@capgo/capacitor-updater 6.14.25 → 6.14.29

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -6,7 +6,6 @@
 package ee.forgr.capacitor_updater;
 
 import android.content.Context;
-import android.util.Log;
 import androidx.annotation.NonNull;
 import androidx.work.Data;
 import androidx.work.Worker;
@@ -17,6 +16,7 @@ import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.channels.FileChannel;
 import java.nio.file.Files;
+import java.nio.file.StandardCopyOption;
 import java.security.MessageDigest;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -28,18 +28,29 @@ import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
+import okhttp3.Interceptor;
 import okhttp3.OkHttpClient;
 import okhttp3.Protocol;
 import okhttp3.Request;
 import okhttp3.Response;
 import okhttp3.ResponseBody;
+import okio.Buffer;
+import okio.BufferedSink;
+import okio.BufferedSource;
+import okio.Okio;
+import okio.Source;
 import org.brotli.dec.BrotliInputStream;
 import org.json.JSONArray;
 import org.json.JSONObject;
 
 public class DownloadService extends Worker {
 
-    public static final String TAG = "Capacitor-updater";
+    private static Logger logger;
+
+    public static void setLogger(Logger loggerInstance) {
+        logger = loggerInstance;
+    }
+
     public static final String URL = "URL";
     public static final String ID = "id";
     public static final String PERCENT = "percent";
@@ -51,12 +62,51 @@ public class DownloadService extends Worker {
     public static final String CHECKSUM = "checksum";
     public static final String PUBLIC_KEY = "publickey";
     public static final String IS_MANIFEST = "is_manifest";
+    public static final String APP_ID = "app_id";
+    public static final String PLUGIN_VERSION = "plugin_version";
     private static final String UPDATE_FILE = "update.dat";
 
-    private final OkHttpClient client = new OkHttpClient.Builder().protocols(Arrays.asList(Protocol.HTTP_2, Protocol.HTTP_1_1)).build();
+    // Shared OkHttpClient to prevent resource leaks
+    protected static OkHttpClient sharedClient;
+    private static String currentAppId = "unknown";
+    private static String currentPluginVersion = "unknown";
+    private static String currentVersionOs = "unknown";
+
+    // Initialize shared client with User-Agent interceptor
+    static {
+        sharedClient = new OkHttpClient.Builder()
+            .protocols(Arrays.asList(Protocol.HTTP_2, Protocol.HTTP_1_1))
+            .addInterceptor((chain) -> {
+                Request originalRequest = chain.request();
+                String userAgent =
+                    "CapacitorUpdater/" +
+                    (currentPluginVersion != null ? currentPluginVersion : "unknown") +
+                    " (" +
+                    (currentAppId != null ? currentAppId : "unknown") +
+                    ") android/" +
+                    (currentVersionOs != null ? currentVersionOs : "unknown");
+                Request requestWithUserAgent = originalRequest.newBuilder().header("User-Agent", userAgent).build();
+                return chain.proceed(requestWithUserAgent);
+            })
+            .build();
+    }
+
+    // Method to update User-Agent values
+    public static void updateUserAgent(String appId, String pluginVersion, String versionOs) {
+        currentAppId = appId != null ? appId : "unknown";
+        currentPluginVersion = pluginVersion != null ? pluginVersion : "unknown";
+        currentVersionOs = versionOs != null ? versionOs : "unknown";
+        logger.debug(
+            "Updated User-Agent: CapacitorUpdater/" + currentPluginVersion + " (" + currentAppId + ") android/" + currentVersionOs
+        );
+    }
 
     public DownloadService(@NonNull Context context, @NonNull WorkerParameters params) {
         super(context, params);
+        // Use shared client - no need to create new instances
+
+        // Clean up old temporary files on service initialization
+        cleanupOldTempFiles(getApplicationContext().getCacheDir());
     }
 
     private void setProgress(int percent) {
@@ -94,7 +144,7 @@ public class DownloadService extends Worker {
             String publicKey = getInputData().getString(PUBLIC_KEY);
             boolean isManifest = getInputData().getBoolean(IS_MANIFEST, false);
 
