peachsim 0.1.1625 → 0.1.1635

package/src/native-app-identity-project.ts

@@ -6,6 +6,7 @@ import {
   extractNativeAppIdentityFromFiles,
   type NativeAppIdentity,
   readRootModuleName,
+  readGoogleSignInConfiguration,
   selectNativeAppIdentityReader,
 } from './native-app-identity'
 import { resolveNativeAppIconArtwork } from './nativeAppIconContract'
@@ -90,6 +91,11 @@ export function readNativeAppIdentityFromXcodeTarget(
     permissionUsageDescriptions[key] = value
   }
 
+  const infoPlistStrings: Record<string, string> = {}
+  for (const [key, value] of Object.entries(dictionary)) {
+    if (typeof value === 'string') infoPlistStrings[key] = value
+  }
+
   const querySchemes = dictionary.LSApplicationQueriesSchemes
   const urlQuerySchemes = Array.isArray(querySchemes) ? querySchemes : []
 
@@ -146,6 +152,15 @@ export function readNativeAppIdentityFromXcodeTarget(
     ...(rootModuleName ? { rootModuleName } : {}),
     ...(rootViewBackgroundColor !== undefined ? { rootViewBackgroundColor } : {}),
     ...(designRequiresCompatibility ? { designRequiresCompatibility } : {}),
+    ...(typeof dictionary.UIStatusBarHidden === 'boolean'
+      ? { statusBarHidden: dictionary.UIStatusBarHidden }
+      : {}),
+    ...(typeof dictionary.UIViewControllerBasedStatusBarAppearance === 'boolean'
+      ? {
+          viewControllerBasedStatusBarAppearance:
+            dictionary.UIViewControllerBasedStatusBarAppearance,
+        }
+      : {}),
     ...(typeof dictionary.DTPlatformVersion === 'string'
       ? { dtPlatformVersion: dictionary.DTPlatformVersion }
       : {}),
@@ -154,6 +169,14 @@ export function readNativeAppIdentityFromXcodeTarget(
     buildVersion,
     bundleIdentifier,
     platform: 'ios',
+    googleSignIn: readGoogleSignInConfiguration(
+      dictionary,
+      Object.fromEntries(
+        app.resources
+          .filter((file) => file.endsWith('.plist'))
+          .map((file) => [file, parseInfoPlist(fs.readFileSync(file, 'utf8'))]),
+      ),
+    ),
     supportedInterfaceOrientations,
     ipadSupportedInterfaceOrientations,
     ...(defaultScreenOrientationMask ? { defaultScreenOrientationMask } : {}),
@@ -177,6 +200,7 @@ export function readNativeAppIdentityFromXcodeTarget(
       (value) => value,
     ),
     permissionUsageDescriptions,
+    infoPlistStrings,
     urlQuerySchemes,
     ...(shareIntoAppGroupId ? { shareIntoAppGroupId } : {}),
     ...(rtcAppGroupIdentifier ? { rtcAppGroupIdentifier } : {}),
@@ -364,8 +388,8 @@ function readIosNativeAppIdentity(
     ? nonEmptyString(installedManifest.version)
     : undefined
   if (!installedVersion) throw new Error('Reanimated package version is malformed')
-  // reanimated 3's native build has no static feature flag schema.
-  if (installedVersion.startsWith('3.')) return identity
+  // the static feature flag schema starts with reanimated 4.
+  if (Number.parseInt(installedVersion, 10) < 4) return identity
   const defaults: unknown = JSON.parse(
     fs.readFileSync(
       path.join(

