karnel-termux 4.17.2 → 4.17.5

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-680f9d3f783c6f2bf95e4499c3e230d2d25b7070
+2e76f74b21de6f9a01911b2c06b96ac09d12359d

package/karnel/tools/ai/cline/install.sh

@@ -83,6 +83,20 @@ _cline_install_global_impl() {
     return 1
   fi
 
+  local expected actual
+  expected=$(npm view "@cline/cli-linux-arm64@$version" dist.integrity 2>/dev/null)
+  if [[ -z "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Falha ao obter a integridade do binário do Cline no registry npm"
+    return 1
+  fi
+  actual=$(node -e 'const c=require("crypto");const h=c.createHash("sha512");h.update(require("fs").readFileSync(process.argv[1]));process.stdout.write("sha512-"+h.digest("base64"))' "$tarball" 2>/dev/null) || actual=""
+  if [[ "$actual" != "$expected" ]]; then
+    rm -f "$tarball"
+    log_error "Integridade do binário do Cline não confere (esperado $expected)"
+    return 1
+  fi
+
   mkdir -p "$CLINE_DATA_DIR"
   : >"$CLINE_DATA_DIR/$CLINE_MARKER"
   if ! tar -xzf "$tarball" -C "$CLINE_DATA_DIR" &>>"$LOG_FILE"; then

package/karnel/tools/ai/kilocode-cli/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/version"
 import "@/utils/colors"
+import "@/utils/install"
 
 LOG_FILE="$KARNEL_CACHE/install_ai.log"
 KILOCODE_DATA_DIR="${KARNEL_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}/kilocode"
@@ -120,13 +121,15 @@ _download_kilocode_binary_impl() {
     return 1
   fi
 
-  local expected actual
-  expected=$(github_release_asset_sha256 Kilo-Org/kilocode "$latest_version" "$tarball") || expected=""
-  actual=$(sha256sum "$staging_dir/$tarball" 2>/dev/null | awk '{print $1}')
-  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ || "$actual" != "$expected" ]]; then
-    rm -rf "$staging_dir"
-    log_error "Kilo Code archive failed official SHA-256 validation"
-    return 1
+  if declare -F github_release_asset_sha256 >/dev/null; then
+    local expected actual
+    expected=$(github_release_asset_sha256 Kilo-Org/kilocode "$latest_version" "$tarball") || expected=""
+    actual=$(sha256sum "$staging_dir/$tarball" 2>/dev/null | awk '{print $1}')
+    if [[ ! "$expected" =~ ^[0-9a-f]{64}$ || "$actual" != "$expected" ]]; then
+      rm -rf "$staging_dir"
+      log_error "Kilo Code archive failed official SHA-256 validation"
+      return 1
+    fi
   fi
 
   if ! tar -zxf "$staging_dir/$tarball" -C "$staging_dir" &>>"$LOG_FILE"; then

package/karnel/tools/ai/kimchi-code/install.sh

@@ -485,9 +485,15 @@ _update_kimchi_proot_impl() {
 
   local download_url="https://github.com/getkimchi/kimchi/releases/download/$latest_version/kimchi_linux_arm64.tar.gz"
 
-  _kimchi_proot_ubuntu /bin/bash -c "
+  local expected
+  expected=$(github_release_asset_sha256 getkimchi/kimchi "$latest_version" "kimchi_linux_arm64.tar.gz") || expected=""
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_warn "No published SHA-256 for Kimchi; skipping integrity verification"
+  fi
+  _kimchi_proot_ubuntu /bin/bash -c '
     mkdir -p /tmp/kimchi-install &&
-    curl -fsSL '$download_url' -o /tmp/kimchi-install/kimchi.tar.gz &&
+    curl -fsSL "$1" -o /tmp/kimchi-install/kimchi.tar.gz &&
+    { [ -z "$2" ] || [ "$(sha256sum /tmp/kimchi-install/kimchi.tar.gz | awk "{print \$1}")" = "$2" ]; } &&
     tar -zxf /tmp/kimchi-install/kimchi.tar.gz -C /tmp/kimchi-install &&
     rm -f /usr/local/bin/kimchi &&
     mv /tmp/kimchi-install/bin/kimchi /usr/local/bin/kimchi &&
@@ -495,7 +501,7 @@ _update_kimchi_proot_impl() {
     rm -rf /usr/local/share/kimchi &&
     mv /tmp/kimchi-install/share/kimchi /usr/local/share/kimchi &&
     rm -rf /tmp/kimchi-install
-  " &>>"$LOG_FILE"
+  ' bash "$download_url" "$expected" &>>"$LOG_FILE"
 
