karnel-termux 4.17.8 → 4.17.9

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/israelmarques1024-dotcom/karnel-termux">
-    <img src="https://img.shields.io/badge/version-4.17.8-0078D4?style=for-the-badge" alt="Version">
+    <img src="https://img.shields.io/badge/version-4.17.9-0078D4?style=for-the-badge" alt="Version">
   </a>
   <a href="https://www.npmjs.com/package/karnel-termux">
     <img src="https://img.shields.io/npm/v/karnel-termux?style=for-the-badge&logo=npm&color=cb3837" alt="npm">
@@ -61,7 +61,7 @@ Core agent contributions by **devcorex**.
 ### Via checksummed GitHub release (recommended)
 
 ```bash
-version=4.17.8
+version=4.17.9
 tmpdir=$(mktemp -d) && trap 'rm -rf "$tmpdir"' EXIT
 base="https://github.com/israelmarques1024-dotcom/karnel-termux/releases/download/v$version"
 curl -fsSL "$base/karnel-termux-install.sh" -o "$tmpdir/karnel-termux-install.sh"

package/docs/CHANGELOG.md

@@ -1,5 +1,48 @@
+---
+title: Documentation Changelog
+permalink: /CHANGELOG/
+---
+
 # Documentation Changelog
 
+## 4.17.9
+
+- Hardened installer and runtime security across the toolkit:
+  - `droid` binary install now refuses when no published SHA-256 digest is
+    available (fail-closed) instead of silently skipping verification.
+  - `keelcode` and `supabase` now extract archives through the hardened
+    `safe_extract_tar` (rejects symlink/absolute-path traversal) instead of
+    raw `tar`.
+  - Restored OpenCode installation: upstream publishes no checksum, so
+    `github_download_and_extract` warns instead of refusing (other tools that
+    publish checksums remain fail-closed).
+  - `cursor-cli` now validates the downloaded bundle is a real gzip archive
+    before extraction.
+  - Agent PLAN (read-only) mode write-guard hardened: now blocks `sed -i` /
+    `perl -i`, full-screen editors, and file descriptors like `2>file`.
+  - Agent compaction no longer drops the freshly built summary during the
+    trim safety-net.
+  - `voice` uninstall no longer removes `termux-api` unless Karnel installed it.
+  - `karnel show` no longer depends on `realpath` (portable fallback).
+  - `karnel update` reports the accurate installed version instead of a
+    misleading `latest`.
+  - Reinstall no longer deletes the ownership marker before confirming the
+    install, preventing a tool from being orphaned on install failure.
+
+## 4.17.8
+
+- Documentation site reconciled with the GitHub Pages deployment: the `Publish
+  Docs` workflow (`.github/workflows/docs.yml`) builds Jekyll from `docs/` and
+  deploys to GitHub Pages, so the live documentation URL is
+  `https://israelmarques1024-dotcom.github.io/karnel-termux/`.
+- `docs/CHANGELOG.md` is now a rendered page (added front matter + permalink)
+  and all internal links to it use the clean `/CHANGELOG/` path.
+- Tool counts verified against the actual `karnel/tools/*` and
+  `karnel/tools/ai/*` directories: 45 AI tools, 3 editors, 8 languages,
+  5 databases, 22 dev tools, 11 npm packages, 10 shell plugins, 4 UI
+  components, 4 deploy CLIs, 6 games, 2 network tools, 12 utility tools,
+  30 security tools, 1 automation tool.
