@capgo/capacitor-updater 8.41.4 → 8.41.6

package/android/build.gradle

@@ -50,7 +50,9 @@ repositories {
 
 dependencies {
     def work_version = "2.10.5"
+    def lifecycle_version = "2.8.7"
     implementation "androidx.work:work-runtime:$work_version"
+    implementation "androidx.lifecycle:lifecycle-process:$lifecycle_version"
     implementation "com.google.android.gms:play-services-tasks:18.4.0"
     implementation "com.google.guava:guava:33.5.0-android"
     implementation fileTree(dir: 'libs', include: ['*.jar'])

package/android/src/main/java/ee/forgr/capacitor_updater/AppLifecycleObserver.java

@@ -0,0 +1,88 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+package ee.forgr.capacitor_updater;
+
+import androidx.annotation.NonNull;
+import androidx.lifecycle.DefaultLifecycleObserver;
+import androidx.lifecycle.LifecycleOwner;
+import androidx.lifecycle.ProcessLifecycleOwner;
+
+/**
+ * Observes app-level lifecycle events using ProcessLifecycleOwner.
+ * This provides reliable detection of when the entire app (not just an activity)
+ * moves to foreground or background.
+ *
+ * Unlike activity lifecycle callbacks, this won't trigger false positives when:
+ * - Opening a native camera view
+ * - Opening share sheets
+ * - Any other native activity overlays within the app
+ *
+ * The ON_STOP event is dispatched with a ~700ms delay after the last activity
+ * passes through onStop(), which helps avoid false triggers during configuration
+ * changes or quick activity transitions.
+ */
+public class AppLifecycleObserver implements DefaultLifecycleObserver {
+
+    public interface AppLifecycleListener {
+        void onAppMovedToForeground();
+        void onAppMovedToBackground();
+    }
+
+    private final AppLifecycleListener listener;
+    private final Logger logger;
+    private boolean isRegistered = false;
+
+    public AppLifecycleObserver(AppLifecycleListener listener, Logger logger) {
+        this.listener = listener;
+        this.logger = logger;
+    }
+
+    public void register() {
+        if (isRegistered) {
+            return;
+        }
+        try {
+            ProcessLifecycleOwner.get().getLifecycle().addObserver(this);
+            isRegistered = true;
+            logger.info("AppLifecycleObserver registered with ProcessLifecycleOwner");
+        } catch (Exception e) {
+            logger.error("Failed to register AppLifecycleObserver: " + e.getMessage());
+        }
+    }
+
+    public void unregister() {
+        if (!isRegistered) {
+            return;
+        }
+        try {
+            ProcessLifecycleOwner.get().getLifecycle().removeObserver(this);
+            isRegistered = false;
+            logger.info("AppLifecycleObserver unregistered from ProcessLifecycleOwner");
+        } catch (Exception e) {
+            logger.error("Failed to unregister AppLifecycleObserver: " + e.getMessage());
+        }
+    }
+
+    @Override
+    public void onStart(@NonNull LifecycleOwner owner) {
+        // App moved to foreground (at least one activity is visible)
+        logger.info("ProcessLifecycleOwner: App moved to foreground");
+        if (listener != null) {
+            listener.onAppMovedToForeground();
+        }
+    }
+
+    @Override
+    public void onStop(@NonNull LifecycleOwner owner) {
+        // App moved to background (no activities are visible)
+        // Note: This is called with a ~700ms delay to avoid false triggers
+        logger.info("ProcessLifecycleOwner: App moved to background");
+        if (listener != null) {
+            listener.onAppMovedToBackground();
+        }
+    }
+}

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -7,7 +7,6 @@
 package ee.forgr.capacitor_updater;
 
 import android.app.Activity;
-import android.app.ActivityManager;
 import android.content.Context;
 import android.content.Intent;
 import android.content.SharedPreferences;
@@ -85,7 +84,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private static final String[] BREAKING_EVENT_NAMES = { "breakingAvailable", "majorAvailable" };
     private static final String LAST_FAILED_BUNDLE_PREF_KEY = "CapacitorUpdater.lastFailedBundle";
 
