@onekeyfe/react-native-bundle-update 6.7.0-1 → 6.7.0-alpha.311

package/android/src/main/java/com/margelo/nitro/reactnativebundleupdate/ReactNativeBundleUpdate.kt

@@ -15,11 +15,13 @@ import okhttp3.Request
 import java.io.File
 import java.io.FileInputStream
 import java.io.FileOutputStream
+import java.io.IOException
 import java.nio.file.Files
 import java.nio.file.Path
 import java.nio.file.Paths
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.CopyOnWriteArrayList
+import java.util.concurrent.CountDownLatch
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicInteger
 import java.util.concurrent.atomic.AtomicLong
@@ -33,6 +35,49 @@ private data class BundleListener(
     val callback: (BundleDownloadEvent) -> Unit
 )
 
+private class BundleUpdateError(
+    val code: String,
+    val step: String,
+    val httpStatus: Int? = null,
+) : Exception(buildString {
+    append("ONEKEY_UPDATE_ERROR:")
+    append(JSONObject().put("code", code).put("step", step).apply {
+        if (code == "HTTP_ERROR" && httpStatus != null && httpStatus in 100..599) {
+            put("httpStatus", httpStatus)
+        }
+    }.toString())
+}) {
+    override fun printStackTrace(writer: java.io.PrintWriter) { writer.print(message.orEmpty()) }
+    override fun printStackTrace(stream: java.io.PrintStream) { stream.print(message.orEmpty()) }
+}
+
+private fun bundleUpdateError(error: Exception, step: String): BundleUpdateError {
+    if (error is BundleUpdateError) {
+        return if (error.step == step) error else BundleUpdateError(error.code, step, error.httpStatus)
+    }
+    val code = when (error) {
+        is ConcurrentRangeDownloader.PermanentHttpException,
+        is ConcurrentRangeDownloader.TransientHttpException -> "HTTP_ERROR"
+        is java.net.SocketTimeoutException -> "TIMEOUT"
+        is java.net.UnknownHostException,
+        is java.net.ConnectException,
+        is java.net.ProtocolException,
+        is java.net.SocketException -> "NETWORK_ERROR"
+        is javax.net.ssl.SSLException -> "SECURITY_REJECTED"
+        is java.io.FileNotFoundException,
+        is java.nio.file.AccessDeniedException -> "STORAGE_ERROR"
+        is IllegalArgumentException -> "INVALID_ARGUMENT"
+        is SecurityException -> "SECURITY_REJECTED"
+        else -> "UNKNOWN"
+    }
+    val status = when (error) {
+        is ConcurrentRangeDownloader.PermanentHttpException -> error.code
+        is ConcurrentRangeDownloader.TransientHttpException -> error.code
+        else -> null
+    }
+    return BundleUpdateError(code, step, status)
+}
+
 // Public static store for CustomReactNativeHost access (called before JS starts)
 object BundleUpdateStoreAndroid {
     private const val PREFS_NAME = "BundleUpdatePrefs"
@@ -162,6 +207,7 @@ object BundleUpdateStoreAndroid {
     }
 
     fun clearUpdateBundleData(context: Context) {
+        didProcessPreLaunchTask = true
         invalidateValidatedBundleInfoCache()
         val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
         prefs.edit().clear().commit()
@@ -249,6 +295,16 @@ object BundleUpdateStoreAndroid {
      * Only handles the happy path (status=pending, bundle exists, env matches).
      * All complex logic (retry, download, error handling) remains in JS layer.
      */
+    private fun failPendingTask(mmkv: MMKV, taskObj: JSONObject, reason: String) {
+        try {
+            taskObj.put("status", "failed")
+            taskObj.put("lastError", reason)
+            mmkv.encode("onekey_pending_install_task", taskObj.toString())
+        } catch (e: Exception) {
+            OneKeyLog.warn("BundleUpdate", "processPreLaunchPendingTask: failed to update MMKV task failure: ${e.message}")
+        }
+    }
+
     fun processPreLaunchPendingTask(context: Context) {
         if (didProcessPreLaunchTask) return
         didProcessPreLaunchTask = true
@@ -282,11 +338,8 @@ object BundleUpdateStoreAndroid {
 
             val currentBV = getCurrentBundleVersion(context)
             val currentBundleVersionStr = if (currentBV != null) {
-                val idx = currentBV.lastIndexOf("-")
-                if (idx > 0) currentBV.substring(idx + 1) else getBuiltinBundleVersion(context)
-            } else {
-                getBuiltinBundleVersion(context)
-            }
+                bundleVersionInFolder(currentBV, currentAppVersion) ?: return
+            } else getBuiltinBundleVersion(context)
             if (taskObj.optString("scheduledEnvBundleVersion") != currentBundleVersionStr) return
 
             // 4. Extract payload
@@ -295,20 +348,67 @@ object BundleUpdateStoreAndroid {
             val bundleVersion = payload.optString("bundleVersion")
             val signature = payload.optString("signature")
             if (appVersion.isEmpty() || bundleVersion.isEmpty() || signature.isEmpty()) return
-            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) return
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Invalid version string")
+                return
+            }
+            if (appVersion != currentAppVersion) {
+                OneKeyLog.warn("BundleUpdate", "processPreLaunchPendingTask: target appVersion ($appVersion) != currentAppVersion ($currentAppVersion)")
+                failPendingTask(mmkv, taskObj, "ERR_ENV_CHANGED:Target appVersion mismatch")
+                return
+            }
 
-            // 5. Verify bundle directory and entry file exist
+            // 5. Verify bundle directory, canonical path confinement, and required files
             val folderName = "$appVersion-$bundleVersion"
+            val baseBundleDir = File(getBundleDir(context)).canonicalPath
             val bundleDirPath = File(getBundleDir(context), folderName)
+            if (Files.isSymbolicLink(bundleDirPath.toPath()) ||
+                !bundleDirPath.canonicalPath.startsWith(baseBundleDir + File.separator)
+            ) {
+                OneKeyLog.error("BundleUpdate", "processPreLaunchPendingTask: bundle path outside bundle directory: ${bundleDirPath.canonicalPath}")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Bundle path outside bundle directory")
+                return
+            }
+            val sigFile = File(getSignatureFilePath(context, folderName))
+            val baseAscDir = File(getAscDir(context)).canonicalPath
+            if (Files.isSymbolicLink(sigFile.toPath()) ||
+                !sigFile.canonicalPath.startsWith(baseAscDir + File.separator)
+            ) {
+                OneKeyLog.error("BundleUpdate", "processPreLaunchPendingTask: signature path outside asc directory: ${sigFile.canonicalPath}")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Signature path outside asc directory")
+                return
+            }
             if (!bundleDirPath.exists()) return
             val entryFile = File(bundleDirPath, "main.jsbundle.hbc")
-            if (!entryFile.exists()) {
-                OneKeyLog.warn("BundleUpdate", "processPreLaunchPendingTask: bundle dir exists but entry file missing: ${entryFile.absolutePath}")
+            val metadataFile = File(bundleDirPath, "metadata.json")
+            if (!entryFile.exists() || !metadataFile.exists()) {
+                OneKeyLog.warn("BundleUpdate", "processPreLaunchPendingTask: bundle dir exists but required files missing: ${bundleDirPath.absolutePath}")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Required bundle files missing")
                 return
             }
 
-            // 6. Apply (same as installBundle) — use commit() for synchronous writes
-            //    to ensure all prefs are persisted atomically before proceeding.
+            val skipGPG = BuildConfig.ALLOW_SKIP_GPG_VERIFICATION && isDevSettingsEnabled(context) && isSkipGPGEnabled(context)
+            if (!skipGPG && !validateMetadataFileSha256(context, folderName, signature, appVersion, bundleVersion)) {
+                OneKeyLog.error("BundleUpdate", "processPreLaunchPendingTask: GPG signature verification failed for $folderName")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Bundle signature verification failed")
+                return
+            }
+
+            val metadata = parseMetadataJson(readFileContent(metadataFile))
+            if (!validateEntryBundlesSha256(bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "processPreLaunchPendingTask: entry bundle SHA256 verification failed for $folderName")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Entry bundle SHA256 verification failed")
+                return
+            }
+            if (!validateBundlePairCompatibility(context, bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "processPreLaunchPendingTask: bundle pair compatibility check failed for $folderName")
+                failPendingTask(mmkv, taskObj, "ERR_VERIFY_FAILED:Bundle pair compatibility check failed")
+                return
+            }
+
+            // 6. Apply (same as installBundle) — write signature BEFORE flipping
+            //    currentBundleVersion, and use commit() for synchronous writes.
+            writeSignatureFile(context, folderName, signature)
             val bundlePrefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
             val versionPrefs = context.getSharedPreferences(NATIVE_VERSION_PREFS_NAME, Context.MODE_PRIVATE)
             val currentVersion = bundlePrefs.getString(CURRENT_BUNDLE_VERSION_KEY, "")
@@ -320,9 +420,6 @@ object BundleUpdateStoreAndroid {
                     }
                 }
                 .commit()
-            if (!signature.isNullOrEmpty()) {
-                writeSignatureFile(context, folderName, signature)
-            }
             versionPrefs.edit()
                 .putString("nativeVersion", currentAppVersion)
                 .putString("nativeBuildNumber", getBuildNumber(context))
@@ -470,11 +567,30 @@ object BundleUpdateStoreAndroid {
         return compatible
     }
 
