karnel-termux 4.17.31 → 4.17.33

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/israelmarques1024-dotcom/karnel-termux">
-    <img src="https://img.shields.io/badge/version-4.17.31-0078D4?style=for-the-badge" alt="Version">
+    <img src="https://img.shields.io/badge/version-4.17.33-0078D4?style=for-the-badge" alt="Version">
   </a>
   <a href="https://www.npmjs.com/package/karnel-termux">
     <img src="https://img.shields.io/npm/v/karnel-termux?style=for-the-badge&logo=npm&color=cb3837" alt="npm">
@@ -78,7 +78,7 @@ Why it's great:
 ### Via checksummed GitHub release (recommended)
 
 ```bash
-version=4.17.31
+version=4.17.33
 tmpdir=$(mktemp -d) && trap 'rm -rf "$tmpdir"' EXIT
 base="https://github.com/israelmarques1024-dotcom/karnel-termux/releases/download/v$version"
 curl -fsSL "$base/karnel-termux-install.sh" -o "$tmpdir/karnel-termux-install.sh"

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-385a0757314adc4d9fdd8d005fb42b6f8b5c29d1
+90bb3622bf61156e730dea73a6e700e4d98c9b13

package/karnel/tools/ai/kilocode-cli/install.sh

@@ -176,15 +176,10 @@ _download_kilocode_binary_impl() {
     return 1
   fi
 
-  if declare -F github_release_asset_sha256 >/dev/null; then
-    local expected actual
-    expected=$(github_release_asset_sha256 Kilo-Org/kilocode "$latest_version" "$tarball") || expected=""
-    actual=$(sha256sum "$staging_dir/$tarball" 2>/dev/null | awk '{print $1}')
-    if [[ ! "$expected" =~ ^[0-9a-f]{64}$ || "$actual" != "$expected" ]]; then
-      rm -rf "$staging_dir"
-      log_error "Kilo Code archive failed official SHA-256 validation"
-      return 1
-    fi
+  if ! verify_github_release_asset Kilo-Org/kilocode "$latest_version" "$tarball" "$staging_dir/$tarball"; then
+    rm -rf "$staging_dir"
+    log_error "Kilo Code archive failed official SHA-256 validation"
+    return 1
   fi
 
   if ! safe_extract_tar "$staging_dir/$tarball" "$staging_dir"; then

package/karnel/utils/install.sh

@@ -201,8 +201,27 @@ activate_installer_file() {
 
 github_release_asset_sha256() {
   local repo="$1" version="$2" asset="$3" digest=""
-  # GitHub's release API does not expose per-asset digests, so fetch the
-  # companion checksum file published alongside the asset (common convention).
+  # Modern GitHub releases expose an official SHA-256 in each asset's digest
+  # field. Prefer it so installers do not depend on companion checksum files.
+  if command -v jq >/dev/null 2>&1; then
+    digest=$(curl -fsSL --connect-timeout 10 --max-time 30 \
+      -H 'Accept: application/vnd.github+json' \
+      "https://api.github.com/repos/$repo/releases/tags/$version" 2>/dev/null \
+      | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' 2>/dev/null \
+      | awk -F: 'NR == 1 { print $NF }' | tr -d '\r')
+  elif command -v python3 >/dev/null 2>&1; then
+    digest=$(curl -fsSL --connect-timeout 10 --max-time 30 \
+      -H 'Accept: application/vnd.github+json' \
+      "https://api.github.com/repos/$repo/releases/tags/$version" 2>/dev/null \
+      | python3 -c 'import json, sys; asset = sys.argv[1]; release = json.load(sys.stdin); print(next((item.get("digest", "") for item in release.get("assets", []) if item.get("name") == asset), ""))' "$asset" 2>/dev/null \
+      | awk -F: 'NR == 1 { print $NF }' | tr -d '\r')
+  fi
+  if [[ "$digest" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "$digest"
+    return 0
+  fi
+  # Older GitHub releases may not have an API digest. Try the companion
+  # checksum file published alongside the asset (a common convention).
   digest=$(curl -fsSL --connect-timeout 10 --max-time 30 \
     "https://github.com/$repo/releases/download/$version/$asset.sha256" 2>/dev/null \
     | awk '{print $1; exit}' | tr -d '\r')
@@ -284,15 +303,9 @@ managed_file_matches() {
 }
 
 github_download_and_extract() {
-  local repo="$1" version="$2" asset="$3" outdir="$4"
-  local tarball expected
+  local repo="$1" version="$2" asset="$3" outdir="$4" tarball
   tarball=$(github_download_release "$repo" "$version" "$asset" "$outdir") || return 1
-  expected=$(github_release_asset_sha256 "$repo" "$version" "$asset") || expected=""
-  if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
-    verify_sha256 "$tarball" "$expected" || return 1
-  else
-    log_warn "No published SHA-256 digest for $repo/$asset; skipping integrity verification"
-  fi
+  verify_github_release_asset "$repo" "$version" "$asset" "$tarball" || { rm -f "$tarball"; return 1; }
   extract_tarball "$tarball" "$outdir" || return 1
   return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.31",
+  "version": "4.17.33",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"