@protobase/mobile 0.57.1 → 0.57.3

package/android/src/liveupdate/java/net/protobase/mobile/ReleaseManifest.java

@@ -0,0 +1,98 @@
+package net.protobase.mobile;
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/**
+ * A release's manifest (`releaseManifestFile` in @protobase/schema): every file by `href`, with its sha256 and size.
+ * Each href is checked as the very string the guard joins to a folder, before any file of it is read or written.
+ */
+final class ReleaseManifest {
+
+    static final String FILE = "capawesome-live-update-manifest.json";
+    static final int MAX_BYTES = 4 * 1024 * 1024;
+    static final int MAX_FILES = 10_000;
+    static final long MAX_FILE_BYTES = 64L * 1024 * 1024;
+    static final long MAX_TOTAL_BYTES = 256L * 1024 * 1024;
+    private static final int MAX_HREF = 1024;
+
+    static final class Item {
+
+        final String href;
+        final String checksum;
+        final long size;
+
+        Item(String href, String checksum, long size) {
+            this.href = href;
+            this.checksum = checksum;
+            this.size = size;
+        }
+    }
+
+    final List<Item> items;
+
+    private ReleaseManifest(List<Item> items) {
+        this.items = Collections.unmodifiableList(items);
+    }
+
+    /** The manifest `bytes` hold, when they are the ones `statement` names, its files to lie inside `dir`. */
+    static ReleaseManifest verify(byte[] bytes, ReleaseStatement statement, File dir) throws BundleRefused {
+        if (!Sha256.of(bytes).equals(statement.manifest)) throw new BundleRefused("its manifest is not the one its statement names");
+        return parse(bytes, dir);
+    }
+
+    /** The manifest `bytes` hold, each href naming a file inside `dir`. */
+    static ReleaseManifest parse(byte[] bytes, File dir) throws BundleRefused {
+        if (bytes.length > MAX_BYTES) throw new BundleRefused("its manifest is too large");
+        try {
+            JSONArray array = new JSONArray(new String(bytes, StandardCharsets.UTF_8));
+            if (array.length() > MAX_FILES) throw new BundleRefused("its manifest lists too many files");
+            List<Item> items = new ArrayList<>();
+            Set<String> hrefs = new HashSet<>();
+            long total = 0;
+            for (int i = 0; i < array.length(); i++) {
+                Item item = item(array.getJSONObject(i), dir);
+                if (!hrefs.add(item.href)) throw new BundleRefused("its manifest lists " + item.href + " twice");
+                total += item.size;
+                if (total > MAX_TOTAL_BYTES) throw new BundleRefused("its files are too large");
+                items.add(item);
+            }
+            return new ReleaseManifest(items);
+        } catch (JSONException e) {
+            throw new BundleRefused("its manifest is malformed");
+        }
+    }
+
+    private static Item item(JSONObject entry, File dir) throws JSONException, BundleRefused {
+        if (entry.length() != 3) throw new BundleRefused("its manifest has an entry that is not an href, checksum and size");
+        String href = entry.getString("href");
+        String checksum = entry.getString("checksum");
+        Object size = entry.get("sizeInBytes");
+        if (!isRelativePath(href) || href.equals(FILE) || href.equals(ReleaseStatement.FILE) || !BundlesFolder.contains(dir, new File(dir, href))) {
+            throw new BundleRefused("its manifest names a file outside its folder");
+        }
+        if (!Hex.isHex(checksum, 64)) throw new BundleRefused("its manifest names no checksum for " + href);
+        if (!(size instanceof Integer || size instanceof Long) || ((Number) size).longValue() < 0 || ((Number) size).longValue() > MAX_FILE_BYTES) {
+            throw new BundleRefused("its manifest names no size for " + href);
+        }
+        return new Item(href, checksum, ((Number) size).longValue());
+    }
+
+    // Path components joined by `/`: none empty, `.` or `..`, and no `\` or NUL, so neither an absolute path nor one
+    // that climbs, nor one another platform reads otherwise.
+    static boolean isRelativePath(String href) {
+        if (href.isEmpty() || href.length() > MAX_HREF || href.indexOf('\\') >= 0 || href.indexOf('\0') >= 0) return false;
+        for (String part : href.split("/", -1)) {
+            if (part.isEmpty() || part.equals(".") || part.equals("..")) return false;
+        }
+        return true;
+    }
+}

