karnel-termux 4.9.4 → 4.9.5

package/karnel/cli/commands/brain.sh

@@ -150,7 +150,11 @@ _brain_pick_file() {
 _brain_editor() {
 	local title="$1"
 
-	if ! command -v ${EDITOR:-nano} &>/dev/null; then
+	local editor_bin
+	editor_bin="${EDITOR:-nano}"
+	editor_bin="${editor_bin%% *}"
+
+	if ! command -v "$editor_bin" &>/dev/null; then
 		log_error "${EDITOR:-nano} not found"
 		list_item "Install it: ${D_CYAN}karnel install editor${D_NC}"
 		return 1
@@ -1082,7 +1086,10 @@ brain_edit() {
 	fi
 
 	local editor="${EDITOR:-}"
-	if command -v ${EDITOR:-nano} &>/dev/null; then
+	local editor_bin
+	editor_bin="${EDITOR:-nano}"
+	editor_bin="${editor_bin%% *}"
+	if command -v "$editor_bin" &>/dev/null; then
 		editor="${EDITOR:-nano}"
 	elif [[ -z "$editor" ]] || ! command -v "$editor" &>/dev/null; then
 		for e in vim nano vi; do

package/karnel/cli/commands/show.sh

@@ -78,7 +78,13 @@ show_main() {
     return
   fi
 
-  local readme_path="$KARNEL_PATH/tools/$module/$tool/README.md"
+  local readme_path
+  readme_path="$(realpath "$KARNEL_PATH/tools/$module/$tool/README.md" 2>/dev/null)"
+
+  if [[ -z "$readme_path" || "$readme_path" != "$KARNEL_PATH/tools/"* ]]; then
+    log_error "No documentation found for $module/$tool"
+    return 1
+  fi
 
   if [[ ! -f "$readme_path" ]]; then
     log_error "No documentation found for $module/$tool"

package/karnel/tools/ai/engram/install.sh

@@ -108,15 +108,19 @@ update_engram() {
 }
 
 _update_engram_impl() {
-  export GOPATH="$HOME/.local/go"
-  export GOCACHE="$HOME/.cache/go"
-  export GOMODCACHE="$GOPATH/pkg/mod"
-
-  if ! git -C "$KARNEL_DATA/engram" pull &>>"$LOG_FILE" && go build -C "$KARNEL_DATA/engram/cmd/engram" -o "$PREFIX/bin/engram" &>>"$LOG_FILE"; then
-    log_error "Failed to update Engram"
-    return 1
-  fi
-  return 0
+	export GOPATH="$HOME/.local/go"
+	export GOCACHE="$HOME/.cache/go"
+	export GOMODCACHE="$GOPATH/pkg/mod"
+
+	if ! git -C "$KARNEL_DATA/engram" pull &>>"$LOG_FILE"; then
+		log_error "Failed to pull engram repository"
+		return 1
+	fi
+	if ! go build -C "$KARNEL_DATA/engram/cmd/engram" -o "$PREFIX/bin/engram" &>>"$LOG_FILE"; then
+		log_error "Failed to build Engram"
+		return 1
+	fi
+	return 0
 }
 
 reinstall_engram() {

package/karnel/tools/ai/hermes-agent/install.sh

@@ -31,7 +31,10 @@ _install_hermes_agent_impl() {
   if [ -d "$HERMES_DIR/.git" ]; then
     cd "$HERMES_DIR" && git pull
   else
-    git clone https://github.com/NousResearch/hermes-agent.git "$HERMES_DIR"
+    git clone https://github.com/NousResearch/hermes-agent.git "$HERMES_DIR" || {
+      log_error "Failed to clone hermes-agent repository"
+      return 1
+    }
   fi
 
   cd "$HERMES_DIR"

package/karnel/tools/ai/kiro/install.sh

@@ -24,10 +24,15 @@ install_kiro() {
 
   # Try the official installer first
   log_info "Running official Kiro installer..."
-  if echo "y" | curl -fsSL https://cli.kiro.dev/install 2>/dev/null | bash 2>>"$LOG_FILE"; then
-    if command -v kiro &>/dev/null || command -v kiro-cli &>/dev/null; then
-      log_success "Kiro installed successfully"
-      return 0
+  local install_script
+  install_script=$(curl -fsSL https://cli.kiro.dev/install 2>/dev/null)
+  if [[ -n "$install_script" ]]; then
+    if echo "y" | bash -s -- <<<"$install_script" 2>>"$LOG_FILE"; then
+      hash -r
+      if command -v kiro &>/dev/null || command -v kiro-cli &>/dev/null; then
+        log_success "Kiro installed successfully"
+        return 0
+      fi
     fi
   fi
 