+
 ## 4.17.7
 
 - Documentation site overhauled: valid `_config.yml`, cayman-compatible custom

package/docs/_config.yml

@@ -7,7 +7,7 @@ lang: en-US
 theme: jekyll-theme-cayman
 markdown: kramdown
 logo: /assets/images/karnel-logo.png
-custom_css: /assets/css/style.css
+custom_css: /karnel-termux/assets/css/style.css
 baseurl: /karnel-termux
 show_downloads: false
 exclude:

package/docs/assets/css/style.scss

@@ -14,6 +14,7 @@
   --karnel-text: #c9d1d9;
   --karnel-muted: #8b949e;
   --karnel-code-bg: #161b22;
+  color-scheme: dark light;
 }
 
 html {
@@ -37,13 +38,23 @@ body {
 }
 
 @media (prefers-color-scheme: dark) {
+  html {
+    background: var(--karnel-bg);
+  }
   body {
     background: var(--karnel-bg);
     color: var(--karnel-text);
   }
+  .main-content {
+    color: var(--karnel-text);
+  }
   .page-header {
     background-image: linear-gradient(120deg, #0078d4, #2f81f7);
   }
+  .page-header .project-name,
+  .page-header .project-tagline {
+    color: #ffffff;
+  }
   .main-content h1,
   .main-content h2,
   .main-content h3,

package/docs/doctor/index.md

@@ -239,5 +239,5 @@ Regression coverage lives in `tests/smoke.sh` and verifies nested module syntax,
 the 76-entry registry, pipeline-safe parsing, mode counts, hidden GitHub workflow
 detection, scoped NestJS detection, TypeScript, and Python manifests.
 
-See [the 2026-07-16 changelog](../CHANGELOG.md) for the complete audit and hardening
+See [the 2026-07-16 changelog](../CHANGELOG/) for the complete audit and hardening
 record.

package/docs/index.md

@@ -11,7 +11,7 @@ Navigate the docs:
   <li><a href="./doctor/">Doctor System</a></li>
   <li><a href="./troubleshooting/">Troubleshooting</a></li>
   <li><a href="./ARCHITECTURE/">Architecture</a></li>
-  <li><a href="./CHANGELOG.md">Changelog</a></li>
+  <li><a href="./CHANGELOG/">Changelog</a></li>
   <li><a href="https://israelmarques1024-dotcom.github.io/karnel-termux/">Live Site</a></li>
 </ul>
 
@@ -38,7 +38,7 @@ voice commands, and reviewed plugins — all from modules: `ai`, `auto`, `db`,
   <a href="https://github.com/israelmarques1024-dotcom/karnel-termux/blob/main/karnel/tools/utils/fconv/README.md">Utility Scripts — fconv, notes, treex, and more</a>
   <a href="./cli/#supabase--remote-project-helpers">Supabase CLI — remote-project helpers</a>
   <a href="./ARCHITECTURE/">Architecture — project structure and module system</a>
-  <a href="./CHANGELOG.md">Changelog — version history and fixes</a>
+  <a href="./CHANGELOG/">Changelog — version history and fixes</a>
 </div>
 
 ## Credits

package/docs/troubleshooting/index.md

@@ -43,12 +43,21 @@ npm publish does not block the release. The workflow needs `contents: write`
 permission (already declared). If `gh release create` fails, confirm the tag
 exists and the token used by GitHub Actions has write access.
 
-## Vercel deployment
-
-The live site deploys automatically through the Vercel integration on push to
-`main`; no GitHub Actions workflow is required. If a deploy fails, check the
-Vercel dashboard for build logs and confirm the framework preset, install
-command, and environment variables.
+## Documentation site (GitHub Pages)
+
+The documentation site is a Jekyll (cayman theme) site built from the `docs/`
+directory and published to GitHub Pages by the `Publish Docs` workflow
+(`.github/workflows/docs.yml`) on every push to `main` that changes `docs/**`.
+The workflow runs `actions/jekyll-build-pages` (from `docs/`, output to
+`docs/_site`), uploads the result as a Pages artifact, and deploys it to the
+`github-pages` environment. The live site is
+`https://israelmarques1024-dotcom.github.io/karnel-termux/`.
+
+If a build fails, open the Actions run for the failing job and read the Jekyll
+output: the usual causes are invalid `_config.yml` YAML, an SCSS compile error
+in `assets/css/style.scss`, or a malformed `{{ }}` Liquid tag. After a
+successful deploy, the published site is visible under the repository's
+**Settings → Pages**.
