@onekeyfe/react-native-range-downloader 3.0.65 → 3.0.67

package/android/src/main/java/com/margelo/nitro/reactnativerangedownloader/ConcurrentRangeDownloader.kt

@@ -3,7 +3,8 @@ package com.margelo.nitro.reactnativerangedownloader
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import java.io.File
-import java.io.RandomAccessFile
+import java.io.FileInputStream
+import java.io.FileOutputStream
 import java.util.concurrent.Executors
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.atomic.AtomicLong
@@ -11,26 +12,43 @@ import java.util.concurrent.atomic.AtomicReference
 
 /**
  * Splits a Range-capable download into [segmentCount] byte ranges fetched in
- * parallel, each written directly into its own offset of ONE pre-allocated
- * `.partial` file (no merge pass, 1x disk). A sidecar `<partial>.progress`
- * manifest records each segment's durably-written cursor so an interrupted
- * download resumes by re-requesting only the unfinished tail of each segment.
+ * parallel, each STREAMED INTO ITS OWN sibling file `<partial>.segN` with plain
+ * sequential `FileOutputStream` appends (O_WRONLY). Once every segment file is
+ * fully present, the segments are concatenated in order into the `.partial`
+ * (and freed as they are consumed, so the peak footprint stays ~1x the file
+ * plus one segment). Mirrors the iOS RangeDownloader segment-file model.
  *
- * Mirrors the desktop DesktopApiBundleUpdate concurrent path. This class is
- * intentionally free of Android/OneKey dependencies (logging is injected) so
- * it can be unit/type-checked standalone; the whole-file SHA256 check the
- * caller already performs after promotion is the final correctness backstop.
+ * Why segment files instead of one pre-allocated `.partial` with positioned
+ * writes: the previous design pre-allocated the full size up front via
+ * `RandomAccessFile(partial, "rw").setLength(total)`. That O_RDWR open +
+ * large reservation fails with EROFS/ENOSPC on near-full f2fs devices (and any
+ * storage that rejects a large up-front reservation), aborting the WHOLE
+ * download before a byte is fetched. This design only ever does plain O_WRONLY
+ * sequential writes (segment fetch + concat) and O_RDONLY reads — the same I/O
+ * shape as the caller's proven single-stream path — so it grows incrementally
+ * up to the real space limit instead of reserving everything at once.
  *
- * Invariant: the manifest is only meaningful as metadata for an existing
- * `.partial`. Either both exist (resume) or neither does (fresh) — any other
- * combination is treated as "no resumable state".
+ * Resume across kill/suspend is simply "which `<partial>.segN` already exist
+ * and how big" plus "how far the `.partial` concat already committed": a
+ * full-sized segment is kept; a short one resumes from its current length via
+ * `Range`; a segment whose extent is already inside the committed `.partial`
+ * prefix is done even if its `.segN` was deleted mid-concat. Object identity is
+ * intentionally NOT pinned (no ETag/If-Range) — resume is unconditional, and a
+ * mid-flight object swap that slips through is caught by the caller's whole-file
+ * SHA256 + GPG verify after promotion, which then drives a clean full
+ * re-download (concat deletes every `.segN` on success). That verify is the sole
+ * correctness backstop. The only validator-free safety nets kept inline are: a
+ * 200 to a Range request → FallbackException, an over-long/oversized segment →
+ * discard, and a per-segment Content-Range bounds check against mis-aligned 206s.
+ *
+ * This class is intentionally free of Android/OneKey dependencies (logging is
+ * injected) so it can be unit/type-checked standalone.
  */
 class ConcurrentRangeDownloader(
     private val httpClient: OkHttpClient,
     private val segmentCount: Int = 8,
     private val minConcurrentBytes: Long = 2L * 1024 * 1024,
     private val maxPartRetry: Int = 3,
-    private val manifestFlushBytes: Long = 4L * 1024 * 1024,
     private val log: (String) -> Unit = {},
 ) {
     enum class Outcome {
@@ -48,7 +66,7 @@ class ConcurrentRangeDownloader(
      * Cooperative-cancel handle the caller can register a download against. The
      * adapter keeps these in a per-taskId registry so `cancel`/`discardArtifacts`
      * can flip [aborted] and `shutdownNow()` the worker pool BEFORE deleting the
-     * `.partial`/`.progress`, so no in-flight worker resurrects a deleted file.
+     * segment files, so no in-flight worker resurrects a deleted file.
      */
     class CancelHandle {
         val aborted = AtomicBoolean(false)
@@ -69,20 +87,17 @@ class ConcurrentRangeDownloader(
         }
     }
 
