@capgo/capacitor-updater 8.51.12 → 8.51.14

package/android/src/main/java/ee/forgr/capacitor_updater/BundleInfo.java

@@ -99,7 +99,7 @@ public class BundleInfo {
     }
 
     public boolean isDownloaded() {
-        return (!this.isBuiltin() && this.downloaded != null && !this.downloaded.isEmpty() && !this.isDeleted() && !this.isDeleting());
+        return !this.isBuiltin() && this.downloaded != null && !this.downloaded.isEmpty() && !this.isDeleted() && !this.isDeleting();
     }
 
     public String getDownloaded() {

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.12";
+    private final String pluginVersion = "8.51.14";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -250,6 +250,8 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private volatile long webViewPageStartedAtMs = 0;
     private volatile boolean launchStartReported = false;
     private volatile boolean launchReadyReported = false;
+    private volatile boolean launchTimeoutReported = false;
+    private final Object launchReportLock = new Object();
     private FrameLayout splashscreenLoaderOverlay;
     private Runnable splashscreenTimeoutRunnable;
     private FrameLayout previewTransitionLoaderOverlay;
@@ -1751,16 +1753,18 @@ public class CapacitorUpdaterPlugin extends Plugin {
     }
 
     private void reportAppLaunchReady(final BundleInfo bundle) {
-        if (
-            this.implementation == null ||
-            this.implementation.statsUrl == null ||
-            this.implementation.statsUrl.isEmpty() ||
-            this.launchReadyReported
-        ) {
-            return;
+        synchronized (this.launchReportLock) {
+            if (
+                this.implementation == null ||
+                this.implementation.statsUrl == null ||
+                this.implementation.statsUrl.isEmpty() ||
+                this.launchReadyReported ||
+                this.launchTimeoutReported
+            ) {
+                return;
+            }
+            this.launchReadyReported = true;
         }
-
-        this.launchReadyReported = true;
         final Map<String, String> metadata = new HashMap<>();
         metadata.put("duration_ms", Long.toString(Math.max(0, System.currentTimeMillis() - this.launchStartedAtMs)));
         metadata.put("launch_started_at", Long.toString(this.launchStartedAtMs));
@@ -1769,14 +1773,22 @@ public class CapacitorUpdaterPlugin extends Plugin {
     }
 
     private void reportAppLaunchTimeout(final BundleInfo bundle) {
-        if (this.implementation == null || this.implementation.statsUrl == null || this.implementation.statsUrl.isEmpty()) {
-            return;
+        synchronized (this.launchReportLock) {
+            if (
+                this.implementation == null ||
+                this.implementation.statsUrl == null ||
+                this.implementation.statsUrl.isEmpty() ||
+                this.launchReadyReported ||
+                this.launchTimeoutReported
+            ) {
+                return;
+            }
+            this.launchTimeoutReported = true;
         }
-
         final Map<String, String> metadata = new HashMap<>();
         metadata.put("duration_ms", Long.toString(Math.max(0, System.currentTimeMillis() - this.launchStartedAtMs)));
         metadata.put("launch_started_at", Long.toString(this.launchStartedAtMs));
-        metadata.put("timeout_ms", Long.toString(this.appReadyTimeout));
+        metadata.put("timeout_ms", Long.toString(this.resolveAppReadyCheckTimeoutMs()));
         metadata.put("source", "app_ready_timeout");
         this.implementation.sendStats("app_launch_timeout", bundle == null ? "" : bundle.getVersionName(), "", metadata);
     }

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -2854,7 +2854,17 @@ public class CapgoUpdater {
 
     public void restorePendingStats() {
         File file = pendingStatsFile();
-        if (file == null || !file.exists()) {
+        if (file == null) {
+            return;
+        }
+        File backup = new File(file.getAbsolutePath() + ".bak");
+        if (!file.exists() && backup.exists() && !backup.renameTo(file)) {
+            if (logger != null) {
+                logger.error("Failed to restore stats backup");
+            }
+            return;
+        }
+        if (!file.exists()) {
             return;
         }
         try {
@@ -2958,18 +2968,39 @@ public class CapgoUpdater {
 
     private static void writeFileAtomically(final File file, final byte[] bytes) throws IOException {
         final File tmp = new File(file.getAbsolutePath() + ".tmp");
-        try (FileOutputStream out = new FileOutputStream(tmp)) {
-            out.write(bytes);
-            out.flush();
-        }
-        if (tmp.renameTo(file)) {
-            return;
-        }
-        if (file.exists() && !file.delete()) {
-            throw new IOException("Failed to replace " + file.getAbsolutePath());
-        }
-        if (!tmp.renameTo(file)) {
+        File backup = null;
+        try {
+            try (FileOutputStream out = new FileOutputStream(tmp)) {
+                out.write(bytes);
+                out.flush();
+            }
+            if (tmp.renameTo(file)) {
+                return;
+            }
+            if (file.exists()) {
+                backup = new File(file.getAbsolutePath() + ".bak");
+                if (backup.exists() && !backup.delete()) {
+                    throw new IOException("Failed to replace " + file.getAbsolutePath());
+                }
+                if (!file.renameTo(backup)) {
+                    throw new IOException("Failed to replace " + file.getAbsolutePath());
+                }
+            }
+            if (tmp.renameTo(file)) {
+                if (backup != null && backup.exists() && !backup.delete()) {
+                    backup.deleteOnExit();
+                }
+                backup = null;
+                return;
+            }
             throw new IOException("Failed to persist " + file.getAbsolutePath());
+        } finally {
+            if (backup != null && !file.exists()) {
+                backup.renameTo(file);
+            }
+            if (tmp.exists() && !tmp.delete()) {
+                tmp.deleteOnExit();
+            }
         }
     }
 

