karnel-termux 4.18.0 → 4.18.2

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/karnel-termuxOFC/karnel-termux">
-    <img src="https://img.shields.io/badge/version-4.18.0-0078D4?style=for-the-badge" alt="Version">
+    <img src="https://img.shields.io/badge/version-4.18.2-0078D4?style=for-the-badge" alt="Version">
   </a>
   <a href="https://www.npmjs.com/package/karnel-termux">
     <img src="https://img.shields.io/npm/v/karnel-termux?style=for-the-badge&logo=npm&color=cb3837" alt="npm">
@@ -78,7 +78,7 @@ Why it's great:
 ### Via checksummed GitHub release (recommended)
 
 ```bash
-version=4.18.0
+version=4.18.2
 tmpdir=$(mktemp -d) && trap 'rm -rf "$tmpdir"' EXIT
 base="https://github.com/karnel-termuxOFC/karnel-termux/releases/download/v$version"
 curl -fsSL "$base/karnel-termux-install.sh" -o "$tmpdir/karnel-termux-install.sh"

package/docs/CHANGELOG.md

@@ -6,6 +6,19 @@ layout: base
 
 # Documentation Changelog
 
+## 4.18.2
+
+- **Wrappers no longer hand a preload to glibc.** `login(1)` exports `LD_PRELOAD=$PREFIX/lib/libtermux-exec-ld-preload.so`, a bionic object; glibc's `ld.so` cannot load it, so every wrapped tool died before `main()` with `.../glibc/lib/libc.so: invalid ELF header`. Tier 3's own preload was fatal in the other direction: exporting the glibc `libtermux-exec.so` shim left every bionic child of the tool failing with `library "libc.so.6" not found`. Every wrapper now starts with `unset LD_PRELOAD`, and tier 3 exports `PATH` only.
+- **Wrappers written by older Karnels are refreshed.** `compat_wrapper_is_current()` checks the invariants the current code emits; when one is missing the wrapper is rewritten in place before `compat_escalate` probes it, so a stale launcher can no longer keep a tool pinned to a tier it no longer reaches.
+- **An orphaned parked copy no longer blocks adaptation.** Freebuff's own entry re-extracts its runtime in place, dropping a raw ELF over the wrapper and leaving `.karnel-real` behind; `compat_wrap` refused to touch that file, so the tool could never be adapted again — which is how `karnel install ai --freebuff` ended in "does not start at any tier" and then "Freebuff runtime still does not run after repair". Identical bytes are dropped (a 130 MB runtime is not copied to prove a point) and a different copy is parked as `.karnel-real.stale`.
+- **Tests.** Four new cases pin the behaviour — no wrapper hands a preload to the loader on tier 2 or tier 3, a launcher from an older karnel is refreshed in place, an orphaned parked copy does not block adaptation — in a suite of 23 cases running in 8 seconds. Every branch was proven to fail first: removing the `unset` fails 2 cases, restoring the tier 3 preload fails 5, dropping the refresh fails 1, restoring the refusal fails 1, and always discarding the orphan fails 1.
+
+## 4.18.1
+
+- **The ladder is reachable from every installer, not just Freebuff:** `compat_adapt_installed()` is the single entry point behind `_tool_compat_adapt` (utils/tools.sh), `_ai_tool_compat_adapt` (tools/ai/all.sh) and the post-install loop in `cli/commands/install.sh`, so it already covered all 16 categories — but it only ever called `compat_wrap()`, which stops at the loader tier. Tiers 3 (glibc userland) and 4 (proot FHS root) were reachable solely from Freebuff's `compat_adapt()` call, which is why no other tool could ever climb above tier 2. It now escalates after wrapping, and re-probes wrappers already on disk so a tool that stops starting at its current tier climbs on the next install or update instead of staying broken behind a launcher nobody re-examines.
+- **No cost for what already runs:** native binaries, scripts and plain files still return before any probe, so the added `--version` probe applies only to tools that actually needed a wrapper — the hundreds of native entries in a Termux prefix are untouched.