-    private class Part(val index: Int, val start: Long, val end: Long, done: Long) {
-        // AtomicLong so manifest snapshots read a consistent value even if the
-        // owning thread ever changes (cross-thread reads in flushManifest).
-        val done = AtomicLong(done)
+    private class Part(val index: Int, val start: Long, val end: Long) {
         val length: Long get() = end - start + 1
     }
 
-    private class Probe(val totalSize: Long, val etag: String?, val supportsRange: Boolean)
+    private class Probe(val totalSize: Long, val supportsRange: Boolean)
 
     /**
      * Fills [partialFilePath] completely with the resource at [url] using
      * concurrent ranges. See [Outcome]. Throws on a transient/IO error after
-     * per-segment retries, leaving the partial + manifest in place so a later
-     * attempt resumes.
+     * per-segment retries, leaving the segment files in place so a later attempt
+     * resumes.
      */
     fun download(
         url: String,
@@ -91,11 +106,12 @@ class ConcurrentRangeDownloader(
         onProgress: (transferred: Long, total: Long) -> Unit,
     ): Outcome {
         val partialFile = File(partialFilePath)
-        val manifestFile = File("$partialFilePath.progress")
+        val segFile: (Int) -> File = { index -> File("$partialFilePath.seg$index") }
 
-        // A bare `.partial` with no manifest is a single-stream leftover; let
-        // the caller's single-stream path resume it instead of discarding it.
-        if (partialFile.exists() && !manifestFile.exists()) {
+        // A bare `.partial` with NO segment files is a single-stream leftover;
+        // let the caller's single-stream path resume it instead of touching it.
+        val anyLeftoverSeg = (0 until segmentCount).any { segFile(it).exists() }
+        if (partialFile.exists() && !anyLeftoverSeg) {
             log("concurrent: single-stream partial present, deferring to single-stream")
             return Outcome.FALLBACK
         }
@@ -106,19 +122,46 @@ class ConcurrentRangeDownloader(
             return Outcome.FALLBACK
         }
         val total = probe.totalSize
-        val etag = probe.etag
-        // A strong validator (ETag) is what lets If-Range pin a resumed range to
-        // the exact object the partial was started against. Without it we cannot
-        // safely trust or persist `.partial`/`.progress` across attempts, so we
-        // start fresh and skip manifest persistence (the caller's whole-file
-        // SHA256 check after promotion remains the final correctness backstop).
-        val hasValidator = !etag.isNullOrEmpty()
 
         partialFile.parentFile?.let { if (!it.exists()) it.mkdirs() }
-        dropOrphanManifest(partialFile, manifestFile)
-        val parts = loadOrInitManifest(manifestFile, partialFile, total, etag, hasValidator)
 