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -169,7 +169,11 @@ public class CryptoCipher {
         }
         Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
         cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getEncoded(), "AES"), new IvParameterSpec(iv));
-        File tempFile = File.createTempFile("capgo-aes-", ".tmp", file.getParentFile());
+        File parent = file.getAbsoluteFile().getParentFile();
+        if (parent == null) {
+            throw new IOException("Cannot create temp file for " + file.getAbsolutePath());
+        }
+        File tempFile = File.createTempFile("capgo-aes-", ".tmp", parent);
         try {
             byte[] inBuf = new byte[ioBufferBytes()];
             // Reuse one output buffer. cipher.update(in) allocates a new byte[] per chunk.
@@ -187,6 +191,9 @@ public class CryptoCipher {
                     fos.write(outBuf, 0, last);
                 }
             }
+            if (tempFile.length() == 0) {
+                throw new IOException("Empty decrypted data");
+            }
             replaceFile(tempFile, file);
             tempFile = null;
         } finally {
@@ -369,14 +376,7 @@ public class CryptoCipher {
             while ((length = inputStream.read(buffer)) != -1) {
                 digest.update(buffer, 0, length);
             }
-            byte[] hash = digest.digest();
-            StringBuilder hexString = new StringBuilder();
-            for (byte b : hash) {
-                String hex = Integer.toHexString(0xff & b);
-                if (hex.length() == 1) hexString.append('0');
-                hexString.append(hex);
-            }
-            return hexString.toString();
+            return digestToHex(digest);
         } catch (IOException e) {
             logger.error("Cannot calculate checksum");
             logger.debug("Error: " + e.getMessage());
@@ -384,6 +384,27 @@ public class CryptoCipher {
         }
     }
 
+    static String digestToHex(MessageDigest digest) {
+        byte[] hash = digest.digest();
+        StringBuilder hexString = new StringBuilder(hash.length * 2);
+        for (byte b : hash) {
+            String hex = Integer.toHexString(0xff & b);
+            if (hex.length() == 1) hexString.append('0');
+            hexString.append(hex);
+        }
+        return hexString.toString();
+    }
+
+    static String shortPathKey(String fileName) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            digest.update((fileName == null ? "" : fileName).getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            return digestToHex(digest).substring(0, 16);
+        } catch (java.security.NoSuchAlgorithmException e) {
+            return Integer.toHexString((fileName == null ? "" : fileName).hashCode());
+        }
+    }
+
     private static byte[] createDEREncoding(int tag, byte[] value) {
         if (tag < 0 || tag >= 0xFF) {
             throw new IllegalArgumentException("Currently only single byte tags supported");

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -76,8 +76,10 @@ public class DownloadService extends Worker {
     public static final String DEFAULT_CHANNEL = "default_channel";
     public static final String IS_PROD = "is_prod";
     public static final String IS_EMULATOR = "is_emulator";
-    // HTTP + decode share one pool. Cap by CPU: 8 on 4 cores, 16 on 8 cores, 64 max.
+    // HTTP + decode share one pool. Cap per host by CPU: 8 on 4 cores, 16 on 8 cores.
+    // Keep the global cap at 64 so API calls on another host are not starved by manifest downloads.
     private static final int MANIFEST_MAX_CONCURRENT_FILES = manifestMaxConcurrentFiles();
+    private static final int SHARED_MAX_REQUESTS = 64;
     private static final String UPDATE_FILE = "update.dat";
 
     // Shared OkHttpClient to prevent resource leaks
@@ -89,7 +91,7 @@ public class DownloadService extends Worker {
     // Initialize shared client with User-Agent interceptor
     static {
         Dispatcher dispatcher = new Dispatcher();
-        dispatcher.setMaxRequests(MANIFEST_MAX_CONCURRENT_FILES);
+        dispatcher.setMaxRequests(SHARED_MAX_REQUESTS);
         dispatcher.setMaxRequestsPerHost(MANIFEST_MAX_CONCURRENT_FILES);
         sharedClient = new OkHttpClient.Builder()
             .dispatcher(dispatcher)
@@ -157,6 +159,7 @@ public class DownloadService extends Worker {
 
         // Clean up old temporary files on service initialization
         cleanupOldTempFiles(getApplicationContext().getCacheDir());
+        cleanupOldTempFiles(new File(getApplicationContext().getCacheDir(), "capgo_downloads"));
     }
 
     private void setProgress(int percent) {
@@ -532,7 +535,16 @@ public class DownloadService extends Worker {
                         ) {
                             logger.debug("already cached " + fileName);
                         } else {
-                            downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey, finalIsBrotli);
+                            downloadAndVerify(
+                                downloadUrl,
+                                targetFile,
+                                cacheFile,
+                                finalFileHash,
+                                sessionKey,
+                                publicKey,
+                                finalIsBrotli,
+                                fileName
+                            );
                         }
 
                         long completed = completedFiles.incrementAndGet();
@@ -827,96 +839,135 @@ public class DownloadService extends Worker {
         String expectedHash,
         String sessionKey,
         String publicKey,
-        boolean isBrotli
+        boolean isBrotli,
+        String relativeName
     ) throws Exception {
         logger.debug("downloadAndVerify " + downloadUrl);
 