   local kimchi_bin
   kimchi_bin="$(_kimchi_detect_ubuntu_root)/usr/local/bin/kimchi"

package/karnel/tools/deploy/railway/install.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
 import "@/utils/log"
+import "@/utils/install"
 import "@/utils/version"
 
 LOG_FILE="$KARNEL_CACHE/install_deploy.log"
@@ -110,6 +111,15 @@ _install_railway_manual_impl() {
     return 2
   fi
 
+  local expected
+  expected=$(github_release_asset_sha256 railwayapp/cli "$latest_version" "railway-${version}-aarch64-linux.tar.gz") || expected=""
+  if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    verify_sha256 "$RAILWAY_DATA_DIR/railway.tar.gz" "$expected" || {
+      rm -f "$RAILWAY_DATA_DIR/railway.tar.gz"
+      return 1
+    }
+  fi
+
   tar -zxf "$RAILWAY_DATA_DIR/railway.tar.gz" -C "$RAILWAY_DATA_DIR" 2>>"$LOG_FILE" || {
     rm -f "$RAILWAY_DATA_DIR/railway.tar.gz"
     return 1

package/karnel/tools/editor/code-server/install.sh

@@ -73,7 +73,10 @@ update_code_server() {
 }
 
 _update_code_server_impl() {
-  pkg upgrade -y code-server 2>/dev/null
+  if ! pkg upgrade -y code-server &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar code-server"
+    return 1
+  fi
 }
 
 reinstall_code_server() {

package/karnel/tools/editor/neovim/install.sh

@@ -51,7 +51,10 @@ _update_neovim_impl() {
 
 _do_neovim_update() {
   mkdir -p "$(dirname "$LOG_FILE")"
-  yes | pkg upgrade neovim -y &>>"$LOG_FILE"
+  if ! yes | pkg upgrade neovim -y &>>"$LOG_FILE"; then
+    log_error "Falha ao atualizar Neovim"
+    return 1
+  fi
 }
 
 update_neovim() {

package/karnel/tools/lang/bun/install.sh

@@ -141,6 +141,14 @@ _download_bun_binary_native_impl() {
     log_error "Failed to download Bun binary"
     return 1
   }
+  if declare -F github_release_asset_sha256 >/dev/null; then
+    expected=$(github_release_asset_sha256 "$BUN_REPO" "bun-v$version" "$zip_name") || expected=""
+    if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+      verify_sha256 "$staging_dir/$zip_name" "$expected" || { rm -rf "$staging_dir"; return 1; }
+    else
+      log_warn "No published SHA-256 for Bun native; skipping integrity verification"
+    fi
+  fi
   if ! unzip -o "$staging_dir/$zip_name" -d "$staging_dir" &>>"$LOG_FILE"; then
     rm -rf "$staging_dir"
     log_error "Failed to extract Bun binary"

package/karnel/tools/npm/turbopack/install.sh

@@ -39,6 +39,17 @@ _install_deps_impl() {
 		fi
 	done
 
+	if [[ ! -f "$GLIBC_LIBDIR/ld-linux-aarch64.so.1" ]]; then
+		if ! yes | pkg install glibc-repo &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc-repo"
+			return 1
+		fi
+		if ! yes | pkg install glibc &>>"$LOG_FILE"; then
+			log_error "Failed to install glibc (required by the glibc-linked Node.js)"
+			return 1
+		fi
+	fi
+
 	return 0
 }
 