-        val transferred = AtomicLong(parts.sumOf { it.done.get() })
+        val parts = planRanges(total)
+
+        // Resume is unconditional: object identity is NOT pinned (no ETag) — any
+        // mid-flight object swap that survives this far is caught by the caller's
+        // whole-file SHA256/GPG verify, which then drives a clean full re-download
+        // (concat deletes every `.segN` on success, so the retry starts fresh).
+        // We therefore never wipe `.segN` for "no/changed validator" reasons.
+
+        // Discard any leftover segment that can't belong to this plan (wrong
+        // length = different object/range, or an index beyond the plan). This is
+        // a pure size check, independent of any validator.
+        for (i in 0 until segmentCount) {
+            val f = segFile(i)
+            if (!f.exists()) continue
+            val expected = parts.getOrNull(i)?.length
+            if (expected == null || f.length() > expected) {
+                log("concurrent: discarding stale/oversized segment $i")
+                f.delete()
+            }
+        }
+
+        // `.partial`'s current length is the committed-concat cursor: every byte
+        // below it has already been appended into `.partial` and its source
+        // `.segN` may have been deleted by an interrupted concat. Such prefix
+        // segments are DONE — they must not be re-fetched (that would waste the
+        // network and break the "~1x + one segment" footprint target).
+        val committedBytes = if (partialFile.exists()) partialFile.length() else 0L
+        // A segment is "committed" when `.partial` already covers its full extent.
+        val isCommitted: (Part) -> Boolean = { committedBytes >= it.start + it.length }
+
+        // Progress baseline: committed bytes already in `.partial`, plus the
+        // current length of every not-yet-committed segment file (committed
+        // segments are already accounted for by `committedBytes`, so adding their
+        // `.segN` length — if it still exists — would double-count).
+        val transferred = AtomicLong(
+            committedBytes + parts.filterNot(isCommitted).sumOf { segFile(it.index).length() }
+        )
         onProgress(transferred.get(), total)
 
         // Share the abort flag with the cancel handle so an external cancel() is
@@ -126,94 +169,97 @@ class ConcurrentRangeDownloader(
         val aborted = cancelHandle?.aborted ?: AtomicBoolean(false)
         val fallback = AtomicBoolean(false)
         val firstError = AtomicReference<Exception?>(null)
-        val lastFlushed = LongArray(parts.size) { parts[it].done.get() }
 
-        val pool = Executors.newFixedThreadPool(minOf(segmentCount, parts.size))
-        cancelHandle?.attach(pool)
-        try {
-            val futures = parts.map { part ->
-                pool.submit {
-                    try {
-                        downloadPart(url, etag, partialFile, part, aborted) { delta ->
-                            val t = transferred.addAndGet(delta)
-                            if (hasValidator) {
-                                synchronized(lastFlushed) {
-                                    if (part.done.get() - lastFlushed[part.index] >= manifestFlushBytes) {
-                                        lastFlushed[part.index] = part.done.get()
-                                        flushManifest(manifestFile, total, etag, parts)
-                                    }
-                                }
+        // Only segments not yet fully on disk AND not already committed into
+        // `.partial` need fetching. A committed prefix segment whose `.segN` was
+        // deleted by an interrupted concat must NOT be treated as missing.
+        val pending = parts.filterNot(isCommitted).filter { segFile(it.index).length() < it.length }
+        if (pending.isNotEmpty()) {
+            val pool = Executors.newFixedThreadPool(minOf(segmentCount, pending.size))
+            cancelHandle?.attach(pool)
+            try {
+                val futures = pending.map { part ->
+                    pool.submit {
+                        try {
+                            downloadSegment(url, segFile(part.index), part, aborted) { delta ->
+                                onProgress(transferred.addAndGet(delta), total)
                             }
-                            onProgress(t, total)
+                        } catch (e: FallbackException) {
+                            fallback.set(true)
+                            aborted.set(true)
+                            firstError.compareAndSet(null, e)
+                        } catch (e: Exception) {
+                            aborted.set(true)
+                            firstError.compareAndSet(null, e)
                         }
-                    } catch (e: FallbackException) {
-                        fallback.set(true)
-                        aborted.set(true)
-                        firstError.compareAndSet(null, e)
-                    } catch (e: Exception) {
-                        aborted.set(true)
-                        firstError.compareAndSet(null, e)
                     }
                 }
+                futures.forEach { it.get() }
+            } finally {
+                pool.shutdownNow()
             }
-            futures.forEach { it.get() }
-        } finally {
-            pool.shutdownNow()
         }
 
