@scalebun/react-native 1.3.3 → 1.5.0

package/android/src/main/java/com/scalebun/rn/ota/BsPatch.kt

@@ -0,0 +1,182 @@
+package com.scalebun.rn.ota
+
+import java.io.ByteArrayOutputStream
+import java.util.zip.Inflater
+
+/**
+ * bspatch — reconstructs a bundle from a previous bundle plus a delta.
+ *
+ * WHAT WAS WRONG. `stagePatch` resolved `false` unconditionally on both
+ * platforms, so the whole delta pipeline was decorative: the server generated
+ * patches, the check response advertised them, the orchestrator asked for
+ * them, and the device always fell back to a full download. Nobody ever
+ * downloaded less than the entire bundle.
+ *
+ * FORMAT (produced by the backend's `bsdiff.ts`; all integers little-endian):
+ *
+ *   0   8   magic "SBDIFF01"
+ *   8   4   target size — the exact number of bytes this must produce
+ *   12  4   deflated control-block length
+ *   16  4   inflated control-block length
+ *   20  4   deflated diff-block length
+ *   24  4   inflated diff-block length
+ *   28  4   deflated extra-block length
+ *   32  4   inflated extra-block length
+ *   36  .   deflate(control) ++ deflate(diff) ++ deflate(extra)
+ *
+ * Control is a run of (addLen, extraLen, seek) int32 triples. `addLen` bytes
+ * are read from the diff block and added, bytewise mod 256, to the source at
+ * the current read cursor; `extraLen` bytes are copied verbatim from the extra
+ * block; then the source cursor moves by the signed `seek`.
+ *
+ * WHY RAW DEFLATE. Android has `java.util.zip` and iOS has the Compression
+ * framework; neither ships zstd. On real Hermes bundles zstd-19 beat deflate-9
+ * by 0.3 percentage points (95.79% vs 95.51%) — not worth a native dependency
+ * on two platforms forever. See the backend module for the measurements.
+ *
+ * EVERY FIELD HERE IS UNTRUSTED. The patch arrives over the network, so a
+ * malformed or hostile one must fail cleanly rather than index out of bounds.
+ * Each run is bounds-checked against all four buffers before it is used, and
+ * the caller still verifies the SHA-256 of the result before anything is
+ * promoted — this routine producing the wrong bytes can never install them.
+ */
+internal object BsPatch {
+
+    private const val MAGIC = "SBDIFF01"
+    private const val HEADER_BYTES = 36
+
+    /** Refuse absurd allocations from a corrupt header (bundles are single-digit MB). */
+    private const val MAX_TARGET_BYTES = 256 * 1024 * 1024
+
+    class PatchFormatException(message: String) : Exception(message)
+
+    private fun u32(b: ByteArray, off: Int): Long =
+        (b[off].toLong() and 0xff) or
+            ((b[off + 1].toLong() and 0xff) shl 8) or
+            ((b[off + 2].toLong() and 0xff) shl 16) or
+            ((b[off + 3].toLong() and 0xff) shl 24)
+
+    private fun i32(b: ByteArray, off: Int): Int =
+        (b[off].toInt() and 0xff) or
+            ((b[off + 1].toInt() and 0xff) shl 8) or
+            ((b[off + 2].toInt() and 0xff) shl 16) or
+            ((b[off + 3].toInt() and 0xff) shl 24)
+
+    /** Raw DEFLATE (no zlib header) — matches Node's `deflateRawSync`. */
+    private fun inflateRaw(data: ByteArray, offset: Int, length: Int): ByteArray {
+        val inflater = Inflater(true)
+        try {
+            inflater.setInput(data, offset, length)
+            val out = ByteArrayOutputStream(maxOf(length * 4, 1024))
+            val buf = ByteArray(64 * 1024)
+            while (true) {
+                val n = inflater.inflate(buf)
+                if (n > 0) {
+                    out.write(buf, 0, n)
+                    continue
+                }
+                // ORDER MATTERS. A block that legitimately decodes to zero bytes
+                // — an empty extra block, which happens whenever a patch is one
+                // unbroken run — also reports needsInput() once the stream is
+                // consumed. Testing needsInput() first therefore rejected valid
+                // patches as truncated; `finished()` has to be asked first.
+                if (inflater.finished()) break
+                if (inflater.needsInput() || inflater.needsDictionary()) {