package/android/src/liveupdate/java/net/protobase/mobile/ReleaseOrder.java

@@ -0,0 +1,46 @@
+package net.protobase.mobile;
+
+/**
+ * Release orders, compared element by element, a missing element counting as 0, so a later server can add one without
+ * breaking binaries already shipped. Kept as text such as `1800000000000,0`.
+ */
+final class ReleaseOrder {
+
+    /** The built-in bundle's order. */
+    static final long[] BUILT_IN = { 0 };
+
+    private ReleaseOrder() {}
+
+    static int compare(long[] a, long[] b) {
+        for (int i = 0; i < Math.max(a.length, b.length); i++) {
+            long x = i < a.length ? a[i] : 0;
+            long y = i < b.length ? b[i] : 0;
+            if (x != y) return x < y ? -1 : 1;
+        }
+        return 0;
+    }
+
+    /**
+     * Refuses a bundle of order `next` as the next bundle unless it is above the running one's, `current`, and not below
+     * the highest order the app downloaded, `highest`.
+     */
+    static void acceptNext(long[] next, long[] current, long[] highest) throws BundleRefused {
+        if (compare(next, current) <= 0) throw new BundleRefused("it is not newer than the bundle the app runs");
+        if (compare(next, highest) < 0) throw new BundleRefused("it is older than a release the app downloaded");
+    }
+
+    static String format(long[] order) {
+        StringBuilder text = new StringBuilder();
+        for (int i = 0; i < order.length; i++) text.append(i == 0 ? "" : ",").append(order[i]);
+        return text.toString();
+    }
+
+    /** The order `text` holds, or the built-in bundle's for none. Only this class writes it. */
+    static long[] parse(String text) {
+        if (text == null || text.isEmpty()) return BUILT_IN;
+        String[] parts = text.split(",");
+        long[] order = new long[parts.length];
+        for (int i = 0; i < parts.length; i++) order[i] = Long.parseLong(parts[i]);
+        return order;
+    }
+}