-            Log.d(TAG, "doWork isManifest: " + isManifest);
+            logger.debug("doWork isManifest: " + isManifest);
 
             if (isManifest) {
                 JSONArray manifest = DataManager.getInstance().getAndClearManifest();
@@ -102,7 +152,7 @@ public class DownloadService extends Worker {
                     handleManifestDownload(id, documentsDir, dest, version, sessionKey, publicKey, manifest.toString());
                     return createSuccessResult(dest, version, sessionKey, checksum, true);
                 } else {
-                    Log.e(TAG, "Manifest is null");
+                    logger.error("Manifest is null");
                     return createFailureResult("Manifest is null");
                 }
             } else {
@@ -134,7 +184,7 @@ public class DownloadService extends Worker {
         String manifestString
     ) {
         try {
-            Log.d(TAG, "handleManifestDownload");
+            logger.debug("handleManifestDownload");
             JSONArray manifest = new JSONArray(manifestString);
             File destFolder = new File(documentsDir, dest);
             File cacheFolder = new File(getApplicationContext().getCacheDir(), "capgo_downloads");
@@ -167,7 +217,7 @@ public class DownloadService extends Worker {
                     try {
                         fileHash = CryptoCipherV2.decryptChecksum(fileHash, publicKey);
                     } catch (Exception e) {
-                        Log.e(TAG, "Error decrypting checksum for " + fileName, e);
+                        logger.error("Error decrypting checksum for " + fileName + "fileHash: " + fileHash);
                         hasError.set(true);
                         continue;
                     }
@@ -180,7 +230,7 @@ public class DownloadService extends Worker {
 
                 // Ensure parent directories of the target file exist
                 if (!Objects.requireNonNull(targetFile.getParentFile()).exists() && !targetFile.getParentFile().mkdirs()) {
-                    Log.e(TAG, "Failed to create parent directory for: " + targetFile.getAbsolutePath());
+                    logger.error("Failed to create parent directory for: " + targetFile.getAbsolutePath());
                     hasError.set(true);
                     continue;
                 }
@@ -189,10 +239,10 @@ public class DownloadService extends Worker {
                     try {
                         if (builtinFile.exists() && verifyChecksum(builtinFile, finalFileHash)) {
                             copyFile(builtinFile, targetFile);
-                            Log.d(TAG, "using builtin file " + fileName);
+                            logger.debug("using builtin file " + fileName);
                         } else if (cacheFile.exists() && verifyChecksum(cacheFile, finalFileHash)) {
                             copyFile(cacheFile, targetFile);
-                            Log.d(TAG, "already cached " + fileName);
+                            logger.debug("already cached " + fileName);
                         } else {
                             downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey);
                         }
@@ -201,7 +251,7 @@ public class DownloadService extends Worker {
                         int percent = calcTotalPercent(completed, totalFiles);
                         setProgress(percent);
                     } catch (Exception e) {
-                        Log.e(TAG, "Error processing file: " + fileName, e);
+                        logger.error("Error processing file: " + fileName + " " + e.getMessage());
                         hasError.set(true);
                     }
                 });
@@ -213,7 +263,7 @@ public class DownloadService extends Worker {
                 try {
                     future.get();
                 } catch (Exception e) {
-                    Log.e(TAG, "Error waiting for download", e);
+                    logger.error("Error waiting for download " + e.getMessage());
                     hasError.set(true);
                 }
             }
@@ -229,11 +279,11 @@ public class DownloadService extends Worker {
             }
 
             if (hasError.get()) {
-                Log.e(TAG, "One or more files failed to download");
+                logger.error("One or more files failed to download");
                 throw new IOException("One or more files failed to download");
             }
         } catch (Exception e) {
-            Log.e(TAG, "Error in handleManifestDownload", e);
+            logger.error("Error in handleManifestDownload " + e.getMessage());
             throw new RuntimeException(e.getLocalizedMessage());
         }
     }
@@ -248,93 +298,156 @@ public class DownloadService extends Worker {
         String checksum
     ) {
         File target = new File(documentsDir, dest);
-        File infoFile = new File(documentsDir, UPDATE_FILE); // The file where the download progress (how much byte
-        // downloaded) is stored
-        File tempFile = new File(documentsDir, "temp" + ".tmp"); // Temp file, where the downloaded data is stored
+        File infoFile = new File(documentsDir, UPDATE_FILE);
+        File tempFile = new File(documentsDir, "temp" + ".tmp");
+
+        // Check available disk space before starting
+        long availableSpace = target.getParentFile().getUsableSpace();
+        long estimatedSize = 50 * 1024 * 1024; // 50MB default estimate
+        if (availableSpace < estimatedSize * 2) {
+            throw new RuntimeException("insufficient_disk_space");
+        }
+
+        HttpURLConnection httpConn = null;
+        InputStream inputStream = null;
+        FileOutputStream outputStream = null;
+        BufferedReader reader = null;
+        BufferedWriter writer = null;
+
         try {
             URL u = new URL(url);
-            HttpURLConnection httpConn = null;
-            try {
-                httpConn = (HttpURLConnection) u.openConnection();
+            httpConn = (HttpURLConnection) u.openConnection();
 