-    fun readMetadataFileSha256(signature: String?): String? {
+    fun bundleVersionInFolder(folder: String, appVersion: String): String? {
+        if (!isSafeVersionString(appVersion)) return null
+        val prefix = "$appVersion-"
+        if (!folder.startsWith(prefix)) return null
+        val bundleVersion = folder.removePrefix(prefix)
+        return bundleVersion.takeIf { isSafeVersionString(it) }
+    }
+
+    @JvmOverloads
+    fun readMetadataFileSha256(
+        signature: String?,
+        expectedAppVersion: String? = null,
+        expectedBundleVersion: String? = null,
+        expectedAppType: String? = "android",
+    ): String? {
         if (signature.isNullOrEmpty()) return null
 
         // GPG cleartext signature verification is required
-        val gpgResult = verifyGPGAndExtractSha256(signature)
+        val gpgResult = verifyGPGAndExtractSha256(
+            signature,
+            expectedAppVersion = expectedAppVersion,
+            expectedBundleVersion = expectedBundleVersion,
+            expectedAppType = expectedAppType,
+        )
         if (gpgResult != null) return gpgResult
 
         OneKeyLog.error("BundleUpdate", "readMetadataFileSha256: GPG verification failed, rejecting unsigned content")
@@ -505,8 +621,19 @@ object BundleUpdateStoreAndroid {
      * (NOT_PGP_SIGNED_MESSAGE / INVALID_FORMAT / NO_SIGNATURE / PUBKEY_NOT_FOUND
      * / SIGNATURE_INVALID / NO_SHA256_FIELD / ERROR_*) maps to null.
      */
-    fun verifyGPGAndExtractSha256(signature: String): String? {
-        val result = BundleCryptoCore.verifyGpgCleartext(signature)
+    @JvmOverloads
+    fun verifyGPGAndExtractSha256(
+        signature: String,
+        expectedAppVersion: String? = null,
+        expectedBundleVersion: String? = null,
+        expectedAppType: String? = "android",
+    ): String? {
+        val result = BundleCryptoCore.verifyGpgCleartext(
+            signature,
+            expectedAppVersion = expectedAppVersion,
+            expectedBundleVersion = expectedBundleVersion,
+            expectedAppType = expectedAppType,
+        )
         if (!result.valid) {
             OneKeyLog.error("BundleUpdate", "GPG verification failed: ${result.reason}")
             return null
@@ -514,12 +641,19 @@ object BundleUpdateStoreAndroid {
         return result.sha256
     }
 
-    fun validateMetadataFileSha256(context: Context, currentBundleVersion: String, signature: String?): Boolean {
+    fun validateMetadataFileSha256(context: Context, currentBundleVersion: String, signature: String?, expectedAppVersion: String, expectedBundleVersion: String): Boolean {
         val metadataFilePath = getMetadataFilePath(context, currentBundleVersion) ?: run {
             OneKeyLog.debug("BundleUpdate", "metadataFilePath is null")
             return false
         }
-        val extractedSha256 = readMetadataFileSha256(signature)
+        if (!isSafeVersionString(expectedAppVersion) || !isSafeVersionString(expectedBundleVersion) ||
+            currentBundleVersion != "$expectedAppVersion-$expectedBundleVersion") return false
+        val extractedSha256 = readMetadataFileSha256(
+            signature,
+            expectedAppVersion = expectedAppVersion,
+            expectedBundleVersion = expectedBundleVersion,
+            expectedAppType = "android",
+        )
         if (extractedSha256.isNullOrEmpty()) return false
         val calculated = calculateSHA256(metadataFilePath) ?: return false
         return secureCompare(calculated, extractedSha256)
@@ -717,7 +851,7 @@ object BundleUpdateStoreAndroid {
     private fun getValidatedCurrentBundleInfo(context: Context): ValidatedBundleInfo? {
         processPreLaunchPendingTask(context)
         return try {
-            val currentAppVersion = getAppVersion(context)
+            val currentAppVersion = getAppVersion(context) ?: return null
             val currentBundleVersion = getCurrentBundleVersion(context) ?: run {
                 OneKeyLog.warn("BundleUpdate", "getJsBundlePath: no currentBundleVersion stored")
                 invalidateValidatedBundleInfoCache()
@@ -775,11 +909,12 @@ object BundleUpdateStoreAndroid {
             val signature = readSignatureFile(context, currentBundleVersion)
             OneKeyLog.debug("BundleUpdate", "getJsBundlePath: signatureLength=${signature.length}")
 
-            val devSettingsEnabled = if (BuildConfig.ALLOW_SKIP_GPG_VERIFICATION) isDevSettingsEnabled(context) else false
-            if (devSettingsEnabled) {
-                OneKeyLog.warn("BundleUpdate", "Startup SHA256 validation skipped (DevSettings enabled)")
+            val skipGPG = BuildConfig.ALLOW_SKIP_GPG_VERIFICATION && isDevSettingsEnabled(context) && isSkipGPGEnabled(context)
+            if (skipGPG) {
+                OneKeyLog.warn("BundleUpdate", "Startup SHA256 validation skipped (DevSettings + skip-GPG enabled)")
             }
-            if (!devSettingsEnabled && !validateMetadataFileSha256(context, currentBundleVersion, signature)) {
+            val currentBundleRelease = bundleVersionInFolder(currentBundleVersion, currentAppVersion) ?: return null
+            if (!skipGPG && !validateMetadataFileSha256(context, currentBundleVersion, signature, currentAppVersion, currentBundleRelease)) {
                 OneKeyLog.warn("BundleUpdate", "getJsBundlePath: validateMetadataFileSha256 failed, signatureLength=${signature.length}")
                 return null
             }
@@ -1066,6 +1201,7 @@ object BundleUpdateStoreAndroid {
     fun deleteDir(dir: File): Boolean = deleteDirectory(dir)
 
     private const val MAX_UNZIPPED_SIZE = 512L * 1024 * 1024  // 512 MB limit
+    private const val MAX_ZIP_ENTRIES = 4096
 
     fun unzipFile(zipFilePath: String, destDirectory: String) {
         val destDir = File(destDirectory)
@@ -1073,9 +1209,14 @@ object BundleUpdateStoreAndroid {
 
         val destDirPath: Path = Paths.get(destDir.canonicalPath)
         var totalBytesWritten = 0L
+        var entryCount = 0
         ZipInputStream(FileInputStream(zipFilePath)).use { zipIn ->
             var entry: ZipEntry? = zipIn.nextEntry
             while (entry != null) {
+                entryCount++
+                if (entryCount > MAX_ZIP_ENTRIES) {
+                    throw SecurityException("Zip entry count exceeds maximum allowed ($MAX_ZIP_ENTRIES)")
+                }
                 val outFile = File(destDir, entry.name)
                 val outPath: Path = Paths.get(outFile.canonicalPath)
                 if (!outPath.startsWith(destDirPath)) {
@@ -1135,7 +1276,9 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
     // in-memory map, a crashed run leaves no stale lock — the entry is gone on
     // relaunch, giving inherent stale-lock recovery (OCDS §5.8).
     private val activeDownloads =
-        ConcurrentHashMap<String, ConcurrentRangeDownloader.CancelHandle>()
+        ConcurrentHashMap<String, Pair<ConcurrentRangeDownloader.CancelHandle, CountDownLatch>>()
+    private val clearDownloadsLock = Any()
+    private var clearingDownloads = false
     private val httpClient = OkHttpClient.Builder()
         // OCDS §5.4 timeouts. `readTimeout` is the primary inter-byte stall
         // window: OkHttp raises SocketTimeoutException when no bytes arrive within
@@ -1148,7 +1291,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         .addNetworkInterceptor { chain ->
             val req = chain.request()
             if (!req.url.isHttps) {
-                throw java.io.IOException("Redirect to non-HTTPS URL is not allowed: ${req.url}")
+                throw SecurityException("Redirect to non-HTTPS URL is not allowed: ${req.url}")
             }
             chain.proceed(req)
         }
@@ -1165,33 +1308,16 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         }
     }
 
