@onekeyfe/react-native-app-update 3.0.67 → 3.0.69

package/android/build.gradle

@@ -153,4 +153,9 @@ dependencies {
 
   // MMKV for reading DevSettings (compileOnly: provided by the host app via react-native-mmkv)
   compileOnly "io.github.zhongwuzw:mmkv:2.2.4"
+
+  // Pure-logic unit tests (AppUpdateLogic) run on the local JVM via
+  // :onekeyfe_react-native-app-update:testDebugUnitTest. No Robolectric: the
+  // extracted logic is dependency-free (no Context / Nitro / OkHttp).
+  testImplementation "junit:junit:4.13.2"
 }

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/AppUpdateLogic.kt

@@ -0,0 +1,85 @@
+package com.margelo.nitro.reactnativeappupdate
+
+/**
+ * Dependency-free pure logic extracted from ReactNativeAppUpdate.
+ *
+ * This object intentionally pulls in NO Android / Nitro / OkHttp / File-I/O
+ * dependencies: it holds only constants and pure string-derivation helpers so
+ * the values can be unit-tested under plain JVM JUnit (the adapter itself
+ * cannot, because it needs a live Context / FileProvider / network).
+ */
+object AppUpdateLogic {
+    // Must match ConcurrentRangeDownloader's default segmentCount: the
+    // concurrent downloader writes sibling segment files
+    // "<partial>.seg0".."<partial>.seg${N-1}", and Phase 2 below scans this
+    // range to detect an in-flight concurrent download.
+    const val CONCURRENT_SEGMENT_COUNT = 8
+
+    /**
+     * Derive the sibling segment-file name the concurrent downloader writes for
+     * a given partial path and segment index, i.e. "<partial>.seg<index>".
+     * This MUST match exactly what ConcurrentRangeDownloader writes.
+     */
+    fun segmentFileName(partialFilePath: String, index: Int): String =
+        "$partialFilePath.seg$index"
+
+    /**
+     * All [CONCURRENT_SEGMENT_COUNT] segment-file names for a given partial
+     * path, ordered seg0..seg${N-1}.
+     */
+    fun segmentFileNames(partialFilePath: String): List<String> =
+        (0 until CONCURRENT_SEGMENT_COUNT).map { segmentFileName(partialFilePath, it) }
+
+    /**
+     * Parse the total size out of a 416 (Range Not Satisfiable)
+     * `Content-Range: bytes * /<total>` header. Returns null when the header is
+     * absent or is not the "unsatisfiable range" form (e.g. a normal
+     * `bytes start-end/total`).
+     *
+     * Regex body copied VERBATIM from ReactNativeAppUpdate.downloadAPK (the 416
+     * branch); wrapped here with no behavior change so the parse step is pure
+     * and unit-testable. The adapter's `total == partialBytes` comparison stays
+     * in the adapter (it needs runtime `partialBytes`); see [is416Complete].
+     */
+    fun parse416Total(contentRange: String?): Long? =
+        contentRange
+            ?.let { Regex("""bytes\s+\*\s*/\s*(\d+)""").find(it)?.groupValues?.getOrNull(1)?.toLongOrNull() }
+
+    /**
+     * Parse a 206 `Content-Range: bytes start-end/total` header into
+     * (start, end, total). `total` is null when the server sends `*`
+     * (unknown total). Returns null when the header is absent or malformed.
+     *
+     * `rangeRegex` body copied VERBATIM from ReactNativeAppUpdate.downloadAPK
+     * (the 206 sanity-check). The adapter's `start != partialBytes`
+     * CDN-misalignment guard stays in the adapter; see [is206StartAligned].
+     */
+    fun parse206ContentRange(contentRange: String?): Triple<Long?, Long?, Long?>? {
+        val match = contentRange
+            ?.let { Regex("""bytes\s+(\d+)\s*-\s*(\d+)\s*/\s*(\d+|\*)""").find(it) }
+            ?: return null
+        val start = match.groupValues.getOrNull(1)?.toLongOrNull()
+        val end = match.groupValues.getOrNull(2)?.toLongOrNull()
+        // group 3 is either digits or literal "*"; "*" → unknown total → null.
+        val total = match.groupValues.getOrNull(3)?.toLongOrNull()
+        return Triple(start, end, total)
+    }
+
+    /**
+     * 416 recovery predicate: the server-reported total exactly equals the
+     * bytes we already have on disk, meaning our `.partial` IS the whole APK
+     * and just needs verify + rename rather than a wipe. Pure mirror of the
+     * adapter's `totalFromHeader != null && totalFromHeader == partialBytes`.
+     */
+    fun is416Complete(total: Long?, partialBytes: Long): Boolean =
+        total != null && total == partialBytes
+
+    /**
+     * 206 start-alignment guard: the server's body starts exactly where we
+     * asked it to resume from. When false (CDN/proxy rewrote the range), the
+     * 206 body is a mis-aligned slice and must NOT be appended. Pure mirror of
+     * the adapter's `rangeStart != null && rangeStart == partialBytes` check.
+     */
+    fun is206StartAligned(start: Long?, partialBytes: Long): Boolean =
+        start != null && start == partialBytes
+}