-                // Reading progress file (if exist)
-                long downloadedBytes = 0;
+            // Set reasonable timeouts
+            httpConn.setConnectTimeout(30000); // 30 seconds
+            httpConn.setReadTimeout(60000); // 60 seconds
 
-                if (infoFile.exists() && tempFile.exists()) {
-                    try (BufferedReader reader = new BufferedReader(new FileReader(infoFile))) {
-                        String updateVersion = reader.readLine();
-                        if (!updateVersion.equals(version)) {
-                            clearDownloadData(documentsDir);
-                        } else {
-                            downloadedBytes = tempFile.length();
-                        }
+            // Reading progress file (if exist)
+            long downloadedBytes = 0;
+
+            if (infoFile.exists() && tempFile.exists()) {
+                try {
+                    reader = new BufferedReader(new FileReader(infoFile));
+                    String updateVersion = reader.readLine();
+                    if (updateVersion != null && !updateVersion.equals(version)) {
+                        clearDownloadData(documentsDir);
+                    } else {
+                        downloadedBytes = tempFile.length();
+                    }
+                } finally {
+                    if (reader != null) {
+                        try {
+                            reader.close();
+                        } catch (Exception ignored) {}
                     }
-                } else {
-                    clearDownloadData(documentsDir);
                 }
+            } else {
+                clearDownloadData(documentsDir);
+            }
+
+            if (downloadedBytes > 0) {
+                httpConn.setRequestProperty("Range", "bytes=" + downloadedBytes + "-");
+            }
+
+            int responseCode = httpConn.getResponseCode();
+
+            if (responseCode == HttpURLConnection.HTTP_OK || responseCode == HttpURLConnection.HTTP_PARTIAL) {
+                long contentLength = httpConn.getContentLength() + downloadedBytes;
 
-                if (downloadedBytes > 0) {
-                    httpConn.setRequestProperty("Range", "bytes=" + downloadedBytes + "-");
+                // Check if we have enough space for the actual file
+                if (contentLength > 0 && availableSpace < contentLength * 2) {
+                    throw new RuntimeException("insufficient_disk_space");
                 }
 
-                int responseCode = httpConn.getResponseCode();
+                try {
+                    inputStream = httpConn.getInputStream();
+                    outputStream = new FileOutputStream(tempFile, downloadedBytes > 0);
+
+                    if (downloadedBytes == 0) {
+                        writer = new BufferedWriter(new FileWriter(infoFile));
+                        writer.write(String.valueOf(version));
+                        writer.close();
+                        writer = null;
+                    }
 
-                if (responseCode == HttpURLConnection.HTTP_OK || responseCode == HttpURLConnection.HTTP_PARTIAL) {
-                    long contentLength = httpConn.getContentLength() + downloadedBytes;
+                    byte[] buffer = new byte[8192]; // Larger buffer for better performance
+                    int lastNotifiedPercent = 0;
+                    int bytesRead;
 
