karnel-termux 4.17.13 → 4.17.19

package/docs/karnel/deploy/index.md

@@ -11,7 +11,7 @@ Deploy CLIs (Railway, Netlify, Vercel, Supabase).
 
 | `deploy`  | `--vercel`, `--railway`, `--netlify`, `--supabase` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#deploy) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#deploy) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/deploy.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/dev/index.md

@@ -6,12 +6,12 @@ layout: base
 
 # Dev module
 
-General development utilities (fzf, bat, make, proot-distro, tmux, and more).
+General development utilities (fzf, bat, make, proot, tmux, and more).
 ## Install
 
 | `dev`     | `--gh`, `--wget`, `--curl`, `--lsd`, `--bat`, `--proot`, `--ncurses`, `--tmate`, `--openssh`, `--tmux`, `--cloudflared`, `--translate`, `--html2text`, `--jq`, `--bc`, `--tree`, `--fzf`, `--imagemagick`, `--shfmt`, `--make`, `--udocker`, `--snyk` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#dev) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#dev) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/dev.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/editor/index.md

@@ -11,7 +11,7 @@ Terminal and browser-based editors (code-server, Neovim, and more).
 
 | `editor`  | `--code-server`, `--neovim`, `--nvchad` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#editor) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#editor) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/editor.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/games/index.md

@@ -11,7 +11,7 @@ Terminal games to relax between sessions.
 
 | `games`   | `--buzz`, `--ctfgod`, `--detective`, `--pet-friends`, `--tamagotchi`, `--arcade` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#games) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#games) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/games.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/lang/index.md

@@ -11,7 +11,7 @@ Programming-language runtimes (Python, Node.js, Rust, Go, and more).
 
 | `lang`    | `--bun`, `--nodejs`, `--python`, `--perl`, `--php`, `--rust`, `--clang`, `--golang` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#lang) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#lang) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/lang.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/network/index.md

@@ -11,7 +11,7 @@ Network utilities (dark, dedsec-network).
 
 | `network` | `--dark`, `--dedsec-network` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#network) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#network) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/network.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/npm/index.md

@@ -11,7 +11,7 @@ Node.js packages and JavaScript tooling.
 
 | `npm`     | `--typescript`, `--nestjs`, `--prettier`, `--live-server`, `--localtunnel`, `--vercel`, `--markserv`, `--psqlformat`, `--ncu`, `--ngrok`, `--turbopack` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#npm) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#npm) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/npm.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/osint/index.md

@@ -11,7 +11,7 @@ OSINT tooling, centered on Robin.
 
 | `osint`   | Robin OSINT |
 
-See the [CLI reference]({ '/cli/' | relative_url }#osint) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#osint) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/osint.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/plugin/index.md

@@ -11,7 +11,7 @@ The plugin system and manager.
 
 | `plugin`         | Plugin system |
 
-See the [CLI reference]({ '/cli/' | relative_url }#plugin) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#plugin) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/plugin.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/security/index.md

@@ -6,12 +6,12 @@ layout: base
 
 # Security module
 
-Security and pentest tooling (30+ tools).
+Security and pentest tooling (30 tools).
 ## Install
 
 | `security`       | Security tools |
 
-See the [CLI reference]({ '/cli/' | relative_url }#security) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#security) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/security.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/shell/index.md

@@ -11,7 +11,7 @@ Shell enhancements (ZSH, Oh My Zsh, zoxide).
 
 | `shell`   | `--powerlevel10k`, `--zsh-defer`, `--zsh-autosuggestions`, `--zsh-syntax-highlighting`, `--history-substring`, `--zsh-completions`, `--fzf-tab`, `--you-should-use`, `--zsh-autopair`, `--better-npm` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#shell) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#shell) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/shell.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/ui/index.md

@@ -11,7 +11,7 @@ Termux UI components.
 
 | `ui`      | `--font`, `--extra-keys`, `--cursor`, `--banner` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#ui) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#ui) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/ui.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/utils/index.md

@@ -15,7 +15,7 @@ and tracked with Karnel ownership markers so `karnel uninstall utils --herdr` is
 
 | `utils`   | `--fconv`, `--filecheck`, `--websites`, `--notes`, `--treex`, `--passman`, `--applaunch`, `--splash`, `--httptmux`, `--zork`, `--qrcode`, `--superfile`, `--herdr` |
 
-See the [CLI reference]({ '/cli/' | relative_url }#utils) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#utils) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/utils.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/karnel/voice/index.md

@@ -11,7 +11,7 @@ Voice commands for AI agents.
 
 | `voice`          | Voice command |
 
-See the [CLI reference]({ '/cli/' | relative_url }#voice) for the full command list, or the
+See the [CLI reference]({{ '/cli/' | relative_url }}#voice) for the full command list, or the
 [source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/voice.sh).
 