-    private final String pluginVersion = "8.41.4";
+    private final String pluginVersion = "8.41.6";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -116,6 +115,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private Boolean allowManualBundleError = false;
     private Boolean allowSetDefaultChannel = true;
 
+    // Used for activity-based foreground/background detection on Android < 14
     private Boolean isPreviousMainActivity = true;
 
     private volatile Thread backgroundDownloadTask;
@@ -138,6 +138,9 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private FrameLayout splashscreenLoaderOverlay;
     private Runnable splashscreenTimeoutRunnable;
 
+    // App lifecycle observer using ProcessLifecycleOwner for reliable foreground/background detection
+    private AppLifecycleObserver appLifecycleObserver;
+
     // Play Store In-App Updates
     private AppUpdateManager appUpdateManager;
     private AppUpdateInfo cachedAppUpdateInfo;
@@ -431,6 +434,31 @@ public class CapacitorUpdaterPlugin extends Plugin {
         this.delayUpdateUtils.checkCancelDelay(DelayUpdateUtils.CancelDelaySource.KILLED);
 
         this.checkForUpdateAfterDelay();
+
+        // On Android 14+ (API 34+), topActivity in RecentTaskInfo returns null due to
+        // security restrictions (StrandHogg task hijacking mitigations). Use ProcessLifecycleOwner
+        // for reliable app-level foreground/background detection on these versions.
+        // On older versions, we use the traditional activity lifecycle callbacks in handleOnStart/handleOnStop.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            this.appLifecycleObserver = new AppLifecycleObserver(
+                new AppLifecycleObserver.AppLifecycleListener() {
+                    @Override
+                    public void onAppMovedToForeground() {
+                        CapacitorUpdaterPlugin.this.appMovedToForeground();
+                    }
+
+                    @Override
+                    public void onAppMovedToBackground() {
+                        CapacitorUpdaterPlugin.this.appMovedToBackground();
+                    }
+                },
+                logger
+            );
+            this.appLifecycleObserver.register();
+            logger.info("Using ProcessLifecycleOwner for foreground/background detection (Android 14+)");
+        } else {
+            logger.info("Using activity lifecycle callbacks for foreground/background detection (Android <14)");
+        }
     }
 
     private void semaphoreWait(Number waitTime) {
@@ -2129,16 +2157,22 @@ public class CapacitorUpdaterPlugin extends Plugin {
         }
     }
 
+    /**
+     * Check if the current activity is the main activity.
+     * Used for activity-based foreground/background detection on Android < 14.
+     * On Android 14+, topActivity returns null due to security restrictions, so we use
+     * ProcessLifecycleOwner instead.
+     */
     private boolean isMainActivity() {
         try {
             Context mContext = this.getContext();
-            ActivityManager activityManager = (ActivityManager) mContext.getSystemService(Context.ACTIVITY_SERVICE);
-            List<ActivityManager.AppTask> runningTasks = activityManager.getAppTasks();
+            android.app.ActivityManager activityManager = (android.app.ActivityManager) mContext.getSystemService(Context.ACTIVITY_SERVICE);
+            java.util.List<android.app.ActivityManager.AppTask> runningTasks = activityManager.getAppTasks();
             if (runningTasks.isEmpty()) {
                 return false;
             }
-            ActivityManager.RecentTaskInfo runningTask = runningTasks.get(0).getTaskInfo();
-            String className = Objects.requireNonNull(runningTask.baseIntent.getComponent()).getClassName();
+            android.app.ActivityManager.RecentTaskInfo runningTask = runningTasks.get(0).getTaskInfo();
+            String className = java.util.Objects.requireNonNull(runningTask.baseIntent.getComponent()).getClassName();
             if (runningTask.topActivity == null) {
                 return false;
             }
@@ -2152,12 +2186,17 @@ public class CapacitorUpdaterPlugin extends Plugin {
     @Override
     public void handleOnStart() {
         try {
-            if (isPreviousMainActivity) {
-                logger.info("handleOnStart: appMovedToForeground");
-                this.appMovedToForeground();
-            }
             logger.info("handleOnStart: onActivityStarted " + getActivity().getClass().getName());
-            isPreviousMainActivity = true;
+
+            // On Android < 14, use activity lifecycle for foreground detection
+            // On Android 14+, ProcessLifecycleOwner handles this via AppLifecycleObserver
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                if (isPreviousMainActivity) {
+                    logger.info("handleOnStart: appMovedToForeground (Android <14 path)");
+                    this.appMovedToForeground();
+                }
+                isPreviousMainActivity = true;
+            }
 