-                    try (
-                        InputStream inputStream = httpConn.getInputStream();
-                        FileOutputStream outputStream = new FileOutputStream(tempFile, downloadedBytes > 0)
-                    ) {
-                        if (downloadedBytes == 0) {
-                            try (BufferedWriter writer = new BufferedWriter(new FileWriter(infoFile))) {
-                                writer.write(String.valueOf(version));
-                            }
-                        }
-                        // Updating the info file
-                        try (BufferedWriter writer = new BufferedWriter(new FileWriter(infoFile))) {
-                            writer.write(String.valueOf(version));
+                    while ((bytesRead = inputStream.read(buffer)) != -1) {
+                        outputStream.write(buffer, 0, bytesRead);
+                        downloadedBytes += bytesRead;
+
+                        // Flush every 1MB to ensure progress is saved
+                        if (downloadedBytes % (1024 * 1024) == 0) {
+                            outputStream.flush();
                         }
 
-                        int bytesRead = -1;
-                        byte[] buffer = new byte[4096];
-                        int lastNotifiedPercent = 0;
-                        while ((bytesRead = inputStream.read(buffer)) != -1) {
-                            outputStream.write(buffer, 0, bytesRead);
-                            downloadedBytes += bytesRead;
-                            // Saving progress (flushing every 100 Ko)
-                            if (downloadedBytes % 102400 == 0) {
-                                outputStream.flush();
-                            }
-                            // Computing percentage
-                            int percent = calcTotalPercent(downloadedBytes, contentLength);
-                            while (lastNotifiedPercent + 10 <= percent) {
-                                lastNotifiedPercent += 10;
-                                // Artificial delay using CPU-bound calculation to take ~5 seconds
-                                double result = 0;
-                                setProgress(lastNotifiedPercent);
-                            }
+                        // Computing percentage
+                        int percent = calcTotalPercent(downloadedBytes, contentLength);
+                        if (percent >= lastNotifiedPercent + 10) {
+                            lastNotifiedPercent = (percent / 10) * 10;
+                            setProgress(lastNotifiedPercent);
                         }
+                    }
+
+                    // Final flush
+                    outputStream.flush();
+                    outputStream.close();
+                    outputStream = null;
 
-                        outputStream.close();
-                        inputStream.close();
+                    inputStream.close();
+                    inputStream = null;
 
-                        // Rename the temp file with the final name (dest)
-                        tempFile.renameTo(new File(documentsDir, dest));
-                        infoFile.delete();
+                    // Rename the temp file with the final name (dest)
+                    if (!tempFile.renameTo(new File(documentsDir, dest))) {
+                        throw new RuntimeException("Failed to rename temp file to final destination");
                     }
-                } else {
                     infoFile.delete();
+                } catch (OutOfMemoryError e) {
+                    logger.error("Out of memory during download: " + e.getMessage());
+                    // Try to free some memory
+                    System.gc();
+                    throw new RuntimeException("low_mem_fail");
+                } finally {
+                    // Ensure all resources are closed
+                    if (outputStream != null) {
+                        try {
+                            outputStream.close();
+                        } catch (Exception ignored) {}
+                    }
+                    if (inputStream != null) {
+                        try {
+                            inputStream.close();
+                        } catch (Exception ignored) {}
+                    }
+                    if (writer != null) {
+                        try {
+                            writer.close();
+                        } catch (Exception ignored) {}
+                    }
                 }
-            } finally {
-                if (httpConn != null) {
-                    httpConn.disconnect();
-                }
+            } else {
+                infoFile.delete();
+                throw new RuntimeException("HTTP error: " + responseCode);
             }
         } catch (OutOfMemoryError e) {
+            logger.error("Critical memory error: " + e.getMessage());
+            System.gc(); // Suggest garbage collection
             throw new RuntimeException("low_mem_fail");
+        } catch (SecurityException e) {
+            logger.error("Security error during download: " + e.getMessage());
+            throw new RuntimeException("security_error: " + e.getMessage());
         } catch (Exception e) {
-            throw new RuntimeException(e.getLocalizedMessage());
+            logger.error("Download error: " + e.getMessage());
+            throw new RuntimeException(e.getMessage());
+        } finally {
+            // Ensure connection is closed
+            if (httpConn != null) {
+                try {
+                    httpConn.disconnect();
+                } catch (Exception ignored) {}
+            }
         }
     }
 
