karnel-termux 4.17.9 → 4.17.13

package/karnel/tools/security/gobuster/install.sh

@@ -19,7 +19,7 @@ _install_gobuster_bin() (
     x86_64) checksum="871be404ce5f80c96b864586b3caa90f894598d1a8222ae316c19e5f70e04cfc" ;;
   esac
   local url="https://github.com/OJ/gobuster/releases/download/v${_GOBUSTER_VERSION}/$asset"
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/gobuster.XXXXXX") || return 1
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/gobuster.XXXXXX") || return 1
   staged_bin=""
   trap 'rm -rf "$tmpdir"; [ -z "$staged_bin" ] || rm -f "$staged_bin"' EXIT
   archive="$tmpdir/gobuster.tar.gz"

package/karnel/tools/security/subfinder/install.sh

@@ -47,7 +47,7 @@ install_subfinder() (
   esac
   url="https://github.com/projectdiscovery/subfinder/releases/download/v${_SUBFINDER_VERSION}/$asset"
 
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/subfinder.XXXXXX") || return 1
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/subfinder.XXXXXX") || return 1
   staged_bin=""
   trap 'rm -rf "$tmpdir"; [ -z "$staged_bin" ] || rm -f "$staged_bin"' EXIT
   archive="$tmpdir/subfinder.zip"

package/karnel/tools/security/zap/install.sh

@@ -34,7 +34,7 @@ install_zap() (
 
   local url="https://github.com/zaproxy/zaproxy/releases/download/v${_ZAP_VERSION}/$ZAP_ASSET"
 
-  tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/zap.XXXXXX") || {
+  tmpdir=$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/zap.XXXXXX") || {
     log_error "Falha ao criar diretório temporário"
     return 1
   }

package/karnel/tools/utils/all.sh

@@ -19,6 +19,7 @@ TOOLS_PACKAGES=(
   "zork"
   "qrcode"
   "superfile"
+  "herdr"
 )
 
 TOOLS_DISPLAY=(
@@ -34,6 +35,7 @@ TOOLS_DISPLAY=(
   "Zork (text adventure games I, II, III)"
   "QR Code (link-to-QR generator)"
   "SuperFile (terminal file manager)"
+  "Herdr (terminal AI assistant CLI)"
 )
 
 for _tool in "${TOOLS_PACKAGES[@]}"; do

package/karnel/tools/utils/herdr/README.md

@@ -0,0 +1,33 @@
+# Herdr — terminal AI assistant
+
+[Herdr](https://herdr.dev) is a fast terminal AI assistant CLI, distributed by the
+Herdr project and integrated into Karnel Termux as a managed utility.
+
+## Install
+
+```bash
+karnel install utils --herdr
+```
+
+The installer:
+- Resolves the latest release via the official manifest at `https://herdr.dev/latest.json`.
+- Verifies the SHA-256 checksum before extracting.
+- Installs atomically into `$PREFIX/bin/herdr` and writes a Karnel ownership marker
+  (`.karnel-wrapper-herdr`) so the binary is tracked.
+- Honors `TMPDIR` / `KARNEL_CACHE` (never hardcodes `/tmp`, which is broken on Termux).
+
+## Uninstall / Update
+
+```bash
+karnel uninstall utils --herdr   # clean removal, only the managed binary
+karnel update utils --herdr      # re-fetch and re-verify latest release
+```
+
+## Usage
+
+```bash
+herdr --help
+herdr --version
+```
+
+See https://herdr.dev for full documentation.