             // Initialize shake menu if enabled and activity is BridgeActivity
             if (shakeMenuEnabled && getActivity() instanceof com.getcapacitor.BridgeActivity && shakeMenu == null) {
@@ -2176,10 +2215,16 @@ public class CapacitorUpdaterPlugin extends Plugin {
     @Override
     public void handleOnStop() {
         try {
-            isPreviousMainActivity = isMainActivity();
-            if (isPreviousMainActivity) {
-                logger.info("handleOnStop: appMovedToBackground");
-                this.appMovedToBackground();
+            logger.info("handleOnStop: onActivityStopped");
+
+            // On Android < 14, use activity lifecycle for background detection
+            // On Android 14+, ProcessLifecycleOwner handles this via AppLifecycleObserver
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                isPreviousMainActivity = isMainActivity();
+                if (isPreviousMainActivity) {
+                    logger.info("handleOnStop: appMovedToBackground (Android <14 path)");
+                    this.appMovedToBackground();
+                }
             }
         } catch (Exception e) {
             logger.error("Failed to run handleOnStop: " + e.getMessage());
@@ -2604,6 +2649,17 @@ public class CapacitorUpdaterPlugin extends Plugin {
                     logger.error("Failed to clean up shake menu: " + e.getMessage());
                 }
             }
+
+            // Clean up app lifecycle observer
+            if (appLifecycleObserver != null) {
+                try {
+                    appLifecycleObserver.unregister();
+                    appLifecycleObserver = null;
+                    logger.info("AppLifecycleObserver cleaned up");
+                } catch (Exception e) {
+                    logger.error("Failed to clean up AppLifecycleObserver: " + e.getMessage());
+                }
+            }
         } catch (Exception e) {
             logger.error("Failed to run handleOnDestroy: " + e.getMessage());
         }

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -153,12 +153,25 @@ public class CapgoUpdater {
     }
 
     public void setPublicKey(String publicKey) {
-        this.publicKey = publicKey;
-        if (!publicKey.isEmpty()) {
-            this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
-        } else {
+        // Empty string means no encryption - proceed normally
+        if (publicKey == null || publicKey.isEmpty()) {
+            this.publicKey = "";
             this.cachedKeyId = "";
+            return;
+        }
+
+        // Non-empty: must be a valid RSA key or crash
+        try {
+            CryptoCipher.stringToPublicKey(publicKey);
+        } catch (Exception e) {
+            throw new RuntimeException(
+                "Invalid public key in capacitor.config.json: failed to parse RSA key. Remove the key or provide a valid PEM-formatted RSA public key.",
+                e
+            );
         }
+
+        this.publicKey = publicKey;
+        this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
     }
 
     public String getKeyId() {

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -291,7 +291,7 @@ public class DownloadService extends Worker {
                 String fileHash = entry.getString("file_hash");
                 String downloadUrl = entry.getString("download_url");
 
-                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
                     try {
                         fileHash = CryptoCipher.decryptChecksum(fileHash, publicKey);
                     } catch (Exception e) {
@@ -633,7 +633,7 @@ public class DownloadService extends Worker {
                 // Use OkIO for atomic write
                 writeFileAtomic(compressedFile, responseBody.byteStream(), null);
 