package/src/native-app-identity.ts

@@ -48,6 +48,9 @@ export interface NativeAppIdentity {
   // UIDesignRequiresCompatibility: UIKit draws its pre-liquid-glass chrome.
   // carried only when the plist sets it true.
   designRequiresCompatibility?: true
+  // initial UIKit visibility and the owner of subsequent status bar preferences.
+  statusBarHidden?: boolean
+  viewControllerBasedStatusBarAppearance?: boolean
   // the literal DTPlatformVersion stamp when the app plist supplies one.
   dtPlatformVersion?: string
   // CFBundleName, which CFNetwork stamps into the default User-Agent and iOS's
@@ -62,6 +65,10 @@ export interface NativeAppIdentity {
   // SDK filtering belongs to the evaluation's device, not the bundle builder.
   androidManifestPermissions?: readonly AndroidManifestPermission[]
   permissionUsageDescriptions?: Readonly<Record<string, unknown>>
+  // every top-level string the app's Info.plist declares, build settings
+  // resolved, for native code that reads its own plist keys.
+  infoPlistStrings?: Readonly<Record<string, string>>
+  googleSignIn?: Readonly<Record<string, unknown>>
   urlQuerySchemes?: readonly unknown[]
   appIntentIdentifiers?: readonly string[]
   backgroundTaskIdentifiers?: readonly string[]
@@ -102,6 +109,9 @@ function nonEmptyString(value: unknown): string | null {
 
 export function isNativeAppIdentity(value: unknown): value is NativeAppIdentity {
   if (!isRecord(value)) return false
+  for (const key of ['statusBarHidden', 'viewControllerBasedStatusBarAppearance']) {
+    if (value[key] !== undefined && typeof value[key] !== 'boolean') return false
+  }
   const oneUpdates = value.oneUpdates
   if (
     oneUpdates !== undefined &&
@@ -143,6 +153,7 @@ export function isNativeAppIdentity(value: unknown): value is NativeAppIdentity
       ))
   )
     return false
+  if (value.googleSignIn !== undefined && !isRecord(value.googleSignIn)) return false
   const descriptions = value.permissionUsageDescriptions
   if (
     value.reanimatedStaticFeatureFlags !== undefined &&
@@ -153,6 +164,12 @@ export function isNativeAppIdentity(value: unknown): value is NativeAppIdentity
   )
     return false
   if (descriptions !== undefined && !isRecord(descriptions)) return false
+  if (
+    value.infoPlistStrings !== undefined &&
+    (!isRecord(value.infoPlistStrings) ||
+      !Object.values(value.infoPlistStrings).every((entry) => typeof entry === 'string'))
+  )
+    return false
   if (value.urlQuerySchemes !== undefined && !Array.isArray(value.urlQuerySchemes))
     return false
   if (
@@ -267,6 +284,15 @@ export function readNativeAppIdentity(value: unknown): NativeAppIdentity | null
     ...(value.designRequiresCompatibility === undefined
       ? {}
       : { designRequiresCompatibility: value.designRequiresCompatibility }),
+    ...(value.statusBarHidden === undefined
+      ? {}
+      : { statusBarHidden: value.statusBarHidden }),
+    ...(value.viewControllerBasedStatusBarAppearance === undefined
+      ? {}
+      : {
+          viewControllerBasedStatusBarAppearance:
+            value.viewControllerBasedStatusBarAppearance,
+        }),
     ...(value.dtPlatformVersion === undefined
       ? {}
       : { dtPlatformVersion: value.dtPlatformVersion }),
@@ -291,11 +317,17 @@ export function readNativeAppIdentity(value: unknown): NativeAppIdentity | null
             (permission) => ({ ...permission }),
           ),
         }),
+    ...(value.googleSignIn === undefined
+      ? {}
+      : { googleSignIn: structuredClone(value.googleSignIn) }),
     ...(value.permissionUsageDescriptions === undefined
       ? {}
       : {
           permissionUsageDescriptions: { ...value.permissionUsageDescriptions },
         }),
+    ...(value.infoPlistStrings === undefined
+      ? {}
+      : { infoPlistStrings: { ...value.infoPlistStrings } }),
     ...(value.appIntentIdentifiers === undefined
       ? {}
       : { appIntentIdentifiers: [...value.appIntentIdentifiers] }),
@@ -496,6 +528,39 @@ export function insertNativeAppIdentityFooter(
 