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/ReactNativeAppUpdate.kt

@@ -46,16 +46,23 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
         private const val CHANNEL_ID = "updateApp"
         private const val NOTIFICATION_ID = 1
 
-        // Must match ConcurrentRangeDownloader's default segmentCount: the
-        // concurrent downloader writes sibling segment files
-        // "<partial>.seg0".."<partial>.seg${N-1}", and Phase 2 below scans this
-        // range to detect an in-flight concurrent download.
-        private const val CONCURRENT_SEGMENT_COUNT = 8
+        // Segment-count + segment-file naming live in AppUpdateLogic (pure,
+        // unit-testable). The concurrent downloader writes sibling segment
+        // files "<partial>.seg0".."<partial>.seg${N-1}", and Phase 2 below
+        // scans this range to detect an in-flight concurrent download.
+        private const val CONCURRENT_SEGMENT_COUNT = AppUpdateLogic.CONCURRENT_SEGMENT_COUNT
     }
 
     private val listeners = CopyOnWriteArrayList<Listener>()
     private val nextListenerId = AtomicLong(1)
     private val isDownloading = AtomicBoolean(false)
+    // The in-flight concurrent download's cancel handle, so clearCache can stop
+    // its workers (shutdownNow + awaitTermination) BEFORE deleting .segN files.
+    // Without this a still-running worker resurrects a just-deleted segment / writes
+    // to a deleted FD — the cancel-then-delete race OCDS §5.8 forbids. Mirrors
+    // react-native-bundle-update's activeDownloads cancel wiring.
+    private val activeDownload =
+        java.util.concurrent.atomic.AtomicReference<ConcurrentRangeDownloader.CancelHandle?>(null)
     // downloadThread removed: downloads use coroutine-based Promise.async, not raw threads
 
     private fun sendEvent(type: String, progress: Int = 0, message: String = "") {
@@ -289,9 +296,22 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 OneKeyLog.warn("AppUpdate", "verifyExistingApk: SHA256 mismatch, expected=${expectedSha256.take(16)}..., got=${actualSha256.take(16)}...")
                 ApkVerifyOutcome.HashMismatch
             }
-        } catch (e: Exception) {
-            OneKeyLog.warn("AppUpdate", "verifyExistingApk: unexpected failure: ${e.javaClass.simpleName}: ${e.message}")
+        } catch (e: java.io.IOException) {
+            // Offline / disk-I/O transient (ASC fetch or APK read): we genuinely
+            // cannot decide validity right now, so preserve the bytes and defer to
+            // the next online retry (Indeterminate → caller rolls back to .partial).
+            OneKeyLog.warn("AppUpdate", "verifyExistingApk: transient I/O failure, indeterminate: ${e.javaClass.simpleName}: ${e.message}")
             ApkVerifyOutcome.Indeterminate
+        } catch (e: Exception) {
+            // A non-I/O failure (corrupt local state, path/security rejection,
+            // runtime fault) is NOT a "can't tell because offline" case — it is a
+            // genuine local error. Do NOT collapse it into a benign Deferred verify:
+            // downloadAPK's catch suppresses ApkVerificationDeferredException from
+            // `update/error`, which would silently hide this real failure and keep
+            // retrying a permanently-bad file until the JS budget is spent. Rethrow
+            // so it surfaces to the caller as an error.
+            OneKeyLog.error("AppUpdate", "verifyExistingApk: non-I/O failure, surfacing: ${e.javaClass.simpleName}: ${e.message}")
+            throw e
         }
     }
 