         if (fallback.get()) {
             // Stale/unusable bytes — clear before the caller falls back.
-            discard(partialFile, manifestFile)
+            wipeArtifacts(partialFile, segFile)
             return Outcome.FALLBACK
         }
         val err = firstError.get()
         if (err != null) {
-            if (hasValidator) {
-                // Transient — persist progress so the next attempt resumes, then bubble up.
-                flushManifest(manifestFile, total, etag, parts)
-            } else {
-                // No validator: resume state is untrustworthy, so don't persist
-                // it — discard and let the next attempt start clean.
-                discard(partialFile, manifestFile)
-            }
+            // Transient. Always keep the segment files so the next attempt
+            // resumes — resume is unconditional now (no validator gate).
             throw err
         }
-        val got = parts.sumOf { it.done.get() }
-        if (got < total) {
-            if (hasValidator) {
-                flushManifest(manifestFile, total, etag, parts)
-            } else {
-                discard(partialFile, manifestFile)
-            }
-            throw java.io.IOException("Concurrent download incomplete ($got/$total)")
+        // A committed prefix segment is complete even though its `.segN` is gone;
+        // only not-yet-committed segments must have a full-length `.segN`.
+        val incomplete = parts.filterNot(isCommitted)
+            .firstOrNull { segFile(it.index).length() != it.length }
+        if (incomplete != null) {
+            // Keep the segment files for the next attempt to resume.
+            throw java.io.IOException("Concurrent download incomplete (segment ${incomplete.index})")
         }
 
-        // Success: `.partial` is fully filled. The manifest's job is done and it
-        // must never outlive the `.partial` it describes (caller is about to
-        // promote it), so drop it now.
-        manifestFile.delete()
+        // All segments complete → assemble the `.partial`.
+        concatenate(partialFile, parts, segFile, total)
         log("concurrent: completed ($total bytes)")
         return Outcome.COMPLETED
     }
 
+    private fun planRanges(total: Long): List<Part> {
+        val parts = ArrayList<Part>()
+        val chunk = (total + segmentCount - 1) / segmentCount
+        var i = 0
+        while (i < segmentCount) {
+            val start = i * chunk
+            if (start >= total) break
+            val end = minOf(start + chunk - 1, total - 1)
+            parts.add(Part(parts.size, start, end))
+            i += 1
+        }
+        return parts
+    }
+
     // Single round-trip probe: a one-byte Range request that confirms Range
-    // support and captures total size + ETag. OkHttp follows redirects (the
-    // caller's client enforces HTTPS on each hop).
+    // support and captures total size. Object identity is intentionally NOT
+    // validated here (no ETag/If-Range) — the caller's whole-file SHA256 + GPG
+    // verify after promotion is the sole correctness backstop, so resume is
+    // always allowed. OkHttp follows redirects (the caller's client enforces
+    // HTTPS on each hop).
     private fun probe(url: String): Probe? {
         return try {
             val req = Request.Builder().url(url).addHeader("Range", "bytes=0-0").build()
             httpClient.newCall(req).execute().use { response ->
-                val etag = response.header("ETag")
                 when (response.code) {
                     206 -> {
                         val total = response.header("Content-Range")
                             ?.let { Regex("""bytes \d+-\d+/(\d+)""").find(it)?.groupValues?.getOrNull(1)?.toLongOrNull() }
-                        if (total != null) Probe(total, etag, true) else Probe(0, etag, false)
+                        if (total != null) Probe(total, true) else Probe(0, false)
                     }
                     200 -> {
                         // Server ignored Range — single-stream only.
                         val len = response.body?.contentLength() ?: -1L
-                        Probe(if (len > 0) len else 0, etag, false)
+                        Probe(if (len > 0) len else 0, false)
                     }
                     else -> null
                 }
@@ -224,113 +270,68 @@ class ConcurrentRangeDownloader(
         }
     }
 
-    private fun dropOrphanManifest(partialFile: File, manifestFile: File) {
-        if (!partialFile.exists() && manifestFile.exists()) {
-            log("concurrent: dropping orphan manifest")
-            manifestFile.delete()
-        }
-    }
-
-    private fun discard(partialFile: File, manifestFile: File) {
-        // Manifest first so it never outlives the partial it describes.
-        manifestFile.delete()
+    private fun wipeArtifacts(partialFile: File, segFile: (Int) -> File) {
         partialFile.delete()
+        for (i in 0 until segmentCount) segFile(i).delete()
     }
 