 // ── native project extraction ────────────────────────────────────────────────
 
+// Info.plist and bundled service plists are native configuration, independent of Firebase initialization.
+export function readGoogleSignInConfiguration(
+  plist: Record<string, unknown>,
+  resources: Readonly<Record<string, unknown>>,
+): Record<string, unknown> {
+  const clientIds: Record<string, string> = {}
+  for (const [file, value] of Object.entries(resources)) {
+    if (isRecord(value) && typeof value.CLIENT_ID === 'string')
+      clientIds[
+        file
+          .split('/')
+          .pop()
+          ?.replace(/\.plist$/, '') ?? file
+      ] = value.CLIENT_ID
+  }
+  const urlSchemes: string[] = []
+  for (const entry of Array.isArray(plist.CFBundleURLTypes)
+    ? plist.CFBundleURLTypes
+    : []) {
+    if (!isRecord(entry) || !Array.isArray(entry.CFBundleURLSchemes)) continue
+    for (const scheme of entry.CFBundleURLSchemes)
+      if (typeof scheme === 'string') urlSchemes.push(scheme)
+  }
+  return {
+    clientId: plist.GIDClientID,
+    serverClientId: plist.GIDServerClientID,
+    hostedDomain: plist.GIDHostedDomain,
+    openIDRealm: plist.GIDOpenIDRealm,
+    urlSchemes,
+    clientIds,
+  }
+}
+
 function plistString(plist: string, key: string): string | null {
   const match = plist.match(new RegExp(`<key>${key}</key>\\s*<string>([^<]*)</string>`))
   return match ? match[1].trim() : null
@@ -952,6 +1017,13 @@ function nativeAppIdentityFromIos(
     permissionUsageDescriptions[key] = resolved
   }
 
+  const infoPlistStrings: Record<string, string> = {}
+  for (const [key, value] of Object.entries(dictionary)) {
+    if (typeof value !== 'string') continue
+    const resolved = resolveBuildSetting(value, settings)
+    if (resolved !== null) infoPlistStrings[key] = resolved
+  }
+
   // Xcode's generated Info.plist uses these build settings only when enabled.
   // source: developer.apple.com/documentation/xcode/build-settings-reference.
   if (settings.GENERATE_INFOPLIST_FILE === 'YES') {
@@ -1025,12 +1097,29 @@ function nativeAppIdentityFromIos(
     ...(rootModuleName === undefined ? {} : { rootModuleName }),
     ...(rootViewBackgroundColor === undefined ? {} : { rootViewBackgroundColor }),
     ...(designRequiresCompatibility ? { designRequiresCompatibility } : {}),
+    ...(typeof dictionary.UIStatusBarHidden === 'boolean'
+      ? { statusBarHidden: dictionary.UIStatusBarHidden }
+      : {}),
+    ...(typeof dictionary.UIViewControllerBasedStatusBarAppearance === 'boolean'
+      ? {
+          viewControllerBasedStatusBarAppearance:
+            dictionary.UIViewControllerBasedStatusBarAppearance,
+        }
+      : {}),
     ...(dtPlatformVersion === undefined ? {} : { dtPlatformVersion }),
     bundleName,
     appVersion,
     buildVersion,
     bundleIdentifier,
     platform: 'ios',
+    googleSignIn: readGoogleSignInConfiguration(
+      dictionary,
+      Object.fromEntries(
+        [...resources]
+          .filter((file) => file.endsWith('.plist') && files[file])
+          .map((file) => [file, parseInfoPlist(files[file])]),
+      ),
+    ),
     supportedInterfaceOrientations,
     ipadSupportedInterfaceOrientations,
     ...(defaultScreenOrientationMask === undefined
@@ -1056,6 +1145,7 @@ function nativeAppIdentityFromIos(
         }
       : {}),
     permissionUsageDescriptions,
+    infoPlistStrings,
     urlQuerySchemes,
     ...(shareIntoAppGroupId === undefined ? {} : { shareIntoAppGroupId }),
     ...(rtcAppGroupIdentifier === undefined ? {} : { rtcAppGroupIdentifier }),