-[← Back to docs]({ '/' | relative_url })
+[← Back to docs]({{ '/' | relative_url }}) · [CLI reference]({{ '/cli/' | relative_url }})

package/docs/troubleshooting/index.md

@@ -24,8 +24,10 @@ npm/pnpm installs.
 | `All update methods failed` | Every fallback failed. Check network, the Git checkout state, and npm connectivity. |
 | Update stays on the same version | Old releases (`v4.13.3`, `v4.13.4`) do not ship installer assets, so the curl path falls back to git. A release that includes the installer assets enables the verified curl path. |
 
-Logs: `$KARNEL_CACHE/install_dev.log` (GitHub/installer) and
-`$KARNEL_CACHE/install_npm.log` (npm).
+The updater prints its progress to the terminal only; it does not write log
+files. For module installs, `karnel install dev` logs to
+`$KARNEL_CACHE/install_dev.log` and `karnel install npm` logs to
+`$KARNEL_CACHE/install_npm.log`.
 
 ## npm publishing
 

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-3d9d862c0be40df2c3f17648f56bf83ef74507b7
+1eb16a5898d6f323ed664668b96bf8eff18348cd

package/karnel/cli/commands/backup.sh

@@ -61,7 +61,7 @@ backup_run() {
   echo
 
   local tmp archive_tmp checksum_tmp
-  tmp=$(mktemp -d) || { _backup_release_output; return 1; }
+  tmp=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX") || { _backup_release_output; return 1; }
   archive_tmp="$BACKUP_DIR/.$(basename "$file").$$.tmp"
   checksum_tmp="$archive_tmp.sha256"
   if ! _backup_collect_payload "$tmp"; then
@@ -130,7 +130,7 @@ backup_snapshot() {
   echo
 
   local tmp archive_tmp checksum_tmp checksum
-  tmp=$(mktemp -d) || { _backup_release_output; return 1; }
+  tmp=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX") || { _backup_release_output; return 1; }
   archive_tmp="$BACKUP_DIR/.$(basename "$file").$$.tmp"
   checksum_tmp="$archive_tmp.sha256"
   if ! _backup_collect_payload "$tmp" ||

package/karnel/cli/commands/brain.sh

@@ -142,7 +142,7 @@ _brain_update_related() {
 	if grep -q "^related:" "$tmp" 2>/dev/null; then
 		sed -i "s/^related: \[\(.*\)\]/related: [\1, $escaped]/" "$tmp"
 	else
-		sed -i "/^---$/a related: [$slug]" "$tmp"
+		sed -i "/^---$/a related: [$escaped]" "$tmp"
 	fi
 	tail -n +$((frontmatter_end)) "$file" >>"$tmp"
 	mv "$tmp" "$file"
@@ -230,7 +230,7 @@ _brain_editor() {
 	fi
 
 	local tmpfile
-	tmpfile=$(mktemp)
+	tmpfile=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 
 	echo "# $title" >"$tmpfile"
 	echo >>"$tmpfile"
@@ -1466,7 +1466,7 @@ EOF
 
 	if command -v jq &>/dev/null; then
 		local temp
-		temp=$(mktemp)
+		temp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 		if [[ "$val" == "true" ]] || [[ "$val" == "false" ]]; then
 			jq --argjson v "$val" ".${key} = \$v" "$config_file" > "$temp" && mv "$temp" "$config_file"
 		elif [[ "$val" =~ ^[0-9]+$ ]]; then
@@ -1635,7 +1635,7 @@ EOF
 	echo
 
 	local ai_response_temp
-	ai_response_temp=$(mktemp)
+	ai_response_temp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 
 	if loading "Generating AI response" _run_ai_query "$ai_cmd" "$full_prompt" "$default_model" "$ai_response_temp"; then
 		echo

package/karnel/cli/commands/doctor/code_exec.sh

@@ -115,6 +115,11 @@ _exec_apply_fix() {
   local tool="$1" fix_cmd="$2" lang="$3" file="$4" dir="${5:-$PWD}"
   local full_cmd; full_cmd="$(_tool_command "$fix_cmd" "$file")"
 
