karnel-termux 4.17.9 → 4.17.13

package/docs/karnel/shell/index.md

@@ -0,0 +1,17 @@
+---
+title: Shell module
+permalink: /karnel/shell/
+layout: base
+---
+
+# Shell module
+
+Shell enhancements (ZSH, Oh My Zsh, zoxide).
+## Install
+
+| `shell`   | `--powerlevel10k`, `--zsh-defer`, `--zsh-autosuggestions`, `--zsh-syntax-highlighting`, `--history-substring`, `--zsh-completions`, `--fzf-tab`, `--you-should-use`, `--zsh-autopair`, `--better-npm` |
+
+See the [CLI reference]({ '/cli/' | relative_url }#shell) for the full command list, or the
+[source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/shell.sh).
+
+[← Back to docs]({ '/' | relative_url })

package/docs/karnel/ui/index.md

@@ -0,0 +1,17 @@
+---
+title: Ui module
+permalink: /karnel/ui/
+layout: base
+---
+
+# Ui module
+
+Termux UI components.
+## Install
+
+| `ui`      | `--font`, `--extra-keys`, `--cursor`, `--banner` |
+
+See the [CLI reference]({ '/cli/' | relative_url }#ui) for the full command list, or the
+[source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/ui.sh).
+
+[← Back to docs]({ '/' | relative_url })

package/docs/karnel/utils/index.md

@@ -0,0 +1,21 @@
+---
+title: Utils module
+permalink: /karnel/utils/
+layout: base
+---
+
+# Utils module
+
+Utility scripts (converters, notes, QR codes, and more).
+> **🌟 Herdr** — Karnel now ships the [Herdr](https://herdr.dev) terminal AI assistant CLI.
+Install it with `karnel install utils --herdr`. The binary is checksum-verified, installed atomically,
+and tracked with Karnel ownership markers so `karnel uninstall utils --herdr` is clean.
+
+## Install
+
+| `utils`   | `--fconv`, `--filecheck`, `--websites`, `--notes`, `--treex`, `--passman`, `--applaunch`, `--splash`, `--httptmux`, `--zork`, `--qrcode`, `--superfile`, `--herdr` |
+
+See the [CLI reference]({ '/cli/' | relative_url }#utils) for the full command list, or the
+[source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/utils.sh).
+
+[← Back to docs]({ '/' | relative_url })

package/docs/karnel/voice/index.md

@@ -0,0 +1,17 @@
+---
+title: Voice module
+permalink: /karnel/voice/
+layout: base
+---
+
+# Voice module
+
+Voice commands for AI agents.
+## Install
+
+| `voice`          | Voice command |
+
+See the [CLI reference]({ '/cli/' | relative_url }#voice) for the full command list, or the
+[source on GitHub](https://github.com/israelmarques1024-dotcom/karnel-termux/tree/main/karnel/modules/voice.sh).
+
+[← Back to docs]({ '/' | relative_url })

package/docs/troubleshooting/index.md

@@ -1,3 +1,9 @@
+---
+title: Troubleshooting
+permalink: /troubleshooting/
+layout: base
+---
+
 # Troubleshooting
 
 Common issues when installing, updating, or publishing Karnel Termux.
@@ -55,7 +61,7 @@ The workflow runs `actions/jekyll-build-pages` (from `docs/`, output to
 
 If a build fails, open the Actions run for the failing job and read the Jekyll
 output: the usual causes are invalid `_config.yml` YAML, an SCSS compile error
-in `assets/css/style.scss`, or a malformed `{{ }}` Liquid tag. After a
+in `assets/css/style.scss`, or a malformed `{% raw %}{{ }}{% endraw %}` Liquid tag. After a
 successful deploy, the published site is visible under the repository's
 **Settings → Pages**.
 