+- **Tests:** three new cases pin the behaviour (ladder reachable from the installer path, existing wrappers re-evaluated, natives never probed — the last with a positive control so its zero cannot pass vacuously). Each was proven to fail first: dropping the escalation fails 3 cases, probing natives fails the efficiency case alone, removing tier 3's `PATH` export fails the 3 ladder cases, and letting tier 4 write a wrapper without a root fails the refusal case alone. The suite runs 20 cases in 7 seconds.
+
 ## 4.18.0
 
 - **Three-tier compatibility layer:** a foreign glibc binary is no longer handled by one fixed trick. `compat_adapt` wraps, probes and climbs to the cheapest tier that actually starts the tool — the glibc loader alone (free, installs nothing), the glibc userland (`$PREFIX/glibc/bin`, 383 glibc tools, prepended to `PATH` together with the glibc exec shim so child processes resolve the same way), or proot over a synthetic `/lib`, `/usr` and `/etc` assembled from the sysroot already on the device. That last tier replaces `proot-distro install ubuntu` for binaries that merely hardcode an absolute path, and it downloads nothing. A tier that cannot be reached is refused before the wrapper is written, so `proot -r ''` can never ship, and every step unwraps back to `<path>.karnel-real`.

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-a6c1aeb11507e48d4e14c3f6c2eb9bd9e9f969da
+fff0d351f344943ef88e0745cc0f7f56c7aaf970

package/karnel/utils/compat.sh

@@ -206,6 +206,19 @@ compat_wrapper_tier() {
   esac
 }
 
+# A wrapper written by an older karnel is still a wrapper, but it may hand
+# LD_PRELOAD straight to the glibc loader and die in a login shell. Returns 0
+# only when the launcher carries every invariant the current code emits.
+compat_wrapper_is_current() {
+  local file="$1"
+  _compat_is_wrapper "$file" || return 1
+  grep -qF 'unset LD_PRELOAD' -- "$file" 2>/dev/null || return 1
+  if grep -qF 'export LD_PRELOAD' -- "$file" 2>/dev/null; then
+    return 1
+  fi
+  return 0
+}
+
 # Builds (once) a synthetic filesystem root out of the glibc sysroot that is
 # already on the device. proot then maps /lib, /usr and /etc onto it, which is
 # everything a binary that hardcodes those paths needs -- for a few kilobytes
@@ -273,24 +286,23 @@ _compat_write_wrapper() {
     printf '%s\n' "#!$bash_bin"
     printf '%s\n' "$COMPAT_WRAPPER_MARKER"
     printf '%s\n' "$COMPAT_WRAPPER_TIER_MARKER $tier"
+    # login(1) exports LD_PRELOAD=$PREFIX/lib/libtermux-exec-ld-preload.so,
+    # a bionic object. glibc's ld.so cannot load it and dies with
+    # "libc.so: invalid ELF header" on every start. The glibc termux-exec
+    # shim is equally unusable: every bionic child this tool spawns then
+    # fails with "library libc.so.6 not found". So no preload survives.
+    printf '%s\n' "unset LD_PRELOAD"
     case "$tier" in
     "$COMPAT_TIER_USERLAND")
-      # The $root/$PATH/$LD_PRELOAD below must reach the wrapper verbatim.
+      # The $root/$PATH below must reach the wrapper verbatim.
       # shellcheck disable=SC2016
       printf '%s\n' "# Tier 3: the glibc loader plus the glibc userland, so the child"
-      printf '%s\n' "# processes this tool spawns find the same coreutils and exec shim."
+      printf '%s\n' "# processes this tool spawns find the same coreutils."
       # Everything below is emitted literally and expanded by the wrapper at
       # runtime, where "root" is the assignment written on the previous line.
       printf 'root=%q\n' "$(compat_glibc_root)"
       # shellcheck disable=SC2016  # expands in the wrapper
       printf 'export PATH="$root/bin:$PATH"\n'
-      # The glibc termux-exec shim is optional; a preload pointing nowhere
-      # makes ld.so complain on every start of the tool.