-        Request request = new Request.Builder().url(downloadUrl).build();
-
-        // targetFile is already the final destination without .br extension
         File finalTargetFile = targetFile;
-
-        // Create a temporary file for the compressed data with a unique name to avoid race conditions
-        // between threads processing files with the same basename in different directories
-        File compressedFile = new File(
-            getApplicationContext().getCacheDir(),
-            "temp_" + java.util.UUID.randomUUID().toString() + "_" + targetFile.getName() + ".tmp"
-        );
-
+        File cacheFolder = new File(getApplicationContext().getCacheDir(), "capgo_downloads");
+        if (!cacheFolder.exists() && !cacheFolder.mkdirs()) {
+            throw new IOException("Failed to create cache directory: " + cacheFolder.getAbsolutePath());
+        }
+        File partial = manifestPartialFile(cacheFolder, expectedHash, relativeName);
+        File workFile = null;
+        boolean keepPartial = partial.isFile();
         try {
-            try (Response response = sharedClient.newCall(request).execute()) {
-                if (!response.isSuccessful()) {
+            long existing = partial.isFile() ? partial.length() : 0;
+            Request.Builder builder = new Request.Builder().url(downloadUrl);
+            if (existing > 0) {
+                builder.header("Range", "bytes=" + existing + "-");
+            }
+            try (Response response = sharedClient.newCall(builder.build()).execute()) {
+                int code = response.code();
+                if (code == 416 && existing > 0) {
+                    logger.debug("Range not satisfiable, using existing partial " + partial.getName());
+                    keepPartial = true;
+                } else if (code != HttpURLConnection.HTTP_OK && code != HttpURLConnection.HTTP_PARTIAL) {
                     sendStatsAsync("download_manifest_file_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                    throw new IOException("Unexpected response code: " + response.code());
-                }
-
-                // Download compressed file atomically
-                ResponseBody responseBody = response.body();
-                if (responseBody == null) {
-                    throw new IOException("Response body is null");
+                    throw new IOException("Unexpected response code: " + code);
+                } else {
+                    ResponseBody responseBody = response.body();
+                    if (responseBody == null) {
+                        throw new IOException("Response body is null");
+                    }
+                    try {
+                        writeHttpBody(partial, responseBody.byteStream(), code, existing);
+                        keepPartial = true;
+                    } catch (Exception e) {
+                        keepPartial = true;
+                        throw e;
+                    }
                 }
+            }
 
-                // Use OkIO for atomic write
-                writeFileAtomic(compressedFile, responseBody.byteStream(), null);
-
-                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+            boolean needDecrypt = publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty();
+            File source = partial;
+            if (needDecrypt) {
+                workFile = new File(cacheFolder, "work_" + UUID.randomUUID() + "_" + targetFile.getName() + ".tmp");
+                copyFile(partial, workFile);
+                try {
                     logger.debug("Decrypting file " + targetFile.getName());
-                    CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
+                    CryptoCipher.decryptFile(workFile, publicKey, sessionKey);
+                    source = workFile;
+                } catch (Exception e) {
+                    keepPartial = false;
+                    throw e;
                 }
+            }
 
-                // Only decompress if file has .br extension
+            try {
                 if (isBrotli) {
-                    try {
-                        decompressBrotli(compressedFile, finalTargetFile, targetFile.getName());
-                    } catch (IOException e) {
-                        sendStatsAsync(
-                            "download_manifest_brotli_fail",
-                            getInputData().getString(VERSION) + ":" + finalTargetFile.getName()
-                        );
-                        throw e;
-                    }
+                    decompressBrotli(source, finalTargetFile, targetFile.getName(), expectedHash);
                 } else {
-                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
-                        writeFileAtomic(finalTargetFile, fis, null);
+                    try (FileInputStream fis = new FileInputStream(source)) {
+                        writeFileAtomic(finalTargetFile, fis, expectedHash);
                     }
                 }
-
-                // Delete the compressed file
-                compressedFile.delete();
-                String calculatedHash = CryptoCipher.calcChecksum(finalTargetFile);
-                CryptoCipher.logChecksumInfo("Calculated checksum", calculatedHash);
-                CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
-
-                // Verify checksum
-                if (calculatedHash.equalsIgnoreCase(expectedHash)) {
-                    // Only cache if checksum is correct - use atomic copy
-                    if (cacheFile != null) {
-                        try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
-                            writeFileAtomic(cacheFile, fis, null);
-                        }
-                    }
-                } else {
-                    finalTargetFile.delete();
+            } catch (IOException e) {
+                String msg = e.getMessage();
+                if (msg != null && msg.contains("Checksum verification failed")) {
                     sendStatsAsync("download_manifest_checksum_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                    throw new IOException(
-                        "Checksum verification failed for: " +
-                            downloadUrl +
-                            " " +
-                            targetFile.getName() +
-                            " expected: " +
-                            expectedHash +
-                            " calculated: " +
-                            calculatedHash
-                    );
+                    keepPartial = false;
+                } else if (isBrotli && msg != null && msg.toLowerCase(java.util.Locale.US).contains("brotli")) {
+                    sendStatsAsync("download_manifest_brotli_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    keepPartial = false;
+                }
+                throw e;
+            }
+
+            CryptoCipher.logChecksumInfo("Calculated checksum", expectedHash);
+            CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
+
+            if (cacheFile != null) {
+                try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
+                    writeFileAtomic(cacheFile, fis, null);
                 }
             }
+            keepPartial = false;
         } catch (Exception e) {
-            throw new IOException("Error in downloadAndVerify: " + e.getMessage());
+            throw new IOException("Error in downloadAndVerify: " + e.getMessage(), e);
         } finally {
-            // Always cleanup the compressed temp file if it still exists
-            if (compressedFile.exists()) {
-                compressedFile.delete();
+            if (workFile != null && workFile.exists() && !workFile.delete()) {
+                logger.debug("Failed to delete decrypt work file");
+            }
+            if (!keepPartial && partial.exists() && !partial.delete()) {
+                logger.debug("Failed to delete manifest partial " + partial.getName());
+            }
+        }
+    }
+
+    static String safePartialToken(String fileName) {
+        return CryptoCipher.shortPathKey(fileName);
+    }
+
+    static File manifestPartialFile(File cacheDir, String hash, String fileName) {
+        String token = safePartialToken(fileName);
+        if (CapgoUpdater.isSafeCacheHash(hash) && hash.length() == 64) {
+            return new File(cacheDir, "partial_" + hash + "_" + token + ".tmp");
+        }
+        String digest = CryptoCipher.shortPathKey((hash == null ? "" : hash) + "\0" + (fileName == null ? "" : fileName));
+        return new File(cacheDir, "partial_" + digest + "_" + token + ".tmp");
+    }
+
+    static boolean shouldAppendHttpBody(int statusCode, long existingBytes) {
+        return existingBytes > 0 && statusCode == HttpURLConnection.HTTP_PARTIAL;
+    }
+
+    static void writeHttpBody(File dest, InputStream body, int statusCode, long existingBytes) throws IOException {
+        boolean append = shouldAppendHttpBody(statusCode, existingBytes);
+        byte[] buffer = new byte[CryptoCipher.ioBufferBytes()];
+        try (FileOutputStream fos = new FileOutputStream(dest, append)) {
+            int n;
+            long written = append ? existingBytes : 0;
+            while ((n = body.read(buffer)) != -1) {
+                fos.write(buffer, 0, n);
+                written += n;
+                if (written % (1024 * 1024) == 0) {
+                    fos.flush();
+                }
             }
+            fos.flush();
         }
     }
 