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-f3ce43f67dd4d213f0af574d1673e8dbd6c910b9
+3d9d862c0be40df2c3f17648f56bf83ef74507b7

package/karnel/bin/karnel

@@ -119,7 +119,7 @@ show_update_notification() {
   fi
 }
 
-if [[ "${KARNEL_READ_ONLY:-0}" != "1" ]] && [[ "${1:-}" != "update" ]] && [[ "${1:-}" != "uninstall" ]] && [[ "${1:-}" != "reinstall" ]]; then
+if [[ "${KARNEL_READ_ONLY:-0}" != "1" ]] && [[ "${1:-}" != "update" ]] && [[ "${1:-}" != "uninstall" ]] && [[ "${1:-}" != "reinstall" ]] && [[ "${1:-}" != "upgrade" ]]; then
   check_for_updates
   import "@/utils/log"
   import "@/utils/colors"

package/karnel/cli/commands/brain.sh

@@ -121,7 +121,7 @@ _brain_slug_escape() {
 _brain_update_related() {
 	local file="$1" slug="$2"
 	local tmp
-	tmp=$(mktemp "${TMPDIR:-/tmp}/karnel-brain.XXXXXX")
+	tmp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-brain.XXXXXX")
 	local frontmatter_end
 	frontmatter_end=$(awk '/^---$/ {++n} n==2 {print NR; exit}' "$file")
 
@@ -151,7 +151,7 @@ _brain_update_related() {
 _brain_remove_related() {
 	local file="$1" slug="$2"
 	local tmp
-	tmp=$(mktemp "${TMPDIR:-/tmp}/karnel-brain.XXXXXX")
+	tmp=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-brain.XXXXXX")
 	local frontmatter_end
 	frontmatter_end=$(awk '/^---$/ {++n} n==2 {print NR; exit}' "$file")
 

package/karnel/cli/commands/doctor/code_exec.sh

@@ -126,6 +126,10 @@ _exec_apply_fix() {
   fi
 
   log_info "Applying fix: $tool ($lang)..."
+  # Snapshot the target before an in-place rewrite so the user can revert.
+  if [[ -n "$file" && -f "$file" && ! -e "$file.karnel-bak" ]]; then
+    cp -p "$file" "$file.karnel-bak" 2>/dev/null || true
+  fi
   local out rc
   if out=$(cd "$dir" && timeout 60 bash -c "$full_cmd" 2>&1); then
     rc=0

package/karnel/cli/commands/doctor/code_langs.sh

@@ -64,7 +64,7 @@ _init_lang_tools() {
   LANG_TOOLS["C/C++:clang_tidy"]="clang-tidy|lint|clang-tidy {} -- -std=c17 2>&1 | head -20|||official"
 
   # Java
-  LANG_TOOLS["Java:javac"]="javac|syntax|javac -d \"${TMPDIR:-/tmp}\" -Xlint:all {} 2>&1 | head -10|||official"
+  LANG_TOOLS["Java:javac"]="javac|syntax|javac -d \"${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}\" -Xlint:all {} 2>&1 | head -10|||official"
 
   # Docker
   LANG_TOOLS["Docker:hadolint"]="hadolint|lint|hadolint Dockerfile|||community"

package/karnel/cli/commands/doctor/fixes.sh

@@ -3,6 +3,7 @@
 
 import "@/utils/log"
 import "@/utils/colors"
+import "@/utils/install"
 
 _fix_storage() {
   termux-setup-storage 2>/dev/null
@@ -207,7 +208,7 @@ _fix_psutil() {
   local tmp="$PREFIX/tmp/psutil_patch"
   mkdir -p "$tmp"
   pip download psutil==7.2.2 --no-binary :all: --no-deps -d "$tmp" 2>/dev/null || return 1
-  tar xzf "$tmp/psutil-7.2.2.tar.gz" -C "$tmp"
+  safe_extract_tar "$tmp/psutil-7.2.2.tar.gz" "$tmp" || return 1
   if grep -q 'LINUX = sys.platform.startswith("linux")' "$tmp/psutil-7.2.2/psutil/_common.py" 2>/dev/null; then
     sed -i 's/LINUX = sys.platform.startswith("linux")/LINUX = sys.platform.startswith(("linux", "android"))/' "$tmp/psutil-7.2.2/psutil/_common.py"
   else
@@ -248,7 +249,18 @@ _fix_npm_shebangs() {
 }
 