@@ -347,7 +460,7 @@ public class DownloadService extends Worker {
             infoFile.createNewFile();
             tempFile.createNewFile();
         } catch (IOException e) {
-            Log.e(TAG, "Error in clearDownloadData", e);
+            logger.error("Error in clearDownloadData " + e.getMessage());
             // not a fatal error, so we don't throw an exception
         }
     }
@@ -373,62 +486,81 @@ public class DownloadService extends Worker {
         String sessionKey,
         String publicKey
     ) throws Exception {
-        Log.d(TAG, "downloadAndVerify " + downloadUrl);
+        logger.debug("downloadAndVerify " + downloadUrl);
 
         Request request = new Request.Builder().url(downloadUrl).build();
 
+        // Check if file is a Brotli file
+        boolean isBrotli = targetFile.getName().endsWith(".br");
+
+        // Create final target file with .br extension removed if it's a Brotli file
+        File finalTargetFile = isBrotli
+            ? new File(targetFile.getParentFile(), targetFile.getName().substring(0, targetFile.getName().length() - 3))
+            : targetFile;
+
         // Create a temporary file for the compressed data
-        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".br");
+        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".tmp");
 
-        try (Response response = client.newCall(request).execute()) {
+        try (Response response = sharedClient.newCall(request).execute()) {
             if (!response.isSuccessful()) {
                 throw new IOException("Unexpected response code: " + response.code());
             }
 
-            // Download compressed file
-            try (ResponseBody responseBody = response.body(); FileOutputStream compressedFos = new FileOutputStream(compressedFile)) {
-                if (responseBody == null) {
-                    throw new IOException("Response body is null");
-                }
-
-                byte[] buffer = new byte[8192];
-                int bytesRead;
-                try (InputStream inputStream = responseBody.byteStream()) {
-                    while ((bytesRead = inputStream.read(buffer)) != -1) {
-                        compressedFos.write(buffer, 0, bytesRead);
-                    }
-                }
+            // Download compressed file atomically
+            ResponseBody responseBody = response.body();
+            if (responseBody == null) {
+                throw new IOException("Response body is null");
             }
 
+            // Use OkIO for atomic write
+            writeFileAtomic(compressedFile, responseBody.byteStream(), null);
+
             if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
-                Log.d(CapacitorUpdater.TAG + " DLSrv", "Decrypting file " + targetFile.getName());
+                logger.debug("Decrypting file " + targetFile.getName());
                 CryptoCipherV2.decryptFile(compressedFile, publicKey, sessionKey);
             }
 
-            // Use new decompression method
-            byte[] compressedData = Files.readAllBytes(compressedFile.toPath());
-            byte[] decompressedData = decompressBrotli(compressedData, targetFile.getName());
-            Files.write(targetFile.toPath(), decompressedData);
+            // Only decompress if file has .br extension
+            if (isBrotli) {
+                // Use new decompression method with atomic write
+                try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                    byte[] compressedData = new byte[(int) compressedFile.length()];
+                    fis.read(compressedData);
+                    byte[] decompressedData = decompressBrotli(compressedData, targetFile.getName());
+
+                    // Write decompressed data atomically
+                    try (java.io.ByteArrayInputStream bais = new java.io.ByteArrayInputStream(decompressedData)) {
+                        writeFileAtomic(finalTargetFile, bais, null);
+                    }
+                }
+            } else {
+                // Just copy the file without decompression using atomic operation
+                try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                    writeFileAtomic(finalTargetFile, fis, null);
+                }
+            }
 
             // Delete the compressed file
             compressedFile.delete();
-            String calculatedHash = CryptoCipherV2.calcChecksum(targetFile);
+            String calculatedHash = CryptoCipherV2.calcChecksum(finalTargetFile);
 
             // Verify checksum
             if (calculatedHash.equals(expectedHash)) {
-                // Only cache if checksum is correct
-                copyFile(targetFile, cacheFile);
+                // Only cache if checksum is correct - use atomic copy
+                try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
+                    writeFileAtomic(cacheFile, fis, expectedHash);
+                }
             } else {
-                targetFile.delete();
+                finalTargetFile.delete();
                 throw new IOException(
                     "Checksum verification failed for: " +
-                    downloadUrl +
-                    " " +
-                    targetFile.getName() +
-                    " expected: " +
-                    expectedHash +
-                    " calculated: " +
-                    calculatedHash
+                        downloadUrl +
+                        " " +
+                        targetFile.getName() +
+                        " expected: " +
+                        expectedHash +
+                        " calculated: " +
+                        calculatedHash
                 );
             }
         } catch (Exception e) {
@@ -448,14 +580,14 @@ public class DownloadService extends Worker {
 
     private String calculateFileHash(File file) throws Exception {
         MessageDigest digest = MessageDigest.getInstance("SHA-256");
-        FileInputStream fis = new FileInputStream(file);
         byte[] byteArray = new byte[1024];
         int bytesCount = 0;
 