package/karnel/tools/utils/herdr/install.sh

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+
+import "@/utils/log"
+
+HERDR_BIN="$PREFIX/bin/herdr"
+HERDR_DATA_DIR="$KARNEL_DATA/herdr"
+HERDR_MARKER="$HERDR_DATA_DIR/.karnel-managed"
+HERDR_WRAPPER_MARKER="$HERDR_DATA_DIR/.karnel-wrapper-herdr"
+HERDR_MANIFEST_URL="https://herdr.dev/latest.json"
+
+_herdr_binary_owned() {
+  [[ -f "$HERDR_WRAPPER_MARKER" && -f "$HERDR_BIN" ]] || return 1
+  [[ "$(sha256sum "$HERDR_BIN" 2>/dev/null)" == "$(<"$HERDR_WRAPPER_MARKER")" ]]
+}
+
+_herdr_verify_ownership() {
+  if [[ -e "$HERDR_DATA_DIR" && ! -f "$HERDR_MARKER" ]]; then
+    log_error "Refusing to replace unowned data directory: $HERDR_DATA_DIR"
+    return 1
+  fi
+  if [[ -e "$HERDR_BIN" ]] && ! _herdr_binary_owned; then
+    log_error "Refusing to replace unowned command: $HERDR_BIN"
+    return 1
+  fi
+}
+
+_herdr_detect_target() {
+  local os arch
+  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+  [[ "$os" == "linux" ]] || {
+    log_error "Herdr supports Linux/macOS; this system reports: $os"
+    return 1
+  }
+  arch="$(uname -m)"
+  case "$arch" in
+    aarch64 | arm64) arch="aarch64" ;;
+    x86_64 | amd64) arch="x86_64" ;;
+    *) log_error "Unsupported architecture for Herdr: $arch"; return 1 ;;
+  esac
+  printf 'linux-%s' "$arch"
+}
+
+_herdr_resolve() {
+  local target="$1" manifest tmpf rc
+  manifest="$(curl -fsSL --retry 3 --connect-timeout 10 --max-time 20 "$HERDR_MANIFEST_URL" 2>/dev/null)" || return 1
+  tmpf="$(mktemp "${KARNEL_CACHE}/.herdr-manifest.XXXXXX")" || return 1
+  printf '%s' "$manifest" >"$tmpf"
+  python3 -c '
+import sys, json
+with open(sys.argv[1]) as fh:
+    data = json.load(fh)
+target = sys.argv[2]
+assets = data.get("assets", {})
+sha = data.get("sha256", {})
+url = assets.get(target)
+digest = sha.get(target)
+version = data.get("version")
+if not url or not digest:
+    sys.exit(1)
+print(url)
+print(digest)
+print(version or "")
+' "$tmpf" "$target"
+  rc=$?
+  rm -f "$tmpf"
+  return $rc
+}
+
+_herdr_download_and_install() {
+  local target="$1" info url sha version tmp actual temporary_bin
+
+  info="$(_herdr_resolve "$target")" || {
+    log_error "Failed to resolve the Herdr release for $target"
+    return 1
+  }
+  url="$(printf '%s' "$info" | sed -n '1p')"
+  sha="$(printf '%s' "$info" | sed -n '2p')"
+  version="$(printf '%s' "$info" | sed -n '3p')"
+
+  if [[ ! "$sha" =~ ^[0-9a-fA-F]{64}$ ]]; then
+    log_error "Herdr release manifest did not include a valid SHA-256 for $target"
+    return 1
+  fi
+  sha="${sha,,}"
+
+  mkdir -p "$KARNEL_DATA" "$PREFIX/bin" "${KARNEL_CACHE}" || return 1
+  _herdr_verify_ownership || return 1
+
+  tmp="$(mktemp -d "${KARNEL_CACHE}/.herdr.XXXXXX")" || return 1
+  if ! curl -fsSL --retry 3 --connect-timeout 10 --max-time 120 "$url" -o "$tmp/herdr"; then
+    rm -rf "$tmp"
+    log_error "Failed to download Herdr from $url"
+    return 1
+  fi
+
+  actual="$(sha256sum "$tmp/herdr" 2>/dev/null | awk '{print $1}')"
+  if [[ "$actual" != "$sha" ]]; then
+    rm -rf "$tmp"
+    log_error "Herdr checksum verification failed (expected $sha, got $actual)"
+    return 1
+  fi
+
+  temporary_bin="$(mktemp "$PREFIX/bin/.herdr.XXXXXX")" || { rm -rf "$tmp"; return 1; }
+  if ! install -m 755 "$tmp/herdr" "$temporary_bin" || ! mv -f "$temporary_bin" "$HERDR_BIN"; then
+    rm -f "$temporary_bin"
+    rm -rf "$tmp"
+    log_error "Failed to install the Herdr binary"
+    return 1
+  fi
+
+  mkdir -p "$HERDR_DATA_DIR" || return 1
+  sha256sum "$HERDR_BIN" >"$HERDR_WRAPPER_MARKER" || return 1
+  : >"$HERDR_MARKER"
+  rm -rf "$tmp"
+}
+
+install_herdr() {
+  if command -v herdr &>/dev/null; then
+    log_info "Herdr is already installed"
+    return 2
+  fi
+
+  local target
+  target="$(_herdr_detect_target)" || return 1
+
+  log_info "Installing Herdr..."
+  _herdr_download_and_install "$target" || return 1
+  log_success "Herdr installed"
+}
+
+uninstall_herdr() {
+  if [[ ! -e "$HERDR_BIN" && ! -d "$HERDR_DATA_DIR" ]]; then
+    log_info "Herdr is not installed"
+    return 2
+  fi
+
+  if _herdr_binary_owned && ! rm -f "$HERDR_BIN"; then
+    log_error "Failed to remove the Herdr command"
+    return 1
+  fi
+  if [[ -f "$HERDR_MARKER" ]] && ! rm -rf "$HERDR_DATA_DIR"; then
+    log_error "Failed to uninstall Herdr"
+    return 1
+  fi
+  log_success "Herdr uninstalled"
+}
+
+update_herdr() {
+  local target
+  target="$(_herdr_detect_target)" || return 1
+
+  log_info "Updating Herdr..."
+  _herdr_download_and_install "$target" || return 1
+  log_success "Herdr updated"
+}
+
+reinstall_herdr() {
+  uninstall_herdr || [[ $? -eq 2 ]] || return 1
+  install_herdr
+}

