curl ca-certificates unzip' \
     &>>"$LOG_FILE"
-  _bun_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 "$BUN_REPO" "bun-v$version" "bun-linux-aarch64.zip") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Bun; skipping integrity verification"
+  fi
+  _bun_proot_ubuntu /bin/bash -c '
     export HOME=/root TMPDIR=/tmp
     cd /tmp &&
-    curl -fsSL '$download_url' -o bun.zip &&
+    curl -fsSL "$1" -o bun.zip &&
+    { [ -z "$2" ] || [ "$(sha256sum bun.zip | awk "{print \$1}")" = "$2" ]; } &&
     unzip -o bun.zip >/dev/null 2>&1 &&
     mkdir -p /usr/local/bin &&
     mv bun-linux-aarch64/bun /usr/local/bin/bun &&
     chmod +x /usr/local/bin/bun &&
     rm -rf bun.zip bun-linux-aarch64
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
   local ubuntu_root
   ubuntu_root="$(_bun_detect_ubuntu_root)"
   if [ -z "$ubuntu_root" ]; then
@@ -374,16 +381,22 @@ _update_bun_proot() {
   fi
   local download_url="https://github.com/$BUN_REPO/releases/download/bun-v$version/bun-linux-aarch64.zip"
   _bun_proot_ubuntu /bin/bash -c 'rm -f /usr/local/bin/bun' &>>"$LOG_FILE"
-  _bun_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 "$BUN_REPO" "bun-v$version" "bun-linux-aarch64.zip") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Bun; skipping integrity verification"
+  fi
+  _bun_proot_ubuntu /bin/bash -c '
     export HOME=/root TMPDIR=/tmp
     cd /tmp &&
-    curl -fsSL '$download_url' -o bun.zip &&
+    curl -fsSL "$1" -o bun.zip &&
+    { [ -z "$2" ] || [ "$(sha256sum bun.zip | awk "{print \$1}")" = "$2" ]; } &&
     unzip -o bun.zip >/dev/null 2>&1 &&
     mkdir -p /usr/local/bin &&
     mv bun-linux-aarch64/bun /usr/local/bin/bun &&
     chmod +x /usr/local/bin/bun &&
     rm -rf bun.zip bun-linux-aarch64
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
   local ubuntu_root
   ubuntu_root="$(_bun_detect_ubuntu_root)"
   local bun_bin="$ubuntu_root/usr/local/bin/bun"

package/karnel/tools/npm/turbopack/install.sh

@@ -39,6 +39,17 @@ _install_deps_impl() {
 		fi
 	done
 
+	if [[ ! -f "$GLIBC_LIBDIR/ld-linux-aarch64.so.1" ]]; then
+		if ! yes | pkg install glibc-repo &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc-repo"
+			return 1
+		fi
+		if ! yes | pkg install glibc &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc (required by the glibc-linked Node.js)"
+			return 1
+		fi
+	fi
+
 	return 0
 }
 

package/karnel/tools/osint/robin/install.sh

@@ -493,10 +493,14 @@ uninstall_robin() {
     return 2
   fi
 
+  if [[ ! -f "$ROBIN_ROOT/.managed-by-karnel" ]]; then
+    log_error "Robin at $ROBIN_ROOT is not managed by Karnel; refusing to remove it to avoid deleting unrelated data"
+    return 1
+  fi
+
   _robin_acquire_lock || return 1
   local rc=0
-  _robin_migrate_legacy_layout || rc=$?
-  if (( rc == 0 )) && _robin_runtime_active; then
+  if _robin_runtime_active; then
     log_error "Stop Robin before uninstalling it: karnel robin stop"
     rc=1
   fi

package/karnel/tools/security/amass/install.sh

@@ -24,10 +24,17 @@ install_amass() (
   log_info "Instalando amass..."
   if [ ! -f "$_AMASS_MARKER" ] &&
     { pkg install -y amass 2>/dev/null || apt install -y amass 2>/dev/null; }; then
+    local bin; bin="$(command -v amass)"
+    [ -n "$bin" ] && sha256sum "$bin" > "$_AMASS_MARKER" 2>/dev/null
     log_success "amass instalado"
     return 0
   fi
 
+  command -v unzip >/dev/null 2>&1 || pkg install -y unzip >/dev/null 2>&1 || {
+    log_error "unzip indisponível; não foi possível extrair amass"
+    return 1
+  }
+
   local arch asset checksum url tmpdir archive amass_bin staged_bin
   arch=$(_amass_arch) || { log_error "Arquitetura não suportada"; return 1; }
   [[ "$arch" == armv7 ]] && arch="arm"

package/karnel/tools/security/dnsrecon/install.sh

@@ -14,6 +14,10 @@ install_dnsrecon() {
     log_success "dnsrecon instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o dnsrecon via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_DNSRECON_REPO" "$_DNSRECON_COMMIT" "$_DNSRECON_DIR"; then
     pip install -r "$_DNSRECON_DIR/requirements.txt" 2>/dev/null
     chmod +x "$_DNSRECON_DIR/dnsrecon.py"