package/src/native-firebase-config.ts

@@ -106,6 +106,172 @@ export async function readExpoConfigAsync(
   }
 }
 
+// a launch method may guard configure() with the safe-configure idiom: an
+// `if` whose comma-separated clauses read the bundled GoogleService-Info.plist
+// and test its API_KEY prefix. every clause is evaluated against the plist the
+// target ships, so the answer is the one native launch reaches. any other
+// condition cannot be proven and stays refused.
+function evaluateFirebaseGuard(header: string, resources: string[]): boolean | null {
+  const condition = header.replace(/^\s*if\b/, '').replace(/\{\s*$/, '')
+  const clauses: string[] = []
+  let depth = 0
+  let start = 0
+  let quoted = false
+  for (let index = 0; index < condition.length; index++) {
+    const char = condition[index]
+    if (char === '"') quoted = !quoted
+    if (quoted) continue
+    if (char === '(' || char === '[') depth += 1
+    if (char === ')' || char === ']') depth -= 1
+    if (char === ',' && depth === 0) {
+      clauses.push(condition.slice(start, index).trim())
+      start = index + 1
+    }
+  }
+  clauses.push(condition.slice(start).trim())
+  const sources = resources.filter(
+    (file) => path.basename(file) === 'GoogleService-Info.plist',
+  )
+  const bound = new Map<string, unknown>()
+  for (const clause of clauses) {
+    if (/^FirebaseApp\s*\.\s*app\s*\(\s*\)\s*==\s*nil$/.test(clause)) continue
+    const resource =
+      /^let\s+(\w+)\s*=\s*Bundle\.main\.path\s*\(\s*forResource:\s*"GoogleService-Info"\s*,\s*ofType:\s*"plist"\s*\)$/.exec(
+        clause,
+      )
+    if (resource) {
+      if (sources.length !== 1) return false
+      bound.set(resource[1], sources[0])
+      continue
+    }
+    const dictionary =
+      /^let\s+(\w+)\s*=\s*NSDictionary\s*\(\s*contentsOfFile:\s*(\w+)\s*\)$/.exec(clause)
+    if (dictionary && typeof bound.get(dictionary[2]) === 'string') {
+      const parsed = parsePlistSource(
+        fs.readFileSync(String(bound.get(dictionary[2])), 'utf8'),
+      )
+      if (!isRecord(parsed)) return false
+      bound.set(dictionary[1], parsed)
+      continue
+    }
+    const entry = /^let\s+(\w+)\s*=\s*(\w+)\s*\[\s*"(\w+)"\s*\]\s+as\?\s+String$/.exec(
+      clause,
+    )
+    const dictionaryValue = entry ? bound.get(entry[2]) : undefined
+    if (entry && isRecord(dictionaryValue)) {
+      const value = dictionaryValue[entry[3]]
+      if (typeof value !== 'string') return false
+      bound.set(entry[1], value)
+      continue
+    }
+    const prefix = /^(\w+)\.hasPrefix\s*\(\s*"([^"]*)"\s*\)$/.exec(clause)
+    const subject = prefix ? bound.get(prefix[1]) : undefined
+    if (prefix && typeof subject === 'string') {
+      if (!subject.startsWith(prefix[2])) return false
+      continue
+    }
+    return null
+  }
+  return true
+}
+
+// native source with comments and string contents blanked in place, so brace
+// and keyword scans see only code and offsets still index the raw text.
+function blankSwiftObjcLiterals(raw: string) {
+  return raw.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"/g, (token) =>
+    token.startsWith('"')
+      ? `"${' '.repeat(token.length - 2)}"`
+      : token.replace(/[^\n]/g, ' '),
+  )
+}
+
+// the text of the brace block opening at `open`, and the index after its end.
+function braceBlock(source: string, open: number) {
+  let depth = 0
+  for (let index = open; index < source.length; index += 1) {
+    if (source[index] === '{') depth += 1
+    if (source[index] === '}') depth -= 1
+    if (depth === 0) return { body: source.slice(open + 1, index), end: index + 1 }
+  }
+  return null
+}
+
+// whether every path through the code configures the default Firebase app: a
+// top-level configure call, or an if/else chain ending in else whose blocks each
+// do.
+function configuresDefaultApp(code: string): boolean {
+  const configureCall = /\bFirebaseApp\s*\.\s*configure\s*\(/
+  let topLevel = ''
+  let depth = 0
+  for (const char of code) {
+    if (char === '{') depth += 1
+    if (depth === 0) topLevel += char
+    if (char === '}') depth -= 1
+  }
+  if (configureCall.test(topLevel)) return true
+  for (const chain of code.matchAll(/\bif\b[^{]*\{/g)) {
+    let open = chain.index + chain[0].length - 1
+    const blocks: string[] = []
+    let complete = false
+    for (;;) {
+      const block = braceBlock(code, open)
+      if (!block) break
+      blocks.push(block.body)
+      const next = /^\s*else\s*(if\b[^{]*)?\{/.exec(code.slice(block.end))
+      if (!next) break
+      open = block.end + next[0].length - 1
+      if (!next[1]) {
+        const last = braceBlock(code, open)
+        if (last) {
+          blocks.push(last.body)
+          complete = true
+        }
+        break
+      }
+    }
+    if (complete && blocks.every(configuresDefaultApp)) return true
+  }
+  return false
+}
+