package/android/src/liveupdate/java/net/protobase/mobile/ReleaseStatement.java

@@ -0,0 +1,124 @@
+package net.protobase.mobile;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+import java.util.regex.Pattern;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/**
+ * A release's statement (`releaseStatementFile` in @protobase/schema): what binds its manifest to its order, the app,
+ * the binary and the shell, signed with the app's key. Only bytes the signature covers are parsed for what they say.
+ */
+final class ReleaseStatement {
+
+    static final String FILE = "protobase-release.json";
+    static final int MAX_BYTES = 64 * 1024;
+    private static final byte[] CONTEXT = "protobase-mobile-release\n".getBytes(StandardCharsets.UTF_8);
+    private static final Set<String> KEYS = new HashSet<>(Arrays.asList("manifest", "order", "appId", "fingerprint", "shellVersion"));
+    private static final Pattern VERSION = Pattern.compile("(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)");
+    private static final int MAX_ORDER = 8;
+
+    final String manifest;
+    final long[] order;
+    final String appId;
+    final String fingerprint;
+    final String shellVersion;
+
+    private ReleaseStatement(String manifest, long[] order, String appId, String fingerprint, String shellVersion) {
+        this.manifest = manifest;
+        this.order = order;
+        this.appId = appId;
+        this.fingerprint = fingerprint;
+        this.shellVersion = shellVersion;
+    }
+
+    /**
+     * The statement `file` holds, when it is the one bundle `bundleId` names, the first 16 hex of the sha256 of its bytes
+     * and of `key`'s SPKI DER, as `composeRelease` derives it, and `key` signed what it says.
+     */
+    static ReleaseStatement verify(byte[] file, String bundleId, PublicKey key) throws BundleRefused {
+        if (file.length > MAX_BYTES) throw new BundleRefused("its statement is too large");
+        if (!Sha256.of(file, key.getEncoded()).substring(0, 16).equals(bundleId)) {
+            throw new BundleRefused("its id does not name its statement and the app's key");
+        }
+        byte[] payload;
+        byte[] signature;
+        try {
+            JSONObject outer = new JSONObject(new String(file, StandardCharsets.UTF_8));
+            payload = Hex.decode(outer.getString("payload"), "its statement's payload");
+            signature = Hex.decode(outer.getString("signature"), "its statement's signature");
+        } catch (JSONException e) {
+            throw new BundleRefused("its statement is malformed");
+        }
+        if (!signed(payload, signature, key)) throw new BundleRefused("its statement is not signed with the app's key");
+        try {
+            return parse(new JSONObject(new String(payload, StandardCharsets.UTF_8)));
+        } catch (JSONException e) {
+            throw new BundleRefused("its statement says nothing it can read");
+        }
+    }
+
+    private static boolean signed(byte[] payload, byte[] signature, PublicKey key) {
+        try {
+            Signature verifier = Signature.getInstance("SHA256withRSA");
+            verifier.initVerify(key);
+            verifier.update(CONTEXT);
+            verifier.update(payload);
+            return verifier.verify(signature);
+        } catch (SignatureException e) {
+            // A signature of the wrong length or shape.
+            return false;
+        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+            // Every runtime has SHA256withRSA, and load() takes only an RSA key.
+            throw new IllegalStateException(e);
+        }
+    }
+
+    private static ReleaseStatement parse(JSONObject payload) throws JSONException, BundleRefused {
+        Set<String> keys = new HashSet<>();
+        for (Iterator<String> it = payload.keys(); it.hasNext(); ) keys.add(it.next());
+        if (!keys.equals(KEYS)) throw new BundleRefused("its statement does not say exactly what binds it");
+        String manifest = payload.getString("manifest");
+        String appId = payload.getString("appId");
+        String fingerprint = payload.getString("fingerprint");
+        String shellVersion = payload.getString("shellVersion");
+        if (!Hex.isHex(manifest, 64)) throw new BundleRefused("its statement names no manifest hash");
+        if (appId.isEmpty()) throw new BundleRefused("its statement names no app");
+        if (!Hex.isHex(fingerprint, 16)) throw new BundleRefused("its statement names no fingerprint");
+        if (!VERSION.matcher(shellVersion).matches()) throw new BundleRefused("its statement names no shell version");
+        return new ReleaseStatement(manifest, order(payload.getJSONArray("order")), appId, fingerprint, shellVersion);
+    }
+
+    private static long[] order(JSONArray array) throws JSONException, BundleRefused {
+        if (array.length() == 0 || array.length() > MAX_ORDER) throw new BundleRefused("its statement names no order");
+        long[] order = new long[array.length()];
+        for (int i = 0; i < order.length; i++) {
+            Object part = array.get(i);
+            if (!(part instanceof Integer || part instanceof Long) || ((Number) part).longValue() < 0) {
+                throw new BundleRefused("its statement names no order");
+            }
+            order[i] = ((Number) part).longValue();
+        }
+        return order;
+    }
+
+    /** The major and minor of an x.y.z version this class accepted. */
+    static long[] majorMinor(String version) {
+        String[] parts = version.split("\\.");
+        return new long[] { Long.parseLong(parts[0]), Long.parseLong(parts[1]) };
+    }
+
+    static boolean isVersion(String version) {
+        return version != null && VERSION.matcher(version).matches();
+    }
+}

package/android/src/liveupdate/java/net/protobase/mobile/Sha256.java

@@ -0,0 +1,53 @@
+package net.protobase.mobile;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+/** SHA-256 in lowercase hex, of bytes, of a file, and of a bounded copy from a stream into a file. */
+final class Sha256 {
+
+    private Sha256() {}
+
+    static MessageDigest digest() {
+        try {
+            return MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            // Every Java and Android runtime has SHA-256.
+            throw new IllegalStateException(e);
+        }
+    }
+
+    static String of(byte[]... parts) {
+        MessageDigest digest = digest();
+        for (byte[] part : parts) digest.update(part);
+        return Hex.encode(digest.digest());
+    }
+
+    static String of(File file) throws IOException {
+        try (InputStream in = new FileInputStream(file)) {
+            return copy(in, null, Long.MAX_VALUE);
+        }
+    }
+
+    /**
+     * Hashes what `in` holds while writing it to `out` (none: only hashes), refusing more than `limit` bytes. Returns
+     * the hash, or null when `in` held more.
+     */
+    static String copy(InputStream in, OutputStream out, long limit) throws IOException {
+        MessageDigest digest = digest();
+        byte[] buffer = new byte[64 * 1024];
+        long total = 0;
+        for (int read; (read = in.read(buffer)) != -1; ) {
+            total += read;
+            if (total > limit) return null;
+            digest.update(buffer, 0, read);
+            if (out != null) out.write(buffer, 0, read);
+        }
+        return Hex.encode(digest.digest());
+    }
+}