@@ -440,6 +460,9 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 throw Exception("Download already in progress")
             }
 
+            // Hoisted so the catch can tell an intentional clearCache-cancel from a
+            // real failure (a cancel must NOT surface as an `update/error`).
+            var cancelHandle: ConcurrentRangeDownloader.CancelHandle? = null
             try {
                 val url = params.downloadUrl
                 val filePath = filePathFromUrl(url)
@@ -510,7 +533,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                             // concurrent run could otherwise be picked up below and reused —
                             // wipe them so this restarts cleanly from byte zero.
                             if (partialFile.exists()) partialFile.delete()
-                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                         }
                         expectedSize > 0 && existingSize < expectedSize -> {
                             OneKeyLog.info("AppUpdate", "downloadAPK: existing APK smaller than expected, promoting to .partial for resume")
@@ -522,7 +545,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                             // concat committed-cursor, risking a mixed file. With no .segN,
                             // Phase 2 takes the single-stream size-based path and Range-resumes
                             // from the partial's length.
-                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                             if (!downloadedFile.renameTo(partialFile)) {
                                 OneKeyLog.warn("AppUpdate", "downloadAPK: rename to .partial failed, deleting stale final")
                                 downloadedFile.delete()
@@ -542,7 +565,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                                     // Final was stale → start from byte zero. Wipe any
                                     // sibling .segN left by an earlier concurrent run so
                                     // it can't be mistaken for trustworthy in-flight bytes.
-                                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                                 }
                                 ApkVerifyOutcome.Indeterminate -> {
                                     // ASC could not be fetched (offline) or could
@@ -573,7 +596,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 // path must match exactly what ConcurrentRangeDownloader writes:
                 // File("$partialFilePath.seg$i").
                 val hasConcurrentSegments =
-                    (0 until CONCURRENT_SEGMENT_COUNT).any { buildFile("$partialFilePath.seg$it").exists() }
+                    (0 until CONCURRENT_SEGMENT_COUNT).any { buildFile(AppUpdateLogic.segmentFileName(partialFilePath, it)).exists() }
                 var partialBytes = 0L
                 if (partialFile.exists() && !hasConcurrentSegments) {
                     val partialSize = partialFile.length()
@@ -608,7 +631,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                             OneKeyLog.warn("AppUpdate", "downloadAPK: stale partial (>expected $partialSize/$expectedSize), discarding")
                             partialFile.delete()
                             // Partial bytes are untrustworthy → restart from zero; drop any sibling .segN too.
-                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                         }
                         partialSize > 0 -> {
                             partialBytes = partialSize
@@ -643,6 +666,10 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     // the thread that actually moved the percent forward proceeds.
                     val concurrentProgress = AtomicInteger(-1)
                     val notifyLock = Any()
+                    // Wire a cancel handle so clearCache can stop these workers
+                    // before deleting .segN (OCDS §5.8). Cleared in the finally below.
+                    cancelHandle = ConcurrentRangeDownloader.CancelHandle()
+                    activeDownload.set(cancelHandle)
                     val concurrentOutcome = ConcurrentRangeDownloader(
                         httpClient = concurrentClient,
                         log = { msg -> OneKeyLog.info("AppUpdate", msg) },
@@ -653,7 +680,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                         // files to the read-only root fs → EROFS. Resolve it to
                         // the real apks dir (filesDir/apks) first, exactly like
                         // react-native-bundle-update passes an absolute path.
-                    ).download(url, partialFile.absolutePath) { transferred, total ->
+                    ).download(url, partialFile.absolutePath, cancelHandle) { transferred, total ->
                         if (total > 0) {
                             val p = ((transferred * 100) / total).toInt().coerceIn(0, 100)
                             // Only the thread that advances the percent emits; a
@@ -724,9 +751,8 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 if (response.code == 416) {
                     val contentRange = response.header("Content-Range")
                     response.close()
-                    val totalFromHeader = contentRange
-                        ?.let { Regex("""bytes\s+\*\s*/\s*(\d+)""").find(it)?.groupValues?.getOrNull(1)?.toLongOrNull() }
-                    if (totalFromHeader != null && totalFromHeader == partialBytes && partialFile.exists()) {
+                    val totalFromHeader = AppUpdateLogic.parse416Total(contentRange)
+                    if (AppUpdateLogic.is416Complete(totalFromHeader, partialBytes) && partialFile.exists()) {
                         OneKeyLog.info("AppUpdate", "downloadAPK: HTTP 416 with total=$totalFromHeader matches partial, attempting promote+verify")
                         when (tryPromoteAndVerify(url, filePath, partialFile, downloadedFile)) {
                             PromoteOutcome.Valid -> {
@@ -743,7 +769,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                                 OneKeyLog.warn("AppUpdate", "downloadAPK: 416 recovery hash mismatch — server build changed mid-download")
                                 if (partialFile.exists()) partialFile.delete()
                                 // Server build changed → these bytes are worthless; drop sibling .segN too.
-                                for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                                for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                                 throw java.io.IOException("Server build changed mid-download (size matches but hash differs)")
                             }
                             PromoteOutcome.Deferred -> {
@@ -761,7 +787,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     OneKeyLog.warn("AppUpdate", "downloadAPK: HTTP 416 (range not satisfiable), discarding partial and failing attempt")
                     if (partialFile.exists()) partialFile.delete()
                     // Partial discarded as unusable → drop sibling .segN too so the next attempt starts clean.
-                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                     throw Exception("HTTP 416 (range not satisfiable)")
                 }
 