-    // Resume from a manifest whose size/ETag still match, else (re)create a
-    // fresh pre-allocated partial + manifest. Manifest is removed before the
-    // partial is (re)created, and written only after the partial exists.
-    private fun loadOrInitManifest(
-        manifestFile: File,
+    // Concatenate the completed segment files, in order, into the `.partial`.
+    // Append-mode + the `.partial`'s current length as the resume cursor make
+    // this idempotent and crash-safe: an interrupted concat resumes where it
+    // left off, and each segment is deleted only after it has been fully
+    // appended, so the peak footprint stays ~1x the file plus one segment
+    // (critical on near-full devices — a 2x "all segs + full copy" peak would
+    // re-introduce the out-of-space failure this design exists to avoid).
+    private fun concatenate(
         partialFile: File,
+        parts: List<Part>,
+        segFile: (Int) -> File,
         total: Long,
-        etag: String?,
-        hasValidator: Boolean,
-    ): List<Part> {
-        // Only trust an existing manifest when a strong validator pins it to the
-        // server object; otherwise always start fresh.
-        if (hasValidator && manifestFile.exists() && partialFile.exists()) {
-            val parsed = parseManifest(manifestFile, total, etag, partialFile.length())
-            if (parsed != null) {
-                log("concurrent: resuming, transferred=${parsed.sumOf { it.done.get() }}/$total")
-                return parsed
-            }
-        }
-        discard(partialFile, manifestFile)
-        RandomAccessFile(partialFile, "rw").use { it.setLength(total) }
-        val parts = ArrayList<Part>()
-        val chunk = (total + segmentCount - 1) / segmentCount
-        var i = 0
-        while (i < segmentCount) {
-            val start = i * chunk
-            if (start >= total) break
-            val end = minOf(start + chunk - 1, total - 1)
-            parts.add(Part(parts.size, start, end, 0))
-            i += 1
-        }
-        // Persist the manifest only when it can be safely resumed later.
-        if (hasValidator) writeManifest(manifestFile, total, etag, parts)
-        return parts
-    }
-
-    // Manifest format (dependency-free, internal): line 0 "<size>|<etag>",
-    // then one "<index>,<start>,<end>,<done>" line per segment.
-    private fun writeManifest(manifestFile: File, total: Long, etag: String?, parts: List<Part>) {
-        val sb = StringBuilder()
-        sb.append(total).append('|').append(etag ?: "").append('\n')
-        for (p in parts) {
-            sb.append(p.index).append(',').append(p.start).append(',')
-                .append(p.end).append(',').append(p.done.get()).append('\n')
-        }
-        manifestFile.writeText(sb.toString())
-    }
-
-    @Synchronized
-    private fun flushManifest(manifestFile: File, total: Long, etag: String?, parts: List<Part>) {
-        try {
-            writeManifest(manifestFile, total, etag, parts)
-        } catch (e: Exception) {
-            log("concurrent: manifest flush failed: ${e.javaClass.simpleName}")
+    ) {
+        var written = if (partialFile.exists()) partialFile.length() else 0L
+        if (written > total) {
+            // Corrupt/over-long prior concat — restart clean.
+            partialFile.delete()
+            written = 0L
         }
-    }
-
-    private fun parseManifest(manifestFile: File, total: Long, etag: String?, partialSize: Long): List<Part>? {
-        return try {
-            val lines = manifestFile.readText().trim().split('\n')
-            if (lines.isEmpty()) return null
-            val head = lines[0].split('|')
-            val savedSize = head.getOrNull(0)?.toLongOrNull() ?: return null
-            val savedEtag = head.getOrNull(1)?.takeIf { it.isNotEmpty() }
-            // Object must be identical to what's on disk and on the CDN.
-            if (savedSize != total || partialSize != total) return null
-            if (etag != null && savedEtag != null && etag != savedEtag) return null
-            val parts = ArrayList<Part>()
-            for (idx in 1 until lines.size) {
-                val cols = lines[idx].split(',')
-                if (cols.size != 4) return null
-                val i = cols[0].toIntOrNull() ?: return null
-                val s = cols[1].toLongOrNull() ?: return null
-                val e = cols[2].toLongOrNull() ?: return null
-                var d = cols[3].toLongOrNull() ?: return null
-                val segLen = e - s + 1
-                if (d < 0) d = 0
-                if (d > segLen) d = segLen
-                parts.add(Part(i, s, e, d))
+        FileOutputStream(partialFile, /* append = */ true).use { out ->
+            var cursor = 0L
+            for (part in parts) {
+                val segEndInFinal = cursor + part.length
+                if (written < segEndInFinal) {
+                    val seg = segFile(part.index)
+                    // Skip the prefix of this segment that a prior interrupted
+                    // concat already appended (append always writes at EOF).
+                    val skip = (written - cursor).coerceAtLeast(0L)
+                    FileInputStream(seg).use { input ->
+                        var toSkip = skip
+                        while (toSkip > 0) {
+                            val s = input.skip(toSkip)
+                            if (s <= 0) break
+                            toSkip -= s
+                        }
+                        input.copyTo(out)
+                    }
+                    out.flush()
+                    written = segEndInFinal
+                }
+                cursor = segEndInFinal
+                segFile(part.index).delete()
             }
-            if (parts.isEmpty()) null else parts
-        } catch (e: Exception) {
-            log("concurrent: manifest parse failed: ${e.javaClass.simpleName}")
-            null
+        }
+        if (partialFile.length() != total) {
+            partialFile.delete()
+            throw java.io.IOException("Concat size mismatch (${partialFile.length()}/$total)")
         }
     }
 