-    /**
-     * Returns a low-cardinality, path-free tag describing why a download
-     * failed. Used in the JS-facing `update/error` event so listeners
-     * never observe Android's `/data/data/<pkg>/...` or `/data/user/<u>/<pkg>/...`
-     * paths that FileNotFoundException / IOException embed in `e.message`.
-     *
-     * Recognized payloads (same shape extractUpdateErrorCode parses):
-     *   - "Bundle SHA256 verification failed: <REASON>" → preserved verbatim;
-     *      JS extractor maps to SHA256_<REASON>.
-     *   - "HTTP <code>" / "HTTP 416 ..." → preserved verbatim; maps to HTTP_<code>.
-     *   - "Already downloading" / "Invalid version string format" /
-     *     "Bundle download URL must use HTTPS" → preserved verbatim; the
-     *     hooks unrecoverable-list matches them by exact substring.
-     *   - Anything else → "IO_<exceptionClassName>" so the JS extractor
-     *     splits the bucket on exception class without leaking the message.
-     */
-    private fun sanitizeErrorMessageForEvent(e: Exception): String {
-        val msg = e.message ?: return "IO_${e.javaClass.simpleName}"
-        if (msg.startsWith("Bundle SHA256 verification failed:")) return msg
-        if (msg.startsWith("HTTP ")) return msg
-        if (msg == "Already downloading" ||
-            msg == "Invalid version string format" ||
-            msg == "Bundle download URL must use HTTPS" ||
-            msg == "Empty response body" ||
-            msg == "Failed to finalize download"
-        ) return msg
-        return "IO_${e.javaClass.simpleName}"
+    /** Keep raw exceptions in local logs and send only the fixed update wire to JS. */
+    private fun <T> updatePromise(step: String, work: suspend () -> T): Promise<T> {
+        return Promise.async {
+            try {
+                work()
+            } catch (e: Exception) {
+                OneKeyLog.error("BundleUpdate", "$step failed: ${e.javaClass.simpleName}: ${e.message}")
+                throw bundleUpdateError(e, step)
+            }
+        }
     }
 
     override fun addDownloadListener(callback: (BundleDownloadEvent) -> Unit): Double {
@@ -1239,7 +1365,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
     }
 
     override fun downloadBundle(params: BundleDownloadParams): Promise<BundleDownloadResult> {
-        return Promise.async {
+        return updatePromise("download") {
             // Per-dest single-flight is acquired below once `filePath` is known.
             // Input validation (version/HTTPS) runs FIRST and is intentionally
             // NOT gated by the lock — a malformed request must fail the same way
@@ -1247,6 +1373,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             // lock entry it then has to unwind.
             var acquiredKey: String? = null
             var cancelHandle: ConcurrentRangeDownloader.CancelHandle? = null
+            var completionLatch: CountDownLatch? = null
+            var duplicateDownload = false
 
             try {
             val context = getContext()
@@ -1260,12 +1388,12 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             if (!BundleUpdateStoreAndroid.isSafeVersionString(appVersion) ||
                 !BundleUpdateStoreAndroid.isSafeVersionString(bundleVersion)) {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: invalid version string format: appVersion=$appVersion, bundleVersion=$bundleVersion")
-                throw Exception("Invalid version string format")
+                throw BundleUpdateError("INVALID_ARGUMENT", "download")
             }
 
             if (!downloadUrl.startsWith("https://")) {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: URL is not HTTPS: $downloadUrl")
-                throw Exception("Bundle download URL must use HTTPS")
+                throw BundleUpdateError("SECURITY_REJECTED", "download")
             }
 
             val fileName = "$appVersion-$bundleVersion.zip"
@@ -1282,15 +1410,24 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             // concurrently. The handle is passed to the concurrent downloader so
             // clearDownload/clearBundle can stop its workers before deleting files.
             val handle = ConcurrentRangeDownloader.CancelHandle()
-            if (activeDownloads.putIfAbsent(filePath, handle) != null) {
+            val finished = CountDownLatch(1)
+            val registration = handle to finished
+            val wasActive = synchronized(activeDownloads) {
+                clearingDownloads || activeDownloads.putIfAbsent(filePath, registration) != null
+            }
+            if (wasActive) {
                 OneKeyLog.warn("BundleUpdate", "downloadBundle: rejected, already downloading $filePath")
-                throw Exception("Already downloading")
+                duplicateDownload = true
+                throw BundleUpdateError("INVALID_ARGUMENT", "download")
             }
             acquiredKey = filePath
             cancelHandle = handle
+            completionLatch = finished
+            fun ensureNotCancelled() {
+                if (handle.aborted.get()) throw BundleUpdateError("CANCELLED", "download")
+            }
 
             val result = BundleDownloadResult(
-                downloadedFile = filePath,
                 downloadUrl = downloadUrl,
                 latestVersion = appVersion,
                 bundleVersion = bundleVersion,
@@ -1304,6 +1441,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             if (downloadedFile.exists()) {
                 OneKeyLog.info("BundleUpdate", "downloadBundle: file already exists, verifying SHA256...")
                 if (verifyBundleSHA256(filePath, sha256)) {
+                    ensureNotCancelled()
                     OneKeyLog.info("BundleUpdate", "downloadBundle: existing file SHA256 valid, skipping download")
                     // Final file is authoritative — drop any stale concurrent
                     // partial + segment files left by an earlier interrupted
@@ -1318,8 +1456,9 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                     // where a second downloadBundle for this dest could otherwise
                     // pass the single-flight guard and run concurrently.
                     Thread.sleep(1000)
+                    ensureNotCancelled()
                     sendEvent("update/complete")
-                    return@async result
+                    return@updatePromise result
                 } else {
                     OneKeyLog.warn("BundleUpdate", "downloadBundle: existing file SHA256 mismatch, re-downloading")
                     downloadedFile.delete()
@@ -1337,6 +1476,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             // FALLBACK we fall through to the original single-stream path below.
             // Transient errors bubble to the outer catch (the concurrent
             // downloader keeps its partial + manifest for resume).
+            ensureNotCancelled()
             sendEvent("update/start")
             run {
                 // onProgress is invoked concurrently by all 8 worker threads, so
@@ -1350,6 +1490,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                     httpClient = httpClient,
                     log = { msg -> OneKeyLog.info("BundleUpdate", msg) },
                 ).download(downloadUrl, partialFilePath, cancelHandle) { transferred, total ->
+                    if (handle.aborted.get()) return@download
                     if (total > 0) {
                         val p = ((transferred * 100) / total).toInt().coerceIn(0, 100)
                         val prev = concurrentProgress.get()
@@ -1358,24 +1499,30 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                         }
                     }
                 }
+                ensureNotCancelled()
                 if (concurrentOutcome == ConcurrentRangeDownloader.Outcome.COMPLETED) {
                     // Promote .partial -> final, then SHA256 verify — identical
                     // finalize to the single-stream path below.
                     if (downloadedFile.exists()) downloadedFile.delete()
                     if (!File(partialFilePath).renameTo(downloadedFile)) {
                         OneKeyLog.error("BundleUpdate", "downloadBundle: concurrent rename .partial -> final failed")
-                        throw Exception("Failed to finalize download")
+                        throw BundleUpdateError("STORAGE_ERROR", "download")
                     }
                     OneKeyLog.info("BundleUpdate", "downloadBundle: concurrent download finished, verifying SHA256...")
-                    if (!verifyBundleSHA256(filePath, sha256)) {
+                    ensureNotCancelled()
+                    val calculatedHash = BundleUpdateStoreAndroid.calculateSHA256(filePath)
+                        ?: throw BundleUpdateError("STORAGE_ERROR", "download")
+                    if (!BundleUpdateStoreAndroid.secureCompare(calculatedHash, sha256)) {
+                        ensureNotCancelled()
                         val reason = BundleUpdateStoreAndroid.lastSHA256FailureReason() ?: "MISMATCH"
                         File(filePath).delete()
                         OneKeyLog.error("BundleUpdate", "downloadBundle: concurrent SHA256 verification failed, reason=$reason")
-                        throw Exception("Bundle SHA256 verification failed: $reason")
+                        throw BundleUpdateError("INTEGRITY_FAILED", "download")
                     }
+                    ensureNotCancelled()
                     sendEvent("update/complete")
                     OneKeyLog.info("BundleUpdate", "downloadBundle: concurrent completed successfully, appVersion=$appVersion, bundleVersion=$bundleVersion")
-                    return@async result
+                    return@updatePromise result
                 }
                 OneKeyLog.info("BundleUpdate", "downloadBundle: concurrent not used, falling back to single-stream")
             }
@@ -1402,13 +1549,15 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                         OneKeyLog.info("BundleUpdate", "downloadBundle: partial matches expected size ($partialSize), trying promote+verify")
                         if (downloadedFile.exists()) downloadedFile.delete()
                         if (partialFile.renameTo(downloadedFile) && verifyBundleSHA256(filePath, sha256)) {
+                            ensureNotCancelled()
                             OneKeyLog.info("BundleUpdate", "downloadBundle: recovered crashed-before-rename bundle, skipping download")
                             // The `finally` removes the per-dest lock after this
                             // return; the lock therefore spans the skip delay,
                             // same as the existing-file cache-hit path above.
                             Thread.sleep(1000)
+                            ensureNotCancelled()
                             sendEvent("update/complete")
-                            return@async result
+                            return@updatePromise result
                         } else {
                             OneKeyLog.warn("BundleUpdate", "downloadBundle: promote+verify failed, discarding both files")
                             if (downloadedFile.exists()) downloadedFile.delete()
@@ -1436,6 +1585,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 requestBuilder.addHeader("Range", "bytes=$partialBytes-")
             }
             val response = httpClient.newCall(requestBuilder.build()).execute()
+            ensureNotCancelled()
 