@@ -93,6 +98,7 @@ for p in d['packages']:
         # Create symlink for convenience
         ln -sf "$PREFIX/bin/kiro-cli" "$PREFIX/bin/kiro"
         rm -rf "$tmpdir"
+        hash -r
         if command -v kiro-cli &>/dev/null || command -v kiro &>/dev/null; then
           log_success "Kiro installed from direct download"
           return 0

package/karnel/tools/lang/bun/src/bun-shim.c

@@ -240,14 +240,15 @@ int access(const char *p, int mode) {
 ssize_t readlinkat(int dirfd, const char *path, char *buf, size_t bufsiz) {
     if (path && streq(path, "/proc/self/exe")) {
         int len = slen(wrapper_path);
-        if (len < (int)bufsiz) {
+        int to_copy = len < (int)bufsiz ? len : (int)bufsiz - 1;
+        if (to_copy > 0) {
             char *d = buf;
             const char *s = wrapper_path;
-            while (*s)
+            for (int i = 0; i < to_copy; i++)
                 *d++ = *s++;
             *d = '\0';
         }
-        return len;
+        return to_copy > 0 ? to_copy : 0;
     }
     return (ssize_t)SREADLINKAT(dirfd, path, buf, bufsiz);
 }
@@ -270,9 +271,14 @@ ssize_t readlinkat(int dirfd, const char *path, char *buf, size_t bufsiz) {
  * bionic binaries. We use --library-path/--preload for glibc binaries instead.
  * Returns pointer to static buffer. */
 static char **strip_glibc_env(char *const envp[]) {
-    static char *clean[256];
+    int count = 0;
+    while (envp[count])
+        count++;
+    static char *clean[4096];
+    if (count > 4095)
+        count = 4095;
     int j = 0;
-    for (int i = 0; envp[i] && j < 255; i++) {
+    for (int i = 0; envp[i] && j < count; i++) {
         const char *e = envp[i];
         /* Skip LD_LIBRARY_PATH=* */
         if (e[0] == 'L' && e[1] == 'D' && e[2] == '_' && e[3] == 'L' &&
@@ -301,7 +307,9 @@ int execve(const char *pathname, char *const argv[], char *const envp[]) {
         while (argv[argc])
             argc++;
 
-        char *new_argv[64];
+        if (argc + 7 > 1024)
+            goto fallback;
+        char *new_argv[1024];
         int i = 0;
         new_argv[i++] = (char *)pathname;
         new_argv[i++] = "--library-path";
@@ -331,7 +339,9 @@ int execve(const char *pathname, char *const argv[], char *const envp[]) {
             while (argv[argc])
                 argc++;
 
-            char *new_argv[64];
+            if (argc + 8 > 1024)
+                goto fallback;
+            char *new_argv[1024];
             int i = 0;
             new_argv[i++] = (char *)ld_path;
             new_argv[i++] = "--library-path";
@@ -349,4 +359,15 @@ int execve(const char *pathname, char *const argv[], char *const envp[]) {
 
     errno = err;
     return -1;
+
+fallback:
+    /* If argv was too large for our static buffer, try the original execve */
+    r = SEXECVE(pathname, argv, clean_env);
+    if (r >= 0)
+        return (int)r;
+    r = SEXECVE(pathname, argv, envp);
+    if (r >= 0)
+        return (int)r;
+    errno = (int)(-r);
+    return -1;
 }

package/karnel/utils/bootstrap.sh

@@ -9,17 +9,24 @@ declare -A __KARNEL_IMPORTED
 
 import() {
 	local base="${KARNEL_PATH}"
-	local path="${1//@/$base}.sh"
+	local resolved="${1//@/$base}.sh"
+	local canonical
+	canonical="$(realpath "$resolved" 2>/dev/null || echo "$resolved")"
 
-	if [[ -n "${__KARNEL_IMPORTED[$path]}" ]]; then
+	if [[ "$canonical" != "$base"/* ]]; then
+		echo "karnel: import error: path traversal denied: $1" >&2
+		return 1
+	fi
+
+	if [[ -n "${__KARNEL_IMPORTED[$canonical]}" ]]; then
 		return
 	fi
 
-	if [[ ! -f "$path" ]]; then
-		echo "karnel: import error: $path not found" >&2
+	if [[ ! -f "$canonical" ]]; then
+		echo "karnel: import error: $canonical not found" >&2
 		return 1
 	fi
 
-	__KARNEL_IMPORTED[$path]=1
-	source "$path"
+	__KARNEL_IMPORTED[$canonical]=1
+	source "$canonical"
 }

package/karnel/utils/env.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-KARNEL_VERSION="4.9.4"
+KARNEL_VERSION="4.9.5"
 
 # -------------------------
 # Directorios del usuario

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.9.4",
+  "version": "4.9.5",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"