@@ -781,7 +807,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     OneKeyLog.warn("AppUpdate", "downloadAPK: requested Range but server returned 200, restarting from scratch")
                     if (partialFile.exists()) partialFile.delete()
                     // Restarting from byte zero → drop any sibling .segN too.
-                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                     partialBytes = 0L
                 }
 
@@ -791,13 +817,14 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 // be appending mis-aligned bytes and only catching it later
                 // at the SHA step — with the partial now corrupted. Demote to
                 // a full restart instead.
-                val rangeRegex = Regex("""bytes\s+(\d+)\s*-\s*(\d+)\s*/\s*(\d+|\*)""")
-                val rangeMatch = if (serverWillResume) {
-                    response.header("Content-Range")?.let { rangeRegex.find(it) }
+                // Parse the 206 Content-Range via the unit-tested helper (was an
+                // inline duplicate of AppUpdateLogic.parse206ContentRange's regex).
+                val parsed206 = if (serverWillResume) {
+                    AppUpdateLogic.parse206ContentRange(response.header("Content-Range"))
                 } else null
                 if (serverWillResume) {
-                    val rangeStart = rangeMatch?.groupValues?.getOrNull(1)?.toLongOrNull()
-                    if (rangeStart == null || rangeStart != partialBytes) {
+                    val rangeStart = parsed206?.first
+                    if (!AppUpdateLogic.is206StartAligned(rangeStart, partialBytes)) {
                         // This 206 body is a slice starting at the wrong offset (CDN bug /
                         // proxy rewrite). It is NOT a full file, so we must not consume it as
                         // one — doing so would write mis-aligned bytes (caught only later at
@@ -809,7 +836,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                         val contentRangeHeader = response.header("Content-Range")
                         OneKeyLog.warn("AppUpdate", "downloadAPK: 206 Content-Range start mismatch (header='$contentRangeHeader', requested=$partialBytes); discarding partial and retrying from scratch")
                         if (partialFile.exists()) partialFile.delete()
-                        for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                        for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile(AppUpdateLogic.segmentFileName(partialFilePath, i)).delete()
                         response.close()
                         throw java.io.IOException("206 Content-Range start mismatch (header='$contentRangeHeader', requested=$partialBytes); discarded partial, retry from scratch")
                     }
@@ -821,7 +848,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 }
                 val contentLength = body.contentLength()
                 val totalSize: Long = if (serverWillResume) {
-                    val parsedTotal = rangeMatch?.groupValues?.getOrNull(3)?.toLongOrNull()
+                    val parsedTotal = parsed206?.third
                     parsedTotal ?: (partialBytes + contentLength.coerceAtLeast(0L))
                 } else {
                     if (contentLength > 0) contentLength else expectedSize
@@ -898,10 +925,37 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     notifyManager.notify(NOTIFICATION_ID, builder.build())
                 }
             } catch (e: Exception) {
-                OneKeyLog.error("AppUpdate", "downloadAPK: failed: ${e.javaClass.simpleName}: ${e.message}")
-                sendEvent("update/error", message = "${e.javaClass.simpleName}: ${e.message}")
+                // Two conditions reach this catch that are NOT download failures and
+                // must therefore be suppressed from `update/error`:
+                //
+                //   1. A clearCache/clearApkCache cancel aborts the core workers,
+                //      which surfaces here as an exception — intentional, not a
+                //      failure (mirrors react-native-bundle-update).
+                //   2. A deferred verification (ApkVerificationDeferredException):
+                //      the detached ASC was temporarily unreachable, so we couldn't
+                //      decide whether the on-disk bytes are still the right APK. The
+                //      bytes are preserved (rolled back to .partial) for the next
+                //      online retry; this is a "retry later", not a download error.
+                //      Detect it by TYPE, never by message string — the message is a
+                //      constant today but type-matching can't silently rot.
+                //
+                // Both still rethrow so the JS Promise rejects (the caller learns the
+                // attempt didn't complete); only the spurious `update/error` event is
+                // withheld. For the deferred case we also downgrade the log to info so
+                // logs don't read like a failure.
+                val intentionallyCancelled = cancelHandle?.aborted?.get() == true
+                val verificationDeferred = e is ApkVerificationDeferredException
+                if (verificationDeferred) {
+                    OneKeyLog.info("AppUpdate", "downloadAPK: verification deferred (ASC unavailable); bytes preserved for next online retry: ${e.message}")
+                } else {
+                    OneKeyLog.error("AppUpdate", "downloadAPK: failed: ${e.javaClass.simpleName}: ${e.message}")
+                }
+                if (!intentionallyCancelled && !verificationDeferred) {
+                    sendEvent("update/error", message = "${e.javaClass.simpleName}: ${e.message}")
+                }
                 throw e
             } finally {
+                activeDownload.set(null)
                 isDownloading.set(false)
             }
         }
@@ -1089,7 +1143,18 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 OneKeyLog.info("AppUpdate", "verifyAPK: package name matches installed app")
             }
 