package/karnel/tools/utils/zork/zork.sh

@@ -3,8 +3,13 @@ ZORK_DIR="$HOME/.local/share/karnel-data/zork"
 if [ ! -f "$ZORK_DIR/zork1.dat" ]; then
   mkdir -p "$ZORK_DIR"
   echo "Baixando Zork I..."
-  curl -sL "https://www.infocom-if.org/downloads/zork1.zip" -o /tmp/zork1.zip
-  unzip -o /tmp/zork1.zip -d "$ZORK_DIR" 2>/dev/null
-  rm -f /tmp/zork1.zip
+  tmpdir="$(mktemp -d "${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}/zork.XXXXXX")" || exit 1
+  curl -fsSL "https://www.infocom-if.org/downloads/zork1.zip" -o "$tmpdir/zork1.zip"
+  if unzip -l "$tmpdir/zork1.zip" 2>/dev/null | grep -qE '\.\.[/\\]|^/|[A-Za-z]:\\'; then
+    echo "Refusing potentially unsafe Zork archive" >&2
+    rm -rf "$tmpdir"; exit 1
+  fi
+  unzip -o "$tmpdir/zork1.zip" -d "$ZORK_DIR" 2>/dev/null
+  rm -rf "$tmpdir"
 fi
 exec frotz "$ZORK_DIR/zork1.dat" "$@"