             // 416 Range Not Satisfiable: server says our offset is past the
             // file length. Two sub-cases distinguishable from
@@ -1454,9 +1604,10 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                     OneKeyLog.info("BundleUpdate", "downloadBundle: HTTP 416 with total==$totalFromHeader matches partial, attempting promote+verify")
                     if (downloadedFile.exists()) downloadedFile.delete()
                     if (partialFile.renameTo(downloadedFile) && verifyBundleSHA256(filePath, sha256)) {
+                        ensureNotCancelled()
                         OneKeyLog.info("BundleUpdate", "downloadBundle: 416 recovery succeeded, skipping download")
                         sendEvent("update/complete")
-                        return@async result
+                        return@updatePromise result
                     }
                     OneKeyLog.warn("BundleUpdate", "downloadBundle: 416 recovery failed verify, discarding")
                     if (downloadedFile.exists()) downloadedFile.delete()
@@ -1464,10 +1615,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 OneKeyLog.warn("BundleUpdate", "downloadBundle: HTTP 416 (range not satisfiable), discarding partial and failing this attempt")
                 if (partialFile.exists()) partialFile.delete()
                 for (i in 0 until CONCURRENT_SEGMENT_COUNT) File("$partialFilePath.seg$i").delete()
-                // Don't pre-emit update/error here; the outer catch is the
-                // single source of error events. sanitizeErrorMessageForEvent
-                // recognizes "HTTP " prefix and forwards this string verbatim.
-                throw Exception("HTTP 416 (range not satisfiable)")
+                // The outer catch emits one error event for this failure.
+                throw BundleUpdateError("HTTP_ERROR", "download", 416)
             }
 
             val expectsResume = partialBytes > 0
@@ -1477,7 +1626,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: HTTP error, statusCode=${response.code}")
                 response.close()
                 // outer catch is the single source of update/error events.
-                throw Exception("HTTP ${response.code}")
+                throw BundleUpdateError("HTTP_ERROR", "download", response.code)
             }
 
             // Server can ignore `Range` and return the full body with 200; in
@@ -1521,7 +1670,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             // consumption would close it for us.
             val body = response.body ?: run {
                 response.close()
-                throw Exception("Empty response body")
+                throw BundleUpdateError("NETWORK_ERROR", "download")
             }
             val contentLength = body.contentLength()
             // Total size of the whole resource (not the slice). On 206 prefer
@@ -1547,6 +1696,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             }
 
             // Append iff server granted us a 206 partial; otherwise overwrite.
+            val maxDownloadBytes = 512L * 1024 * 1024
             val appendMode = isPartialResponse
             var totalBytesRead = if (isPartialResponse) partialBytes else 0L
             body.byteStream().use { inputStream ->
@@ -1556,8 +1706,12 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
 
                     var prevProgress = -1
                     while (inputStream.read(buffer).also { bytesRead = it } != -1) {
-                        outputStream.write(buffer, 0, bytesRead)
+                        ensureNotCancelled()
                         totalBytesRead += bytesRead
+                        if (totalBytesRead > maxDownloadBytes) {
+                            throw BundleUpdateError("SECURITY_REJECTED", "download")
+                        }
+                        outputStream.write(buffer, 0, bytesRead)
                         if (totalSize > 0) {
                             val progress = ((totalBytesRead * 100) / totalSize).toInt().coerceIn(0, 100)
                             if (progress != prevProgress) {
@@ -1571,6 +1725,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             }
 
             val partialAfter = File(partialFilePath)
+            ensureNotCancelled()
             OneKeyLog.info(
                 "BundleUpdate",
                 "downloadBundle: download finished, totalBytesRead=$totalBytesRead, partialExists=${partialAfter.exists()}, partialSize=${if (partialAfter.exists()) partialAfter.length() else -1}, finalizing..."
@@ -1583,63 +1738,39 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             if (!partialAfter.renameTo(downloadedFile)) {
                 OneKeyLog.error("BundleUpdate", "downloadBundle: rename .partial -> final failed")
                 // outer catch is the single source of update/error events;
-                // "Failed to finalize download" is in the verbatim allowlist.
-                throw Exception("Failed to finalize download")
+                // The outer catch emits one error event for this failure.
+                throw BundleUpdateError("STORAGE_ERROR", "download")
             }
 
             OneKeyLog.info("BundleUpdate", "downloadBundle: verifying SHA256...")
-            if (!verifyBundleSHA256(filePath, sha256)) {
+            ensureNotCancelled()
+            val calculatedHash = BundleUpdateStoreAndroid.calculateSHA256(filePath)
+                ?: throw BundleUpdateError("STORAGE_ERROR", "download")
+            if (!BundleUpdateStoreAndroid.secureCompare(calculatedHash, sha256)) {
+                ensureNotCancelled()
                 val reason = BundleUpdateStoreAndroid.lastSHA256FailureReason() ?: "MISMATCH"
                 File(filePath).delete()
                 OneKeyLog.error("BundleUpdate", "downloadBundle: SHA256 verification failed after download, reason=$reason")
-                // outer catch emits the verbatim "Bundle SHA256 verification
-                // failed: <REASON>" payload (recognized by sanitize/JS).
-                throw Exception("Bundle SHA256 verification failed: $reason")
+                // The outer catch emits the fixed integrity failure wire.
+                throw BundleUpdateError("INTEGRITY_FAILED", "download")
             }
 
+            ensureNotCancelled()
             sendEvent("update/complete")
             OneKeyLog.info("BundleUpdate", "downloadBundle: completed successfully, appVersion=$appVersion, bundleVersion=$bundleVersion")
             result
             } catch (e: Exception) {
-                // Keep the rich detail in OneKeyLog (local-only). The JS
-                // event channel must NOT carry e.message verbatim — Android
-                // FileNotFoundException etc. embed the full /data/user/.../
-                // path including the package identifier, and downstream
-                // listeners would forward that into analytics. Emit only the
-                // sanitized tag; mirrors the iOS sendEvent payload at
-                // ReactNativeBundleUpdate.swift's "update/error" sites and
-                // matches the verbatim guarantees documented on
-                // sanitizeErrorMessageForEvent.
                 OneKeyLog.error("BundleUpdate", "downloadBundle: failed: ${e.javaClass.simpleName}: ${e.message}")
-                val sanitized = sanitizeErrorMessageForEvent(e)
-                // An INTENTIONAL cancel (clearDownload/clearBundle flipped THIS
-                // run's CancelHandle, which aborts the workers → they throw
-                // IOException("aborted")) is NOT a download failure — the caller
-                // deliberately tore the run down. Before the cancel-then-delete
-                // path existed, clearing never aborted an in-flight run, so no
-                // `update/error` was emitted; preserve that. Detect it off the
-                // handle's `aborted` flag rather than the message, because
-                // sanitizeErrorMessageForEvent collapses "aborted" to the generic
-                // "IO_IOException" tag and would be indistinguishable from a real
-                // I/O failure.
                 val intentionallyCancelled = cancelHandle?.aborted?.get() == true
-                // A duplicate-dest single-flight rejection ("Already downloading")
-                // is NOT a failure of any in-flight download — it means another
-                // run already owns this dest. The original global-boolean guard
-                // threw this BEFORE the try, so no `update/error` was emitted;
-                // preserve that so listeners don't observe a spurious error for the
-                // rejected caller while the real download is still progressing.
-                if (sanitized != "Already downloading" && !intentionallyCancelled) {
-                    sendEvent("update/error", message = sanitized)
+                val updateError = if (intentionallyCancelled) {
+                    BundleUpdateError("CANCELLED", "download")
+                } else {
+                    bundleUpdateError(e, "download")
+                }
+                if (!duplicateDownload && !intentionallyCancelled) {
+                    sendEvent("update/error", message = updateError.message.orEmpty())
                 }
-                // Rethrow with the same sanitized message so the Promise
-                // rejection surfacing to JS carries no /data/user/<u>/<pkg>/
-                // paths. Without this rewrap, FileNotFoundException etc.
-                // would re-leak via Promise.reject's message channel even
-                // though the event payload was already sanitized. Keep
-                // the original exception as `cause` so OneKeyLog (and any
-                // native crash reporter) still sees the full chain.
-                throw Exception(sanitized, e)
+                throw updateError
             } finally {
                 // Release THIS run's per-dest single-flight lock. Keyed remove
                 // (only if we actually acquired it — input-validation failures
@@ -1648,8 +1779,10 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 // the same dest may have re-registered after a concurrent cancel.
                 val key = acquiredKey
                 val handle = cancelHandle
-                if (key != null && handle != null) {
-                    activeDownloads.remove(key, handle)
+                val finished = completionLatch
+                finished?.countDown()
+                if (key != null && handle != null && finished != null) {
+                    activeDownloads.remove(key, handle to finished)
                 }
             }
         }
@@ -1674,31 +1807,73 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         return isValid
     }
 
+    private fun isSafeVersionString(version: String): Boolean {
+        return BundleUpdateStoreAndroid.isSafeVersionString(version)
+    }
+
     override fun downloadBundleASC(params: BundleDownloadASCParams): Promise<Unit> {
-        return Promise.async {
-            val context = getContext()
+        return updatePromise("downloadASC") {
             val appVersion = params.latestVersion
             val bundleVersion = params.bundleVersion
             val signature = params.signature
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw BundleUpdateError("INVALID_ARGUMENT", "downloadASC")
+            }
+            if (signature.toByteArray(Charsets.UTF_8).size > 64 * 1024) {
+                throw BundleUpdateError("INVALID_ARGUMENT", "downloadASC")
+            }
 