-      # shellcheck disable=SC2016  # expands in the wrapper
-      printf 'if [ -f "$root/lib/libtermux-exec.so" ]; then\n'
-      # shellcheck disable=SC2016  # expands in the wrapper
-      printf '  export LD_PRELOAD="$root/lib/libtermux-exec.so${LD_PRELOAD:+:$LD_PRELOAD}"\n'
-      printf 'fi\n' 
       printf 'exec %q --library-path %q %q "$@"\n' "$loader" "$libpath" "$real"
       ;;
     "$COMPAT_TIER_PROOT")
@@ -328,22 +340,43 @@ compat_wrap() {
   [[ -f "$real" ]] || return 1
   if _compat_is_wrapper "$real"; then
     current="$(compat_wrapper_tier "$real")"
-    [[ "$current" == "$tier" ]] && return 0
-    # Re-tier an existing wrapper: the original is already parked next to it,
-    # so only the launcher changes.
+    if [[ "$current" == "$tier" ]] && compat_wrapper_is_current "$real"; then
+      return 0
+    fi
+    # Re-tier an existing wrapper, or refresh one written by an older karnel:
+    # the original is already parked next to it, so only the launcher changes.
     stored="$real.karnel-real"
     [[ -e "$stored" ]] || return 1
     loader="$(compat_glibc_loader)" || loader="/lib/ld-linux-aarch64.so.1"
     _compat_write_wrapper "$real" "$stored" "$loader" "$tier" || return 1
-    log_info "compat: $real retiered to level $tier"
+    if [[ "$current" == "$tier" ]]; then
+      log_info "compat: $real wrapper refreshed"
+    else
+      log_info "compat: $real retiered to level $tier"
+    fi
     return 0
   fi
   compat_is_glibc_elf "$real" || return 1
   loader="$(compat_glibc_loader)" || return 1
   stored="$real.karnel-real"
   if [[ -e "$stored" ]]; then
-    log_error "compat: refusing to overwrite existing $stored"
-    return 1
+    # The file on disk is a real ELF, not our wrapper, while a parked copy is
+    # already sitting beside it: something outside karnel replaced the
+    # launcher (freebuff's node entry re-extracts its runtime in place) and
+    # orphaned the copy. The file on disk is authoritative now, so the parked
+    # copy is stale. A refusal here would leave the tool permanently
+    # unrunnable, so the copy is dropped when it is the same bytes and kept
+    # as .karnel-real.stale otherwise - a 130 MB runtime must not be copied
+    # just to prove a point.
+    if cmp -s -- "$stored" "$real" 2>/dev/null; then
+      rm -f -- "$stored" || return 1
+      log_warn "compat: dropped a stale parked copy for $real"
+    elif ! mv -f -- "$stored" "$stored.stale" 2>/dev/null; then
+      log_error "compat: could not move the stale parked copy for $real"
+      return 1
+    else
+      log_warn "compat: replaced a stale parked copy for $real"
+    fi
   fi
   if ! mv -- "$real" "$stored"; then
     log_error "compat: could not move $real aside"
@@ -392,6 +425,11 @@ compat_escalate() {
   real="$(readlink -f -- "$target" 2>/dev/null || printf '%s' "$target")"
   _compat_is_wrapper "$real" || return 0
 
+  # Refresh a launcher written by an older karnel before probing it: the probe
+  # has to exercise the wrapper we are about to ship, not the stale one.
+  compat_wrapper_is_current "$real" ||
+    compat_wrap "$real" "$(compat_wrapper_tier "$real")" || true
+
   compat_probe "$real" && return 0
 
   if compat_wrap "$real" "$COMPAT_TIER_USERLAND" && compat_probe "$real"; then
@@ -507,10 +545,17 @@ compat_adapt_installed() {
   real="$(readlink -f -- "$path" 2>/dev/null || printf '%s' "$path")"
   [[ -f "$real" && -x "$real" ]] || return 0
   if _compat_is_wrapper "$real"; then
+    # Already wrapped: re-probe it, so a binary that later stops starting at
+    # this tier climbs instead of being handed to the user as-is. Escalation
+    # is what every installer reaches through this function; only freebuff
+    # calls compat_adapt() directly, so without this the glibc userland and
+    # proot tiers would stay unreachable for the rest of the catalog.
+    compat_escalate "$real" || true
     return 0
   fi
   if compat_is_glibc_elf "$real"; then
     compat_wrap "$real" || true
+    compat_escalate "$real" || true
   fi
   return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.18.0",
+  "version": "4.18.2",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"