-            // Verify APK signing certificate matches the installed app
+            // Verify APK signing certificate matches the installed app.
+            //
+            // This cross-check is defense-in-depth ONLY: by the time verifyAPK
+            // runs, verifyASC has already proven the bytes on disk are the
+            // authentic OneKey APK via GPG + SHA-256, and Android's own
+            // PackageInstaller re-verifies the signing certificate at install
+            // time. So a genuine MISMATCH is still hard-failed, but when the
+            // platform can't read the archive's signers (null) we just log it
+            // and silently skip — on some OEM ROMs (Huawei/EMUI Android 9–10)
+            // and for large APKs getPackageArchiveInfo returns null signers
+            // even for a perfectly valid APK, and blocking on that bricks the
+            // update for those users.
             OneKeyLog.info("AppUpdate", "verifyAPK: verifying APK signing certificate (API level=${Build.VERSION.SDK_INT})...")
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
                 val apkInfo = pm.getPackageArchiveInfo(file.absolutePath, PackageManager.GET_SIGNING_CERTIFICATES)
@@ -1097,9 +1162,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 val apkSigners = apkInfo?.signingInfo?.apkContentsSigners
                 val installedSigners = installedInfo?.signingInfo?.apkContentsSigners
                 if (apkSigners == null || installedSigners == null) {
-                    OneKeyLog.error("AppUpdate", "verifyAPK: signing info unavailable (apkSigners=${apkSigners != null}, installedSigners=${installedSigners != null})")
-                    if (!debugBuild) throw Exception("SIGNATURE_UNAVAILABLE")
-                    OneKeyLog.warn("AppUpdate", "verifyAPK: DEBUG build — ignoring unavailable signatures")
+                    OneKeyLog.info("AppUpdate", "verifyAPK: signing info unavailable (apkSigners=${apkSigners != null}, installedSigners=${installedSigners != null}), skipping signing certificate check")
                 } else {
                     OneKeyLog.info("AppUpdate", "verifyAPK: APK signers count=${apkSigners.size}, installed signers count=${installedSigners.size}")
                     if (apkSigners.toSet() != installedSigners.toSet()) {
@@ -1118,9 +1181,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 val apkSignatures = apkInfo?.signatures
                 val installedSignatures = installedInfo?.signatures
                 if (apkSignatures == null || installedSignatures == null) {
-                    OneKeyLog.error("AppUpdate", "verifyAPK: legacy signatures unavailable")
-                    if (!debugBuild) throw Exception("SIGNATURE_UNAVAILABLE")
-                    OneKeyLog.warn("AppUpdate", "verifyAPK: DEBUG build — ignoring unavailable signatures")
+                    OneKeyLog.info("AppUpdate", "verifyAPK: legacy signatures unavailable (apkSignatures=${apkSignatures != null}, installedSignatures=${installedSignatures != null}), skipping signing certificate check")
                 } else {
                     OneKeyLog.info("AppUpdate", "verifyAPK: APK signatures count=${apkSignatures.size}, installed signatures count=${installedSignatures.size}")
                     if (apkSignatures.toSet() != installedSignatures.toSet()) {
@@ -1270,6 +1331,15 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
      * log lines so the two callers stay distinguishable in logcat.
      */
     private fun wipeApkCacheFiles(tag: String, protectedPaths: Set<String> = emptySet()) {
+        // OCDS §5.8: stop any in-flight concurrent download (shutdownNow +
+        // awaitTermination) BEFORE deleting its .segN, so a still-running worker
+        // cannot resurrect a just-deleted segment or write to a deleted FD. Only
+        // the two external cleanup paths (clearCache / clearApkCache) call this;
+        // it is never invoked mid-download.
+        activeDownload.getAndSet(null)?.let {
+            OneKeyLog.info("AppUpdate", "$tag: cancelling in-flight download before wipe")
+            it.cancel()
+        }
         val context = NitroModules.applicationContext
         if (context == null) {
             OneKeyLog.warn("AppUpdate", "$tag: application context unavailable, skipping file cleanup")