 _fix_broken_symlinks() {
-  find "$PREFIX/bin" -type l ! -exec test -e {} \; -delete 2>/dev/null
+  local link target
+  for link in "$PREFIX/bin"/*; do
+    [[ -L "$link" ]] || continue
+    [[ -e "$link" ]] && continue
+    target="$(readlink -f "$link" 2>/dev/null || true)"
+    # Only remove broken symlinks that point into Karnel-managed locations so we
+    # never delete unrelated third-party software from the user's environment.
+    if [[ "$target" == "$KARNEL_PATH"/* || "$target" == "$KARNEL_DATA"/* ||
+          "$target" == "$PREFIX/lib/node_modules"/* || "$target" == "$PREFIX/lib"/* ]]; then
+      rm -f "$link" 2>/dev/null || true
+    fi
+  done
   return 0
 }
 

package/karnel/cli/commands/doctor.sh

@@ -1413,20 +1413,45 @@ doctor_termux() {
     fi
     if [[ "$confirm" == "y" ]]; then
       echo
+      local -A DESTRUCTIVE_FIXES=(
+        [_fix_ai_install]=1
+        [_fix_proot_ubuntu]=1
+        [_fix_disk_cleanup]=1
+        [_fix_broken_symlinks]=1
+        [_fix_apt_cache]=1
+      )
       for ((i=0; i<${#fix_commands[@]}; i++)); do
         log_info "Fixing: ${fix_descriptions[$i]}..."
         local callback="${fix_callbacks[$i]:-}"
         local success=false
-
-        if [[ -n "$callback" ]] && type "$callback" &>/dev/null 2>&1; then
-          "$callback" && success=true
+        local apply_this="y"
+
+        # Destructive fixes are never auto-applied in --fix mode. In an
+        # interactive --fix session they require an explicit confirmation; in a
+        # non-interactive one they are skipped (fail-closed) to avoid wiping
+        # caches, reinstalling packages or deleting unrelated software.
+        if [[ -n "$callback" && -n "${DESTRUCTIVE_FIXES[$callback]:-}" ]]; then
+          if $FIX_MODE; then
+            if [[ -t 0 ]]; then
+              read_confirm "DANGEROUS: ${fix_descriptions[$i]}. Apply?" apply_this
+            else
+              log_warn "Skipping destructive fix (non-interactive): ${fix_descriptions[$i]}"
+              continue
+            fi
+          fi
         fi
 
-        if [[ "$success" == "true" ]]; then
-          ((fixed++))
-          log_success "Fixed: ${fix_descriptions[$i]}"
-        else
-          log_warn "Could not fix: ${fix_descriptions[$i]}"
+        if [[ "$apply_this" == "y" ]]; then
+          if [[ -n "$callback" ]] && type "$callback" &>/dev/null 2>&1; then
+            "$callback" && success=true
+          fi
+
+          if [[ "$success" == "true" ]]; then
+            ((fixed++))
+            log_success "Fixed: ${fix_descriptions[$i]}"
+          else
+            log_warn "Could not fix: ${fix_descriptions[$i]}"
+          fi
         fi
       done
       echo

package/karnel/cli/commands/open.sh

@@ -3,7 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 
-OPEN_BASE_URL="https://karneltermux.vercel.app"
+OPEN_DOCS="https://israelmarques1024-dotcom.github.io/karnel-termux"
 