 
 ## Reporting a bug
 

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-ad787cd9d5efa67b498b0b1dc5e00203553b32e7
+f3ce43f67dd4d213f0af574d1673e8dbd6c910b9

package/karnel/cli/commands/show.sh

@@ -86,8 +86,15 @@ show_main() {
     return
   fi
 
-  local readme_path
-  readme_path="$(realpath "$KARNEL_PATH/tools/$module/$tool/README.md" 2>/dev/null)"
+  local readme_path raw
+  raw="$KARNEL_PATH/tools/$module/$tool/README.md"
+  if command -v realpath &>/dev/null; then
+    readme_path="$(realpath "$raw" 2>/dev/null)"
+  elif command -v readlink &>/dev/null; then
+    readme_path="$(readlink -f "$raw" 2>/dev/null)"
+  else
+    readme_path="$raw"
+  fi
 
   if [[ -z "$readme_path" ]]; then
     log_error "No documentation found for $module/$tool"

package/karnel/cli/commands/update.sh

@@ -347,12 +347,22 @@ _update_try_git() {
   return 1
 }
 
+_npm_installed_version() {
+  local v pr
+  v=$(npm list -g karnel-termux 2>/dev/null | grep -oP 'karnel-termux@\K[0-9.]+')
+  if [[ -z "$v" ]]; then
+    pr="$(npm root -g 2>/dev/null)/karnel-termux/package.json"
+    [[ -f "$pr" ]] && v=$(grep -oP '"version"\s*:\s*"\K[0-9.]+' "$pr")
+  fi
+  printf '%s' "${v:-unknown}"
+}
+
 _update_try_npm() {
   command -v npm &>/dev/null || return 1
   log_info "Trying npm update..."
   if npm update -g karnel-termux --ignore-scripts 2>/dev/null; then
     local new_ver
-    new_ver=$(npm list -g karnel-termux 2>/dev/null | grep karnel-termux | grep -oP '@\K[0-9.]+' || echo "latest")
+    new_ver=$(_npm_installed_version)
     log_success "Updated to v$new_ver via npm"
     return 0
   fi
@@ -365,7 +375,7 @@ _update_try_npm_install() {
   log_info "Trying npm install..."
   if npm install -g karnel-termux@latest --ignore-scripts 2>/dev/null; then
     local new_ver
-    new_ver=$(npm list -g karnel-termux 2>/dev/null | grep karnel-termux | grep -oP '@\K[0-9.]+' || echo "latest")
+    new_ver=$(_npm_installed_version)
     log_success "Updated to v$new_ver via npm install"
     return 0
   fi

package/karnel/tools/ai/cursor-cli/install.sh

@@ -129,11 +129,18 @@ _download_cursor_binary_impl() {
 
   # Cursor does not publish a verifiable checksum for this asset, so integrity
   # relies on HTTPS transport only; upstream does not publish a verifiable checksum.
+  # Validate the payload is a real gzip archive before extracting so a corrupted
+  # or error response (e.g. an HTML error page) is rejected.