@@ -950,13 +1001,17 @@ public class DownloadService extends Worker {
     }
 
     static void decompressBrotli(File input, File output, String fileName) throws IOException {
+        decompressBrotli(input, output, fileName, null);
+    }
+
+    static void decompressBrotli(File input, File output, String fileName, String expectedChecksum) throws IOException {
         File parent = output.getParentFile();
         if (parent != null) {
             parent.mkdirs();
         }
         long length = input.length();
         if (length == 0) {
-            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), null);
+            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), expectedChecksum);
             return;
         }
 
@@ -971,7 +1026,7 @@ public class DownloadService extends Worker {
         }
 
         if (length == 3 && head[0] == 0x1B && head[1] == 0x00 && head[2] == 0x06) {
-            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), null);
+            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), expectedChecksum);
             return;
         }
 
@@ -988,14 +1043,14 @@ public class DownloadService extends Worker {
                         }
                         skipped += n;
                     }
-                    writeFileAtomic(output, new BoundedInputStream(fis, length - 4), null);
+                    writeFileAtomic(output, new BoundedInputStream(fis, length - 4), expectedChecksum);
                 }
                 return;
             }
         }
 
         try (FileInputStream fis = new FileInputStream(input); BrotliInputStream brotliInputStream = new BrotliInputStream(fis)) {
-            writeFileAtomic(output, brotliInputStream, null);
+            writeFileAtomic(output, brotliInputStream, expectedChecksum);
         } catch (IOException e) {
             logger.error("Error: Brotli process failed for " + fileName + ". Status: " + e.getMessage());
             StringBuilder hexDump = new StringBuilder();
@@ -1007,7 +1062,7 @@ public class DownloadService extends Worker {
                 }
             }
             logger.error("Error: Raw data (" + fileName + "): " + hexDump);
-            throw e;
+            throw new IOException("Brotli process failed for " + fileName + ": " + e.getMessage(), e);
         }
     }
 
@@ -1048,6 +1103,7 @@ public class DownloadService extends Worker {
 
     /**
      * Atomically write a stream to a file using the 256 KiB IO buffer.
+     * When expectedChecksum is set, SHA-256 is hashed during the write.
      */
     static void writeFileAtomic(File targetFile, InputStream inputStream, String expectedChecksum) throws IOException {
         File tempFile = File.createTempFile("capgo-", ".tmp", targetFile.getParentFile());
@@ -1056,26 +1112,39 @@ public class DownloadService extends Worker {
             // Okio's default segment is 8 KiB. Copy with 256 KiB so 8 MiB wrapper unwraps
             // are not 1000 tiny writes.
             byte[] buffer = new byte[CryptoCipher.ioBufferBytes()];
+            MessageDigest digest = null;
+            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
+                try {
+                    digest = MessageDigest.getInstance("SHA-256");
+                } catch (java.security.NoSuchAlgorithmException e) {
+                    throw new IOException("SHA-256 algorithm not available", e);
+                }
+            }
             try (FileOutputStream fos = new FileOutputStream(tempFile)) {
                 int n;
                 while ((n = inputStream.read(buffer)) != -1) {
+                    if (digest != null) {
+                        digest.update(buffer, 0, n);
+                    }
                     fos.write(buffer, 0, n);
                 }
             }
 
-            // Verify checksum if provided
-            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
-                String actualChecksum = CryptoCipher.calcChecksum(tempFile);
+            if (digest != null) {
+                String actualChecksum = CryptoCipher.digestToHex(digest);
                 if (!expectedChecksum.equalsIgnoreCase(actualChecksum)) {
-                    tempFile.delete();
-                    throw new IOException("Checksum verification failed");
+                    throw new IOException("Checksum verification failed expected: " + expectedChecksum + " calculated: " + actualChecksum);
                 }
             }
 