+            val context = getContext()
             OneKeyLog.info("BundleUpdate", "downloadBundleASC: appVersion=$appVersion, bundleVersion=$bundleVersion, signatureLength=${signature.length}")
 
             val storageKey = "$appVersion-$bundleVersion"
-            BundleUpdateStoreAndroid.writeSignatureFile(context, storageKey, signature)
-
-            OneKeyLog.info("BundleUpdate", "downloadBundleASC: stored signature for key=$storageKey")
+            val ascBaseCanonical = File(BundleUpdateStoreAndroid.getAscDir(context)).canonicalPath
+            val signatureFile = File(BundleUpdateStoreAndroid.getSignatureFilePath(context, storageKey))
+            if (Files.isSymbolicLink(signatureFile.toPath()) ||
+                !signatureFile.canonicalPath.startsWith(ascBaseCanonical + File.separator)
+            ) {
+                throw BundleUpdateError("SECURITY_REJECTED", "downloadASC")
+            }
         }
     }
 
     override fun verifyBundleASC(params: BundleVerifyASCParams): Promise<Unit> {
-        return Promise.async {
-            val context = getContext()
-            val filePath = params.downloadedFile
+        return updatePromise("verifyASC") {
             val sha256 = params.sha256
             val appVersion = params.latestVersion
             val bundleVersion = params.bundleVersion
             val signature = params.signature
 
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw BundleUpdateError("INVALID_ARGUMENT", "verifyASC")
+            }
+
+            val context = getContext()
+            val filePath = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context),
+                "$appVersion-$bundleVersion.zip").absolutePath
+            val downloadBaseCanonical = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context)).canonicalPath
+            val resolvedFilePath = File(filePath).canonicalPath
+            if (!resolvedFilePath.startsWith(downloadBaseCanonical + File.separator)) {
+                OneKeyLog.error("BundleUpdate", "verifyBundleASC: ZIP outside download directory: $resolvedFilePath")
+                throw BundleUpdateError("SECURITY_REJECTED", "verifyASC")
+            }
+            if (!File(resolvedFilePath).isFile) {
+                throw BundleUpdateError("PACKAGE_MISSING", "verifyASC")
+            }
+
+            val folderName = "$appVersion-$bundleVersion"
+            val isInstalled = BundleUpdateStoreAndroid.getCurrentBundleVersion(context) == folderName ||
+                BundleUpdateStoreAndroid.readFallbackUpdateBundleDataFile(context).any {
+                    it["appVersion"] == appVersion && it["bundleVersion"] == bundleVersion
+                }
+            val bundleBaseCanonical = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
+            val destinationDir = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            val destination = destinationDir.canonicalPath
+            if (!destination.startsWith(bundleBaseCanonical + File.separator)) {
+                OneKeyLog.error("BundleUpdate", "verifyBundleASC: destination outside bundle directory: $destination")
+                throw BundleUpdateError("SECURITY_REJECTED", "verifyASC")
+            }
+
             OneKeyLog.info("BundleUpdate", "verifyBundleASC: appVersion=$appVersion, bundleVersion=$bundleVersion, file=$filePath, signatureLength=${signature.length}")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
@@ -1706,44 +1881,69 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG check: skipGPG=$skipGPG")
 
             if (!skipGPG) {
+                OneKeyLog.info("BundleUpdate", "verifyBundleASC: pre-verifying GPG signature before extraction...")
+                if (BundleUpdateStoreAndroid.readMetadataFileSha256(
+                        signature,
+                        expectedAppVersion = appVersion,
+                        expectedBundleVersion = bundleVersion,
+                        expectedAppType = "android",
+                    ).isNullOrEmpty()
+                ) {
+                    OneKeyLog.error("BundleUpdate", "verifyBundleASC: pre-extraction GPG signature verification failed")
+                    throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
+                }
+
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: verifying SHA256 of downloaded file...")
-                if (!verifyBundleSHA256(filePath, sha256)) {
-                    // Promote the SHA256 subtype (FILE_TRUNCATED / OOM /
-                    // IO_<class> / MISMATCH) into the thrown message so
-                    // extractUpdateErrorCode in the JS layer can split
-                    // this bucket the same way the download stage does.
+                val calculatedHash = BundleUpdateStoreAndroid.calculateSHA256(resolvedFilePath)
+                    ?: throw BundleUpdateError("STORAGE_ERROR", "verifyASC")
+                if (!BundleUpdateStoreAndroid.secureCompare(calculatedHash, sha256)) {
+                    // Keep the detailed hash reason in the local log only.
                     val reason = BundleUpdateStoreAndroid.lastSHA256FailureReason() ?: "MISMATCH"
                     OneKeyLog.error("BundleUpdate", "verifyBundleASC: SHA256 verification failed for file=$filePath, reason=$reason")
-                    throw Exception("Bundle SHA256 verification failed: $reason")
+                    throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
                 }
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: SHA256 verified OK")
             } else {
                 OneKeyLog.warn("BundleUpdate", "verifyBundleASC: SHA256 + GPG verification skipped (DevSettings enabled)")
             }
 
-            val folderName = "$appVersion-$bundleVersion"
-            val destination = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName).absolutePath
-            val destinationDir = File(destination)
+            if (isInstalled) {
+                if (!skipGPG && !BundleUpdateStoreAndroid.validateMetadataFileSha256(context, folderName, signature, appVersion, bundleVersion)) {
+                    throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
+                }
+                val metadata = BundleUpdateStoreAndroid.parseMetadataJson(
+                    BundleUpdateStoreAndroid.readFileContent(File(destination, "metadata.json"))
+                )
+                if (!BundleUpdateStoreAndroid.validateAllFilesInDir(context, destination, metadata, appVersion, bundleVersion) ||
+                    !BundleUpdateStoreAndroid.validateBundlePairCompatibility(context, destination, metadata)
+                ) {
+                    throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
+                }
+                return@updatePromise
+            }
 
             try {
+                if (destinationDir.exists()) {
+                    BundleUpdateStoreAndroid.deleteDir(destinationDir)
+                }
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: extracting zip to $destination...")
-                BundleUpdateStoreAndroid.unzipFile(filePath, destination)
+                BundleUpdateStoreAndroid.unzipFile(resolvedFilePath, destination)
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: extraction completed")
 
                 val metadataFile = File(destination, "metadata.json")
                 if (!metadataFile.exists()) {
                     OneKeyLog.error("BundleUpdate", "verifyBundleASC: metadata.json not found after extraction")
                     BundleUpdateStoreAndroid.deleteDir(destinationDir)
-                    throw Exception("Failed to read metadata.json")
+                    throw BundleUpdateError("PACKAGE_MISSING", "verifyASC")
                 }
 
                 val currentBundleVersion = "$appVersion-$bundleVersion"
                 if (!skipGPG) {
                     OneKeyLog.info("BundleUpdate", "verifyBundleASC: validating GPG signature for metadata...")
-                    if (!BundleUpdateStoreAndroid.validateMetadataFileSha256(context, currentBundleVersion, signature)) {
+                    if (!BundleUpdateStoreAndroid.validateMetadataFileSha256(context, currentBundleVersion, signature, appVersion, bundleVersion)) {
                         OneKeyLog.error("BundleUpdate", "verifyBundleASC: GPG signature verification failed")
                         BundleUpdateStoreAndroid.deleteDir(destinationDir)
-                        throw Exception("Bundle signature verification failed")
+                        throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
                     }
                     OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG signature verified OK")
                 }
@@ -1754,12 +1954,12 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 if (!BundleUpdateStoreAndroid.validateAllFilesInDir(context, destination, metadata, appVersion, bundleVersion)) {
                     OneKeyLog.error("BundleUpdate", "verifyBundleASC: file integrity check failed")
                     BundleUpdateStoreAndroid.deleteDir(destinationDir)
-                    throw Exception("Extracted files verification against metadata failed")
+                    throw BundleUpdateError("INTEGRITY_FAILED", "verifyASC")
                 }
                 if (!BundleUpdateStoreAndroid.validateBundlePairCompatibility(context, destination, metadata)) {
                     OneKeyLog.error("BundleUpdate", "verifyBundleASC: bundle pair compatibility check failed")
                     BundleUpdateStoreAndroid.deleteDir(destinationDir)
-                    throw Exception("Bundle pair compatibility check failed")
+                    throw BundleUpdateError("INCOMPATIBLE", "verifyASC")
                 }
 
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: all verifications passed, appVersion=$appVersion, bundleVersion=$bundleVersion")
@@ -1773,23 +1973,38 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
     }
 
     override fun verifyBundle(params: BundleVerifyParams): Promise<Unit> {
-        return Promise.async {
-            val filePath = params.downloadedFile
+        return updatePromise("verifyPackage") {
             val sha256 = params.sha256
             val appVersion = params.latestVersion
             val bundleVersion = params.bundleVersion
 
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw BundleUpdateError("INVALID_ARGUMENT", "verifyPackage")
+            }
+
+            val context = getContext()
+            val filePath = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context),
+                "$appVersion-$bundleVersion.zip").absolutePath
+            val downloadBaseCanonical = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context)).canonicalPath
+            val resolvedFilePath = File(filePath).canonicalPath
+            if (!resolvedFilePath.startsWith(downloadBaseCanonical + File.separator)) {
+                throw BundleUpdateError("SECURITY_REJECTED", "verifyPackage")
+            }
+            if (!File(resolvedFilePath).isFile) {
+                throw BundleUpdateError("PACKAGE_MISSING", "verifyPackage")
+            }
+
             OneKeyLog.info("BundleUpdate", "verifyBundle: appVersion=$appVersion, bundleVersion=$bundleVersion, file=$filePath")
 