   if ! curl -fsSL "$download_url" -o "$staging_dir/$tarball" &>>"$LOG_FILE"; then
     rm -rf "$staging_dir"
     log_error "Failed to download Cursor CLI binary"
     return 1
   fi
+  if ! gzip -t "$staging_dir/$tarball" 2>/dev/null; then
+    rm -rf "$staging_dir"
+    log_error "Downloaded Cursor bundle is not a valid gzip archive"
+    return 1
+  fi
 
   if ! tar -zxf "$staging_dir/$tarball" --strip-components=1 -C "$staging_dir" &>>"$LOG_FILE"; then
     rm -rf "$staging_dir"

package/karnel/tools/ai/droid/install.sh

@@ -125,13 +125,22 @@ _download_droid_binary_impl() {
 
   local expected actual
   expected="$(curl -fsSL "$sha_url" 2>/dev/null | awk '{print $1}')"
-  if [ -n "$expected" ] && command -v sha256sum &>/dev/null; then
+  if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
+    log_error "No published SHA-256 for Droid binary; refusing install"
+    rm -f "$DROID_DATA_DIR/droid"
+    return 1
+  fi
+  if command -v sha256sum &>/dev/null; then
     actual="$(sha256sum "$DROID_DATA_DIR/droid" | awk '{print $1}')"
     if [ "$actual" != "$expected" ]; then
       log_error "Checksum verification failed"
       rm -f "$DROID_DATA_DIR/droid"
       return 1
     fi
+  else
+    log_error "sha256sum unavailable; refusing install"
+    rm -f "$DROID_DATA_DIR/droid"
+    return 1
   fi
 
   chmod +x "$DROID_DATA_DIR/droid"

package/karnel/tools/ai/keelcode/install.sh

@@ -2,6 +2,7 @@
 
 import "@/utils/log"
 import "@/utils/version"
+import "@/utils/install"
 
 if ! declare -f safe_extract_tar >/dev/null 2>&1; then
   safe_extract_tar() {

package/karnel/tools/deploy/supabase/install.sh

@@ -2,6 +2,14 @@
 
 import "@/utils/log"
 import "@/utils/version"
+import "@/utils/install"
+
+if ! declare -f safe_extract_tar >/dev/null 2>&1; then
+  safe_extract_tar() {
+    local archive="$1" outdir="$2" strip_components="${3:-0}"
+    tar -xzf "$archive" -C "$outdir" --strip-components="$strip_components"
+  }
+fi
 
 _SUPABASE_VERSION="2.20.8"
 _SUPABASE_RELEASE_URL="https://github.com/supabase/cli/releases/download/v${_SUPABASE_VERSION}"
@@ -81,8 +89,11 @@ install_supabase() (
   fi
   log_success "Checksum verified"
 
-  # Extract
-  tar -xzf "$tmp_dir/$filename" -C "$tmp_dir" supabase 2>/dev/null
+  # Extract (hardened: rejects symlink/absolute-path traversal)
+  safe_extract_tar "$tmp_dir/$filename" "$tmp_dir" || {
+    log_error "Extraction failed"
+    return 1
+  }
   if [[ ! -f "$tmp_dir/supabase" ]]; then
     log_error "Extraction failed"
     return 1

package/karnel/tools/voice/uninstall.sh

@@ -3,13 +3,20 @@
 import "@/utils/log"
 
 _uninstall_voice_tool() {
+  local karnel_data="${KARNEL_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
+  local marker="$karnel_data/voice/.termux-api-managed"
   if command -v termux-api &>/dev/null; then
-    log_info "Removing Termux:API..."
-    if ! pkg uninstall -y termux-api &>>"$LOG_FILE"; then
-      log_error "Failed to remove Termux:API (see $LOG_FILE)"
-      return 1
+    if [[ -f "$marker" ]]; then
+      log_info "Removing Termux:API (installed by Karnel)..."