package/android/src/test/java/com/margelo/nitro/reactnativeappupdate/AppUpdateContentRangeTest.kt

@@ -0,0 +1,164 @@
+package com.margelo.nitro.reactnativeappupdate
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Pure-JVM coverage for the "Content-Range / 416 header parsing" unit extracted
+ * out of ReactNativeAppUpdate.downloadAPK into [AppUpdateLogic].
+ *
+ * These exercise the REAL extracted code (regex literals copied character-for-
+ * character from the adapter — the 416 `bytes * /<total>` branch and the 206
+ * `bytes start-end/total` sanity check), never a re-implementation. The adapter
+ * keeps all File I/O / response.close / throw; only the pure string-parse and
+ * the two comparison predicates moved here, so this guards the parse step is
+ * byte-identical and the CDN-misalignment / 416-complete guards stay total.
+ */
+class AppUpdateContentRangeTest {
+
+  // ---------------------------------------------------------------------------
+  // parse416Total — `Content-Range: bytes * /<total>` (the 416 branch, line 742)
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun parse416Total_extractsTotalFromUnsatisfiableRange() {
+    assertEquals(12345L, AppUpdateLogic.parse416Total("bytes */12345"))
+  }
+
+  @Test
+  fun parse416Total_isTolerantOfWhitespaceAroundStarAndSlash() {
+    // The verbatim regex is `bytes\s+\*\s*/\s*(\d+)`, so spaces around `*` and
+    // `/` are all allowed.
+    assertEquals(99L, AppUpdateLogic.parse416Total("bytes * / 99"))
+    assertEquals(99L, AppUpdateLogic.parse416Total("bytes  *  /99"))
+  }
+
+  @Test
+  fun parse416Total_rejectsNormalContentRange() {
+    // A satisfiable `bytes 0-1/2` is NOT the unsatisfiable form → no total.
+    assertNull(AppUpdateLogic.parse416Total("bytes 0-1/2"))
+    assertNull(AppUpdateLogic.parse416Total("bytes 100-199/500"))
+  }
+
+  @Test
+  fun parse416Total_nullAndGarbageYieldNull() {
+    assertNull(AppUpdateLogic.parse416Total(null))
+    assertNull(AppUpdateLogic.parse416Total(""))
+    assertNull(AppUpdateLogic.parse416Total("garbage"))
+    assertNull(AppUpdateLogic.parse416Total("bytes */")) // no digits after slash
+  }
+
+  // ---------------------------------------------------------------------------
+  // parse206ContentRange — `bytes start-end/total` (the 206 sanity check, l.808)
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun parse206ContentRange_parsesStartEndTotal() {
+    assertEquals(
+      Triple(100L, 199L, 500L),
+      AppUpdateLogic.parse206ContentRange("bytes 100-199/500"),
+    )
+  }
+
+  @Test
+  fun parse206ContentRange_starTotalYieldsNullTotal() {
+    // `total` is `*` (server doesn't know the full length) → total parses null,
+    // but start/end are still recovered.
+    assertEquals(
+      Triple(0L, 99L, null),
+      AppUpdateLogic.parse206ContentRange("bytes 0-99/*"),
+    )
+  }
+
+  @Test
+  fun parse206ContentRange_isTolerantOfWhitespace() {
+    // Verbatim regex `bytes\s+(\d+)\s*-\s*(\d+)\s*/\s*(\d+|\*)`.
+    assertEquals(
+      Triple(100L, 199L, 500L),
+      AppUpdateLogic.parse206ContentRange("bytes  100 - 199 / 500"),
+    )
+  }
+
+  @Test
+  fun parse206ContentRange_garbageAndNullYieldNull() {
+    assertNull(AppUpdateLogic.parse206ContentRange("garbage"))
+    assertNull(AppUpdateLogic.parse206ContentRange(null))
+    assertNull(AppUpdateLogic.parse206ContentRange(""))
+    // The 416 unsatisfiable form is not a valid 206 range → no match.