             // Atomic rename (on same filesystem). renameTo works on API 24; Files.move does not.
             CryptoCipher.replaceFile(tempFile, targetFile);
+        } catch (IOException e) {
+            if (tempFile.exists()) {
+                tempFile.delete();
+            }
+            throw e;
         } catch (Exception e) {
-            // Clean up temp file on error
             if (tempFile.exists()) {
                 tempFile.delete();
             }

package/android/src/main/java/ee/forgr/capacitor_updater/ShakeMenu.java

@@ -238,6 +238,9 @@ public class ShakeMenu implements ShakeDetector.Listener, ThreeFingerPinchDetect
 
     private void setPreviewMenuButtonsEnabled(List<Button> buttons, boolean enabled) {
         for (Button button : buttons) {
+            if (!enabled && "Close menu".equals(button.getText().toString())) {
+                continue;
+            }
             button.setEnabled(enabled);
         }
     }

package/ios/Sources/CapacitorUpdaterPlugin/AES.swift

@@ -180,6 +180,11 @@ public struct AES128Key {
         }
         try output.close()
 
+        let decryptedSize = (try fileManager.attributesOfItem(atPath: tempURL.path)[.size] as? NSNumber)?.uint64Value ?? 0
+        if decryptedSize == 0 {
+            throw NSError(domain: "Empty decrypted data", code: 7, userInfo: nil)
+        }
+
         do {
             _ = try fileManager.replaceItemAt(destination, withItemAt: tempURL)
         } catch {

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -96,7 +96,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     deinit {
         implementation.shutdown()
     }
-    private let pluginVersion: String = "8.51.12"
+    private let pluginVersion: String = "8.51.14"
     private let launchStartedAtMs = Int64(Date().timeIntervalSince1970 * 1000)
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
@@ -1096,6 +1096,9 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                 }
                 let res = self.implementation.list()
                 for version in res {
+                    if Thread.current.isCancelled {
+                        return
+                    }
                     self.logger.info("Deleting obsolete bundle: \(version.getId())")
                     let deleted = self.implementation.delete(id: version.getId())
                     if !deleted {
@@ -1103,17 +1106,28 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                     }
                     Thread.sleep(forTimeInterval: 0.075)
                 }
-                self.implementation.cleanupDeltaCache()
+                self.implementation.cleanupDeltaCache(threadToCheck: Thread.current)
+            }
+
+            if Thread.current.isCancelled {
+                return
             }
 
             // Resume any DELETING leftovers from prior kills, one-by-one.
             self.implementation.drainPendingDeletes()
 
+            if Thread.current.isCancelled {
+                return
+            }
+
             // Always sweep orphan directories so incomplete prior cleanups (or failed deletes)
             // cannot leave hundreds of MB behind across launches.
             let allowedIds = self.implementation.allowedBundleIdsForCleanup()
-            self.implementation.cleanupDownloadDirectories(allowedIds: allowedIds)
-            self.implementation.cleanupOrphanedTempFolders(threadToCheck: nil)
+            self.implementation.cleanupDownloadDirectories(allowedIds: allowedIds, threadToCheck: Thread.current)
+            if Thread.current.isCancelled {
+                return
+            }
+            self.implementation.cleanupOrphanedTempFolders(threadToCheck: Thread.current)
 
             if self.defaultChannelCleanupMustRetry {
                 self.logger.warn("Keeping the previous native build version so default channel cleanup retries")
@@ -1131,7 +1145,13 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         }
 
         logger.info("Waiting for cleanup to complete before starting download...")
-        cleanupGroup.wait()
+        let result = cleanupGroup.wait(timeout: .now() + .seconds(60))
+        if result == .timedOut {
+            logger.warn("Cleanup wait timed out after 60s, cancelling leftover cleanup")
+            cleanupThread?.cancel()
+            _ = cleanupGroup.wait(timeout: .now() + .seconds(60))
+            return
+        }
         logger.info("Cleanup finished, proceeding with download")
     }
 
@@ -2749,7 +2769,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             guard self.previewSessionEnabled else {
                 return
             }
-            if let topVC = UIApplication.topViewController(),
+            if let topVC = UIApplication.topViewController(self.bridge?.viewController),
                topVC.isKind(of: UIAlertController.self) {
                 self.previewSessionAlertPending = true
                 UserDefaults.standard.set(true, forKey: self.previewSessionAlertPendingDefaultsKey)
@@ -2763,7 +2783,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                 preferredStyle: .alert
             )
             alert.addAction(UIAlertAction(title: "Got it", style: .default))
-            if let topVC = UIApplication.topViewController() {
+            if let topVC = UIApplication.topViewController(self.bridge?.viewController) {
                 topVC.present(alert, animated: true)
             } else {
                 self.previewSessionAlertPending = true

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -305,9 +305,48 @@ import UIKit
         return fileManager.fileExists(atPath: fallback.path) ? fallback : nil
     }
 