+  # NOTE: fix/check commands come exclusively from the in-repo LANG_TOOLS
+  # registry (code_langs.sh); some legitimate fixes are multi-statement
+  # loops (e.g. Go gofmt) or contain pipes, so pattern-based "injection"
+  # guards here would refuse valid commands. Do not re-add one.
+
   if [[ "$fix_cmd" == *'{}'* && -z "$file" ]]; then
     log_warn "Cannot fix — no matching file found for $tool"
     return 1

package/karnel/cli/commands/env.sh

@@ -86,6 +86,12 @@ env_set() {
 
 	printf 'export %s=%q\n' "$key" "$value" >>"$rc_file"
 
+	# Secrets stored in a shell rc are world-readable by default; tighten the
+	# file's permissions so other local users cannot read them.
+	if [[ "$key" =~ (SECRET|TOKEN|KEY|PASSWORD|PASSWD|API_|ACCESS|PRIVATE|CREDENTIAL) ]]; then
+		chmod go-rwx "$rc_file" 2>/dev/null || true
+	fi
+
 	echo
 	log_success "Variable ${D_CYAN}${key}${D_GREEN} set in ${D_NC}$(basename "$rc_file")"
 	list_item "Run: ${D_CYAN}source $(basename "$rc_file")${D_NC} to apply, or restart your terminal"

package/karnel/cli/commands/ia.sh

@@ -22,7 +22,6 @@ ia_help() {
 	separator_section "Examples"
 	echo
 	printf "    ${D_CYAN}karnel ia sessions${NC}         # Show all AI sessions\n"
-	printf "    ${D_CYAN}karnel ia sessions --all${NC}   # Include agent names\n"
 	printf "    ${D_CYAN}karnel ia install omni-route${NC}  # Install omniRoute\n"
 	printf "    ${D_CYAN}karnel ia routes${NC}             # Show AI CLI routes\n"
 	printf "    ${D_CYAN}karnel list ai${NC}               # List installed AI tools\n"
@@ -31,7 +30,12 @@ ia_help() {
 
 # List all AI sessions from known tools
 ia_sessions() {
+	# $1 was historically `--all`; agent names are always shown now, so the
+	# flag is accepted for back-compat and ignored.
 	local show_all="${1:-0}"
+	if [[ "$show_all" == "--all" ]]; then
+		show_all=0
+	fi
 
 	mkdir -p "$IA_SESSIONS_DIR"
 
@@ -407,7 +411,7 @@ PY
 	# Persist all discovered sessions to IA_SESSIONS_DIR for history
 	local persist_file="$IA_SESSIONS_DIR/.all_sessions.json"
 	local tmp_persist
-	tmp_persist=$(mktemp)
+	tmp_persist=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 	echo "[" > "$tmp_persist"
 	local first=1
 	for session in "${sessions[@]}"; do

package/karnel/cli/commands/init.sh

@@ -132,7 +132,7 @@ EOF
 			log_warn "jq not found — skipping package.json update"
 		else
 			local temp
-			temp=$(mktemp)
+			temp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 			jq '.scripts.dev = "next dev --webpack" | .scripts.build = "next build --webpack" | .scripts.start = "next start"' package.json > "$temp" && mv "$temp" package.json
 			log_success "Added --webpack flag to dev and build scripts"
 		fi
@@ -533,7 +533,7 @@ EOF
 			log_warn "jq not found — skipping package.json update"
 		else
 		local temp
-		temp=$(mktemp)
+		temp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")
 		jq '.scripts += {
       "dev": "ts-node-dev --require tsconfig-paths/register --env-file=.env --respawn src/index.ts",
       "build": "tsc && tsc-alias -p tsconfig.json",

package/karnel/cli/commands/list.sh

@@ -461,6 +461,7 @@ _list_utils() {
   table_row "Zork (text adventure)" "--zork" "zork" "$(_check_cmd "zork")"
   table_row "QR Code Generator" "--qrcode" "qrcode" "$(_check_cmd "qrcode")"
   table_row "SuperFile" "--superfile" "spf" "$(_check_cmd "spf")"
+  table_row "Herdr (AI assistant)" "--herdr" "herdr" "$(_check_cmd "herdr")"
   table_end
 