package/karnel/tools/security/enum4linux/install.sh

@@ -14,6 +14,10 @@ install_enum4linux() {
     log_success "enum4linux instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o enum4linux via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_ENUM4LINUX_REPO" "$_ENUM4LINUX_COMMIT" "$_ENUM4LINUX_DIR"; then
     chmod +x "$_ENUM4LINUX_DIR/enum4linux.pl"
     ln -sf "$_ENUM4LINUX_DIR/enum4linux.pl" "$PREFIX/bin/enum4linux"

package/karnel/tools/security/masscan/install.sh

@@ -46,9 +46,9 @@ update_masscan() {
     _pinned_git_repo_owned "$_MASSCAN_DIR" "$_MASSCAN_REPO" ||
       { [ -f "$_MASSCAN_DIR/.karnel-wrapper" ] && _adopt_pinned_git_repo "$_MASSCAN_DIR" "$_MASSCAN_REPO"; } || return 1
     install_pinned_git_repo "$_MASSCAN_REPO" "$_MASSCAN_COMMIT" "$_MASSCAN_DIR" || return 1
-    make -C "$_MASSCAN_DIR" -j4 2>/dev/null
-  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan"
-    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper"
+    make -C "$_MASSCAN_DIR" -j4 2>/dev/null || return 1
+  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan" || return 1
+    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper" || return 1
     log_success "masscan atualizado"
     return 0
   fi

package/karnel/tools/security/nikto/install.sh

@@ -14,6 +14,10 @@ install_nikto() {
     log_success "nikto instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o nikto via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_NIKTO_REPO" "$_NIKTO_COMMIT" "$_NIKTO_DIR"; then
     ln -sf "$_NIKTO_DIR/program/nikto.pl" "$PREFIX/bin/nikto"
     chmod +x "$PREFIX/bin/nikto"

package/karnel/tools/security/sqlmap/install.sh

@@ -14,6 +14,10 @@ install_sqlmap() {
     log_success "sqlmap instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o sqlmap via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_SQLMAP_REPO" "$_SQLMAP_COMMIT" "$_SQLMAP_DIR"; then
     ln -sf "$_SQLMAP_DIR/sqlmap.py" "$PREFIX/bin/sqlmap"
     chmod +x "$PREFIX/bin/sqlmap"

package/karnel/tools/security/subfinder/install.sh

@@ -24,10 +24,17 @@ install_subfinder() (
   log_info "Instalando subfinder..."
   if [ ! -f "$_SUBFINDER_MARKER" ] &&
     { pkg install -y subfinder 2>/dev/null || apt install -y subfinder 2>/dev/null; }; then
+    local bin; bin="$(command -v subfinder)"
+    [ -n "$bin" ] && sha256sum "$bin" > "$_SUBFINDER_MARKER" 2>/dev/null
     log_success "subfinder instalado"
     return 0
   fi
 
+  command -v unzip >/dev/null 2>&1 || pkg install -y unzip >/dev/null 2>&1 || {
+    log_error "unzip indisponível; não foi possível extrair subfinder"
+    return 1
+  }
+
   local arch asset checksum url tmpdir archive staged_bin
   arch=$(_subfinder_arch) || { log_error "Arquitetura não suportada"; return 1; }
   [[ "$arch" == armv7 ]] && arch="arm"

package/karnel/tools/security/theharvester/install.sh

@@ -14,6 +14,10 @@ install_theharvester() {
     log_success "theharvester instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o theharvester via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_THEHARVESTER_REPO" "$_THEHARVESTER_COMMIT" "$_THEHARVESTER_DIR"; then
     pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>/dev/null
     chmod +x "$_THEHARVESTER_DIR/theHarvester.py"

package/karnel/tools/security/whatweb/install.sh

@@ -14,6 +14,10 @@ install_whatweb() {
     log_success "whatweb instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o whatweb via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_WHATWEB_REPO" "$_WHATWEB_COMMIT" "$_WHATWEB_DIR"; then
     ln -sf "$_WHATWEB_DIR/whatweb" "$PREFIX/bin/whatweb"
     chmod +x "$PREFIX/bin/whatweb"

package/karnel/utils/agent_actions.sh

@@ -366,6 +366,11 @@ agent_apply_files() {
 	d=$(agent_md_dir)
 	fm="$d/actions_files_manifest.txt"
 	ws="${AGENT_ACTIONS_WORKSPACE:-$PWD}"
+	ws="$(realpath -m "$ws" 2>/dev/null)" || ws=""
+	if [[ -z "$ws" || "$ws" == "/" ]]; then
+		log_error "Recusando aplicar arquivos com workspace '/' (permitiria escrita em qualquer lugar)"
+		return 1
+	fi
 	AGENT_FILES_WRITTEN=0
 	shown=0
 	# paths attached as action="no-read" are write-protected for this task

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.1",
+  "version": "4.17.3",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"