 open_main() {
 	if [[ $# -eq 0 ]]; then
@@ -16,74 +16,30 @@ open_main() {
 
 	case "$target" in
 	karnel | help)
-		url="$OPEN_BASE_URL/karnel"
+		url="$OPEN_DOCS/"
 		;;
-	lang)
-		url="$OPEN_BASE_URL/karnel/lang"
-		;;
-	db)
-		url="$OPEN_BASE_URL/karnel/db"
-		;;
-	ai)
-		url="$OPEN_BASE_URL/karnel/ai"
-		;;
-	editor)
-		url="$OPEN_BASE_URL/karnel/editor"
-		;;
-	dev)
-		url="$OPEN_BASE_URL/karnel/dev"
-		;;
-	npm)
-		url="$OPEN_BASE_URL/karnel/npm"
-		;;
-	shell)
-		url="$OPEN_BASE_URL/karnel/shell"
-		;;
-	ui)
-		url="$OPEN_BASE_URL/karnel/ui"
-		;;
-	auto)
-		url="$OPEN_BASE_URL/karnel/auto"
-		;;
-	deploy)
-		url="$OPEN_BASE_URL/karnel/deploy"
+	herdr)
+		url="$OPEN_DOCS/karnel/utils"
 		;;
 	supabase)
-		url="$OPEN_BASE_URL/karnel/supabase"
+		url="$OPEN_DOCS/karnel/deploy"
+		;;
+	cleanup)
+		url="$OPEN_DOCS/cli"
 		;;
-  cleanup)
-    url="$OPEN_BASE_URL/karnel/cleanup"
-    ;;
-  network)
-    url="$OPEN_BASE_URL/karnel/network"
-    ;;
-  utils)
-    url="$OPEN_BASE_URL/karnel/utils"
-    ;;
-  games)
-    url="$OPEN_BASE_URL/karnel/games"
-    ;;
-  voice)
-    url="$OPEN_BASE_URL/karnel/voice"
-    ;;
-  plugin)
-    url="$OPEN_BASE_URL/karnel/plugin"
-    ;;
-  security)
-    url="$OPEN_BASE_URL/karnel/security"
-    ;;
-  osint|robin)
-    url="$OPEN_BASE_URL/karnel/osint"
-    ;;
-  --help | -h)
+	--help | -h)
 		open_help
 		return
 		;;
 	*)
-		log_error "Unknown target: $target"
-		echo
-		open_help
-		return 1
+		if [[ -f "$KARNEL_PATH/modules/$target.sh" ]]; then
+			url="$OPEN_DOCS/karnel/$target"
+		else
+			log_error "Unknown target: $target"
+			echo
+			open_help
+			return 1
+		fi
 		;;
 	esac
 
@@ -130,20 +86,21 @@ open_help() {
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "npm" "Node.js tools"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "shell" "ZSH shell"
 	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "ui" "Termux UI"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "auto" "Automation tools"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "deploy" "Deploy CLIs"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "supabase" "Supabase CLI"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "games" "Games"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "cleanup" "Cache cleanup"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "network" "Network tools"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "utils" "Utility tools"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "voice" "Voice command"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "osint" "OSINT tools"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "plugin" "Plugin system"
-  printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "security" "Security tools"
-  echo
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "auto" "Automation tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "deploy" "Deploy CLIs"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "supabase" "Supabase CLI"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "games" "Games"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "cleanup" "Cache cleanup"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "network" "Network tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "utils" "Utility tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "voice" "Voice command"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "osint" "OSINT tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "plugin" "Plugin system"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "security" "Security tools"
+	printf "    ${D_GREEN}%-14s${NC} ${D_DIM}%s${NC}\n" "herdr" "Herdr terminal AI assistant"
+	echo
 	separator_section "Website"
 	echo
-	list_item "${D_CYAN}$OPEN_BASE_URL${NC}"
+	list_item "${D_CYAN}$OPEN_DOCS${NC}"
 	echo
 }

package/karnel/cli/commands/pg.sh

@@ -635,8 +635,11 @@ pg_restore_db() {
 			success=true
 		fi
 	else
-		if loading "Restoring database" pg_restore -d "$db_name" -c "$backup_file" 2>/dev/null || pg_restore -d "$db_name" "$backup_file" 2>/dev/null; then
+		local pg_log="$KARNEL_CACHE/pg-restore.log"
+		if loading "Restoring database" pg_restore -d "$db_name" -c --single-transaction "$backup_file" 2>>"$pg_log"; then
 			success=true
+		else
+			log_warn "pg_restore failed; details in: $pg_log"
 		fi
 	fi
 
