karnel-termux 4.17.2 → 4.17.3

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-680f9d3f783c6f2bf95e4499c3e230d2d25b7070
+5b88c3c7229d293e0e92665c71bcb3501a87ed74

package/karnel/tools/ai/cline/install.sh

@@ -83,6 +83,20 @@ _cline_install_global_impl() {
     return 1
   fi
 
+  local expected actual
+  expected=$(npm view "@cline/cli-linux-arm64@$version" dist.integrity 2>/dev/null)
+  if [[ -z "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Falha ao obter a integridade do binário do Cline no registry npm"
+    return 1
+  fi
+  actual=$(node -e 'const c=require("crypto");const h=c.createHash("sha512");h.update(require("fs").readFileSync(process.argv[1]));process.stdout.write("sha512-"+h.digest("base64"))' "$tarball" 2>/dev/null) || actual=""
+  if [[ "$actual" != "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Integridade do binário do Cline não confere (esperado $expected)"
+    return 1
+  fi
+
   mkdir -p "$CLINE_DATA_DIR"
   : >"$CLINE_DATA_DIR/$CLINE_MARKER"
   if ! tar -xzf "$tarball" -C "$CLINE_DATA_DIR" &>>"$LOG_FILE"; then

package/karnel/tools/ai/kimchi-code/install.sh

@@ -485,9 +485,15 @@ _update_kimchi_proot_impl() {
 
   local download_url="https://github.com/getkimchi/kimchi/releases/download/$latest_version/kimchi_linux_arm64.tar.gz"
 
-  _kimchi_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 getkimchi/kimchi "$latest_version" "kimchi_linux_arm64.tar.gz") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Kimchi; skipping integrity verification"
+  fi
+  _kimchi_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/kimchi-install &&
-    curl -fsSL '$download_url' -o /tmp/kimchi-install/kimchi.tar.gz &&
+    curl -fsSL "$1" -o /tmp/kimchi-install/kimchi.tar.gz &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/kimchi-install/kimchi.tar.gz | awk "{print \$1}")" = "$2" ]; } &&
     tar -zxf /tmp/kimchi-install/kimchi.tar.gz -C /tmp/kimchi-install &&
     rm -f /usr/local/bin/kimchi &&
     mv /tmp/kimchi-install/bin/kimchi /usr/local/bin/kimchi &&
@@ -495,7 +501,7 @@ _update_kimchi_proot_impl() {
     rm -rf /usr/local/share/kimchi &&
     mv /tmp/kimchi-install/share/kimchi /usr/local/share/kimchi &&
     rm -rf /tmp/kimchi-install
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
 
   local kimchi_bin
   kimchi_bin="$(_kimchi_detect_ubuntu_root)/usr/local/bin/kimchi"

package/karnel/tools/npm/turbopack/install.sh

@@ -39,6 +39,17 @@ _install_deps_impl() {
 		fi
 	done
 
+	if [[ ! -f "$GLIBC_LIBDIR/ld-linux-aarch64.so.1" ]]; then
+		if ! yes | pkg install glibc-repo &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc-repo"
+			return 1
+		fi
+		if ! yes | pkg install glibc &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc (required by the glibc-linked Node.js)"
+			return 1
+		fi
+	fi
+
 	return 0
 }
 

package/karnel/tools/security/dnsrecon/install.sh

@@ -14,6 +14,10 @@ install_dnsrecon() {
     log_success "dnsrecon instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o dnsrecon via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_DNSRECON_REPO" "$_DNSRECON_COMMIT" "$_DNSRECON_DIR"; then
     pip install -r "$_DNSRECON_DIR/requirements.txt" 2>/dev/null
     chmod +x "$_DNSRECON_DIR/dnsrecon.py"

package/karnel/tools/security/enum4linux/install.sh

@@ -14,6 +14,10 @@ install_enum4linux() {
     log_success "enum4linux instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o enum4linux via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_ENUM4LINUX_REPO" "$_ENUM4LINUX_COMMIT" "$_ENUM4LINUX_DIR"; then
     chmod +x "$_ENUM4LINUX_DIR/enum4linux.pl"
     ln -sf "$_ENUM4LINUX_DIR/enum4linux.pl" "$PREFIX/bin/enum4linux"

package/karnel/tools/security/masscan/install.sh

@@ -46,9 +46,9 @@ update_masscan() {
     _pinned_git_repo_owned "$_MASSCAN_DIR" "$_MASSCAN_REPO" ||
       { [ -f "$_MASSCAN_DIR/.karnel-wrapper" ] && _adopt_pinned_git_repo "$_MASSCAN_DIR" "$_MASSCAN_REPO"; } || return 1
     install_pinned_git_repo "$_MASSCAN_REPO" "$_MASSCAN_COMMIT" "$_MASSCAN_DIR" || return 1
-    make -C "$_MASSCAN_DIR" -j4 2>/dev/null
-  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan"
-    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper"
+    make -C "$_MASSCAN_DIR" -j4 2>/dev/null || return 1
+  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan" || return 1
+    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper" || return 1
     log_success "masscan atualizado"
     return 0
   fi

package/karnel/tools/security/nikto/install.sh

@@ -14,6 +14,10 @@ install_nikto() {
     log_success "nikto instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o nikto via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_NIKTO_REPO" "$_NIKTO_COMMIT" "$_NIKTO_DIR"; then
     ln -sf "$_NIKTO_DIR/program/nikto.pl" "$PREFIX/bin/nikto"
     chmod +x "$PREFIX/bin/nikto"

package/karnel/tools/security/sqlmap/install.sh

@@ -14,6 +14,10 @@ install_sqlmap() {
     log_success "sqlmap instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o sqlmap via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_SQLMAP_REPO" "$_SQLMAP_COMMIT" "$_SQLMAP_DIR"; then
     ln -sf "$_SQLMAP_DIR/sqlmap.py" "$PREFIX/bin/sqlmap"
     chmod +x "$PREFIX/bin/sqlmap"

package/karnel/tools/security/theharvester/install.sh

@@ -14,6 +14,10 @@ install_theharvester() {
     log_success "theharvester instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o theharvester via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_THEHARVESTER_REPO" "$_THEHARVESTER_COMMIT" "$_THEHARVESTER_DIR"; then
     pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>/dev/null
     chmod +x "$_THEHARVESTER_DIR/theHarvester.py"

package/karnel/tools/security/whatweb/install.sh

@@ -14,6 +14,10 @@ install_whatweb() {
     log_success "whatweb instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o whatweb via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_WHATWEB_REPO" "$_WHATWEB_COMMIT" "$_WHATWEB_DIR"; then
     ln -sf "$_WHATWEB_DIR/whatweb" "$PREFIX/bin/whatweb"
     chmod +x "$PREFIX/bin/whatweb"

package/karnel/utils/agent_actions.sh

@@ -366,6 +366,11 @@ agent_apply_files() {
 	d=$(agent_md_dir)
 	fm="$d/actions_files_manifest.txt"
 	ws="${AGENT_ACTIONS_WORKSPACE:-$PWD}"
+	ws="$(realpath -m "$ws" 2>/dev/null)" || ws=""
+	if [[ -z "$ws" || "$ws" == "/" ]]; then
+		log_error "Recusando aplicar arquivos com workspace '/' (permitiria escrita em qualquer lugar)"
+		return 1
+	fi
 	AGENT_FILES_WRITTEN=0
 	shown=0
 	# paths attached as action="no-read" are write-protected for this task

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.2",
+  "version": "4.17.3",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"