package/ios/Sources/ProtobaseMobile/BundlesFolder.swift

@@ -0,0 +1,26 @@
+import Foundation
+
+/**
+ * Where the live updater unzips bundles (capacitor-live-update's LiveUpdate.swift) and Capacitor serves a persisted
+ * server base path from (CAPBridgeViewController.swift).
+ */
+enum BundlesFolder {
+    static var path: String { NSHomeDirectory() + "/Library/NoCloud/ionic_built_snapshots" }
+
+    // One path component: no separator, no `.` or `..`, no NUL, ASCII only.
+    private static let bundleId = try! NSRegularExpression(pattern: "^[A-Za-z0-9_-]{1,64}$")
+
+    static func isBundleIdShape(_ id: String) -> Bool {
+        bundleId.firstMatch(in: id, range: NSRange(id.startIndex..., in: id)) != nil
+    }
+
+    /**
+     * An id that names an existing direct child of `root` once symlinks are resolved, by its exact name on disk: the stock
+     * code joins ids to the folder unchecked, and the volume ignores case, so `ABC` would open `abc`.
+     */
+    static func isBundleId(_ id: String, in root: String = path) -> Bool {
+        guard isBundleIdShape(id), let rootPath = realPath(root), let resolved = realPath(root + "/" + id) else { return false }
+        let url = URL(fileURLWithPath: resolved)
+        return url.deletingLastPathComponent().path == rootPath && url.lastPathComponent == id
+    }
+}

package/ios/Sources/ProtobaseMobile/GuardedLiveUpdatePlugin.swift

@@ -0,0 +1,95 @@
+import Capacitor
+
+/**
+ * Takes the stock live updater's (8.7.1) place, so page script cannot steer it. The stock class is `public`, not
+ * `open`, so it cannot be subclassed here; the CLI lists this class instead of it in capacitor.config.json, and this
+ * plugin holds the stock one unregistered (StockLiveUpdate). Capacitor dispatches only the methods a plugin's own
+ * `pluginMethods` names (CapacitorBridge.swift, handleJSCall), so this list, every stock method, decides what page
+ * script reaches; page script's input never reaches the stock code, which gets a new call with what the guard built.
+ *
+ * - The methods the shell needs that take no input get none.
+ * - downloadBundle: see LiveUpdateDownload and DownloadBudget.
+ * - setNextBundle takes null, which resets to the built-in bundle, or an id naming a bundle (BundlesFolder.isBundleId):
+ *   the stock code joins ids to its path unchecked (LiveUpdate.swift, buildBundleURLFor).
+ * - Everything else is refused, and so is every method when load() refuses to load (LiveUpdateLoadCheck): the stock
+ *   plugin then never loads.
+ */
+@objc(GuardedLiveUpdatePlugin)
+public class GuardedLiveUpdatePlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "GuardedLiveUpdatePlugin"
+    public let jsName = "LiveUpdate"
+    public let pluginMethods = LiveUpdateMethods.declared.map { CAPPluginMethod(name: $0, returnType: CAPPluginReturnPromise)! }
+
+    private var stock: StockLiveUpdate?
+    private var settings: LiveUpdateSettings?
+
+    override public func load() {
+        start(LiveUpdateSettings(getConfig()), StockLiveUpdate.make())
+    }
+
+    func start(_ settings: LiveUpdateSettings, _ stock: StockLiveUpdate?) {
+        if let reason = LiveUpdateLoadCheck.refusal(settings, stockMethods: stock?.methodNames, stockResponds: { stock?.responds(to: $0) ?? false }) {
+            CAPLog.print("⚡️ ", reason)
+            return
+        }
+        guard let stock else { return }
+        stock.load(guardedBy: self)
+        self.settings = settings
+        self.stock = stock
+    }
+
+    private func refuse(_ call: CAPPluginCall) {
+        Refusal.reject(call, plugin: jsName)
+    }
+
+    private func forwardCleared(_ call: CAPPluginCall) {
+        guard let stock else { return refuse(call) }
+        stock.forward(call, call.methodName, options: [:])
+    }
+
+    // Checked
+
+    @objc func downloadBundle(_ call: CAPPluginCall) {
+        guard let stock, let settings, let options = LiveUpdateDownload.options(call.options, settings) else { return refuse(call) }
+        guard DownloadBudget.shared.take() else { return call.reject("LiveUpdate.downloadBundle was called too often in this run of the app") }
+        stock.forward(call, "downloadBundle", options: options)
+    }
+
+    @objc func setNextBundle(_ call: CAPPluginCall) {
+        guard let stock else { return refuse(call) }
+        let bundleId = call.options["bundleId"]
+        if bundleId == nil || bundleId is NSNull { return stock.forward(call, "setNextBundle", options: [:]) }
+        guard let bundleId = bundleId as? String, BundlesFolder.isBundleId(bundleId) else { return refuse(call) }
+        stock.forward(call, "setNextBundle", options: ["bundleId": bundleId])
+    }
+
+    // Cleared
+
+    @objc func ready(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func reload(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getCurrentBundle(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getNextBundle(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getDownloadedBundles(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getVersionCode(_ call: CAPPluginCall) { forwardCleared(call) }
+    @objc func getVersionName(_ call: CAPPluginCall) { forwardCleared(call) }
+
+    // Refused
+
+    @objc func clearBlockedBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func deleteBundle(_ call: CAPPluginCall) { refuse(call) }
+    @objc func fetchChannels(_ call: CAPPluginCall) { refuse(call) }
+    @objc func fetchLatestBundle(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getBlockedBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getBundles(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getChannel(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getCustomId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func getDeviceId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func isSyncing(_ call: CAPPluginCall) { refuse(call) }
+    @objc func reset(_ call: CAPPluginCall) { refuse(call) }
+    @objc func resetConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setChannel(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setConfig(_ call: CAPPluginCall) { refuse(call) }
+    @objc func setCustomId(_ call: CAPPluginCall) { refuse(call) }
+    @objc func sync(_ call: CAPPluginCall) { refuse(call) }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateDownload.swift