+// where a launch method configures the default Firebase app: directly, or by
+// calling a static no-argument function of an app target type whose body
+// configures it on every path. returns a match-like result carrying the call's
+// index, or null.
+function findDefaultConfigureCall(body: string, sources: readonly string[]) {
+  const direct =
+    /^\s*(?:FirebaseApp\s*\.\s*configure\s*\(\s*\)|\[FIRApp\s+configure\])/m.exec(body)
+  if (direct) return direct
+  for (const call of body.matchAll(/^\s*([A-Z]\w*)\s*\.\s*(\w+)\s*\(\s*\)/gm)) {
+    const [, type, name] = call
+    for (const file of sources) {
+      if (!file.endsWith('.swift')) continue
+      const source = blankSwiftObjcLiterals(fs.readFileSync(file, 'utf8'))
+      const declaration = new RegExp(
+        `\\b(?:enum|struct|class)\\s+${type}\\b[^{]*\\{`,
+      ).exec(source)
+      if (!declaration) continue
+      const owner = braceBlock(source, declaration.index + declaration[0].length - 1)
+      const method = owner
+        ? new RegExp(`\\bstatic\\s+func\\s+${name}\\s*\\(\\s*\\)[^{]*\\{`).exec(
+            owner.body,
+          )
+        : null
+      const helper =
+        owner && method
+          ? braceBlock(owner.body, method.index + method[0].length - 1)
+          : null
+      if (
+        helper &&
+        !/\b(?:return|throw)\b/.test(helper.body) &&
+        configuresDefaultApp(helper.body)
+      )
+        return call
+    }
+  }
+  return null
+}
+
 // the GoogleService-Info.plist an app target's launch method configures as the
 // default app, relative to the project root, or null when it configures none.
 function readTargetGoogleServicesFile(
@@ -120,27 +286,43 @@ function readTargetGoogleServicesFile(
     /^AppDelegate\.(swift|mm|m)$/.test(path.basename(file)),
   )
   const defaultConfigured = delegates.some((file) => {
-    const source = fs
-      .readFileSync(file, 'utf8')
-      .replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"/g, (token) =>
-        token.startsWith('"') ? '""' : token.replace(/[^\n]/g, ' '),
-      )
+    const raw = fs.readFileSync(file, 'utf8')
+    const source = blankSwiftObjcLiterals(raw)
     const launch =
       /(?:\bfunc\s+application\s*\([\s\S]*?didFinishLaunchingWithOptions[\s\S]*?\)\s*->\s*Bool|^-\s*\(BOOL\)\s*application\s*:[\s\S]*?didFinishLaunchingWithOptions[^{]*)\s*\{/m.exec(
         source,
       )
     if (!launch) return false
-    const body = source.slice(launch.index + launch[0].length)
-    const configure =
-      /^\s*(?:FirebaseApp\s*\.\s*configure\s*\(\s*\)|\[FIRApp\s+configure\])/m.exec(body)
+    const bodyStart = launch.index + launch[0].length
+    const body = source.slice(bodyStart)
+    const configure = findDefaultConfigureCall(body, app.allSources)
     if (!configure) return false
-    const before = body.slice(0, configure.index)
+    let before = body.slice(0, configure.index)
     let depth = 1
-    for (const token of before) {
-      if (token === '{') depth += 1
+    let guardOpen = -1
+    for (let index = 0; index < before.length; index++) {
+      const token = before[index]
+      if (token === '{') {
+        depth += 1
+        if (depth === 2) guardOpen = index
+      }
       if (token === '}') depth -= 1
       if (depth === 0) return false
     }
+    let guard: string | null = null
+    if (depth === 2) {
+      const headers = [...before.slice(0, guardOpen).matchAll(/^[ \t]*if\b/gm)]
+      const header = headers.at(-1)
+      if (header) {
+        guard = raw.slice(bodyStart + header.index, bodyStart + guardOpen + 1)
+        before = before.slice(0, header.index)
+        depth = 1
+        for (const token of before) {
+          if (token === '{') depth += 1
+          if (token === '}') depth -= 1
+        }
+      }
+    }
     let conditionalDepth = 0
     for (const directive of before.matchAll(
       /^\s*#\s*(if|ifdef|ifndef|elseif|elif|else|endif)\b/gm,
@@ -155,11 +337,25 @@ function readTargetGoogleServicesFile(
         conditionalDepth -= 1
       }
     }
-    if (depth !== 1 || conditionalDepth !== 0 || /\b(?:return|throw)\b/.test(before))
+    // a return inside a nested closure leaves the launch method running
+    let topLevelBefore = ''
+    let nesting = 0
+    for (const token of before) {
+      if (token === '{') nesting += 1
+      if (nesting === 0) topLevelBefore += token
+      if (token === '}') nesting -= 1
+    }
+    const guarded = guard === null ? true : evaluateFirebaseGuard(guard, app.resources)
+    if (
+      guarded === null ||
+      depth !== 1 ||
+      conditionalDepth !== 0 ||
+      /\b(?:return|throw)\b/.test(topLevelBefore)
+    )
       throw new Error(
         'native Firebase initialization must be unconditional in the app launch method',
       )
-    return true
+    return guarded
   })
   if (!defaultConfigured) return null
   const resources = app.resources.filter((file) =>