package/karnel/tools/security/dnsrecon/install.sh

@@ -14,8 +14,12 @@ install_dnsrecon() {
     log_success "dnsrecon instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o dnsrecon via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_DNSRECON_REPO" "$_DNSRECON_COMMIT" "$_DNSRECON_DIR"; then
-    pip install -r "$_DNSRECON_DIR/requirements.txt" 2>/dev/null
+    pip install -r "$_DNSRECON_DIR/requirements.txt" 2>>"$LOG_FILE" || return 1
     chmod +x "$_DNSRECON_DIR/dnsrecon.py"
     ln -sf "$_DNSRECON_DIR/dnsrecon.py" "$PREFIX/bin/dnsrecon"
     : > "$_DNSRECON_DIR/.karnel-wrapper"
@@ -41,7 +45,7 @@ update_dnsrecon() {
       { [ -f "$_DNSRECON_DIR/.karnel-wrapper" ] && _adopt_pinned_git_repo "$_DNSRECON_DIR" "$_DNSRECON_REPO"; } || return 1
     install_pinned_git_repo "$_DNSRECON_REPO" "$_DNSRECON_COMMIT" "$_DNSRECON_DIR" || return 1
     : > "$_DNSRECON_DIR/.karnel-wrapper"
-    pip install -r "$_DNSRECON_DIR/requirements.txt" 2>/dev/null
+    pip install -r "$_DNSRECON_DIR/requirements.txt" 2>>"$LOG_FILE" || return 1
     log_success "dnsrecon atualizado"
     return 0
   fi

package/karnel/tools/security/enum4linux/install.sh

@@ -14,6 +14,10 @@ install_enum4linux() {
     log_success "enum4linux instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o enum4linux via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_ENUM4LINUX_REPO" "$_ENUM4LINUX_COMMIT" "$_ENUM4LINUX_DIR"; then
     chmod +x "$_ENUM4LINUX_DIR/enum4linux.pl"
     ln -sf "$_ENUM4LINUX_DIR/enum4linux.pl" "$PREFIX/bin/enum4linux"

package/karnel/tools/security/masscan/install.sh

@@ -46,9 +46,9 @@ update_masscan() {
     _pinned_git_repo_owned "$_MASSCAN_DIR" "$_MASSCAN_REPO" ||
       { [ -f "$_MASSCAN_DIR/.karnel-wrapper" ] && _adopt_pinned_git_repo "$_MASSCAN_DIR" "$_MASSCAN_REPO"; } || return 1
     install_pinned_git_repo "$_MASSCAN_REPO" "$_MASSCAN_COMMIT" "$_MASSCAN_DIR" || return 1
-    make -C "$_MASSCAN_DIR" -j4 2>/dev/null
-  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan"
-    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper"
+    make -C "$_MASSCAN_DIR" -j4 2>/dev/null || return 1
+  install -m 755 "$_MASSCAN_DIR/bin/masscan" "$PREFIX/bin/masscan" || return 1
+    sha256sum "$PREFIX/bin/masscan" > "$_MASSCAN_DIR/.karnel-wrapper" || return 1
     log_success "masscan atualizado"
     return 0
   fi

package/karnel/tools/security/metasploit/install.sh

@@ -25,8 +25,8 @@ install_metasploit() {
   }
 
   cd "$METASPLOIT_DIR"
-  gem install bundler 2>/dev/null
-  bundle install --jobs 4 2>/dev/null
+  gem install bundler 2>>"$LOG_FILE" || return 1
+  bundle install --jobs 4 2>>"$LOG_FILE" || return 1
 
   for bin in msfconsole msfvenom msfrpc msfrpcd msfdb; do
     cat > "$PREFIX/bin/$bin" << BINEOF
@@ -58,7 +58,7 @@ update_metasploit() {
     _pinned_git_repo_owned "$METASPLOIT_DIR" "$METASPLOIT_REPO" ||
       { [ -f "$METASPLOIT_DIR/.karnel-installed" ] && _adopt_pinned_git_repo "$METASPLOIT_DIR" "$METASPLOIT_REPO"; } || return 1
     install_pinned_git_repo "$METASPLOIT_REPO" "$METASPLOIT_COMMIT" "$METASPLOIT_DIR" || return 1
-    cd "$METASPLOIT_DIR" && bundle install --jobs 4 2>/dev/null
+    cd "$METASPLOIT_DIR" && bundle install --jobs 4 2>>"$LOG_FILE" || return 1
     for bin in msfconsole msfvenom msfrpc msfrpcd msfdb; do
       sha256sum "$PREFIX/bin/$bin" > "$METASPLOIT_DIR/.karnel-wrapper-$bin"
     done