             // Verify SHA256 of the downloaded file
-            val calculated = BundleUpdateStoreAndroid.calculateSHA256(filePath)
+            val calculated = BundleUpdateStoreAndroid.calculateSHA256(resolvedFilePath)
             if (calculated == null) {
                 OneKeyLog.error("BundleUpdate", "verifyBundle: failed to calculate SHA256 for file=$filePath")
-                throw Exception("Failed to calculate SHA256")
+                throw BundleUpdateError("STORAGE_ERROR", "verifyPackage")
             }
             if (!BundleUpdateStoreAndroid.secureCompare(calculated, sha256)) {
                 OneKeyLog.error("BundleUpdate", "verifyBundle: SHA256 mismatch, expected=${sha256.take(16)}..., got=${calculated.take(16)}...")
-                throw Exception("SHA256 verification failed")
+                throw BundleUpdateError("INTEGRITY_FAILED", "verifyPackage")
             }
 
             OneKeyLog.info("BundleUpdate", "verifyBundle: SHA256 verified OK for appVersion=$appVersion, bundleVersion=$bundleVersion")
@@ -1802,12 +2017,16 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         // commits so a same-version reinstall (or any reader that re-cached
         // pre-commit data inside the race window) can't leave stale entries.
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
-        return Promise.async {
-            val context = getContext()
+        return updatePromise("install") {
             val appVersion = params.latestVersion
             val bundleVersion = params.bundleVersion
             val signature = params.signature
 
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw BundleUpdateError("INVALID_ARGUMENT", "install")
+            }
+
+            val context = getContext()
             OneKeyLog.info("BundleUpdate", "installBundle: appVersion=$appVersion, bundleVersion=$bundleVersion, signatureLength=${signature.length}")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
@@ -1816,13 +2035,53 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
 
             val folderName = "$appVersion-$bundleVersion"
             val currentFolderName = BundleUpdateStoreAndroid.getCurrentBundleVersion(context)
+            val previousActiveBundleVersion = currentFolderName?.let {
+                BundleUpdateStoreAndroid.bundleVersionInFolder(it, appVersion)
+            }
             OneKeyLog.info("BundleUpdate", "installBundle: target=$folderName, current=$currentFolderName")
 
-            // Verify bundle directory exists
+            // Verify bundle directory exists and is canonically confined inside getBundleDir(context)
+            val bundleBaseCanonical = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val bundleDirPath = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (Files.isSymbolicLink(bundleDirPath.toPath()) ||
+                !bundleDirPath.canonicalPath.startsWith(bundleBaseCanonical + File.separator)
+            ) {
+                throw BundleUpdateError("SECURITY_REJECTED", "install")
+            }
+            val ascBaseCanonical = File(BundleUpdateStoreAndroid.getAscDir(context)).canonicalPath
+            val sigFile = File(BundleUpdateStoreAndroid.getSignatureFilePath(context, folderName))
+            if (Files.isSymbolicLink(sigFile.toPath()) ||
+                !sigFile.canonicalPath.startsWith(ascBaseCanonical + File.separator)
+            ) {
+                throw BundleUpdateError("SECURITY_REJECTED", "install")
+            }
             if (!bundleDirPath.exists()) {
                 OneKeyLog.error("BundleUpdate", "installBundle: bundle directory not found: ${bundleDirPath.absolutePath}")
-                throw Exception("Bundle directory not found: $folderName")
+                throw BundleUpdateError("PACKAGE_MISSING", "install")
+            }
+
+            val mainBundleFile = File(bundleDirPath, "main.jsbundle.hbc")
+            val metadataFile = File(bundleDirPath, "metadata.json")
+            if (!mainBundleFile.exists() || !metadataFile.exists()) {
+                OneKeyLog.error("BundleUpdate", "installBundle: required bundle files missing in: ${bundleDirPath.absolutePath}")
+                throw BundleUpdateError("PACKAGE_MISSING", "install")
+            }
+
+            if (!skipGPG) {
+                if (signature.isEmpty() || !BundleUpdateStoreAndroid.validateMetadataFileSha256(context, folderName, signature, appVersion, bundleVersion)) {
+                    OneKeyLog.error("BundleUpdate", "installBundle: GPG signature verification failed for $folderName")
+                    throw BundleUpdateError("INTEGRITY_FAILED", "install")
+                }
+            }
+
+            val metadata = BundleUpdateStoreAndroid.parseMetadataJson(BundleUpdateStoreAndroid.readFileContent(metadataFile))
+            if (!BundleUpdateStoreAndroid.validateEntryBundlesSha256(bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "installBundle: entry bundle SHA256 verification failed for $folderName")
+                throw BundleUpdateError("INTEGRITY_FAILED", "install")
+            }
+            if (!BundleUpdateStoreAndroid.validateBundlePairCompatibility(context, bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "installBundle: bundle pair compatibility check failed for $folderName")
+                throw BundleUpdateError("INCOMPATIBLE", "install")
             }
 
             val currentSignature = if (currentFolderName != null) BundleUpdateStoreAndroid.readSignatureFile(context, currentFolderName) else ""
@@ -1838,13 +2097,11 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 val fallbackData = BundleUpdateStoreAndroid.readFallbackUpdateBundleDataFile(context)
 
                 if (!currentFolderName.isNullOrEmpty()) {
-                    val lastDashIndex = currentFolderName.lastIndexOf("-")
-                    if (lastDashIndex > 0) {
-                        val curAppVersion = currentFolderName.substring(0, lastDashIndex)
-                        val curBundleVersion = currentFolderName.substring(lastDashIndex + 1)
+                    val curBundleVersion = BundleUpdateStoreAndroid.bundleVersionInFolder(currentFolderName, appVersion)
+                    if (curBundleVersion != null) {
                         if (currentSignature.isNotEmpty()) {
                             fallbackData.add(mutableMapOf(
-                                "appVersion" to curAppVersion,
+                                "appVersion" to appVersion,
                                 "bundleVersion" to curBundleVersion,
                                 "signature" to currentSignature
                             ))
@@ -1853,16 +2110,20 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 }
 
                 if (fallbackData.size > 3) {
-                    val shifted = fallbackData.removeAt(0)
-                    val shiftApp = shifted["appVersion"]
-                    val shiftBundle = shifted["bundleVersion"]
+                    val removedBundle = fallbackData.removeAt(0)
+                    val shiftApp = removedBundle["appVersion"]
+                    val shiftBundle = removedBundle["bundleVersion"]
                     if (shiftApp != null && shiftBundle != null) {
                         val shiftFolderName = "$shiftApp-$shiftBundle"
-                        val oldDir = File(BundleUpdateStoreAndroid.getBundleDir(context), shiftFolderName)
-                        if (oldDir.exists()) {
-                            BundleUpdateStoreAndroid.deleteDir(oldDir)
+                        if (shiftBundle != previousActiveBundleVersion && shiftFolderName != currentFolderName) {
+                            val oldDir = File(BundleUpdateStoreAndroid.getBundleDir(context), shiftFolderName)
+                            if (oldDir.exists()) {
+                                BundleUpdateStoreAndroid.deleteDir(oldDir)
+                            }
+                            BundleUpdateStoreAndroid.deleteSignatureFile(context, shiftFolderName)
+                        } else {
+                            OneKeyLog.info("BundleUpdate", "installBundle: skipping disk deletion of active bundle $shiftFolderName during eviction")
                         }
-                        BundleUpdateStoreAndroid.deleteSignatureFile(context, shiftFolderName)
                     }
                 }
 
@@ -1879,58 +2140,72 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         }
     }
 
-    // OCDS §5.8 cancel-then-delete. Stop every in-flight concurrent run's worker
-    // pool (flip its abort flag + shutdownNow) BEFORE the caller deletes the
-    // download directory. Without this, a live segment worker could re-create a
-    // `.segN` we just deleted (CRD streams into `.segN` via append). Removing each
-    // entry here also makes the dest immediately re-acquirable. The in-flight
-    // download's own `finally` does a value-checked remove, so racing it is safe.
-    private fun cancelAllActiveDownloads() {
-        val keys = activeDownloads.keys.toList()
-        for (key in keys) {
-            activeDownloads.remove(key)?.let {
-                OneKeyLog.info("BundleUpdate", "cancelling in-flight download: $key")
-                it.cancel()
+    private fun clearDownloadFiles(context: Context, includeInstalled: Boolean) {
+        synchronized(clearDownloadsLock) {
+            try {
+                val active = synchronized(activeDownloads) {
+                    clearingDownloads = true
+                    activeDownloads.entries.map { it.key to it.value }
+                }
+                active.forEach { (_, run) -> run.first.aborted.set(true) }
+                active.forEach { (key, run) ->
+                    OneKeyLog.info("BundleUpdate", "cancelling in-flight download: $key")
+                    run.first.cancel()
+                }
+                val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(65)
+                for ((_, run) in active) {
+                    val remaining = deadline - System.nanoTime()
+                    val completed = try {
+                        remaining > 0 && run.second.await(remaining, TimeUnit.NANOSECONDS)
+                    } catch (e: InterruptedException) {
+                        Thread.currentThread().interrupt()
+                        false
+                    }
+                    if (!completed) throw BundleUpdateError("UNKNOWN", "cleanup")
+                }
+                synchronized(activeDownloads) {
+                    if (active.any { (key, run) ->
+                            val current = activeDownloads[key]
+                            current != null && current !== run
+                        }) {
+                        throw BundleUpdateError("UNKNOWN", "cleanup")
+                    }
+                    val downloadDir = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context))
+                    if (downloadDir.exists()) {
+                        if (!BundleUpdateStoreAndroid.deleteDir(downloadDir)) throw BundleUpdateError("STORAGE_ERROR", "cleanup")
+                        OneKeyLog.info("BundleUpdate", "download directory deleted")
+                    }
+                    if (includeInstalled) {
+                        val bundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context))
+                        if (bundleDir.exists()) {
+                            if (!BundleUpdateStoreAndroid.deleteDir(bundleDir)) throw BundleUpdateError("STORAGE_ERROR", "cleanup")
+                            OneKeyLog.info("BundleUpdate", "bundle directory deleted")
+                        }
+                    }
+                }
+            } finally {
+                synchronized(activeDownloads) {
+                    clearingDownloads = false
+                }
             }
         }
     }
 