package/karnel/utils/agent_actions.sh

@@ -481,8 +481,10 @@ _agent_exec_to_file() {
 # ------------------------------------------------------------
 _agent_cmd_is_write() {
 	local cmd="$1"
-	# file redirections: >file >>file 2>file 1>>file &>file  (excludes fd-to-fd like >&2 and comparisons >=)
-	if printf '%s\n' "$cmd" | grep -qE '(^|[;&|[:space:]])(>|>>|&>|[0-9]>|[0-9]>>)([^&=]|$)'; then
+	# file redirections: >file >>file 2>file 1>>file &>file (also without a
+	# preceding space, e.g. echo x>file). Excludes fd-to-fd like >&2 and
+	# numeric comparisons >= / =>.
+	if printf '%s\n' "$cmd" | grep -qE '(^|[;&|[:space:]]|[A-Za-z0-9])(>|>>|&>)([^&=]|$)'; then
 		return 0
 	fi
 	# command substitution / backticks execute arbitrary code → write
@@ -497,8 +499,14 @@ _agent_cmd_is_write() {
 	if printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(vim|nvim|emacs|ed|ex|vi|nano)[[:space:]]'; then
 		return 0
 	fi
+	# interpreters that can execute arbitrary code / spawn processes / modify
+	# files even without a trailing redirection or -i flag (sed 'w', perl
+	# open(">"), awk system(), env/setsid/nohup running a command, make, xargs)
+	if printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(sed|awk|perl|xargs|make|env|nohup|setsid)[[:space:]]'; then
+		return 0
+	fi
 	# blocklist of commands that write to disk / change state / spawn a shell
-	printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(rm|rmdir|unlink|mv|cp|mkdir|touch|ln|chmod|chown|chgrp|install|truncate|tee|dd|mkfs|mount|umount|tar|gzip|gunzip|bzip2|xz|zstd|curl|wget|python3|python|node|npm|bun|yarn|pnpm|cargo|go |rustc|git (add|commit|push|pull|merge|rebase|reset|checkout|switch|restore|clean|stash|tag|clone|init|rm|mv)|pkg (install|uninstall|upgrade|reinstall|update)|apt( |-)|apt-get|dpkg|yum|dnf|pacman|brew|pip|pip3|uv|conda|mysql|psql|sqlite3|redis-cli|mongosh|kill|pkill|killall|service|systemctl|halt|reboot|shutdown|sudo|doas|su|pkexec|chroot|bash|sh|dash|zsh|ksh|eval|source|exec|screen|tmux|ssh|scp|sftp|rsync|telnet|nc|ncat|ftp|lftp|rsh|sshpass|socat|crontab|at |iptables|nft|ufw|docker|podman|kubectl|helm)[[:space:]]' && return 0
+	printf '%s\n' "$cmd" | grep -qiE '(^|[;&|[:space:]])(rm|rmdir|unlink|mv|cp|mkdir|touch|ln|chmod|chown|chgrp|install|truncate|tee|dd|mkfs|mount|umount|tar|gzip|gunzip|bzip2|xz|zstd|curl|wget|python3|python|node|npm|bun|yarn|pnpm|cargo|go |rustc|git (add|commit|push|pull|merge|rebase|reset|checkout|switch|restore|clean|stash|tag|clone|init|rm|mv|apply|am|worktree|read-tree|update-index|write-tree|checkout-index)|pkg (install|uninstall|upgrade|reinstall|update)|apt( |-)|apt-get|dpkg|yum|dnf|pacman|brew|pip|pip3|uv|conda|mysql|psql|sqlite3|redis-cli|mongosh|kill|pkill|killall|service|systemctl|halt|reboot|shutdown|sudo|doas|su|pkexec|chroot|bash|sh|dash|zsh|ksh|eval|source|exec|screen|tmux|ssh|scp|sftp|rsync|telnet|nc|ncat|ftp|lftp|rsh|sshpass|socat|crontab|at |iptables|nft|ufw|docker|podman|kubectl|helm)[[:space:]]' && return 0
 	return 1
 }
 