+                    throw PatchFormatException("compressed block is truncated")
+                }
+            }
+            return out.toByteArray()
+        } finally {
+            inflater.end()
+        }
+    }
+
+    /**
+     * Apply [patch] to [source], returning the reconstructed bundle.
+     *
+     * @throws PatchFormatException if the patch is malformed, truncated, or
+     *   inconsistent with [source]. Callers treat this as "fall back to a full
+     *   download", never as a fatal error.
+     */
+    fun apply(source: ByteArray, patch: ByteArray): ByteArray {
+        if (patch.size < HEADER_BYTES) throw PatchFormatException("patch too short")
+        val magic = String(patch, 0, 8, Charsets.ISO_8859_1)
+        if (magic != MAGIC) throw PatchFormatException("bad patch magic '$magic'")
+
+        val targetSizeL = u32(patch, 8)
+        val cLen = u32(patch, 12)
+        val cRaw = u32(patch, 16)
+        val dLen = u32(patch, 20)
+        val dRaw = u32(patch, 24)
+        val eLen = u32(patch, 28)
+        val eRaw = u32(patch, 32)
+
+        if (targetSizeL > MAX_TARGET_BYTES) {
+            throw PatchFormatException("declared target size $targetSizeL is implausible")
+        }
+        if (cRaw > MAX_TARGET_BYTES || dRaw > MAX_TARGET_BYTES || eRaw > MAX_TARGET_BYTES) {
+            throw PatchFormatException("declared block size is implausible")
+        }
+        if (HEADER_BYTES + cLen + dLen + eLen != patch.size.toLong()) {
+            throw PatchFormatException("block lengths do not match patch size")
+        }
+        val targetSize = targetSizeL.toInt()
+
+        var off = HEADER_BYTES
+        val control = inflateRaw(patch, off, cLen.toInt()); off += cLen.toInt()
+        val diff = inflateRaw(patch, off, dLen.toInt()); off += dLen.toInt()
+        val extra = inflateRaw(patch, off, eLen.toInt())
+
+        // A block that inflates to a size other than the declared one is
+        // corrupt; iOS sizes its buffers from these numbers, so Android holds
+        // the format to the same contract rather than trusting the stream.
+        if (control.size.toLong() != cRaw) throw PatchFormatException("control block size mismatch")
+        if (diff.size.toLong() != dRaw) throw PatchFormatException("diff block size mismatch")
+        if (extra.size.toLong() != eRaw) throw PatchFormatException("extra block size mismatch")
+
+        if (control.size % 12 != 0) {
+            throw PatchFormatException("control block is not a whole number of triples")
+        }
+
+        val out = ByteArray(targetSize)
+        var newpos = 0
+        var oldpos = 0
+        var dpos = 0
+        var epos = 0
+
+        var c = 0
+        while (c < control.size) {
+            val addLen = i32(control, c)
+            val extraLen = i32(control, c + 4)
+            val seek = i32(control, c + 8)
+            c += 12
+
+            if (addLen < 0 || extraLen < 0) throw PatchFormatException("negative run length")
+            if (newpos + addLen > targetSize) throw PatchFormatException("add run overruns target")
+            if (dpos + addLen > diff.size) throw PatchFormatException("add run overruns diff block")
+            if (oldpos < 0 || oldpos + addLen > source.size) {
+                throw PatchFormatException("add run overruns source")
+            }
+
+            for (i in 0 until addLen) {
+                out[newpos + i] = ((diff[dpos + i].toInt() + source[oldpos + i].toInt()) and 0xff).toByte()
+            }
+            newpos += addLen
+            oldpos += addLen
+            dpos += addLen
+
+            if (newpos + extraLen > targetSize) throw PatchFormatException("extra run overruns target")
+            if (epos + extraLen > extra.size) throw PatchFormatException("extra run overruns extra block")
+            System.arraycopy(extra, epos, out, newpos, extraLen)
+            newpos += extraLen
+            epos += extraLen
+
+            oldpos += seek
+        }
+
+        if (newpos != targetSize) {
+            throw PatchFormatException("patch produced $newpos bytes, declared $targetSize")
+        }
+        return out
+    }
+}