     override fun clearDownload(): Promise<Unit> {
-        return Promise.async {
+        return updatePromise("cleanup") {
             OneKeyLog.info("BundleUpdate", "clearDownload: clearing download directory...")
             val context = getContext()
-            // Cancel-then-delete: stop live workers before removing files.
-            cancelAllActiveDownloads()
-            val downloadDir = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context))
-            if (downloadDir.exists()) {
-                BundleUpdateStoreAndroid.deleteDir(downloadDir)
-                OneKeyLog.info("BundleUpdate", "clearDownload: download directory deleted")
-            } else {
-                OneKeyLog.info("BundleUpdate", "clearDownload: download directory does not exist, skipping")
-            }
+            clearDownloadFiles(context, includeInstalled = false)
             OneKeyLog.info("BundleUpdate", "clearDownload: completed")
         }
     }
 
     override fun clearBundle(): Promise<Unit> {
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
-        return Promise.async {
+        return updatePromise("cleanup") {
             OneKeyLog.info("BundleUpdate", "clearBundle: clearing download and bundle directories...")
             val context = getContext()
-            // Cancel-then-delete: stop live workers before removing files.
-            cancelAllActiveDownloads()
-            // Clear download directory
-            val downloadDir = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context))
-            if (downloadDir.exists()) {
-                BundleUpdateStoreAndroid.deleteDir(downloadDir)
-                OneKeyLog.info("BundleUpdate", "clearBundle: download directory deleted")
-            }
-            // Clear installed bundle directory
-            val bundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context))
-            if (bundleDir.exists()) {
-                BundleUpdateStoreAndroid.deleteDir(bundleDir)
-                OneKeyLog.info("BundleUpdate", "clearBundle: bundle directory deleted")
-            }
+            clearDownloadFiles(context, includeInstalled = true)
             OneKeyLog.info("BundleUpdate", "clearBundle: completed")
         }
     }
@@ -1943,9 +2218,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
      * appVersion's artifacts and the active currentBundleVersion. Tolerates
      * already-missing files. Returns the count of deleted version directories.
      *
-     * appVersion is parsed from the "{appVersion}-{bundleVersion}" stem using
-     * the SAME last-dash split as listLocalBundles / the installBundle fallback
-     * logic, so behavior matches the rest of the module.
+     * The running app version is matched as an exact prefix before best-effort
+     * classification of non-current stems.
      */
     override fun pruneStaleAppVersionBundles(): Promise<Double> {
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
@@ -1978,6 +2252,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             // unparseable (leave foreign names alone).
             fun shouldKeep(stem: String): Boolean {
                 if (currentBundleVersion != null && stem == currentBundleVersion) return true
+                if (BundleUpdateStoreAndroid.bundleVersionInFolder(stem, currentAppV) != null) return true
                 val appV = appVersionFromStem(stem) ?: return true
                 return appV == currentAppV
             }
@@ -2083,7 +2358,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
 
     override fun resetToBuiltInBundle(): Promise<Unit> {
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
-        return Promise.async {
+        return updatePromise("cleanup") {
             OneKeyLog.info("BundleUpdate", "resetToBuiltInBundle: clearing currentBundleVersion preference...")
             val context = getContext()
             val prefs = context.getSharedPreferences("BundleUpdatePrefs", Context.MODE_PRIVATE)
@@ -2100,7 +2375,7 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
 
     override fun clearAllJSBundleData(): Promise<TestResult> {
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
-        return Promise.async {
+        return updatePromise("cleanup") {
             OneKeyLog.info("BundleUpdate", "clearAllJSBundleData: starting...")
             val context = getContext()
             val downloadDir = File(BundleUpdateStoreAndroid.getDownloadBundleDir(context))
@@ -2138,16 +2413,37 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
 
     override fun setCurrentUpdateBundleData(params: BundleSwitchParams): Promise<Unit> {
         BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
-        return Promise.async {
+        return updatePromise("install") {
+            if (!isSafeVersionString(params.appVersion) || !isSafeVersionString(params.bundleVersion)) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: invalid version string format: appVersion=${params.appVersion}, bundleVersion=${params.bundleVersion}")
+                throw BundleUpdateError("INVALID_ARGUMENT", "install")
+            }
+
             val context = getContext()
             val bundleVersion = "${params.appVersion}-${params.bundleVersion}"
             OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: switching to $bundleVersion")
 
-            // Verify the bundle directory actually exists
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val bundleDirPath = File(BundleUpdateStoreAndroid.getBundleDir(context), bundleVersion)
+            if (Files.isSymbolicLink(bundleDirPath.toPath()) ||
+                !bundleDirPath.canonicalPath.startsWith(baseBundleDir + File.separator)
+            ) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: bundle path outside bundle directory: ${bundleDirPath.canonicalPath}")
+                throw BundleUpdateError("SECURITY_REJECTED", "install")
+            }
+            val sigFile = File(BundleUpdateStoreAndroid.getSignatureFilePath(context, bundleVersion))
+            val baseAscDir = File(BundleUpdateStoreAndroid.getAscDir(context)).canonicalPath
+            if (Files.isSymbolicLink(sigFile.toPath()) ||
+                !sigFile.canonicalPath.startsWith(baseAscDir + File.separator)
+            ) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: signature path outside asc directory: ${sigFile.canonicalPath}")
+                throw BundleUpdateError("SECURITY_REJECTED", "install")
+            }
+
+            // Verify the bundle directory actually exists
             if (!bundleDirPath.exists()) {
                 OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: bundle directory not found: ${bundleDirPath.absolutePath}")
-                throw Exception("Bundle directory not found")
+                throw BundleUpdateError("PACKAGE_MISSING", "install")
             }
 
             // Verify GPG signature is valid (skipped when both DevSettings and skip-GPG toggle are enabled)
@@ -2155,22 +2451,36 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG check: skipGPG=$skipGPGSwitch")
             if (!skipGPGSwitch) {
                 if (params.signature.isEmpty() ||
-                    !BundleUpdateStoreAndroid.validateMetadataFileSha256(context, bundleVersion, params.signature)) {
+                    !BundleUpdateStoreAndroid.validateMetadataFileSha256(context, bundleVersion, params.signature, params.appVersion, params.bundleVersion)) {
                     OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: GPG signature verification failed")
-                    throw Exception("Bundle signature verification failed")
+                    throw BundleUpdateError("INTEGRITY_FAILED", "install")
                 }
                 OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG signature verified OK")
             } else {
                 OneKeyLog.warn("BundleUpdate", "setCurrentUpdateBundleData: GPG signature verification skipped (DevSettings + skip-GPG enabled)")
             }
 