-        while ((bytesCount = fis.read(byteArray)) != -1) {
-            digest.update(byteArray, 0, bytesCount);
+        try (FileInputStream fis = new FileInputStream(file)) {
+            while ((bytesCount = fis.read(byteArray)) != -1) {
+                digest.update(byteArray, 0, bytesCount);
+            }
         }
-        fis.close();
 
         byte[] bytes = digest.digest();
         StringBuilder sb = new StringBuilder();
@@ -468,7 +600,7 @@ public class DownloadService extends Worker {
     private byte[] decompressBrotli(byte[] data, String fileName) throws IOException {
         // Validate input
         if (data == null) {
-            Log.e(TAG, "Error: Null data received for " + fileName);
+            logger.error("Error: Null data received for " + fileName);
             throw new IOException("Null data received");
         }
 
@@ -495,7 +627,7 @@ public class DownloadService extends Worker {
                     return Arrays.copyOfRange(data, 3, data.length - 1);
                 }
             } catch (ArrayIndexOutOfBoundsException e) {
-                Log.e(TAG, "Error: Malformed data for " + fileName);
+                logger.error("Error: Malformed data for " + fileName);
                 throw new IOException("Malformed data structure");
             }
         }
@@ -513,14 +645,63 @@ public class DownloadService extends Worker {
             }
             return bos.toByteArray();
         } catch (IOException e) {
-            Log.e(TAG, "Error: Brotli process failed for " + fileName + ". Status: " + e.getMessage());
+            logger.error("Error: Brotli process failed for " + fileName + ". Status: " + e.getMessage());
             // Add hex dump for debugging
             StringBuilder hexDump = new StringBuilder();
             for (int i = 0; i < Math.min(32, data.length); i++) {
                 hexDump.append(String.format("%02x ", data[i]));
             }
-            Log.e(TAG, "Error: Raw data (" + fileName + "): " + hexDump.toString());
+            logger.error("Error: Raw data (" + fileName + "): " + hexDump.toString());
             throw e;
         }
     }
+
+    /**
+     * Atomically write data to a file using OkIO
+     */
+    private void writeFileAtomic(File targetFile, InputStream inputStream, String expectedChecksum) throws IOException {
+        File tempFile = new File(targetFile.getParent(), targetFile.getName() + ".tmp");
+
+        try {
+            // Write to temp file first using OkIO
+            try (BufferedSink sink = Okio.buffer(Okio.sink(tempFile)); BufferedSource source = Okio.buffer(Okio.source(inputStream))) {
+                sink.writeAll(source);
+            }
+
+            // Verify checksum if provided
+            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
+                String actualChecksum = CryptoCipherV2.calcChecksum(tempFile);
+                if (!expectedChecksum.equalsIgnoreCase(actualChecksum)) {
+                    tempFile.delete();
+                    throw new IOException("Checksum verification failed");
+                }
+            }
+
+            // Atomic rename (on same filesystem)
+            Files.move(tempFile.toPath(), targetFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+        } catch (Exception e) {
+            // Clean up temp file on error
+            if (tempFile.exists()) {
+                tempFile.delete();
+            }
+            throw new IOException("Failed to write file atomically: " + e.getMessage(), e);
+        }
+    }
+
+    /**
+     * Clean up old temporary files
+     */
+    private void cleanupOldTempFiles(File directory) {
+        if (directory == null || !directory.exists()) return;
+
+        File[] tempFiles = directory.listFiles((dir, name) -> name.endsWith(".tmp"));
+        if (tempFiles != null) {
+            long oneHourAgo = System.currentTimeMillis() - 3600000;
+            for (File tempFile : tempFiles) {
+                if (tempFile.lastModified() < oneHourAgo) {
+                    tempFile.delete();
+                }
+            }
+        }
+    }
 }