+      if ! pkg uninstall -y termux-api &>>"$LOG_FILE"; then
+        log_error "Failed to remove Termux:API (see $LOG_FILE)"
+        return 1
+      fi
+      rm -f "$marker"
+      log_success "Termux:API removed"
+    else
+      log_info "Termux:API is present but was not installed by Karnel; leaving it in place"
     fi
-    log_success "Termux:API removed"
   else
     log_info "Termux:API is not installed"
   fi

package/karnel/utils/agent_actions.sh

@@ -481,14 +481,22 @@ _agent_exec_to_file() {
 # ------------------------------------------------------------
 _agent_cmd_is_write() {
 	local cmd="$1"
-	# file redirections (2>&1 / >= are not redirections to a file)
-	if printf '%s\n' "$cmd" | grep -qE '(^|[;&|[:space:]])(>|>>)[^=&]'; then
+	# file redirections: >file >>file 2>file 1>>file &>file  (excludes fd-to-fd like >&2 and comparisons >=)
+	if printf '%s\n' "$cmd" | grep -qE '(^|[;&|[:space:]])(>|>>|&>|[0-9]>|[0-9]>>)([^&=]|$)'; then
 		return 0
 	fi
 	# command substitution / backticks execute arbitrary code → write
 	if printf '%s\n' "$cmd" | grep -qE '\$\(|`'; then
 		return 0
 	fi
+	# in-place editors: sed -i / perl -i modify files in place
+	if printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(sed|perl)[[:space:]][^|;&]*-[A-Za-z]*i[A-Za-z]*([[:space:]]|$)'; then
+		return 0
+	fi
+	# full-screen / line editors that can modify files
+	if printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(vim|nvim|emacs|ed|ex|vi|nano)[[:space:]]'; then
+		return 0
+	fi
 	# blocklist of commands that write to disk / change state / spawn a shell
 	printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(rm|rmdir|unlink|mv|cp|mkdir|touch|ln|chmod|chown|chgrp|install|truncate|tee|dd|mkfs|mount|umount|tar|gzip|gunzip|bzip2|xz|zstd|curl|wget|python3|python|node|npm|bun|yarn|pnpm|cargo|go |rustc|git (add|commit|push|pull|merge|rebase|reset|checkout|switch|restore|clean|stash|tag|clone|init|rm|mv)|pkg (install|uninstall|upgrade|reinstall|update)|apt( |-)|apt-get|dpkg|yum|dnf|pacman|brew|pip|pip3|uv|conda|mysql|psql|sqlite3|redis-cli|mongosh|kill|pkill|killall|service|systemctl|halt|reboot|shutdown|sudo|doas|su|pkexec|chroot|bash|sh|dash|zsh|ksh|eval|source|exec|screen|tmux|ssh|scp|sftp|rsync|telnet|nc|ncat|ftp|lftp|rsh|sshpass|socat|crontab|at |iptables|nft|ufw|docker|podman|kubectl|helm)[[:space:]]' && return 0
 	return 1
@@ -1359,12 +1367,17 @@ agent_context_footer() {
 agent_history_trim_tokens() {
 	local history="$1" budget="${2:-0}"
 	(( budget <= 0 )) && { echo "$history"; return; }
-	local toks n
+	local toks n drop_idx is_summary
 	while :; do
 		toks=$(agent_context_tokens "$history")
 		(( toks <= budget )) && break
 		n=$(printf '%s' "$history" | jq 'length')
 		(( n <= 4 )) && break
+		drop_idx=$(printf '%s' "$history" | jq -c 'if .[0].role == "system" then 1 else 0 end')
+		is_summary=$(printf '%s' "$history" | jq -r --argjson i "$drop_idx" '.[$i].content // "" | contains("<compacted_summary>")')
+		if [[ "$is_summary" == "true" ]]; then
+			break
+		fi
 		history=$(printf '%s' "$history" | jq -c 'if .[0].role == "system" then .[0:1] + .[2:] else .[1:] end')
 	done
 	echo "$history"

package/karnel/utils/install.sh

@@ -291,9 +291,7 @@ github_download_and_extract() {
   if [[ "$expected" =~ ^[0-9a-f]{64}$ ]]; then
     verify_sha256 "$tarball" "$expected" || return 1
   else
-    log_error "No verifiable SHA-256 digest published for $repo/$asset; refusing install"
-    rm -f "$tarball"
-    return 1
+    log_warn "No published SHA-256 digest for $repo/$asset; skipping integrity verification"
   fi
   extract_tarball "$tarball" "$outdir" || return 1
   return 0

package/karnel/utils/tools.sh

@@ -60,9 +60,6 @@ _run_tool_lifecycle_action() {
     "$uninstall_handler"
     rc=$?
     (( rc == 0 )) || return "$rc"
-    if (( protected )); then
-      rm -f "$marker" || return 1
-    fi
     "$install_handler"
     rc=$?
     if (( rc == 0 && protected )); then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.8",
+  "version": "4.17.9",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"