   echo

package/karnel/cli/commands/open.sh

@@ -21,6 +21,9 @@ open_main() {
 	herdr)
 		url="$OPEN_DOCS/karnel/utils"
 		;;
+	robin)
+		url="$OPEN_DOCS/karnel/osint"
+		;;
 	supabase)
 		url="$OPEN_DOCS/karnel/deploy"
 		;;
@@ -95,6 +98,7 @@ open_help() {
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "utils" "Utility tools"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "voice" "Voice command"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "osint" "OSINT tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "robin" "Robin OSINT service"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "plugin" "Plugin system"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "security" "Security tools"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "herdr" "Herdr terminal AI assistant"

package/karnel/cli/commands/pg.sh

@@ -466,7 +466,7 @@ _run_restore_cmd() {
 	local file_path="$2"
 	local _rs_ret=0
 	set -o pipefail
-	gunzip -c "$file_path" | pg_restore -d "$db_name" -c 2>/dev/null || _rs_ret=$?
+	gunzip -c "$file_path" | pg_restore -d "$db_name" -c 2>>"${KARNEL_CACHE:-$HOME/.cache/karnel}/karnel-pg.log" || _rs_ret=$?
 	set +o pipefail
 	return $_rs_ret
 }

package/karnel/cli/commands/restore.sh

@@ -114,10 +114,10 @@ restore_main() {
   log_success "Checksum verified"
 
   local tmp transaction
-  tmp=$(mktemp -d) || return 1
-  if ! tar -xzf "$file" -C "$tmp" --no-same-owner --no-same-permissions 2>/dev/null; then
+  tmp=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX") || return 1
+  if ! tar -xzf "$file" -C "$tmp" --no-same-owner --no-same-permissions 2>"$tmp/extract.err"; then
+    log_error "Failed to extract backup: $(cat "$tmp/extract.err" 2>/dev/null)"
     rm -rf "$tmp"
-    log_error "Failed to extract backup"
     return 1
   fi
   local pkgs="$tmp/metadata/packages.list"

package/karnel/cli/commands/voice.sh

@@ -47,7 +47,7 @@ voice_help() {
   echo
   list_item "Termux:API package: ${D_CYAN}pkg install termux-api${NC}"
   list_item "${EDITOR:-nano} editor: ${D_CYAN}karnel install editor${NC}"
-  list_item "Termux:API app: ${D_CYAN}https://karneltermux.vercel.app/termux/api${NC}"
+  list_item "Termux:API app: ${D_CYAN}https://github.com/termux/termux-api${NC}"
   echo
 }
 
@@ -101,7 +101,7 @@ voice_main() {
     else
       log_error "Termux:API is not installed"
       list_item "Install the package: ${D_CYAN}pkg install termux-api${NC}"
-      list_item "Install the app: https://karneltermux.vercel.app/termux/api"
+      list_item "Install the app: https://github.com/termux/termux-api"
       separator
       return 1
     fi
@@ -151,7 +151,7 @@ voice_main() {
   local prompt="$raw"
   if [[ "$skip_edit" == "false" ]] && [[ -t 0 ]] && [[ -t 1 ]]; then
     local tmpfile
-    tmpfile="$(mktemp)"
+    tmpfile="$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-XXXXXX")"
     echo "$raw" >"$tmpfile"
     $is_text || log_info "Review the prompt in ${EDITOR:-nano}, fix mistakes, then save and quit"
     ${EDITOR:-nano} "$tmpfile" </dev/tty >/dev/tty || true

package/karnel/modules/shell.sh

@@ -43,7 +43,9 @@ install_oh_my_zsh() (
 
 	if curl -fsSL "https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/$OH_MY_ZSH_REF/tools/install.sh" -o "$temp_file" &>>"$LOG_FILE"; then
 		# Keep the reviewed installer behavior, but fetch and check out the reviewed commit.
-		sed -i "s|git fetch --depth=1 origin|git fetch --depth=1 origin $OH_MY_ZSH_REF|" "$temp_file"
+		local omz_ref_esc
+omz_ref_esc=$(printf '%s\n' "$OH_MY_ZSH_REF" | sed 's/[][\/.&*?^$|]/\\&/g')
+sed -i "s|git fetch --depth=1 origin|git fetch --depth=1 origin $omz_ref_esc|" "$temp_file"
 		# shellcheck disable=SC2016
 		sed -i 's|git checkout -b "$BRANCH" "origin/$BRANCH"|git checkout --detach FETCH_HEAD|' "$temp_file"
 		if ! grep -qF "git fetch --depth=1 origin $OH_MY_ZSH_REF" "$temp_file" ||