@@ -0,0 +1,39 @@
+import Foundation
+
+/**
+ * What page script may download: a manifest from the app's own releases URL, `releasesUrl + "/" + bundleId`, with
+ * `publicKey` pinned, so the stock code checks the manifest and each file against it with the response's signature
+ * (LiveUpdate.swift, downloadAndVerifyFile and verifyFile). A caller's checksum and signature are dropped.
+ */
+enum LiveUpdateDownload {
+    /** The options the stock code downloads with, or nil when the call is refused. */
+    static func options(_ call: [AnyHashable: Any], _ settings: LiveUpdateSettings) -> [String: Any]? {
+        guard let releasesUrl = settings.releasesUrl, ReleasesUrl.isOwnSource(releasesUrl) else { return nil }
+        guard let publicKey = settings.publicKey, !publicKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else { return nil }
+        guard call["artifactType"] as? String == "manifest", let bundleId = call["bundleId"] as? String else { return nil }
+        let url = releasesUrl + "/" + bundleId
+        guard BundlesFolder.isBundleIdShape(bundleId), call["url"] as? String == url else { return nil }
+        return ["artifactType": "manifest", "bundleId": bundleId, "url": url]
+    }
+}
+
+/** A few downloads per run of the app, so a loop cannot drain the data plan; a reload of the page keeps the count. */
+final class DownloadBudget {
+    static let shared = DownloadBudget(limit: 3)
+
+    private let lock = NSLock()
+    private let limit: Int
+    private var used = 0
+
+    init(limit: Int) {
+        self.limit = limit
+    }
+
+    func take() -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        if used >= limit { return false }
+        used += 1
+        return true
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateLoadCheck.swift

@@ -0,0 +1,21 @@
+/**
+ * Why the guard refuses to load the live updater, or nil. A stock method the guard does not declare means a plugin
+ * upgrade added one: no live updater then rather than an open one. Background updates sync with the vendor's cloud
+ * outside every method (LiveUpdate.swift, handleLoad); `autoDeleteBundles` and a `readyTimeout` make ready() drop every
+ * bundle but the current and next one and roll back a bundle that never gets ready, so page script cannot pin an older one.
+ */
+enum LiveUpdateLoadCheck {
+    static func refusal(_ settings: LiveUpdateSettings, stockMethods: [String]?, stockResponds: (String) -> Bool) -> String? {
+        guard let stockMethods else { return "LiveUpdate has no stock LiveUpdatePlugin in this Protobase app" }
+        if let unguarded = stockMethods.first(where: { !LiveUpdateMethods.declared.contains($0) }) {
+            return "LiveUpdate.\(unguarded) has no guard in this Protobase app"
+        }
+        if let missing = LiveUpdateMethods.forwarded.first(where: { !stockResponds($0) }) {
+            return "LiveUpdate.\(missing) is missing from the stock LiveUpdatePlugin"
+        }
+        if settings.autoUpdateStrategy != "none" { return "plugins.LiveUpdate.autoUpdateStrategy must be \"none\" in a Protobase app" }
+        if !settings.autoDeleteBundles { return "plugins.LiveUpdate.autoDeleteBundles must be true in a Protobase app" }
+        if settings.readyTimeout <= 0 { return "plugins.LiveUpdate.readyTimeout must be above 0 in a Protobase app" }
+        return nil
+    }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateMethods.swift