@@ -736,10 +739,24 @@ pg_schedule() {
 
 		local escaped_db; printf -v escaped_db '%q' "$db_name"
 		local escaped_path; printf -v escaped_path '%q' "$KARNEL_PATH"
-		local job="$cron_expr KARNEL_PATH=$escaped_path $escaped_path/bin/karnel pg backup $escaped_db >/dev/null 2>&1"
-		(crontab -l 2>/dev/null | grep -v "karnel pg backup $db_name"; echo "$job") | crontab -
-		log_success "Backup scheduled successfully ($interval) for database '$db_name'!"
-		list_item "Ensure cron daemon is running (run: 'crond')"
+		local pg_log="$KARNEL_CACHE/pg-backup.log"
+		local job="$cron_expr PATH=\"$PREFIX/bin:/usr/bin:/bin\" PREFIX=\"$PREFIX\" KARNEL_PATH=$escaped_path $escaped_path/bin/karnel pg backup $escaped_db >>\"$pg_log\" 2>&1"
+		local tmpcron
+		tmpcron="$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-pg.XXXXXX")" || {
+			log_error "Failed to schedule backup for database '$db_name'"
+			return 1
+		}
+		{
+			crontab -l 2>/dev/null | grep -vF "karnel pg backup $escaped_db"
+			echo "$job"
+		} >"$tmpcron"
+		if crontab "$tmpcron"; then
+			log_success "Backup scheduled successfully ($interval) for database '$db_name'!"
+			list_item "Ensure cron daemon is running (run: 'crond')"
+		else
+			log_error "Failed to schedule backup for database '$db_name'"
+		fi
+		rm -f "$tmpcron"
 	fi
 	echo
 }

package/karnel/cli/commands/show.sh

@@ -47,6 +47,11 @@ show_main() {
 		return 1
 	fi
 
+  if [[ ! "$module" =~ ^[A-Za-z0-9_-]+$ ]]; then
+    log_error "Invalid module name: $module"
+    return 1
+  fi
+
   if [[ "$module" == "backup" ]]; then
     _show_backup_docs "$tool"
     return

package/karnel/cli/commands/update.sh

@@ -226,9 +226,9 @@ _update_try_curl() {
   command -v curl &>/dev/null || return 1
 
   local meta installer sumfile tag
-  meta=$(mktemp "${TMPDIR:-/tmp}/karnel-meta.XXXXXX") || return 1
-  installer=$(mktemp "${TMPDIR:-/tmp}/karnel-install.XXXXXX") || { rm -f "$meta"; return 1; }
-  sumfile=$(mktemp "${TMPDIR:-/tmp}/karnel-sum.XXXXXX") || { rm -f "$meta" "$installer"; return 1; }
+  meta=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-meta.XXXXXX") || return 1
+  installer=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-install.XXXXXX") || { rm -f "$meta"; return 1; }
+  sumfile=$(mktemp "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/karnel-sum.XXXXXX") || { rm -f "$meta" "$installer"; return 1; }
 
   log_info "Trying the official curl installer..."
 

package/karnel/modules/shell.sh

@@ -32,7 +32,7 @@ install_oh_my_zsh() (
 	echo
 
 	local temp_base temp_dir temp_file
-	temp_base="${TMPDIR:-${PREFIX:-/tmp}/tmp}"
+	temp_base="${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}"
 	mkdir -p "$temp_base" || return 1
 	temp_dir=$(mktemp -d "$temp_base/karnel-omz.XXXXXX") || {
 		log_error "Failed to create private Oh My Zsh temporary directory"

package/karnel/tools/ai/cline/install.sh

@@ -3,6 +3,14 @@
 import "@/utils/log"
 import "@/utils/version"
 import "@/utils/colors"
+import "@/utils/install"
+
+if ! declare -f safe_extract_tar >/dev/null 2>&1; then
+  safe_extract_tar() {
+    local archive="$1" outdir="$2" strip_components="${3:-0}"
+    tar -xzf "$archive" -C "$outdir" --strip-components="$strip_components"
+  }
+fi
 
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
 : "${KARNEL_CACHE:=${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
@@ -99,7 +107,7 @@ _cline_install_global_impl() {
 
   mkdir -p "$CLINE_DATA_DIR"
   : >"$CLINE_DATA_DIR/$CLINE_MARKER"
-  if ! tar -xzf "$tarball" -C "$CLINE_DATA_DIR" &>>"$LOG_FILE"; then
+  if ! safe_extract_tar "$tarball" "$CLINE_DATA_DIR" &>>"$LOG_FILE"; then
     rm -f "$tarball"
     log_error "Failed to extract cline linux-arm64 binary"
     return 1

package/karnel/tools/ai/cursor-cli/install.sh

@@ -3,6 +3,7 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
 
 : "${KARNEL_CACHE:=${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
@@ -142,7 +143,7 @@ _download_cursor_binary_impl() {
     return 1
   fi
 