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaModule.kt

@@ -191,20 +191,21 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
     }
 
     /**
-     * Binary-patch staging (S7-NAT-1) — NOT IMPLEMENTED on Android.
+     * Binary-patch staging (S7-NAT-1).
      *
-     * [SlotManager] has no patch/bspatch path, so there is nothing to apply a diff
-     * with. The JS contract in `src/specs/NativeScaleBunOta.ts` defines `false` as
-     * "patching unavailable — fall back to a full-bundle download", which is exactly
-     * the honest answer here; OtaOrchestrator then downloads the whole bundle and the
-     * update still lands. Resolving false (rather than rejecting) keeps that fallback
-     * on its documented path instead of surfacing an error the caller must special-case.
+     * Downloads a delta, reconstructs the full bundle from the currently
+     * installed one, and hands the result to the ordinary staging path — so a
+     * patched bundle passes exactly the same SHA-256 and slot-promotion checks
+     * as a fully downloaded one. [expectedSha256] is the hash of the COMPLETE
+     * bundle, which is what makes a bad patch unable to install: reconstruct
+     * the wrong bytes and staging rejects them.
      *
-     * This override must exist regardless: on the New Architecture the codegen base
-     * (`NativeScaleBunOtaSpec`, generated from the JS spec) declares `stagePatch`
-     * abstract, so omitting it fails Kotlin compilation for every new-arch consumer.
-     *
-     * Replace the body with a real bspatch once SlotManager grows patch support.
+     * Resolves `false` — never rejects — for every "cannot patch" case, because
+     * `src/specs/NativeScaleBunOta.ts` defines false as "patching unavailable,
+     * fall back to a full download". The update still lands, just larger. The
+     * cases are: no OTA bundle installed yet (nothing to patch against — the
+     * first install is always full), a patch that does not match its own
+     * advertised hash, and a malformed patch.
      */
     @ReactMethod
     override fun stagePatch(
@@ -213,7 +214,81 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         expectedSha256: String,
         promise: Promise,
     ) {
-        promise.resolve(false)
+        var downloadedPatch: File? = null
+        var rebuilt: File? = null
+        try {
+            // Patching is relative to the bundle already on disk. With no OTA
+            // bundle installed the source would be the APK's built-in asset,
+            // which the server did not diff against — so there is nothing valid
+            // to apply and a full download is the correct path.
+            val currentBundle = slotManager.currentBundlePath()
+            if (currentBundle == null || !currentBundle.exists()) {
+                android.util.Log.i(NAME, "stagePatch: no current OTA bundle to patch — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_patch_${System.nanoTime()}")
+            downloadedPatch = temp
+            if (!BundleDownloader.download(patchUrl, temp, ::emitProgress)) {
+                promise.resolve(false)
+                return
+            }
+
+            val patchBytes = temp.readBytes()
+
+            // Verify the patch against its own hash before parsing it. This is
+            // cheap and keeps obviously-corrupt input away from the parser.
+            val actualPatchSha = sha256Hex(patchBytes)
+            if (!actualPatchSha.equals(patchSha256, ignoreCase = true)) {
+                android.util.Log.w(NAME, "stagePatch: patch hash mismatch — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val sourceBytes = currentBundle.readBytes()
+            val rebuiltBytes = try {
+                BsPatch.apply(sourceBytes, patchBytes)
+            } catch (e: BsPatch.PatchFormatException) {
+                android.util.Log.w(NAME, "stagePatch: ${e.message} — full download")
+                promise.resolve(false)
+                return
+            }
+
+            val out = File(reactApplicationContext.cacheDir, "scalebun_ota_rebuilt_${System.nanoTime()}")
+            rebuilt = out
+            out.writeBytes(rebuiltBytes)
+
+            val meta = JSONObject()
+            meta.put("sha256", expectedSha256)
+            meta.put("installedAt", System.currentTimeMillis())
+            meta.put("patched", true)
+
+            // SlotManager re-hashes and compares against the full-bundle hash;
+            // a mis-applied patch cannot get past this.
+            val success = slotManager.stage(out, expectedSha256, meta)
+            if (!success) {
+                android.util.Log.w(NAME, "stagePatch: rebuilt bundle failed verification — full download")
+            }
+            promise.resolve(success)
+        } catch (e: Exception) {
+            // Any unexpected failure is still just "no patch" — the caller has
+            // a working full-download path and a rejected promise would turn a
+            // recoverable situation into a failed update.
+            android.util.Log.w(NAME, "stagePatch: ${e.message} — full download")
+            promise.resolve(false)
+        } finally {
+            downloadedPatch?.delete()
+            rebuilt?.delete()
+        }
+    }
+
+    private fun sha256Hex(bytes: ByteArray): String {
+        val digest = java.security.MessageDigest.getInstance("SHA-256")
+        val hash = digest.digest(bytes)
+        val sb = StringBuilder(hash.size * 2)
+        for (b in hash) sb.append(String.format("%02x", b))
+        return sb.toString()
     }
 