@@ -0,0 +1,15 @@
+/** The stock live updater's (8.7.1) methods, by what page script may do with them. */
+enum LiveUpdateMethods {
+    /** Forwarded with their input cleared. */
+    static let cleared = ["ready", "reload", "getCurrentBundle", "getNextBundle", "getDownloadedBundles", "getVersionCode", "getVersionName"]
+    /** Forwarded with only the input the guard checked and built. */
+    static let checked = ["downloadBundle", "setNextBundle"]
+    /** Never forwarded: deleting, resetting, the vendor's cloud, config, channel and ids. */
+    static let refused = [
+        "clearBlockedBundles", "deleteBundle", "fetchChannels", "fetchLatestBundle", "getBlockedBundles", "getBundles", "getChannel",
+        "getConfig", "getCustomId", "getDeviceId", "isSyncing", "reset", "resetConfig", "setChannel", "setConfig", "setCustomId", "sync",
+    ]
+
+    static var forwarded: [String] { cleared + checked }
+    static var declared: [String] { forwarded + refused }
+}

package/ios/Sources/ProtobaseMobile/LiveUpdateSettings.swift

@@ -0,0 +1,25 @@
+import Capacitor
+
+/**
+ * The live updater's `plugins.LiveUpdate` settings the guard checks, read with the stock plugin's own keys and defaults
+ * (capacitor-live-update's LiveUpdatePlugin.swift, liveUpdateConfig), plus Protobase's `releasesUrl`. They come from
+ * capacitor.config.json, which ships in the binary outside the web part, beyond page script and a live update.
+ */
+struct LiveUpdateSettings {
+    var autoUpdateStrategy: String?
+    var autoDeleteBundles: Bool
+    var readyTimeout: Int
+    var releasesUrl: String?
+    var publicKey: String?
+}
+
+extension LiveUpdateSettings {
+    init(_ config: PluginConfig) {
+        self.init(
+            autoUpdateStrategy: config.getString("autoUpdateStrategy", "none"),
+            autoDeleteBundles: config.getBoolean("autoDeleteBundles", false),
+            readyTimeout: config.getInt("readyTimeout", 0),
+            releasesUrl: config.getString("releasesUrl"),
+            publicKey: config.getString("publicKey"))
+    }
+}

package/ios/Sources/ProtobaseMobile/LocalFileGuard.swift

@@ -7,9 +7,6 @@ import Foundation
  * live updater's bundles folder. Each check runs on the decoded path, the one the asset handler opens.
  */
 final class LocalFileGuard {
-    // Where the live updater unzips bundles (capacitor-live-update's LiveUpdate.swift) and Capacitor serves a persisted
-    // server base path from (CAPBridgeViewController.swift).
-    private static let bundlesFolder = "Library/NoCloud/ionic_built_snapshots"
     private static let refusedPrefixes = [
         CapacitorBridge.fileStartIdentifier,
         CapacitorBridge.httpInterceptorStartIdentifier,
@@ -18,14 +15,15 @@ final class LocalFileGuard {
 
     private let lock = NSLock()
     private let appBundle: String?
-    // Resolved once: with no bundles folder at launch, nothing outside the app bundle is served.
-    private let bundles: String?
+    // Resolved once it exists, under the lock: a fresh install has none until its first download, which the app then
+    // loads in the same run. Until then nothing outside the app bundle is served.
+    private var bundles: String?
     var basePath: String
 
     init(basePath: String) {
         self.basePath = basePath
-        appBundle = Self.realPath(Bundle.main.bundlePath)
-        bundles = Self.realPath(NSHomeDirectory() + "/" + Self.bundlesFolder)
+        appBundle = realPath(Bundle.main.bundlePath)
+        bundles = realPath(BundlesFolder.path)
     }
 