+    assertNull(AppUpdateLogic.parse206ContentRange("bytes */12345"))
+  }
+
+  // ---------------------------------------------------------------------------
+  // is416Complete — the 416-recovery predicate (adapter comparison, line 743)
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun is416Complete_trueOnlyWhenTotalEqualsPartial() {
+    // Server says the whole APK is exactly what we already have → recover, don't wipe.
+    assertTrue(AppUpdateLogic.is416Complete(99L, 99L))
+    // Sizes differ → partial is stale/corrupt → not complete.
+    assertFalse(AppUpdateLogic.is416Complete(99L, 50L))
+    assertFalse(AppUpdateLogic.is416Complete(50L, 99L))
+    // No parseable total → cannot claim completeness.
+    assertFalse(AppUpdateLogic.is416Complete(null, 0L))
+    assertFalse(AppUpdateLogic.is416Complete(null, 99L))
+  }
+
+  // ---------------------------------------------------------------------------
+  // is206StartAligned — the CDN-misalignment guard (adapter check, lines 814)
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun is206StartAligned_trueOnlyWhenStartEqualsPartial() {
+    // 206 body starts exactly where we asked to resume → safe to append.
+    assertTrue(AppUpdateLogic.is206StartAligned(100L, 100L))
+    // Start != requested offset (CDN/proxy rewrote the range) → mis-aligned slice.
+    assertFalse(AppUpdateLogic.is206StartAligned(100L, 50L))
+    assertFalse(AppUpdateLogic.is206StartAligned(50L, 100L))
+    // Missing/unparseable start → demote to full restart, never append.
+    assertFalse(AppUpdateLogic.is206StartAligned(null, 0L))
+    assertFalse(AppUpdateLogic.is206StartAligned(null, 100L))
+  }
+
+  // ---------------------------------------------------------------------------
+  // End-to-end: parse → predicate, mirroring how the adapter chains them.
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun parse416ThenIs416Complete_matchesAdapterRecoveryDecision() {
+    // (a) total == partialBytes → recover.
+    val total = AppUpdateLogic.parse416Total("bytes */2048")
+    assertTrue(AppUpdateLogic.is416Complete(total, 2048L))
+    // (b) anything else → wipe.
+    assertFalse(AppUpdateLogic.is416Complete(total, 1024L))
+  }
+
+  @Test
+  fun parse206ThenIs206StartAligned_matchesAdapterStartCheck() {
+    val (start, _, _) = AppUpdateLogic.parse206ContentRange("bytes 4096-8191/8192")!!
+    assertTrue(AppUpdateLogic.is206StartAligned(start, 4096L))
+    assertFalse(AppUpdateLogic.is206StartAligned(start, 0L))
+  }
+
+  // ---------------------------------------------------------------------------
+  // Sibling-segment invariant: segmentCount == 8 (the concurrent downloader's
+  // default that the 416/206 cleanup loops scan). Asserted over the REAL const.
+  // ---------------------------------------------------------------------------
+
+  @Test
+  fun concurrentSegmentCountIsEight() {
+    assertEquals(8, AppUpdateLogic.CONCURRENT_SEGMENT_COUNT)
+    assertEquals(8, AppUpdateLogic.segmentFileNames("/tmp/app.apk.partial").size)
+    assertEquals(
+      "/tmp/app.apk.partial.seg0",
+      AppUpdateLogic.segmentFileNames("/tmp/app.apk.partial").first(),
+    )
+    assertEquals(
+      "/tmp/app.apk.partial.seg7",
+      AppUpdateLogic.segmentFileNames("/tmp/app.apk.partial").last(),
+    )
+  }
+}

package/android/src/test/java/com/margelo/nitro/reactnativeappupdate/AppUpdateLogicSegmentTest.kt