-    // Download [start+done, end] of [part] into its own RandomAccessFile handle
-    // (each segment gets its own fd so concurrent positioned writes don't race),
-    // resuming from part.done and retrying transient failures in place.
-    private fun downloadPart(
+    // Fetch [start+have, end] of [part] into its OWN segment file via plain
+    // sequential O_WRONLY appends (no positioned writes, no pre-allocation),
+    // resuming from the segment file's current length and retrying transient
+    // failures in place.
+    private fun downloadSegment(
         url: String,
-        etag: String?,
-        partialFile: File,
+        segFile: File,
         part: Part,
         aborted: AtomicBoolean,
         onBytes: (delta: Long) -> Unit,
@@ -338,10 +339,11 @@ class ConcurrentRangeDownloader(
         var retry = 0
         while (true) {
             if (aborted.get()) throw java.io.IOException("aborted")
-            val rangeStart = part.start + part.done.get()
-            if (rangeStart > part.end) return
+            val have = segFile.length()
+            if (have >= part.length) return
+            val rangeStart = part.start + have
             try {
-                fetchSegment(url, etag, partialFile, part, rangeStart, aborted, onBytes)
+                fetchSegment(url, segFile, part, rangeStart, aborted, onBytes)
                 return
             } catch (e: FallbackException) {
                 throw e
@@ -355,40 +357,74 @@ class ConcurrentRangeDownloader(
 