-    private func storeDownloadedFile(_ downloadedFileURL: URL, at tempPath: URL, existingBytes: Int64, response: HTTPURLResponse?) throws {
+    static func shouldAppendHttpBody(statusCode: Int, existingBytes: Int64) -> Bool {
+        existingBytes > 0 && statusCode == 206
+    }
+
+    static func safePartialToken(_ fileName: String) -> String {
+        CryptoCipher.shortPathKey(fileName)
+    }
+
+    static func manifestPartialURL(cacheFolder: URL, hash: String, fileName: String) -> URL {
+        let token = safePartialToken(fileName)
+        if isSafeCacheHash(hash) && hash.count == 64 {
+            return cacheFolder.appendingPathComponent("partial_\(hash)_\(token).tmp")
+        }
+        let digest = CryptoCipher.shortPathKey("\(hash)|\(fileName)")
+        return cacheFolder.appendingPathComponent("partial_\(digest)_\(token).tmp")
+    }
+
+    private func cleanupOldManifestPartials() {
+        let cutoff = Date().addingTimeInterval(-3600)
+        guard let files = try? FileManager.default.contentsOfDirectory(
+            at: cacheFolder,
+            includingPropertiesForKeys: [.contentModificationDateKey],
+            options: [.skipsHiddenFiles]
+        ) else {
+            return
+        }
+        for url in files {
+            let name = url.lastPathComponent
+            guard name.hasPrefix("partial_") && name.hasSuffix(".tmp") else {
+                continue
+            }
+            let modified = (try? url.resourceValues(forKeys: [.contentModificationDateKey]).contentModificationDate) ?? .distantPast
+            if modified < cutoff {
+                try? FileManager.default.removeItem(at: url)
+            }
+        }
+    }
+
+    func storeDownloadedFile(_ downloadedFileURL: URL, at tempPath: URL, existingBytes: Int64, response: HTTPURLResponse?) throws {
         let fileManager = FileManager.default
-        if existingBytes > 0 && (response?.statusCode == 206 || response == nil) {
+        if Self.shouldAppendHttpBody(statusCode: response?.statusCode ?? 0, existingBytes: existingBytes) ||
+            (existingBytes > 0 && response == nil) {
             let fileHandle = try FileHandle(forWritingTo: tempPath)
             defer {
                 try? fileHandle.close()
@@ -1342,6 +1381,7 @@ import UIKit
         try checkDiskSpace(estimatedSize: estimatedSize)
 
         try FileManager.default.createDirectory(at: cacheFolder, withIntermediateDirectories: true, attributes: nil)
+        cleanupOldManifestPartials()
         try FileManager.default.createDirectory(at: destFolder, withIntermediateDirectories: true, attributes: nil)
 
         // Create and save BundleInfo before starting the download process
@@ -1550,7 +1590,7 @@ import UIKit
             )
         }
 
-        guard let request = createRequest(url: url, method: "GET") else {
+        guard var request = createRequest(url: url, method: "GET") else {
             throw NSError(
                 domain: "ManifestDownloadError",
                 code: 2,
@@ -1558,6 +1598,18 @@ import UIKit
             )
         }
 
+        try FileManager.default.createDirectory(at: cacheFolder, withIntermediateDirectories: true, attributes: nil)
+        let partialURL = Self.manifestPartialURL(cacheFolder: cacheFolder, hash: fileHash, fileName: fileName)
+        let existingBytes: Int64
+        if FileManager.default.fileExists(atPath: partialURL.path) {
+            existingBytes = Int64((try FileManager.default.attributesOfItem(atPath: partialURL.path)[.size] as? NSNumber)?.int64Value ?? 0)
+        } else {
+            existingBytes = 0
+        }
+        if existingBytes > 0 {
+            request.setValue("bytes=\(existingBytes)-", forHTTPHeaderField: "Range")
+        }
+
         let result = performDownloadRequest(request, label: "downloadManifestFile \(fileName)")
         defer {
             if let fileURL = result.fileURL {
@@ -1566,6 +1618,7 @@ import UIKit
         }
 
         if result.timedOut {
+            persistPartialDownload(result, id: bundleId, tempPath: partialURL, existingBytes: existingBytes)
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(
                 domain: NSURLErrorDomain,
@@ -1575,6 +1628,7 @@ import UIKit
         }
 
         if let error = result.error {
+            persistPartialDownload(result, id: bundleId, tempPath: partialURL, existingBytes: existingBytes)
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             self.logger.error("Manifest file download network error")
             self.logger.debug("Bundle: \(bundleId), File: \(fileName), Error: \(error.localizedDescription)")
@@ -1582,12 +1636,24 @@ import UIKit
         }
 
         let statusCode = result.response?.statusCode ?? 200
-        if statusCode < 200 || statusCode >= 300 {
+        if statusCode == 416 && existingBytes > 0 {
+            logger.debug("Range not satisfiable, using existing partial \(partialURL.lastPathComponent)")
+        } else if statusCode < 200 || statusCode >= 300 {
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(domain: "StatusCodeError", code: statusCode, userInfo: [NSLocalizedDescriptionKey: "Failed to fetch. Status code (\(statusCode)) invalid for file \(fileName) at url \(downloadUrl)"])
+        } else {
+            guard let downloadedFileURL = result.fileURL, FileManager.default.fileExists(atPath: downloadedFileURL.path) else {
+                self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
+                throw NSError(
+                    domain: "ManifestDownloadError",
+                    code: 3,
+                    userInfo: [NSLocalizedDescriptionKey: "Manifest file response was empty for \(fileName) at url \(downloadUrl)"]
+                )
+            }
+            try storeDownloadedFile(downloadedFileURL, at: partialURL, existingBytes: existingBytes, response: result.response)
         }
 
-        guard let downloadedFileURL = result.fileURL, FileManager.default.fileExists(atPath: downloadedFileURL.path) else {
+        guard FileManager.default.fileExists(atPath: partialURL.path) else {
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(
                 domain: "ManifestDownloadError",
@@ -1596,42 +1662,60 @@ import UIKit
             )
         }
 
+        var workURL: URL?
+        defer {
+            if let workURL {
+                try? FileManager.default.removeItem(at: workURL)
+            }
+        }
+
         do {
-            // Decrypt in place when a session key is present — streamed, not a whole-file copy.
+            var source = partialURL
             if !self.publicKey.isEmpty && !sessionKey.isEmpty {
+                let work = cacheFolder.appendingPathComponent("work_\(UUID().uuidString)_\((fileName as NSString).lastPathComponent)")
+                try FileManager.default.copyItem(at: partialURL, to: work)
+                workURL = work
                 do {
-                    try CryptoCipher.decryptFile(filePath: downloadedFileURL, publicKey: self.publicKey, sessionKey: sessionKey, version: version)
+                    try CryptoCipher.decryptFile(filePath: work, publicKey: self.publicKey, sessionKey: sessionKey, version: version)
                 } catch {
+                    try? FileManager.default.removeItem(at: partialURL)
                     self.sendStats(action: "decrypt_fail", versionName: version)
                     throw error
                 }
+                source = work
             }
 