package/karnel/tools/ai/cactus/install.sh

@@ -285,7 +285,7 @@ _cactus_cli_post_install_glibc() {
   fi
   mkdir -p "$PREFIX/libexec"
   cp "$launcher_src" "$launcher_dst"
-  chmod 644 "$launcher_dst"
+  chmod 755 "$launcher_dst"
 
   if ! command -v patchelf &>/dev/null; then
     if ! yes | pkg install patchelf &>>"$CACTUS_CLI_LOG_FILE"; then

package/karnel/tools/ai/cline/install.sh

@@ -4,13 +4,61 @@ import "@/utils/log"
 import "@/utils/version"
 import "@/utils/colors"
 import "@/utils/install"
+# Safe, self-contained tar extractor (independent of framework import).
+# Rejects path traversal, absolute paths, unsafe symlinks/hardlinks, and
+# device/special-file entries. Intentionally has NO unsafe fallback.
+_archive_member_is_safe() {
+  local member="$1"
+  [[ -n "$member" && "$member" != /* && "$member" != *\\* ]] || return 1
+  case "/$member/" in
+    */../*) return 1 ;;
+  esac
+}
+
+_archive_link_is_safe() {
+  local member="$1" target="$2" part depth=0
+  local -a _archive_parts
+  [[ -n "$target" && "$target" != /* && "$target" != *\\* ]] || return 1
+  IFS=/ read -r -a _archive_parts <<<"$(dirname "$member")/$target"
+  for part in "${_archive_parts[@]}"; do
+    case "$part" in
+      ''|.) ;;
+      ..) ((depth > 0)) || return 1; ((depth -= 1)) ;;
+      *) ((depth += 1)) ;;
+    esac
+  done
+}
+
+safe_extract_tar() {
+  local archive="$1" outdir="$2" strip_components="${3:-0}"
+  local member listing verbose mode line target
+  listing=$(tar -tf "$archive" 2>/dev/null) || return 1
+  while IFS= read -r member; do
+    _archive_member_is_safe "$member" || return 1
+  done <<<"$listing"
+  verbose=$(tar -tvf "$archive" 2>/dev/null) || return 1
+  while IFS= read -r line; do
+    mode=${line%% *}
+    case "${mode:0:1}" in
+      l)
+        member=${line%% -> *}; member=${member##* }
+        target=${line#* -> }
+        _archive_link_is_safe "$member" "$target" || return 1
+        ;;
+      h)
+        member=${line%% link to *}; member=${member##* }
+        target=${line#* link to }
+        _archive_link_is_safe "$member" "$target" || return 1
+        ;;
+      b|c|p) return 1 ;;
+    esac
+  done <<<"$verbose"
+  mkdir -p "$outdir" || return 1
+  tar -xf "$archive" -C "$outdir" --strip-components="$strip_components" \
+    --no-same-owner --no-same-permissions
+}
+
 
-if ! declare -f safe_extract_tar >/dev/null 2>&1; then
-  safe_extract_tar() {
-    local archive="$1" outdir="$2" strip_components="${3:-0}"
-    tar -xzf "$archive" -C "$outdir" --strip-components="$strip_components"
-  }
-fi
 
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
 : "${KARNEL_CACHE:=${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"

package/karnel/tools/ai/crush/install.sh

@@ -47,7 +47,7 @@ install_crush() {
   log_info "Downloading Crush v${CRUSH_VERSION} for Android arm64..."
 
   local tmpdir
-  tmpdir=$(mktemp -d)
+  tmpdir=$(mktemp -d "${KARNEL_CACHE:-${TMPDIR:-$HOME/.cache/karnel}}/karnel-crush.XXXXXX" 2>/dev/null) || tmpdir=$(mktemp -d) || return 1
   if curl -fsSL --connect-timeout 15 --max-time 120 "$url" -o "$tmpdir/$tarball" 2>>"$LOG_FILE"; then
     if verify_github_release_asset charmbracelet/crush "v${CRUSH_VERSION}" "$tarball" "$tmpdir/$tarball" &&
       extract_tarball "$tmpdir/$tarball" "$tmpdir"; then