     private fun fetchSegment(
         url: String,
-        etag: String?,
-        partialFile: File,
+        segFile: File,
         part: Part,
         rangeStart: Long,
         aborted: AtomicBoolean,
         onBytes: (delta: Long) -> Unit,
     ) {
-        val builder = Request.Builder().url(url)
+        val request = Request.Builder().url(url)
             .addHeader("Range", "bytes=$rangeStart-${part.end}")
-        // If-Range: a mismatched ETag makes the CDN reply 200 (full body)
-        // instead of 206, which we treat as a fallback signal.
-        if (etag != null) builder.addHeader("If-Range", etag)
-        httpClient.newCall(builder.build()).execute().use { response ->
+            .build()
+        httpClient.newCall(request).execute().use { response ->
+            // A 200 (full body) to a Range request is the one validator-free
+            // safety net we keep: appending a from-zero body onto a partially
+            // filled segment would corrupt it, so bail to the single-stream path.
             if (response.code == 200) {
                 throw FallbackException("server returned 200 to a Range request")
             }
             if (response.code != 206) {
                 throw java.io.IOException("HTTP ${response.code}")
             }
+            // Verify the 206 covers exactly the slice we asked for. This guards
+            // against a proxy/CDN returning a mis-aligned 206 (wrong window),
+            // which would otherwise silently corrupt the assembled file. A
+            // missing/mismatched Content-Range is treated as transient (retry).
+            // It canNOT detect an object swapped behind an identical window —
+            // that is the caller's whole-file SHA256/GPG verify's job.
+            val contentRange = response.header("Content-Range")
+                ?: throw java.io.IOException("206 without Content-Range")
+            val bounds = parseContentRangeBounds(contentRange)
+                ?: throw java.io.IOException("unparseable Content-Range: $contentRange")
+            if (bounds.first != rangeStart || bounds.second != part.end) {
+                throw java.io.IOException(
+                    "Content-Range mismatch: got ${bounds.first}-${bounds.second}, " +
+                        "expected $rangeStart-${part.end}"
+                )
+            }
             val body = response.body ?: throw java.io.IOException("Empty segment body")
-            RandomAccessFile(partialFile, "rw").use { raf ->
-                raf.seek(rangeStart)
+            // Append the fetched tail to the segment file. Append mode keeps
+            // resume correct: we only ever request the bytes not yet on disk.
+            FileOutputStream(segFile, /* append = */ true).use { out ->
                 body.byteStream().use { input ->
                     val buffer = ByteArray(8192)
                     while (true) {
                         if (aborted.get()) throw java.io.IOException("aborted")
                         val read = input.read(buffer)
                         if (read == -1) break
-                        raf.write(buffer, 0, read)
-                        part.done.addAndGet(read.toLong())
+                        out.write(buffer, 0, read)
                         onBytes(read.toLong())
                     }
                 }
             }
         }
+        // A 206 can still over-deliver (server ignored our end bound). A segment
+        // longer than its planned length is unusable — drop it so the next
+        // attempt re-fetches cleanly rather than concatenating misaligned bytes.
+        if (segFile.length() > part.length) {
+            segFile.delete()
+            throw java.io.IOException(
+                "Segment ${part.index} overran (${segFile.length()}/${part.length})"
+            )
+        }
+    }
+
+    // Parse "bytes <start>-<end>/<total>" → (start, end). Returns null when the
+    // header is absent-of-bounds (e.g. "bytes */1234") or otherwise unparseable.
+    private fun parseContentRangeBounds(value: String): Pair<Long, Long>? {
+        val m = Regex("""bytes\s+(\d+)-(\d+)/""").find(value) ?: return null
+        val start = m.groupValues[1].toLongOrNull() ?: return null
+        val end = m.groupValues[2].toLongOrNull() ?: return null
+        return start to end
     }
 }

package/android/src/main/java/com/margelo/nitro/reactnativerangedownloader/ReactNativeRangeDownloader.kt

@@ -10,20 +10,23 @@ import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.CopyOnWriteArrayList
 import java.util.concurrent.atomic.AtomicLong
 
-// P1: faithful migration of the Android concurrent multi-range downloader.
+// P1: Nitro adapter for the Android concurrent multi-range downloader.
 //
-// The core algorithm (.partial preallocation + .progress manifest resume +
-// 8-segment thread pool + If-Range/200 fallback) lives unchanged in the
-// in-module ConcurrentRangeDownloader helper, copied byte-for-byte from
-// react-native-bundle-update. This class is the Nitro adapter: it builds the
-// HTTPS-only OkHttpClient, drives the helper, finalizes on COMPLETED (promote
-// .partial -> dest + optional SHA256 self-check), and bridges progress to the
-// shared listener registry as RangeDownloadEvent (tagged with channel/taskId).
+// The core algorithm lives in the in-module ConcurrentRangeDownloader helper:
+// each of the N segments streams into its own sibling file
+// `<dest>.partial.seg0` .. `<dest>.partial.segN-1` (no whole-file preallocation,
+// no `.progress` manifest), and on success the segments are concatenated in
+// order into `<dest>.partial`. Resume re-uses whatever bytes each `.segN`
+// already holds. An 8-segment thread pool plus a 200-to-a-Range fallback round
+// it out (object identity is not pinned — no ETag/If-Range; the optional
+// whole-file SHA256 self-check below is the correctness backstop). This class
+// builds the HTTPS-only OkHttpClient, drives the helper,
+// finalizes on COMPLETED (promote .partial -> dest + optional SHA256
+// self-check), and bridges progress to the shared listener registry as
+// RangeDownloadEvent (tagged with channel/taskId).
 //
 // Android has no background-session concept: `channel` is only an event label
-// + artifact-directory tag and does not change the download mechanism. The
-// on-disk format (.partial + .progress) is kept exactly as shipped so existing
-// interrupted downloads resume cleanly.
+// + artifact-directory tag and does not change the download mechanism.
 @DoNotStrip
 class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
 