@@ -0,0 +1,88 @@
+package com.margelo.nitro.reactnativeappupdate
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Pin tests for the extracted pure unit:
+ *   "CONCURRENT_SEGMENT_COUNT constant (segment-count + segment-path derivation)".
+ *
+ * These assert directly against the REAL extracted code in [AppUpdateLogic]
+ * (never a re-implementation): the byte-identical-move constant and the
+ * faithful capture of the inlined "<partial>.seg<i>" string template that the
+ * adapter previously duplicated across 6 sites.
+ */
+class AppUpdateLogicSegmentTest {
+
+  /**
+   * Pins the must-equal-core-default invariant.
+   *
+   * COUPLING NOTE: [AppUpdateLogic.CONCURRENT_SEGMENT_COUNT] must equal the
+   * shared `ConcurrentRangeDownloader`'s default `segmentCount = 8`. That core
+   * default is a PRIVATE constructor parameter default, not a public constant,
+   * so this test cannot reference it directly — it can only pin the documented
+   * magic number 8. If the core default ever changes, this hard-coded 8 is the
+   * tripwire that forces a human to re-sync both sides (otherwise the Phase-2
+   * scan would miss in-flight segment files written past index 7, or scan a
+   * dead range).
+   */
+  @Test
+  fun concurrentSegmentCountEqualsCoreDefaultEight() {
+    assertEquals(8, AppUpdateLogic.CONCURRENT_SEGMENT_COUNT)
+  }
+
+  /** segmentFileName is the verbatim "<partial>.seg<index>" template. */
+  @Test
+  fun segmentFileNameAppendsDotSegIndex() {
+    assertEquals(
+      "x.apk.partial.seg0",
+      AppUpdateLogic.segmentFileName("x.apk.partial", 0),
+    )
+    assertEquals(
+      "x.apk.partial.seg7",
+      AppUpdateLogic.segmentFileName("x.apk.partial", 7),
+    )
+    // The helper is a dumb string template: it does not validate the index, so
+    // any integer flows straight through (mirrors the inlined call sites).
+    assertEquals(
+      "x.apk.partial.seg42",
+      AppUpdateLogic.segmentFileName("x.apk.partial", 42),
+    )
+  }
+
+  /** segmentFileNames returns exactly CONCURRENT_SEGMENT_COUNT names, seg0..seg7. */
+  @Test
+  fun segmentFileNamesYieldsEightOrderedNamesSeg0ToSeg7() {
+    val names = AppUpdateLogic.segmentFileNames("x.apk.partial")
+
+    assertEquals(AppUpdateLogic.CONCURRENT_SEGMENT_COUNT, names.size)
+    assertEquals(8, names.size)
+    assertEquals("x.apk.partial.seg0", names.first())
+    assertEquals("x.apk.partial.seg7", names.last())
+  }
+
+  /**
+   * The generated names are distinct and strictly ordered seg0..seg${N-1},
+   * each equal to the single-name helper for the same index. This guards the
+   * Phase-2 scan range: a duplicate or out-of-order name would make the
+   * in-flight-download detection scan the wrong sibling files.
+   */
+  @Test
+  fun segmentFileNamesAreDistinctAndOrderedAndMatchSingleHelper() {
+    val partial = "/data/user/0/app/files/update.apk.partial"
+    val names = AppUpdateLogic.segmentFileNames(partial)
+
+    // distinct
+    assertEquals(names.size, names.toSet().size)
+
+    // ordered seg0..seg${N-1}, each consistent with segmentFileName(index)
+    for (i in 0 until AppUpdateLogic.CONCURRENT_SEGMENT_COUNT) {
+      assertEquals(AppUpdateLogic.segmentFileName(partial, i), names[i])
+      assertTrue(
+        "name at $i must end with .seg$i",
+        names[i].endsWith(".seg$i"),
+      )
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-app-update",
-  "version": "3.0.67",
+  "version": "3.0.69",
   "description": "react-native-app-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",