     @ReactMethod

package/android/src/oldarch/java/com/scalebun/rn/crash/ScaleBunCrashSpec.kt

@@ -18,4 +18,20 @@ abstract class ScaleBunCrashSpec(reactContext: ReactApplicationContext) :
     abstract fun install(promise: Promise)
     abstract fun crashNow(promise: Promise)
     abstract fun drainPendingCrash(promise: Promise)
+
+    /**
+     * These two were added to the JS spec and to [ScaleBunCrashModule] without
+     * being added here, and the omission is invisible on the New Architecture:
+     * there the base is GENERATED from the JS spec, so it grew the methods
+     * automatically. On the Old Architecture this file IS the base and it has
+     * to be edited by hand — so `ScaleBunCrashModule` was overriding two
+     * methods that did not exist, and the SDK failed to compile for every
+     * old-arch consumer with "'setActiveSessionId' overrides nothing".
+     *
+     * Any change to `src/specs/NativeScaleBunCrash.ts` has to be mirrored here.
+     * That is the cost of the two-base design described above; the alternative
+     * is that old-arch apps silently stop building.
+     */
+    abstract fun setActiveSessionId(sessionId: String?, promise: Promise)
+    abstract fun clearPendingCrash(crashId: String?, promise: Promise)
 }

package/bin/scalebun.js

@@ -630,12 +630,64 @@ function main() {
             console.log('  npx scalebun init ios --check    Verify hooks exist (exit 1 if missing)');
             console.log('  npx scalebun init ios --dry-run  Preview changes without writing');
             console.log('');
+            console.log('OTA commands (login, quickstart, ota publish, releases, rollout…)');
+            console.log('ship with this package (via the bundled @scalebun/cli) and are');
+            console.log('forwarded automatically — no extra install needed.');
+            console.log('');
             break;
         default:
-            console.error(`Unknown command: ${cmd}`);
-            console.error('Run `npx scalebun help` for usage.');
-            process.exit(2);
+            // TWO PACKAGES, ONE COMMAND NAME.
+            //
+            // The OTA commands (login, ota publish, releases, rollout, quickstart…)
+            // live in @scalebun/cli, which declares the SAME `scalebun` bin as this
+            // package. Every doc and generated CI pipeline says `npx scalebun ota
+            // publish`, so whichever package won the bin race decided whether that
+            // worked — and when this one won, a new user's very first command died
+            // with "Unknown command: ota" and no way to find out why.
+            //
+            // Delegate instead of guessing: if @scalebun/cli is installed, run it.
+            // If not, say exactly what to install rather than what went wrong.
+            delegateToOtaCli(argv);
     }
 }
 
+/**
+ * Hand the invocation to @scalebun/cli, preserving argv and exit code.
+ * Falls back to an actionable install instruction when it is not present.
+ */
+function delegateToOtaCli(argv) {
+    let cliEntry = null;
+    try {
+        cliEntry = require.resolve('@scalebun/cli/lib/index.js', {
+            paths: [process.cwd(), __dirname],
+        });
+    } catch {
+        cliEntry = null;
+    }
+
+    if (!cliEntry) {
+        const cmd = argv[0];
+        console.error('');
+        console.error(`"${cmd}" is an OTA command, provided by @scalebun/cli.`);
+        console.error('');
+        console.error('@scalebun/cli ships as a dependency of @scalebun/react-native, so it');
+        console.error('should already be present. It could not be resolved — your install may');
+        console.error('be incomplete or the dependency was pruned.');
+        console.error('');
+        console.error('Reinstall dependencies, then re-run:');
+        console.error('  npm install');
+        console.error(`  npx scalebun ${argv.join(' ')}`);
+        console.error('');
+        console.error('(Or install it explicitly:  npm i -D @scalebun/cli)');
+        console.error('');
+        process.exit(2);
+    }
+
+    const { spawnSync } = require('child_process');
+    const res = spawnSync(process.execPath, [cliEntry, ...argv], {
+        stdio: 'inherit',
+    });
+    process.exit(res.status ?? 1);
+}
+
 main();