     func withLock<T>(_ body: () throws -> T) rethrows -> T {
@@ -37,23 +35,18 @@ final class LocalFileGuard {
     func refuses(path: String) -> Bool {
         if Self.refusedPrefixes.contains(where: { path.hasPrefix($0) }) { return true }
         if path.contains("\0") || path.split(separator: "/", omittingEmptySubsequences: false).contains("..") { return true }
-        guard let base = Self.realPath(basePath) else { return true }
+        guard let base = realPath(basePath) else { return true }
         if let appBundle, Self.isInside(base, appBundle) { return false }
+        if bundles == nil { bundles = realPath(BundlesFolder.path) }
         guard let bundles else { return true }
         // The file the asset handler opens, by Capacitor's own routing.
         var router = CapacitorRouter()
         router.basePath = basePath
-        guard let file = Self.realPath(router.route(for: path)) else { return true }
+        guard let file = realPath(router.route(for: path)) else { return true }
         return !Self.isInside(file, bundles)
     }
 
     private static func isInside(_ path: String, _ folder: String) -> Bool {
         path == folder || path.hasPrefix(folder.hasSuffix("/") ? folder : folder + "/")
     }
-
-    private static func realPath(_ path: String) -> String? {
-        guard let resolved = realpath(path, nil) else { return nil }
-        defer { free(resolved) }
-        return String(cString: resolved)
-    }
 }

package/ios/Sources/ProtobaseMobile/PageScriptFilter.swift

@@ -5,7 +5,9 @@ import WebKit
  * Stands in front of Capacitor's `bridge` script message handler, the way page script calls native code. It drops
  * messages from any frame but the main one of the app's own origin, as Capacitor Android's MessageHandler does, and
  * refuses `CapacitorHttp`, `CapacitorCookies` and `WebView`, which hand over or plant the session, and any plugin id
- * the bridge has not loaded: Capacitor would otherwise load a plugin by class name, such as `CAPHttpPlugin`.
+ * the bridge has not loaded: Capacitor would otherwise load a plugin by class name, such as `CAPHttpPlugin` or the stock
+ * `LiveUpdatePlugin`. `LiveUpdate` passes only when GuardedLiveUpdatePlugin holds the name: an `npx cap sync` lists the
+ * stock class again, which then registers under it beside or instead of the guard.
  */
 final class PageScriptFilter: NSObject, WKScriptMessageHandler {
     private static let handlerName = "bridge"
@@ -32,7 +34,7 @@ final class PageScriptFilter: NSObject, WKScriptMessageHandler {
         }
         guard type == "message" else { return }
         let pluginId = body["pluginId"] as? String ?? ""
-        if !Self.refusedPlugins.contains(pluginId), bridge.plugin(withName: pluginId) != nil {
+        if !Self.refusedPlugins.contains(pluginId), let plugin = bridge.plugin(withName: pluginId), pluginId != "LiveUpdate" || plugin is GuardedLiveUpdatePlugin {
             bridge.webViewDelegationHandler.userContentController(userContentController, didReceive: message)
             return
         }
@@ -47,7 +49,7 @@ final class PageScriptFilter: NSObject, WKScriptMessageHandler {
             "pluginId": pluginId,
             "methodName": body["methodName"] as? String ?? "",
             "success": false,
-            "error": ["message": "\(pluginId) is not available to page script in a Protobase app"],
+            "error": ["message": Refusal.message(pluginId)],
         ]
         guard let json = try? JSONSerialization.data(withJSONObject: answer), let text = String(data: json, encoding: .utf8) else { return }
         webView?.evaluateJavaScript("window.Capacitor.fromNative(\(text))")

package/ios/Sources/ProtobaseMobile/RealPath.swift

@@ -0,0 +1,8 @@
+import Foundation
+
+/** A path with its symlinks, `.` and `..` resolved and each component in its case on disk, or nil when it does not exist. */
+func realPath(_ path: String) -> String? {
+    guard let resolved = realpath(path, nil) else { return nil }
+    defer { free(resolved) }
+    return String(cString: resolved)
+}

package/ios/Sources/ProtobaseMobile/Refusal.swift

@@ -0,0 +1,12 @@
+import Capacitor
+
+/** How Protobase answers page script that calls a plugin or method it may not reach. */
+enum Refusal {
+    static func message(_ name: String) -> String {
+        "\(name) is not available to page script in a Protobase app"
+    }
+
+    static func reject(_ call: CAPPluginCall, plugin: String) {
+        call.reject(message("\(plugin).\(call.methodName ?? "")"))
+    }
+}