package/src/process-group.ts

@@ -13,6 +13,7 @@ import { setTimeout as sleep } from 'node:timers/promises'
 
 const GRACEFUL_TIMEOUT_MS = 3_000
 const FORCED_EXIT_TIMEOUT_MS = 1_000
+const FREEZE_GUARD_NAME = 'process-freeze-guard'
 
 // keep this self-contained: the detached browser host embeds its source.
 export function listProcessChildren(parents: number[], timeoutMs = 3_000): number[] {
@@ -107,7 +108,7 @@ async function protectProcessFreeze(rootPid: number) {
     printf 'ready\n'
     if ! IFS= read -r command || [ "$command" != disarm ]; then cleanup; fi
   `,
-      'process-freeze-guard',
+      FREEZE_GUARD_NAME,
       journal,
     ],
     {
@@ -151,6 +152,28 @@ async function protectProcessFreeze(rootPid: number) {
   }
 }
 
+// a nested capture's guard is a descendant of this tree but must keep running
+// to resume its own targets, so a freeze never reaches it. ps exits 1 when
+// some pids already vanished, so only a spawn failure or timeout is an error.
+function withoutFreezeGuards(pids: number[]): number[] {
+  if (pids.length === 0) return pids
+  const result = spawnSync('ps', ['-o', 'pid=,command=', '-p', pids.join(',')], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: FORCED_EXIT_TIMEOUT_MS,
+    killSignal: 'SIGKILL',
+  })
+  if (result.error || (result.status !== 0 && result.status !== 1))
+    throw new Error(result.error?.message || `ps exited ${result.status}`)
+  const guards = new Set(
+    result.stdout
+      .split('\n')
+      .filter((line) => line.includes(FREEZE_GUARD_NAME))
+      .map((line) => Number(line.trim().split(/\s+/)[0])),
+  )
+  return pids.filter((pid) => !guards.has(pid))
+}
+
 // reparented members remain in the group; detached descendants need their
 // recorded pids. both can leave zombies, which signal zero cannot distinguish
 // from running processes. inspect their states together before confirming exit.
@@ -243,7 +266,7 @@ export async function terminateProcessGroup(
       }
       let children: number[]
       try {
-        children = listProcessChildren(parents, remaining)
+        children = withoutFreezeGuards(listProcessChildren(parents, remaining))
       } catch (error) {
         inspectionError = new Error(`could not inspect descendants: ${String(error)}`)
         break