-            val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
-            prefs.edit()
-                .putString("currentBundleVersion", bundleVersion)
-                .apply()
-            if (params.signature.isNotEmpty()) {
-                BundleUpdateStoreAndroid.writeSignatureFile(context, bundleVersion, params.signature)
+            val metadataFile = File(bundleDirPath, "metadata.json")
+            if (!metadataFile.exists()) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: metadata.json not found in ${bundleDirPath.absolutePath}")
+                throw BundleUpdateError("PACKAGE_MISSING", "install")
+            }
+            val metadata = BundleUpdateStoreAndroid.parseMetadataJson(BundleUpdateStoreAndroid.readFileContent(metadataFile))
+            if (!BundleUpdateStoreAndroid.validateEntryBundlesSha256(bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: entry bundle SHA256 verification failed")
+                throw BundleUpdateError("INTEGRITY_FAILED", "install")
+            }
+            if (!BundleUpdateStoreAndroid.validateBundlePairCompatibility(context, bundleDirPath.absolutePath, metadata)) {
+                OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: bundle pair compatibility check failed")
+                throw BundleUpdateError("INCOMPATIBLE", "install")
             }
+
+            BundleUpdateStoreAndroid.setCurrentBundleVersionAndSignature(context, bundleVersion, params.signature)
+            val currentNativeVersion = BundleUpdateStoreAndroid.getAppVersion(context) ?: ""
+            BundleUpdateStoreAndroid.setNativeVersion(context, currentNativeVersion)
+            val currentBuildNumber = BundleUpdateStoreAndroid.getBuildNumber(context)
+            BundleUpdateStoreAndroid.setNativeBuildNumber(context, currentBuildNumber)
+            BundleUpdateStoreAndroid.invalidateValidatedBundleInfoCache()
             OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: switched to $bundleVersion")
         }
     }
@@ -2278,7 +2588,7 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 91Js0rQ=
 =A/Ii
 -----END PGP SIGNATURE-----"""
-            val result = BundleUpdateStoreAndroid.verifyGPGAndExtractSha256(testSignature)
+            val result = BundleUpdateStoreAndroid.verifyGPGAndExtractSha256(testSignature, expectedAppType = null)
             val isValid = result == "2ada9c871104fc40649fa3de67a7d8e33faadc18e9abd587e8bb85be0a003eba"
             OneKeyLog.info("BundleUpdate", "testVerification: GPG verification result: $isValid")
             isValid
@@ -2305,9 +2615,17 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 
     override fun isBundleExists(appVersion: String, bundleVersion: String): Promise<Boolean> {
         return Promise.async {
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                OneKeyLog.error("BundleUpdate", "isBundleExists: invalid version string format: appVersion=$appVersion, bundleVersion=$bundleVersion")
+                throw SecurityException("Invalid version string")
+            }
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val bundlePath = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!bundlePath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
             val exists = bundlePath.exists()
             OneKeyLog.info("BundleUpdate", "isBundleExists: appVersion=$appVersion, bundleVersion=$bundleVersion, exists=$exists")
             exists
@@ -2315,19 +2633,27 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
     }
 
     override fun verifyExtractedBundle(appVersion: String, bundleVersion: String): Promise<Unit> {
-        return Promise.async {
+        return updatePromise("verifyPackage") {
             OneKeyLog.info("BundleUpdate", "verifyExtractedBundle: appVersion=$appVersion, bundleVersion=$bundleVersion")
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                OneKeyLog.error("BundleUpdate", "verifyExtractedBundle: invalid version string format: appVersion=$appVersion, bundleVersion=$bundleVersion")
+                throw BundleUpdateError("INVALID_ARGUMENT", "verifyPackage")
+            }
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val bundlePath = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!bundlePath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw BundleUpdateError("SECURITY_REJECTED", "verifyPackage")
+            }
             if (!bundlePath.exists()) {
                 OneKeyLog.error("BundleUpdate", "verifyExtractedBundle: bundle directory not found: ${bundlePath.absolutePath}")
-                throw Exception("Bundle directory not found")
+                throw BundleUpdateError("PACKAGE_MISSING", "verifyPackage")
             }
             val metadataFile = File(bundlePath, "metadata.json")
             if (!metadataFile.exists()) {
                 OneKeyLog.error("BundleUpdate", "verifyExtractedBundle: metadata.json not found in ${bundlePath.absolutePath}")
-                throw Exception("metadata.json not found")
+                throw BundleUpdateError("PACKAGE_MISSING", "verifyPackage")
             }
 
             OneKeyLog.info("BundleUpdate", "verifyExtractedBundle: parsing metadata and validating files...")
@@ -2335,11 +2661,11 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
             val metadata = BundleUpdateStoreAndroid.parseMetadataJson(metadataContent)
             if (!BundleUpdateStoreAndroid.validateAllFilesInDir(context, bundlePath.absolutePath, metadata, appVersion, bundleVersion)) {
                 OneKeyLog.error("BundleUpdate", "verifyExtractedBundle: file integrity check failed")
-                throw Exception("File integrity check failed")
+                throw BundleUpdateError("INTEGRITY_FAILED", "verifyPackage")
             }
             if (!BundleUpdateStoreAndroid.validateBundlePairCompatibility(context, bundlePath.absolutePath, metadata)) {
                 OneKeyLog.error("BundleUpdate", "verifyExtractedBundle: bundle pair compatibility check failed")
-                throw Exception("Bundle pair compatibility check failed")
+                throw BundleUpdateError("INCOMPATIBLE", "verifyPackage")
             }
             OneKeyLog.info("BundleUpdate", "verifyExtractedBundle: all files verified OK, fileCount=${metadata.size}")
         }
@@ -2348,19 +2674,15 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
     override fun listLocalBundles(): Promise<Array<LocalBundleInfo>> {
         return Promise.async {
             val context = getContext()
+            val appVersion = BundleUpdateStoreAndroid.getAppVersion(context) ?: return@async emptyArray<LocalBundleInfo>()
             val bundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context))
             val results = mutableListOf<LocalBundleInfo>()
             if (bundleDir.exists() && bundleDir.isDirectory) {
                 bundleDir.listFiles()?.forEach { child ->
                     if (!child.isDirectory) return@forEach
                     val name = child.name
-                    val lastDash = name.lastIndexOf('-')
-                    if (lastDash <= 0) return@forEach
-                    val appVer = name.substring(0, lastDash)
-                    val bundleVer = name.substring(lastDash + 1)
-                    if (appVer.isNotEmpty() && bundleVer.isNotEmpty()) {
-                        results.add(LocalBundleInfo(appVersion = appVer, bundleVersion = bundleVer))
-                    }
+                    val bundleVersion = BundleUpdateStoreAndroid.bundleVersionInFolder(name, appVersion) ?: return@forEach
+                    results.add(LocalBundleInfo(appVersion = appVersion, bundleVersion = bundleVersion))
                 }
             }
             OneKeyLog.info("BundleUpdate", "listLocalBundles: found ${results.size} bundles")
@@ -2415,10 +2737,24 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 
     override fun testDeleteJsBundle(appVersion: String, bundleVersion: String): Promise<TestResult> {
         return Promise.async {
+            if (!BuildConfig.DEBUG) {
+                throw SecurityException("Test fault-injection methods are disabled in release builds")
+            }
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw SecurityException("Invalid version string")
+            }
             OneKeyLog.info("BundleUpdate", "testDeleteJsBundle: appVersion=$appVersion, bundleVersion=$bundleVersion")
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
-            val jsBundlePath = File(File(BundleUpdateStoreAndroid.getBundleDir(context), folderName), "main.jsbundle.hbc")
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
+            val bundleDirPath = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!bundleDirPath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
+            val jsBundlePath = File(bundleDirPath, "main.jsbundle.hbc")
+            if (!jsBundlePath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
 
             if (jsBundlePath.exists()) {
                 val success = jsBundlePath.delete()
@@ -2438,10 +2774,20 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 
     override fun testDeleteJsRuntimeDir(appVersion: String, bundleVersion: String): Promise<TestResult> {
         return Promise.async {
+            if (!BuildConfig.DEBUG) {
+                throw SecurityException("Test fault-injection methods are disabled in release builds")
+            }
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw SecurityException("Invalid version string")
+            }
             OneKeyLog.info("BundleUpdate", "testDeleteJsRuntimeDir: appVersion=$appVersion, bundleVersion=$bundleVersion")
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val dir = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!dir.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
 
             if (dir.exists()) {
                 BundleUpdateStoreAndroid.deleteDir(dir)
@@ -2461,10 +2807,24 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 
     override fun testDeleteMetadataJson(appVersion: String, bundleVersion: String): Promise<TestResult> {
         return Promise.async {
+            if (!BuildConfig.DEBUG) {
+                throw SecurityException("Test fault-injection methods are disabled in release builds")
+            }
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw SecurityException("Invalid version string")
+            }
             OneKeyLog.info("BundleUpdate", "testDeleteMetadataJson: appVersion=$appVersion, bundleVersion=$bundleVersion")
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
-            val metadataFile = File(File(BundleUpdateStoreAndroid.getBundleDir(context), folderName), "metadata.json")
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
+            val bundleDirPath = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!bundleDirPath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
+            val metadataFile = File(bundleDirPath, "metadata.json")
+            if (!metadataFile.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
 
             if (metadataFile.exists()) {
                 val success = metadataFile.delete()
@@ -2484,11 +2844,24 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
 
     override fun testWriteEmptyMetadataJson(appVersion: String, bundleVersion: String): Promise<TestResult> {
         return Promise.async {
+            if (!BuildConfig.DEBUG) {
+                throw SecurityException("Test fault-injection methods are disabled in release builds")
+            }
+            if (!isSafeVersionString(appVersion) || !isSafeVersionString(bundleVersion)) {
+                throw SecurityException("Invalid version string")
+            }
             OneKeyLog.info("BundleUpdate", "testWriteEmptyMetadataJson: appVersion=$appVersion, bundleVersion=$bundleVersion")
             val context = getContext()
             val folderName = "$appVersion-$bundleVersion"
+            val baseBundleDir = File(BundleUpdateStoreAndroid.getBundleDir(context)).canonicalPath
             val jsRuntimeDir = File(BundleUpdateStoreAndroid.getBundleDir(context), folderName)
+            if (!jsRuntimeDir.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
             val metadataPath = File(jsRuntimeDir, "metadata.json")
+            if (!metadataPath.canonicalPath.startsWith(baseBundleDir + File.separator)) {
+                throw SecurityException("Bundle path outside bundle directory")
+            }
 
             if (!jsRuntimeDir.exists()) {
                 if (!jsRuntimeDir.mkdirs()) {
@@ -2508,3 +2881,4 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
         }
     }
 }
+