+            let calculatedChecksum: String
             if isBrotli {
                 do {
-                    try decompressBrotli(from: downloadedFileURL, to: destFilePath, fileName: fileName)
+                    calculatedChecksum = try decompressBrotli(from: source, to: destFilePath, fileName: fileName)
                 } catch {
+                    try? FileManager.default.removeItem(at: partialURL)
                     self.sendStats(action: "download_manifest_brotli_fail", versionName: "\(version):\(destFileName)")
                     throw error
                 }
             } else {
-                try copyItemReplacing(from: downloadedFileURL, to: destFilePath)
+                let handle = try FileHandle(forReadingFrom: source)
+                defer {
+                    try? handle.close()
+                }
+                let length = (try FileManager.default.attributesOfItem(atPath: source.path)[.size] as? NSNumber)?.uint64Value ?? 0
+                calculatedChecksum = try streamCopy(from: handle, count: length, to: destFilePath)
             }
 
-            // Always verify checksum when file_hash is present
-            let calculatedChecksum = CryptoCipher.calcChecksum(filePath: destFilePath)
             CryptoCipher.logChecksumInfo(label: "Calculated checksum", hexChecksum: calculatedChecksum)
             CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: fileHash)
             if calculatedChecksum != fileHash {
                 try? FileManager.default.removeItem(at: destFilePath)
+                try? FileManager.default.removeItem(at: partialURL)
                 self.sendStats(action: "download_manifest_checksum_fail", versionName: "\(version):\(destFileName)")
                 throw NSError(domain: "ChecksumError", code: 1, userInfo: [NSLocalizedDescriptionKey: "Computed checksum is not equal to required checksum (\(calculatedChecksum) != \(fileHash)) for file \(fileName) at url \(downloadUrl)"])
             }
 
-            // Save to cache (replace stale cache entries from partial or concurrent downloads)
             if let cacheFilePath {
                 try copyItemAtomically(from: destFilePath, to: cacheFilePath)
             }
+            try? FileManager.default.removeItem(at: partialURL)
 
             self.logger.info("Manifest file downloaded and cached")
             self.logger.debug("Bundle: \(bundleId), File: \(fileName), Brotli: \(isBrotli), Encrypted: \(!self.publicKey.isEmpty && !sessionKey.isEmpty)")
@@ -1701,13 +1785,13 @@ import UIKit
 
     /// Stream Brotli from disk to disk. Peek only the 3-byte header and last byte
     /// for the empty/wrapper special cases; never load the whole file.
-    func decompressBrotli(from source: URL, to dest: URL, fileName: String) throws {
+    func decompressBrotli(from source: URL, to dest: URL, fileName: String) throws -> String {
         let fileManager = FileManager.default
         try fileManager.createDirectory(at: dest.deletingLastPathComponent(), withIntermediateDirectories: true, attributes: nil)
         let length = (try fileManager.attributesOfItem(atPath: source.path)[.size] as? NSNumber)?.uint64Value ?? 0
         if length == 0 {
             try Data().write(to: dest, options: .atomic)
-            return
+            return CryptoCipher.RunningChecksum().hex()
         }
 
         let handle = try FileHandle(forReadingFrom: source)
@@ -1724,7 +1808,7 @@ import UIKit
 
         if length == 3 && head.count == 3 && head[0] == 0x1B && head[1] == 0x00 && head[2] == 0x06 {
             try Data().write(to: dest, options: .atomic)
-            return
+            return CryptoCipher.RunningChecksum().hex()
         }
 
         if length > 3 && head.count == 3 && last == 0x03 {
@@ -1732,16 +1816,15 @@ import UIKit
             let isQualityZeroWrapper = head[0] == 0x0b && head[1] == 0x02 && head[2] == 0x80
             if isEmptyWrapper || isQualityZeroWrapper {
                 try handle.seek(toOffset: 3)
-                try streamCopy(from: handle, count: length - 4, to: dest)
-                return
+                return try streamCopy(from: handle, count: length - 4, to: dest)
             }
         }
 
         try handle.seek(toOffset: 0)
-        try streamBrotliDecode(from: handle, to: dest, fileName: fileName)
+        return try streamBrotliDecode(from: handle, to: dest, fileName: fileName)
     }
 
-    private func streamCopy(from handle: FileHandle, count: UInt64, to dest: URL) throws {
+    func streamCopy(from handle: FileHandle, count: UInt64, to dest: URL) throws -> String {
         let fileManager = FileManager.default
         let tempURL = dest.deletingLastPathComponent().appendingPathComponent("capgo-br-\(UUID().uuidString).tmp")
         fileManager.createFile(atPath: tempURL.path, contents: nil)
@@ -1751,6 +1834,7 @@ import UIKit
             try? fileManager.removeItem(at: tempURL)
         }
 
+        let hasher = CryptoCipher.RunningChecksum()
         var remaining = count
         let chunkSize = CryptoCipher.ioBufferBytes()
         while remaining > 0 {
@@ -1758,6 +1842,7 @@ import UIKit
                 let toRead = Int(min(UInt64(chunkSize), remaining))
                 let chunk = try handle.read(upToCount: toRead) ?? Data()
                 if !chunk.isEmpty {
+                    hasher.update(chunk)
                     try output.write(contentsOf: chunk)
                 }
                 return chunk.count
@@ -1769,9 +1854,10 @@ import UIKit
         }
         try output.close()
         try replaceItemAtomically(at: dest, withItemAt: tempURL)
+        return hasher.hex()
     }
 