package/karnel/tools/ai/droid/install.sh

@@ -256,13 +256,13 @@ _droid_ubuntu_install_bin() {
     return 1
   fi
   _droid_proot_ubuntu /bin/bash -c '
-    mkdir -p /tmp/droid-install &&
-    curl -fsSL "$1" -o /tmp/droid-install/droid &&
-    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-install/droid | awk "{print \$1}")" = "$2" ]; } &&
+    d=$(mktemp -d) &&
+    curl -fsSL "$1" -o "$d/droid" &&
+    { [ -z "$2" ] || [ "$(sha256sum "$d/droid" | awk "{print \$1}")" = "$2" ]; } &&
     mkdir -p /usr/local/bin &&
-    mv /tmp/droid-install/droid /usr/local/bin/droid &&
+    mv "$d/droid" /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
-    rm -rf /tmp/droid-install
+    rm -rf "$d"
   ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local droid_bin="$(_droid_detect_ubuntu_root)/usr/local/bin/droid"
@@ -438,12 +438,12 @@ _update_droid_proot_impl() {
   fi
   _droid_proot_ubuntu /bin/bash -c '
     rm -f /usr/local/bin/droid &&
-    mkdir -p /tmp/droid-update &&
-    curl -fsSL "$1" -o /tmp/droid-update/droid &&
-    { [ -z "$2" ] || [ "$(sha256sum /tmp/droid-update/droid | awk "{print \$1}")" = "$2" ]; } &&
-    mv /tmp/droid-update/droid /usr/local/bin/droid &&
+    d=$(mktemp -d) &&
+    curl -fsSL "$1" -o "$d/droid" &&
+    { [ -z "$2" ] || [ "$(sha256sum "$d/droid" | awk "{print \$1}")" = "$2" ]; } &&
+    mv "$d/droid" /usr/local/bin/droid &&
     chmod +x /usr/local/bin/droid &&
-    rm -rf /tmp/droid-update
+    rm -rf "$d"
   ' bash "$binary_url" "$expected" &>>"$LOG_FILE"
 
   local ubuntu_root

package/karnel/tools/ai/keelcode/install.sh

@@ -3,13 +3,61 @@
 import "@/utils/log"
 import "@/utils/version"
 import "@/utils/install"
+# Safe, self-contained tar extractor (independent of framework import).
+# Rejects path traversal, absolute paths, unsafe symlinks/hardlinks, and
+# device/special-file entries. Intentionally has NO unsafe fallback.
+_archive_member_is_safe() {
+  local member="$1"
+  [[ -n "$member" && "$member" != /* && "$member" != *\\* ]] || return 1
+  case "/$member/" in
+    */../*) return 1 ;;
+  esac
+}
+
+_archive_link_is_safe() {
+  local member="$1" target="$2" part depth=0
+  local -a _archive_parts
+  [[ -n "$target" && "$target" != /* && "$target" != *\\* ]] || return 1
+  IFS=/ read -r -a _archive_parts <<<"$(dirname "$member")/$target"
+  for part in "${_archive_parts[@]}"; do
+    case "$part" in
+      ''|.) ;;
+      ..) ((depth > 0)) || return 1; ((depth -= 1)) ;;
+      *) ((depth += 1)) ;;
+    esac
+  done
+}
+
+safe_extract_tar() {
+  local archive="$1" outdir="$2" strip_components="${3:-0}"
+  local member listing verbose mode line target
+  listing=$(tar -tf "$archive" 2>/dev/null) || return 1
+  while IFS= read -r member; do
+    _archive_member_is_safe "$member" || return 1
+  done <<<"$listing"
+  verbose=$(tar -tvf "$archive" 2>/dev/null) || return 1
+  while IFS= read -r line; do
+    mode=${line%% *}
+    case "${mode:0:1}" in
+      l)
+        member=${line%% -> *}; member=${member##* }
+        target=${line#* -> }
+        _archive_link_is_safe "$member" "$target" || return 1
+        ;;
+      h)
+        member=${line%% link to *}; member=${member##* }
+        target=${line#* link to }
+        _archive_link_is_safe "$member" "$target" || return 1
+        ;;
+      b|c|p) return 1 ;;
+    esac
+  done <<<"$verbose"
+  mkdir -p "$outdir" || return 1
+  tar -xf "$archive" -C "$outdir" --strip-components="$strip_components" \
+    --no-same-owner --no-same-permissions
+}
+
 
-if ! declare -f safe_extract_tar >/dev/null 2>&1; then
-  safe_extract_tar() {
-    local archive="$1" outdir="$2" strip_components="${3:-0}"
-    tar -xf "$archive" -C "$outdir" --strip-components="$strip_components"
-  }
-fi
 
 KEELCODE_PACKAGE="@keelcode-ai/keelcode"
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"