-  if ! tar -zxf "$staging_dir/$tarball" --strip-components=1 -C "$staging_dir" &>>"$LOG_FILE"; then
+  if ! safe_extract_tar "$staging_dir/$tarball" "$staging_dir" 1; then
     rm -rf "$staging_dir"
     log_error "Failed to extract Cursor CLI binary"
     return 1

package/karnel/tools/ai/goose/install.sh

@@ -197,7 +197,7 @@ _goose_download_binary_proot_impl() {
     return 1
   fi
   verify_github_release_asset aaif-goose/goose "v${latest_version}" "$tarball" "$GOOSE_DATA_DIR/$tarball" || return 1
-  if ! tar -xzf "$GOOSE_DATA_DIR/$tarball" -C "$GOOSE_DATA_DIR" &>>"$LOG_FILE"; then
+  if ! extract_tarball "$GOOSE_DATA_DIR/$tarball" "$GOOSE_DATA_DIR" &>>"$LOG_FILE"; then
     rm -f "$GOOSE_DATA_DIR/$tarball"
     log_error "Failed to extract Goose CLI"
     return 1

package/karnel/tools/ai/hermes-agent/install.sh

@@ -41,7 +41,7 @@ _patch_psutil_for_termux() {
   local tmp
   tmp=$(mktemp -d "$KARNEL_CACHE/psutil_patch.XXXXXX") || return 1
   "$HERMES_VENV/bin/python" -m pip download psutil==7.2.2 --no-binary :all: --no-deps -d "$tmp" 2>/dev/null || { rm -rf "$tmp"; return 1; }
-  tar xzf "$tmp/psutil-7.2.2.tar.gz" -C "$tmp" || { rm -rf "$tmp"; return 1; }
+  safe_extract_tar "$tmp/psutil-7.2.2.tar.gz" "$tmp" || { rm -rf "$tmp"; return 1; }
   sed -i 's/LINUX = sys.platform.startswith("linux")/LINUX = sys.platform.startswith(("linux", "android"))/' "$tmp/psutil-7.2.2/psutil/_common.py" || { rm -rf "$tmp"; return 1; }
   "$HERMES_VENV/bin/python" -m pip install "$tmp/psutil-7.2.2" || { rm -rf "$tmp"; return 1; }
   rm -rf "$tmp"

package/karnel/tools/ai/kiro/install.sh

@@ -3,6 +3,14 @@
 import "@/utils/log"
 import "@/utils/colors"
 import "@/utils/version"
+import "@/utils/install"
+
+if ! declare -f safe_extract_tar >/dev/null 2>&1; then
+  safe_extract_tar() {
+    local archive="$1" outdir="$2" strip_components="${3:-0}"
+    tar -xzf "$archive" -C "$outdir" --strip-components="$strip_components"
+  }
+fi
 
 : "${KARNEL_CACHE:=${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
 : "${KARNEL_DATA:=${XDG_DATA_HOME:-$HOME/.local/share}/karnel-data}"
@@ -136,7 +144,7 @@ print(version, download, checksum, sep="\t")
     fi
     log_success "Checksum verified"
 
-    if tar xzf "$archive" -C "$tmpdir" 2>>"$LOG_FILE"; then
+    if safe_extract_tar "$archive" "$tmpdir" 2>>"$LOG_FILE"; then
       bin_path=$(find "$tmpdir" -name "kiro-cli" -type f -executable 2>/dev/null | head -1)
       if [[ -z "$bin_path" ]]; then
         bin_path=$(find "$tmpdir" -name "kiro*" -type f -executable 2>/dev/null | head -1)

package/karnel/tools/deploy/supabase/install.sh

@@ -52,7 +52,7 @@ install_supabase() (
   local checksum_url="${_SUPABASE_RELEASE_URL}/supabase_${_SUPABASE_VERSION}_checksums.txt"
   local tmp_dir staged_bin marker_staging="" old_bin="" old_marker=""
   local _kdir="${KARNEL_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
-  mkdir -p "$_kdir" 2>/dev/null || _kdir="${TMPDIR:-/tmp}"
+  mkdir -p "$_kdir" 2>/dev/null || _kdir="${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}"
   tmp_dir=$(mktemp -d "$_kdir/supabase.XXXXXX") || return 1
   staged_bin=""
   trap 'rm -rf "$tmp_dir"; [[ -z "$staged_bin" ]] || rm -f "$staged_bin"; [[ -z "$marker_staging" ]] || rm -f "$marker_staging"' EXIT

