@scalebun/react-native 1.0.4 → 1.2.0

package/android/src/main/java/com/scalebun/rn/ota/SlotManager.kt

@@ -30,6 +30,15 @@ class SlotManager(private val filesDir: File) {
         private const val BUNDLE_FILENAME = "bundle.jsbundle"
         private const val META_FILENAME = "meta.json"
         private const val BOOT_MARKER_FILENAME = "boot_marker"
+
+        /**
+         * Launches a freshly-applied bundle gets to call markHealthy() before the
+         * guard treats it as crash-looping. 2 = one retry: a single unlucky boot
+         * (OOM kill, user swipe-away during startup) does not cost the update,
+         * but a bundle that genuinely cannot start is gone by the second launch.
+         */
+        private const val MAX_BOOT_ATTEMPTS = 2
+        private const val REVERT_RECORD_FILENAME = "last_revert.json"
     }
 
     private val otaRoot: File get() = File(filesDir, OTA_DIR)
@@ -37,6 +46,7 @@ class SlotManager(private val filesDir: File) {
     private val nextSlot: File get() = File(otaRoot, "next")
     private val previousSlot: File get() = File(otaRoot, "previous")
     private val bootMarker: File get() = File(otaRoot, BOOT_MARKER_FILENAME)
+    private val revertRecord: File get() = File(otaRoot, REVERT_RECORD_FILENAME)
 
     /**
      * Returns the absolute path to the active JS bundle, or null if no OTA
@@ -157,9 +167,26 @@ class SlotManager(private val filesDir: File) {
 
     /**
      * Revert to previous slot (boot-guard triggered or manual rollback).
+     *
+     * `reason` is persisted so JS can report WHY the device is no longer on the
+     * bundle it installed. Without it an auto-revert was invisible to the
+     * dashboard: `bootGuardReverted` was read by the orchestrator and written by
+     * nobody, so every crash-guard rollback recorded zero rollbacks.
      */
-    fun revert(): Boolean {
+    @JvmOverloads
+    fun revert(reason: String? = null): Boolean {
         try {
+            if (reason != null) {
+                runCatching {
+                    otaRoot.mkdirs()
+                    revertRecord.writeText(
+                        JSONObject()
+                            .put("reason", reason)
+                            .put("at", System.currentTimeMillis())
+                            .toString(),
+                    )
+                }
+            }
             if (!previousSlot.exists()) {
                 Log.w(TAG, "No previous/ to revert to — clearing current/")
                 currentSlot.deleteRecursively()
@@ -228,12 +255,39 @@ class SlotManager(private val filesDir: File) {
                     "Boot guard cannot verify this bundle — marker or meta has no sha256. " +
                         "Leaving it in place; restage with a current SDK to re-enable the check.",
                 )
-            } else if (currentId != markerId) {
+                return
+            }
+            if (currentId != markerId) {
                 Log.w(TAG, "Boot marker sha256 mismatch — auto-reverting")
                 revert()
+                return
             }
-            // If they match: this is the first launch of a new bundle.
-            // The marker stays until markHealthy() is called.
+
+            // ── Crash-loop revert ────────────────────────────────────────────
+            // Matching hashes mean the bundle is INTACT, which says nothing
+            // about whether it RUNS. A bundle that throws at JS init installs
+            // cleanly, matches every boot, and never reaches markHealthy() — so
+            // a hash-only guard let it crash-loop forever, bricking the app
+            // until reinstall. That is the exact failure an OTA boot guard
+            // exists to prevent.
+            //
+            // The marker is therefore also a boot-attempt counter: every launch
+            // that starts with the marker still present increments it. Reaching
+            // the limit means the bundle has been given MAX_BOOT_ATTEMPTS
+            // chances to call markHealthy() and never did → revert.
+            val attempts = markerJson.optInt("bootAttempts", 0) + 1
+            if (attempts >= MAX_BOOT_ATTEMPTS) {
+                Log.w(
+                    TAG,
+                    "Bundle failed to become healthy in $attempts launch(es) — auto-reverting",
+                )
+                revert(reason = "boot_crash_guard")
+                return
+            }
+            markerJson.put("bootAttempts", attempts)
+            bootMarker.writeText(markerJson.toString())
+            FileOutputStream(bootMarker, true).use { it.fd.sync() }
+            Log.i(TAG, "Boot guard: attempt $attempts/$MAX_BOOT_ATTEMPTS for this bundle")
         } catch (e: Exception) {
             Log.e(TAG, "checkBootGuard() failed — reverting to be safe", e)
             revert()
@@ -249,6 +303,18 @@ class SlotManager(private val filesDir: File) {
         state.put("next", readMeta(nextSlot))
         state.put("previous", readMeta(previousSlot))
         state.put("bootMarkerPresent", bootMarker.exists())
+        // Consume-on-read: the orchestrator turns this into an AUTO_ROLLBACK
+        // event exactly once, then the record is gone. Leaving it in place would
+        // re-report the same rollback on every subsequent launch.
+        if (revertRecord.exists()) {
+            runCatching {
+                val rec = JSONObject(revertRecord.readText())
+                state.put("bootGuardReverted", true)
+                state.put("bootGuardRevertReason", rec.optString("reason", "boot_crash_guard"))
+                state.put("bootGuardRevertedAt", rec.optLong("at", 0L))
+            }
+            revertRecord.delete()
+        }
         return state
     }