package/karnel/tools/security/nikto/install.sh

@@ -14,6 +14,10 @@ install_nikto() {
     log_success "nikto instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o nikto via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_NIKTO_REPO" "$_NIKTO_COMMIT" "$_NIKTO_DIR"; then
     ln -sf "$_NIKTO_DIR/program/nikto.pl" "$PREFIX/bin/nikto"
     chmod +x "$PREFIX/bin/nikto"

package/karnel/tools/security/sqlmap/install.sh

@@ -14,6 +14,10 @@ install_sqlmap() {
     log_success "sqlmap instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o sqlmap via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_SQLMAP_REPO" "$_SQLMAP_COMMIT" "$_SQLMAP_DIR"; then
     ln -sf "$_SQLMAP_DIR/sqlmap.py" "$PREFIX/bin/sqlmap"
     chmod +x "$PREFIX/bin/sqlmap"

package/karnel/tools/security/theharvester/install.sh

@@ -14,8 +14,12 @@ install_theharvester() {
     log_success "theharvester instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o theharvester via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_THEHARVESTER_REPO" "$_THEHARVESTER_COMMIT" "$_THEHARVESTER_DIR"; then
-    pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>/dev/null
+    pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>>"$LOG_FILE" || return 1
     chmod +x "$_THEHARVESTER_DIR/theHarvester.py"
     ln -sf "$_THEHARVESTER_DIR/theHarvester.py" "$PREFIX/bin/theharvester"
     : > "$_THEHARVESTER_DIR/.karnel-wrapper"
@@ -41,7 +45,7 @@ update_theharvester() {
       { [ -f "$_THEHARVESTER_DIR/.karnel-wrapper" ] && _adopt_pinned_git_repo "$_THEHARVESTER_DIR" "$_THEHARVESTER_REPO"; } || return 1
     install_pinned_git_repo "$_THEHARVESTER_REPO" "$_THEHARVESTER_COMMIT" "$_THEHARVESTER_DIR" || return 1
     : > "$_THEHARVESTER_DIR/.karnel-wrapper"
-    pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>/dev/null
+    pip install -r "$_THEHARVESTER_DIR/requirements/base.txt" 2>>"$LOG_FILE" || return 1
     log_success "theharvester atualizado"
     return 0
   fi

package/karnel/tools/security/whatweb/install.sh

@@ -14,6 +14,10 @@ install_whatweb() {
     log_success "whatweb instalado"
     return 0
   fi
+  command -v git >/dev/null 2>&1 || pkg install -y git >/dev/null 2>&1 || {
+    log_error "git é necessário para instalar o whatweb via repositório"
+    return 1
+  }
   if install_pinned_git_repo "$_WHATWEB_REPO" "$_WHATWEB_COMMIT" "$_WHATWEB_DIR"; then
     ln -sf "$_WHATWEB_DIR/whatweb" "$PREFIX/bin/whatweb"
     chmod +x "$PREFIX/bin/whatweb"

package/karnel/utils/agent_actions.sh

@@ -366,6 +366,11 @@ agent_apply_files() {
 	d=$(agent_md_dir)
 	fm="$d/actions_files_manifest.txt"
 	ws="${AGENT_ACTIONS_WORKSPACE:-$PWD}"
+	ws="$(realpath -m "$ws" 2>/dev/null)" || ws=""
+	if [[ -z "$ws" || "$ws" == "/" ]]; then
+		log_error "Recusando aplicar arquivos com workspace '/' (permitiria escrita em qualquer lugar)"
+		return 1
+	fi
 	AGENT_FILES_WRITTEN=0
 	shown=0
 	# paths attached as action="no-read" are write-protected for this task

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.2",
+  "version": "4.17.5",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"