@@ -83,7 +86,12 @@ class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
       val cancelHandle = ConcurrentRangeDownloader.CancelHandle()
       activeDownloads[runKey] = cancelHandle
 
-      var lastProgress = -1
+      // The progress callback is invoked concurrently by the helper's worker
+      // threads, so guard lastProgress with an AtomicInteger + CAS: only the
+      // thread that advances the percentage to a strictly higher value wins the
+      // CAS and emits the event, which keeps progress monotonic and de-duped
+      // without a lock (this only affects event ordering, never file bytes).
+      val lastProgress = java.util.concurrent.atomic.AtomicInteger(-1)
       val outcome = try {
         ConcurrentRangeDownloader(
           httpClient = httpClient,
@@ -93,9 +101,9 @@ class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
         ).download(downloadUrl, partialFilePath, cancelHandle) { transferred, total ->
           if (total > 0) {
             val p = ((transferred * 100) / total).toInt().coerceIn(0, 100)
-            if (p != lastProgress) {
+            val prev = lastProgress.get()
+            if (p > prev && lastProgress.compareAndSet(prev, p)) {
               sendEvent(channel, taskId, type = "progress", progress = p)
-              lastProgress = p
             }
           }
         }
@@ -158,9 +166,11 @@ class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
       // files, otherwise a still-running segment could re-create the .partial we
       // just deleted.
       cancelActive(channel, taskId)
-      // Manifest first so it never outlives the partial it describes.
-      File("$destFilePath.partial.progress").delete()
-      File("$destFilePath.partial").delete()
+      // Sweep the per-segment `.segN` files plus the concatenated `.partial` so a
+      // future resume can't re-trust stale bytes (no `.progress` manifest exists
+      // anymore in the segmented model). Glob by filename prefix so any custom
+      // segmentCount is fully cleared, not just the shipped default of 8.
+      sweepPartialArtifacts(destFilePath)
       OneKeyLog.info("RangeDownloader", "discardArtifacts: channel=$channel taskId=$taskId")
       Unit
     }
@@ -174,8 +184,9 @@ class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
     return Promise.async {
       // Stop workers first, then delete artifacts so nothing resurrects them.
       cancelActive(channel, taskId)
-      File("$destFilePath.partial.progress").delete()
-      File("$destFilePath.partial").delete()
+      // Same segmented-artifact sweep as discardArtifacts: glob every per-segment
+      // `.segN` file by prefix plus the concatenated `.partial`.
+      sweepPartialArtifacts(destFilePath)
       OneKeyLog.info("RangeDownloader", "cancel: channel=$channel taskId=$taskId")
       Unit
     }
@@ -186,6 +197,17 @@ class ReactNativeRangeDownloader : HybridReactNativeRangeDownloaderSpec() {
     activeDownloads.remove(runKey(channel, taskId))?.cancel()
   }
 
+  // Delete every sibling artifact for [destFilePath]: all `<dest>.partial.seg<N>`
+  // segment files (matched by filename prefix, so any segmentCount is swept, not
+  // just the shipped default) plus the concatenated `<dest>.partial` itself.
+  private fun sweepPartialArtifacts(destFilePath: String) {
+    val partial = File("$destFilePath.partial")
+    partial.parentFile
+      ?.listFiles { f -> f.name.startsWith(partial.name + ".seg") }
+      ?.forEach { it.delete() }
+    partial.delete()
+  }
+
   // Atomically replace [dest] with [src] so a kill mid-finalize never leaves
   // NEITHER file. On API 26+ uses Files.move with ATOMIC_MOVE/REPLACE_EXISTING
   // (single-step rename onto the destination). On older APIs (java.nio.file is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-range-downloader",
-  "version": "3.0.65",
+  "version": "3.0.67",
   "description": "react-native-range-downloader",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",