@@ -898,7 +906,7 @@ agent_exec_loading() {
 	local delay=0.08
 	local tmpfile
 	local _ktmpdir="${KARNEL_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
-	mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-/tmp}"
+	mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}"
 	tmpfile="$(mktemp "$_ktmpdir/karnel.XXXXXX" 2>/dev/null)" || tmpfile="$(mktemp 2>/dev/null)"
 
 	local stty_saved=""

package/karnel/utils/log.sh

@@ -430,7 +430,7 @@ loading() {
 	local delay=0.08
 	local tmpfile
 	local _ktmpdir="${KARNEL_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
-	mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-/tmp}"
+	mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}"
 	tmpfile="$(mktemp "$_ktmpdir/karnel.XXXXXX" 2>/dev/null)" || tmpfile="$(mktemp 2>/dev/null)"
 	local cmd_pid=""
 

package/karnel/utils/tools.sh

@@ -59,7 +59,7 @@ _run_tool_lifecycle_action() {
     fi
     "$uninstall_handler"
     rc=$?
-    (( rc == 0 )) || return "$rc"
+    (( rc == 0 || rc == 2 )) || return "$rc"
     "$install_handler"
     rc=$?
     if (( rc == 0 && protected )); then

package/karnel/utils/version.sh

@@ -52,7 +52,7 @@ _spin_capture() {
   local frames=('⠋' '⠙' '⠹' '⠸' '⠼' '⠴' '⠦' '⠧' '⠇' '⠏')
   local tmp
   local _ktmpdir="${KARNEL_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/karnel}"
-  mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-/tmp}"
+  mkdir -p "$_ktmpdir" 2>/dev/null || _ktmpdir="${TMPDIR:-${KARNEL_CACHE:-$HOME/.cache/karnel}}"
   tmp=$(mktemp "$_ktmpdir/karnel.XXXXXX" 2>/dev/null) || tmp=$(mktemp 2>/dev/null)
   local spinner_fd
   if [ -c /dev/tty ] 2>/dev/null; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.9",
+  "version": "4.17.13",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"
@@ -46,5 +46,5 @@
   "bugs": {
     "url": "https://github.com/israelmarques1024-dotcom/karnel-termux/issues"
   },
-  "homepage": "https://karneltermux.vercel.app"
+  "homepage": "https://israelmarques1024-dotcom.github.io/karnel-termux"
 }

package/scripts/completion.bash

@@ -20,7 +20,7 @@ _karnel_tool_flags() {
     security) tools="aircrack-ng amass binwalk burpsuite dirb dnsrecon enum4linux exiftool ffuf foremost gobuster hashcat hydra john masscan metasploit netcat nikto nmap smbclient sqlmap steghide subfinder tcpdump theharvester wafw00f whatweb whois wpscan zap" ;;
     shell) tools="powerlevel10k zsh-defer zsh-autosuggestions zsh-syntax-highlighting history-substring zsh-completions fzf-tab you-should-use zsh-autopair better-npm" ;;
     ui) tools="font extra-keys cursor banner" ;;
-    utils) tools="fconv filecheck websites notes treex passman applaunch splash httptmux zork qrcode superfile" ;;
+    utils) tools="fconv filecheck websites notes treex passman applaunch splash httptmux zork qrcode superfile herdr" ;;
   esac
 
   local flags=""

package/scripts/completion.zsh

@@ -82,7 +82,7 @@ _karnel_tool_flags() {
     security) tools="aircrack-ng amass binwalk burpsuite dirb dnsrecon enum4linux exiftool ffuf foremost gobuster hashcat hydra john masscan metasploit netcat nikto nmap smbclient sqlmap steghide subfinder tcpdump theharvester wafw00f whatweb whois wpscan zap" ;;
     shell) tools="powerlevel10k zsh-defer zsh-autosuggestions zsh-syntax-highlighting history-substring zsh-completions fzf-tab you-should-use zsh-autopair better-npm" ;;
     ui) tools="font extra-keys cursor banner" ;;
-    utils) tools="fconv filecheck websites notes treex passman applaunch splash httptmux zork qrcode superfile" ;;
+    utils) tools="fconv filecheck websites notes treex passman applaunch splash httptmux zork qrcode superfile herdr" ;;
   esac
 
   local -a flags=()