package/karnel/tools/plugins/install.sh

@@ -519,7 +519,10 @@ _plugin_verify_checksum() {
   local expected actual
 
   expected="$(jq -r '.checksum // empty' "$manifest")" || return 1
-  [[ -n "$expected" ]] || return 0
+  if [[ -z "$expected" ]]; then
+    log_error "Plugin '$(jq -r '.name' "$manifest")' has no checksum; refusing install"
+    return 1
+  fi
 
   actual="$(_plugin_payload_checksum "$plugin_root")" || return 1
   if [[ "$actual" != "$expected" ]]; then
@@ -882,11 +885,15 @@ _plugin_clone_repository() {
   local repo="$1"
   local ref="$2"
   local destination="$3"
+  local commit="$4"
   local source_url="https://github.com/$repo.git"
 
   _plugin_require_command git || return 1
 
-  if [[ -n "$ref" ]]; then
+  if [[ -n "$commit" ]]; then
+    git clone "$source_url" "$destination" || return 1
+    git -C "$destination" checkout "$commit" --detach || return 1
+  elif [[ -n "$ref" ]]; then
     git clone --depth=1 --branch "$ref" "$source_url" "$destination"
   else
     git clone --depth=1 "$source_url" "$destination"
@@ -1083,6 +1090,13 @@ _plugin_stage_and_install() {
   local replace_existing="$7"
   local staging checkout checkout_root candidate candidate_root manifest_name commit installed_ref expected_commit registry_name
 
+  expected_commit=""
+  registry_name=""
+  if [[ -n "$registry_entry" ]]; then
+    expected_commit="$(jq -r '.commit // empty' <<<"$registry_entry")" || return 1
+    registry_name="$(jq -r '.name' <<<"$registry_entry")" || return 1
+  fi
+
   _plugin_prepare_plugins_dir || return 1
   _plugin_validate_repo "$repo" || return 1
   [[ -z "$ref" ]] || _plugin_ref_is_valid "$ref" || {
@@ -1100,7 +1114,7 @@ _plugin_stage_and_install() {
   }
   checkout="$staging/repository"
 
-  if ! _plugin_clone_repository "$repo" "$ref" "$checkout"; then
+  if ! _plugin_clone_repository "$repo" "$ref" "$checkout" "$expected_commit"; then
     log_error "Failed to clone plugin repository '$repo'."
     _plugin_cleanup_staging "$staging"
     return 1

package/karnel/tools/security/amass/install.sh

@@ -47,7 +47,7 @@ install_amass() (
   esac
   url="https://github.com/owasp-amass/amass/releases/download/v${_AMASS_VERSION}/$asset"
 
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/amass.XXXXXX") || return 1
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/amass.XXXXXX") || return 1
   staged_bin=""
   trap 'rm -rf "$tmpdir"; [ -z "$staged_bin" ] || rm -f "$staged_bin"' EXIT
   archive="$tmpdir/amass.zip"

package/karnel/tools/security/burpsuite/install.sh

@@ -28,7 +28,7 @@ install_burpsuite() (
 
   local url tmpdir staged_dir wrapper old_dir wrapper_backup
   url="https://portswigger.net/burp/releases/download?product=community&type=Jar&version=${_BURP_VERSION}"
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/burpsuite.XXXXXX") || return 1
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/burpsuite.XXXXXX") || return 1
   trap 'rm -rf "$tmpdir"' EXIT
   staged_dir="$tmpdir/data"
   mkdir -p "$staged_dir" "$PREFIX/bin" "$(dirname "$_BURP_DIR")" || return 1

package/karnel/tools/security/ffuf/install.sh

@@ -26,7 +26,7 @@ _download_ffuf() (
     *) return 1 ;;
   esac
   url="https://github.com/ffuf/ffuf/releases/download/v${_FFUF_VERSION}/$asset"
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/ffuf.XXXXXX") || return 1
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/ffuf.XXXXXX") || return 1
   staged_bin=""
   trap 'rm -rf "$tmpdir"; [ -z "$staged_bin" ] || rm -f "$staged_bin"' EXIT
   archive="$tmpdir/ffuf.tar.gz"