-    private func streamBrotliDecode(from handle: FileHandle, to dest: URL, fileName: String) throws {
+    private func streamBrotliDecode(from handle: FileHandle, to dest: URL, fileName: String) throws -> String {
         let fileManager = FileManager.default
         let tempURL = dest.deletingLastPathComponent().appendingPathComponent("capgo-br-\(UUID().uuidString).tmp")
         fileManager.createFile(atPath: tempURL.path, contents: nil)
@@ -1780,6 +1866,7 @@ import UIKit
             try? output.close()
             try? fileManager.removeItem(at: tempURL)
         }
+        let hasher = CryptoCipher.RunningChecksum()
 
         let chunkSize = max(CryptoCipher.ioBufferBytes(), 65536)
         var inputBuffer = [UInt8](repeating: 0, count: chunkSize)
@@ -1824,7 +1911,9 @@ import UIKit
                     status = compression_stream_process(streamPointer, flags)
                     let have = chunkSize - streamPointer.pointee.dst_size
                     if have > 0 {
-                        try output.write(contentsOf: Data(bytes: outBase, count: have))
+                        let decoded = Data(bytes: outBase, count: have)
+                        hasher.update(decoded)
+                        try output.write(contentsOf: decoded)
                     }
                     streamPointer.pointee.dst_ptr = outBase
                     streamPointer.pointee.dst_size = chunkSize
@@ -1848,6 +1937,7 @@ import UIKit
 
         try output.close()
         try replaceItemAtomically(at: dest, withItemAt: tempURL)
+        return hasher.hex()
     }
 
     public func download(url: URL, version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {
@@ -2165,6 +2255,7 @@ import UIKit
         if !hadRegistry && !hadFolder {
             logger.error("Cannot delete unknown bundle")
             logger.debug("Bundle ID: \(id)")
+            self.dequeuePendingDelete(id: id)
             return false
         }
 
@@ -2224,6 +2315,10 @@ import UIKit
         var pendingIds = Set(self.list(raw: true).filter { $0.isDeleting() }.map { $0.getId() }.filter { !$0.isEmpty })
         pendingIds.formUnion(self.getPendingDeleteIds())
         for id in pendingIds {
+            if Thread.current.isCancelled {
+                logger.warn("drainPendingDeletes was cancelled")
+                return
+            }
             logger.info("Resuming pending delete for bundle: \(id)")
             if self.delete(id: id, removeInfo: true) {
                 self.dequeuePendingDelete(id: id)
@@ -2410,11 +2505,16 @@ import UIKit
             logger.debug("Error: \(error.localizedDescription)")
         }
 
+        if let thread = threadToCheck, thread.isCancelled {
+            logger.warn("cleanupOrphanedTempFolders was cancelled")
+            return
+        }
+
         // Also cleanup old download temp files (package_*.tmp and update_*.dat)
-        cleanupOldDownloadTempFiles()
+        cleanupOldDownloadTempFiles(threadToCheck: threadToCheck)
     }
 
-    private func cleanupOldDownloadTempFiles() {
+    private func cleanupOldDownloadTempFiles(threadToCheck: Thread? = nil) {
         let fileManager = FileManager.default
         guard let documentsDir = fileManager.urls(for: .documentDirectory, in: .userDomainMask).first else {
             return
@@ -2425,6 +2525,10 @@ import UIKit
             let oneHourAgo = Date().addingTimeInterval(-3600)
 
             for url in contents {
+                if let thread = threadToCheck, thread.isCancelled {
+                    logger.warn("cleanupOldDownloadTempFiles was cancelled")
+                    return
+                }
                 let fileName = url.lastPathComponent
                 // Only cleanup package_*.tmp and update_*.dat files
                 let isDownloadTemp = (fileName.hasPrefix("package_") && fileName.hasSuffix(".tmp")) ||

package/ios/Sources/CapacitorUpdaterPlugin/CryptoCipher.swift

@@ -198,8 +198,7 @@ public struct CryptoCipher {
                 }
             }) {}
 
-            let digest = sha256.finalize()
-            return digest.compactMap { String(format: "%02x", $0) }.joined()
+            return hexString(from: sha256)
         } catch {
             logger.error("Cannot calculate checksum")
             logger.debug("Path: \(filePath.path), Error: \(error)")
@@ -207,6 +206,32 @@ public struct CryptoCipher {
         }
     }
 
+    final class RunningChecksum {
+        private var sha256 = SHA256()
+
+        func update(_ data: Data) {
+            guard !data.isEmpty else {
+                return
+            }
+            sha256.update(data: data)
+        }
+
+        func hex() -> String {
+            CryptoCipher.hexString(from: sha256)
+        }
+    }
+
+    static func hexString(from sha256: SHA256) -> String {
+        var copy = sha256
+        return copy.finalize().compactMap { String(format: "%02x", $0) }.joined()
+    }
+
+    static func shortPathKey(_ fileName: String) -> String {
+        var sha256 = SHA256()
+        sha256.update(data: Data(fileName.utf8))
+        return String(hexString(from: sha256).prefix(16))
+    }
+
     public static func decryptFile(filePath: URL, publicKey: String, sessionKey: String, version: String) throws {
         if publicKey.isEmpty || sessionKey.isEmpty || sessionKey.components(separatedBy: ":").count != 2 {
             logger.info("Encryption not set, no public key or session, ignored")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.12",
+  "version": "8.51.14",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",