-                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
                     logger.debug("Decrypting file " + targetFile.getName());
                     CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
                 }

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -60,7 +60,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         CAPPluginMethod(name: "completeFlexibleUpdate", returnType: CAPPluginReturnPromise)
     ]
     public var implementation = CapgoUpdater()
-    private let pluginVersion: String = "8.41.4"
+    private let pluginVersion: String = "8.41.6"
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
     static let channelUrlDefault = "https://plugin.capgo.app/channel_self"
@@ -387,13 +387,13 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             // The initial report: https://discord.com/channels/912707985829163099/1456985639345061969
             // The bug happens in a very specific scenario. Here is the reproduction steps, followed by the lackof busniess impact
             // Reproduction steps:
-            // 1. Install iOS app via app store. Version: 10.13.0. Version v10 of the app uses Capacitor 6 (6.3.13) - a version where the key was still "LatestVersionNative" 
+            // 1. Install iOS app via app store. Version: 10.13.0. Version v10 of the app uses Capacitor 6 (6.3.13) - a version where the key was still "LatestVersionNative"
             // 2. The plugin writes "10.13.0" to the key "LatestVersionNative"
             // 3. Update the app to version 10.17.0 via Capgo.
             // 4. Update the app via testflight to version 11.0.0. This version uses Capacitor 8 (8.41.3) - a version where the key was changed to "LatestNativeBuildVersion"
             // 5. During the initial load of then new native version, the plugin will read "LatestNativeBuildVersion", not find it, read "LatestVersionNative", find it and revert to builtin version sucessfully.
             // 6. The plugin writes "11.0.0" to the key "LatestNativeBuildVersion"
-            // 7. The app is now in a state where it is using the builtin version, but the key "LatestNativeBuildVersion" is still set to "11.0.0" and "LatestVersionNative" is still set to "10.13.0". 
+            // 7. The app is now in a state where it is using the builtin version, but the key "LatestNativeBuildVersion" is still set to "11.0.0" and "LatestVersionNative" is still set to "10.13.0".
             // 8. The user downgrades using app store back to version 10.13.0.
             // 9. The old plugin reads "LatestVersionNative", finds "10.13.0," so it doesn't revert to builtin version. // <--- THIS IS THE FIRST PART OF THE BUG
             // 10. "LatestVersionNative" is written to "10.13.0" but "LatestNativeBuildVersion" is not touched, and stays at "11.0.0"

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -80,12 +80,20 @@ import UIKit
     }
 
     public func setPublicKey(_ publicKey: String) {
-        self.publicKey = publicKey
-        if !publicKey.isEmpty {
-            self.cachedKeyId = CryptoCipher.calcKeyId(publicKey: publicKey)
-        } else {
+        // Empty string means no encryption - proceed normally
+        if publicKey.isEmpty {
+            self.publicKey = ""
             self.cachedKeyId = nil
+            return
         }
+
+        // Non-empty: must be a valid RSA key or crash
+        guard RSAPublicKey.load(rsaPublicKey: publicKey) != nil else {
+            fatalError("Invalid public key in capacitor.config.json: failed to parse RSA key. Remove the key or provide a valid PEM-formatted RSA public key.")
+        }
+
+        self.publicKey = publicKey
+        self.cachedKeyId = CryptoCipher.calcKeyId(publicKey: publicKey)
     }
 
     public func getKeyId() -> String? {
@@ -1306,7 +1314,7 @@ import UIKit
                 let fileName = url.lastPathComponent
                 // Only cleanup package_*.tmp and update_*.dat files
                 let isDownloadTemp = (fileName.hasPrefix("package_") && fileName.hasSuffix(".tmp")) ||
-                                     (fileName.hasPrefix("update_") && fileName.hasSuffix(".dat"))
+                    (fileName.hasPrefix("update_") && fileName.hasSuffix(".dat"))
                 if !isDownloadTemp {
                     continue
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.41.4",
+  "version": "8.41.6",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",